alchemy 2.0.0-beta.73 → 2.0.0-beta.75

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "2.0.0-beta.73",
+  "version": "2.0.0-beta.75",
   "description": "Infrastructure as Effects for TypeScript.",
   "homepage": "https://alchemy.run",
   "license": "Apache-2.0",
@@ -229,6 +229,18 @@
       "worker": "./src/Fly/*.ts",
       "import": "./lib/Fly/*.js"
     },
+    "./Railway": {
+      "types": "./lib/Railway/index.d.ts",
+      "bun": "./src/Railway/index.ts",
+      "worker": "./src/Railway/index.ts",
+      "import": "./lib/Railway/index.js"
+    },
+    "./Railway/*": {
+      "types": "./lib/Railway/*.d.ts",
+      "bun": "./src/Railway/*.ts",
+      "worker": "./src/Railway/*.ts",
+      "import": "./lib/Railway/*.js"
+    },
     "./Prisma": {
       "types": "./lib/Prisma/index.d.ts",
       "bun": "./src/Prisma/index.ts",
@@ -285,12 +297,26 @@
       "worker": "./src/Runtime.ts",
       "import": "./lib/Runtime.js"
     },
+    "./Runtime/Bootstrap/*": {
+      "types": "./src/Runtime/Bootstrap/*.ts",
+      "bun": "./src/Runtime/Bootstrap/*.ts",
+      "node": "./src/Runtime/Bootstrap/*.ts",
+      "worker": "./src/Runtime/Bootstrap/*.ts",
+      "import": "./src/Runtime/Bootstrap/*.ts",
+      "default": "./src/Runtime/Bootstrap/*.ts"
+    },
     "./Process": {
       "types": "./lib/Process/index.d.ts",
       "bun": "./src/Process/index.ts",
       "worker": "./src/Process/index.ts",
       "import": "./lib/Process/index.js"
     },
+    "./Redis": {
+      "types": "./lib/Redis/index.d.ts",
+      "bun": "./src/Redis/index.ts",
+      "worker": "./src/Redis/index.ts",
+      "import": "./lib/Redis/index.js"
+    },
     "./SQL/*": {
       "types": "./lib/SQL/*.d.ts",
       "bun": "./src/SQL/*.ts",
@@ -377,11 +403,23 @@
     "access": "public"
   },
   "dependencies": {
+    "@alchemy.run/cloudflare-runtime": "2.0.0-beta.75",
+    "@alchemy.run/floci": "2.0.0-beta.75",
+    "@alchemy.run/node-utils": "2.0.0-beta.75",
     "@aws-sdk/credential-providers": "^3.0.0",
     "@clack/prompts": "^1.7.0",
-    "@effect/sql-d1": ">=4.0.0-rc.110 || >=4.0.0",
-    "@effect/sql-sqlite-do": ">=4.0.0-rc.110 || >=4.0.0",
-    "@effect/vitest": ">=4.0.0-rc.110 || >=4.0.0",
+    "@distilled.cloud/aws": "1.0.0-rc.8",
+    "@distilled.cloud/axiom": "1.0.0-rc.8",
+    "@distilled.cloud/cloudflare": "1.0.0-rc.8",
+    "@distilled.cloud/core": "1.0.0-rc.8",
+    "@distilled.cloud/fly-io": "1.0.0-rc.8",
+    "@distilled.cloud/hetzner": "1.0.0-rc.8",
+    "@distilled.cloud/neon": "1.0.0-rc.8",
+    "@distilled.cloud/planetscale": "1.0.0-rc.8",
+    "@distilled.cloud/railway": "1.0.0-rc.8",
+    "@effect/sql-d1": ">=4.0.0-rc.112 || >=4.0.0",
+    "@effect/sql-sqlite-do": ">=4.0.0-rc.112 || >=4.0.0",
+    "@effect/vitest": ">=4.0.0-rc.112 || >=4.0.0",
     "@libsql/client": "^0.17.0",
     "@octokit/rest": "^22.0.1",
     "@octokit/webhooks": "^14.2.0",
@@ -400,35 +438,31 @@
     "pathe": "^2.0.3",
     "picomatch": "^4.0.4",
     "react": "^19.2.0",
-    "rolldown": "1.1.5",
+    "rolldown": "1.2.5",
     "undici": "^7.16.0",
-    "yaml": "^2.0.0",
-    "@alchemy.run/floci": "2.0.0-beta.73",
-    "@alchemy.run/node-utils": "2.0.0-beta.73",
-    "@alchemy.run/cloudflare-runtime": "2.0.0-beta.73",
-    "@distilled.cloud/axiom": "1.0.0-rc.6",
-    "@distilled.cloud/cloudflare": "1.0.0-rc.6",
-    "@distilled.cloud/aws": "1.0.0-rc.6",
-    "@distilled.cloud/core": "1.0.0-rc.6",
-    "@distilled.cloud/hetzner": "1.0.0-rc.6",
-    "@distilled.cloud/neon": "1.0.0-rc.6",
-    "@distilled.cloud/planetscale": "1.0.0-rc.6",
-    "@distilled.cloud/fly-io": "1.0.0-rc.6"
+    "yaml": "^2.0.0"
   },
   "devDependencies": {
+    "@alchemy.run/frontend-frameworks": "2.0.0-beta.75",
     "@aws/durable-execution-sdk-js": "^2.1.0",
     "@cloudflare/containers": "^0.3.7",
     "@cloudflare/puppeteer": "^1.1.0",
+    "@cloudflare/unenv-preset": "^2.16.0",
     "@cloudflare/workers-types": "^5.20260812.1",
-    "@effect/platform-bun": ">=4.0.0-rc.110 || >=4.0.0",
-    "@effect/platform-node": ">=4.0.0-rc.110 || >=4.0.0",
-    "@effect/platform-node-shared": ">=4.0.0-rc.110 || >=4.0.0",
-    "@foldkit/vite-plugin": "^0.15.0",
+    "@effect/platform-bun": ">=4.0.0-rc.112 || >=4.0.0",
+    "@effect/platform-node": ">=4.0.0-rc.112 || >=4.0.0",
+    "@effect/platform-node-shared": ">=4.0.0-rc.112 || >=4.0.0",
+    "@foldkit/vite-plugin": "^0.16.1",
     "@octanejs/adapter-cloudflare": "0.0.12",
     "@octanejs/vite-plugin": "0.1.22",
     "@opennextjs/aws": "4.1.0",
     "@opennextjs/cloudflare": "1.20.1",
-    "@oxc-project/types": "^0.139.0",
+    "@oxc-project/types": "^0.146.0",
+    "@react-router/dev": "^7.16.0",
+    "@react-router/node": "^7.16.0",
+    "@solidjs/router": "^0.16.0",
+    "@solidjs/start": "^2.0.4",
+    "@solidjs/vite-plugin-nitro-2": "^0.3.2",
     "@sveltejs/kit": "3.0.0-next.9",
     "@sveltejs/vite-plugin-svelte": "^7.2.0",
     "@tanstack/react-router": "^1.167.4",
@@ -444,13 +478,15 @@
     "@vercel/nft": "^1.10.2",
     "@vitejs/plugin-react": "^6.0.2",
     "@vitejs/plugin-rsc": "^0.5.27",
+    "alchemy-test": "0.0.0",
     "astro": "7.2.0",
-    "effect": ">=4.0.0-rc.110 || >=4.0.0",
-    "foldkit": "^0.147.0",
+    "effect": ">=4.0.0-rc.112 || >=4.0.0",
+    "foldkit": "^0.148.2",
     "hono": "^4.12.14",
     "iovalkey": "^0.3.3",
+    "isbot": "^5.2.1",
     "mongodb": "^6.10.0",
-    "mysql2": "^3.23.2",
+    "mysql2": "^3.24.2",
     "next": "16.2.10",
     "nitropack": "2.13.4",
     "nuxt": "4.5.1",
@@ -458,39 +494,43 @@
     "pg": "^8.22.0",
     "react-devtools-core": "^7.0.1",
     "react-dom": "^19.2.7",
-    "react-router": "7.16.0",
+    "react-router": "^7.16.0",
     "react-server-dom-webpack": "~19.2.6",
-    "solid-js": "latest",
+    "solid-js": "^1.9.5",
     "svelte": "^5.56.6",
     "tsconfig-paths": "^4.2.0",
     "tsdown": "^0.15.4",
     "tsx": "^4.20.6",
     "typescript": "^7.0.2",
+    "unenv": "^2.0.0-rc.24",
     "uuid": "^14.0.0",
     "vitest": "^4.1.8",
+    "vocs": "2.8.2",
     "waku": "1.0.0-beta.7",
     "wrangler": "^4.103.0",
-    "ws": "^8.20.0",
-    "@alchemy.run/frontend-frameworks": "2.0.0-beta.73",
-    "alchemy-test": "0.0.0"
+    "ws": "^8.20.0"
   },
   "peerDependencies": {
+    "@alchemy.run/frontend-frameworks": "2.0.0-beta.75",
     "@aws/durable-execution-sdk-js": "^2.1.0",
-    "@effect/platform-bun": ">=4.0.0-rc.110 || >=4.0.0",
-    "@effect/platform-node": ">=4.0.0-rc.110 || >=4.0.0",
-    "@effect/sql-mysql2": ">=4.0.0-rc.110 || >=4.0.0",
-    "@effect/sql-pg": ">=4.0.0-rc.110 || >=4.0.0",
+    "@effect/platform-bun": ">=4.0.0-rc.112 || >=4.0.0",
+    "@effect/platform-node": ">=4.0.0-rc.112 || >=4.0.0",
+    "@effect/sql-mysql2": ">=4.0.0-rc.112 || >=4.0.0",
+    "@effect/sql-pg": ">=4.0.0-rc.112 || >=4.0.0",
     "@vercel/nft": "^1.10.2",
     "drizzle-kit": "1.0.0-rc.5-ab785fc",
     "drizzle-orm": "1.0.0-rc.5-ab785fc",
-    "effect": ">=4.0.0-rc.110 || >=4.0.0",
+    "effect": ">=4.0.0-rc.112 || >=4.0.0",
     "mongodb": "^6.10.0",
-    "mysql2": "^3.23.2",
+    "mysql2": "^3.24.2",
     "pg": "^8.22.0",
     "vite": "^8.0.7",
     "ws": "^8.20.0"
   },
   "peerDependenciesMeta": {
+    "@alchemy.run/frontend-frameworks": {
+      "optional": true
+    },
     "@aws/durable-execution-sdk-js": {
       "optional": true
     },
@@ -537,7 +577,7 @@
     "build": "rm -rf lib && tsc -b --force && tsc -b tsconfig.bin.json --force && bun bundle && bun ../../scripts/copy-package-files.ts alchemy",
     "bundle": "tsdown",
     "bundle:watch": "tsdown --watch",
-    "test": "alchemy-test",
+    "test": "alchemy-test --exclude test/Railway",
     "test:benchmark": "tsx --tsconfig tsconfig.test.json test/types.benchmark.ts",
     "nuke": "cd ../../ && bun nuke"
   }

package/src/AWS/ACM/Certificate.ts

@@ -15,6 +15,7 @@ import {
   hasAlchemyTags,
 } from "../../Tags.ts";
 import type { Providers } from "../Providers.ts";
+import { findPublicHostedZoneId } from "../Route53/HostedZoneLookup.ts";
 
 export interface CertificateProps {
   /**
@@ -33,8 +34,12 @@ export interface CertificateProps {
   /**
    * Route 53 hosted zone used to auto-create DNS validation records.
    *
-   * When provided together with `validationMethod: "DNS"`, the certificate
-   * provider will upsert the validation records and wait for issuance.
+   * With `validationMethod: "DNS"` the certificate provider upserts the
+   * validation records into this zone and waits for issuance. When
+   * omitted, the most specific PUBLIC hosted zone in the account
+   * containing `domainName` is inferred; if none matches, validation is
+   * left to the caller (external DNS) and the certificate is returned
+   * pending.
    */
   hostedZoneId?: string;
   /**
@@ -498,7 +503,11 @@ export const CertificateProvider = () =>
             ) ||
             (olds.validationMethod ?? defaultValidationMethod) !==
               (news.validationMethod ?? defaultValidationMethod) ||
-            olds.hostedZoneId !== news.hostedZoneId ||
+            // An undefined side means "inferred" — only two explicit,
+            // differing zones are a replacement.
+            (olds.hostedZoneId !== undefined &&
+              news.hostedZoneId !== undefined &&
+              olds.hostedZoneId !== news.hostedZoneId) ||
             olds.keyAlgorithm !== news.keyAlgorithm ||
             // Certificates cannot move regions — a region change replaces.
             (olds.region ?? ACM_REGION) !== (news.region ?? ACM_REGION) ||
@@ -620,18 +629,27 @@ export const CertificateProvider = () =>
           const certificateArn = certificate.CertificateArn;
           yield* session.note(certificateArn);
 
-          // Sync DNS validation. If the user wired a hostedZoneId, ensure
-          // validation records are upserted and the cert reaches `ISSUED`.
-          // For an already-issued cert this is mostly a fast-path: we only
-          // wait for validation records when the cert isn't already issued.
-          const shouldAutoValidate =
+          // Sync DNS validation: ensure validation records are upserted and
+          // the cert reaches `ISSUED`. The zone is the explicit
+          // `hostedZoneId` when given; otherwise the most specific public
+          // zone containing `domainName` is inferred. When neither yields a
+          // zone, validation is left to the caller (external DNS) and the
+          // certificate is returned pending — the pre-inference behavior.
+          // For an already-issued cert this is a fast-path: we only wait
+          // for validation records when the cert isn't already issued.
+          if (
             (news.validationMethod ?? defaultValidationMethod) === "DNS" &&
-            news.hostedZoneId !== undefined;
-
-          if (shouldAutoValidate && certificate.Status !== "ISSUED") {
-            const withRecords = yield* waitForValidationRecords(certificateArn);
-            yield* upsertValidationRecords(news.hostedZoneId!, withRecords);
-            certificate = yield* waitForIssued(certificateArn);
+            certificate.Status !== "ISSUED"
+          ) {
+            const validationZoneId =
+              news.hostedZoneId ??
+              (yield* findPublicHostedZoneId(news.domainName));
+            if (validationZoneId !== undefined) {
+              const withRecords =
+                yield* waitForValidationRecords(certificateArn);
+              yield* upsertValidationRecords(validationZoneId, withRecords);
+              certificate = yield* waitForIssued(certificateArn);
+            }
           }
 
           // Sync options — only the CT logging preference is mutable in

package/src/AWS/AppRunner/Service.ts

@@ -1,4 +1,5 @@
 import * as apprunner from "@distilled.cloud/aws/apprunner";
+import * as logs from "@distilled.cloud/aws/cloudwatch-logs";
 import * as ecr from "@distilled.cloud/aws/ecr";
 import * as iam from "@distilled.cloud/aws/iam";
 import type { Region } from "@distilled.cloud/aws/Region";
@@ -296,6 +297,22 @@ export interface ServiceProps extends PlatformProps {
    * @default AWS-owned key
    */
   kmsKeyArn?: string;
+  /**
+   * Keep the CloudWatch log groups App Runner auto-creates for the service
+   * (`/aws/apprunner/{serviceName}/{serviceId}/application` and
+   * `.../service`) when the service is deleted.
+   *
+   * By default they are deleted along with the service — App Runner itself
+   * leaves them behind, so every deploy+destroy cycle would otherwise
+   * strand a pair. Set this when the logs must outlive the service (an
+   * incident post-mortem, a compliance retention window). The kept groups
+   * are inert: their names embed the service id, so no future service ever
+   * writes to them, and nothing but a manual delete (or
+   * `alchemy unsafe nuke`) removes them.
+   *
+   * @default false
+   */
+  retainLogGroups?: boolean;
   /**
    * User-defined tags for the service.
    */
@@ -786,6 +803,96 @@ const emptyPlatformAttributes: PlatformAttributes = {
   codeHash: undefined,
 };
 
+/**
+ * The two CloudWatch log groups App Runner auto-creates for a service:
+ * `.../application` (the container's stdout/stderr) and `.../service`
+ * (App Runner's own deployment and health-check events).
+ *
+ * Both names embed the AWS-generated service id, so a pair belongs to
+ * exactly one service instance — it can never be shared with, or reused
+ * by, another service.
+ */
+const logGroupNamesFor = (serviceName: string, serviceId: string) => [
+  `/aws/apprunner/${serviceName}/${serviceId}/application`,
+  `/aws/apprunner/${serviceName}/${serviceId}/service`,
+];
+
+/**
+ * Delete one of a service's auto-created log groups, idempotently.
+ *
+ * `deleteService` does NOT remove them, so without this every
+ * deploy+destroy cycle strands a pair (matching how the Lambda and ECS
+ * providers reap `/aws/lambda/{name}` and their task log group).
+ *
+ * App Runner can flush a final batch of events after the service itself
+ * is gone, silently re-creating a just-deleted group, so the delete is
+ * followed by a bounded observe→delete convergence loop. A group that
+ * never reappears — the common case — costs a single extra describe.
+ * Reaping is auxiliary to an already-completed service deletion, so a
+ * group that survives the budget warns rather than failing the destroy.
+ */
+const reapLogGroup = Effect.fn(function* (logGroupName: string) {
+  const deleteGroup = logs.deleteLogGroup({ logGroupName }).pipe(
+    Effect.retry({
+      while: (error) =>
+        error._tag === "OperationAbortedException" ||
+        error._tag === "ServiceUnavailableException",
+      schedule: Schedule.max([
+        Schedule.exponential("250 millis"),
+        Schedule.recurs(6),
+      ]),
+    }),
+    Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+    Effect.timeoutOrElse({
+      duration: "30 seconds",
+      orElse: () =>
+        Effect.logWarning(
+          `Timed out deleting App Runner log group ${logGroupName}`,
+        ),
+    }),
+  );
+
+  // A describe that cannot complete in time is not deletion proof —
+  // assume the group is still present and let the bounded loop converge.
+  const observeGroup = logs
+    .describeLogGroups({ logGroupNamePrefix: logGroupName, limit: 1 })
+    .pipe(
+      Effect.map((response) =>
+        (response.logGroups ?? []).some(
+          (group) => group.logGroupName === logGroupName,
+        ),
+      ),
+      Effect.timeoutOrElse({
+        duration: "15 seconds",
+        orElse: () =>
+          Effect.logWarning(
+            `Timed out observing App Runner log group ${logGroupName} — assuming still present`,
+          ).pipe(Effect.as(true)),
+      }),
+    );
+
+  yield* deleteGroup;
+
+  // Re-reaps at t=0s/5s/…/30s, each attempt idempotent.
+  const stillPresent = yield* Effect.gen(function* () {
+    const present = yield* observeGroup;
+    if (present) yield* deleteGroup;
+    return present;
+  }).pipe(
+    Effect.repeat({
+      schedule: Schedule.spaced("5 seconds"),
+      until: (present) => !present,
+      times: 6,
+    }),
+  );
+
+  if (stillPresent) {
+    yield* Effect.logWarning(
+      `App Runner log group ${logGroupName} kept reappearing after delete`,
+    );
+  }
+});
+
 export const ServiceProvider = () =>
   Provider.effect(
     Service,
@@ -977,7 +1084,7 @@ export const ServiceProvider = () =>
                   []),
               ],
               resolve: {
-                conditionNames: ["bun", "import", "module", "default"],
+                conditionNames: [...Bundle.BUN_CONDITION_NAMES],
                 ...props.build?.input?.resolve,
               },
               plugins: [props.build?.input?.plugins, plugins],
@@ -999,68 +1106,10 @@ export const ServiceProvider = () =>
               realMain,
               virtualEntryPlugin(
                 (importPath) => `
-import { BunServices } from "@effect/platform-bun";
-import { BunHttpServer } from "alchemy/Http";
-import { Stack } from "alchemy/Stack";
-import * as Config from "effect/Config";
-import * as ConfigProvider from "effect/ConfigProvider";
-import * as Credentials from "@distilled.cloud/aws/Credentials";
-import * as Effect from "effect/Effect";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
-import * as Region from "@distilled.cloud/aws/Region";
-
-import { ${handler} as handler } from ${JSON.stringify(importPath)};
-
-const platform = Layer.mergeAll(
-  BunServices.layer,
-  FetchHttpClient.layer,
-  Logger.layer([Logger.consolePretty()]),
-);
-
-// Resolve the bundled program (the runners registered via host.run / serve)
-// and run it with a Bun HTTP server bound to PORT (App Runner injects PORT
-// for the configured service port), so a returned { fetch } handler is
-// actually served and host.run loops stay alive.
-const program = handler.pipe(
-  Effect.flatMap((service) => service.RuntimeContext.exports),
-  Effect.flatMap((exports) => exports.program),
-  Effect.provide(
-    Layer.effect(
-      Stack,
-      Effect.all([
-        Config.string("ALCHEMY_STACK_NAME"),
-        Config.string("ALCHEMY_STAGE")
-      ]).pipe(
-        Effect.map(([name, stage]) => ({
-          name,
-          stage,
-          bindings: {},
-          resources: {}
-        }))
-      )
-    ).pipe(
-      Layer.provideMerge(Credentials.fromEnv()),
-      Layer.provideMerge(Region.fromEnv()),
-      Layer.provideMerge(BunHttpServer()),
-      Layer.provideMerge(platform),
-      Layer.provideMerge(
-        Layer.succeed(
-          ConfigProvider.ConfigProvider,
-          ConfigProvider.fromEnv()
-        )
-      ),
-    )
-  ),
-  Effect.scoped
-);
-
-console.log("App Runner service bootstrap starting...");
-await Effect.runPromise(program).catch((err) => {
-  console.error("App Runner service bootstrap failed:", err);
-  process.exit(1);
-});
+import { bootstrap } from "alchemy/Runtime/Bootstrap/AppRunner";
+import { ${handler} as entrypoint } from ${JSON.stringify(importPath)};
+
+await bootstrap(entrypoint);
 `,
               ),
             );
@@ -1596,7 +1645,7 @@ await Effect.runPromise(program).catch((err) => {
           return toAttrs(observed, platformAttributes);
         }),
 
-        delete: Effect.fn(function* ({ output }) {
+        delete: Effect.fn(function* ({ olds, output, force }) {
           // A service mid-operation rejects deletion with
           // InvalidStateException — wait (bounded) for it to settle first.
           const observed = yield* waitForSettled(output.serviceArn);
@@ -1673,6 +1722,24 @@ await Effect.runPromise(program).catch((err) => {
                 Effect.catchTag("NoSuchEntityException", () => Effect.void),
               );
           }
+
+          // Last, because the reap can sit through App Runner's final log
+          // flush: an interruption during that window must not strand the
+          // repository or the roles, which cost money and block re-creates.
+          //
+          // `retainLogGroups` keeps them; account-wide teardown (`force`)
+          // overrides that opt-out, since nuke's contract is to leave
+          // nothing behind. Nuke also enumerates from the cloud, so `olds`
+          // carries Attributes rather than Props there and the flag reads
+          // as unset anyway.
+          if (!olds.retainLogGroups || force) {
+            for (const logGroupName of logGroupNamesFor(
+              output.serviceName,
+              output.serviceId,
+            )) {
+              yield* reapLogGroup(logGroupName);
+            }
+          }
         }),
 
         list: () =>

package/src/AWS/ApplicationAutoScaling/ScalingPolicy.ts

@@ -201,6 +201,11 @@ export const ScalingPolicyProvider = () =>
           ? Effect.succeed(props.policyName)
           : createPhysicalName({ id, maxLength: 255 });
 
+      // Narrow by the target triple only when it is complete: the API rejects
+      // a ScalableDimension without a ResourceId ("Scalable dimension cannot
+      // be provided without a resource ID"), and a row persisted by an
+      // interrupted create can carry one without the other — which would
+      // wedge `read` and therefore every destroy of the stack.
       const describe = (props: {
         serviceNamespace: aas.ServiceNamespace;
         policyName: string;
@@ -211,8 +216,13 @@ export const ScalingPolicyProvider = () =>
           .describeScalingPolicies({
             ServiceNamespace: props.serviceNamespace,
             PolicyNames: [props.policyName],
-            ResourceId: props.resourceId,
-            ScalableDimension: props.scalableDimension,
+            ...(props.resourceId !== undefined &&
+            props.scalableDimension !== undefined
+              ? {
+                  ResourceId: props.resourceId,
+                  ScalableDimension: props.scalableDimension,
+                }
+              : {}),
           })
           .pipe(
             Effect.map((res) =>
@@ -355,27 +365,42 @@ export const ScalingPolicyProvider = () =>
         // Deleting the parent scalable target implicitly deletes its
         // policies, so a policy that is already gone (typed
         // `ObjectNotFoundException`) is success.
-        delete: Effect.fn(function* ({ output }) {
-          yield* aas
-            .deleteScalingPolicy({
-              PolicyName: output.policyName,
-              ServiceNamespace: output.serviceNamespace,
-              ResourceId: output.resourceId,
-              ScalableDimension: output.scalableDimension,
-            })
-            .pipe(
-              Effect.catchTag("ObjectNotFoundException", () => Effect.void),
-            );
+        delete: Effect.fn(function* ({ olds, output }) {
+          // Observe before deleting: resolve the live policy by name (a row
+          // persisted by an interrupted create can lack the target triple)
+          // and delete with ITS triple; a policy that no longer exists is
+          // already gone.
+          const policy = yield* describe({
+            serviceNamespace: output.serviceNamespace,
+            policyName: output.policyName,
+            resourceId: output.resourceId ?? olds?.resourceId,
+            scalableDimension:
+              output.scalableDimension ?? olds?.scalableDimension,
+          });
+          if (policy?.ResourceId && policy.ScalableDimension) {
+            yield* aas
+              .deleteScalingPolicy({
+                PolicyName: output.policyName,
+                ServiceNamespace: output.serviceNamespace,
+                ResourceId: policy.ResourceId,
+                ScalableDimension: policy.ScalableDimension,
+              })
+              .pipe(
+                Effect.catchTag("ObjectNotFoundException", () => Effect.void),
+              );
+          }
           // Reap the managed CloudWatch alarms of a target tracking policy.
           // Application Auto Scaling deletes them asynchronously (and not at
           // all when the policy went away via target deregistration), so an
           // explicit delete keeps teardown deterministic. DeleteAlarms
           // ignores names that no longer exist.
-          if (output.alarms.length > 0) {
+          const alarms = [
+            ...(output.alarms ?? []).map((alarm) => alarm.alarmName),
+            ...(policy?.Alarms ?? []).map((alarm) => alarm.AlarmName),
+          ].filter((name, i, all) => all.indexOf(name) === i);
+          if (alarms.length > 0) {
             yield* cloudwatch
-              .deleteAlarms({
-                AlarmNames: output.alarms.map((alarm) => alarm.alarmName),
-              })
+              .deleteAlarms({ AlarmNames: alarms })
               .pipe(Effect.catchTag("ResourceNotFound", () => Effect.void));
           }
         }),

package/src/AWS/AuthProvider.ts

@@ -182,8 +182,14 @@ export const AwsAuth = AuthProviderLayer<
             // very service still being constructed by this STS call.
             Region.of(region),
             // A custom endpoint (local emulator) must apply to this STS call
-            // too — the default resolver would call real AWS.
-            endpoint ? Endpoint.of(endpoint) : Layer.empty,
+            // too — the default resolver would call real AWS. When there is
+            // no custom endpoint we must still provide `Endpoint.none`
+            // rather than leaving it unset: falling through to the ambient
+            // `Endpoint.fromEnvironment` reads it off AWSEnvironment — the
+            // very service this STS call is constructing — and deadlocks
+            // the fiber on its own in-flight cache (no I/O, no timer, no
+            // output). Same reason as `Region.of` above.
+            endpoint ? Endpoint.of(endpoint) : Endpoint.none,
           ),
         ),
         Effect.flatMap((self) =>