alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/src/AWS/ElastiCache/SubnetGroup.ts

@@ -0,0 +1,208 @@
+import * as elasticache from "@distilled.cloud/aws/elasticache";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.ts";
+import type { Providers } from "../Providers.ts";
+import { readElastiCacheTags, sameStringSet, tagsToWire } from "./internal.ts";
+
+export interface SubnetGroupProps {
+  /** Name of the subnet group. Generated deterministically when omitted. */
+  subnetGroupName?: string;
+  /** Human-readable description. */
+  description: string;
+  /** VPC subnet IDs. Use at least two AZs for a highly-available cache. */
+  subnetIds: string[];
+  /** User-defined tags. */
+  tags?: Record<string, string>;
+}
+
+export interface SubnetGroup extends Resource<
+  "AWS.ElastiCache.SubnetGroup",
+  SubnetGroupProps,
+  {
+    subnetGroupName: string;
+    subnetGroupArn: string;
+    description: string | undefined;
+    vpcId: string | undefined;
+    subnetIds: string[];
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A VPC subnet group for provisioned ElastiCache resources.
+ *
+ * ### Creating a Subnet Group
+ * **Example:** Two Availability Zones
+ * ```typescript
+ * const subnets = yield* SubnetGroup("CacheSubnets", {
+ *   description: "cache subnets",
+ *   subnetIds: [subnetA.subnetId, subnetB.subnetId],
+ * });
+ * ```
+ *
+ * @resource
+ */
+export const SubnetGroup = Resource<SubnetGroup>("AWS.ElastiCache.SubnetGroup");
+
+export const SubnetGroupProvider = () =>
+  Provider.effect(
+    SubnetGroup,
+    Effect.gen(function* () {
+      const toName = (id: string, props: SubnetGroupProps) =>
+        props.subnetGroupName
+          ? Effect.succeed(props.subnetGroupName)
+          : createPhysicalName({ id, maxLength: 40, lowercase: true });
+      const readGroup = Effect.fn(function* (name: string) {
+        const response = yield* elasticache
+          .describeCacheSubnetGroups({ CacheSubnetGroupName: name })
+          .pipe(
+            Effect.catchTag("CacheSubnetGroupNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.CacheSubnetGroups?.[0];
+      });
+      const attrs = Effect.fn(function* (group: elasticache.CacheSubnetGroup) {
+        if (!group.CacheSubnetGroupName || !group.ARN) {
+          return yield* Effect.fail(
+            new Error("ElastiCache subnet group is missing its name or ARN"),
+          );
+        }
+        return {
+          subnetGroupName: group.CacheSubnetGroupName,
+          subnetGroupArn: group.ARN,
+          description: group.CacheSubnetGroupDescription,
+          vpcId: group.VpcId,
+          subnetIds: (group.Subnets ?? [])
+            .map((subnet) => subnet.SubnetIdentifier)
+            .filter((id): id is string => id !== undefined),
+          tags: yield* readElastiCacheTags(group.ARN),
+        };
+      });
+
+      return {
+        stables: ["subnetGroupName", "subnetGroupArn"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* toName(id, olds ?? { description: "", subnetIds: [] })) !==
+            (yield* toName(id, news ?? { description: "", subnetIds: [] }))
+          )
+            return { action: "replace" } as const;
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const group = yield* readGroup(
+            output?.subnetGroupName ??
+              (yield* toName(id, olds ?? { description: "", subnetIds: [] })),
+          );
+          if (!group?.ARN) return undefined;
+          const result = yield* attrs(group);
+          return (yield* hasAlchemyTags(id, result.tags))
+            ? result
+            : Unowned(result);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const props = news!;
+          const name = output?.subnetGroupName ?? (yield* toName(id, props));
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...props.tags,
+          };
+          let group = yield* readGroup(name);
+          if (!group) {
+            yield* elasticache
+              .createCacheSubnetGroup({
+                CacheSubnetGroupName: name,
+                CacheSubnetGroupDescription: props.description,
+                SubnetIds: props.subnetIds,
+                Tags: tagsToWire(desiredTags),
+              })
+              .pipe(
+                Effect.catchTag(
+                  "CacheSubnetGroupAlreadyExistsFault",
+                  () => Effect.void,
+                ),
+              );
+            group = yield* readGroup(name);
+          }
+          if (!group)
+            return yield* Effect.fail(
+              new Error(`Subnet group '${name}' not found after create`),
+            );
+          const observedSubnets = (group.Subnets ?? [])
+            .map((subnet) => subnet.SubnetIdentifier)
+            .filter((id): id is string => id !== undefined);
+          if (
+            group.CacheSubnetGroupDescription !== props.description ||
+            !sameStringSet(observedSubnets, props.subnetIds)
+          ) {
+            group =
+              (yield* elasticache.modifyCacheSubnetGroup({
+                CacheSubnetGroupName: name,
+                CacheSubnetGroupDescription: props.description,
+                SubnetIds: props.subnetIds,
+              })).CacheSubnetGroup ?? group;
+          }
+          if (group.ARN) {
+            const { removed, upsert } = diffTags(
+              yield* readElastiCacheTags(group.ARN),
+              desiredTags,
+            );
+            if (upsert.length)
+              yield* elasticache.addTagsToResource({
+                ResourceName: group.ARN,
+                Tags: upsert,
+              });
+            if (removed.length)
+              yield* elasticache.removeTagsFromResource({
+                ResourceName: group.ARN,
+                TagKeys: removed,
+              });
+          }
+          yield* session.note(name);
+          return yield* attrs(group);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* elasticache
+            .deleteCacheSubnetGroup({
+              CacheSubnetGroupName: output.subnetGroupName,
+            })
+            .pipe(
+              Effect.catchTag(
+                "CacheSubnetGroupNotFoundFault",
+                () => Effect.void,
+              ),
+              Effect.retry({
+                while: (error) => error._tag === "CacheSubnetGroupInUse",
+                schedule: Schedule.max([
+                  Schedule.fixed("5 seconds"),
+                  Schedule.recurs(8),
+                ]),
+              }),
+            );
+        }),
+        list: () =>
+          elasticache.describeCacheSubnetGroups.pages({}).pipe(
+            Stream.runCollect,
+            Effect.map((pages) =>
+              Array.from(pages).flatMap((page) => page.CacheSubnetGroups ?? []),
+            ),
+            Effect.flatMap((groups) =>
+              Effect.forEach(
+                groups.filter((group) => group.ARN),
+                attrs,
+              ),
+            ),
+          ),
+      };
+    }),
+  );

package/src/AWS/ElastiCache/index.ts

@@ -1,6 +1,11 @@
 export * from "./CacheEventSource.ts";
+export * from "./CacheCluster.ts";
 export * from "./Connect.ts";
 export * from "./ConnectHttp.ts";
+export * from "./ConnectCacheCluster.ts";
+export * from "./ConnectCacheClusterHttp.ts";
+export * from "./ConnectReplicationGroup.ts";
+export * from "./ConnectReplicationGroupHttp.ts";
 export * from "./CopyServerlessCacheSnapshot.ts";
 export * from "./CopyServerlessCacheSnapshotHttp.ts";
 export * from "./CreateServerlessCacheSnapshot.ts";
@@ -16,3 +21,5 @@ export * from "./DescribeServerlessCachesHttp.ts";
 export * from "./ExportServerlessCacheSnapshot.ts";
 export * from "./ExportServerlessCacheSnapshotHttp.ts";
 export * from "./ServerlessCache.ts";
+export * from "./ReplicationGroup.ts";
+export * from "./SubnetGroup.ts";

package/src/AWS/ElastiCache/internal.ts

@@ -0,0 +1,36 @@
+import * as elasticache from "@distilled.cloud/aws/elasticache";
+import * as Effect from "effect/Effect";
+
+export const toTagRecord = (
+  tags: Array<{ Key?: string; Value?: string }> | undefined,
+): Record<string, string> =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is { Key: string; Value: string } =>
+          tag.Key !== undefined && tag.Value !== undefined,
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+/** Read tags after a resource has reached an observable state. */
+export const readElastiCacheTags = Effect.fn(function* (arn: string) {
+  const response = yield* elasticache
+    .listTagsForResource({ ResourceName: arn })
+    .pipe(Effect.catch(() => Effect.succeed(undefined)));
+  return toTagRecord(response?.TagList);
+});
+
+export const sameStringSet = (
+  a: readonly string[] | undefined,
+  b: readonly string[] | undefined,
+): boolean => {
+  const left = [...new Set(a ?? [])].sort();
+  const right = [...new Set(b ?? [])].sort();
+  return (
+    left.length === right.length && left.every((value, i) => value === right[i])
+  );
+};
+
+export const tagsToWire = (tags: Record<string, string>) =>
+  Object.entries(tags).map(([Key, Value]) => ({ Key, Value }));

package/src/AWS/Environment.ts

@@ -7,11 +7,7 @@ import * as Context from "effect/Context";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as Option from "effect/Option";
-import * as Result from "effect/Result";
-import { AlchemyContext } from "../AlchemyContext.ts";
-import { getAuthProvider } from "../Auth/AuthProvider.ts";
-import { ALCHEMY_PROFILE, AlchemyProfile } from "../Auth/Profile.ts";
+import { resolveProviderConfig } from "../Auth/Resolve.ts";
 import {
   AWS_AUTH_PROVIDER_NAME,
   LOCAL_ACCOUNT_ID,
@@ -63,7 +59,7 @@ export class AWSEnvironment extends Context.Service<
 >()("AWS::Environment") {
   static current = AWSEnvironment.use((env) => env);
   /**
-   * Whether this environment is the floci / `{ method: "local" }` emulator
+   * Whether this environment is the floci emulator
    * (dummy account {@link LOCAL_ACCOUNT_ID}). A set `endpoint` is not
    * enough: `AWS_ENDPOINT_URL` and explicit endpoint overrides also
    * populate it on real-account credentials.
@@ -81,48 +77,19 @@ export const isLocalEmulator = AWSEnvironment.isLocalEmulator;
 export const Default = Layer.effect(
   AWSEnvironment,
   Effect.gen(function* () {
-    const profile = yield* AlchemyProfile;
-    const auth = yield* getAuthProvider<AwsAuthConfig, AwsResolvedCredentials>(
-      AWS_AUTH_PROVIDER_NAME,
-    );
-    const profileName = yield* ALCHEMY_PROFILE;
-    const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
-    const dev = Option.match(yield* Effect.serviceOption(AlchemyContext), {
-      onNone: () => false,
-      onSome: (ctx) => ctx.dev,
-    });
-
-    // The pre-existing resolution path: stored profile config (or, when
-    // nothing is stored, the interactive configure flow / non-interactive
-    // AuthError) → resolved credentials. Deploy-mode behavior is unchanged.
-    const resolveConfigured = profile
-      .loadOrConfigure(auth, profileName, { ci })
-      .pipe(Effect.flatMap((config) => auth.read(profileName, config)));
-
-    // Credential-free dev: an `alchemy dev` run must work with zero AWS
-    // credentials. When nothing is configured for the active profile, try
-    // ambient env-var credentials first (a developer who exported AWS_*
-    // wants the real cloud), then fall back to the local emulator — the
-    // same environment `{ method: "local" }` produces (dummy creds,
-    // account 000000000000, endpoint localhost:4566, ensureFloci).
-    // A profile that IS configured keeps its normal resolution (and its
-    // normal failures) even in dev.
-    const resolveDev = Effect.gen(function* () {
-      const stored = yield* profile.getProfile(profileName);
-      if (stored?.[AWS_AUTH_PROVIDER_NAME] != null) {
-        return yield* resolveConfigured;
-      }
-      const fromEnv = yield* Effect.result(
-        auth.read(profileName, { method: "env" }),
-      );
-      if (Result.isSuccess(fromEnv)) {
-        return fromEnv.success;
-      }
-      yield* Effect.logInfo("no AWS credentials — using the local emulator");
-      return yield* auth.read(profileName, { method: "local" });
-    });
-
-    return yield* (dev ? resolveDev : resolveConfigured).pipe(
+    // Provider layers are built on every run — before any profile may be
+    // configured — so nothing may resolve at construction. A dev run with
+    // zero AWS credentials builds this layer too (the ambient environment
+    // is the emulator; only `Alchemy.remote()` rows ever need it), so the
+    // profile/CI precedence is captured here and evaluated on first use,
+    // exactly once.
+    const resolve = resolveProviderConfig<
+      AwsAuthConfig,
+      AwsResolvedCredentials
+    >(AWS_AUTH_PROVIDER_NAME).pipe(Effect.flatMap(({ resolve }) => resolve));
+    const context = yield* Effect.context<Effect.Services<typeof resolve>>();
+    return yield* resolve.pipe(
+      Effect.provideContext(context),
       Effect.orDie,
       Effect.cached,
     );

package/src/AWS/IAM/actions.generated.ts

@@ -2,7 +2,7 @@
 //
 // Regenerate with: bun scripts/generate-iam-actions.ts
 //
-// Source: distilled/packages/aws/src/services/*.ts (429 service modules,
+// Source: submodules/distilled/packages/aws/src/services/*.ts (429 service modules,
 // 357 IAM action prefixes, 18270 operations).
 //
 // A SHALLOW literal union (no template-literal type computation) of

package/src/AWS/IdentityCenter/AccountAssignment.ts

@@ -330,6 +330,13 @@ const readAssignment = Effect.fn(function* ({
   principalType,
   targetId,
 }: AccountAssignmentProps) {
+  // A `creating` row can serialize without resolved Outputs (`targetId`
+  // from `account.accountId`, etc.). Distilled `ListAccountAssignments`
+  // then fails with `ParseError: Expected string at ["AccountId"]`.
+  if (!targetId || !permissionSetArn || !principalId) {
+    return undefined;
+  }
+
   const instance = yield* resolveInstance(instanceArn);
   const assignments = yield* ssoAdmin.listAccountAssignments
     .items({

package/src/AWS/Lambda/Function.ts

@@ -325,13 +325,11 @@ export interface FunctionZipProps extends FunctionCommonProps {
    */
   layers?: LayerRef[];
   /**
-   * Bundler configuration for {@link main}: rolldown input options (flat),
-   * `output` overrides, `install` for native packages, plus pure-annotation
-   * options (`pure`) and the bundle analyzer. Top-level calls in `effect`,
-   * `@effect/*`, `alchemy`, `@alchemy.run/*`, and `@distilled.cloud/*` are
-   * annotated as pure by default so unused code from those packages is
-   * tree-shaken; list additional packages via `pure.packages`, or disable
-   * with `pure: false`.
+   * Bundler configuration for {@link main}: rolldown input options, `output`
+   * overrides, `install` for native packages, `pure`, and the bundle analyzer.
+   * Unused code is tree-shaken. `effect`, alchemy, and `@distilled.cloud`
+   * are marked pure so unused parts prune more aggressively. List extra
+   * packages with `pure.packages`, or disable with `pure: false`.
    */
   build?: FunctionBuildOptions;
   uploadSourceMap?: boolean;
@@ -597,7 +595,7 @@ export const normalizeFunctionUrl = (
  * - **Async** — plain handler export, no Effect runtime in the bundle.
  * - **Effect** — Effect implementation with typed bindings and event sources.
  *
- * See [Effect handlers vs async handlers](/infrastructure-as-effects/functions-and-servers#effect-handlers-vs-async-handlers)
+ * See [Effect handlers vs async handlers](/infrastructure-as-effects/runtime#effect-handlers-vs-async-handlers)
  * for plain handler patterns, or the
  * [Lambda guide](/aws/compute/lambda)
  * for the full Effect-based approach with bindings, event sources, and sinks.
@@ -784,20 +782,13 @@ export const normalizeFunctionUrl = (
  * ```
  *
  * ### Bundling & Tree-shaking
- * `main` is bundled with rolldown at deploy time. Top-level calls in the
- * `effect`, `@effect/*`, `alchemy`, `@alchemy.run/*`, and
- * `@distilled.cloud/*` packages receive `#__PURE__` annotations by
- * default, so anything the function doesn't use from those packages is
- * tree-shaken out of the bundle. Any other package — including your own
- * app — is left untouched unless you list it explicitly.
+ * `main` is bundled with rolldown at deploy time. Unused code is
+ * tree-shaken. `effect`, alchemy, and `@distilled.cloud` are marked
+ * pure so unused parts prune more aggressively. Your app is not
+ * marked pure.
  *
- * **Example:** Treat additional packages as pure
- * Pass package names (or picomatch globs) via `build.pure.packages` to
- * annotate them in addition to the defaults. Listing a package that also
- * declares `"sideEffects": false` (or `[]`) in its `package.json` opts it
- * into full annotation — top-level calls whose result is discarded are
- * deleted under minification when unused — so only list packages whose
- * modules really are free of meaningful top-level side effects.
+ * **Example:** Mark additional packages as pure
+ * Only list packages with no top-level side effects.
  * ```typescript
  * const func = yield* AWS.Lambda.Function("ApiFunction", {
  *   main: "./src/handler.ts",
@@ -807,7 +798,7 @@ export const normalizeFunctionUrl = (
  * });
  * ```
  *
- * **Example:** Disable pure annotations
+ * **Example:** Turn it off
  * ```typescript
  * const func = yield* AWS.Lambda.Function("ApiFunction", {
  *   main: "./src/handler.ts",
@@ -1652,9 +1643,15 @@ export const FunctionProvider = () =>
             (e.message?.includes("KMS key is invalid for CreateGrant") &&
               e.message?.includes("ARN does not refer to a valid principal")));
 
-        const noteRolePropagationWait = () =>
+        const isSecurityGroupPropagationError = (
+          e: Lambda.CreateFunctionError,
+        ) =>
+          e._tag === "InvalidParameterValueException" &&
+          e.message?.includes("InvalidGroup.NotFound");
+
+        const noteCreateDependencyWait = () =>
           session.note(
-            `Waiting for Lambda execution role to become assumable: ${functionName} (${Math.ceil((Date.now() - waitStartedAt) / 1000)}s)`,
+            `Waiting for Lambda creation dependencies to propagate: ${functionName} (${Math.ceil((Date.now() - waitStartedAt) / 1000)}s)`,
           );
 
         const tags = yield* createInternalTags(id);
@@ -1772,7 +1769,7 @@ export const FunctionProvider = () =>
               }).pipe(
                 Effect.tapError((e) =>
                   isRolePropagationError(e)
-                    ? noteRolePropagationWait()
+                    ? noteCreateDependencyWait()
                     : Effect.void,
                 ),
                 Effect.retry({
@@ -1807,7 +1804,7 @@ export const FunctionProvider = () =>
               }).pipe(
                 Effect.tapError((e) =>
                   isRolePropagationError(e)
-                    ? noteRolePropagationWait()
+                    ? noteCreateDependencyWait()
                     : Effect.void,
                 ),
                 Effect.retry({
@@ -1829,9 +1826,10 @@ export const FunctionProvider = () =>
             }),
           ),
           Effect.retry({
-            while: (e) => isRolePropagationError(e),
+            while: (e) =>
+              isRolePropagationError(e) || isSecurityGroupPropagationError(e),
             schedule: Schedule.fixed(1000).pipe(
-              Schedule.tap(() => noteRolePropagationWait()),
+              Schedule.tap(() => noteCreateDependencyWait()),
             ),
           }),
           Effect.catchTags({

package/src/AWS/Lambda/MicrovmImage.ts

@@ -88,12 +88,10 @@ export interface MicrovmImageProps {
   external?: string[];
 
   /**
-   * Bundler configuration for {@link main} (effectful mode): rolldown
-   * `input`/`output` overrides plus pure-annotation options (`pure`).
-   * `effect`, `@effect/*`, `alchemy`, `@alchemy.run/*`, and
-   * `@distilled.cloud/*` are annotated as pure by default so unused code
-   * from those packages is tree-shaken; list additional packages via
-   * `pure.packages`, or disable with `pure: false`.
+   * Bundler configuration for {@link main} (effectful mode). Unused
+   * code is tree-shaken. `effect`, alchemy, and `@distilled.cloud` are
+   * marked pure so unused parts prune more aggressively. List extra
+   * packages with `pure.packages`, or disable with `pure: false`.
    */
   build?: Bundle.BundleConfig;
 
@@ -257,7 +255,7 @@ export type MicrovmImageShape = Main<MicrovmImageServices>;
  * - A **build role** (`buildRole`) Lambda assumes to read the code artifact and
  *   write build logs. Pass a {@link Role} instance and the required permissions
  *   are granted automatically — see the example below.
- * - A **bootstrapped Assets bucket** (`alchemy aws bootstrap`) for effectful /
+ * - A **bootstrapped Assets bucket** (`alchemy provider aws bootstrap`) for effectful /
  *   external modes, which upload the artifact to S3.
  * - The account must be **onboarded to the Lambda MicroVM preview**.
  *
@@ -407,16 +405,13 @@ export type MicrovmImageShape = Main<MicrovmImageServices>;
  * ```
  *
  * ### Bundling & Tree-shaking
- * `main` is bundled with rolldown at deploy time. Top-level calls in the
- * `effect`, `@effect/*`, `alchemy`, `@alchemy.run/*`, and
- * `@distilled.cloud/*` packages receive `#__PURE__` annotations by
- * default, so anything the MicroVM program doesn't use from those packages is
- * tree-shaken out of the bundle. Any other package — including your own
- * app — is left untouched unless you list it explicitly.
+ * `main` is bundled with rolldown at deploy time. Unused code is
+ * tree-shaken. `effect`, alchemy, and `@distilled.cloud` are marked
+ * pure so unused parts prune more aggressively. Your app is not
+ * marked pure.
  *
- * **Example:** Treat additional packages as pure
- * Pass package names (or picomatch globs) via `build.pure.packages` to
- * annotate them in addition to the defaults.
+ * **Example:** Mark additional packages as pure
+ * Only list packages with no top-level side effects.
  * ```typescript
  * {
  *   main: import.meta.url,
@@ -426,18 +421,7 @@ export type MicrovmImageShape = Main<MicrovmImageServices>;
  * }
  * ```
  *
- * Listing a package annotates calls whose result is bound (variable
- * initializers, exports) — safe anywhere. If a listed package also
- * declares `"sideEffects": false` (or `[]`) in its `package.json`, that
- * combination opts it into full annotation: top-level calls whose result
- * is discarded (e.g. `router.on("/path", handler)` registrations) are
- * also marked pure and deleted under minification when unused. Only list
- * a `sideEffects: false` package if its modules really are free of
- * meaningful top-level side effects. The `effect`, `alchemy`, and
- * `@distilled.cloud` defaults declare exactly that, on purpose — their
- * modules are designed to be fully tree-shakeable.
- *
- * **Example:** Disable pure annotations
+ * **Example:** Turn it off
  * ```typescript
  * {
  *   main: import.meta.url,

package/src/AWS/Lambda/MicrovmProvider.ts

@@ -9,7 +9,7 @@ import * as Stream from "effect/Stream";
 
 import type { ValidationException } from "@distilled.cloud/aws/Errors";
 import * as Artifacts from "../../Artifacts.ts";
-import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import type { ScopedPlanStatusSession } from "../../Report.ts";
 import { isResolved } from "../../Diff.ts";
 import type { Input, InputProps } from "../../Input.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";

package/src/AWS/Lambda/NetworkConnector.ts

@@ -4,7 +4,7 @@ import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 
-import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import type { ScopedPlanStatusSession } from "../../Report.ts";
 import { deepEqual, isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";

package/src/AWS/Local/DevWatchProvider.ts

@@ -378,7 +378,7 @@ export const makeDevWatchProvider = <
         diff: Effect.fn(function* ({
           id,
           olds,
-          news,
+          news: rawNews,
           output,
         }: {
           id: string;
@@ -386,6 +386,15 @@ export const makeDevWatchProvider = <
           news: Props;
           output: Attrs | undefined;
         }) {
+          // Runtime props (an Effect-native Function's handler, a Layer)
+          // arrive as Effects, which `isResolved` classifies as unresolved.
+          // They are irrelevant to the dev diff, so strip them BEFORE the
+          // resolved check — otherwise this diff bails to the engine default
+          // (`havePropsChanged` → noop) and the "fresh session with a state
+          // row but no watcher" branch below never runs: `alchemy dev`
+          // resumed over an existing stage would start no watch loop and
+          // hot reload would silently be dead.
+          const news = stripEffects(rawNews);
           if (!isResolved(news)) return;
           if (!output) return undefined;
           if (spec.replaceOn !== undefined) {

package/src/AWS/Organizations/Account.ts

@@ -12,6 +12,7 @@ import {
   collectPages,
   readResourceTags,
   retryOrganizations,
+  unredact,
   updateResourceTags,
 } from "./common.ts";
 
@@ -60,11 +61,11 @@ export interface Account extends Resource<
     /**
      * Friendly account name.
      */
-    name: organizations.Account["Name"] | undefined;
+    name: string | undefined;
     /**
      * Email address associated with the account.
      */
-    email: organizations.Account["Email"] | undefined;
+    email: string | undefined;
     /**
      * ID of the parent root or OU.
      */
@@ -192,12 +193,18 @@ export const AccountProvider = () =>
             if (requestId) {
               const status = yield* waitForCreateAccount(requestId);
               yield* session.note(status.AccountId ?? requestId);
+              state = status.AccountId
+                ? yield* readAccountById(status.AccountId)
+                : yield* readAccountByNameOrEmail({
+                    name: news.name,
+                    email: news.email,
+                  });
+            } else {
+              state = yield* readAccountByNameOrEmail({
+                name: news.name,
+                email: news.email,
+              });
             }
-
-            state = yield* readAccountByNameOrEmail({
-              name: news.name,
-              email: news.email,
-            });
             if (!state) {
               return yield* Effect.fail(
                 new Error(`account '${news.name}' not found after create`),
@@ -338,8 +345,8 @@ const readAccountById = Effect.fn(function* (accountId: string) {
   return {
     accountId: described.Id,
     accountArn: described.Arn,
-    name: described.Name,
-    email: described.Email,
+    name: unredact(described.Name),
+    email: unredact(described.Email),
     parentId,
     status: described.Status,
     state: described.State,
@@ -355,7 +362,8 @@ const readAccountByNameOrEmail = Effect.fn(function* ({
 }: Pick<AccountProps, "name" | "email">) {
   const accounts = yield* listAccounts();
   const match = accounts.find(
-    (candidate) => candidate.Name === name || candidate.Email === email,
+    (candidate) =>
+      unredact(candidate.Name) === name || unredact(candidate.Email) === email,
   );
   return match?.Id ? yield* readAccountById(match.Id) : undefined;
 });