alchemy 2.0.0-beta.81 → 2.0.0-beta.82

package/src/AWS/RDS/Aurora.ts

@@ -533,89 +533,91 @@ export const Aurora = (id: string, props: AuroraProps) =>
         { concurrency: "unbounded" },
       );
 
-      const proxy =
-        proxyConfig === undefined
-          ? undefined
-          : yield* Effect.gen(function* () {
-              const role = yield* IAM.Role("ProxyRole", {
-                assumeRolePolicyDocument: {
-                  Version: "2012-10-17",
-                  Statement: [
-                    {
-                      Effect: "Allow",
-                      Principal: {
-                        Service: "rds.amazonaws.com",
-                      },
-                      Action: ["sts:AssumeRole"],
-                      Resource: ["*"],
-                    },
-                  ],
+      const createProxy = Effect.gen(function* () {
+        if (proxyConfig === undefined) {
+          return undefined;
+        }
+
+        const role = yield* IAM.Role("ProxyRole", {
+          assumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Effect: "Allow",
+                Principal: {
+                  Service: "rds.amazonaws.com",
                 },
-                inlinePolicies: {
-                  ReadSecret: {
-                    Version: "2012-10-17",
-                    Statement: [
-                      {
-                        Effect: "Allow",
-                        Action: ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"],
-                        Resource: [secret.secretArn],
-                      },
-                    ],
-                  },
+                Action: ["sts:AssumeRole"],
+                Resource: ["*"],
+              },
+            ],
+          },
+          inlinePolicies: {
+            ReadSecret: {
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: "Allow",
+                  Action: ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"],
+                  Resource: [secret.secretArn],
                 },
-                tags: mergeTags(commonTags, undefined),
-              });
+              ],
+            },
+          },
+          tags: mergeTags(commonTags, undefined),
+        });
 
-              const proxy = yield* DBProxy("Proxy", {
-                dbProxyName: proxyConfig.dbProxyName,
-                engineFamily: inferProxyEngineFamily(engine),
-                auth: proxyConfig.auth ?? [
-                  {
-                    AuthScheme: "SECRETS",
-                    SecretArn: secret.secretArn,
-                    IAMAuth: "DISABLED",
-                  },
-                ],
-                roleArn: role.roleArn,
-                vpcSubnetIds: subnetIds,
-                vpcSecurityGroupIds: securityGroupIds,
-                requireTLS: proxyConfig.requireTLS ?? true,
-                idleClientTimeout: proxyConfig.idleClientTimeout,
-                debugLogging: proxyConfig.debugLogging,
-                endpointNetworkType: proxyConfig.endpointNetworkType,
-                targetConnectionNetworkType: proxyConfig.targetConnectionNetworkType,
-                tags: mergeTags(commonTags, proxyConfig.tags),
-              });
+        const proxy = yield* DBProxy("Proxy", {
+          dbProxyName: proxyConfig.dbProxyName,
+          engineFamily: inferProxyEngineFamily(engine),
+          auth: proxyConfig.auth ?? [
+            {
+              AuthScheme: "SECRETS",
+              SecretArn: secret.secretArn,
+              IAMAuth: "DISABLED",
+            },
+          ],
+          roleArn: role.roleArn,
+          vpcSubnetIds: subnetIds,
+          vpcSecurityGroupIds: securityGroupIds,
+          requireTLS: proxyConfig.requireTLS ?? true,
+          idleClientTimeout: proxyConfig.idleClientTimeout,
+          debugLogging: proxyConfig.debugLogging,
+          endpointNetworkType: proxyConfig.endpointNetworkType,
+          targetConnectionNetworkType: proxyConfig.targetConnectionNetworkType,
+          tags: mergeTags(commonTags, proxyConfig.tags),
+        });
+
+        const targetGroup = yield* DBProxyTargetGroup("ProxyTargetGroup", {
+          targetGroupName: proxyConfig.targetGroup?.targetGroupName,
+          dbProxyName: proxy.dbProxyName,
+          dbClusterIdentifiers: [cluster.dbClusterIdentifier],
+          dbInstanceIdentifiers: proxyConfig.targetGroup?.dbInstanceIdentifiers,
+          connectionPoolConfig: proxyConfig.targetGroup?.connectionPoolConfig,
+        });
 
-              const targetGroup = yield* DBProxyTargetGroup("ProxyTargetGroup", {
-                targetGroupName: proxyConfig.targetGroup?.targetGroupName,
+        const endpoint =
+          proxyConfig.endpoint === undefined
+            ? undefined
+            : yield* DBProxyEndpoint("ProxyEndpoint", {
                 dbProxyName: proxy.dbProxyName,
-                dbClusterIdentifiers: [cluster.dbClusterIdentifier],
-                dbInstanceIdentifiers: proxyConfig.targetGroup?.dbInstanceIdentifiers,
-                connectionPoolConfig: proxyConfig.targetGroup?.connectionPoolConfig,
+                vpcSubnetIds: subnetIds,
+                vpcSecurityGroupIds: securityGroupIds,
+                ...(proxyConfig.endpoint === true ? {} : proxyConfig.endpoint),
+                tags: mergeTags(
+                  commonTags,
+                  proxyConfig.endpoint === true ? undefined : proxyConfig.endpoint.tags,
+                ),
               });
 
-              const endpoint =
-                proxyConfig.endpoint === undefined
-                  ? undefined
-                  : yield* DBProxyEndpoint("ProxyEndpoint", {
-                      dbProxyName: proxy.dbProxyName,
-                      vpcSubnetIds: subnetIds,
-                      vpcSecurityGroupIds: securityGroupIds,
-                      ...(proxyConfig.endpoint === true ? {} : proxyConfig.endpoint),
-                      tags: mergeTags(
-                        commonTags,
-                        proxyConfig.endpoint === true ? undefined : proxyConfig.endpoint.tags,
-                      ),
-                    });
-
-              return {
-                role,
-                proxy,
-                targetGroup,
-                endpoint,
-              };
-            });
+        return {
+          role,
+          proxy,
+          targetGroup,
+          endpoint,
+        };
+      });
+      const proxy = yield* createProxy;
 
       return {
         secret,

package/src/AWS/RDS/DBCluster.ts

@@ -11,6 +11,7 @@ import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { createInternalTags, diffTags } from "../../Tags.ts";
 import { toWireDays, toWireSeconds } from "../../Util/Duration.ts";
+import { reapLogGroupsByPrefix } from "../Logs/reapLogGroups.ts";
 import type { Providers } from "../Providers.ts";
 
 export interface DBClusterProps {
@@ -600,21 +601,19 @@ export const DBClusterProvider = () =>
         // Attributes shape. Tags come inline on `DBCluster.TagList`, so no
         // per-item `listTagsForResource` hydration is needed (matching `read`).
         list: () =>
-          Effect.gen(function* () {
-            return yield* rds.describeDBClusters.pages({}).pipe(
-              Stream.runCollect,
-              Effect.map((chunk) =>
-                Array.from(chunk).flatMap((page) =>
-                  (page.DBClusters ?? []).map((cluster) =>
-                    toAttrs({
-                      cluster,
-                      tags: toTagRecord(cluster.TagList),
-                    }),
-                  ),
+          rds.describeDBClusters.pages({}).pipe(
+            Stream.runCollect,
+            Effect.map((chunk) =>
+              Array.from(chunk).flatMap((page) =>
+                (page.DBClusters ?? []).map((cluster) =>
+                  toAttrs({
+                    cluster,
+                    tags: toTagRecord(cluster.TagList),
+                  }),
                 ),
               ),
-            );
-          }),
+            ),
+          ),
         diff: Effect.fn(function* ({ id, olds, news }) {
           if (!isResolved(news)) return;
           if (
@@ -869,6 +868,11 @@ export const DBClusterProvider = () =>
               until: (exists) => exists === false,
             },
           ).pipe(Effect.catch(() => Effect.void));
+          // RDS creates `/aws/rds/cluster/<id>/<logType>` for every
+          // `enableCloudwatchLogsExports` type and never deletes them.
+          yield* reapLogGroupsByPrefix(
+            `/aws/rds/cluster/${output.dbClusterIdentifier.toLowerCase()}/`,
+          );
         }),
       };
     }),

package/src/AWS/RDS/DBInstance.ts

@@ -19,6 +19,7 @@ import {
   stringifyPolicyDocument,
   type PolicyDocument,
 } from "../IAM/Policy.ts";
+import { reapLogGroupsByPrefix } from "../Logs/reapLogGroups.ts";
 import type { Providers } from "../Providers.ts";
 
 export interface DBInstanceProps {
@@ -794,8 +795,11 @@ export interface DBInstance extends Resource<
  * ```
  *
  * Declared policies are checked with `ValidateResourcePolicy`, including
- * unchanged plans, and writes additionally use `BlockPublicPolicy`. Deployment
- * requires `secretsmanager:ValidateResourcePolicy` permission. Alchemy compares
+ * unchanged plans, and writes additionally use `BlockPublicPolicy`. Once the
+ * managed secret exists, validation names it, so deployment requires
+ * `secretsmanager:ValidateResourcePolicy` and `secretsmanager:PutResourcePolicy`
+ * on that secret rather than on `*`. Before the first create, with no secret
+ * yet, validation runs without a target. Alchemy compares
  * live policy metadata without reading secret values. RDS owns credential
  * generation, rotation, and secret deletion. Only instance-managed secrets are
  * supported; an Aurora or Multi-AZ cluster owns its own secret, and RDS Custom
@@ -1646,9 +1650,16 @@ export const DBInstanceProvider = () =>
         return instance;
       });
 
-      const validateMasterSecretPolicy = Effect.fn(function* (policy: PolicyDocument | undefined) {
+      // ValidateResourcePolicy is authorized like PutResourcePolicy on its
+      // target; without a SecretId the target is `*`, so an identity scoped to
+      // the instance's own secret ARN is denied. Name the known secret.
+      const validateMasterSecretPolicy = Effect.fn(function* (
+        policy: PolicyDocument | undefined,
+        secretArn?: string,
+      ) {
         if (policy === undefined) return;
         const validation = yield* secretsmanager.validateResourcePolicy({
+          ...(secretArn === undefined ? {} : { SecretId: secretArn }),
           ResourcePolicy: stringifyPolicyDocument(policy),
         });
         if (validation.PolicyValidationPassed !== true) {
@@ -1774,7 +1785,10 @@ export const DBInstanceProvider = () =>
           ),
         diff: Effect.fn(function* ({ id, olds, news, output }) {
           if (!isResolved(news)) return undefined;
-          yield* validateMasterSecretPolicy(news.masterUserSecretResourcePolicy);
+          yield* validateMasterSecretPolicy(
+            news.masterUserSecretResourcePolicy,
+            output?.masterUserSecretArn,
+          );
           if (
             (yield* toIdentifier(id, olds ?? ({} as DBInstanceProps))) !==
             (yield* toIdentifier(id, news))
@@ -1800,6 +1814,13 @@ export const DBInstanceProvider = () =>
             if (!instance?.DBInstanceArn) {
               return { action: "update", stables: [] } as const;
             }
+            // The identifier names a different physical instance than the one
+            // recorded, e.g. after a point-in-time restore renamed into place.
+            // Nothing in the props changed, but the attributes did: reconcile
+            // re-reads the instance so dependents see the new one.
+            if (instance.DbiResourceId !== output.dbiResourceId) {
+              return { action: "update" } as const;
+            }
             if (!instanceReady(instance)) {
               return { action: "update" } as const;
             }
@@ -1844,7 +1865,10 @@ export const DBInstanceProvider = () =>
           });
         }),
         reconcile: Effect.fn(function* ({ id, news, output, session }) {
-          yield* validateMasterSecretPolicy(news.masterUserSecretResourcePolicy);
+          yield* validateMasterSecretPolicy(
+            news.masterUserSecretResourcePolicy,
+            output?.masterUserSecretArn,
+          );
           const identifier = output?.dbInstanceIdentifier ?? (yield* toIdentifier(id, news));
           // AWS never returns the master password, so there is nothing to
           // observe-and-diff — fingerprint the configured value instead and
@@ -2269,6 +2293,11 @@ export const DBInstanceProvider = () =>
               until: (exists) => exists === false,
             },
           ).pipe(Effect.catch(() => Effect.void));
+          // RDS creates `/aws/rds/instance/<id>/<logType>` for every
+          // `enableCloudwatchLogsExports` type and never deletes them.
+          yield* reapLogGroupsByPrefix(
+            `/aws/rds/instance/${output.dbInstanceIdentifier.toLowerCase()}/`,
+          );
         }),
       };
     }),

package/src/AWS/RDS/DBProxyTargetGroup.ts

@@ -158,9 +158,11 @@ export const DBProxyTargetGroupProvider = () =>
             TargetGroupName: targetGroupName,
           })
           .pipe(
-            Effect.catchTag("DBProxyTargetNotFoundFault", () => Effect.succeed(undefined)),
-            Effect.catchTag("DBProxyTargetGroupNotFoundFault", () => Effect.succeed(undefined)),
-            Effect.catchTag("DBProxyNotFoundFault", () => Effect.succeed(undefined)),
+            Effect.catchTags({
+              DBProxyTargetNotFoundFault: () => Effect.succeed(undefined),
+              DBProxyTargetGroupNotFoundFault: () => Effect.succeed(undefined),
+              DBProxyNotFoundFault: () => Effect.succeed(undefined),
+            }),
           );
         const targets = response?.Targets ?? [];
         const observedClusters: string[] = [];
@@ -206,12 +208,11 @@ export const DBProxyTargetGroupProvider = () =>
                       Effect.map((chunk) =>
                         Array.from(chunk).flatMap((page) => page.TargetGroups ?? []),
                       ),
-                      Effect.catchTag("DBProxyNotFoundFault", () =>
-                        Effect.succeed([] as rds.DBProxyTargetGroup[]),
-                      ),
-                      Effect.catchTag("DBProxyTargetGroupNotFoundFault", () =>
-                        Effect.succeed([] as rds.DBProxyTargetGroup[]),
-                      ),
+                      Effect.catchTags({
+                        DBProxyNotFoundFault: () => Effect.succeed([] as rds.DBProxyTargetGroup[]),
+                        DBProxyTargetGroupNotFoundFault: () =>
+                          Effect.succeed([] as rds.DBProxyTargetGroup[]),
+                      }),
                     );
                   return yield* Effect.forEach(
                     groups,

package/src/AWS/RDS/DBSubnetGroup.ts

@@ -230,7 +230,9 @@ export const DBSubnetGroupProvider = () =>
             Effect.map((chunk) =>
               Array.from(chunk).flatMap((page) =>
                 (page.DBSubnetGroups ?? []).flatMap((group) =>
-                  group.DBSubnetGroupName
+                  // `default` is the RDS-family subnet group AWS auto-creates
+                  // for the default VPC — never ours, never census/nuke it.
+                  group.DBSubnetGroupName && group.DBSubnetGroupName !== "default"
                     ? [
                         {
                           dbSubnetGroupName: group.DBSubnetGroupName,

package/src/AWS/RUM/MetricsDestination.ts

@@ -303,13 +303,11 @@ export const MetricsDestinationProvider = () =>
               MetricDefinitions: toCreate.map(toWireDefinition),
             });
             if (Errors.length > 0) {
-              yield* Effect.fail(
-                new RumMetricDefinitionsError({
-                  message: `failed to create ${Errors.length} metric definition(s): ${Errors.map(
-                    (e) => `${e.MetricDefinition.Name}: ${e.ErrorMessage}`,
-                  ).join("; ")}`,
-                }),
-              );
+              return yield* new RumMetricDefinitionsError({
+                message: `failed to create ${Errors.length} metric definition(s): ${Errors.map(
+                  (e) => `${e.MetricDefinition.Name}: ${e.ErrorMessage}`,
+                ).join("; ")}`,
+              });
             }
           }
 
@@ -335,13 +333,11 @@ export const MetricsDestinationProvider = () =>
               MetricDefinitionIds: toDelete.map((d) => d.MetricDefinitionId),
             });
             if (Errors.length > 0) {
-              yield* Effect.fail(
-                new RumMetricDefinitionsError({
-                  message: `failed to delete ${Errors.length} metric definition(s): ${Errors.map(
-                    (e) => `${e.MetricDefinitionId}: ${e.ErrorMessage}`,
-                  ).join("; ")}`,
-                }),
-              );
+              return yield* new RumMetricDefinitionsError({
+                message: `failed to delete ${Errors.length} metric definition(s): ${Errors.map(
+                  (e) => `${e.MetricDefinitionId}: ${e.ErrorMessage}`,
+                ).join("; ")}`,
+              });
             }
           }
 

package/src/AWS/RePostSpace/Space.ts

@@ -257,7 +257,7 @@ export const SpaceProvider = () =>
       const readSpaceTags = Effect.fn(function* (arn: string) {
         const response = yield* repostspace
           .listTagsForResource({ resourceArn: arn })
-          .pipe(Effect.catch(() => Effect.succeed(undefined)));
+          .pipe(Effect.orElseSucceed(() => undefined));
         const tags: Record<string, string> = {};
         for (const [key, value] of Object.entries(response?.tags ?? {})) {
           if (value !== undefined) tags[key] = value;
@@ -285,15 +285,13 @@ export const SpaceProvider = () =>
           Effect.gen(function* () {
             const space = yield* repostspace.getSpace({ spaceId });
             if (space.status === "CREATE_FAILED" || space.status.startsWith("DELETE")) {
-              return yield* Effect.fail(
-                new RePostSpaceProvisioningFailed({
-                  spaceId,
-                  status: space.status,
-                }),
-              );
+              return yield* new RePostSpaceProvisioningFailed({
+                spaceId,
+                status: space.status,
+              });
             }
             if (space.status !== "CREATE_COMPLETED") {
-              return yield* Effect.fail(new RePostSpaceNotReady({ spaceId, status: space.status }));
+              return yield* new RePostSpaceNotReady({ spaceId, status: space.status });
             }
             return space;
           }),

package/src/AWS/Redshift/Cluster.ts

@@ -444,11 +444,9 @@ export const ClusterProvider = () =>
           // 2. Ensure — create if missing; tolerate AlreadyExists as a race.
           if (observed === undefined) {
             if (!news.masterUserPassword && !news.manageMasterPassword) {
-              return yield* Effect.fail(
-                new RedshiftMasterPasswordRequired({
-                  clusterIdentifier: identifier,
-                }),
-              );
+              return yield* new RedshiftMasterPasswordRequired({
+                clusterIdentifier: identifier,
+              });
             }
             yield* redshift
               .createCluster({
@@ -610,7 +608,7 @@ export const ClusterProvider = () =>
           // A cluster mid-create/modify rejects deletion with
           // InvalidClusterStateFault — wait (bounded) for it to settle
           // first. A cluster already deleting (or gone) is success.
-          yield* waitUntilSettled(identifier).pipe(Effect.catch(() => Effect.succeed(undefined)));
+          yield* waitUntilSettled(identifier).pipe(Effect.orElseSucceed(() => undefined));
           yield* retryWhileClusterTransitioning(
             redshift
               .deleteCluster({

package/src/AWS/Redshift/ClusterSubnetGroup.ts

@@ -267,7 +267,11 @@ export const ClusterSubnetGroupProvider = () =>
             Effect.map((chunk) =>
               Array.from(chunk).flatMap((page) =>
                 (page.ClusterSubnetGroups ?? []).filter(
-                  (group) => group.ClusterSubnetGroupName !== undefined,
+                  (group) =>
+                    group.ClusterSubnetGroupName !== undefined &&
+                    // `default` is auto-created by Redshift for the default
+                    // VPC — never ours, never census/nuke it.
+                    group.ClusterSubnetGroupName !== "default",
                 ),
               ),
             ),

package/src/AWS/Redshift/ConnectHttp.ts

@@ -47,7 +47,12 @@ export const ConnectHttp = Layer.effect(
           const database = options.database ?? cluster.dbName;
           const dbNameArn = Output.interpolate`${arnBase}:dbname:${cluster.clusterIdentifier}/${database}`;
           const prefix = connectEnvPrefix(cluster.LogicalId);
-          yield* host.bind`Allow(${host}, AWS.Redshift.Connect(${cluster}))`({
+          // The binding id must be unique per credential strategy: a Function
+          // that connects to the same cluster both as its IAM identity and as
+          // a named database user needs BOTH policy statements, and binds that
+          // share an id collapse into one (the last one wins).
+          const strategy = options.dbUser !== undefined ? `, ${options.dbUser}` : "";
+          yield* host.bind`Allow(${host}, AWS.Redshift.Connect(${cluster}${strategy}))`({
             policyStatements:
               options.dbUser !== undefined
                 ? [

package/src/AWS/RedshiftData/StatementsHttp.ts

@@ -215,13 +215,11 @@ export const StatementsHttp = Layer.effect(
             }),
           );
           if (described.Status !== "FINISHED") {
-            return yield* Effect.fail(
-              new RedshiftStatementFailed({
-                statementId: id,
-                status: described.Status ?? "UNKNOWN",
-                error: described.Error,
-              }),
-            );
+            return yield* new RedshiftStatementFailed({
+              statementId: id,
+              status: described.Status ?? "UNKNOWN",
+              error: described.Error,
+            });
           }
           return yield* getResult(id);
         },

package/src/AWS/RedshiftServerless/internal.ts

@@ -32,7 +32,7 @@ export const toWireTags = (tags: Record<string, string>): redshiftserverless.Tag
 export const readTags = Effect.fn(function* (arn: string) {
   const response = yield* redshiftserverless
     .listTagsForResource({ resourceArn: arn })
-    .pipe(Effect.catch(() => Effect.succeed(undefined)));
+    .pipe(Effect.orElseSucceed(() => undefined));
   return toTagRecord(response?.tags);
 });
 

package/src/AWS/Region.ts

@@ -23,7 +23,7 @@ export const fromEnvOrElse = (region: string) =>
 // `AWSEnvironment` eagerly at top level hits a temporal-dead-zone error when
 // this module is evaluated mid-cycle.
 export const CurrentRegion = Effect.suspend(() =>
-  AWSEnvironment.use((env) => Effect.flatMap(env, ({ region }) => Effect.succeed(region))),
+  AWSEnvironment.use((env) => Effect.map(env, ({ region }) => region)),
 );
 
 /**

package/src/AWS/ResourceExplorer/View.ts

@@ -291,11 +291,9 @@ export const ViewProvider = () =>
           if (found === undefined || view?.ViewArn === undefined) {
             // Unreachable in practice: create either succeeded or the
             // conflicting peer exists; observation just raced a delete.
-            return yield* Effect.fail(
-              new ViewUnobservable({
-                message: `ResourceExplorer view ${name} could not be created or observed`,
-              }),
-            );
+            return yield* new ViewUnobservable({
+              message: `ResourceExplorer view ${name} could not be created or observed`,
+            });
           }
 
           // 3. SYNC — UpdateView REPLACES both Filters and

package/src/AWS/ResourceGroups/Group.ts

@@ -250,7 +250,7 @@ export const GroupProvider = () =>
       const readGroupTags = (groupArn: string) =>
         resourcegroups.getTags({ Arn: groupArn }).pipe(
           Effect.map((r) => (r.Tags ?? {}) as Record<string, string>),
-          Effect.catch(() => Effect.succeed({} as Record<string, string>)),
+          Effect.orElseSucceed(() => ({}) as Record<string, string>),
         );
 
       return Group.Provider.of({

package/src/AWS/RolesAnywhere/internal.ts

@@ -29,7 +29,7 @@ export const toWireTags = (tags: Record<string, string>): rolesanywhere.Tag[] =>
 export const readRolesAnywhereTags = Effect.fn(function* (arn: string) {
   const response = yield* rolesanywhere
     .listTagsForResource({ resourceArn: arn })
-    .pipe(Effect.catch(() => Effect.succeed(undefined)));
+    .pipe(Effect.orElseSucceed(() => undefined));
   return toTagRecord(response?.tags);
 });
 

package/src/AWS/Route53/Record.ts

@@ -342,6 +342,18 @@ export const normalizeHostedZoneId = (hostedZoneId: string) =>
 /** @internal shared with `Records.ts` — not exported from the barrel. */
 export const normalizeName = (name: string) => (name.endsWith(".") ? name : `${name}.`);
 
+/**
+ * Route 53 returns record names in lowercase with special characters as
+ * `\ddd` octal escapes (a wildcard `*` comes back as `\052`), so compare
+ * names in that decoded, lowercase form.
+ *
+ * @internal shared with `Records.ts` — not exported from the barrel.
+ */
+export const canonicalName = (name: string) =>
+  normalizeName(name)
+    .replace(/\\(\d{3})/g, (_, code: string) => String.fromCharCode(Number.parseInt(code, 8)))
+    .toLowerCase();
+
 /** @internal shared with `Records.ts` — not exported from the barrel. */
 export const toAliasTarget = (
   aliasTarget: route53.AliasTarget | undefined,
@@ -521,7 +533,7 @@ export const RecordProvider = () =>
 
         return (response?.ResourceRecordSets ?? []).find(
           (recordSet) =>
-            recordSet.Name === normalizeName(props.name) &&
+            canonicalName(recordSet.Name) === canonicalName(props.name) &&
             recordSet.Type === props.type &&
             (recordSet.SetIdentifier ?? undefined) === props.setIdentifier,
         );
@@ -705,8 +717,10 @@ export const RecordProvider = () =>
             })
             .pipe(
               Effect.flatMap((response) => waitForChange(response.ChangeInfo.Id)),
-              Effect.catchTag("NoSuchHostedZone", () => Effect.void),
-              Effect.catchTag("InvalidChangeBatch", () => Effect.void),
+              Effect.catchTags({
+                NoSuchHostedZone: () => Effect.void,
+                InvalidChangeBatch: () => Effect.void,
+              }),
             );
         }),
       };

package/src/AWS/Route53/Records.ts

@@ -9,6 +9,7 @@ import { durationToSeconds } from "../IAM/common.ts";
 import type { Providers } from "../Providers.ts";
 import { resolveHostedZoneId } from "./HostedZoneLookup.ts";
 import {
+  canonicalName,
   normalizeHostedZoneId,
   normalizeName,
   toAliasTarget,
@@ -201,7 +202,7 @@ export const RecordsProvider = () =>
 
         return (response?.ResourceRecordSets ?? []).find(
           (recordSet) =>
-            recordSet.Name.toLowerCase() === normalizeName(name).toLowerCase() &&
+            canonicalName(recordSet.Name) === canonicalName(name) &&
             recordSet.Type === type &&
             recordSet.SetIdentifier === undefined,
         );
@@ -267,8 +268,10 @@ export const RecordsProvider = () =>
           })
           .pipe(
             Effect.flatMap((response) => waitForChange(response.ChangeInfo.Id)),
-            Effect.catchTag("NoSuchHostedZone", () => Effect.void),
-            Effect.catchTag("InvalidChangeBatch", () => Effect.void),
+            Effect.catchTags({
+              NoSuchHostedZone: () => Effect.void,
+              InvalidChangeBatch: () => Effect.void,
+            }),
           );
       });
 

package/src/AWS/Route53/VpcAssociationAuthorization.ts

@@ -168,8 +168,10 @@ export const VpcAssociationAuthorizationProvider = () =>
               },
             })
             .pipe(
-              Effect.catchTag("VPCAssociationAuthorizationNotFound", () => Effect.void),
-              Effect.catchTag("NoSuchHostedZone", () => Effect.void),
+              Effect.catchTags({
+                VPCAssociationAuthorizationNotFound: () => Effect.void,
+                NoSuchHostedZone: () => Effect.void,
+              }),
             );
         }),
       };