alchemy 2.0.0-beta.55 → 2.0.0-beta.56

package/src/AWS/IdentityCenter/Instance.ts

@@ -85,6 +85,32 @@ export const InstanceProvider = () =>
     Effect.gen(function* () {
       return {
         stables: ["instanceArn", "identityStoreId", "ownerAccountId", "mode"],
+        // Enumerate every Identity Center instance visible to the calling
+        // account (organization + account instances). `ListInstances` is
+        // paginated and fully hydrates each `InstanceMetadata`, so no
+        // per-item read is needed. Accounts with no SSO enabled return an
+        // empty list (not an error). Each item is mapped to the exact `read`
+        // Attributes shape; `mode` defaults to "existing" since enumeration
+        // only observes pre-existing instances.
+        list: () =>
+          Effect.gen(function* () {
+            const instances = yield* listInstances();
+            return instances
+              .filter(
+                (
+                  instance,
+                ): instance is ssoAdmin.InstanceMetadata & {
+                  InstanceArn: string;
+                  IdentityStoreId: string;
+                } =>
+                  instance.InstanceArn != null &&
+                  instance.IdentityStoreId != null,
+              )
+              .map((instance) => ({
+                ...toInstanceAttributes(instance),
+                mode: "existing" as const,
+              }));
+          }),
         diff: Effect.fn(function* ({ olds, news }) {
           if (!isResolved(news)) return;
           if (

package/src/AWS/IdentityCenter/PermissionSet.ts

@@ -70,6 +70,35 @@ export const PermissionSetProvider = () =>
     Effect.gen(function* () {
       return {
         stables: ["permissionSetArn", "instanceArn"],
+        list: () =>
+          Effect.gen(function* () {
+            // Permission sets live on an Identity Center instance. Resolve
+            // the single enabled SSO instance, enumerate every permission
+            // set ARN via `listPermissionSets` (exhaustively paginated by
+            // the distilled `.items` stream), then hydrate each into the
+            // exact `read` shape via `describePermissionSet` (bounded
+            // concurrency, typed per-item not-found handled inside
+            // `readPermissionSetByArn`).
+            const instance = yield* resolveInstance();
+            const arns = yield* ssoAdmin.listPermissionSets
+              .items({
+                InstanceArn: instance.InstanceArn!,
+                MaxResults: 100,
+              })
+              .pipe(Stream.runCollect);
+            const rows = yield* Effect.forEach(
+              arns,
+              (permissionSetArn) =>
+                readPermissionSetByArn({
+                  instanceArn: instance.InstanceArn!,
+                  permissionSetArn,
+                }),
+              { concurrency: 10 },
+            );
+            return rows.filter(
+              (row): row is PermissionSet["Attributes"] => row !== undefined,
+            );
+          }),
         diff: Effect.fn(function* ({ olds, news }) {
           if (!isResolved(news)) return;
           if (

package/src/AWS/Kinesis/Stream.ts

@@ -5,6 +5,9 @@ import * as kinesis from "@distilled.cloud/aws/kinesis";
 import type * as lambda from "aws-lambda";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
+// `Stream` is the resource class name in this file, so alias the Effect
+// `Stream` module to avoid the collision.
+import * as EffectStream from "effect/Stream";
 import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
@@ -425,6 +428,32 @@ export const StreamProvider = () =>
     Effect.gen(function* () {
       return {
         stables: ["streamName", "streamArn"],
+        // Enumerate every stream in the ambient account/region. `listStreams`
+        // is paginated; collect every page exhaustively, then hydrate each
+        // stream into the exact `read` Attributes shape (summary + tags +
+        // resource policy) via `readStream` with bounded concurrency. A
+        // stream that disappears between listing and hydration is handled
+        // inside `readStream` (typed `ResourceNotFoundException` -> undefined)
+        // and filtered out.
+        list: () =>
+          Effect.gen(function* () {
+            const streamNames = yield* kinesis.listStreams.pages({}).pipe(
+              EffectStream.runCollect,
+              Effect.map((chunk) =>
+                Array.from(chunk).flatMap((page) => page.StreamNames ?? []),
+              ),
+            );
+
+            const hydrated = yield* Effect.forEach(
+              streamNames,
+              (streamName) => readStream({ streamName }),
+              { concurrency: 10 },
+            );
+
+            return hydrated.filter(
+              (attrs): attrs is Stream["Attributes"] => attrs !== undefined,
+            );
+          }),
         read: Effect.fn(function* ({ id, olds, output }) {
           const streamName =
             output?.streamName ?? (yield* createStreamName(id, olds ?? {}));

package/src/AWS/Kinesis/StreamConsumer.ts

@@ -2,19 +2,20 @@ import * as kinesis from "@distilled.cloud/aws/kinesis";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
 import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import type { Input } from "../../Input.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
 import {
   createInternalTags,
   diffTags,
   hasAlchemyTags,
   type Tags,
 } from "../../Tags.ts";
+import type { Providers } from "../Providers.ts";
 import type { StreamArn } from "./Stream.ts";
 
 export type ConsumerName = string;
@@ -370,4 +371,68 @@ export const StreamConsumerProvider = () =>
 
       yield* waitForConsumerDeleted(output.consumerArn);
     }),
+    // Consumers are stream-scoped: listStreamConsumers requires a StreamARN.
+    // Fan out — enumerate every stream in the account/region, then list the
+    // consumers registered on each stream, then hydrate tags per consumer.
+    list: Effect.fn(function* () {
+      const streamArns = yield* kinesis.listStreams.pages({}).pipe(
+        Stream.runCollect,
+        Effect.map((chunk) =>
+          Array.from(chunk).flatMap((page) =>
+            (page.StreamSummaries ?? [])
+              .map((summary) => summary.StreamARN)
+              .filter((arn): arn is string => typeof arn === "string"),
+          ),
+        ),
+      );
+
+      const consumers = yield* Effect.forEach(
+        streamArns,
+        (streamArn) =>
+          kinesis.listStreamConsumers.pages({ StreamARN: streamArn }).pipe(
+            Stream.runCollect,
+            Effect.map((chunk) =>
+              Array.from(chunk).flatMap((page) =>
+                (page.Consumers ?? []).map((consumer) => ({
+                  streamArn,
+                  consumer,
+                })),
+              ),
+            ),
+            // A stream may be deleted mid-enumeration; skip it.
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(
+                [] as { streamArn: string; consumer: kinesis.Consumer }[],
+              ),
+            ),
+          ),
+        { concurrency: 10 },
+      ).pipe(Effect.map((rows) => rows.flat()));
+
+      const hydrated = yield* Effect.forEach(
+        consumers,
+        ({ streamArn, consumer }) =>
+          kinesis
+            .listTagsForResource({ ResourceARN: consumer.ConsumerARN })
+            .pipe(
+              Effect.map((tagsResponse): StreamConsumer["Attributes"] => ({
+                consumerName: consumer.ConsumerName,
+                consumerArn: consumer.ConsumerARN,
+                consumerStatus: consumer.ConsumerStatus as ConsumerStatus,
+                streamArn: streamArn as StreamArn,
+                consumerCreationTimestamp: consumer.ConsumerCreationTimestamp,
+                tags: toTagRecord(tagsResponse.Tags),
+              })),
+              // A consumer may be deregistered between list and tag fetch.
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            ),
+        { concurrency: 10 },
+      );
+
+      return hydrated.filter(
+        (row): row is StreamConsumer["Attributes"] => row !== undefined,
+      );
+    }),
   });

package/src/AWS/Lambda/EventSourceMapping.ts

@@ -458,6 +458,39 @@ export const EventSourceMappingProvider = () =>
             Effect.catchTag("ResourceNotFoundException", () => Effect.void),
           );
         }),
+        // `list()` — AWS account/region collection (§4a). Exhaustively
+        // paginate `listEventSourceMappings` with no `FunctionName` filter to
+        // enumerate every mapping in the current region, hydrating each into
+        // the exact `Attributes` shape `reconcile`/`configToAttrs` returns.
+        // The list response carries full `EventSourceMappingConfiguration`
+        // objects, so there is no per-item `getEventSourceMapping` to issue —
+        // hence no bounded fan-out or per-item `ResourceNotFoundException`
+        // handling is required. We drop any partial entry missing a required
+        // identifier field rather than emitting a malformed `Attributes`.
+        list: () =>
+          lambda.listEventSourceMappings.pages({}).pipe(
+            Stream.runCollect,
+            Effect.map((chunk) =>
+              Array.from(chunk).flatMap((page) =>
+                (page.EventSourceMappings ?? [])
+                  .filter(
+                    (
+                      config,
+                    ): config is lambda.EventSourceMappingConfiguration & {
+                      UUID: string;
+                      EventSourceMappingArn: string;
+                      FunctionArn: string;
+                      State: string;
+                    } =>
+                      config.UUID != null &&
+                      config.EventSourceMappingArn != null &&
+                      config.FunctionArn != null &&
+                      config.State != null,
+                  )
+                  .map(configToAttrs),
+              ),
+            ),
+          ),
       };
     }),
   );

package/src/AWS/Lambda/Function.ts

@@ -17,7 +17,7 @@ import type * as rolldown from "rolldown";
 import { Unowned } from "../../AdoptPolicy.ts";
 import * as Bundle from "../../Bundle/Bundle.ts";
 import * as TempRoot from "../../Bundle/TempRoot.ts";
-import { isResolved } from "../../Diff.ts";
+import { deepEqual, isResolved } from "../../Diff.ts";
 import type { HttpEffect } from "../../Http.ts";
 import * as Output from "../../Output.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
@@ -65,6 +65,24 @@ export interface FunctionBuildOptions {
   readonly output?: Partial<rolldown.OutputOptions>;
 }
 
+export interface FunctionUrlConfig {
+  /**
+   * Authentication type for the Lambda function URL.
+   * `NONE` creates a public endpoint. `AWS_IAM` requires SigV4-signed callers.
+   * @default "NONE"
+   */
+  authType?: Lambda.FunctionUrlAuthType;
+  /**
+   * Cross-origin resource sharing configuration for the function URL.
+   */
+  cors?: Lambda.Cors;
+  /**
+   * Invocation mode for the function URL.
+   * @default "BUFFERED"
+   */
+  invokeMode?: Lambda.InvokeMode;
+}
+
 export interface FunctionProps extends PlatformProps {
   /**
    * Entry module for the bundled Lambda function.
@@ -76,10 +94,12 @@ export interface FunctionProps extends PlatformProps {
    */
   handler?: string;
   /**
-   * Whether to create a public Lambda function URL.
-   * @default false
+   * Whether to create a Lambda function URL, or its configuration.
+   * `true` creates a public Function URL with `authType: "NONE"`.
+   * Set `false` to disable the Function URL.
+   * @default true
    */
-  url?: boolean;
+  url?: boolean | FunctionUrlConfig;
   functionName?: string;
   // TODO(sam): use a Layer instead so we can manage Effect platform?
   runtime?: "nodejs22.x" | "nodejs24.x";
@@ -157,6 +177,31 @@ export type FunctionServices = Credentials | Region | AWSEnvironment;
 
 export type FunctionShape = Main<FunctionServices>;
 
+interface NormalizedFunctionUrlConfig {
+  authType: Lambda.FunctionUrlAuthType;
+  cors?: Lambda.Cors;
+  invokeMode: Lambda.InvokeMode;
+}
+
+const normalizeFunctionUrl = (
+  url: FunctionProps["url"] = true,
+): NormalizedFunctionUrlConfig | undefined => {
+  if (url === false) {
+    return undefined;
+  }
+  if (url === true || url === undefined) {
+    return {
+      authType: "NONE",
+      invokeMode: "BUFFERED",
+    };
+  }
+  return {
+    authType: url.authType ?? "NONE",
+    cors: url.cors,
+    invokeMode: url.invokeMode ?? "BUFFERED",
+  };
+};
+
 /**
  * An AWS Lambda host resource that combines code bundling, IAM role
  * provisioning, and runtime binding collection.
@@ -240,6 +285,16 @@ export type FunctionShape = Main<FunctionServices>;
  * });
  * ```
  *
+ * @example Function URL with IAM auth
+ * ```typescript
+ * const func = yield* AWS.Lambda.Function("ApiFunction", {
+ *   main: "./src/handler.ts",
+ *   url: {
+ *     authType: "AWS_IAM",
+ *   },
+ * });
+ * ```
+ *
  * @example Function in a VPC
  * ```typescript
  * const func = yield* AWS.Lambda.Function("VpcFunction", {
@@ -1025,78 +1080,116 @@ export default await Effect.runPromise(handlerEffect)
         }
       });
 
+      const publicUrlAccessStatementId = "FunctionURLAllowPublicAccess";
+      const publicUrlInvokeStatementId = "FunctionURLAllowPublicInvoke";
+
+      const removePublicFunctionUrlPermissions = Effect.fnUntraced(function* (
+        functionName: string,
+      ) {
+        yield* Effect.all(
+          [
+            Lambda.removePermission({
+              FunctionName: functionName,
+              StatementId: publicUrlAccessStatementId,
+            }).pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            ),
+            Lambda.removePermission({
+              FunctionName: functionName,
+              StatementId: publicUrlInvokeStatementId,
+            }).pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            ),
+          ],
+          { concurrency: "unbounded" },
+        );
+      });
+
+      const upsertPermission = (permission: Lambda.AddPermissionRequest) =>
+        Lambda.addPermission(permission).pipe(
+          Effect.catchTag("ResourceConflictException", () =>
+            Effect.gen(function* () {
+              yield* Lambda.removePermission({
+                FunctionName: permission.FunctionName,
+                StatementId: permission.StatementId,
+              }).pipe(
+                Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+              );
+              yield* Lambda.addPermission(permission);
+            }),
+          ),
+        );
+
+      const upsertPublicFunctionUrlPermissions = Effect.fnUntraced(function* (
+        functionName: string,
+      ) {
+        yield* Effect.all(
+          [
+            upsertPermission({
+              FunctionName: functionName,
+              StatementId: publicUrlAccessStatementId,
+              Action: "lambda:InvokeFunctionUrl",
+              Principal: "*",
+              FunctionUrlAuthType: "NONE",
+            }),
+            upsertPermission({
+              FunctionName: functionName,
+              StatementId: publicUrlInvokeStatementId,
+              Action: "lambda:InvokeFunction",
+              Principal: "*",
+              InvokedViaFunctionUrl: true,
+            }),
+          ],
+          { concurrency: "unbounded" },
+        );
+      });
+
       const createOrUpdateFunctionUrl = Effect.fnUntraced(function* ({
         functionName,
-        url = true,
+        url,
         oldUrl,
+        currentFunctionUrl,
       }: {
         functionName: string;
         url: FunctionProps["url"];
         oldUrl?: FunctionProps["url"];
+        currentFunctionUrl?: string;
       }) {
-        // TODO(sam): support AWS_IAM
-        const authType = "NONE";
-        yield* Effect.logDebug(`creating function url config ${functionName}`);
-        if (url) {
+        const desired = normalizeFunctionUrl(url);
+        const previous = normalizeFunctionUrl(oldUrl);
+        const hadFunctionUrl = previous !== undefined || !!currentFunctionUrl;
+
+        if (desired) {
+          yield* Effect.logDebug(
+            `creating function url config ${functionName}`,
+          );
+          const shouldClearCors =
+            desired.cors === undefined && previous?.cors !== undefined;
           const config = {
             FunctionName: functionName,
-            AuthType: authType, // | AWS_IAM
-            // Cors: {
-            //   AllowCredentials: true,
-            //   AllowHeaders: ["*"],
-            //   AllowMethods: ["*"],
-            //   AllowOrigins: ["*"],
-            //   ExposeHeaders: ["*"],
-            //   MaxAge: 86400,
-            // },
-            InvokeMode: "BUFFERED", // | RESPONSE_STREAM
-            // Qualifier: "$LATEST"
+            AuthType: desired.authType,
+            Cors: desired.cors ?? (shouldClearCors ? {} : undefined),
+            InvokeMode: desired.invokeMode,
           } satisfies
             | Lambda.CreateFunctionUrlConfigRequest
             | Lambda.UpdateFunctionUrlConfigRequest;
-          const urlPermission = {
-            FunctionName: functionName,
-            StatementId: "FunctionURLAllowPublicAccess",
-            Action: "lambda:InvokeFunctionUrl",
-            Principal: "*",
-            FunctionUrlAuthType: "NONE",
-          } as const;
-          const invokePermission = {
-            FunctionName: functionName,
-            StatementId: "FunctionURLAllowPublicInvoke",
-            Action: "lambda:InvokeFunction",
-            Principal: "*",
-            InvokedViaFunctionUrl: true,
-          } as const;
-          const upsertPermission = (permission: Lambda.AddPermissionRequest) =>
-            Lambda.addPermission(permission).pipe(
-              Effect.catchTag("ResourceConflictException", () =>
-                Effect.gen(function* () {
-                  yield* Lambda.removePermission({
-                    FunctionName: functionName,
-                    StatementId: permission.StatementId,
-                  });
-                  yield* Lambda.addPermission(permission);
-                }),
-              ),
-            );
-          const [{ FunctionUrl }] = yield* Effect.all([
-            Lambda.createFunctionUrlConfig(config).pipe(
-              Effect.catchTag("ResourceConflictException", () =>
-                Lambda.updateFunctionUrlConfig(config),
-              ),
+          const { FunctionUrl } = yield* Lambda.createFunctionUrlConfig(
+            config,
+          ).pipe(
+            Effect.catchTag("ResourceConflictException", () =>
+              Lambda.updateFunctionUrlConfig(config),
             ),
-            authType === "NONE"
-              ? Effect.all([
-                  upsertPermission(urlPermission),
-                  upsertPermission(invokePermission),
-                ])
-              : // TODO(sam): support AWS_IAM
-                Effect.void,
-          ]);
+          );
+
+          if (desired.authType === "NONE") {
+            yield* upsertPublicFunctionUrlPermissions(functionName);
+          } else {
+            yield* removePublicFunctionUrlPermissions(functionName);
+          }
+
           yield* Effect.logDebug(`created function url config ${functionName}`);
           return FunctionUrl;
-        } else if (oldUrl) {
+        } else if (hadFunctionUrl) {
           yield* Effect.logDebug(
             `deleting function url config ${functionName}`,
           );
@@ -1106,18 +1199,7 @@ export default await Effect.runPromise(handlerEffect)
             }).pipe(
               Effect.catchTag("ResourceNotFoundException", () => Effect.void),
             ),
-            Lambda.removePermission({
-              FunctionName: functionName,
-              StatementId: "FunctionURLAllowPublicAccess",
-            }).pipe(
-              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
-            ),
-            Lambda.removePermission({
-              FunctionName: functionName,
-              StatementId: "FunctionURLAllowPublicInvoke",
-            }).pipe(
-              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
-            ),
+            removePublicFunctionUrlPermissions(functionName),
           ]);
           yield* Effect.logDebug(`deleted function url config ${functionName}`);
         }
@@ -1144,12 +1226,18 @@ export default await Effect.runPromise(handlerEffect)
           if (
             // function name changed
             output.functionName !==
-              (yield* createFunctionName(id, news.functionName)) ||
-            // url changed
-            (olds.url ?? true) !== news.url
+            (yield* createFunctionName(id, news.functionName))
           ) {
             return { action: "replace" };
           }
+          if (
+            !deepEqual(
+              normalizeFunctionUrl(olds.url),
+              normalizeFunctionUrl(news.url),
+            )
+          ) {
+            return { action: "update" };
+          }
           if (
             output.code.hash !==
             (yield* bundleCode(id, {
@@ -1218,6 +1306,52 @@ export default await Effect.runPromise(handlerEffect)
             ? attrs
             : Unowned(attrs);
         }),
+        // Account/region collection: exhaustively paginate `listFunctions`
+        // (its `Functions` items are `FunctionConfiguration`s, the same shape
+        // `read` pulls from `getFunction().Configuration`), then hydrate each
+        // into the exact `read` Attributes shape with a bounded fan-out. The
+        // code hash is not recoverable from the API (it lives in persisted
+        // state), so it is left empty — `delete`/nuke only needs the
+        // function/role identifiers.
+        list: () =>
+          Effect.gen(function* () {
+            const configs = yield* Lambda.listFunctions.items({}).pipe(
+              Stream.runCollect,
+              Effect.map((chunk) => Array.from(chunk)),
+            );
+            const rows = yield* Effect.forEach(
+              configs,
+              (fn) =>
+                Effect.gen(function* () {
+                  if (!fn.FunctionArn || !fn.FunctionName || !fn.Role) {
+                    return undefined;
+                  }
+                  const functionUrl = yield* Lambda.getFunctionUrlConfig({
+                    FunctionName: fn.FunctionName,
+                  }).pipe(
+                    Effect.map((f) => f.FunctionUrl),
+                    // No URL config (or the function vanished between the
+                    // list and the hydrate) — surface `undefined`, matching
+                    // `read`.
+                    Effect.catchTag("ResourceNotFoundException", () =>
+                      Effect.succeed(undefined),
+                    ),
+                  );
+                  return {
+                    functionArn: fn.FunctionArn,
+                    functionName: fn.FunctionName,
+                    functionUrl,
+                    roleArn: fn.Role,
+                    roleName: fn.Role.split("/").pop()!,
+                    code: { hash: "" },
+                  } satisfies Function["Attributes"];
+                }),
+              { concurrency: 10 },
+            );
+            return rows.filter(
+              (row): row is Function["Attributes"] => row !== undefined,
+            );
+          }),
 
         precreate: Effect.fnUntraced(function* ({ id, news, session }) {
           const { accountId, region } = yield* AWSEnvironment.current;
@@ -1310,6 +1444,7 @@ export default await Effect.runPromise(handlerEffect)
             functionName,
             url: news.url,
             oldUrl: olds?.url,
+            currentFunctionUrl: output?.functionUrl,
           });
 
           yield* session.note(summary({ code }));

package/src/AWS/Lambda/HttpServer.ts

@@ -33,7 +33,18 @@ export const isApiGatewayProxyEvent = (
 
 export const makeFunctionHttpHandler = <Req>(handler: Http.HttpEffect<Req>) => {
   const safeHandler = Http.safeHttpEffect(handler);
-  return (event: any) => {
+  return (
+    event: any,
+  ):
+    | Effect.Effect<
+        APIGatewayProxyResult | LambdaFunctionURLResult,
+        never,
+        Exclude<
+          Effect.Services<typeof handler>,
+          HttpServerRequest.HttpServerRequest | Scope
+        >
+      >
+    | undefined => {
     if (isFunctionURLEvent(event)) {
       const webRequest = functionUrlEventToWebRequest(event);
       const request = HttpServerRequest.fromWeb(webRequest).modify({