alchemy 2.0.0-beta.81 → 2.0.0-beta.83

package/src/AWS/OpenSearchServerless/LifecyclePolicy.ts

@@ -233,11 +233,9 @@ export const LifecyclePolicyProvider = () =>
           }
 
           if (detail?.name === undefined) {
-            return yield* Effect.fail(
-              new aoss.ResourceNotFoundException({
-                message: `lifecycle policy ${type}/${name} not visible after reconcile`,
-              }),
-            );
+            return yield* aoss.ResourceNotFoundException.make({
+              message: `lifecycle policy ${type}/${name} not visible after reconcile`,
+            });
           }
           yield* session.note(`${type}/${name}`);
           return toAttributes(detail);

package/src/AWS/OpenSearchServerless/SecurityConfig.ts

@@ -352,11 +352,9 @@ export const SecurityConfigProvider = () =>
           }
 
           if (detail?.id === undefined) {
-            return yield* Effect.fail(
-              new aoss.ResourceNotFoundException({
-                message: `security config ${configId} not visible after reconcile`,
-              }),
-            );
+            return yield* aoss.ResourceNotFoundException.make({
+              message: `security config ${configId} not visible after reconcile`,
+            });
           }
           yield* session.note(detail.id);
           return toAttributes(detail);

package/src/AWS/OpenSearchServerless/SecurityPolicy.ts

@@ -252,11 +252,9 @@ export const SecurityPolicyProvider = () =>
           }
 
           if (detail?.name === undefined) {
-            return yield* Effect.fail(
-              new aoss.ResourceNotFoundException({
-                message: `security policy ${type}/${name} not visible after reconcile`,
-              }),
-            );
+            return yield* aoss.ResourceNotFoundException.make({
+              message: `security policy ${type}/${name} not visible after reconcile`,
+            });
           }
           yield* session.note(`${type}/${name}`);
           return toAttributes(detail);

package/src/AWS/OpenSearchServerless/UpdateIndex.ts

@@ -5,7 +5,7 @@ import type { Collection } from "./Collection.ts";
 
 /**
  * Runtime binding for the `UpdateIndex` operation scoped to one collection
- * (IAM action `aoss:APIAccessAll` on the collection ARN).
+ * (IAM actions `aoss:UpdateIndex` + `aoss:APIAccessAll` on the collection ARN).
  *
  * Updates an index's schema in the bound {@link Collection} — add new fields
  * or change field mappings at runtime. The calling principal must also be

package/src/AWS/OpenSearchServerless/UpdateIndexHttp.ts

@@ -8,6 +8,11 @@ export const UpdateIndexHttp = Layer.effect(
   makeAossCollectionHttpBinding({
     tag: "AWS.OpenSearchServerless.UpdateIndex",
     operation: aoss.updateIndex,
-    actions: ["aoss:APIAccessAll"],
+    // IAM checks both: `aoss:UpdateIndex` for the API call, and
+    // `aoss:APIAccessAll` because the service reads the index through the
+    // collection's data plane ("Access denied to head index" without it).
+    // IAM has no narrower data-plane action; per-index permissions belong in
+    // the collection's AccessPolicy.
+    actions: ["aoss:UpdateIndex", "aoss:APIAccessAll"],
   }),
 );

package/src/AWS/OpenSearchServerless/VpcEndpoint.ts

@@ -180,11 +180,9 @@ export const VpcEndpointProvider = () =>
               );
             const endpointId = created?.id ?? (yield* findByName(name))?.id;
             if (endpointId === undefined) {
-              return yield* Effect.fail(
-                new aoss.ResourceNotFoundException({
-                  message: `VPC endpoint ${name} not visible after create`,
-                }),
-              );
+              return yield* aoss.ResourceNotFoundException.make({
+                message: `VPC endpoint ${name} not visible after create`,
+              });
             }
             yield* session.note(`creating VPC endpoint ${name} (async)...`);
             detail = yield* awaitVpcEndpointActive(endpointId);

package/src/AWS/OpenSearchServerless/internal.ts

@@ -15,7 +15,13 @@ export class OpenSearchServerlessProvisioningFailed extends Data.TaggedError(
   readonly status: string | undefined;
   readonly failureCode: string | undefined;
   readonly failureMessage: string | undefined;
-}> {}
+}> {
+  override get message() {
+    return `${this.resource} ${this.id} did not reach ACTIVE (status: ${this.status ?? "unknown"}${
+      this.failureCode !== undefined ? `, ${this.failureCode}` : ""
+    }${this.failureMessage !== undefined ? `: ${this.failureMessage}` : ""})`;
+  }
+}
 
 /**
  * Serialize a security/access policy document to the compact JSON string the
@@ -82,15 +88,13 @@ export const awaitCollectionActive = Effect.fn("AWS.OpenSearchServerless.awaitCo
   function* (id: string) {
     const detail = yield* untilCollectionTerminal(aoss.batchGetCollection({ ids: [id] }));
     if (detail?.status !== "ACTIVE") {
-      return yield* Effect.fail(
-        new OpenSearchServerlessProvisioningFailed({
-          resource: "Collection",
-          id,
-          status: detail?.status,
-          failureCode: detail?.failureCode,
-          failureMessage: detail?.failureMessage,
-        }),
-      );
+      return yield* new OpenSearchServerlessProvisioningFailed({
+        resource: "Collection",
+        id,
+        status: detail?.status,
+        failureCode: detail?.failureCode,
+        failureMessage: detail?.failureMessage,
+      });
     }
     return detail;
   },
@@ -117,15 +121,13 @@ export const awaitVpcEndpointActive = Effect.fn("AWS.OpenSearchServerless.awaitV
   function* (id: string) {
     const detail = yield* untilVpcEndpointTerminal(aoss.batchGetVpcEndpoint({ ids: [id] }));
     if (detail?.status !== "ACTIVE") {
-      return yield* Effect.fail(
-        new OpenSearchServerlessProvisioningFailed({
-          resource: "VpcEndpoint",
-          id,
-          status: detail?.status,
-          failureCode: detail?.failureCode,
-          failureMessage: detail?.failureMessage,
-        }),
-      );
+      return yield* new OpenSearchServerlessProvisioningFailed({
+        resource: "VpcEndpoint",
+        id,
+        status: detail?.status,
+        failureCode: detail?.failureCode,
+        failureMessage: detail?.failureMessage,
+      });
     }
     return detail;
   },

package/src/AWS/PaymentCryptography/Key.ts

@@ -253,7 +253,7 @@ const fetchKeyTags = (keyArn: string) =>
   paymentcryptography.listTagsForResource.items({ ResourceArn: keyArn }).pipe(
     Stream.runCollect,
     Effect.map((chunk) => tagsToRecord(Array.from(chunk))),
-    Effect.catch(() => Effect.succeed({} as Record<string, string>)),
+    Effect.orElseSucceed(() => ({}) as Record<string, string>),
   );
 
 export const KeyProvider = () =>
@@ -411,20 +411,21 @@ export const KeyProvider = () =>
               DeleteKeyInDays: toWireDays(olds.deleteWindow) ?? 3,
             })
             .pipe(
-              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
-              // A key already scheduled for deletion rejects a second
-              // DeleteKey with a conflict — that is the desired end state,
-              // so treat it as success. Any other conflict is re-raised.
-              Effect.catchTag("ConflictException", (error) =>
-                paymentcryptography.getKey({ KeyIdentifier: output.keyArn }).pipe(
-                  Effect.flatMap((r) =>
-                    r.Key.KeyState === "DELETE_PENDING" || r.Key.KeyState === "DELETE_COMPLETE"
-                      ? Effect.void
-                      : Effect.fail(error),
+              Effect.catchTags({
+                ResourceNotFoundException: () => Effect.void,
+                // A key already scheduled for deletion rejects a second
+                // DeleteKey with a conflict — that is the desired end state,
+                // so treat it as success. Any other conflict is re-raised.
+                ConflictException: (error) =>
+                  paymentcryptography.getKey({ KeyIdentifier: output.keyArn }).pipe(
+                    Effect.flatMap((r) =>
+                      r.Key.KeyState === "DELETE_PENDING" || r.Key.KeyState === "DELETE_COMPLETE"
+                        ? Effect.void
+                        : Effect.fail(error),
+                    ),
+                    Effect.catchTag("ResourceNotFoundException", () => Effect.void),
                   ),
-                  Effect.catchTag("ResourceNotFoundException", () => Effect.void),
-                ),
-              ),
+              }),
             );
         }),
       });

package/src/AWS/Personalize/internal.ts

@@ -24,7 +24,7 @@ export const toTagRecord = (tags: personalize.Tag[] | undefined): Record<string,
 export const readPersonalizeTags = Effect.fn(function* (arn: string) {
   const response = yield* personalize
     .listTagsForResource({ resourceArn: arn })
-    .pipe(Effect.catch(() => Effect.succeed(undefined)));
+    .pipe(Effect.orElseSucceed(() => undefined));
   return toTagRecord(response?.tags);
 });
 

package/src/AWS/PinpointSMSVoiceV2/ConfigurationSet.ts

@@ -174,11 +174,9 @@ export const ConfigurationSetProvider = () =>
             observed = yield* getByName(name);
           }
           if (observed === undefined) {
-            return yield* Effect.fail(
-              new SmsVoiceConfigurationSetMissing({
-                message: `configuration set '${name}' not observable after create`,
-              }),
-            );
+            return yield* new SmsVoiceConfigurationSetMissing({
+              message: `configuration set '${name}' not observable after create`,
+            });
           }
 
           // 3. Sync default message type — diff observed against desired;

package/src/AWS/PinpointSMSVoiceV2/EventDestination.ts

@@ -293,11 +293,9 @@ export const EventDestinationProvider = () =>
             (ed) => ed.EventDestinationName === eventDestinationName,
           );
           if (finalSet === undefined || observed === undefined) {
-            return yield* Effect.fail(
-              new SmsVoiceEventDestinationMissing({
-                message: `event destination '${eventDestinationName}' on configuration set '${configurationSetName}' not observable after create`,
-              }),
-            );
+            return yield* new SmsVoiceEventDestinationMissing({
+              message: `event destination '${eventDestinationName}' on configuration set '${configurationSetName}' not observable after create`,
+            });
           }
 
           // 3. Sync — apply a single update when any mutable aspect

package/src/AWS/PinpointSMSVoiceV2/OptOutList.ts

@@ -150,11 +150,9 @@ export const OptOutListProvider = () =>
             observed = yield* getByName(name);
           }
           if (observed === undefined) {
-            return yield* Effect.fail(
-              new SmsVoiceOptOutListMissing({
-                message: `opt-out list '${name}' not observable after create`,
-              }),
-            );
+            return yield* new SmsVoiceOptOutListMissing({
+              message: `opt-out list '${name}' not observable after create`,
+            });
           }
 
           // 3. Sync tags — diff against OBSERVED cloud tags.

package/src/AWS/PinpointSMSVoiceV2/PhoneNumber.ts

@@ -166,11 +166,9 @@ const untilNotPending = <E, R>(
 const toAttrs = (info: smsvoice.PhoneNumberInformation) =>
   Effect.gen(function* () {
     if (info.PhoneNumberId === undefined) {
-      return yield* Effect.fail(
-        new SmsVoicePhoneNumberMissing({
-          message: `phone number '${info.PhoneNumberArn}' is missing its ID`,
-        }),
-      );
+      return yield* new SmsVoicePhoneNumberMissing({
+        message: `phone number '${info.PhoneNumberArn}' is missing its ID`,
+      });
     }
     return {
       phoneNumberId: info.PhoneNumberId,
@@ -255,20 +253,16 @@ export const PhoneNumberProvider = () =>
               })
               .pipe(retrySmsVoiceThrottled);
             if (requested.PhoneNumberId === undefined) {
-              return yield* Effect.fail(
-                new SmsVoicePhoneNumberMissing({
-                  message: "RequestPhoneNumber returned no PhoneNumberId",
-                }),
-              );
+              return yield* new SmsVoicePhoneNumberMissing({
+                message: "RequestPhoneNumber returned no PhoneNumberId",
+              });
             }
             observed = yield* getById(requested.PhoneNumberId).pipe(untilNotPending);
           }
           if (observed === undefined || observed.PhoneNumberId === undefined) {
-            return yield* Effect.fail(
-              new SmsVoicePhoneNumberMissing({
-                message: "phone number not observable after request",
-              }),
-            );
+            return yield* new SmsVoicePhoneNumberMissing({
+              message: "phone number not observable after request",
+            });
           }
           const phoneNumberId = observed.PhoneNumberId;
 
@@ -296,11 +290,9 @@ export const PhoneNumberProvider = () =>
           // 4. Return fresh attributes.
           const final = yield* getById(phoneNumberId);
           if (final === undefined) {
-            return yield* Effect.fail(
-              new SmsVoicePhoneNumberMissing({
-                message: `phone number '${phoneNumberId}' vanished during reconcile`,
-              }),
-            );
+            return yield* new SmsVoicePhoneNumberMissing({
+              message: `phone number '${phoneNumberId}' vanished during reconcile`,
+            });
           }
           yield* session.note(final.PhoneNumberArn);
           return yield* toAttrs(final);

package/src/AWS/PinpointSMSVoiceV2/internal.ts

@@ -22,7 +22,7 @@ export const toTagList = (tags: Record<string, string>): smsvoice.Tag[] =>
 export const readSmsVoiceTags = Effect.fn(function* (arn: string) {
   const response = yield* smsvoice
     .listTagsForResource({ ResourceArn: arn })
-    .pipe(Effect.catch(() => Effect.succeed(undefined)));
+    .pipe(Effect.orElseSucceed(() => undefined));
   return toTagRecord(response?.Tags);
 });
 

package/src/AWS/Pipes/Pipe.ts

@@ -429,13 +429,11 @@ export const PipeProvider = () =>
           ),
         );
         if (described?.CurrentState !== undefined && isFailedState(described.CurrentState)) {
-          return yield* Effect.fail(
-            new PipeFailed({
-              pipeName,
-              state: described.CurrentState,
-              stateReason: described.StateReason,
-            }),
-          );
+          return yield* new PipeFailed({
+            pipeName,
+            state: described.CurrentState,
+            stateReason: described.StateReason,
+          });
         }
         return described;
       });
@@ -571,13 +569,11 @@ export const PipeProvider = () =>
           }
 
           if (observed?.Arn === undefined) {
-            return yield* Effect.fail(
-              new PipeFailed({
-                pipeName,
-                state: "MISSING",
-                stateReason: `describePipe returned no pipe after createPipe('${pipeName}') succeeded`,
-              }),
-            );
+            return yield* new PipeFailed({
+              pipeName,
+              state: "MISSING",
+              stateReason: `describePipe returned no pipe after createPipe('${pipeName}') succeeded`,
+            });
           }
 
           // 3. SYNC — diff OBSERVED cloud state against desired and update
@@ -626,13 +622,11 @@ export const PipeProvider = () =>
           }
 
           if (observed?.Arn === undefined) {
-            return yield* Effect.fail(
-              new PipeFailed({
-                pipeName,
-                state: "MISSING",
-                stateReason: `Pipe '${pipeName}' disappeared during reconciliation`,
-              }),
-            );
+            return yield* new PipeFailed({
+              pipeName,
+              state: "MISSING",
+              stateReason: `Pipe '${pipeName}' disappeared during reconciliation`,
+            });
           }
 
           // 3b. SYNC TAGS — diff against OBSERVED cloud tags so adoption

package/src/AWS/Providers.ts

@@ -98,7 +98,7 @@ import * as EMRContainers from "./EMRContainers/index.ts";
 import * as EMRServerless from "./EMRServerless/index.ts";
 import * as Endpoint from "./Endpoint.ts";
 import * as EntityResolution from "./EntityResolution/index.ts";
-import { Default as DefaultEnvironment } from "./Environment.ts";
+import { providedOrDefault } from "./Environment.ts";
 import * as EventBridge from "./EventBridge/index.ts";
 import * as FinSpace from "./FinSpace/index.ts";
 import * as Firehose from "./Firehose/index.ts";
@@ -225,6 +225,39 @@ import * as XRay from "./XRay/index.ts";
 
 export class Providers extends Provider.ProviderCollection<Providers>()("AWS") {}
 
+/**
+ * Every AWS provider, pinned to one AWS environment (account, region and
+ * credentials).
+ *
+ * By default the environment resolves lazily from the configured profile, CI
+ * credentials or the ambient AWS environment. Provide your own
+ * `AWSEnvironment` to deploy with another credential source, e.g. a role
+ * assumed at runtime; provide the same layer to {@link state} so resources and
+ * state share it.
+ *
+ * ```typescript
+ * const environment = Layer.effect(
+ *   AWS.AWSEnvironment,
+ *   Effect.gen(function* () {
+ *     const session = yield* assumeDeployRole;
+ *     return Effect.succeed({
+ *       accountId: session.accountId,
+ *       region: session.region,
+ *       credentials: session.credentials,
+ *     });
+ *   }),
+ * );
+ *
+ * const Stack = Alchemy.Stack(
+ *   "my-stack",
+ *   {
+ *     providers: AWS.providers().pipe(Layer.provide(environment)),
+ *     state: AWS.state({ bucketName: "my-company-state" }).pipe(Layer.provide(environment)),
+ *   },
+ *   program,
+ * );
+ * ```
+ */
 export const providers = () =>
   Layer.effect(
     Providers,
@@ -1796,10 +1829,13 @@ export const providers = () =>
     // at the stack level lets `Capability.execute(...)` Outputs (e.g.
     // `AWS.EC2.getAmi`) resolve during plan.
     Layer.provideMerge(EC2.GetAmiHttp),
-    Layer.provideMerge(Region.fromEnvironment),
-    Layer.provideMerge(Credentials.fromEnvironment),
-    Layer.provideMerge(Endpoint.fromEnvironment),
-    Layer.provideMerge(DefaultEnvironment),
+    // Fresh per call: these derive from the environment below, and shared
+    // (memoized) instances built for another environment in the same run
+    // would shadow an `AWSEnvironment` provided to this layer.
+    Layer.provideMerge(Layer.fresh(Region.fromEnvironment)),
+    Layer.provideMerge(Layer.fresh(Credentials.fromEnvironment)),
+    Layer.provideMerge(Layer.fresh(Endpoint.fromEnvironment)),
+    Layer.provideMerge(providedOrDefault()),
     Layer.provideMerge(AwsAuth),
     Layer.provideMerge(CredentialsStoreLive),
     // Apply a blanket retry policy to every AWS SDK call. Like distilled's

package/src/AWS/QBusiness/Application.ts

@@ -272,22 +272,16 @@ const waitForApplicationStatus = (applicationId: string, target: "ACTIVE" | "DEL
         .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.succeed(undefined)));
       if (target === "DELETED") {
         if (described === undefined) return;
-        return yield* Effect.fail(
-          new ApplicationNotReady({ applicationId, status: described.status }),
-        );
+        return yield* new ApplicationNotReady({ applicationId, status: described.status });
       }
       if (described?.status === "ACTIVE") return;
       if (described?.status === "FAILED") {
-        return yield* Effect.fail(
-          new ApplicationProvisioningFailed({
-            applicationId,
-            message: described.error?.errorMessage,
-          }),
-        );
+        return yield* new ApplicationProvisioningFailed({
+          applicationId,
+          message: described.error?.errorMessage,
+        });
       }
-      return yield* Effect.fail(
-        new ApplicationNotReady({ applicationId, status: described?.status }),
-      );
+      return yield* new ApplicationNotReady({ applicationId, status: described?.status });
     }),
   );
 

package/src/AWS/QBusiness/DataSource.ts

@@ -277,22 +277,16 @@ const waitForDataSourceStatus = (
         .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.succeed(undefined)));
       if (target === "DELETED") {
         if (described === undefined) return;
-        return yield* Effect.fail(
-          new DataSourceNotReady({ dataSourceId, status: described.status }),
-        );
+        return yield* new DataSourceNotReady({ dataSourceId, status: described.status });
       }
       if (described?.status === "ACTIVE") return;
       if (described?.status === "FAILED") {
-        return yield* Effect.fail(
-          new DataSourceProvisioningFailed({
-            dataSourceId,
-            message: described.error?.errorMessage,
-          }),
-        );
+        return yield* new DataSourceProvisioningFailed({
+          dataSourceId,
+          message: described.error?.errorMessage,
+        });
       }
-      return yield* Effect.fail(
-        new DataSourceNotReady({ dataSourceId, status: described?.status }),
-      );
+      return yield* new DataSourceNotReady({ dataSourceId, status: described?.status });
     }),
   );
 

package/src/AWS/QBusiness/Retriever.ts

@@ -209,9 +209,9 @@ const waitForRetrieverActive = (applicationId: string, retrieverId: string) =>
         .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.succeed(undefined)));
       if (described?.status === "ACTIVE") return;
       if (described?.status === "FAILED") {
-        return yield* Effect.fail(new RetrieverProvisioningFailed({ retrieverId }));
+        return yield* new RetrieverProvisioningFailed({ retrieverId });
       }
-      return yield* Effect.fail(new RetrieverNotReady({ retrieverId, status: described?.status }));
+      return yield* new RetrieverNotReady({ retrieverId, status: described?.status });
     }),
   );
 

package/src/AWS/QBusiness/SearchIndex.ts

@@ -212,18 +212,16 @@ const waitForIndexStatus = (applicationId: string, indexId: string, target: "ACT
         .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.succeed(undefined)));
       if (target === "DELETED") {
         if (described === undefined) return;
-        return yield* Effect.fail(new IndexNotReady({ indexId, status: described.status }));
+        return yield* new IndexNotReady({ indexId, status: described.status });
       }
       if (described?.status === "ACTIVE") return;
       if (described?.status === "FAILED") {
-        return yield* Effect.fail(
-          new IndexProvisioningFailed({
-            indexId,
-            message: described.error?.errorMessage,
-          }),
-        );
+        return yield* new IndexProvisioningFailed({
+          indexId,
+          message: described.error?.errorMessage,
+        });
       }
-      return yield* Effect.fail(new IndexNotReady({ indexId, status: described?.status }));
+      return yield* new IndexNotReady({ indexId, status: described?.status });
     }),
   );
 

package/src/AWS/QBusiness/WebExperience.ts

@@ -205,30 +205,24 @@ const waitForWebExperienceSettled = (
         .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.succeed(undefined)));
       if (target === "DELETED") {
         if (described === undefined) return;
-        return yield* Effect.fail(
-          new WebExperienceNotReady({
-            webExperienceId,
-            status: described.status,
-          }),
-        );
+        return yield* new WebExperienceNotReady({
+          webExperienceId,
+          status: described.status,
+        });
       }
       if (described?.status === "ACTIVE" || described?.status === "PENDING_AUTH_CONFIG") {
         return;
       }
       if (described?.status === "FAILED") {
-        return yield* Effect.fail(
-          new WebExperienceProvisioningFailed({
-            webExperienceId,
-            message: described.error?.errorMessage,
-          }),
-        );
-      }
-      return yield* Effect.fail(
-        new WebExperienceNotReady({
+        return yield* new WebExperienceProvisioningFailed({
           webExperienceId,
-          status: described?.status,
-        }),
-      );
+          message: described.error?.errorMessage,
+        });
+      }
+      return yield* new WebExperienceNotReady({
+        webExperienceId,
+        status: described?.status,
+      });
     }),
   );
 

package/src/AWS/QuickSight/internal.ts

@@ -91,7 +91,7 @@ export const toTagRecord = (
 export const readQuickSightTags = Effect.fn(function* (arn: string) {
   const response = yield* quicksight
     .listTagsForResource({ ResourceArn: arn })
-    .pipe(Effect.catch(() => Effect.succeed(undefined)));
+    .pipe(Effect.orElseSucceed(() => undefined));
   return toTagRecord(response?.Tags);
 });
 

package/src/AWS/RAM/ResourceShare.ts

@@ -326,9 +326,11 @@ export const ResourceShareProvider = () =>
               resourceShareArn: output.resourceShareArn,
             })
             .pipe(
-              Effect.catchTag("UnknownResourceException", () => Effect.void),
-              // Already transitioning to DELETED from a prior attempt.
-              Effect.catchTag("InvalidStateTransitionException", () => Effect.void),
+              Effect.catchTags({
+                UnknownResourceException: () => Effect.void,
+                // Already transitioning to DELETED from a prior attempt.
+                InvalidStateTransitionException: () => Effect.void,
+              }),
             );
         }),
       };