alchemy 2.0.0-beta.73 → 2.0.0-beta.75

package/src/AWS/Providers.ts

@@ -22,9 +22,18 @@ import * as Command from "../Command/index.ts";
 import { DockerLive } from "../Docker/Docker.ts";
 import { KeyPair, KeyPairProvider } from "../KeyPair.ts";
 import * as ProviderLayer from "../Local/ProviderLayer.ts";
-import { flociDual } from "./Local/FlociServices.ts";
+import { defaultProviderMode } from "../ProviderMode.ts";
+import {
+  captureAwsEnvironment,
+  pinCollectionEnvironment,
+} from "./Local/ProviderContext.ts";
+import { flociDual, flociServices } from "./Local/FlociServices.ts";
 import * as Provider from "../Provider.ts";
 import { Random, RandomProvider } from "../Random.ts";
+import {
+  Server as WebsiteServer,
+  ServerProvider as WebsiteServerProvider,
+} from "../Website/Server.ts";
 import * as AccessAnalyzer from "./AccessAnalyzer/index.ts";
 import * as Account from "./Account/index.ts";
 import * as ACM from "./ACM/index.ts";
@@ -233,722 +242,734 @@ export class Providers extends Provider.ProviderCollection<Providers>()(
 export const providers = () =>
   Layer.effect(
     Providers,
-    Provider.collection([
-      KeyPair,
-      Random,
-      AccessAnalyzer.Analyzer,
-      AccessAnalyzer.ArchiveRule,
-      Account.AccountName,
-      Account.AlternateContact,
-      Account.ContactInformation,
-      Account.Region,
-      ACM.AccountConfiguration,
-      ACM.Certificate,
-      ACMPCA.CertificateAuthority,
-      ACMPCA.CertificateAuthorityPolicy,
-      ACMPCA.Permission,
-      AIOps.InvestigationGroup,
-      AMP.AlertManagerDefinition,
-      AMP.AnomalyDetector,
-      AMP.LoggingConfiguration,
-      AMP.QueryLoggingConfiguration,
-      AMP.ResourcePolicy,
-      AMP.RuleGroupsNamespace,
-      AMP.Scraper,
-      AMP.ScraperLoggingConfiguration,
-      AMP.Workspace,
-      Amplify.App,
-      Amplify.Branch,
-      ApiGateway.Account,
-      ApiGateway.ApiKey,
-      ApiGateway.Authorizer,
-      ApiGateway.BasePathMapping,
-      ApiGateway.DeploymentResource,
-      ApiGateway.DomainName,
-      ApiGateway.GatewayResponse,
-      ApiGateway.MethodResource,
-      ApiGateway.GatewayResource,
-      ApiGateway.RestApi,
-      ApiGateway.StageResource,
-      ApiGateway.UsagePlan,
-      ApiGateway.UsagePlanKey,
-      ApiGateway.VpcLink,
-      ApiGatewayV2.Api,
-      ApiGatewayV2.ApiMappingResource,
-      ApiGatewayV2.AuthorizerResource,
-      ApiGatewayV2.DomainName,
-      ApiGatewayV2.IntegrationResource,
-      ApiGatewayV2.RouteResource,
-      ApiGatewayV2.StageResource,
-      ApiGatewayV2.VpcLink,
-      AppConfig.Application,
-      AppConfig.ConfigurationProfile,
-      AppConfig.Deployment,
-      AppConfig.DeploymentStrategy,
-      AppConfig.Environment,
-      AppConfig.Extension,
-      AppConfig.ExtensionAssociation,
-      AppConfig.HostedConfigurationVersion,
-      AppFlow.ConnectorProfile,
-      AppFlow.Flow,
-      AppIntegrations.Application,
-      AppIntegrations.DataIntegration,
-      AppIntegrations.EventIntegration,
-      ApplicationAutoScaling.ScalableTarget,
-      ApplicationAutoScaling.ScalingPolicy,
-      ApplicationAutoScaling.ScheduledAction,
-      ApplicationSignals.Discovery,
-      ApplicationSignals.GroupingConfiguration,
-      ApplicationSignals.InstrumentationConfiguration,
-      ApplicationSignals.ServiceLevelObjective,
-      AppRegistry.Application,
-      AppRegistry.AttributeGroup,
-      AppRegistry.AttributeGroupAssociation,
-      AppRegistry.ResourceAssociation,
-      AppRunner.AutoScalingConfiguration,
-      AppRunner.ObservabilityConfiguration,
-      AppRunner.Service,
-      AppRunner.VpcConnector,
-      AppSync.ApiAssociationResource,
-      AppSync.ApiKeyResource,
-      AppSync.DataSourceResource,
-      AppSync.DomainName,
-      AppSync.FunctionResource,
-      AppSync.GraphqlApi,
-      AppSync.ResolverResource,
-      Athena.DataCatalog,
-      Athena.NamedQuery,
-      Athena.PreparedStatement,
-      Athena.WorkGroup,
-      AuditManager.Assessment,
-      AuditManager.Control,
-      AuditManager.Framework,
-      AutoScaling.AutoScalingGroup,
-      AutoScaling.LaunchTemplate,
-      AutoScaling.LifecycleHook,
-      AutoScaling.ScalingPolicy,
-      AutoScaling.ScheduledAction,
-      B2BI.Capability,
-      B2BI.Partnership,
-      B2BI.Profile,
-      B2BI.Transformer,
-      Backup.BackupPlan,
-      Backup.BackupSelection,
-      Backup.BackupVault,
-      BackupSearch.ExportJob,
-      BackupSearch.SearchJob,
-      Batch.ComputeEnvironment,
-      Batch.JobDefinition,
-      Batch.JobQueue,
-      BCMDataExports.Export,
-      Bedrock.Agent,
-      Bedrock.AgentAlias,
-      Bedrock.DataSource,
-      Bedrock.KnowledgeBase,
-      BedrockAgentCore.BrowserCustom,
-      BedrockAgentCore.CodeInterpreter,
-      BedrockAgentCore.Gateway,
-      BedrockAgentCore.Memory,
-      BedrockAgentCore.Runtime,
-      BedrockDataAutomation.Blueprint,
-      BedrockDataAutomation.DataAutomationLibrary,
-      BedrockDataAutomation.DataAutomationProject,
-      Budgets.Budget,
-      Budgets.BudgetAction,
-      Chatbot.Association,
-      Chatbot.CustomAction,
-      Chatbot.MicrosoftTeamsChannelConfiguration,
-      Chatbot.SlackChannelConfiguration,
-      CloudControl.Resource,
-      CloudFormation.Stack,
-      CloudFront.CachePolicy,
-      CloudFront.Distribution,
-      CloudFront.Function,
-      CloudFront.Invalidation,
-      CloudFront.KeyGroup,
-      CloudFront.KeyValueStore,
-      CloudFront.KvEntries,
-      CloudFront.KvRoutesUpdate,
-      CloudFront.OriginAccessControl,
-      CloudFront.OriginRequestPolicy,
-      CloudFront.PublicKey,
-      CloudFront.RealtimeLogConfig,
-      CloudFront.ResponseHeadersPolicy,
-      CloudFront.VpcOrigin,
-      CloudHSMV2.Cluster,
-      CloudHSMV2.Hsm,
-      CloudMap.HttpNamespace,
-      CloudMap.InstanceRegistration,
-      CloudMap.PrivateDnsNamespace,
-      CloudMap.PublicDnsNamespace,
-      CloudMap.Service,
-      CloudTrail.EventDataStore,
-      CloudTrail.Trail,
-      CloudWatch.Alarm,
-      CloudWatch.AlarmMuteRule,
-      CloudWatch.AnomalyDetector,
-      CloudWatch.CompositeAlarm,
-      CloudWatch.Dashboard,
-      CloudWatch.InsightRule,
-      CloudWatch.MetricStream,
-      CodeArtifact.Domain,
-      CodeArtifact.Repository,
-      CodeBuild.Project,
-      CodeBuild.ReportGroup,
-      CodeConnections.Connection,
-      CodeConnections.Host,
-      CodeConnections.RepositoryLink,
-      CodeConnections.SyncConfiguration,
-      CodeDeploy.Application,
-      CodeDeploy.DeploymentConfig,
-      CodeDeploy.DeploymentGroup,
-      CodePipeline.Pipeline,
-      Cognito.Group,
-      Cognito.IdentityPool,
-      Cognito.IdentityPoolRoleAttachment,
-      Cognito.IdentityProvider,
-      Cognito.ResourceServer,
-      Cognito.User,
-      Cognito.UserPool,
-      Cognito.UserPoolClient,
-      Cognito.UserPoolDomain,
-      Config.AggregationAuthorization,
-      Config.ConfigRule,
-      Config.ConfigurationRecorder,
-      Config.DeliveryChannel,
-      Config.RetentionConfiguration,
-      ControlTower.EnabledBaseline,
-      ControlTower.EnabledControl,
-      ControlTower.LandingZone,
-      CostAndUsageReport.ReportDefinition,
-      CostExplorer.AnomalyMonitor,
-      CostExplorer.AnomalySubscription,
-      CostExplorer.CostCategory,
-      DataBrew.Dataset,
-      DataBrew.Job,
-      DataBrew.Project,
-      DataBrew.Recipe,
-      DataBrew.Ruleset,
-      DataBrew.Schedule,
-      DataExchange.DataSet,
-      DataExchange.EventAction,
-      DataExchange.Revision,
-      DataSync.LocationEfs,
-      DataSync.LocationS3,
-      DataSync.Task,
-      DataZone.Domain,
-      DataZone.Environment,
-      DataZone.EnvironmentBlueprintConfiguration,
-      DataZone.Project,
-      DAX.Cluster,
-      DAX.ParameterGroup,
-      DAX.SubnetGroup,
-      Deadline.Budget,
-      Deadline.Farm,
-      Deadline.Fleet,
-      Deadline.Monitor,
-      Deadline.Queue,
-      Deadline.StorageProfile,
-      DirectoryService.ConditionalForwarder,
-      DirectoryService.Directory,
-      DirectoryService.EventTopic,
-      DLM.LifecyclePolicy,
-      DocDB.DBCluster,
-      DocDB.DBInstance,
-      DocDB.DBSubnetGroup,
-      DocDBElastic.Cluster,
-      DMS.Endpoint,
-      DMS.ReplicationInstance,
-      DMS.ReplicationSubnetGroup,
-      DSQL.Cluster,
-      DSQL.ClusterPolicy,
-      DSQL.Stream,
-      Detective.Graph,
-      DevOpsGuru.EventSourcesConfig,
-      DevOpsGuru.NotificationChannel,
-      DevOpsGuru.ResourceCollection,
-      DevOpsGuru.ServiceIntegration,
-      DynamoDB.Table,
-      EC2.DhcpOptions,
-      EC2.EgressOnlyInternetGateway,
-      EC2.EIP,
-      EC2.FlowLog,
-      EC2.Instance,
-      EC2.InternetGateway,
-      EC2.KeyPair,
-      EC2.NatGateway,
-      EC2.NetworkAcl,
-      EC2.NetworkAclAssociation,
-      EC2.NetworkAclEntry,
-      EC2.NetworkInterface,
-      EC2.NetworkInterfaceAttachment,
-      EC2.PrefixList,
-      EC2.Route,
-      EC2.RouteTable,
-      EC2.RouteTableAssociation,
-      EC2.SecurityGroup,
-      EC2.SecurityGroupRule,
-      EC2.Snapshot,
-      EC2.Subnet,
-      EC2.Volume,
-      EC2.VolumeAttachment,
-      EC2.Vpc,
-      EC2.VpcEndpoint,
-      EC2.VpcPeeringConnection,
-      ECR.Image,
-      ECR.RegistryPolicy,
-      ECR.Repository,
-      ECRPublic.PublicRepository,
-      ECS.CapacityProvider,
-      ECS.Cluster,
-      ECS.Service,
-      ECS.Task,
-      ECS.TaskDefinition,
-      EFS.AccessPoint,
-      EFS.FileSystem,
-      EFS.MountTarget,
-      EKS.AccessEntry,
-      EKS.Addon,
-      EKS.Cluster,
-      EKS.FargateProfile,
-      EKS.Nodegroup,
-      EKS.PodIdentityAssociation,
-      ElastiCache.ServerlessCache,
-      ELBv2.Listener,
-      ELBv2.ListenerCertificate,
-      ELBv2.ListenerRule,
-      ELBv2.LoadBalancer,
-      ELBv2.TargetGroup,
-      ELBv2.TargetGroupAttachment,
-      ELBv2.TrustStore,
-      EMR.Cluster,
-      EMR.SecurityConfiguration,
-      EMR.Studio,
-      EMRContainers.JobTemplate,
-      EMRContainers.VirtualCluster,
-      EMRServerless.Application,
-      EntityResolution.IdMappingWorkflow,
-      EntityResolution.IdNamespace,
-      EntityResolution.MatchingWorkflow,
-      EntityResolution.SchemaMapping,
-      EventBridge.ApiDestination,
-      EventBridge.Archive,
-      EventBridge.Connection,
-      EventBridge.EventBus,
-      EventBridge.Permission,
-      EventBridge.Rule,
-      FIS.ExperimentTemplate,
-      FIS.TargetAccountConfiguration,
-      FMS.AdminAccount,
-      FinSpace.Environment,
-      FinSpace.KxCluster,
-      FinSpace.KxDatabase,
-      FinSpace.KxEnvironment,
-      Firehose.DeliveryStream,
-      FSx.FileSystem,
-      Forecast.Dataset,
-      Forecast.DatasetGroup,
-      FraudDetector.Detector,
-      FraudDetector.DetectorVersion,
-      FraudDetector.EntityType,
-      FraudDetector.EventType,
-      FraudDetector.Label,
-      FraudDetector.List,
-      FraudDetector.Outcome,
-      FraudDetector.Variable,
-      Glacier.Vault,
-      GlobalAccelerator.Accelerator,
-      GlobalAccelerator.EndpointGroup,
-      GlobalAccelerator.Listener,
-      Glue.Connection,
-      Glue.Crawler,
-      Glue.Database,
-      Glue.Job,
-      Glue.Table,
-      Grafana.Workspace,
-      GreengrassV2.ComponentVersion,
-      GreengrassV2.Deployment,
-      GuardDuty.Detector,
-      GuardDuty.Filter,
-      GuardDuty.IPSet,
-      GuardDuty.ThreatIntelSet,
-      HealthLake.FHIRDatastore,
-      IAM.AccessKey,
-      IAM.AccountAlias,
-      IAM.AccountPasswordPolicy,
-      IAM.Group,
-      IAM.GroupMembership,
-      IAM.InstanceProfile,
-      IAM.LoginProfile,
-      IAM.OpenIDConnectProvider,
-      IAM.Policy,
-      IAM.Role,
-      IAM.SAMLProvider,
-      IAM.ServerCertificate,
-      IAM.ServiceLinkedRole,
-      IAM.ServiceSpecificCredential,
-      IAM.SigningCertificate,
-      IAM.SSHPublicKey,
-      IAM.User,
-      IAM.VirtualMFADevice,
-      IdentityCenter.AccountAssignment,
-      IdentityCenter.Group,
-      IdentityCenter.Instance,
-      ImageBuilder.Component,
-      ImageBuilder.DistributionConfiguration,
-      ImageBuilder.ImagePipeline,
-      ImageBuilder.ImageRecipe,
-      ImageBuilder.InfrastructureConfiguration,
-      Inspector2.CisScanConfiguration,
-      Inspector2.Enabler,
-      Inspector2.Filter,
-      InternetMonitor.Monitor,
-      IdentityCenter.PermissionSet,
-      IoT.Policy,
-      IoT.Thing,
-      IoT.ThingType,
-      IoT.TopicRule,
-      IoTFleetWise.Campaign,
-      IoTFleetWise.DecoderManifest,
-      IoTFleetWise.Fleet,
-      IoTFleetWise.ModelManifest,
-      IoTFleetWise.SignalCatalog,
-      IoTFleetWise.StateTemplate,
-      IoTFleetWise.Vehicle,
-      IoTManagedIntegrations.CredentialLocker,
-      IoTManagedIntegrations.Destination,
-      IoTManagedIntegrations.ManagedThing,
-      IoTManagedIntegrations.NotificationConfiguration,
-      IoTSiteWise.Asset,
-      IoTSiteWise.AssetModel,
-      IoTSiteWise.Gateway,
-      IoTWireless.Destination,
-      IoTWireless.DeviceProfile,
-      IoTWireless.ServiceProfile,
-      IoTWireless.WirelessDevice,
-      IoTWireless.WirelessGateway,
-      IVS.Channel,
-      IVS.PlaybackKeyPair,
-      IVS.PlaybackRestrictionPolicy,
-      IVS.RecordingConfiguration,
-      IVS.StreamKey,
-      IVSChat.LoggingConfiguration,
-      IVSChat.Room,
-      IVSRealtime.Stage,
-      Kafka.ServerlessCluster,
-      Kendra.DataSource,
-      Kendra.Index,
-      Keyspaces.Keyspace,
-      Keyspaces.Table,
-      Keyspaces.Type,
-      KMS.Alias,
-      KMS.Key,
-      Kinesis.Stream,
-      Kinesis.StreamConsumer,
-      KinesisAnalyticsV2.Application,
-      KinesisAnalyticsV2.ApplicationCloudWatchLoggingOption,
-      KinesisAnalyticsV2.ApplicationSnapshot,
-      KinesisVideo.SignalingChannel,
-      KinesisVideo.Stream,
-      LakeFormation.DataCellsFilter,
-      LakeFormation.DataLakeSettings,
-      LakeFormation.LFTag,
-      LakeFormation.LFTagAssociation,
-      LakeFormation.LFTagExpression,
-      LakeFormation.OptIn,
-      LakeFormation.Permissions,
-      LakeFormation.Resource,
-      Lambda.Alias,
-      Lambda.EventSourceMapping,
-      Lambda.Function,
-      Lambda.LayerVersion,
-      Lambda.Version,
-      Lambda.MicrovmImage,
-      Lambda.NetworkConnector,
-      Lambda.Permission,
-      LexV2.Bot,
-      LexV2.BotAlias,
-      LexV2.BotLocale,
-      LexV2.BotVersion,
-      LexV2.Intent,
-      LexV2.SlotType,
-      LicenseManager.LicenseConfiguration,
-      Location.ApiKey,
-      Location.GeofenceCollection,
-      Location.Map,
-      Location.PlaceIndex,
-      Location.RouteCalculator,
-      Location.Tracker,
-      Location.TrackerConsumer,
-      Logs.Destination,
-      Logs.LogGroup,
-      Logs.LogStream,
-      Logs.MetricFilter,
-      Logs.ResourcePolicy,
-      Logs.SubscriptionFilter,
-      MediaConnect.Flow,
-      MediaConvert.Job,
-      MediaConvert.JobTemplate,
-      MediaConvert.Preset,
-      MediaConvert.Queue,
-      MediaLive.Channel,
-      MediaLive.Input,
-      MediaLive.InputSecurityGroup,
-      MediaPackageV2.Channel,
-      MediaPackageV2.ChannelGroup,
-      MediaPackageV2.OriginEndpoint,
-      MediaTailor.PlaybackConfiguration,
-      MedicalImaging.Datastore,
-      MQ.Broker,
-      MQ.Configuration,
-      MWAA.Environment,
-      MWAAServerless.Workflow,
-      Macie2.Session,
-      Macie2.ClassificationJob,
-      Macie2.AllowList,
-      Macie2.CustomDataIdentifier,
-      Macie2.FindingsFilter,
-      MailManager.AddonInstance,
-      MailManager.AddonSubscription,
-      MailManager.AddressList,
-      MailManager.Archive,
-      MailManager.IngressPoint,
-      MailManager.Relay,
-      MailManager.RuleSet,
-      MailManager.TrafficPolicy,
-      MemoryDB.ACL,
-      MemoryDB.Cluster,
-      MemoryDB.ParameterGroup,
-      MemoryDB.SubnetGroup,
-      MemoryDB.User,
-      Neptune.DBCluster,
-      Neptune.DBClusterParameterGroup,
-      Neptune.DBInstance,
-      Neptune.DBParameterGroup,
-      Neptune.DBSubnetGroup,
-      NeptuneGraph.Graph,
-      NetworkFirewall.Firewall,
-      NetworkFirewall.FirewallPolicy,
-      NetworkFirewall.LoggingConfiguration,
-      NetworkFirewall.RuleGroup,
-      Notifications.ChannelAssociation,
-      Notifications.EventRule,
-      Notifications.NotificationConfiguration,
-      Notifications.NotificationHub,
-      NotificationsContacts.EmailContact,
-      OAM.Link,
-      OAM.Sink,
-      ObservabilityAdmin.TelemetryConfig,
-      ObservabilityAdmin.TelemetryRule,
-      Omics.AnnotationStore,
-      Omics.ReferenceStore,
-      Omics.RunGroup,
-      Omics.SequenceStore,
-      Omics.VariantStore,
-      Omics.Workflow,
-      OpenSearch.Domain,
-      OSIS.Pipeline,
-      OSIS.PipelineEndpoint,
-      OSIS.ResourcePolicy,
-      OpenSearchServerless.AccessPolicy,
-      OpenSearchServerless.Collection,
-      OpenSearchServerless.CollectionGroup,
-      OpenSearchServerless.LifecyclePolicy,
-      OpenSearchServerless.SecurityConfig,
-      OpenSearchServerless.SecurityPolicy,
-      OpenSearchServerless.VpcEndpoint,
-      Organizations.Account,
-      Organizations.DelegatedAdministrator,
-      Organizations.Organization,
-      Organizations.OrganizationalUnit,
-      Organizations.OrganizationResourcePolicy,
-      Organizations.Policy,
-      Organizations.PolicyAttachment,
-      Organizations.Root,
-      Organizations.RootPolicyType,
-      Organizations.TrustedServiceAccess,
-      PaymentCryptography.Alias,
-      PaymentCryptography.Key,
-      Personalize.Dataset,
-      Personalize.DatasetGroup,
-      Personalize.EventTracker,
-      Personalize.Schema,
-      PinpointSMSVoiceV2.ConfigurationSet,
-      PinpointSMSVoiceV2.EventDestination,
-      PinpointSMSVoiceV2.OptOutList,
-      PinpointSMSVoiceV2.PhoneNumber,
-      Pipes.Pipe,
-      Polly.Lexicon,
-      QApps.QApp,
-      QBusiness.Application,
-      QBusiness.DataSource,
-      QBusiness.Index,
-      QBusiness.Retriever,
-      QBusiness.WebExperience,
-      QuickSight.Analysis,
-      QuickSight.Dashboard,
-      QuickSight.DataSet,
-      QuickSight.DataSource,
-      RAM.Permission,
-      RAM.ResourceShare,
-      RDS.DBCluster,
-      RDS.DBClusterEndpoint,
-      RDS.DBClusterParameterGroup,
-      RDS.DBInstance,
-      RDS.DBParameterGroup,
-      RDS.DBProxy,
-      RDS.DBProxyEndpoint,
-      RDS.DBProxyTargetGroup,
-      RDS.DBSubnetGroup,
-      Rbin.Rule,
-      RePostSpace.Space,
-      Redshift.Cluster,
-      Redshift.ClusterParameterGroup,
-      Redshift.ClusterSubnetGroup,
-      Redshift.EventSubscription,
-      RedshiftServerless.Namespace,
-      RedshiftServerless.Workgroup,
-      ResourceExplorer.Index,
-      ResourceExplorer.View,
-      ResourceGroups.Group,
-      RolesAnywhere.Crl,
-      RolesAnywhere.Profile,
-      RolesAnywhere.TrustAnchor,
-      Route53.HealthCheck,
-      Route53.HostedZone,
-      Route53.QueryLoggingConfig,
-      Route53.Record,
-      Route53.Records,
-      Route53.VpcAssociationAuthorization,
-      Route53.ZoneVpcAssociation,
-      Route53Profiles.Profile,
-      Route53Profiles.ProfileAssociation,
-      Route53Profiles.ProfileResourceAssociation,
-      Route53Resolver.ResolverEndpoint,
-      Route53Resolver.ResolverRule,
-      Route53Resolver.ResolverRuleAssociation,
-      RUM.AppMonitor,
-      RUM.MetricsDestination,
-      RUM.ResourcePolicy,
-      S3.Bucket,
-      S3Control.AccessPoint,
-      S3Control.AccessPointPolicy,
-      S3Control.MultiRegionAccessPoint,
-      S3Control.ObjectLambdaAccessPoint,
-      S3Control.StorageLensConfiguration,
-      S3Files.AccessPoint,
-      S3Files.FileSystem,
-      S3Tables.TableBucket,
-      S3Tables.Namespace,
-      S3Tables.Table,
-      S3Vectors.VectorBucket,
-      S3Vectors.Index,
-      SageMaker.Model,
-      SageMaker.EndpointConfig,
-      SageMaker.Endpoint,
-      SageMaker.FeatureGroup,
-      SageMaker.Cluster,
-      SageMaker.ClusterSchedulerConfig,
-      SageMaker.ComputeQuota,
-      Scheduler.Schedule,
-      Scheduler.ScheduleGroup,
-      Schemas.Discoverer,
-      Schemas.Registry,
-      Schemas.Schema,
-      SecurityHub.ActionTarget,
-      SecurityHub.AutomationRule,
-      SecurityHub.FindingAggregator,
-      SecurityHub.Hub,
-      SecurityHub.Insight,
-      SecurityLake.AwsLogSource,
-      SecurityLake.CustomLogSource,
-      SecurityLake.DataLake,
-      SecurityLake.ExceptionSubscription,
-      SecurityLake.Subscriber,
-      SecurityLake.SubscriberNotification,
-      SecretsManager.RotationSchedule,
-      SecretsManager.Secret,
-      ServiceCatalog.Portfolio,
-      ServiceCatalog.PortfolioProductAssociation,
-      ServiceCatalog.PrincipalPortfolioAssociation,
-      ServiceCatalog.Product,
-      ServiceQuotas.ServiceQuotaIncreaseRequest,
-      SES.AccountSettings,
-      SES.ActiveReceiptRuleSet,
-      SES.ConfigurationSet,
-      SES.ConfigurationSetEventDestination,
-      SES.Contact,
-      SES.ContactList,
-      SES.CustomVerificationEmailTemplate,
-      SES.DedicatedIpPool,
-      SES.EmailIdentity,
-      SES.EmailIdentityPolicy,
-      SES.EmailTemplate,
-      SES.MultiRegionEndpoint,
-      SES.ReceiptFilter,
-      SES.ReceiptRule,
-      SES.ReceiptRuleSet,
-      SES.Tenant,
-      SES.TenantResourceAssociation,
-      Shield.Protection,
-      Shield.ProtectionGroup,
-      Shield.Subscription,
-      Signer.ProfilePermission,
-      Signer.SigningProfile,
-      SimpleDB.Domain,
-      SNS.PlatformApplication,
-      SNS.Subscription,
-      SNS.Topic,
-      SocialMessaging.LinkedWhatsAppBusinessAccount,
-      SQS.Queue,
-      SSM.Parameter,
-      SSMContacts.Contact,
-      SSMContacts.ContactChannel,
-      SSMContacts.Plan,
-      SSMContacts.Rotation,
-      SSMIncidents.ReplicationSet,
-      SSMIncidents.ResponsePlan,
-      StepFunctions.Activity,
-      StepFunctions.StateMachine,
-      Synthetics.Canary,
-      Synthetics.Group,
-      Textract.Adapter,
-      Timestream.Database,
-      Timestream.DbInstance,
-      Timestream.ScheduledQuery,
-      Timestream.Table,
-      Transfer.Server,
-      Transfer.User,
-      Translate.ParallelData,
-      Translate.Terminology,
-      VerifiedPermissions.IdentitySource,
-      VerifiedPermissions.Policy,
-      VerifiedPermissions.PolicyStore,
-      VerifiedPermissions.PolicyStoreAlias,
-      VerifiedPermissions.PolicyTemplate,
-      VerifiedPermissions.Schema,
-      VpcLattice.AccessLogSubscription,
-      VpcLattice.AuthPolicy,
-      VpcLattice.Listener,
-      VpcLattice.ResourcePolicy,
-      VpcLattice.Rule,
-      VpcLattice.ServiceNetworkServiceAssociation,
-      VpcLattice.TargetGroup,
-      VpcLattice.Service,
-      VpcLattice.ServiceNetwork,
-      VpcLattice.ServiceNetworkVpcAssociation,
-      WAFv2.IPSet,
-      WAFv2.LoggingConfiguration,
-      WAFv2.RegexPatternSet,
-      WAFv2.RuleGroup,
-      WAFv2.WebACL,
-      WAFv2.WebACLAssociation,
-      Website.AssetDeployment,
-      Website.Server,
-      XRay.Group,
-      XRay.ResourcePolicy,
-      XRay.SamplingRule,
-    ]),
+    // Providers are PINNED to the environment they are registered with (the
+    // live chain provided at the bottom of this pipe) — see
+    // `pinCollectionEnvironment`. The ambient environment the STACK program
+    // sees flips to the emulator in a dev run (bottom of this file), and the
+    // pin is what keeps live-mode and mode-agnostic providers on the real
+    // cloud regardless.
+    Effect.flatMap(
+      Provider.collection([
+        KeyPair,
+        Random,
+        AccessAnalyzer.Analyzer,
+        AccessAnalyzer.ArchiveRule,
+        Account.AccountName,
+        Account.AlternateContact,
+        Account.ContactInformation,
+        Account.Region,
+        ACM.AccountConfiguration,
+        ACM.Certificate,
+        ACMPCA.CertificateAuthority,
+        ACMPCA.CertificateAuthorityPolicy,
+        ACMPCA.Permission,
+        AIOps.InvestigationGroup,
+        AMP.AlertManagerDefinition,
+        AMP.AnomalyDetector,
+        AMP.LoggingConfiguration,
+        AMP.QueryLoggingConfiguration,
+        AMP.ResourcePolicy,
+        AMP.RuleGroupsNamespace,
+        AMP.Scraper,
+        AMP.ScraperLoggingConfiguration,
+        AMP.Workspace,
+        Amplify.App,
+        Amplify.Branch,
+        ApiGateway.Account,
+        ApiGateway.ApiKey,
+        ApiGateway.Authorizer,
+        ApiGateway.BasePathMapping,
+        ApiGateway.DeploymentResource,
+        ApiGateway.DomainName,
+        ApiGateway.GatewayResponse,
+        ApiGateway.MethodResource,
+        ApiGateway.GatewayResource,
+        ApiGateway.RestApi,
+        ApiGateway.StageResource,
+        ApiGateway.UsagePlan,
+        ApiGateway.UsagePlanKey,
+        ApiGateway.VpcLink,
+        ApiGatewayV2.Api,
+        ApiGatewayV2.ApiMappingResource,
+        ApiGatewayV2.AuthorizerResource,
+        ApiGatewayV2.DomainName,
+        ApiGatewayV2.IntegrationResource,
+        ApiGatewayV2.RouteResource,
+        ApiGatewayV2.StageResource,
+        ApiGatewayV2.VpcLink,
+        AppConfig.Application,
+        AppConfig.ConfigurationProfile,
+        AppConfig.Deployment,
+        AppConfig.DeploymentStrategy,
+        AppConfig.Environment,
+        AppConfig.Extension,
+        AppConfig.ExtensionAssociation,
+        AppConfig.HostedConfigurationVersion,
+        AppFlow.ConnectorProfile,
+        AppFlow.Flow,
+        AppIntegrations.Application,
+        AppIntegrations.DataIntegration,
+        AppIntegrations.EventIntegration,
+        ApplicationAutoScaling.ScalableTarget,
+        ApplicationAutoScaling.ScalingPolicy,
+        ApplicationAutoScaling.ScheduledAction,
+        ApplicationSignals.Discovery,
+        ApplicationSignals.GroupingConfiguration,
+        ApplicationSignals.InstrumentationConfiguration,
+        ApplicationSignals.ServiceLevelObjective,
+        AppRegistry.Application,
+        AppRegistry.AttributeGroup,
+        AppRegistry.AttributeGroupAssociation,
+        AppRegistry.ResourceAssociation,
+        AppRunner.AutoScalingConfiguration,
+        AppRunner.ObservabilityConfiguration,
+        AppRunner.Service,
+        AppRunner.VpcConnector,
+        AppSync.ApiAssociationResource,
+        AppSync.ApiKeyResource,
+        AppSync.DataSourceResource,
+        AppSync.DomainName,
+        AppSync.FunctionResource,
+        AppSync.GraphqlApi,
+        AppSync.ResolverResource,
+        Athena.DataCatalog,
+        Athena.NamedQuery,
+        Athena.PreparedStatement,
+        Athena.WorkGroup,
+        AuditManager.Assessment,
+        AuditManager.Control,
+        AuditManager.Framework,
+        AutoScaling.AutoScalingGroup,
+        AutoScaling.LaunchTemplate,
+        AutoScaling.LifecycleHook,
+        AutoScaling.ScalingPolicy,
+        AutoScaling.ScheduledAction,
+        B2BI.Capability,
+        B2BI.Partnership,
+        B2BI.Profile,
+        B2BI.Transformer,
+        Backup.BackupPlan,
+        Backup.BackupSelection,
+        Backup.BackupVault,
+        BackupSearch.ExportJob,
+        BackupSearch.SearchJob,
+        Batch.ComputeEnvironment,
+        Batch.JobDefinition,
+        Batch.JobQueue,
+        BCMDataExports.Export,
+        Bedrock.Agent,
+        Bedrock.AgentAlias,
+        Bedrock.DataSource,
+        Bedrock.KnowledgeBase,
+        BedrockAgentCore.BrowserCustom,
+        BedrockAgentCore.CodeInterpreter,
+        BedrockAgentCore.Gateway,
+        BedrockAgentCore.Memory,
+        BedrockAgentCore.Runtime,
+        BedrockDataAutomation.Blueprint,
+        BedrockDataAutomation.DataAutomationLibrary,
+        BedrockDataAutomation.DataAutomationProject,
+        Budgets.Budget,
+        Budgets.BudgetAction,
+        Chatbot.Association,
+        Chatbot.CustomAction,
+        Chatbot.MicrosoftTeamsChannelConfiguration,
+        Chatbot.SlackChannelConfiguration,
+        CloudControl.Resource,
+        CloudFormation.Stack,
+        CloudFront.CachePolicy,
+        CloudFront.Distribution,
+        CloudFront.Function,
+        CloudFront.Invalidation,
+        CloudFront.KeyGroup,
+        CloudFront.KeyValueStore,
+        CloudFront.KvEntries,
+        CloudFront.KvRoutesUpdate,
+        CloudFront.OriginAccessControl,
+        CloudFront.OriginRequestPolicy,
+        CloudFront.PublicKey,
+        CloudFront.RealtimeLogConfig,
+        CloudFront.ResponseHeadersPolicy,
+        CloudFront.VpcOrigin,
+        CloudHSMV2.Cluster,
+        CloudHSMV2.Hsm,
+        CloudMap.HttpNamespace,
+        CloudMap.InstanceRegistration,
+        CloudMap.PrivateDnsNamespace,
+        CloudMap.PublicDnsNamespace,
+        CloudMap.Service,
+        CloudTrail.EventDataStore,
+        CloudTrail.Trail,
+        CloudWatch.Alarm,
+        CloudWatch.AlarmMuteRule,
+        CloudWatch.AnomalyDetector,
+        CloudWatch.CompositeAlarm,
+        CloudWatch.Dashboard,
+        CloudWatch.InsightRule,
+        CloudWatch.MetricStream,
+        CodeArtifact.Domain,
+        CodeArtifact.Repository,
+        CodeBuild.Project,
+        CodeBuild.ReportGroup,
+        CodeConnections.Connection,
+        CodeConnections.Host,
+        CodeConnections.RepositoryLink,
+        CodeConnections.SyncConfiguration,
+        CodeDeploy.Application,
+        CodeDeploy.DeploymentConfig,
+        CodeDeploy.DeploymentGroup,
+        CodePipeline.Pipeline,
+        Cognito.Group,
+        Cognito.IdentityPool,
+        Cognito.IdentityPoolRoleAttachment,
+        Cognito.IdentityProvider,
+        Cognito.ResourceServer,
+        Cognito.User,
+        Cognito.UserPool,
+        Cognito.UserPoolClient,
+        Cognito.UserPoolDomain,
+        Config.AggregationAuthorization,
+        Config.ConfigRule,
+        Config.ConfigurationRecorder,
+        Config.DeliveryChannel,
+        Config.RetentionConfiguration,
+        ControlTower.EnabledBaseline,
+        ControlTower.EnabledControl,
+        ControlTower.LandingZone,
+        CostAndUsageReport.ReportDefinition,
+        CostExplorer.AnomalyMonitor,
+        CostExplorer.AnomalySubscription,
+        CostExplorer.CostCategory,
+        DataBrew.Dataset,
+        DataBrew.Job,
+        DataBrew.Project,
+        DataBrew.Recipe,
+        DataBrew.Ruleset,
+        DataBrew.Schedule,
+        DataExchange.DataSet,
+        DataExchange.EventAction,
+        DataExchange.Revision,
+        DataSync.LocationEfs,
+        DataSync.LocationS3,
+        DataSync.Task,
+        DataZone.Domain,
+        DataZone.Environment,
+        DataZone.EnvironmentBlueprintConfiguration,
+        DataZone.Project,
+        DAX.Cluster,
+        DAX.ParameterGroup,
+        DAX.SubnetGroup,
+        Deadline.Budget,
+        Deadline.Farm,
+        Deadline.Fleet,
+        Deadline.Monitor,
+        Deadline.Queue,
+        Deadline.StorageProfile,
+        DirectoryService.ConditionalForwarder,
+        DirectoryService.Directory,
+        DirectoryService.EventTopic,
+        DLM.LifecyclePolicy,
+        DocDB.DBCluster,
+        DocDB.DBInstance,
+        DocDB.DBSubnetGroup,
+        DocDBElastic.Cluster,
+        DMS.Endpoint,
+        DMS.ReplicationInstance,
+        DMS.ReplicationSubnetGroup,
+        DSQL.Cluster,
+        DSQL.ClusterPolicy,
+        DSQL.Stream,
+        Detective.Graph,
+        DevOpsGuru.EventSourcesConfig,
+        DevOpsGuru.NotificationChannel,
+        DevOpsGuru.ResourceCollection,
+        DevOpsGuru.ServiceIntegration,
+        DynamoDB.Table,
+        EC2.DhcpOptions,
+        EC2.EgressOnlyInternetGateway,
+        EC2.EIP,
+        EC2.FlowLog,
+        EC2.Instance,
+        EC2.InternetGateway,
+        EC2.KeyPair,
+        EC2.NatGateway,
+        EC2.NetworkAcl,
+        EC2.NetworkAclAssociation,
+        EC2.NetworkAclEntry,
+        EC2.NetworkInterface,
+        EC2.NetworkInterfaceAttachment,
+        EC2.PrefixList,
+        EC2.Route,
+        EC2.RouteTable,
+        EC2.RouteTableAssociation,
+        EC2.SecurityGroup,
+        EC2.SecurityGroupRule,
+        EC2.Snapshot,
+        EC2.Subnet,
+        EC2.Volume,
+        EC2.VolumeAttachment,
+        EC2.Vpc,
+        EC2.VpcEndpoint,
+        EC2.VpcPeeringConnection,
+        ECR.Image,
+        ECR.RegistryPolicy,
+        ECR.Repository,
+        ECRPublic.PublicRepository,
+        ECS.CapacityProvider,
+        ECS.Cluster,
+        ECS.Service,
+        ECS.Task,
+        ECS.TaskDefinition,
+        EFS.AccessPoint,
+        EFS.FileSystem,
+        EFS.MountTarget,
+        EKS.AccessEntry,
+        EKS.Addon,
+        EKS.Cluster,
+        EKS.FargateProfile,
+        EKS.Nodegroup,
+        EKS.PodIdentityAssociation,
+        ElastiCache.ServerlessCache,
+        ELBv2.Listener,
+        ELBv2.ListenerCertificate,
+        ELBv2.ListenerRule,
+        ELBv2.LoadBalancer,
+        ELBv2.TargetGroup,
+        ELBv2.TargetGroupAttachment,
+        ELBv2.TrustStore,
+        EMR.Cluster,
+        EMR.SecurityConfiguration,
+        EMR.Studio,
+        EMRContainers.JobTemplate,
+        EMRContainers.VirtualCluster,
+        EMRServerless.Application,
+        EntityResolution.IdMappingWorkflow,
+        EntityResolution.IdNamespace,
+        EntityResolution.MatchingWorkflow,
+        EntityResolution.SchemaMapping,
+        EventBridge.ApiDestination,
+        EventBridge.Archive,
+        EventBridge.Connection,
+        EventBridge.EventBus,
+        EventBridge.Permission,
+        EventBridge.Rule,
+        FIS.ExperimentTemplate,
+        FIS.TargetAccountConfiguration,
+        FMS.AdminAccount,
+        FinSpace.Environment,
+        FinSpace.KxCluster,
+        FinSpace.KxDatabase,
+        FinSpace.KxEnvironment,
+        Firehose.DeliveryStream,
+        FSx.FileSystem,
+        Forecast.Dataset,
+        Forecast.DatasetGroup,
+        FraudDetector.Detector,
+        FraudDetector.DetectorVersion,
+        FraudDetector.EntityType,
+        FraudDetector.EventType,
+        FraudDetector.Label,
+        FraudDetector.List,
+        FraudDetector.Outcome,
+        FraudDetector.Variable,
+        Glacier.Vault,
+        GlobalAccelerator.Accelerator,
+        GlobalAccelerator.EndpointGroup,
+        GlobalAccelerator.Listener,
+        Glue.Connection,
+        Glue.Crawler,
+        Glue.Database,
+        Glue.Job,
+        Glue.Table,
+        Grafana.Workspace,
+        GreengrassV2.ComponentVersion,
+        GreengrassV2.Deployment,
+        GuardDuty.Detector,
+        GuardDuty.Filter,
+        GuardDuty.IPSet,
+        GuardDuty.ThreatIntelSet,
+        HealthLake.FHIRDatastore,
+        IAM.AccessKey,
+        IAM.AccountAlias,
+        IAM.AccountPasswordPolicy,
+        IAM.Group,
+        IAM.GroupMembership,
+        IAM.InstanceProfile,
+        IAM.LoginProfile,
+        IAM.OpenIDConnectProvider,
+        IAM.Policy,
+        IAM.Role,
+        IAM.SAMLProvider,
+        IAM.ServerCertificate,
+        IAM.ServiceLinkedRole,
+        IAM.ServiceSpecificCredential,
+        IAM.SigningCertificate,
+        IAM.SSHPublicKey,
+        IAM.User,
+        IAM.VirtualMFADevice,
+        IdentityCenter.AccountAssignment,
+        IdentityCenter.Group,
+        IdentityCenter.Instance,
+        ImageBuilder.Component,
+        ImageBuilder.DistributionConfiguration,
+        ImageBuilder.ImagePipeline,
+        ImageBuilder.ImageRecipe,
+        ImageBuilder.InfrastructureConfiguration,
+        Inspector2.CisScanConfiguration,
+        Inspector2.Enabler,
+        Inspector2.Filter,
+        InternetMonitor.Monitor,
+        IdentityCenter.PermissionSet,
+        IoT.Policy,
+        IoT.Thing,
+        IoT.ThingType,
+        IoT.TopicRule,
+        IoTFleetWise.Campaign,
+        IoTFleetWise.DecoderManifest,
+        IoTFleetWise.Fleet,
+        IoTFleetWise.ModelManifest,
+        IoTFleetWise.SignalCatalog,
+        IoTFleetWise.StateTemplate,
+        IoTFleetWise.Vehicle,
+        IoTManagedIntegrations.CredentialLocker,
+        IoTManagedIntegrations.Destination,
+        IoTManagedIntegrations.ManagedThing,
+        IoTManagedIntegrations.NotificationConfiguration,
+        IoTSiteWise.Asset,
+        IoTSiteWise.AssetModel,
+        IoTSiteWise.Gateway,
+        IoTWireless.Destination,
+        IoTWireless.DeviceProfile,
+        IoTWireless.ServiceProfile,
+        IoTWireless.WirelessDevice,
+        IoTWireless.WirelessGateway,
+        IVS.Channel,
+        IVS.PlaybackKeyPair,
+        IVS.PlaybackRestrictionPolicy,
+        IVS.RecordingConfiguration,
+        IVS.StreamKey,
+        IVSChat.LoggingConfiguration,
+        IVSChat.Room,
+        IVSRealtime.Stage,
+        Kafka.ServerlessCluster,
+        Kendra.DataSource,
+        Kendra.Index,
+        Keyspaces.Keyspace,
+        Keyspaces.Table,
+        Keyspaces.Type,
+        KMS.Alias,
+        KMS.Key,
+        Kinesis.Stream,
+        Kinesis.StreamConsumer,
+        KinesisAnalyticsV2.Application,
+        KinesisAnalyticsV2.ApplicationCloudWatchLoggingOption,
+        KinesisAnalyticsV2.ApplicationSnapshot,
+        KinesisVideo.SignalingChannel,
+        KinesisVideo.Stream,
+        LakeFormation.DataCellsFilter,
+        LakeFormation.DataLakeSettings,
+        LakeFormation.LFTag,
+        LakeFormation.LFTagAssociation,
+        LakeFormation.LFTagExpression,
+        LakeFormation.OptIn,
+        LakeFormation.Permissions,
+        LakeFormation.Resource,
+        Lambda.Alias,
+        Lambda.EventSourceMapping,
+        Lambda.Function,
+        Lambda.LayerVersion,
+        Lambda.Version,
+        Lambda.MicrovmImage,
+        Lambda.NetworkConnector,
+        Lambda.Permission,
+        LexV2.Bot,
+        LexV2.BotAlias,
+        LexV2.BotLocale,
+        LexV2.BotVersion,
+        LexV2.Intent,
+        LexV2.SlotType,
+        LicenseManager.LicenseConfiguration,
+        Location.ApiKey,
+        Location.GeofenceCollection,
+        Location.Map,
+        Location.PlaceIndex,
+        Location.RouteCalculator,
+        Location.Tracker,
+        Location.TrackerConsumer,
+        Logs.Destination,
+        Logs.LogGroup,
+        Logs.LogStream,
+        Logs.MetricFilter,
+        Logs.ResourcePolicy,
+        Logs.SubscriptionFilter,
+        MediaConnect.Flow,
+        MediaConvert.Job,
+        MediaConvert.JobTemplate,
+        MediaConvert.Preset,
+        MediaConvert.Queue,
+        MediaLive.Channel,
+        MediaLive.Input,
+        MediaLive.InputSecurityGroup,
+        MediaPackageV2.Channel,
+        MediaPackageV2.ChannelGroup,
+        MediaPackageV2.OriginEndpoint,
+        MediaTailor.PlaybackConfiguration,
+        MedicalImaging.Datastore,
+        MQ.Broker,
+        MQ.Configuration,
+        MWAA.Environment,
+        MWAAServerless.Workflow,
+        Macie2.Session,
+        Macie2.ClassificationJob,
+        Macie2.AllowList,
+        Macie2.CustomDataIdentifier,
+        Macie2.FindingsFilter,
+        MailManager.AddonInstance,
+        MailManager.AddonSubscription,
+        MailManager.AddressList,
+        MailManager.Archive,
+        MailManager.IngressPoint,
+        MailManager.Relay,
+        MailManager.RuleSet,
+        MailManager.TrafficPolicy,
+        MemoryDB.ACL,
+        MemoryDB.Cluster,
+        MemoryDB.ParameterGroup,
+        MemoryDB.SubnetGroup,
+        MemoryDB.User,
+        Neptune.DBCluster,
+        Neptune.DBClusterParameterGroup,
+        Neptune.DBInstance,
+        Neptune.DBParameterGroup,
+        Neptune.DBSubnetGroup,
+        NeptuneGraph.Graph,
+        NetworkFirewall.Firewall,
+        NetworkFirewall.FirewallPolicy,
+        NetworkFirewall.LoggingConfiguration,
+        NetworkFirewall.RuleGroup,
+        Notifications.ChannelAssociation,
+        Notifications.EventRule,
+        Notifications.NotificationConfiguration,
+        Notifications.NotificationHub,
+        NotificationsContacts.EmailContact,
+        OAM.Link,
+        OAM.Sink,
+        ObservabilityAdmin.TelemetryConfig,
+        ObservabilityAdmin.TelemetryRule,
+        Omics.AnnotationStore,
+        Omics.ReferenceStore,
+        Omics.RunGroup,
+        Omics.SequenceStore,
+        Omics.VariantStore,
+        Omics.Workflow,
+        OpenSearch.Domain,
+        OSIS.Pipeline,
+        OSIS.PipelineEndpoint,
+        OSIS.ResourcePolicy,
+        OpenSearchServerless.AccessPolicy,
+        OpenSearchServerless.Collection,
+        OpenSearchServerless.CollectionGroup,
+        OpenSearchServerless.LifecyclePolicy,
+        OpenSearchServerless.SecurityConfig,
+        OpenSearchServerless.SecurityPolicy,
+        OpenSearchServerless.VpcEndpoint,
+        Organizations.Account,
+        Organizations.DelegatedAdministrator,
+        Organizations.Organization,
+        Organizations.OrganizationalUnit,
+        Organizations.OrganizationResourcePolicy,
+        Organizations.Policy,
+        Organizations.PolicyAttachment,
+        Organizations.Root,
+        Organizations.RootPolicyType,
+        Organizations.TrustedServiceAccess,
+        PaymentCryptography.Alias,
+        PaymentCryptography.Key,
+        Personalize.Dataset,
+        Personalize.DatasetGroup,
+        Personalize.EventTracker,
+        Personalize.Schema,
+        PinpointSMSVoiceV2.ConfigurationSet,
+        PinpointSMSVoiceV2.EventDestination,
+        PinpointSMSVoiceV2.OptOutList,
+        PinpointSMSVoiceV2.PhoneNumber,
+        Pipes.Pipe,
+        Polly.Lexicon,
+        QApps.QApp,
+        QBusiness.Application,
+        QBusiness.DataSource,
+        QBusiness.Index,
+        QBusiness.Retriever,
+        QBusiness.WebExperience,
+        QuickSight.Analysis,
+        QuickSight.Dashboard,
+        QuickSight.DataSet,
+        QuickSight.DataSource,
+        RAM.Permission,
+        RAM.ResourceShare,
+        RDS.DBCluster,
+        RDS.DBClusterEndpoint,
+        RDS.DBClusterParameterGroup,
+        RDS.DBInstance,
+        RDS.DBParameterGroup,
+        RDS.DBProxy,
+        RDS.DBProxyEndpoint,
+        RDS.DBProxyTargetGroup,
+        RDS.DBSubnetGroup,
+        Rbin.Rule,
+        RePostSpace.Space,
+        Redshift.Cluster,
+        Redshift.ClusterParameterGroup,
+        Redshift.ClusterSubnetGroup,
+        Redshift.EventSubscription,
+        RedshiftServerless.Namespace,
+        RedshiftServerless.Workgroup,
+        ResourceExplorer.Index,
+        ResourceExplorer.View,
+        ResourceGroups.Group,
+        RolesAnywhere.Crl,
+        RolesAnywhere.Profile,
+        RolesAnywhere.TrustAnchor,
+        Route53.HealthCheck,
+        Route53.HostedZone,
+        Route53.QueryLoggingConfig,
+        Route53.Record,
+        Route53.Records,
+        Route53.VpcAssociationAuthorization,
+        Route53.ZoneVpcAssociation,
+        Route53Profiles.Profile,
+        Route53Profiles.ProfileAssociation,
+        Route53Profiles.ProfileResourceAssociation,
+        Route53Resolver.ResolverEndpoint,
+        Route53Resolver.ResolverRule,
+        Route53Resolver.ResolverRuleAssociation,
+        RUM.AppMonitor,
+        RUM.MetricsDestination,
+        RUM.ResourcePolicy,
+        S3.Bucket,
+        S3Control.AccessPoint,
+        S3Control.AccessPointPolicy,
+        S3Control.MultiRegionAccessPoint,
+        S3Control.ObjectLambdaAccessPoint,
+        S3Control.StorageLensConfiguration,
+        S3Files.AccessPoint,
+        S3Files.FileSystem,
+        S3Tables.TableBucket,
+        S3Tables.Namespace,
+        S3Tables.Table,
+        S3Vectors.VectorBucket,
+        S3Vectors.Index,
+        SageMaker.Model,
+        SageMaker.EndpointConfig,
+        SageMaker.Endpoint,
+        SageMaker.FeatureGroup,
+        SageMaker.Cluster,
+        SageMaker.ClusterSchedulerConfig,
+        SageMaker.ComputeQuota,
+        Scheduler.Schedule,
+        Scheduler.ScheduleGroup,
+        Schemas.Discoverer,
+        Schemas.Registry,
+        Schemas.Schema,
+        SecurityHub.ActionTarget,
+        SecurityHub.AutomationRule,
+        SecurityHub.FindingAggregator,
+        SecurityHub.Hub,
+        SecurityHub.Insight,
+        SecurityLake.AwsLogSource,
+        SecurityLake.CustomLogSource,
+        SecurityLake.DataLake,
+        SecurityLake.ExceptionSubscription,
+        SecurityLake.Subscriber,
+        SecurityLake.SubscriberNotification,
+        SecretsManager.RotationSchedule,
+        SecretsManager.Secret,
+        ServiceCatalog.Portfolio,
+        ServiceCatalog.PortfolioProductAssociation,
+        ServiceCatalog.PrincipalPortfolioAssociation,
+        ServiceCatalog.Product,
+        ServiceQuotas.ServiceQuotaIncreaseRequest,
+        SES.AccountSettings,
+        SES.ActiveReceiptRuleSet,
+        SES.ConfigurationSet,
+        SES.ConfigurationSetEventDestination,
+        SES.Contact,
+        SES.ContactList,
+        SES.CustomVerificationEmailTemplate,
+        SES.DedicatedIpPool,
+        SES.EmailIdentity,
+        SES.EmailIdentityPolicy,
+        SES.EmailTemplate,
+        SES.MultiRegionEndpoint,
+        SES.ReceiptFilter,
+        SES.ReceiptRule,
+        SES.ReceiptRuleSet,
+        SES.Tenant,
+        SES.TenantResourceAssociation,
+        Shield.Protection,
+        Shield.ProtectionGroup,
+        Shield.Subscription,
+        Signer.ProfilePermission,
+        Signer.SigningProfile,
+        SimpleDB.Domain,
+        SNS.PlatformApplication,
+        SNS.Subscription,
+        SNS.Topic,
+        SocialMessaging.LinkedWhatsAppBusinessAccount,
+        SQS.Queue,
+        SSM.Parameter,
+        SSMContacts.Contact,
+        SSMContacts.ContactChannel,
+        SSMContacts.Plan,
+        SSMContacts.Rotation,
+        SSMIncidents.ReplicationSet,
+        SSMIncidents.ResponsePlan,
+        StepFunctions.Activity,
+        StepFunctions.StateMachine,
+        Synthetics.Canary,
+        Synthetics.Group,
+        Textract.Adapter,
+        Timestream.Database,
+        Timestream.DbInstance,
+        Timestream.ScheduledQuery,
+        Timestream.Table,
+        Transfer.Server,
+        Transfer.User,
+        Translate.ParallelData,
+        Translate.Terminology,
+        VerifiedPermissions.IdentitySource,
+        VerifiedPermissions.Policy,
+        VerifiedPermissions.PolicyStore,
+        VerifiedPermissions.PolicyStoreAlias,
+        VerifiedPermissions.PolicyTemplate,
+        VerifiedPermissions.Schema,
+        VpcLattice.AccessLogSubscription,
+        VpcLattice.AuthPolicy,
+        VpcLattice.Listener,
+        VpcLattice.ResourcePolicy,
+        VpcLattice.Rule,
+        VpcLattice.ServiceNetworkServiceAssociation,
+        VpcLattice.TargetGroup,
+        VpcLattice.Service,
+        VpcLattice.ServiceNetwork,
+        VpcLattice.ServiceNetworkVpcAssociation,
+        WAFv2.IPSet,
+        WAFv2.LoggingConfiguration,
+        WAFv2.RegexPatternSet,
+        WAFv2.RuleGroup,
+        WAFv2.WebACL,
+        WAFv2.WebACLAssociation,
+        Website.AssetDeployment,
+        WebsiteServer,
+        XRay.Group,
+        XRay.ResourcePolicy,
+        XRay.SamplingRule,
+      ]),
+      (collection) =>
+        Effect.map(captureAwsEnvironment, (environment) =>
+          pinCollectionEnvironment(collection, environment),
+        ),
+    ),
   ).pipe(
     Layer.provide(
       Layer.mergeAll(
@@ -1288,14 +1309,21 @@ export const providers = () =>
           // Dual: live ECS in deploy, floci-emulated (RPC-sidecar-hosted,
           // hot-reloading real containers) in dev — see FlociServiceProvider
           // / FlociTaskProvider.
+          // Hand-written floci local providers still live on the floci data
+          // plane: declare it so deploy-time binding clients (Action bodies,
+          // plan-time `execute`) route to the emulator — and so a binding
+          // spanning a `flociDual` sibling (RunTask(cluster, task)) does not
+          // see "mixed data planes". Pinned by test/AWS/LocalDataPlane.test.ts.
           ProviderLayer.dual(ECS.Service, {
             live: () => ECS.ServiceProvider(),
             local: () => ECS.FlociServiceProvider(),
+            dataPlane: flociServices,
           }),
           flociDual(ECS.TaskDefinition, () => ECS.TaskDefinitionProvider()),
           ProviderLayer.dual(ECS.Task, {
             live: () => ECS.TaskProvider(),
             local: () => ECS.FlociTaskProvider(),
+            dataPlane: flociServices,
           }),
           EFS.AccessPointProvider(),
           EFS.FileSystemProvider(),
@@ -1425,10 +1453,19 @@ export const providers = () =>
           ProviderLayer.dual(Lambda.Function, {
             live: () => Lambda.FunctionProvider(),
             local: () => Lambda.FlociFunctionProvider(),
+            dataPlane: flociServices,
           }),
           flociDual(Lambda.LayerVersion, () => Lambda.LayerVersionProvider()),
           flociDual(Lambda.Version, () => Lambda.VersionProvider()),
-          flociDual(Lambda.MicrovmImage, () => Lambda.MicrovmImageProvider()),
+          // Dual: dev builds the MicroVM image with a plain host-side
+          // `docker build` (BuildKit layer cache against the user's real
+          // sources) and hands floci a pre-built `docker://` reference —
+          // see FlociMicrovmImageProvider.
+          ProviderLayer.dual(Lambda.MicrovmImage, {
+            live: () => Lambda.MicrovmImageProvider(),
+            local: () => Lambda.FlociMicrovmImageProvider(),
+            dataPlane: flociServices,
+          }),
           flociDual(Lambda.NetworkConnector, () =>
             Lambda.NetworkConnectorProvider(),
           ),
@@ -1618,7 +1655,7 @@ export const providers = () =>
             Website.AssetDeploymentProvider(),
           ),
           // ServerProvider is internally dual (LocalProvider.make → ServerLocal).
-          Website.ServerProvider(),
+          WebsiteServerProvider(),
           XRay.GroupProvider(),
           XRay.ResourcePolicyProvider(),
           XRay.SamplingRuleProvider(),
@@ -1929,6 +1966,23 @@ export const providers = () =>
     // a few seconds. Bounded so real rate-limit pressure still surfaces
     // instead of masking as an indefinite hang.
     Layer.provideMerge(Layer.succeed(Retry, awsRetryFactory)),
+    // In an `alchemy dev` run the AMBIENT environment — what stack
+    // composition code, plan-time data sources (`AWS.EC2.getAmi`), and any
+    // raw distilled call see — is the EMULATOR, so dev needs no real
+    // credentials and no call-site routing. The providers above were built
+    // beneath the live chain and keep it (their lifecycle ops close over
+    // their build context): live-mode and mode-agnostic resources still hit
+    // the real cloud, and local variants override per-resource via their
+    // registered data plane. `Layer.merge`'s second layer wins duplicate
+    // tags, which is exactly the shadowing we want; `Alchemy.remote()`
+    // resources stay live through the per-resource binding routing.
+    (base) =>
+      Layer.unwrap(
+        Effect.gen(function* () {
+          const mode = yield* defaultProviderMode;
+          return mode === "local" ? Layer.merge(base, flociServices()) : base;
+        }),
+      ),
     Layer.orDie,
   );