alchemy 2.0.0-beta.74 → 2.0.0-beta.76

package/lib/AWS/Local/ImageSourceTrigger.js

@@ -0,0 +1,67 @@
+/** @effect-diagnostics anyUnknownInErrorContext:off */
+/**
+ * INTERNAL — the "image source changed" trigger stream shared by the floci
+ * dev providers that rebuild a Docker image on file change
+ * ([ECS FlociTaskProvider](../ECS/FlociTaskProvider.ts),
+ * [ECS FlociServiceProvider](../ECS/FlociServiceProvider.ts),
+ * [Lambda FlociMicrovmImageProvider](../Lambda/FlociMicrovmImageProvider.ts)).
+ * NOT exported from any service `index.ts`.
+ */
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Stream from "effect/Stream";
+import * as Bundle from "../../Bundle/Bundle.js";
+import { isInlineDockerfile } from "../../Docker/Dockerfile.js";
+import { imageSourceKind, makeBunBootstrap, makeImageSource, } from "../ECR/ImageSource.js";
+/**
+ * A stream of "the image source changed" triggers for a props bag:
+ *
+ * - `main` — a `Bundle.watch` over the exact module graph the deploy
+ *   bundles (rebuild successes are the trigger; rebuild errors are logged
+ *   and swallowed);
+ * - `context` — a debounced recursive `fs.watch` of the build context (and
+ *   the Dockerfile's directory when it lives outside the context);
+ * - `image` (registry ref) / inline-dockerfile-only — nothing local to
+ *   watch: an empty stream.
+ */
+export const imageSourceTrigger = Effect.fn(function* (options) {
+    const { id, source } = options;
+    const kind = imageSourceKind(source);
+    if (kind === "main") {
+        const imageSource = yield* makeImageSource;
+        const plan = yield* imageSource.watchMain({
+            source: source,
+            isExternal: options.isExternal,
+            bootstrap: makeBunBootstrap(source.handler ?? "default"),
+        });
+        return Bundle.watch(plan.inputOptions, plan.outputOptions, plan.extra).pipe(Stream.tap((event) => event._tag === "Error"
+            ? Effect.logWarning(`[alchemy dev] ${id}: rebuild failed: ${event.error.message}`)
+            : Effect.void), Stream.filter((event) => event._tag === "Success"), Stream.debounce("200 millis"), Stream.map(() => undefined));
+    }
+    if (kind === "context") {
+        if (source.context === undefined) {
+            // Inline-dockerfile-only builds have no local files to watch — the
+            // content is a prop, and prop changes flow through the dev diff.
+            return Stream.empty;
+        }
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const context = path.resolve(source.context);
+        const streams = [
+            fs.watch(context, { recursive: true }),
+        ];
+        // A path Dockerfile living OUTSIDE the context dir is watched too.
+        if (source.dockerfile !== undefined &&
+            !isInlineDockerfile(source.dockerfile)) {
+            const dockerfile = path.resolve(source.dockerfile);
+            if (!dockerfile.startsWith(`${context}/`)) {
+                streams.push(fs.watch(path.dirname(dockerfile)));
+            }
+        }
+        return Stream.mergeAll(streams, { concurrency: streams.length }).pipe(Stream.debounce("300 millis"), Stream.map(() => undefined), Stream.catchCause((cause) => Stream.fromEffect(Effect.logWarning(`[alchemy dev] ${id}: context watch failed`, cause)).pipe(Stream.drain)));
+    }
+    // Registry `image` refs have nothing local to watch.
+    return Stream.empty;
+});
+//# sourceMappingURL=ImageSourceTrigger.js.map

package/lib/AWS/Local/ImageSourceTrigger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ImageSourceTrigger.js","sourceRoot":"","sources":["../../../src/AWS/Local/ImageSourceTrigger.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD;;;;;;;GAOG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,eAAe,GAGhB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,OAKtD;IACC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC/B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAErC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC;YACxC,MAAM,EAAE,MAA4B;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC;SACzD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CACzE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,KAAK,OAAO;YACpB,CAAC,CAAC,MAAM,CAAC,UAAU,CACf,iBAAiB,EAAE,qBAAqB,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAC9D;YACH,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,EACD,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAClD,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CACL,CAAC;IAC3B,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,mEAAmE;YACnE,iEAAiE;YACjE,OAAO,MAAM,CAAC,KAA4B,CAAC;QAC7C,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAkC;YAC7C,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SACvC,CAAC;QACF,mEAAmE;QACnE,IACE,MAAM,CAAC,UAAU,KAAK,SAAS;YAC/B,CAAC,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EACtC,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAC3B,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,MAAM,CAAC,UAAU,CACf,MAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE,wBAAwB,EAAE,KAAK,CAAC,CACtE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CACrB,CACqB,CAAC;IAC3B,CAAC;IAED,qDAAqD;IACrD,OAAO,MAAM,CAAC,KAA4B,CAAC;AAC7C,CAAC,CAAC,CAAC"}

package/lib/AWS/Local/Local.js

@@ -12,7 +12,8 @@ import * as RpcServer from "../../Local/RpcServer.js";
 import { FlociServiceProvider } from "../ECS/FlociServiceProvider.js";
 import { FlociTaskProvider } from "../ECS/FlociTaskProvider.js";
 import { FlociFunctionProvider } from "../Lambda/FlociFunctionProvider.js";
-Layer.mergeAll(FlociFunctionProvider(), FlociTaskProvider(), FlociServiceProvider()).pipe(
+import { FlociMicrovmImageProvider } from "../Lambda/FlociMicrovmImageProvider.js";
+Layer.mergeAll(FlociFunctionProvider(), FlociMicrovmImageProvider(), FlociTaskProvider(), FlociServiceProvider()).pipe(
 // The ECS image pipelines (docker build / mirror / push) run in the
 // sidecar and need the Docker CLI service.
 Layer.provide(DockerLive), RpcServer.launch);

package/lib/AWS/Local/Local.js.map

@@ -1 +1 @@
-{"version":3,"file":"Local.js","sourceRoot":"","sources":["../../../src/AWS/Local/Local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,SAAS,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAE3E,KAAK,CAAC,QAAQ,CACZ,qBAAqB,EAAE,EACvB,iBAAiB,EAAE,EACnB,oBAAoB,EAAE,CACvB,CAAC,IAAI;AACJ,oEAAoE;AACpE,2CAA2C;AAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EACzB,SAAS,CAAC,MAAM,CACjB,CAAC"}
+{"version":3,"file":"Local.js","sourceRoot":"","sources":["../../../src/AWS/Local/Local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,SAAS,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAEnF,KAAK,CAAC,QAAQ,CACZ,qBAAqB,EAAE,EACvB,yBAAyB,EAAE,EAC3B,iBAAiB,EAAE,EACnB,oBAAoB,EAAE,CACvB,CAAC,IAAI;AACJ,oEAAoE;AACpE,2CAA2C;AAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EACzB,SAAS,CAAC,MAAM,CACjB,CAAC"}

package/lib/AWS/Local/ProviderContext.d.ts

@@ -1,4 +1,5 @@
 /** @effect-diagnostics anyUnknownInErrorContext:off */
+import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import type { ProviderService } from "../../Provider.ts";
 import type { ResourceLike } from "../../Resource.ts";
@@ -16,6 +17,30 @@ import type { ResourceLike } from "../../Resource.ts";
  * Proxy in [Local/RpcProvider.ts](../../Local/RpcProvider.ts).
  */
 export declare const withProviderContext: <R extends ResourceLike>(provider: ProviderService<R>, services: Layer.Layer<any, never, never>) => ProviderService<R>;
+/**
+ * Capture the ambient AWS environment — the exact tag set a local data
+ * plane overrides: {@link Endpoint}, {@link Region}, {@link Credentials},
+ * {@link AWSEnvironment} — as a layer that reproduces it verbatim. An
+ * absent Endpoint is pinned as `undefined` (the SDK default resolver), so
+ * a later ambient override cannot leak in.
+ */
+export declare const captureAwsEnvironment: Effect.Effect<Layer.Layer<any, never, never>>;
+/**
+ * Pin every provider in a collection (and every mode variant it lazily
+ * resolves) to the AWS environment captured at REGISTRATION, provided
+ * closest around each lifecycle effect. Providers therefore always run
+ * against the environment they were registered with, regardless of the
+ * caller's ambient context — which in an `alchemy dev` run is the emulator
+ * (see AWS/Providers.ts): composition-time lookups get the emulator for
+ * free while live-mode and mode-agnostic providers keep hitting the real
+ * cloud. Local variants still win — their own data-plane override is
+ * provided closer.
+ */
+export declare const pinCollectionEnvironment: <A extends {
+    readonly kind: "ProviderCollection";
+    get(service: string): ProviderService<any> | undefined;
+    readonly providers: Record<string, ProviderService>;
+}>(collection: A, environment: Layer.Layer<any, never, never>) => A;
 /**
  * Layer-level companion to {@link withProviderContext}: given a provider
  * layer (e.g. `S3.BucketProvider()`) and a layer of override services,

package/lib/AWS/Local/ProviderContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProviderContext.d.ts","sourceRoot":"","sources":["../../../src/AWS/Local/ProviderContext.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAIvD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,SAAS,YAAY,YAC9C,eAAe,CAAC,CAAC,CAAC,YAClB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KACvC,eAAe,CAAC,CAAC,CAgBhB,CAAC;AAML;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,iBAClC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,YAC9B,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,KACrC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAgCK,CAAC"}
+{"version":3,"file":"ProviderContext.d.ts","sourceRoot":"","sources":["../../../src/AWS/Local/ProviderContext.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAMvD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGtD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,SAAS,YAAY,YAC9C,eAAe,CAAC,CAAC,CAAC,YAClB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KACvC,eAAe,CAAC,CAAC,CAiChB,CAAC;AAEL;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAC/C,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAoB9B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GACnC,CAAC,SAAS;IACR,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACrD,cAEW,CAAC,eACA,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAC1C,CAmBF,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,iBAClC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,YAC9B,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,KACrC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAgCK,CAAC"}

package/lib/AWS/Local/ProviderContext.js

@@ -1,9 +1,14 @@
 /** @effect-diagnostics anyUnknownInErrorContext:off */
+import { Credentials } from "@distilled.cloud/aws/Credentials";
+import { Endpoint } from "@distilled.cloud/aws";
+import { Region } from "@distilled.cloud/aws/Region";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
 import * as Predicate from "effect/Predicate";
 import * as Stream from "effect/Stream";
+import { AWSEnvironment } from "../Environment.js";
 /**
  * Wraps a {@link ProviderService} so that EVERY lifecycle method
  * (`reconcile`, `diff`, `read`, `delete`, `list`, `precreate`, `tail`,
@@ -20,6 +25,17 @@ import * as Stream from "effect/Stream";
 export const withProviderContext = (provider, services) => new Proxy(provider, {
     get: (target, prop) => {
         const value = target[prop];
+        if (prop === "modes" && value !== undefined) {
+            // Mode-resolved variants (`findProviderByType(type, mode)`, used for
+            // stamped-mode deletes and `Alchemy.remote()`) bypass this Proxy —
+            // wrap the services THEY resolve to as well, so a live variant's
+            // ops carry the same context. A local variant's own data-plane
+            // override is provided closer and still wins.
+            return Object.fromEntries(Object.entries(value).map(([mode, build]) => [
+                mode,
+                Effect.map(build, (resolved) => withProviderContext(resolved, services)),
+            ]));
+        }
         if (!Predicate.isFunction(value))
             return value;
         return (...args) => {
@@ -34,6 +50,62 @@ export const withProviderContext = (provider, services) => new Proxy(provider, {
         };
     },
 });
+/**
+ * Capture the ambient AWS environment — the exact tag set a local data
+ * plane overrides: {@link Endpoint}, {@link Region}, {@link Credentials},
+ * {@link AWSEnvironment} — as a layer that reproduces it verbatim. An
+ * absent Endpoint is pinned as `undefined` (the SDK default resolver), so
+ * a later ambient override cannot leak in.
+ */
+export const captureAwsEnvironment = Effect.gen(function* () {
+    let ctx = Context.empty();
+    const endpoint = yield* Effect.serviceOption(Endpoint.Endpoint);
+    ctx = Context.add(ctx, Endpoint.Endpoint, Option.getOrElse(endpoint, () => Effect.succeed(undefined)));
+    const region = yield* Effect.serviceOption(Region);
+    if (Option.isSome(region))
+        ctx = Context.add(ctx, Region, region.value);
+    const credentials = yield* Effect.serviceOption(Credentials);
+    if (Option.isSome(credentials)) {
+        ctx = Context.add(ctx, Credentials, credentials.value);
+    }
+    const environment = yield* Effect.serviceOption(AWSEnvironment);
+    if (Option.isSome(environment)) {
+        ctx = Context.add(ctx, AWSEnvironment, environment.value);
+    }
+    return Layer.succeedContext(ctx);
+});
+/**
+ * Pin every provider in a collection (and every mode variant it lazily
+ * resolves) to the AWS environment captured at REGISTRATION, provided
+ * closest around each lifecycle effect. Providers therefore always run
+ * against the environment they were registered with, regardless of the
+ * caller's ambient context — which in an `alchemy dev` run is the emulator
+ * (see AWS/Providers.ts): composition-time lookups get the emulator for
+ * free while live-mode and mode-agnostic providers keep hitting the real
+ * cloud. Local variants still win — their own data-plane override is
+ * provided closer.
+ */
+export const pinCollectionEnvironment = (collection, environment) => {
+    const wrap = (provider) => {
+        if (provider === undefined)
+            return undefined;
+        // Stamp the registration-captured live environment so Binding clients
+        // for `Alchemy.remote()` resources can provide it closest — in a
+        // `dev` run ambient is the emulator, and an unwrapped live client
+        // would miss the real cloud.
+        Object.assign(provider, { liveDataPlane: () => environment });
+        return withProviderContext(provider, environment);
+    };
+    const wrapped = {};
+    for (const [type, provider] of Object.entries(collection.providers)) {
+        wrapped[type] = wrap(provider);
+    }
+    return {
+        ...collection,
+        get: (service) => wrapped[service] ?? wrap(collection.get(service)),
+        providers: wrapped,
+    };
+};
 const isProviderService = (value) => Predicate.hasProperty(value, "reconcile") &&
     Predicate.isFunction(value.reconcile);
 /**

package/lib/AWS/Local/ProviderContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProviderContext.js","sourceRoot":"","sources":["../../../src/AWS/Local/ProviderContext.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,QAA4B,EAC5B,QAAwC,EACpB,EAAE,CACtB,IAAI,KAAK,CAAC,QAAQ,EAAE;IAClB,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,KAAK,GAAI,MAAc,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,CAAC,GAAG,IAAW,EAAE,EAAE;YACxB,MAAM,MAAM,GAAY,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEL,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAiC,EAAE,CAC1E,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC;IACzC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,aAAwC,EACxC,QAAsC,EACT,EAAE,CAC/B,KAAK,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACrC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;IAC/C,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAC/C,QAAQ,EACR,OAAO,EACP,KAAK,CACN,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,gBAAgB,CACzC,aAAa,CAAC,IAAI;IAChB,iEAAiE;IACjE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CACb,EACjC,OAAO,EACP,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAe,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,GAAG,CACT,GAAG,EACH,iBAAiB,CAAC,KAAK,CAAC;YACtB,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC;YAC3C,CAAC,CAAC,KAAK,CACV,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,CAA0B,CAAC;AAC9D,CAAC,CAAC,CAC4B,CAAC"}
+{"version":3,"file":"ProviderContext.js","sourceRoot":"","sources":["../../../src/AWS/Local/ProviderContext.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,QAA4B,EAC5B,QAAwC,EACpB,EAAE,CACtB,IAAI,KAAK,CAAC,QAAQ,EAAE;IAClB,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,KAAK,GAAI,MAAc,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5C,qEAAqE;YACrE,mEAAmE;YACnE,iEAAiE;YACjE,+DAA+D;YAC/D,8CAA8C;YAC9C,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAA2C,CAAC,CAAC,GAAG,CAC7D,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI;gBACJ,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC7B,mBAAmB,CAAC,QAA8B,EAAE,QAAQ,CAAC,CAC9D;aACF,CACF,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,CAAC,GAAG,IAAW,EAAE,EAAE;YACxB,MAAM,MAAM,GAAY,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEL;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAE9B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtB,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChE,GAAG,GAAG,OAAO,CAAC,GAAG,CACf,GAAG,EACH,QAAQ,CAAC,QAAQ,EACjB,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAC5D,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC,cAAc,CAAC,GAAG,CAAmC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAOtC,UAAa,EACb,WAA2C,EACxC,EAAE;IACL,MAAM,IAAI,GAAG,CAAC,QAAqC,EAAE,EAAE;QACrD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,sEAAsE;QACtE,iEAAiE;QACjE,kEAAkE;QAClE,6BAA6B;QAC7B,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,OAAO,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,CAAC,CAAC;IACF,MAAM,OAAO,GAAoC,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAE,CAAC;IAClC,CAAC;IACD,OAAO;QACL,GAAG,UAAU;QACb,GAAG,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3E,SAAS,EAAE,OAAO;KACd,CAAC;AACT,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAiC,EAAE,CAC1E,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC;IACzC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,aAAwC,EACxC,QAAsC,EACT,EAAE,CAC/B,KAAK,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACrC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;IAC/C,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAC/C,QAAQ,EACR,OAAO,EACP,KAAK,CACN,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,gBAAgB,CACzC,aAAa,CAAC,IAAI;IAChB,iEAAiE;IACjE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CACb,EACjC,OAAO,EACP,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAe,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,GAAG,CACT,GAAG,EACH,iBAAiB,CAAC,KAAK,CAAC;YACtB,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC;YAC3C,CAAC,CAAC,KAAK,CACV,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,CAA0B,CAAC;AAC9D,CAAC,CAAC,CAC4B,CAAC"}

package/lib/AWS/Providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../../src/AWS/Providers.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,EAEN,MAAM,4BAA4B,CAAC;AAIpC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAKtC,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,OAAO,EAAmB,MAAM,eAAe,CAAC;AAGzD,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAkB,MAAM,cAAc,CAAC;AAkBtD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAgCtC,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAgBhD,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAC;AAgGtC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;;AAwCtC,qBAAa,SAAU,SAAQ,cAE9B;CAAG;AAEJ,eAAO,MAAM,SAAS,ieAoqDnB,CAAC"}
+{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../../src/AWS/Providers.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,EAEN,MAAM,4BAA4B,CAAC;AAIpC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAKtC,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,OAAO,EAAmB,MAAM,eAAe,CAAC;AAQzD,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAkB,MAAM,cAAc,CAAC;AAsBtD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAgCtC,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAgBhD,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAC;AAgGtC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;;AAwCtC,qBAAa,SAAU,SAAQ,cAE9B;CAAG;AAEJ,eAAO,MAAM,SAAS,ieAqtDnB,CAAC"}

package/lib/AWS/Providers.js

@@ -13,9 +13,12 @@ import * as Command from "../Command/index.js";
 import { DockerLive } from "../Docker/Docker.js";
 import { KeyPair, KeyPairProvider } from "../KeyPair.js";
 import * as ProviderLayer from "../Local/ProviderLayer.js";
-import { flociDual } from "./Local/FlociServices.js";
+import { defaultProviderMode } from "../ProviderMode.js";
+import { captureAwsEnvironment, pinCollectionEnvironment, } from "./Local/ProviderContext.js";
+import { flociDual, flociServices } from "./Local/FlociServices.js";
 import * as Provider from "../Provider.js";
 import { Random, RandomProvider } from "../Random.js";
+import { Server as WebsiteServer, ServerProvider as WebsiteServerProvider, } from "../Website/Server.js";
 import * as AccessAnalyzer from "./AccessAnalyzer/index.js";
 import * as Account from "./Account/index.js";
 import * as ACM from "./ACM/index.js";
@@ -218,7 +221,14 @@ import * as Website from "./Website/index.js";
 import * as XRay from "./XRay/index.js";
 export class Providers extends Provider.ProviderCollection()("AWS") {
 }
-export const providers = () => Layer.effect(Providers, Provider.collection([
+export const providers = () => Layer.effect(Providers, 
+// Providers are PINNED to the environment they are registered with (the
+// live chain provided at the bottom of this pipe) — see
+// `pinCollectionEnvironment`. The ambient environment the STACK program
+// sees flips to the emulator in a dev run (bottom of this file), and the
+// pin is what keeps live-mode and mode-agnostic providers on the real
+// cloud regardless.
+Effect.flatMap(Provider.collection([
     KeyPair,
     Random,
     AccessAnalyzer.Analyzer,
@@ -392,6 +402,7 @@ export const providers = () => Layer.effect(Providers, Provider.collection([
     Cognito.IdentityPool,
     Cognito.IdentityPoolRoleAttachment,
     Cognito.IdentityProvider,
+    Cognito.ManagedLoginBranding,
     Cognito.ResourceServer,
     Cognito.User,
     Cognito.UserPool,
@@ -929,11 +940,11 @@ export const providers = () => Layer.effect(Providers, Provider.collection([
     WAFv2.WebACL,
     WAFv2.WebACLAssociation,
     Website.AssetDeployment,
-    Website.Server,
+    WebsiteServer,
     XRay.Group,
     XRay.ResourcePolicy,
     XRay.SamplingRule,
-])).pipe(Layer.provide(Layer.mergeAll(Layer.mergeAll(ACMPCA.CertificateAuthorityProvider(), ACMPCA.CertificateAuthorityPolicyProvider(), ACMPCA.PermissionProvider(), AppFlow.ConnectorProfileProvider(), AppFlow.FlowProvider(), AppIntegrations.ApplicationProvider(), AppIntegrations.DataIntegrationProvider(), AppIntegrations.EventIntegrationProvider(), B2BI.CapabilityProvider(), B2BI.PartnershipProvider(), B2BI.ProfileProvider(), B2BI.TransformerProvider(), BedrockDataAutomation.BlueprintProvider(), BedrockDataAutomation.DataAutomationLibraryProvider(), BedrockDataAutomation.DataAutomationProjectProvider(), Config.AggregationAuthorizationProvider(), Config.ConfigRuleProvider(), Config.ConfigurationRecorderProvider(), Config.DeliveryChannelProvider(), Config.RetentionConfigurationProvider()), Layer.mergeAll(flociDual(ACM.AccountConfiguration, () => ACM.AccountConfigurationProvider()), flociDual(ACM.Certificate, () => ACM.CertificateProvider()), AMP.AlertManagerDefinitionProvider(), AMP.AnomalyDetectorProvider(), AMP.LoggingConfigurationProvider(), AMP.QueryLoggingConfigurationProvider(), AMP.ResourcePolicyProvider(), AMP.RuleGroupsNamespaceProvider(), AMP.ScraperProvider(), AMP.ScraperLoggingConfigurationProvider(), AMP.WorkspaceProvider(), flociDual(ApiGateway.Account, () => ApiGateway.AccountProvider()), flociDual(ApiGateway.ApiKey, () => ApiGateway.ApiKeyProvider()), flociDual(ApiGateway.Authorizer, () => ApiGateway.AuthorizerProvider()), flociDual(ApiGateway.BasePathMapping, () => ApiGateway.BasePathMappingProvider()), flociDual(ApiGateway.DeploymentResource, () => ApiGateway.DeploymentProvider()), flociDual(ApiGateway.DomainName, () => ApiGateway.DomainNameProvider()), flociDual(ApiGateway.GatewayResponse, () => ApiGateway.GatewayResponseProvider()), flociDual(ApiGateway.MethodResource, () => ApiGateway.MethodProvider()), flociDual(ApiGateway.GatewayResource, () => ApiGateway.ResourceProvider()), flociDual(ApiGateway.RestApi, () => ApiGateway.RestApiProvider()), flociDual(ApiGateway.StageResource, () => ApiGateway.StageProvider()), flociDual(ApiGateway.UsagePlan, () => ApiGateway.UsagePlanProvider()), flociDual(ApiGateway.UsagePlanKey, () => ApiGateway.UsagePlanKeyProvider()), flociDual(ApiGateway.VpcLink, () => ApiGateway.VpcLinkProvider()), flociDual(ApiGatewayV2.Api, () => ApiGatewayV2.ApiProvider()), ApiGatewayV2.ApiMappingProvider(), flociDual(ApiGatewayV2.AuthorizerResource, () => ApiGatewayV2.AuthorizerProvider()), flociDual(ApiGatewayV2.DomainName, () => ApiGatewayV2.DomainNameProvider()), flociDual(ApiGatewayV2.IntegrationResource, () => ApiGatewayV2.IntegrationProvider()), flociDual(ApiGatewayV2.RouteResource, () => ApiGatewayV2.RouteProvider()), flociDual(ApiGatewayV2.StageResource, () => ApiGatewayV2.StageProvider()), flociDual(ApiGatewayV2.VpcLink, () => ApiGatewayV2.VpcLinkProvider()), flociDual(AppConfig.Application, () => AppConfig.ApplicationProvider()), flociDual(AppConfig.ConfigurationProfile, () => AppConfig.ConfigurationProfileProvider()), flociDual(AppConfig.Deployment, () => AppConfig.DeploymentProvider()), flociDual(AppConfig.DeploymentStrategy, () => AppConfig.DeploymentStrategyProvider()), flociDual(AppConfig.Environment, () => AppConfig.EnvironmentProvider()), flociDual(AppConfig.Extension, () => AppConfig.ExtensionProvider()), flociDual(AppConfig.ExtensionAssociation, () => AppConfig.ExtensionAssociationProvider()), flociDual(AppConfig.HostedConfigurationVersion, () => AppConfig.HostedConfigurationVersionProvider()), flociDual(ApplicationAutoScaling.ScalableTarget, () => ApplicationAutoScaling.ScalableTargetProvider()), flociDual(ApplicationAutoScaling.ScalingPolicy, () => ApplicationAutoScaling.ScalingPolicyProvider()), flociDual(ApplicationAutoScaling.ScheduledAction, () => ApplicationAutoScaling.ScheduledActionProvider()), AppRunner.AutoScalingConfigurationProvider(), AppRunner.ObservabilityConfigurationProvider(), AppRunner.ServiceProvider(), AppRunner.VpcConnectorProvider(), flociDual(AppSync.ApiAssociationResource, () => AppSync.ApiAssociationProvider()), flociDual(AppSync.ApiKeyResource, () => AppSync.ApiKeyProvider()), flociDual(AppSync.DataSourceResource, () => AppSync.DataSourceProvider()), flociDual(AppSync.DomainName, () => AppSync.DomainNameProvider()), flociDual(AppSync.FunctionResource, () => AppSync.FunctionProvider()), flociDual(AppSync.GraphqlApi, () => AppSync.GraphqlApiProvider()), flociDual(AppSync.ResolverResource, () => AppSync.ResolverProvider()), flociDual(Athena.DataCatalog, () => Athena.DataCatalogProvider()), flociDual(Athena.NamedQuery, () => Athena.NamedQueryProvider()), flociDual(Athena.PreparedStatement, () => Athena.PreparedStatementProvider()), flociDual(Athena.WorkGroup, () => Athena.WorkGroupProvider()), flociDual(AutoScaling.AutoScalingGroup, () => AutoScaling.AutoScalingGroupProvider()), flociDual(AutoScaling.LaunchTemplate, () => AutoScaling.LaunchTemplateProvider()), flociDual(AutoScaling.LifecycleHook, () => AutoScaling.LifecycleHookProvider()), flociDual(AutoScaling.ScalingPolicy, () => AutoScaling.ScalingPolicyProvider()), flociDual(AutoScaling.ScheduledAction, () => AutoScaling.ScheduledActionProvider()), flociDual(Batch.ComputeEnvironment, () => Batch.ComputeEnvironmentProvider()), flociDual(Batch.JobDefinition, () => Batch.JobDefinitionProvider()), flociDual(Batch.JobQueue, () => Batch.JobQueueProvider()), CloudControl.CloudControlResourceProvider(), CloudFormation.StackProvider(), flociDual(CloudFront.CachePolicy, () => CloudFront.CachePolicyProvider()), flociDual(CloudFront.Distribution, () => CloudFront.DistributionProvider()), flociDual(CloudFront.Function, () => CloudFront.FunctionProvider()), flociDual(CloudFront.Invalidation, () => CloudFront.InvalidationProvider()), flociDual(CloudFront.KeyGroup, () => CloudFront.KeyGroupProvider()), flociDual(CloudFront.KeyValueStore, () => CloudFront.KeyValueStoreProvider()), flociDual(CloudFront.KvEntries, () => CloudFront.KvEntriesProvider()), flociDual(CloudFront.KvRoutesUpdate, () => CloudFront.KvRoutesUpdateProvider()), flociDual(CloudFront.OriginAccessControl, () => CloudFront.OriginAccessControlProvider()), flociDual(CloudFront.OriginRequestPolicy, () => CloudFront.OriginRequestPolicyProvider()), flociDual(CloudFront.PublicKey, () => CloudFront.PublicKeyProvider()), flociDual(CloudFront.RealtimeLogConfig, () => CloudFront.RealtimeLogConfigProvider()), flociDual(CloudFront.ResponseHeadersPolicy, () => CloudFront.ResponseHeadersPolicyProvider()), flociDual(CloudFront.VpcOrigin, () => CloudFront.VpcOriginProvider()), CloudHSMV2.ClusterProvider(), CloudHSMV2.HsmProvider(), flociDual(CloudMap.HttpNamespace, () => CloudMap.HttpNamespaceProvider()), flociDual(CloudMap.InstanceRegistration, () => CloudMap.InstanceRegistrationProvider()), flociDual(CloudMap.PrivateDnsNamespace, () => CloudMap.PrivateDnsNamespaceProvider()), flociDual(CloudMap.PublicDnsNamespace, () => CloudMap.PublicDnsNamespaceProvider()), flociDual(CloudMap.Service, () => CloudMap.ServiceProvider()), CloudWatch.AlarmMuteRuleProvider(), CloudWatch.AlarmProvider(), CloudWatch.AnomalyDetectorProvider(), CloudWatch.CompositeAlarmProvider(), CloudWatch.DashboardProvider(), CloudWatch.InsightRuleProvider(), CloudWatch.MetricStreamProvider(), CodeArtifact.DomainProvider(), CodeArtifact.RepositoryProvider(), CodeBuild.ProjectProvider(), CodeBuild.ReportGroupProvider(), CodeConnections.ConnectionProvider(), CodeConnections.HostProvider(), CodeConnections.RepositoryLinkProvider(), CodeConnections.SyncConfigurationProvider(), CodeDeploy.ApplicationProvider(), CodeDeploy.DeploymentConfigProvider(), CodeDeploy.DeploymentGroupProvider(), CodePipeline.PipelineProvider(), flociDual(Cognito.Group, () => Cognito.GroupProvider()), flociDual(Cognito.IdentityPool, () => Cognito.IdentityPoolProvider()), flociDual(Cognito.IdentityPoolRoleAttachment, () => Cognito.IdentityPoolRoleAttachmentProvider()), flociDual(Cognito.IdentityProvider, () => Cognito.IdentityProviderProvider()), flociDual(Cognito.ResourceServer, () => Cognito.ResourceServerProvider()), flociDual(Cognito.UserPoolClient, () => Cognito.UserPoolClientProvider()), flociDual(Cognito.User, () => Cognito.UserProvider()), flociDual(Cognito.UserPoolDomain, () => Cognito.UserPoolDomainProvider()), flociDual(Cognito.UserPool, () => Cognito.UserPoolProvider())), Layer.mergeAll(DataBrew.DatasetProvider(), DataBrew.JobProvider(), DataBrew.ProjectProvider(), DataBrew.RecipeProvider(), DataBrew.RulesetProvider(), DataBrew.ScheduleProvider(), DataExchange.DataSetProvider(), DataExchange.EventActionProvider(), DataExchange.RevisionProvider(), DataSync.LocationEfsProvider(), DataSync.LocationS3Provider(), DataSync.TaskProvider(), DataZone.DomainProvider(), DataZone.EnvironmentProvider(), DataZone.EnvironmentBlueprintConfigurationProvider(), DataZone.ProjectProvider(), DAX.ClusterProvider(), DAX.ParameterGroupProvider(), DAX.SubnetGroupProvider(), Deadline.BudgetProvider(), Deadline.FarmProvider(), Deadline.FleetProvider(), Deadline.MonitorProvider(), Deadline.QueueProvider(), Deadline.StorageProfileProvider(), DirectoryService.ConditionalForwarderProvider(), DirectoryService.DirectoryProvider(), DirectoryService.EventTopicProvider(), DLM.LifecyclePolicyProvider(), DocDB.DBClusterProvider(), DocDB.DBInstanceProvider(), DocDB.DBSubnetGroupProvider(), DocDBElastic.ClusterProvider(), DMS.EndpointProvider(), DMS.ReplicationInstanceProvider(), DMS.ReplicationSubnetGroupProvider(), DSQL.ClusterProvider(), DSQL.ClusterPolicyProvider(), DSQL.StreamProvider(), DevOpsGuru.EventSourcesConfigProvider(), DevOpsGuru.NotificationChannelProvider(), DevOpsGuru.ResourceCollectionProvider(), DevOpsGuru.ServiceIntegrationProvider(), flociDual(DynamoDB.Table, () => DynamoDB.TableProvider()), flociDual(EC2.DhcpOptions, () => EC2.DhcpOptionsProvider()), flociDual(EC2.EgressOnlyInternetGateway, () => EC2.EgressOnlyInternetGatewayProvider()), flociDual(EC2.EIP, () => EC2.EIPProvider()), flociDual(EC2.FlowLog, () => EC2.FlowLogProvider()), flociDual(EC2.Instance, () => EC2.InstanceProvider()), 
+]), (collection) => Effect.map(captureAwsEnvironment, (environment) => pinCollectionEnvironment(collection, environment)))).pipe(Layer.provide(Layer.mergeAll(Layer.mergeAll(ACMPCA.CertificateAuthorityProvider(), ACMPCA.CertificateAuthorityPolicyProvider(), ACMPCA.PermissionProvider(), AppFlow.ConnectorProfileProvider(), AppFlow.FlowProvider(), AppIntegrations.ApplicationProvider(), AppIntegrations.DataIntegrationProvider(), AppIntegrations.EventIntegrationProvider(), B2BI.CapabilityProvider(), B2BI.PartnershipProvider(), B2BI.ProfileProvider(), B2BI.TransformerProvider(), BedrockDataAutomation.BlueprintProvider(), BedrockDataAutomation.DataAutomationLibraryProvider(), BedrockDataAutomation.DataAutomationProjectProvider(), Config.AggregationAuthorizationProvider(), Config.ConfigRuleProvider(), Config.ConfigurationRecorderProvider(), Config.DeliveryChannelProvider(), Config.RetentionConfigurationProvider()), Layer.mergeAll(flociDual(ACM.AccountConfiguration, () => ACM.AccountConfigurationProvider()), flociDual(ACM.Certificate, () => ACM.CertificateProvider()), AMP.AlertManagerDefinitionProvider(), AMP.AnomalyDetectorProvider(), AMP.LoggingConfigurationProvider(), AMP.QueryLoggingConfigurationProvider(), AMP.ResourcePolicyProvider(), AMP.RuleGroupsNamespaceProvider(), AMP.ScraperProvider(), AMP.ScraperLoggingConfigurationProvider(), AMP.WorkspaceProvider(), flociDual(ApiGateway.Account, () => ApiGateway.AccountProvider()), flociDual(ApiGateway.ApiKey, () => ApiGateway.ApiKeyProvider()), flociDual(ApiGateway.Authorizer, () => ApiGateway.AuthorizerProvider()), flociDual(ApiGateway.BasePathMapping, () => ApiGateway.BasePathMappingProvider()), flociDual(ApiGateway.DeploymentResource, () => ApiGateway.DeploymentProvider()), flociDual(ApiGateway.DomainName, () => ApiGateway.DomainNameProvider()), flociDual(ApiGateway.GatewayResponse, () => ApiGateway.GatewayResponseProvider()), flociDual(ApiGateway.MethodResource, () => ApiGateway.MethodProvider()), flociDual(ApiGateway.GatewayResource, () => ApiGateway.ResourceProvider()), flociDual(ApiGateway.RestApi, () => ApiGateway.RestApiProvider()), flociDual(ApiGateway.StageResource, () => ApiGateway.StageProvider()), flociDual(ApiGateway.UsagePlan, () => ApiGateway.UsagePlanProvider()), flociDual(ApiGateway.UsagePlanKey, () => ApiGateway.UsagePlanKeyProvider()), flociDual(ApiGateway.VpcLink, () => ApiGateway.VpcLinkProvider()), flociDual(ApiGatewayV2.Api, () => ApiGatewayV2.ApiProvider()), ApiGatewayV2.ApiMappingProvider(), flociDual(ApiGatewayV2.AuthorizerResource, () => ApiGatewayV2.AuthorizerProvider()), flociDual(ApiGatewayV2.DomainName, () => ApiGatewayV2.DomainNameProvider()), flociDual(ApiGatewayV2.IntegrationResource, () => ApiGatewayV2.IntegrationProvider()), flociDual(ApiGatewayV2.RouteResource, () => ApiGatewayV2.RouteProvider()), flociDual(ApiGatewayV2.StageResource, () => ApiGatewayV2.StageProvider()), flociDual(ApiGatewayV2.VpcLink, () => ApiGatewayV2.VpcLinkProvider()), flociDual(AppConfig.Application, () => AppConfig.ApplicationProvider()), flociDual(AppConfig.ConfigurationProfile, () => AppConfig.ConfigurationProfileProvider()), flociDual(AppConfig.Deployment, () => AppConfig.DeploymentProvider()), flociDual(AppConfig.DeploymentStrategy, () => AppConfig.DeploymentStrategyProvider()), flociDual(AppConfig.Environment, () => AppConfig.EnvironmentProvider()), flociDual(AppConfig.Extension, () => AppConfig.ExtensionProvider()), flociDual(AppConfig.ExtensionAssociation, () => AppConfig.ExtensionAssociationProvider()), flociDual(AppConfig.HostedConfigurationVersion, () => AppConfig.HostedConfigurationVersionProvider()), flociDual(ApplicationAutoScaling.ScalableTarget, () => ApplicationAutoScaling.ScalableTargetProvider()), flociDual(ApplicationAutoScaling.ScalingPolicy, () => ApplicationAutoScaling.ScalingPolicyProvider()), flociDual(ApplicationAutoScaling.ScheduledAction, () => ApplicationAutoScaling.ScheduledActionProvider()), AppRunner.AutoScalingConfigurationProvider(), AppRunner.ObservabilityConfigurationProvider(), AppRunner.ServiceProvider(), AppRunner.VpcConnectorProvider(), flociDual(AppSync.ApiAssociationResource, () => AppSync.ApiAssociationProvider()), flociDual(AppSync.ApiKeyResource, () => AppSync.ApiKeyProvider()), flociDual(AppSync.DataSourceResource, () => AppSync.DataSourceProvider()), flociDual(AppSync.DomainName, () => AppSync.DomainNameProvider()), flociDual(AppSync.FunctionResource, () => AppSync.FunctionProvider()), flociDual(AppSync.GraphqlApi, () => AppSync.GraphqlApiProvider()), flociDual(AppSync.ResolverResource, () => AppSync.ResolverProvider()), flociDual(Athena.DataCatalog, () => Athena.DataCatalogProvider()), flociDual(Athena.NamedQuery, () => Athena.NamedQueryProvider()), flociDual(Athena.PreparedStatement, () => Athena.PreparedStatementProvider()), flociDual(Athena.WorkGroup, () => Athena.WorkGroupProvider()), flociDual(AutoScaling.AutoScalingGroup, () => AutoScaling.AutoScalingGroupProvider()), flociDual(AutoScaling.LaunchTemplate, () => AutoScaling.LaunchTemplateProvider()), flociDual(AutoScaling.LifecycleHook, () => AutoScaling.LifecycleHookProvider()), flociDual(AutoScaling.ScalingPolicy, () => AutoScaling.ScalingPolicyProvider()), flociDual(AutoScaling.ScheduledAction, () => AutoScaling.ScheduledActionProvider()), flociDual(Batch.ComputeEnvironment, () => Batch.ComputeEnvironmentProvider()), flociDual(Batch.JobDefinition, () => Batch.JobDefinitionProvider()), flociDual(Batch.JobQueue, () => Batch.JobQueueProvider()), CloudControl.CloudControlResourceProvider(), CloudFormation.StackProvider(), flociDual(CloudFront.CachePolicy, () => CloudFront.CachePolicyProvider()), flociDual(CloudFront.Distribution, () => CloudFront.DistributionProvider()), flociDual(CloudFront.Function, () => CloudFront.FunctionProvider()), flociDual(CloudFront.Invalidation, () => CloudFront.InvalidationProvider()), flociDual(CloudFront.KeyGroup, () => CloudFront.KeyGroupProvider()), flociDual(CloudFront.KeyValueStore, () => CloudFront.KeyValueStoreProvider()), flociDual(CloudFront.KvEntries, () => CloudFront.KvEntriesProvider()), flociDual(CloudFront.KvRoutesUpdate, () => CloudFront.KvRoutesUpdateProvider()), flociDual(CloudFront.OriginAccessControl, () => CloudFront.OriginAccessControlProvider()), flociDual(CloudFront.OriginRequestPolicy, () => CloudFront.OriginRequestPolicyProvider()), flociDual(CloudFront.PublicKey, () => CloudFront.PublicKeyProvider()), flociDual(CloudFront.RealtimeLogConfig, () => CloudFront.RealtimeLogConfigProvider()), flociDual(CloudFront.ResponseHeadersPolicy, () => CloudFront.ResponseHeadersPolicyProvider()), flociDual(CloudFront.VpcOrigin, () => CloudFront.VpcOriginProvider()), CloudHSMV2.ClusterProvider(), CloudHSMV2.HsmProvider(), flociDual(CloudMap.HttpNamespace, () => CloudMap.HttpNamespaceProvider()), flociDual(CloudMap.InstanceRegistration, () => CloudMap.InstanceRegistrationProvider()), flociDual(CloudMap.PrivateDnsNamespace, () => CloudMap.PrivateDnsNamespaceProvider()), flociDual(CloudMap.PublicDnsNamespace, () => CloudMap.PublicDnsNamespaceProvider()), flociDual(CloudMap.Service, () => CloudMap.ServiceProvider()), CloudWatch.AlarmMuteRuleProvider(), CloudWatch.AlarmProvider(), CloudWatch.AnomalyDetectorProvider(), CloudWatch.CompositeAlarmProvider(), CloudWatch.DashboardProvider(), CloudWatch.InsightRuleProvider(), CloudWatch.MetricStreamProvider(), CodeArtifact.DomainProvider(), CodeArtifact.RepositoryProvider(), CodeBuild.ProjectProvider(), CodeBuild.ReportGroupProvider(), CodeConnections.ConnectionProvider(), CodeConnections.HostProvider(), CodeConnections.RepositoryLinkProvider(), CodeConnections.SyncConfigurationProvider(), CodeDeploy.ApplicationProvider(), CodeDeploy.DeploymentConfigProvider(), CodeDeploy.DeploymentGroupProvider(), CodePipeline.PipelineProvider(), flociDual(Cognito.Group, () => Cognito.GroupProvider()), flociDual(Cognito.IdentityPool, () => Cognito.IdentityPoolProvider()), flociDual(Cognito.IdentityPoolRoleAttachment, () => Cognito.IdentityPoolRoleAttachmentProvider()), flociDual(Cognito.IdentityProvider, () => Cognito.IdentityProviderProvider()), flociDual(Cognito.ManagedLoginBranding, () => Cognito.ManagedLoginBrandingProvider()), flociDual(Cognito.ResourceServer, () => Cognito.ResourceServerProvider()), flociDual(Cognito.UserPoolClient, () => Cognito.UserPoolClientProvider()), flociDual(Cognito.User, () => Cognito.UserProvider()), flociDual(Cognito.UserPoolDomain, () => Cognito.UserPoolDomainProvider()), flociDual(Cognito.UserPool, () => Cognito.UserPoolProvider())), Layer.mergeAll(DataBrew.DatasetProvider(), DataBrew.JobProvider(), DataBrew.ProjectProvider(), DataBrew.RecipeProvider(), DataBrew.RulesetProvider(), DataBrew.ScheduleProvider(), DataExchange.DataSetProvider(), DataExchange.EventActionProvider(), DataExchange.RevisionProvider(), DataSync.LocationEfsProvider(), DataSync.LocationS3Provider(), DataSync.TaskProvider(), DataZone.DomainProvider(), DataZone.EnvironmentProvider(), DataZone.EnvironmentBlueprintConfigurationProvider(), DataZone.ProjectProvider(), DAX.ClusterProvider(), DAX.ParameterGroupProvider(), DAX.SubnetGroupProvider(), Deadline.BudgetProvider(), Deadline.FarmProvider(), Deadline.FleetProvider(), Deadline.MonitorProvider(), Deadline.QueueProvider(), Deadline.StorageProfileProvider(), DirectoryService.ConditionalForwarderProvider(), DirectoryService.DirectoryProvider(), DirectoryService.EventTopicProvider(), DLM.LifecyclePolicyProvider(), DocDB.DBClusterProvider(), DocDB.DBInstanceProvider(), DocDB.DBSubnetGroupProvider(), DocDBElastic.ClusterProvider(), DMS.EndpointProvider(), DMS.ReplicationInstanceProvider(), DMS.ReplicationSubnetGroupProvider(), DSQL.ClusterProvider(), DSQL.ClusterPolicyProvider(), DSQL.StreamProvider(), DevOpsGuru.EventSourcesConfigProvider(), DevOpsGuru.NotificationChannelProvider(), DevOpsGuru.ResourceCollectionProvider(), DevOpsGuru.ServiceIntegrationProvider(), flociDual(DynamoDB.Table, () => DynamoDB.TableProvider()), flociDual(EC2.DhcpOptions, () => EC2.DhcpOptionsProvider()), flociDual(EC2.EgressOnlyInternetGateway, () => EC2.EgressOnlyInternetGatewayProvider()), flociDual(EC2.EIP, () => EC2.EIPProvider()), flociDual(EC2.FlowLog, () => EC2.FlowLogProvider()), flociDual(EC2.Instance, () => EC2.InstanceProvider()), 
 // Dual EC2 networking glue: local (floci) ECS services/tasks run
 // inside an emulated VPC — a live VPC can't host local containers
 // and local target groups can't reference a live vpcId.
@@ -941,12 +952,19 @@ flociDual(EC2.InternetGateway, () => EC2.InternetGatewayProvider()), flociDual(E
 // Dual: live ECS in deploy, floci-emulated (RPC-sidecar-hosted,
 // hot-reloading real containers) in dev — see FlociServiceProvider
 // / FlociTaskProvider.
+// Hand-written floci local providers still live on the floci data
+// plane: declare it so deploy-time binding clients (Action bodies,
+// plan-time `execute`) route to the emulator — and so a binding
+// spanning a `flociDual` sibling (RunTask(cluster, task)) does not
+// see "mixed data planes". Pinned by test/AWS/LocalDataPlane.test.ts.
 ProviderLayer.dual(ECS.Service, {
     live: () => ECS.ServiceProvider(),
     local: () => ECS.FlociServiceProvider(),
+    dataPlane: flociServices,
 }), flociDual(ECS.TaskDefinition, () => ECS.TaskDefinitionProvider()), ProviderLayer.dual(ECS.Task, {
     live: () => ECS.TaskProvider(),
     local: () => ECS.FlociTaskProvider(),
+    dataPlane: flociServices,
 }), EFS.AccessPointProvider(), EFS.FileSystemProvider(), EFS.MountTargetProvider(), EKS.AccessEntryProvider(), EKS.AddonProvider(), EKS.ClusterProvider(), EKS.FargateProfileProvider(), EKS.NodegroupProvider(), EKS.PodIdentityAssociationProvider(), ElastiCache.ServerlessCacheProvider(), 
 // Dual ELBv2: floci emulates ALBs with locally-resolvable DNS
 // (`*.elb.localhost.floci.io` → 127.0.0.1, host-routed on the
@@ -965,7 +983,17 @@ flociDual(Lambda.EventSourceMapping, () => Lambda.EventSourceMappingProvider()),
 ProviderLayer.dual(Lambda.Function, {
     live: () => Lambda.FunctionProvider(),
     local: () => Lambda.FlociFunctionProvider(),
-}), flociDual(Lambda.LayerVersion, () => Lambda.LayerVersionProvider()), flociDual(Lambda.Version, () => Lambda.VersionProvider()), flociDual(Lambda.MicrovmImage, () => Lambda.MicrovmImageProvider()), flociDual(Lambda.NetworkConnector, () => Lambda.NetworkConnectorProvider()), 
+    dataPlane: flociServices,
+}), flociDual(Lambda.LayerVersion, () => Lambda.LayerVersionProvider()), flociDual(Lambda.Version, () => Lambda.VersionProvider()), 
+// Dual: dev builds the MicroVM image with a plain host-side
+// `docker build` (BuildKit layer cache against the user's real
+// sources) and hands floci a pre-built `docker://` reference —
+// see FlociMicrovmImageProvider.
+ProviderLayer.dual(Lambda.MicrovmImage, {
+    live: () => Lambda.MicrovmImageProvider(),
+    local: () => Lambda.FlociMicrovmImageProvider(),
+    dataPlane: flociServices,
+}), flociDual(Lambda.NetworkConnector, () => Lambda.NetworkConnectorProvider()), 
 // Dual: glue onto the (dual) Lambda Function — a live addPermission
 // against a floci function ARN fails with ResourceNotFoundException.
 flociDual(Lambda.Permission, () => Lambda.PermissionProvider()), flociDual(Logs.Destination, () => Logs.DestinationProvider()), flociDual(Logs.LogGroup, () => Logs.LogGroupProvider()), flociDual(Logs.LogStream, () => Logs.LogStreamProvider()), flociDual(Logs.MetricFilter, () => Logs.MetricFilterProvider()), flociDual(Logs.ResourcePolicy, () => Logs.ResourcePolicyProvider()), flociDual(Logs.SubscriptionFilter, () => Logs.SubscriptionFilterProvider()), MediaConnect.FlowProvider(), MediaConvert.JobProvider(), MediaConvert.JobTemplateProvider(), MediaConvert.PresetProvider(), MediaConvert.QueueProvider(), MediaLive.ChannelProvider(), MediaLive.InputProvider(), MediaLive.InputSecurityGroupProvider(), MediaPackageV2.ChannelProvider(), MediaPackageV2.ChannelGroupProvider(), MediaPackageV2.OriginEndpointProvider(), MediaTailor.PlaybackConfigurationProvider(), MedicalImaging.DatastoreProvider(), MQ.BrokerProvider(), MQ.ConfigurationProvider(), MailManager.AddonInstanceProvider(), MailManager.AddonSubscriptionProvider(), MailManager.AddressListProvider(), MailManager.ArchiveProvider(), MailManager.IngressPointProvider(), MailManager.RelayProvider(), MailManager.RuleSetProvider(), MailManager.TrafficPolicyProvider(), MemoryDB.ACLProvider(), MemoryDB.ClusterProvider(), MemoryDB.ParameterGroupProvider(), MemoryDB.SubnetGroupProvider(), MemoryDB.UserProvider(), Neptune.DBClusterProvider(), Neptune.DBClusterParameterGroupProvider(), Neptune.DBInstanceProvider(), Neptune.DBParameterGroupProvider(), Neptune.DBSubnetGroupProvider(), NeptuneGraph.GraphProvider(), OpenSearch.DomainProvider(), OpenSearchServerless.AccessPolicyProvider(), OSIS.PipelineEndpointProvider(), OSIS.PipelineProvider(), OSIS.ResourcePolicyProvider(), OpenSearchServerless.CollectionProvider(), OpenSearchServerless.CollectionGroupProvider(), OpenSearchServerless.LifecyclePolicyProvider(), OpenSearchServerless.SecurityConfigProvider(), OpenSearchServerless.SecurityPolicyProvider(), OpenSearchServerless.VpcEndpointProvider(), Organizations.AccountProvider(), Organizations.DelegatedAdministratorProvider(), Organizations.OrganizationalUnitProvider(), Organizations.OrganizationProvider(), Organizations.OrganizationResourcePolicyProvider(), Organizations.PolicyAttachmentProvider(), Organizations.PolicyProvider(), Organizations.RootPolicyTypeProvider(), Organizations.RootProvider(), Organizations.TrustedServiceAccessProvider(), PaymentCryptography.AliasProvider(), PaymentCryptography.KeyProvider(), flociDual(Pipes.Pipe, () => Pipes.PipeProvider()), Polly.LexiconProvider(), QApps.QAppProvider(), QBusiness.ApplicationProvider(), QBusiness.DataSourceProvider(), QBusiness.IndexProvider(), QBusiness.RetrieverProvider(), QBusiness.WebExperienceProvider(), QuickSight.AnalysisProvider(), QuickSight.DashboardProvider(), QuickSight.DataSetProvider(), QuickSight.DataSourceProvider(), flociDual(RDS.DBClusterEndpoint, () => RDS.DBClusterEndpointProvider()), flociDual(RDS.DBClusterParameterGroup, () => RDS.DBClusterParameterGroupProvider()), flociDual(RDS.DBCluster, () => RDS.DBClusterProvider()), flociDual(RDS.DBInstance, () => RDS.DBInstanceProvider()), flociDual(RDS.DBParameterGroup, () => RDS.DBParameterGroupProvider()), RDS.DBProxyEndpointProvider(), RDS.DBProxyProvider(), RDS.DBProxyTargetGroupProvider(), flociDual(RDS.DBSubnetGroup, () => RDS.DBSubnetGroupProvider()), RePostSpace.SpaceProvider(), Redshift.ClusterParameterGroupProvider(), Redshift.ClusterProvider(), Redshift.ClusterSubnetGroupProvider(), Redshift.EventSubscriptionProvider(), RedshiftServerless.NamespaceProvider(), RedshiftServerless.WorkgroupProvider(), flociDual(Route53.HealthCheck, () => Route53.HealthCheckProvider()), flociDual(Route53.HostedZone, () => Route53.HostedZoneProvider()), flociDual(Route53.QueryLoggingConfig, () => Route53.QueryLoggingConfigProvider()), flociDual(Route53.Record, () => Route53.RecordProvider()), flociDual(Route53.Records, () => Route53.RecordsProvider()), flociDual(Route53.VpcAssociationAuthorization, () => Route53.VpcAssociationAuthorizationProvider()), flociDual(Route53.ZoneVpcAssociation, () => Route53.ZoneVpcAssociationProvider()), flociDual(S3.Bucket, () => S3.BucketProvider()), 
@@ -977,7 +1005,7 @@ flociDual(Scheduler.ScheduleGroup, () => Scheduler.ScheduleGroupProvider()), flo
 // floci topic ARN fails with InvalidParameterException: TopicArn.
 flociDual(SNS.Subscription, () => SNS.SubscriptionProvider()), flociDual(SNS.Topic, () => SNS.TopicProvider()), SocialMessaging.LinkedWhatsAppBusinessAccountProvider(), flociDual(SQS.Queue, () => SQS.QueueProvider()), flociDual(SSM.Parameter, () => SSM.ParameterProvider()), flociDual(StepFunctions.Activity, () => StepFunctions.ActivityProvider()), flociDual(StepFunctions.StateMachine, () => StepFunctions.StateMachineProvider()), flociDual(WAFv2.IPSet, () => WAFv2.IPSetProvider()), flociDual(WAFv2.LoggingConfiguration, () => WAFv2.LoggingConfigurationProvider()), flociDual(WAFv2.RegexPatternSet, () => WAFv2.RegexPatternSetProvider()), flociDual(WAFv2.RuleGroup, () => WAFv2.RuleGroupProvider()), flociDual(WAFv2.WebACLAssociation, () => WAFv2.WebACLAssociationProvider()), flociDual(WAFv2.WebACL, () => WAFv2.WebACLProvider()), flociDual(Website.AssetDeployment, () => Website.AssetDeploymentProvider()), 
 // ServerProvider is internally dual (LocalProvider.make → ServerLocal).
-Website.ServerProvider(), XRay.GroupProvider(), XRay.ResourcePolicyProvider(), XRay.SamplingRuleProvider(), Bedrock.AgentProvider(), Bedrock.AgentAliasProvider(), Bedrock.DataSourceProvider(), Bedrock.KnowledgeBaseProvider(), BedrockAgentCore.BrowserCustomProvider(), BedrockAgentCore.CodeInterpreterProvider(), BedrockAgentCore.GatewayProvider(), BedrockAgentCore.MemoryProvider(), BedrockAgentCore.RuntimeProvider(), AccessAnalyzer.AnalyzerProvider(), AccessAnalyzer.ArchiveRuleProvider(), Textract.AdapterProvider(), Transfer.ServerProvider(), Transfer.UserProvider(), Translate.ParallelDataProvider(), Translate.TerminologyProvider(), VerifiedPermissions.IdentitySourceProvider(), VerifiedPermissions.PolicyProvider(), VerifiedPermissions.PolicyStoreProvider(), VerifiedPermissions.PolicyStoreAliasProvider(), VerifiedPermissions.PolicyTemplateProvider(), VerifiedPermissions.SchemaProvider(), Backup.BackupVaultProvider(), Backup.BackupPlanProvider(), Backup.BackupSelectionProvider(), BackupSearch.SearchJobProvider(), BackupSearch.ExportJobProvider(), BCMDataExports.ExportProvider(), Budgets.BudgetProvider(), Budgets.BudgetActionProvider(), Chatbot.AssociationProvider(), Chatbot.CustomActionProvider(), Chatbot.MicrosoftTeamsChannelConfigurationProvider(), Chatbot.SlackChannelConfigurationProvider(), GuardDuty.DetectorProvider(), GuardDuty.FilterProvider(), GuardDuty.IPSetProvider(), GuardDuty.ThreatIntelSetProvider(), ImageBuilder.ComponentProvider(), ImageBuilder.DistributionConfigurationProvider(), ImageBuilder.ImagePipelineProvider(), ImageBuilder.ImageRecipeProvider(), ImageBuilder.InfrastructureConfigurationProvider(), Inspector2.CisScanConfigurationProvider(), Inspector2.EnablerProvider(), Inspector2.FilterProvider(), InternetMonitor.MonitorProvider(), SecurityHub.ActionTargetProvider(), SecurityHub.AutomationRuleProvider(), SecurityHub.FindingAggregatorProvider(), SecurityHub.HubProvider(), SecurityHub.InsightProvider(), SecurityLake.DataLakeProvider(), SecurityLake.AwsLogSourceProvider(), SecurityLake.CustomLogSourceProvider(), SecurityLake.ExceptionSubscriptionProvider(), SecurityLake.SubscriberProvider(), SecurityLake.SubscriberNotificationProvider(), Detective.GraphProvider(), FMS.AdminAccountProvider(), Macie2.SessionProvider(), Macie2.ClassificationJobProvider(), Macie2.AllowListProvider(), Macie2.CustomDataIdentifierProvider(), Macie2.FindingsFilterProvider(), RAM.PermissionProvider(), RAM.ResourceShareProvider()), Layer.mergeAll(AIOps.InvestigationGroupProvider(), AuditManager.AssessmentProvider(), AuditManager.ControlProvider(), AuditManager.FrameworkProvider(), ApplicationSignals.DiscoveryProvider(), ApplicationSignals.GroupingConfigurationProvider(), ApplicationSignals.InstrumentationConfigurationProvider(), ApplicationSignals.ServiceLevelObjectiveProvider(), LicenseManager.LicenseConfigurationProvider(), LexV2.BotProvider(), LexV2.BotAliasProvider(), LexV2.BotLocaleProvider(), LexV2.BotVersionProvider(), LexV2.IntentProvider(), LexV2.SlotTypeProvider(), S3Files.FileSystemProvider(), S3Files.AccessPointProvider(), S3Tables.TableBucketProvider(), S3Tables.NamespaceProvider(), S3Tables.TableProvider(), flociDual(S3Vectors.VectorBucket, () => S3Vectors.VectorBucketProvider()), flociDual(S3Vectors.Index, () => S3Vectors.IndexProvider()), SageMaker.ModelProvider(), SageMaker.EndpointConfigProvider(), SageMaker.EndpointProvider(), SageMaker.FeatureGroupProvider(), SageMaker.ClusterProvider(), SageMaker.ClusterSchedulerConfigProvider(), SageMaker.ComputeQuotaProvider(), Account.AccountNameProvider(), Account.AlternateContactProvider(), Account.ContactInformationProvider(), Account.RegionProvider(), Amplify.AppProvider(), Amplify.BranchProvider(), ECRPublic.PublicRepositoryProvider(), VpcLattice.ServiceNetworkProvider(), VpcLattice.ServiceProvider(), VpcLattice.ServiceNetworkVpcAssociationProvider(), VpcLattice.AuthPolicyProvider(), VpcLattice.ResourcePolicyProvider(), VpcLattice.ServiceNetworkServiceAssociationProvider(), VpcLattice.TargetGroupProvider(), VpcLattice.ListenerProvider(), VpcLattice.RuleProvider(), VpcLattice.AccessLogSubscriptionProvider(), MWAA.EnvironmentProvider(), MWAAServerless.WorkflowProvider(), Location.ApiKeyProvider(), Location.MapProvider(), Location.PlaceIndexProvider(), Location.RouteCalculatorProvider(), Location.GeofenceCollectionProvider(), Location.TrackerProvider(), Location.TrackerConsumerProvider(), Forecast.DatasetGroupProvider(), Forecast.DatasetProvider(), FraudDetector.DetectorProvider(), FraudDetector.DetectorVersionProvider(), FraudDetector.EntityTypeProvider(), FraudDetector.EventTypeProvider(), FraudDetector.LabelProvider(), FraudDetector.ListProvider(), FraudDetector.OutcomeProvider(), FraudDetector.VariableProvider(), Personalize.SchemaProvider(), Personalize.DatasetGroupProvider(), Personalize.DatasetProvider(), Personalize.EventTrackerProvider(), PinpointSMSVoiceV2.ConfigurationSetProvider(), PinpointSMSVoiceV2.EventDestinationProvider(), PinpointSMSVoiceV2.OptOutListProvider(), PinpointSMSVoiceV2.PhoneNumberProvider(), IoT.ThingProvider(), IoT.ThingTypeProvider(), IoT.PolicyProvider(), IoT.TopicRuleProvider(), IoTFleetWise.CampaignProvider(), IoTFleetWise.DecoderManifestProvider(), IoTFleetWise.FleetProvider(), IoTFleetWise.ModelManifestProvider(), IoTFleetWise.SignalCatalogProvider(), IoTFleetWise.StateTemplateProvider(), IoTFleetWise.VehicleProvider(), IoTManagedIntegrations.CredentialLockerProvider(), IoTManagedIntegrations.DestinationProvider(), IoTManagedIntegrations.ManagedThingProvider(), IoTManagedIntegrations.NotificationConfigurationProvider(), IoTSiteWise.AssetModelProvider(), IoTSiteWise.AssetProvider(), IoTSiteWise.GatewayProvider(), IoTWireless.DestinationProvider(), IoTWireless.DeviceProfileProvider(), IoTWireless.ServiceProfileProvider(), IoTWireless.WirelessDeviceProvider(), IoTWireless.WirelessGatewayProvider(), ResourceGroups.GroupProvider(), RolesAnywhere.CrlProvider(), RolesAnywhere.ProfileProvider(), RolesAnywhere.TrustAnchorProvider(), Synthetics.CanaryProvider(), Synthetics.GroupProvider(), SSMContacts.ContactProvider(), SSMContacts.ContactChannelProvider(), SSMContacts.PlanProvider(), SSMContacts.RotationProvider(), SSMIncidents.ReplicationSetProvider(), SSMIncidents.ResponsePlanProvider()), Layer.mergeAll(FinSpace.EnvironmentProvider(), FinSpace.KxClusterProvider(), FinSpace.KxDatabaseProvider(), FinSpace.KxEnvironmentProvider(), ControlTower.EnabledBaselineProvider(), ControlTower.EnabledControlProvider(), ControlTower.LandingZoneProvider(), CostAndUsageReport.ReportDefinitionProvider(), CostExplorer.AnomalyMonitorProvider(), CostExplorer.AnomalySubscriptionProvider(), CostExplorer.CostCategoryProvider(), Rbin.RuleProvider(), RUM.AppMonitorProvider(), RUM.MetricsDestinationProvider(), RUM.ResourcePolicyProvider(), EMR.ClusterProvider(), EMR.SecurityConfigurationProvider(), EMR.StudioProvider(), EMRContainers.JobTemplateProvider(), EMRContainers.VirtualClusterProvider(), EMRServerless.ApplicationProvider(), EntityResolution.SchemaMappingProvider(), EntityResolution.MatchingWorkflowProvider(), EntityResolution.IdNamespaceProvider(), EntityResolution.IdMappingWorkflowProvider(), Schemas.DiscovererProvider(), Schemas.RegistryProvider(), Schemas.SchemaProvider(), Route53Profiles.ProfileProvider(), Route53Profiles.ProfileAssociationProvider(), Route53Profiles.ProfileResourceAssociationProvider(), Route53Resolver.ResolverEndpointProvider(), Route53Resolver.ResolverRuleProvider(), Route53Resolver.ResolverRuleAssociationProvider(), Shield.ProtectionProvider(), Shield.ProtectionGroupProvider(), Shield.SubscriptionProvider(), Signer.ProfilePermissionProvider(), Signer.SigningProfileProvider(), SimpleDB.DomainProvider(), Timestream.DatabaseProvider(), Timestream.DbInstanceProvider(), Timestream.ScheduledQueryProvider(), Timestream.TableProvider(), ResourceExplorer.IndexProvider(), ResourceExplorer.ViewProvider(), Notifications.ChannelAssociationProvider(), Notifications.EventRuleProvider(), Notifications.NotificationConfigurationProvider(), Notifications.NotificationHubProvider(), NotificationsContacts.EmailContactProvider(), OAM.LinkProvider(), OAM.SinkProvider(), ObservabilityAdmin.TelemetryConfigProvider(), ObservabilityAdmin.TelemetryRuleProvider(), Omics.AnnotationStoreProvider(), Omics.ReferenceStoreProvider(), Omics.RunGroupProvider(), Omics.SequenceStoreProvider(), Omics.VariantStoreProvider(), Omics.WorkflowProvider(), GlobalAccelerator.AcceleratorProvider(), GlobalAccelerator.ListenerProvider(), GlobalAccelerator.EndpointGroupProvider(), AppRegistry.ApplicationProvider(), AppRegistry.AttributeGroupProvider(), AppRegistry.AttributeGroupAssociationProvider(), AppRegistry.ResourceAssociationProvider(), ServiceCatalog.PortfolioProvider(), ServiceCatalog.PortfolioProductAssociationProvider(), ServiceCatalog.PrincipalPortfolioAssociationProvider(), ServiceCatalog.ProductProvider(), ServiceQuotas.ServiceQuotaIncreaseRequestProvider(), S3Control.AccessPointProvider(), S3Control.AccessPointPolicyProvider(), S3Control.MultiRegionAccessPointProvider(), S3Control.ObjectLambdaAccessPointProvider(), S3Control.StorageLensConfigurationProvider(), NetworkFirewall.RuleGroupProvider(), NetworkFirewall.FirewallPolicyProvider(), NetworkFirewall.FirewallProvider(), NetworkFirewall.LoggingConfigurationProvider(), CloudTrail.EventDataStoreProvider(), CloudTrail.TrailProvider(), IVS.ChannelProvider(), IVS.PlaybackKeyPairProvider(), IVS.PlaybackRestrictionPolicyProvider(), IVS.RecordingConfigurationProvider(), IVS.StreamKeyProvider(), IVSChat.LoggingConfigurationProvider(), IVSChat.RoomProvider(), IVSRealtime.StageProvider()))), 
+WebsiteServerProvider(), XRay.GroupProvider(), XRay.ResourcePolicyProvider(), XRay.SamplingRuleProvider(), Bedrock.AgentProvider(), Bedrock.AgentAliasProvider(), Bedrock.DataSourceProvider(), Bedrock.KnowledgeBaseProvider(), BedrockAgentCore.BrowserCustomProvider(), BedrockAgentCore.CodeInterpreterProvider(), BedrockAgentCore.GatewayProvider(), BedrockAgentCore.MemoryProvider(), BedrockAgentCore.RuntimeProvider(), AccessAnalyzer.AnalyzerProvider(), AccessAnalyzer.ArchiveRuleProvider(), Textract.AdapterProvider(), Transfer.ServerProvider(), Transfer.UserProvider(), Translate.ParallelDataProvider(), Translate.TerminologyProvider(), VerifiedPermissions.IdentitySourceProvider(), VerifiedPermissions.PolicyProvider(), VerifiedPermissions.PolicyStoreProvider(), VerifiedPermissions.PolicyStoreAliasProvider(), VerifiedPermissions.PolicyTemplateProvider(), VerifiedPermissions.SchemaProvider(), Backup.BackupVaultProvider(), Backup.BackupPlanProvider(), Backup.BackupSelectionProvider(), BackupSearch.SearchJobProvider(), BackupSearch.ExportJobProvider(), BCMDataExports.ExportProvider(), Budgets.BudgetProvider(), Budgets.BudgetActionProvider(), Chatbot.AssociationProvider(), Chatbot.CustomActionProvider(), Chatbot.MicrosoftTeamsChannelConfigurationProvider(), Chatbot.SlackChannelConfigurationProvider(), GuardDuty.DetectorProvider(), GuardDuty.FilterProvider(), GuardDuty.IPSetProvider(), GuardDuty.ThreatIntelSetProvider(), ImageBuilder.ComponentProvider(), ImageBuilder.DistributionConfigurationProvider(), ImageBuilder.ImagePipelineProvider(), ImageBuilder.ImageRecipeProvider(), ImageBuilder.InfrastructureConfigurationProvider(), Inspector2.CisScanConfigurationProvider(), Inspector2.EnablerProvider(), Inspector2.FilterProvider(), InternetMonitor.MonitorProvider(), SecurityHub.ActionTargetProvider(), SecurityHub.AutomationRuleProvider(), SecurityHub.FindingAggregatorProvider(), SecurityHub.HubProvider(), SecurityHub.InsightProvider(), SecurityLake.DataLakeProvider(), SecurityLake.AwsLogSourceProvider(), SecurityLake.CustomLogSourceProvider(), SecurityLake.ExceptionSubscriptionProvider(), SecurityLake.SubscriberProvider(), SecurityLake.SubscriberNotificationProvider(), Detective.GraphProvider(), FMS.AdminAccountProvider(), Macie2.SessionProvider(), Macie2.ClassificationJobProvider(), Macie2.AllowListProvider(), Macie2.CustomDataIdentifierProvider(), Macie2.FindingsFilterProvider(), RAM.PermissionProvider(), RAM.ResourceShareProvider()), Layer.mergeAll(AIOps.InvestigationGroupProvider(), AuditManager.AssessmentProvider(), AuditManager.ControlProvider(), AuditManager.FrameworkProvider(), ApplicationSignals.DiscoveryProvider(), ApplicationSignals.GroupingConfigurationProvider(), ApplicationSignals.InstrumentationConfigurationProvider(), ApplicationSignals.ServiceLevelObjectiveProvider(), LicenseManager.LicenseConfigurationProvider(), LexV2.BotProvider(), LexV2.BotAliasProvider(), LexV2.BotLocaleProvider(), LexV2.BotVersionProvider(), LexV2.IntentProvider(), LexV2.SlotTypeProvider(), S3Files.FileSystemProvider(), S3Files.AccessPointProvider(), S3Tables.TableBucketProvider(), S3Tables.NamespaceProvider(), S3Tables.TableProvider(), flociDual(S3Vectors.VectorBucket, () => S3Vectors.VectorBucketProvider()), flociDual(S3Vectors.Index, () => S3Vectors.IndexProvider()), SageMaker.ModelProvider(), SageMaker.EndpointConfigProvider(), SageMaker.EndpointProvider(), SageMaker.FeatureGroupProvider(), SageMaker.ClusterProvider(), SageMaker.ClusterSchedulerConfigProvider(), SageMaker.ComputeQuotaProvider(), Account.AccountNameProvider(), Account.AlternateContactProvider(), Account.ContactInformationProvider(), Account.RegionProvider(), Amplify.AppProvider(), Amplify.BranchProvider(), ECRPublic.PublicRepositoryProvider(), VpcLattice.ServiceNetworkProvider(), VpcLattice.ServiceProvider(), VpcLattice.ServiceNetworkVpcAssociationProvider(), VpcLattice.AuthPolicyProvider(), VpcLattice.ResourcePolicyProvider(), VpcLattice.ServiceNetworkServiceAssociationProvider(), VpcLattice.TargetGroupProvider(), VpcLattice.ListenerProvider(), VpcLattice.RuleProvider(), VpcLattice.AccessLogSubscriptionProvider(), MWAA.EnvironmentProvider(), MWAAServerless.WorkflowProvider(), Location.ApiKeyProvider(), Location.MapProvider(), Location.PlaceIndexProvider(), Location.RouteCalculatorProvider(), Location.GeofenceCollectionProvider(), Location.TrackerProvider(), Location.TrackerConsumerProvider(), Forecast.DatasetGroupProvider(), Forecast.DatasetProvider(), FraudDetector.DetectorProvider(), FraudDetector.DetectorVersionProvider(), FraudDetector.EntityTypeProvider(), FraudDetector.EventTypeProvider(), FraudDetector.LabelProvider(), FraudDetector.ListProvider(), FraudDetector.OutcomeProvider(), FraudDetector.VariableProvider(), Personalize.SchemaProvider(), Personalize.DatasetGroupProvider(), Personalize.DatasetProvider(), Personalize.EventTrackerProvider(), PinpointSMSVoiceV2.ConfigurationSetProvider(), PinpointSMSVoiceV2.EventDestinationProvider(), PinpointSMSVoiceV2.OptOutListProvider(), PinpointSMSVoiceV2.PhoneNumberProvider(), IoT.ThingProvider(), IoT.ThingTypeProvider(), IoT.PolicyProvider(), IoT.TopicRuleProvider(), IoTFleetWise.CampaignProvider(), IoTFleetWise.DecoderManifestProvider(), IoTFleetWise.FleetProvider(), IoTFleetWise.ModelManifestProvider(), IoTFleetWise.SignalCatalogProvider(), IoTFleetWise.StateTemplateProvider(), IoTFleetWise.VehicleProvider(), IoTManagedIntegrations.CredentialLockerProvider(), IoTManagedIntegrations.DestinationProvider(), IoTManagedIntegrations.ManagedThingProvider(), IoTManagedIntegrations.NotificationConfigurationProvider(), IoTSiteWise.AssetModelProvider(), IoTSiteWise.AssetProvider(), IoTSiteWise.GatewayProvider(), IoTWireless.DestinationProvider(), IoTWireless.DeviceProfileProvider(), IoTWireless.ServiceProfileProvider(), IoTWireless.WirelessDeviceProvider(), IoTWireless.WirelessGatewayProvider(), ResourceGroups.GroupProvider(), RolesAnywhere.CrlProvider(), RolesAnywhere.ProfileProvider(), RolesAnywhere.TrustAnchorProvider(), Synthetics.CanaryProvider(), Synthetics.GroupProvider(), SSMContacts.ContactProvider(), SSMContacts.ContactChannelProvider(), SSMContacts.PlanProvider(), SSMContacts.RotationProvider(), SSMIncidents.ReplicationSetProvider(), SSMIncidents.ResponsePlanProvider()), Layer.mergeAll(FinSpace.EnvironmentProvider(), FinSpace.KxClusterProvider(), FinSpace.KxDatabaseProvider(), FinSpace.KxEnvironmentProvider(), ControlTower.EnabledBaselineProvider(), ControlTower.EnabledControlProvider(), ControlTower.LandingZoneProvider(), CostAndUsageReport.ReportDefinitionProvider(), CostExplorer.AnomalyMonitorProvider(), CostExplorer.AnomalySubscriptionProvider(), CostExplorer.CostCategoryProvider(), Rbin.RuleProvider(), RUM.AppMonitorProvider(), RUM.MetricsDestinationProvider(), RUM.ResourcePolicyProvider(), EMR.ClusterProvider(), EMR.SecurityConfigurationProvider(), EMR.StudioProvider(), EMRContainers.JobTemplateProvider(), EMRContainers.VirtualClusterProvider(), EMRServerless.ApplicationProvider(), EntityResolution.SchemaMappingProvider(), EntityResolution.MatchingWorkflowProvider(), EntityResolution.IdNamespaceProvider(), EntityResolution.IdMappingWorkflowProvider(), Schemas.DiscovererProvider(), Schemas.RegistryProvider(), Schemas.SchemaProvider(), Route53Profiles.ProfileProvider(), Route53Profiles.ProfileAssociationProvider(), Route53Profiles.ProfileResourceAssociationProvider(), Route53Resolver.ResolverEndpointProvider(), Route53Resolver.ResolverRuleProvider(), Route53Resolver.ResolverRuleAssociationProvider(), Shield.ProtectionProvider(), Shield.ProtectionGroupProvider(), Shield.SubscriptionProvider(), Signer.ProfilePermissionProvider(), Signer.SigningProfileProvider(), SimpleDB.DomainProvider(), Timestream.DatabaseProvider(), Timestream.DbInstanceProvider(), Timestream.ScheduledQueryProvider(), Timestream.TableProvider(), ResourceExplorer.IndexProvider(), ResourceExplorer.ViewProvider(), Notifications.ChannelAssociationProvider(), Notifications.EventRuleProvider(), Notifications.NotificationConfigurationProvider(), Notifications.NotificationHubProvider(), NotificationsContacts.EmailContactProvider(), OAM.LinkProvider(), OAM.SinkProvider(), ObservabilityAdmin.TelemetryConfigProvider(), ObservabilityAdmin.TelemetryRuleProvider(), Omics.AnnotationStoreProvider(), Omics.ReferenceStoreProvider(), Omics.RunGroupProvider(), Omics.SequenceStoreProvider(), Omics.VariantStoreProvider(), Omics.WorkflowProvider(), GlobalAccelerator.AcceleratorProvider(), GlobalAccelerator.ListenerProvider(), GlobalAccelerator.EndpointGroupProvider(), AppRegistry.ApplicationProvider(), AppRegistry.AttributeGroupProvider(), AppRegistry.AttributeGroupAssociationProvider(), AppRegistry.ResourceAssociationProvider(), ServiceCatalog.PortfolioProvider(), ServiceCatalog.PortfolioProductAssociationProvider(), ServiceCatalog.PrincipalPortfolioAssociationProvider(), ServiceCatalog.ProductProvider(), ServiceQuotas.ServiceQuotaIncreaseRequestProvider(), S3Control.AccessPointProvider(), S3Control.AccessPointPolicyProvider(), S3Control.MultiRegionAccessPointProvider(), S3Control.ObjectLambdaAccessPointProvider(), S3Control.StorageLensConfigurationProvider(), NetworkFirewall.RuleGroupProvider(), NetworkFirewall.FirewallPolicyProvider(), NetworkFirewall.FirewallProvider(), NetworkFirewall.LoggingConfigurationProvider(), CloudTrail.EventDataStoreProvider(), CloudTrail.TrailProvider(), IVS.ChannelProvider(), IVS.PlaybackKeyPairProvider(), IVS.PlaybackRestrictionPolicyProvider(), IVS.RecordingConfigurationProvider(), IVS.StreamKeyProvider(), IVSChat.LoggingConfigurationProvider(), IVSChat.RoomProvider(), IVSRealtime.StageProvider()))), 
 // The `aws-eks` Kubernetes cluster adapter is provideMerged (not just
 // provided) so the cluster-agnostic `Kubernetes.*` workload providers
 // can resolve it dynamically from the ambient stack context.
@@ -993,7 +1021,21 @@ Layer.provideMerge(EC2.GetAmiHttp), Layer.provideMerge(Region.fromEnvironment),
 // parallel deploys ride out S3 `SlowDown` bursts that span more than
 // a few seconds. Bounded so real rate-limit pressure still surfaces
 // instead of masking as an indefinite hang.
-Layer.provideMerge(Layer.succeed(Retry, awsRetryFactory)), Layer.orDie);
+Layer.provideMerge(Layer.succeed(Retry, awsRetryFactory)), 
+// In an `alchemy dev` run the AMBIENT environment — what stack
+// composition code, plan-time data sources (`AWS.EC2.getAmi`), and any
+// raw distilled call see — is the EMULATOR, so dev needs no real
+// credentials and no call-site routing. The providers above were built
+// beneath the live chain and keep it (their lifecycle ops close over
+// their build context): live-mode and mode-agnostic resources still hit
+// the real cloud, and local variants override per-resource via their
+// registered data plane. `Layer.merge`'s second layer wins duplicate
+// tags, which is exactly the shadowing we want; `Alchemy.remote()`
+// resources stay live through the per-resource binding routing.
+(base) => Layer.unwrap(Effect.gen(function* () {
+    const mode = yield* defaultProviderMode;
+    return mode === "local" ? Layer.merge(base, flociServices()) : base;
+})), Layer.orDie);
 // Node socket-level error codes that indicate a transient network failure.
 const TRANSIENT_NETWORK_CODES = new Set([
     "ETIMEDOUT",