alchemy 2.0.0-beta.56 → 2.0.0-beta.57

package/src/AWS/ELBv2/Listener.ts

@@ -8,6 +8,7 @@ import { Resource } from "../../Resource.ts";
 import type { AccountID } from "../Environment.ts";
 import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
+import { type ListenerAction, serializeActions } from "./common.ts";
 import type { LoadBalancer, LoadBalancerArn } from "./LoadBalancer.ts";
 import type { TargetGroup, TargetGroupArn } from "./TargetGroup.ts";
 
@@ -15,12 +16,53 @@ export type ListenerArn =
   `arn:aws:elasticloadbalancing:${RegionID}:${AccountID}:listener/${string}`;
 
 export interface ListenerProps {
+  /** The load balancer this listener belongs to. Changing it replaces the listener. */
   loadBalancerArn: Input<LoadBalancerArn> | LoadBalancer;
-  targetGroupArn: Input<TargetGroupArn> | TargetGroup;
+  /**
+   * Single forward target group. Convenience sugar that desugars to a single
+   * `{ type: "forward" }` default action. Prefer {@link defaultActions} for the
+   * full action surface. Mutually exclusive with `defaultActions`.
+   */
+  targetGroupArn?: Input<TargetGroupArn> | TargetGroup;
+  /**
+   * The default actions for the listener (forward / redirect / fixedResponse /
+   * authenticateOidc / authenticateCognito). Takes precedence over
+   * {@link targetGroupArn}.
+   */
+  defaultActions?: ListenerAction[];
+  /** The port on which the load balancer listens. Updated in place. */
   port: number;
-  protocol?: "HTTP" | "HTTPS" | "TCP";
+  /**
+   * The listener protocol.
+   * @default "HTTP"
+   */
+  protocol?: "HTTP" | "HTTPS" | "TCP" | "TLS" | "UDP" | "TCP_UDP";
+  /**
+   * The default (and any additional SNI) certificate ARNs. The first entry is
+   * the default certificate; the rest are attached as SNI certificates.
+   * Prefer this over the legacy single {@link certificateArn}.
+   */
+  certificates?: string[];
+  /**
+   * The default certificate ARN (legacy single-cert form). Folded into
+   * {@link certificates} as the default certificate.
+   */
   certificateArn?: string;
+  /** The security policy that defines supported protocols and ciphers (HTTPS/TLS). */
   sslPolicy?: string;
+  /** The ALPN policy for TLS listeners (e.g. `HTTP2Optional`). */
+  alpnPolicy?: string[];
+  /** Mutual TLS (mTLS) configuration for HTTPS listeners. */
+  mutualAuthentication?: {
+    /** The mTLS mode. */
+    mode: "off" | "passthrough" | "verify";
+    /** The trust store ARN. Required when `mode` is `verify`. */
+    trustStoreArn?: string;
+    /** Whether to ignore expired client certificates. */
+    ignoreClientCertificateExpiry?: boolean;
+    /** Whether to advertise the trust-store CA names in the TLS handshake. */
+    advertiseTrustStoreCaNames?: "on" | "off";
+  };
 }
 
 export interface Listener extends Resource<
@@ -29,7 +71,7 @@ export interface Listener extends Resource<
   {
     listenerArn: ListenerArn;
     loadBalancerArn: LoadBalancerArn;
-    targetGroupArn: TargetGroupArn;
+    targetGroupArn: TargetGroupArn | undefined;
     port: number;
     protocol: string;
   },
@@ -37,8 +79,147 @@ export interface Listener extends Resource<
   Providers
 > {}
 
+/**
+ * An ELBv2 (Application/Network) Load Balancer listener. A listener checks for
+ * connection requests using its configured protocol and port, then routes them
+ * to target groups via its default actions (and any attached
+ * {@link ListenerRule}s).
+ * @resource
+ * @section Creating a Listener
+ * @example Basic HTTP forward listener
+ * ```typescript
+ * const listener = yield* Listener("http", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   targetGroupArn: tg.targetGroupArn,
+ *   port: 80,
+ *   protocol: "HTTP",
+ * });
+ * ```
+ *
+ * @example HTTPS listener with certificate and SSL policy
+ * ```typescript
+ * const listener = yield* Listener("https", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     { type: "forward", targetGroups: [{ targetGroupArn: tg.targetGroupArn }] },
+ *   ],
+ *   port: 443,
+ *   protocol: "HTTPS",
+ *   certificates: [primaryCertArn, sniCertArn],
+ *   sslPolicy: "ELBSecurityPolicy-TLS13-1-2-2021-06",
+ * });
+ * ```
+ *
+ * @section Default Actions
+ * @example Redirect HTTP to HTTPS
+ * ```typescript
+ * const redirect = yield* Listener("redirect", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     { type: "redirect", statusCode: "HTTP_301", protocol: "HTTPS", port: "443" },
+ *   ],
+ *   port: 80,
+ *   protocol: "HTTP",
+ * });
+ * ```
+ *
+ * @example Fixed response
+ * ```typescript
+ * const maintenance = yield* Listener("maintenance", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     { type: "fixedResponse", statusCode: "503", contentType: "text/plain", messageBody: "down" },
+ *   ],
+ *   port: 80,
+ * });
+ * ```
+ *
+ * @example Weighted forward with stickiness
+ * ```typescript
+ * const weighted = yield* Listener("weighted", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     {
+ *       type: "forward",
+ *       targetGroups: [
+ *         { targetGroupArn: blue.targetGroupArn, weight: 90 },
+ *         { targetGroupArn: green.targetGroupArn, weight: 10 },
+ *       ],
+ *       stickiness: { enabled: true, durationSeconds: 3600 },
+ *     },
+ *   ],
+ *   port: 80,
+ * });
+ * ```
+ *
+ * @section Mutual TLS
+ * @example mTLS verify mode with a trust store
+ * ```typescript
+ * const mtls = yield* Listener("mtls", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     { type: "forward", targetGroups: [{ targetGroupArn: tg.targetGroupArn }] },
+ *   ],
+ *   port: 443,
+ *   protocol: "HTTPS",
+ *   certificates: [certArn],
+ *   mutualAuthentication: { mode: "verify", trustStoreArn: trustStore.trustStoreArn },
+ * });
+ * ```
+ */
 export const Listener = Resource<Listener>("AWS.ELBv2.Listener");
 
+// Build the default-action wire shape from desugared props.
+const desiredDefaultActions = (props: ListenerProps): elbv2.Action[] => {
+  if (props.defaultActions && props.defaultActions.length > 0) {
+    return serializeActions(props.defaultActions);
+  }
+  if (props.targetGroupArn) {
+    return serializeActions([
+      {
+        type: "forward",
+        targetGroups: [
+          { targetGroupArn: props.targetGroupArn as TargetGroupArn },
+        ],
+      },
+    ]);
+  }
+  return [];
+};
+
+// The default forward target group (if any) for the Attributes shape.
+const defaultForwardTargetGroup = (
+  actions: elbv2.Action[] | undefined,
+): TargetGroupArn | undefined => {
+  const forward = (actions ?? []).find((a) => a.Type === "forward");
+  return (forward?.TargetGroupArn ??
+    forward?.ForwardConfig?.TargetGroups?.[0]?.TargetGroupArn) as
+    | TargetGroupArn
+    | undefined;
+};
+
+// Build certificate list: first = default, the rest are SNI extras.
+const desiredCertificates = (props: ListenerProps): string[] => {
+  if (props.certificates && props.certificates.length > 0) {
+    return props.certificates;
+  }
+  return props.certificateArn ? [props.certificateArn] : [];
+};
+
+const desiredMutualAuth = (
+  props: ListenerProps,
+): elbv2.MutualAuthenticationAttributes | undefined =>
+  props.mutualAuthentication
+    ? {
+        Mode: props.mutualAuthentication.mode,
+        TrustStoreArn: props.mutualAuthentication.trustStoreArn,
+        IgnoreClientCertificateExpiry:
+          props.mutualAuthentication.ignoreClientCertificateExpiry,
+        AdvertiseTrustStoreCaNames:
+          props.mutualAuthentication.advertiseTrustStoreCaNames,
+      }
+    : undefined;
+
 export const ListenerProvider = () =>
   Provider.succeed(Listener, {
     stables: ["listenerArn", "loadBalancerArn"],
@@ -65,14 +246,12 @@ export const ListenerProvider = () =>
       if (!listener?.ListenerArn) {
         return undefined;
       }
-      const defaultForward = (listener.DefaultActions ?? []).find(
-        (action) => action.Type === "forward",
-      );
       return {
         listenerArn: listener.ListenerArn as ListenerArn,
         loadBalancerArn: listener.LoadBalancerArn as LoadBalancerArn,
-        targetGroupArn: (defaultForward?.TargetGroupArn ??
-          output.targetGroupArn) as TargetGroupArn,
+        targetGroupArn:
+          defaultForwardTargetGroup(listener.DefaultActions) ??
+          output.targetGroupArn,
         port: listener.Port!,
         protocol: listener.Protocol!,
       };
@@ -107,20 +286,16 @@ export const ListenerProvider = () =>
                       (l): l is typeof l & { ListenerArn: string } =>
                         l.ListenerArn != null,
                     )
-                    .map((listener) => {
-                      const defaultForward = (
-                        listener.DefaultActions ?? []
-                      ).find((action) => action.Type === "forward");
-                      return {
-                        listenerArn: listener.ListenerArn as ListenerArn,
-                        loadBalancerArn:
-                          listener.LoadBalancerArn as LoadBalancerArn,
-                        targetGroupArn: (defaultForward?.TargetGroupArn ??
-                          "") as TargetGroupArn,
-                        port: listener.Port!,
-                        protocol: listener.Protocol!,
-                      };
-                    }),
+                    .map((listener) => ({
+                      listenerArn: listener.ListenerArn as ListenerArn,
+                      loadBalancerArn:
+                        listener.LoadBalancerArn as LoadBalancerArn,
+                      targetGroupArn: defaultForwardTargetGroup(
+                        listener.DefaultActions,
+                      ),
+                      port: listener.Port!,
+                      protocol: listener.Protocol!,
+                    })),
                 ),
               ),
               // The LB may vanish between enumeration and per-LB listing.
@@ -138,8 +313,10 @@ export const ListenerProvider = () =>
     }),
     reconcile: Effect.fn(function* ({ news, output, session }) {
       const loadBalancerArn = news.loadBalancerArn as LoadBalancerArn;
-      const desiredTargetGroupArn = news.targetGroupArn as TargetGroupArn;
       const desiredProtocol = news.protocol ?? "HTTP";
+      const defaultActions = desiredDefaultActions(news);
+      const certs = desiredCertificates(news);
+      const mutualAuthentication = desiredMutualAuth(news);
 
       // Observe — describe the listener if we have a prior ARN; otherwise
       // list listeners on the load balancer and find one matching port.
@@ -172,22 +349,18 @@ export const ListenerProvider = () =>
         listener = listed?.Listeners?.find((l) => l.Port === news.port);
       }
 
-      // Ensure — create if missing.
+      // Ensure — create if missing. The first certificate is the default.
       if (!listener?.ListenerArn) {
         const created = yield* elbv2.createListener({
           LoadBalancerArn: loadBalancerArn,
           Port: news.port,
           Protocol: desiredProtocol,
-          Certificates: news.certificateArn
-            ? [{ CertificateArn: news.certificateArn }]
-            : undefined,
+          Certificates:
+            certs.length > 0 ? [{ CertificateArn: certs[0] }] : undefined,
           SslPolicy: news.sslPolicy,
-          DefaultActions: [
-            {
-              Type: "forward",
-              TargetGroupArn: desiredTargetGroupArn,
-            },
-          ],
+          AlpnPolicy: news.alpnPolicy,
+          MutualAuthentication: mutualAuthentication,
+          DefaultActions: defaultActions,
         });
         listener = created.Listeners?.[0];
         if (!listener?.ListenerArn) {
@@ -195,41 +368,60 @@ export const ListenerProvider = () =>
             new Error("createListener returned no listener"),
           );
         }
-        yield* session.note(listener.ListenerArn);
-        return {
-          listenerArn: listener.ListenerArn as ListenerArn,
-          loadBalancerArn: listener.LoadBalancerArn as LoadBalancerArn,
-          targetGroupArn: desiredTargetGroupArn,
-          port: listener.Port!,
-          protocol: listener.Protocol!,
-        };
+      } else {
+        // Sync — modifyListener fully replaces these mutable fields.
+        const modified = yield* elbv2.modifyListener({
+          ListenerArn: listener.ListenerArn,
+          Port: news.port,
+          Protocol: desiredProtocol,
+          Certificates:
+            certs.length > 0 ? [{ CertificateArn: certs[0] }] : undefined,
+          SslPolicy: news.sslPolicy,
+          AlpnPolicy: news.alpnPolicy,
+          MutualAuthentication: mutualAuthentication,
+          DefaultActions: defaultActions,
+        });
+        listener = modified.Listeners?.[0] ?? listener;
       }
 
-      // Sync — apply mutable fields (port, protocol, certificates,
-      // sslPolicy, defaultActions). modifyListener fully replaces these.
-      const modified = yield* elbv2.modifyListener({
-        ListenerArn: listener.ListenerArn,
-        Port: news.port,
-        Protocol: desiredProtocol,
-        Certificates: news.certificateArn
-          ? [{ CertificateArn: news.certificateArn }]
-          : undefined,
-        SslPolicy: news.sslPolicy,
-        DefaultActions: [
-          {
-            Type: "forward",
-            TargetGroupArn: desiredTargetGroupArn,
-          },
-        ],
-      });
-      const final = modified.Listeners?.[0] ?? listener;
-      yield* session.note(listener.ListenerArn);
+      const listenerArn = listener.ListenerArn!;
+
+      // Sync additional SNI certificates — observed ↔ desired. The default
+      // certificate (certs[0]) is carried by modifyListener and is excluded
+      // from the SNI set.
+      const desiredSni = new Set(certs.slice(1));
+      const observedCerts = yield* elbv2
+        .describeListenerCertificates({ ListenerArn: listenerArn })
+        .pipe(
+          Effect.catchTag("ListenerNotFoundException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      const observedSni = (observedCerts?.Certificates ?? [])
+        .filter((c) => !c.IsDefault && c.CertificateArn)
+        .map((c) => c.CertificateArn!);
+      const toAdd = [...desiredSni].filter((arn) => !observedSni.includes(arn));
+      const toRemove = observedSni.filter((arn) => !desiredSni.has(arn));
+      if (toAdd.length > 0) {
+        yield* elbv2.addListenerCertificates({
+          ListenerArn: listenerArn,
+          Certificates: toAdd.map((arn) => ({ CertificateArn: arn })),
+        });
+      }
+      if (toRemove.length > 0) {
+        yield* elbv2.removeListenerCertificates({
+          ListenerArn: listenerArn,
+          Certificates: toRemove.map((arn) => ({ CertificateArn: arn })),
+        });
+      }
+
+      yield* session.note(listenerArn);
       return {
-        listenerArn: listener.ListenerArn as ListenerArn,
+        listenerArn: listenerArn as ListenerArn,
         loadBalancerArn: listener.LoadBalancerArn as LoadBalancerArn,
-        targetGroupArn: desiredTargetGroupArn,
-        port: final.Port ?? news.port,
-        protocol: final.Protocol ?? desiredProtocol,
+        targetGroupArn: defaultForwardTargetGroup(defaultActions),
+        port: listener.Port ?? news.port,
+        protocol: listener.Protocol ?? desiredProtocol,
       };
     }),
     delete: Effect.fn(function* ({ output }) {

package/src/AWS/ELBv2/ListenerRule.ts

@@ -0,0 +1,289 @@
+import * as elbv2 from "@distilled.cloud/aws/elastic-load-balancing-v2";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
+import type { RegionID } from "../Region.ts";
+import {
+  type ListenerAction,
+  type ListenerRuleCondition,
+  serializeActions,
+  serializeConditions,
+} from "./common.ts";
+import type { Listener, ListenerArn } from "./Listener.ts";
+
+export type RuleArn =
+  `arn:aws:elasticloadbalancing:${RegionID}:${AccountID}:listener-rule/${string}`;
+
+export interface ListenerRuleProps {
+  /** The listener this rule attaches to. Changing it replaces the rule. */
+  listenerArn: Input<ListenerArn> | Listener;
+  /**
+   * The rule priority (1-50000). Lower numbers are evaluated first. Updated in
+   * place via `setRulePriorities`.
+   */
+  priority: number;
+  /** The conditions under which the rule matches a request (AND-ed). */
+  conditions: ListenerRuleCondition[];
+  /** The actions to take when the rule matches. */
+  actions: ListenerAction[];
+  /** Tags to apply to the rule. */
+  tags?: Record<string, string>;
+}
+
+export interface ListenerRule extends Resource<
+  "AWS.ELBv2.ListenerRule",
+  ListenerRuleProps,
+  {
+    ruleArn: RuleArn;
+    listenerArn: ListenerArn;
+    priority: number;
+    isDefault: boolean;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An ELBv2 listener rule. Rules attach to an Application Load Balancer listener
+ * and route requests to target groups (or other actions) based on conditions
+ * such as host header, path pattern, HTTP header, query string, request method,
+ * and source IP.
+ * @resource
+ * @section Creating a Rule
+ * @example Path-based routing
+ * ```typescript
+ * const rule = yield* ListenerRule("api", {
+ *   listenerArn: listener.listenerArn,
+ *   priority: 10,
+ *   conditions: [{ pathPattern: { values: ["/api/*"] } }],
+ *   actions: [
+ *     { type: "forward", targetGroups: [{ targetGroupArn: apiTg.targetGroupArn }] },
+ *   ],
+ * });
+ * ```
+ *
+ * @example Host-header routing
+ * ```typescript
+ * const rule = yield* ListenerRule("admin", {
+ *   listenerArn: listener.listenerArn,
+ *   priority: 20,
+ *   conditions: [{ hostHeader: { values: ["admin.example.com"] } }],
+ *   actions: [
+ *     { type: "forward", targetGroups: [{ targetGroupArn: adminTg.targetGroupArn }] },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Conditions
+ * @example Combining query-string and HTTP-header conditions
+ * ```typescript
+ * const rule = yield* ListenerRule("beta", {
+ *   listenerArn: listener.listenerArn,
+ *   priority: 30,
+ *   conditions: [
+ *     { queryString: { values: [{ key: "version", value: "beta" }] } },
+ *     { httpHeader: { name: "X-Channel", values: ["internal"] } },
+ *   ],
+ *   actions: [{ type: "fixedResponse", statusCode: "200", messageBody: "beta" }],
+ * });
+ * ```
+ */
+export const ListenerRule = Resource<ListenerRule>("AWS.ELBv2.ListenerRule");
+
+export const ListenerRuleProvider = () =>
+  Provider.succeed(ListenerRule, {
+    stables: ["ruleArn", "listenerArn"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      // priority is mutable in place via setRulePriorities; only the listener
+      // forces replacement.
+      if (olds.listenerArn !== news.listenerArn) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ output }) {
+      if (!output) {
+        return undefined;
+      }
+      const described = yield* elbv2
+        .describeRules({ RuleArns: [output.ruleArn] })
+        .pipe(
+          Effect.catchTag("RuleNotFoundException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      const rule = described?.Rules?.[0];
+      if (!rule?.RuleArn) {
+        return undefined;
+      }
+      return {
+        ruleArn: rule.RuleArn as RuleArn,
+        listenerArn: output.listenerArn,
+        priority: Number(rule.Priority ?? output.priority),
+        isDefault: rule.IsDefault ?? false,
+      };
+    }),
+    // Rules belong to a listener, which belongs to a load balancer. Enumerate
+    // every load balancer, then every listener, then every rule.
+    list: Effect.fn(function* () {
+      const loadBalancerArns = yield* elbv2.describeLoadBalancers
+        .pages({})
+        .pipe(
+          Stream.runCollect,
+          Effect.map((chunk) =>
+            Array.from(chunk).flatMap((page) =>
+              (page.LoadBalancers ?? []).flatMap((lb) =>
+                lb.LoadBalancerArn ? [lb.LoadBalancerArn] : [],
+              ),
+            ),
+          ),
+        );
+      const listenerArns = yield* Effect.forEach(
+        loadBalancerArns,
+        (loadBalancerArn) =>
+          elbv2.describeListeners
+            .pages({ LoadBalancerArn: loadBalancerArn })
+            .pipe(
+              Stream.runCollect,
+              Effect.map((chunk) =>
+                Array.from(chunk).flatMap((page) =>
+                  (page.Listeners ?? []).flatMap((l) =>
+                    l.ListenerArn ? [l.ListenerArn as ListenerArn] : [],
+                  ),
+                ),
+              ),
+              Effect.catchTag("LoadBalancerNotFoundException", () =>
+                Effect.succeed([]),
+              ),
+              Effect.catchTag("ListenerNotFoundException", () =>
+                Effect.succeed([]),
+              ),
+            ),
+        { concurrency: 10 },
+      );
+      const rows = yield* Effect.forEach(
+        listenerArns.flat(),
+        (listenerArn) =>
+          elbv2.describeRules({ ListenerArn: listenerArn }).pipe(
+            Effect.map((res) =>
+              (res.Rules ?? [])
+                .filter(
+                  (r): r is typeof r & { RuleArn: string } =>
+                    r.RuleArn != null && !r.IsDefault,
+                )
+                .map((rule) => ({
+                  ruleArn: rule.RuleArn as RuleArn,
+                  listenerArn,
+                  priority: Number(rule.Priority ?? 0),
+                  isDefault: rule.IsDefault ?? false,
+                })),
+            ),
+            Effect.catchTag("ListenerNotFoundException", () =>
+              Effect.succeed([]),
+            ),
+            Effect.catchTag("RuleNotFoundException", () => Effect.succeed([])),
+          ),
+        { concurrency: 10 },
+      );
+      const result: ListenerRule["Attributes"][] = rows.flat();
+      return result;
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output, session }) {
+      const listenerArn = news.listenerArn as ListenerArn;
+      const desiredTags = {
+        ...(yield* createInternalTags(id)),
+        ...news.tags,
+      };
+      const conditions = serializeConditions(news.conditions);
+      const actions = serializeActions(news.actions);
+
+      // Observe — look up the rule by our prior ARN.
+      let rule: elbv2.Rule | undefined;
+      if (output?.ruleArn) {
+        const described = yield* elbv2
+          .describeRules({ RuleArns: [output.ruleArn] })
+          .pipe(
+            Effect.catchTag("RuleNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        rule = described?.Rules?.[0];
+      }
+
+      // Ensure — create if missing.
+      if (!rule?.RuleArn) {
+        const created = yield* elbv2.createRule({
+          ListenerArn: listenerArn,
+          Priority: news.priority,
+          Conditions: conditions,
+          Actions: actions,
+          Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+            Key,
+            Value,
+          })),
+        });
+        rule = created.Rules?.[0];
+        if (!rule?.RuleArn) {
+          return yield* Effect.die(new Error("createRule returned no rule"));
+        }
+      } else {
+        // Sync conditions + actions — modifyRule fully replaces these lists.
+        const modified = yield* elbv2.modifyRule({
+          RuleArn: rule.RuleArn,
+          Conditions: conditions,
+          Actions: actions,
+        });
+        rule = modified.Rules?.[0] ?? rule;
+
+        // Sync priority — not mutable via modifyRule.
+        if (Number(rule.Priority) !== news.priority) {
+          yield* elbv2.setRulePriorities({
+            RulePriorities: [
+              { RuleArn: rule.RuleArn, Priority: news.priority },
+            ],
+          });
+        }
+      }
+
+      const ruleArn = rule.RuleArn!;
+
+      // Sync tags — diff observed cloud tags against desired.
+      const tagDescriptions = yield* elbv2.describeTags({
+        ResourceArns: [ruleArn],
+      });
+      const observedTags = Object.fromEntries(
+        (tagDescriptions.TagDescriptions?.[0]?.Tags ?? [])
+          .filter(
+            (t): t is { Key: string; Value: string } =>
+              typeof t.Key === "string" && typeof t.Value === "string",
+          )
+          .map((t) => [t.Key, t.Value]),
+      );
+      const { removed, upsert } = diffTags(observedTags, desiredTags);
+      if (upsert.length > 0) {
+        yield* elbv2.addTags({ ResourceArns: [ruleArn], Tags: upsert });
+      }
+      if (removed.length > 0) {
+        yield* elbv2.removeTags({ ResourceArns: [ruleArn], TagKeys: removed });
+      }
+
+      yield* session.note(ruleArn);
+      return {
+        ruleArn: ruleArn as RuleArn,
+        listenerArn,
+        priority: news.priority,
+        isDefault: rule.IsDefault ?? false,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* elbv2
+        .deleteRule({ RuleArn: output.ruleArn })
+        .pipe(Effect.catchTag("RuleNotFoundException", () => Effect.void));
+    }),
+  });