alchemy 2.0.0-beta.55 → 2.0.0-beta.56

package/src/AWS/Organizations/TrustedServiceAccess.ts

@@ -48,6 +48,47 @@ export const TrustedServiceAccessProvider = () =>
             output?.servicePrincipal ?? olds!.servicePrincipal,
           );
         }),
+        list: () =>
+          Effect.gen(function* () {
+            // Enumerate every service principal granted trusted access to the
+            // organization. The list response already carries the full `read`
+            // shape (servicePrincipal + dateEnabled), so each enabled principal
+            // maps directly to one Attributes — no per-item hydration needed.
+            const principals = yield* retryOrganizations(
+              collectPages(
+                (NextToken) =>
+                  organizations.listAWSServiceAccessForOrganization({
+                    NextToken,
+                  }),
+                (page) => page.EnabledServicePrincipals,
+              ),
+            );
+
+            return principals
+              .filter(
+                (
+                  candidate,
+                ): candidate is organizations.EnabledServicePrincipal & {
+                  ServicePrincipal: string;
+                } => candidate.ServicePrincipal != null,
+              )
+              .map(
+                (candidate) =>
+                  ({
+                    servicePrincipal: candidate.ServicePrincipal,
+                    dateEnabled: candidate.DateEnabled,
+                  }) satisfies TrustedServiceAccess["Attributes"],
+              );
+          }).pipe(
+            // Not an org management account (or lacking access) — there's no
+            // organization to enumerate, so degrade to an empty list.
+            Effect.catchTags({
+              AWSOrganizationsNotInUseException: () =>
+                Effect.succeed([] as TrustedServiceAccess["Attributes"][]),
+              AccessDeniedException: () =>
+                Effect.succeed([] as TrustedServiceAccess["Attributes"][]),
+            }),
+          ),
         reconcile: Effect.fn(function* ({ news, session }) {
           // Observe — fetch live trusted-access state. We never trust prior
           // `output` blindly; if access was disabled out-of-band we re-enable.

package/src/AWS/Organizations/common.ts

@@ -67,7 +67,7 @@ export const createManagedTags = Effect.fn(function* (
 ) {
   return {
     ...(yield* createInternalTags(id)),
-    ...(tags ?? {}),
+    ...tags,
   };
 });
 

package/src/AWS/RDS/DBCluster.ts

@@ -3,6 +3,7 @@ import * as secretsmanager from "@distilled.cloud/aws/secrets-manager";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
@@ -236,6 +237,26 @@ export const DBClusterProvider = () =>
 
       return {
         stables: ["dbClusterArn", "dbClusterIdentifier"],
+        // AWS account/region collection (pattern a): exhaustively paginate
+        // `describeDBClusters` and map each cluster to the exact `read`
+        // Attributes shape. Tags come inline on `DBCluster.TagList`, so no
+        // per-item `listTagsForResource` hydration is needed (matching `read`).
+        list: () =>
+          Effect.gen(function* () {
+            return yield* rds.describeDBClusters.pages({}).pipe(
+              Stream.runCollect,
+              Effect.map((chunk) =>
+                Array.from(chunk).flatMap((page) =>
+                  (page.DBClusters ?? []).map((cluster) =>
+                    toAttrs({
+                      cluster,
+                      tags: toTagRecord(cluster.TagList),
+                    }),
+                  ),
+                ),
+              ),
+            );
+          }),
         diff: Effect.fn(function* ({ id, olds, news }) {
           if (!isResolved(news)) return;
           if (

package/src/AWS/RDS/DBClusterEndpoint.ts

@@ -1,5 +1,6 @@
 import * as rds from "@distilled.cloud/aws/rds";
 import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
@@ -103,6 +104,23 @@ export const DBClusterEndpointProvider = () =>
 
       return {
         stables: ["dbClusterEndpointArn", "dbClusterEndpointIdentifier"],
+        // Enumerate every custom cluster endpoint in the account/region.
+        // `describeDBClusterEndpoints` with no filter returns custom endpoints
+        // across all clusters; system endpoints (EndpointType WRITER/READER)
+        // aren't managed via createDBClusterEndpoint, so we keep only CUSTOM
+        // ones. Tags aren't returned by describe, so each item carries `{}`
+        // (matching `read`'s default when there is no recorded tag set).
+        list: () =>
+          rds.describeDBClusterEndpoints.pages({}).pipe(
+            Stream.runCollect,
+            Effect.map((chunk) =>
+              Array.from(chunk).flatMap((page) =>
+                (page.DBClusterEndpoints ?? [])
+                  .filter((endpoint) => endpoint.EndpointType === "CUSTOM")
+                  .map((endpoint) => toAttrs({ endpoint, tags: {} })),
+              ),
+            ),
+          ),
         diff: Effect.fn(function* ({ id, olds, news }) {
           if (!isResolved(news)) return;
           if (

package/src/AWS/RDS/DBClusterParameterGroup.ts

@@ -1,5 +1,6 @@
 import * as rds from "@distilled.cloud/aws/rds";
 import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
@@ -71,6 +72,37 @@ export const DBClusterParameterGroupProvider = () =>
 
       return {
         stables: ["dbClusterParameterGroupArn", "dbClusterParameterGroupName"],
+        list: () =>
+          // AWS account/region collection (pattern (a)): exhaustively paginate
+          // describeDBClusterParameterGroups and map each group to the exact
+          // `read` Attributes shape. `read` derives `tags` from the cached
+          // output (the describe response does not surface tags), so list
+          // returns `tags: {}` to match — a future read/delete can hydrate
+          // them via listTagsForResource. Per-item not-found
+          // (DBParameterGroupNotFoundFault) cannot occur here: enumeration
+          // passes no name, so the describe never targets a single group.
+          rds.describeDBClusterParameterGroups.pages({}).pipe(
+            Stream.runCollect,
+            Effect.map((chunk) =>
+              Array.from(chunk).flatMap((page) =>
+                (page.DBClusterParameterGroups ?? [])
+                  .filter(
+                    (
+                      g,
+                    ): g is rds.DBClusterParameterGroup & {
+                      DBClusterParameterGroupName: string;
+                    } => g.DBClusterParameterGroupName != null,
+                  )
+                  .map((g) => ({
+                    dbClusterParameterGroupName: g.DBClusterParameterGroupName,
+                    dbClusterParameterGroupArn: g.DBClusterParameterGroupArn,
+                    family: g.DBParameterGroupFamily ?? "",
+                    description: g.Description,
+                    tags: {} as Record<string, string>,
+                  })),
+              ),
+            ),
+          ),
         diff: Effect.fn(function* ({ id, olds, news }) {
           if (!isResolved(news)) return;
           if (

package/src/AWS/RDS/DBInstance.ts

@@ -1,6 +1,7 @@
 import * as rds from "@distilled.cloud/aws/rds";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
@@ -166,6 +167,37 @@ export const DBInstanceProvider = () =>
 
       return {
         stables: ["dbInstanceArn", "dbInstanceIdentifier"],
+        // Pattern (a) AWS account/region collection: `describeDBInstances` is
+        // paginated (items: "DBInstances") and returns each instance's
+        // `TagList` inline, so we hydrate directly into the same shape `read`
+        // produces — no per-item tag fetch needed. An empty/no-instances
+        // account simply yields no pages. `DBInstanceNotFoundFault` is in the
+        // op's typed error union; treat a stray one as "nothing to list".
+        list: () =>
+          rds.describeDBInstances.pages({}).pipe(
+            Stream.runCollect,
+            Effect.map((chunk) =>
+              Array.from(chunk).flatMap((page) =>
+                (page.DBInstances ?? [])
+                  .filter(
+                    (
+                      instance,
+                    ): instance is typeof instance & {
+                      DBInstanceArn: string;
+                    } => instance.DBInstanceArn != null,
+                  )
+                  .map((instance) =>
+                    toAttrs({
+                      instance,
+                      tags: toTagRecord(instance.TagList),
+                    }),
+                  ),
+              ),
+            ),
+            Effect.catchTag("DBInstanceNotFoundFault", () =>
+              Effect.succeed([] as DBInstance["Attributes"][]),
+            ),
+          ),
         diff: Effect.fn(function* ({ id, olds, news }) {
           if (!isResolved(news)) return undefined;
           if (

package/src/AWS/RDS/DBParameterGroup.ts

@@ -1,5 +1,6 @@
 import * as rds from "@distilled.cloud/aws/rds";
 import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
@@ -86,6 +87,34 @@ export const DBParameterGroupProvider = () =>
             return { action: "replace" } as const;
           }
         }),
+        list: () =>
+          // AWS account/region collection (pattern (a)): exhaustively paginate
+          // describeDBParameterGroups and map each group to the exact `read`
+          // Attributes shape. `read` derives `tags` from the cached output
+          // (the describe response does not surface tags), so list returns
+          // `tags: {}` to match — a future read/delete can hydrate them.
+          rds.describeDBParameterGroups.pages({}).pipe(
+            Stream.runCollect,
+            Effect.map((chunk) =>
+              Array.from(chunk).flatMap((page) =>
+                (page.DBParameterGroups ?? [])
+                  .filter(
+                    (
+                      g,
+                    ): g is rds.DBParameterGroup & {
+                      DBParameterGroupName: string;
+                    } => g.DBParameterGroupName != null,
+                  )
+                  .map((g) => ({
+                    dbParameterGroupName: g.DBParameterGroupName,
+                    dbParameterGroupArn: g.DBParameterGroupArn,
+                    family: g.DBParameterGroupFamily ?? "",
+                    description: g.Description,
+                    tags: {} as Record<string, string>,
+                  })),
+              ),
+            ),
+          ),
         read: Effect.fn(function* ({ id, olds, output }) {
           const name =
             output?.dbParameterGroupName ??

package/src/AWS/RDS/DBProxy.ts

@@ -1,6 +1,7 @@
 import * as rds from "@distilled.cloud/aws/rds";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
@@ -146,6 +147,49 @@ export const DBProxyProvider = () =>
 
       return {
         stables: ["dbProxyArn", "dbProxyName"],
+        // Enumerate every DB proxy in the account/region via the paginated
+        // `describeDBProxies`, then hydrate each proxy's tags via
+        // `listTagsForResource` (describe does not return tags inline) so each
+        // element matches `read`'s `Attributes` shape exactly. A proxy deleted
+        // between the describe and the tag fetch surfaces `DBProxyNotFoundFault`
+        // per item and is dropped.
+        list: () =>
+          Effect.gen(function* () {
+            const proxies = yield* rds.describeDBProxies.pages({}).pipe(
+              Stream.runCollect,
+              Effect.map((chunk) =>
+                Array.from(chunk).flatMap((page) => page.DBProxies ?? []),
+              ),
+            );
+            const rows = yield* Effect.forEach(
+              proxies,
+              (proxy) =>
+                Effect.gen(function* () {
+                  if (!proxy.DBProxyArn) return undefined;
+                  const tagResponse = yield* rds
+                    .listTagsForResource({ ResourceName: proxy.DBProxyArn })
+                    .pipe(
+                      Effect.catchTag("DBProxyNotFoundFault", () =>
+                        Effect.succeed(undefined),
+                      ),
+                    );
+                  if (tagResponse === undefined) return undefined;
+                  const tags = Object.fromEntries(
+                    (tagResponse.TagList ?? [])
+                      .filter(
+                        (tag): tag is rds.Tag & { Key: string } =>
+                          tag.Key != null,
+                      )
+                      .map((tag) => [tag.Key, tag.Value ?? ""] as const),
+                  );
+                  return toAttrs({ proxy, tags });
+                }),
+              { concurrency: 10 },
+            );
+            return rows.filter(
+              (row): row is DBProxy["Attributes"] => row !== undefined,
+            );
+          }),
         diff: Effect.fn(function* ({ id, olds, news }) {
           if (!isResolved(news)) return undefined;
           if (

package/src/AWS/RDS/DBProxyEndpoint.ts

@@ -1,6 +1,7 @@
 import * as rds from "@distilled.cloud/aws/rds";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
@@ -136,6 +137,48 @@ export const DBProxyEndpointProvider = () =>
 
       return {
         stables: ["dbProxyEndpointArn", "dbProxyEndpointName"],
+        list: () =>
+          Effect.gen(function* () {
+            // Endpoints are keyed under a parent proxy. Enumerate every proxy,
+            // then fan out `describeDBProxyEndpoints` per proxy (bounded
+            // concurrency) and flatten. `describe` does not surface tags
+            // inline, so each item hydrates with `tags: {}` — the same shape
+            // `read` returns when no prior tags are recorded.
+            const proxyNames = yield* rds.describeDBProxies.pages({}).pipe(
+              Stream.runCollect,
+              Effect.map((chunk) =>
+                Array.from(chunk).flatMap((page) =>
+                  (page.DBProxies ?? [])
+                    .map((proxy) => proxy.DBProxyName)
+                    .filter((name): name is string => name != null),
+                ),
+              ),
+            );
+            const rows = yield* Effect.forEach(
+              proxyNames,
+              (dbProxyName) =>
+                rds.describeDBProxyEndpoints
+                  .pages({ DBProxyName: dbProxyName })
+                  .pipe(
+                    Stream.runCollect,
+                    Effect.map((chunk) =>
+                      Array.from(chunk).flatMap((page) =>
+                        (page.DBProxyEndpoints ?? []).map((endpoint) =>
+                          toAttrs({ endpoint, tags: {} }),
+                        ),
+                      ),
+                    ),
+                    // A proxy (or its endpoints) may be deleted mid-enumeration.
+                    Effect.catchTag(
+                      ["DBProxyNotFoundFault", "DBProxyEndpointNotFoundFault"],
+                      () =>
+                        Effect.succeed([] as DBProxyEndpoint["Attributes"][]),
+                    ),
+                  ),
+              { concurrency: 10 },
+            );
+            return rows.flat();
+          }),
         diff: Effect.fn(function* ({ id, olds, news }) {
           if (!isResolved(news)) return undefined;
           if (

package/src/AWS/RDS/DBProxyTargetGroup.ts

@@ -1,5 +1,6 @@
 import * as rds from "@distilled.cloud/aws/rds";
 import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
@@ -138,6 +139,70 @@ export const DBProxyTargetGroupProvider = () =>
 
       return {
         stables: ["dbProxyName", "targetGroupArn", "targetGroupName"],
+        // Target groups are proxy-scoped: `describeDBProxyTargetGroups`
+        // requires a `DBProxyName`, so there is no account-wide enumeration.
+        // Fan out — enumerate every proxy via the paginated `describeDBProxies`,
+        // then list each proxy's target groups and hydrate registered targets
+        // (cluster/instance identifiers) via `describeDBProxyTargets` so each
+        // element matches `read`'s `Attributes` shape exactly. A proxy/target
+        // group deleted between describes surfaces a typed not-found per item
+        // and is dropped.
+        list: () =>
+          Effect.gen(function* () {
+            const proxies = yield* rds.describeDBProxies.pages({}).pipe(
+              Stream.runCollect,
+              Effect.map((chunk) =>
+                Array.from(chunk).flatMap((page) => page.DBProxies ?? []),
+              ),
+            );
+            const perProxy = yield* Effect.forEach(
+              proxies,
+              (proxy) =>
+                Effect.gen(function* () {
+                  const dbProxyName = proxy.DBProxyName;
+                  if (!dbProxyName) return [];
+                  const groups = yield* rds.describeDBProxyTargetGroups
+                    .pages({ DBProxyName: dbProxyName })
+                    .pipe(
+                      Stream.runCollect,
+                      Effect.map((chunk) =>
+                        Array.from(chunk).flatMap(
+                          (page) => page.TargetGroups ?? [],
+                        ),
+                      ),
+                      Effect.catchTag("DBProxyNotFoundFault", () =>
+                        Effect.succeed([] as rds.DBProxyTargetGroup[]),
+                      ),
+                      Effect.catchTag("DBProxyTargetGroupNotFoundFault", () =>
+                        Effect.succeed([] as rds.DBProxyTargetGroup[]),
+                      ),
+                    );
+                  return yield* Effect.forEach(
+                    groups,
+                    (group) =>
+                      Effect.gen(function* () {
+                        const targetGroupName =
+                          group.TargetGroupName ?? "default";
+                        const { observedClusters, observedInstances } =
+                          yield* readTargets({ dbProxyName, targetGroupName });
+                        return {
+                          dbProxyName: group.DBProxyName ?? dbProxyName,
+                          targetGroupName,
+                          targetGroupArn: group.TargetGroupArn,
+                          status: group.Status,
+                          isDefault: group.IsDefault,
+                          connectionPoolConfig: group.ConnectionPoolConfig,
+                          dbClusterIdentifiers: observedClusters,
+                          dbInstanceIdentifiers: observedInstances,
+                        } satisfies DBProxyTargetGroup["Attributes"];
+                      }),
+                    { concurrency: 10 },
+                  );
+                }),
+              { concurrency: 10 },
+            );
+            return perProxy.flat();
+          }),
         diff: Effect.fn(function* ({ olds, news }) {
           if (!isResolved(news)) return undefined;
           if (olds?.dbProxyName !== news.dbProxyName) {

package/src/AWS/RDS/DBSubnetGroup.ts

@@ -1,5 +1,6 @@
 import * as rds from "@distilled.cloud/aws/rds";
 import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
@@ -195,6 +196,39 @@ export const DBSubnetGroupProvider = () =>
             tags: desiredTags,
           };
         }),
+        list: () =>
+          // AWS account/region collection: `describeDBSubnetGroups` is
+          // paginated (items field `DBSubnetGroups`). Collect every page and
+          // map each group into the exact `read` Attributes shape. `read` does
+          // not hydrate tags from the cloud (it returns the cached
+          // `output.tags`), so we mirror that here with an empty tag map rather
+          // than issuing a per-item `listTagsForResource` call.
+          rds.describeDBSubnetGroups.pages({}).pipe(
+            Stream.runCollect,
+            Effect.map((chunk) =>
+              Array.from(chunk).flatMap((page) =>
+                (page.DBSubnetGroups ?? []).flatMap((group) =>
+                  group.DBSubnetGroupName
+                    ? [
+                        {
+                          dbSubnetGroupName: group.DBSubnetGroupName,
+                          dbSubnetGroupArn: group.DBSubnetGroupArn,
+                          vpcId: group.VpcId,
+                          subnetIds: (group.Subnets ?? []).flatMap((subnet) =>
+                            subnet.SubnetIdentifier
+                              ? [subnet.SubnetIdentifier]
+                              : [],
+                          ),
+                          status: group.SubnetGroupStatus,
+                          supportedNetworkTypes: group.SupportedNetworkTypes,
+                          tags: {} as Record<string, string>,
+                        },
+                      ]
+                    : [],
+                ),
+              ),
+            ),
+          ),
         delete: Effect.fn(function* ({ output }) {
           yield* rds
             .deleteDBSubnetGroup({

package/src/AWS/Route53/Record.ts

@@ -1,6 +1,7 @@
 import * as route53 from "@distilled.cloud/aws/route-53";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import type { Input } from "../../Input.ts";
 import * as Provider from "../../Provider.ts";
@@ -246,8 +247,62 @@ export const RecordProvider = () =>
         yield* waitForChange(response.ChangeInfo.Id);
       });
 
+      // `listResourceRecordSets` is not paginated by distilled, so manually
+      // walk the `IsTruncated` / `NextRecord*` cursor to collect every record
+      // set in a hosted zone.
+      const listAllRecordSets = Effect.fn(function* (hostedZoneId: string) {
+        const all: route53.ResourceRecordSet[] = [];
+        let request: route53.ListResourceRecordSetsRequest = {
+          HostedZoneId: normalizeHostedZoneId(hostedZoneId),
+          MaxItems: 300,
+        };
+        while (true) {
+          const response = yield* route53.listResourceRecordSets(request);
+          all.push(...response.ResourceRecordSets);
+          if (!response.IsTruncated || response.NextRecordName === undefined) {
+            break;
+          }
+          request = {
+            HostedZoneId: normalizeHostedZoneId(hostedZoneId),
+            StartRecordName: response.NextRecordName,
+            StartRecordType: response.NextRecordType,
+            StartRecordIdentifier: response.NextRecordIdentifier,
+            MaxItems: 300,
+          };
+        }
+        return all;
+      });
+
       return {
         stables: ["hostedZoneId", "name", "type", "setIdentifier"],
+        list: () =>
+          Effect.gen(function* () {
+            // Records are hosted-zone-scoped: enumerate every hosted zone
+            // (paginated), then fan out one `listResourceRecordSets` walk per
+            // zone with bounded concurrency.
+            const zones = yield* route53.listHostedZones.pages({}).pipe(
+              Stream.runCollect,
+              Effect.map((chunk) =>
+                Array.from(chunk).flatMap((page) => page.HostedZones ?? []),
+              ),
+            );
+
+            const rows = yield* Effect.forEach(
+              zones,
+              (zone) =>
+                listAllRecordSets(zone.Id).pipe(
+                  Effect.map((recordSets) =>
+                    recordSets.map((recordSet) => toAttrs(recordSet, zone.Id)),
+                  ),
+                  // A zone may be deleted concurrently with enumeration; treat
+                  // a vanished zone as contributing no records.
+                  Effect.catchTag("NoSuchHostedZone", () => Effect.succeed([])),
+                ),
+              { concurrency: 10 },
+            );
+
+            return rows.flat();
+          }),
         diff: Effect.fn(function* ({ olds, news }) {
           if (!isResolved(news)) return undefined;
           if (

package/src/AWS/S3/Bucket.ts

@@ -5,6 +5,7 @@ import * as Arr from "effect/Array";
 import * as Effect from "effect/Effect";
 import * as Order from "effect/Order";
 import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
 import type { HttpClient } from "effect/unstable/http";
 import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
 import { isResolved } from "../../Diff.ts";
@@ -553,6 +554,30 @@ export const BucketProvider = () =>
         // the bucket exists in our account, so a successful response is itself
         // proof of account-level ownership — there is no separate ownership
         // signal to surface as `Unowned`.
+        list: () =>
+          Effect.gen(function* () {
+            const { accountId, region } = yield* AWSEnvironment.current;
+            return yield* s3.listBuckets.pages({}).pipe(
+              Stream.runCollect,
+              Effect.map((chunk) =>
+                Array.from(chunk).flatMap((page) =>
+                  (page.Buckets ?? [])
+                    .filter(
+                      (b): b is s3.Bucket & { Name: string } => b.Name != null,
+                    )
+                    .map((b) => ({
+                      bucketName: b.Name,
+                      bucketArn: `arn:aws:s3:::${b.Name}` as const,
+                      bucketDomainName: `${b.Name}.s3.amazonaws.com` as const,
+                      bucketRegionalDomainName:
+                        `${b.Name}.s3.${region}.amazonaws.com` as const,
+                      region,
+                      accountId,
+                    })),
+                ),
+              ),
+            );
+          }),
         read: Effect.fn(function* ({ id, olds, output }) {
           const bucketName =
             output?.bucketName ?? (yield* createBucketName(id, olds ?? {}));

package/src/AWS/SNS/Subscription.ts

@@ -1,5 +1,6 @@
 import * as sns from "@distilled.cloud/aws/sns";
 import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import type { Input } from "../../Input.ts";
 import * as Provider from "../../Provider.ts";
@@ -78,6 +79,45 @@ export const SubscriptionProvider = () =>
       });
     }),
     stables: ["subscriptionArn"],
+    // Account/region-scoped collection: paginate `listSubscriptions`
+    // exhaustively, then hydrate each concrete-ARN subscription via
+    // `getSubscriptionAttributes` (inside `readSubscription`) so each element
+    // matches the exact `read` Attributes shape. Pending-confirmation entries
+    // have no real ARN to hydrate or delete against, so they are skipped.
+    list: Effect.fn(function* () {
+      const subscriptions = yield* sns.listSubscriptions.pages({}).pipe(
+        Stream.runCollect,
+        Effect.map((chunk) =>
+          Array.from(chunk).flatMap((page) => page.Subscriptions ?? []),
+        ),
+      );
+
+      const concrete = subscriptions.filter(
+        (
+          subscription,
+        ): subscription is sns.Subscription & {
+          SubscriptionArn: string;
+        } =>
+          typeof subscription.SubscriptionArn === "string" &&
+          !isPendingConfirmation(subscription.SubscriptionArn),
+      );
+
+      const rows = yield* Effect.forEach(
+        concrete,
+        (subscription) =>
+          readSubscription({
+            subscriptionArn: subscription.SubscriptionArn,
+            topicArn: subscription.TopicArn,
+            protocol: subscription.Protocol,
+            endpoint: subscription.Endpoint,
+          }),
+        { concurrency: 10 },
+      );
+
+      return rows.filter(
+        (row): row is NonNullable<typeof row> => row !== undefined,
+      );
+    }),
     diff: Effect.fn(function* ({ news, olds }) {
       if (!isResolved(news)) return undefined;
       if (news.protocol !== olds.protocol) {