alchemy 2.0.0-beta.61 → 2.0.0-beta.63

package/src/AWS/ECS/Task.ts

@@ -585,6 +585,7 @@ export const TaskProvider = () =>
 import { BunServices } from "@effect/platform-bun";
 import { BunHttpServer } from "alchemy/Http";
 import { Stack } from "alchemy/Stack";
+import { reifyBoundConfigProvider } from "alchemy/Runtime";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Credentials from "@distilled.cloud/aws/Credentials";
@@ -630,7 +631,7 @@ const program = handler.pipe(
       Layer.provideMerge(
         Layer.succeed(
           ConfigProvider.ConfigProvider,
-          ConfigProvider.fromEnv()
+          reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env)
         )
       ),
     )

package/src/AWS/EKS/Addon.ts

@@ -391,9 +391,10 @@ const waitForAddonActive = Effect.fn(function* ({
     }),
     Effect.retry({
       while: (error) => error instanceof AddonNotReady,
-      schedule: Schedule.exponential("1 second").pipe(
-        Schedule.both(Schedule.recurs(120)),
-      ),
+      schedule: Schedule.max([
+        Schedule.exponential("1 second"),
+        Schedule.recurs(120),
+      ]),
     }),
   );
 });
@@ -416,9 +417,10 @@ const waitForAddonDeleted = Effect.fn(function* ({
     ),
     Effect.retry({
       while: (error) => error instanceof AddonStillExists,
-      schedule: Schedule.exponential("1 second").pipe(
-        Schedule.both(Schedule.recurs(120)),
-      ),
+      schedule: Schedule.max([
+        Schedule.exponential("1 second"),
+        Schedule.recurs(120),
+      ]),
     }),
   );
 });

package/src/AWS/EKS/Cluster.ts

@@ -163,9 +163,10 @@ const normalizeTags = (tags: Record<string, string | undefined> | undefined) =>
 const jsonEqual = (a: unknown, b: unknown) =>
   JSON.stringify(a ?? undefined) === JSON.stringify(b ?? undefined);
 
-const updateRetrySchedule = Schedule.exponential("1 second").pipe(
-  Schedule.both(Schedule.recurs(120)),
-);
+const updateRetrySchedule = Schedule.max([
+  Schedule.exponential("1 second"),
+  Schedule.recurs(120),
+]);
 
 const getKubernetesConnection = (
   state: Pick<

package/src/AWS/ELBv2/TargetGroup.ts

@@ -399,9 +399,10 @@ export const TargetGroupProvider = () =>
             .pipe(
               Effect.retry({
                 while: (e) => e._tag === "ResourceInUseException",
-                schedule: Schedule.spaced("3 seconds").pipe(
-                  Schedule.both(Schedule.recurs(8)),
-                ),
+                schedule: Schedule.max([
+                  Schedule.spaced("3 seconds"),
+                  Schedule.recurs(8),
+                ]),
               }),
               Effect.catchTag("ResourceInUseException", () => Effect.void),
             );

package/src/AWS/ELBv2/TrustStore.ts

@@ -264,9 +264,10 @@ export const TrustStoreProvider = () =>
               // eventual-consistency window.
               Effect.retry({
                 while: (e) => e._tag === "TrustStoreInUseException",
-                schedule: Schedule.spaced("3 seconds").pipe(
-                  Schedule.both(Schedule.recurs(8)),
-                ),
+                schedule: Schedule.max([
+                  Schedule.spaced("3 seconds"),
+                  Schedule.recurs(8),
+                ]),
               }),
               Effect.catchTag("TrustStoreNotFoundException", () => Effect.void),
               Effect.catchTag("TrustStoreInUseException", () => Effect.void),

package/src/AWS/IAM/SAMLProvider.ts

@@ -71,10 +71,10 @@ export const SAMLProvider = Resource<SAMLProvider>("AWS.IAM.SAMLProvider");
 // until the prior delete settles. A bounded retry rides out that window; a
 // well-formed metadata document never fails persistently, so this never masks a
 // genuine bad-input error for longer than the small budget.
-const transientWriteSchedule = Schedule.exponential(500).pipe(
-  Schedule.jittered,
-  Schedule.both(Schedule.recurs(6)),
-);
+const transientWriteSchedule = Schedule.max([
+  Schedule.exponential(500).pipe(Schedule.jittered),
+  Schedule.recurs(6),
+]);
 const isTransientWriteError = (error: {
   _tag: "ValidationError" | "ConcurrentModificationException" | (string & {});
 }) =>

package/src/AWS/IdentityCenter/AccountAssignment.ts

@@ -384,9 +384,10 @@ const waitForAssignmentCreation = (instanceArn: string, requestId: string) =>
   }).pipe(
     Effect.retry({
       while: (error: any) => error?._tag === "AssignmentCreationInProgress",
-      schedule: Schedule.spaced("2 seconds").pipe(
-        Schedule.both(Schedule.recurs(120)),
-      ),
+      schedule: Schedule.max([
+        Schedule.spaced("2 seconds"),
+        Schedule.recurs(120),
+      ]),
     }),
   );
 
@@ -418,8 +419,9 @@ const waitForAssignmentDeletion = (instanceArn: string, requestId: string) =>
   }).pipe(
     Effect.retry({
       while: (error: any) => error?._tag === "AssignmentDeletionInProgress",
-      schedule: Schedule.spaced("2 seconds").pipe(
-        Schedule.both(Schedule.recurs(120)),
-      ),
+      schedule: Schedule.max([
+        Schedule.spaced("2 seconds"),
+        Schedule.recurs(120),
+      ]),
     }),
   );

package/src/AWS/IdentityCenter/common.ts

@@ -11,9 +11,7 @@ export const retryIdentityCenter = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
         error?._tag === "ConflictException" ||
         error?._tag === "ThrottlingException" ||
         error?._tag === "InternalServerException",
-      schedule: Schedule.exponential(200).pipe(
-        Schedule.both(Schedule.recurs(8)),
-      ),
+      schedule: Schedule.max([Schedule.exponential(200), Schedule.recurs(8)]),
     }),
   );
 

package/src/AWS/KMS/Alias.ts

@@ -213,6 +213,7 @@ const isKmsEventuallyConsistent = (error: { _tag: string }) =>
   error._tag === "KMSInvalidStateException" ||
   error._tag === "NotFoundException";
 
-const kmsRetrySchedule = Schedule.exponential(250).pipe(
-  Schedule.both(Schedule.recurs(7)),
-);
+const kmsRetrySchedule = Schedule.max([
+  Schedule.exponential(250),
+  Schedule.recurs(7),
+]);

package/src/AWS/KMS/Key.ts

@@ -586,6 +586,7 @@ class KmsKeyNotConverged extends Error {
   readonly _tag = "KmsKeyNotConverged";
 }
 
-const kmsRetrySchedule = Schedule.exponential(250).pipe(
-  Schedule.both(Schedule.recurs(7)),
-);
+const kmsRetrySchedule = Schedule.max([
+  Schedule.exponential(250),
+  Schedule.recurs(7),
+]);

package/src/AWS/Kinesis/Stream.ts

@@ -414,9 +414,7 @@ const waitForStreamActive = (streamName: string) =>
     Effect.retry({
       while: (e: { _tag: string }) =>
         e._tag === "StreamNotActive" || e._tag === "ParseError",
-      schedule: Schedule.exponential(500).pipe(
-        Schedule.both(Schedule.recurs(60)),
-      ),
+      schedule: Schedule.max([Schedule.exponential(500), Schedule.recurs(60)]),
     }),
   );
 
@@ -430,9 +428,7 @@ const waitForStreamDeleted = (streamName: string) =>
     Effect.retry({
       while: (e: { _tag: string }) =>
         e._tag === "StreamStillExists" || e._tag === "ParseError",
-      schedule: Schedule.exponential(500).pipe(
-        Schedule.both(Schedule.recurs(60)),
-      ),
+      schedule: Schedule.max([Schedule.exponential(500), Schedule.recurs(60)]),
     }),
     Effect.catchTag("ResourceNotFoundException", () => Effect.void),
   );

package/src/AWS/Kinesis/StreamConsumer.ts

@@ -178,9 +178,7 @@ const adoptExistingConsumer = Effect.fn(function* (
   }).pipe(
     Effect.retry({
       while: (e) => e._tag === "ConsumerRegistryNotConsistent",
-      schedule: Schedule.exponential(250).pipe(
-        Schedule.both(Schedule.recurs(8)),
-      ),
+      schedule: Schedule.max([Schedule.exponential(250), Schedule.recurs(8)]),
     }),
     Effect.catchTag("ConsumerRegistryNotConsistent", () =>
       Effect.fail(
@@ -210,9 +208,7 @@ const waitForConsumerStatus = (
     Effect.retry({
       while: (e: { _tag: string }) =>
         e._tag === "ConsumerStatusNotReady" || e._tag === "ParseError",
-      schedule: Schedule.exponential(500).pipe(
-        Schedule.both(Schedule.recurs(60)),
-      ),
+      schedule: Schedule.max([Schedule.exponential(500), Schedule.recurs(60)]),
     }),
   );
 
@@ -226,9 +222,7 @@ const waitForConsumerDeleted = (consumerArn: string) =>
     Effect.retry({
       while: (e: { _tag: string }) =>
         e._tag === "ConsumerStillExists" || e._tag === "ParseError",
-      schedule: Schedule.exponential(500).pipe(
-        Schedule.both(Schedule.recurs(60)),
-      ),
+      schedule: Schedule.max([Schedule.exponential(500), Schedule.recurs(60)]),
     }),
     Effect.catchTag("ResourceNotFoundException", () => Effect.void),
   );
@@ -309,9 +303,10 @@ export const StreamConsumerProvider = () =>
             // propagation window before giving up.
             Effect.retry({
               while: (e) => e._tag === "ResourceNotFoundException",
-              schedule: Schedule.exponential(500).pipe(
-                Schedule.both(Schedule.recurs(8)),
-              ),
+              schedule: Schedule.max([
+                Schedule.exponential(500),
+                Schedule.recurs(8),
+              ]),
             }),
             Effect.asVoid,
             Effect.catchTag("ResourceInUseException", () =>

package/src/AWS/Lambda/Alias.ts

@@ -165,9 +165,10 @@ export const AliasProvider = () =>
         effect.pipe(
           Effect.retry({
             while: (e) => e._tag === "ResourceConflictException",
-            schedule: Schedule.exponential(500).pipe(
-              Schedule.both(Schedule.recurs(10)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential(500),
+              Schedule.recurs(10),
+            ]),
           }),
         );
 

package/src/AWS/Lambda/EventInvokeConfig.ts

@@ -35,9 +35,7 @@ const retryOnConflict = <A, E extends { _tag: string }, R>(
   effect.pipe(
     Effect.retry({
       while: (e) => e._tag === "ResourceConflictException",
-      schedule: Schedule.exponential(500).pipe(
-        Schedule.both(Schedule.recurs(10)),
-      ),
+      schedule: Schedule.max([Schedule.exponential(500), Schedule.recurs(10)]),
     }),
   );
 
@@ -142,9 +140,7 @@ export const syncEventInvokeConfig = Effect.fn(function* ({
             "The function execution role does not have permissions to call",
           ) ??
             false)),
-      schedule: Schedule.exponential(500).pipe(
-        Schedule.both(Schedule.recurs(10)),
-      ),
+      schedule: Schedule.max([Schedule.exponential(500), Schedule.recurs(10)]),
     }),
   );
 });

package/src/AWS/Lambda/EventSourceMapping.ts

@@ -716,9 +716,10 @@ export const EventSourceMappingProvider = () =>
                 while: (e: any) =>
                   e._tag === "ResourceInUseException" ||
                   e._tag === "ResourceConflictException",
-                schedule: Schedule.exponential(100).pipe(
-                  Schedule.both(Schedule.recurs(20)),
-                ),
+                schedule: Schedule.max([
+                  Schedule.exponential(100),
+                  Schedule.recurs(20),
+                ]),
               }),
               retryPermissionsPropagation,
               retryTransient,
@@ -762,9 +763,10 @@ export const EventSourceMappingProvider = () =>
               while: (e: any) =>
                 e._tag === "ResourceInUseException" ||
                 e._tag === "ResourceConflictException",
-              schedule: Schedule.exponential(100).pipe(
-                Schedule.both(Schedule.recurs(20)),
-              ),
+              schedule: Schedule.max([
+                Schedule.exponential(100),
+                Schedule.recurs(20),
+              ]),
             }),
             Effect.catchTag("ResourceNotFoundException", () => Effect.void),
           );
@@ -818,7 +820,7 @@ const retryTransient: <A, R, Err>(
     e._tag === "TooManyRequestsException" ||
     e._tag === "RequestLimitExceeded" ||
     e._tag === "ResourceInUseException",
-  schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(30))),
+  schedule: Schedule.max([Schedule.exponential(100), Schedule.recurs(30)]),
 });
 
 const retryPermissionsPropagation = Effect.retry({
@@ -831,7 +833,7 @@ const retryPermissionsPropagation = Effect.retry({
       e.message?.includes("Please add Lambda as a Trusted Entity") ||
       e.message?.includes("Cannot access stream") ||
       e.message?.includes("Please ensure the role can perform the GetRecords")),
-  schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(30))),
+  schedule: Schedule.max([Schedule.exponential(100), Schedule.recurs(30)]),
 }) as <A, R, Err>(self: Effect.Effect<A, Err, R>) => Effect.Effect<A, Err, R>;
 
 const sanitizeAwsTagValue = (value: string) =>

package/src/AWS/Lambda/Function.ts

@@ -5,13 +5,17 @@ import type { CreateFunctionRequest } from "@distilled.cloud/aws/lambda";
 import * as Lambda from "@distilled.cloud/aws/lambda";
 import { Region } from "@distilled.cloud/aws/Region";
 import type * as lambda from "aws-lambda";
+import * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
 import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
+import * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
 import type { HttpClient } from "effect/unstable/http/HttpClient";
 import type * as rolldown from "rolldown";
@@ -27,13 +31,14 @@ import {
 } from "../../Bundle/InstalledPackages.ts";
 import * as TempRoot from "../../Bundle/TempRoot.ts";
 import { deepEqual, isResolved } from "../../Diff.ts";
-import type { HttpEffect } from "../../Http.ts";
+import { isScopeEjected, type HttpEffect } from "../../Http.ts";
 import * as Output from "../../Output.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import { Platform, type Main, type PlatformProps } from "../../Platform.ts";
 import type { LogLine, LogsInput } from "../../Provider.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource, type ResourceBinding } from "../../Resource.ts";
+import { packEnvValue, unpackEnvValue } from "../../RuntimeContext.ts";
 import { Self } from "../../Self.ts";
 import * as Serverless from "../../Serverless/index.ts";
 import { Stack } from "../../Stack.ts";
@@ -291,6 +296,20 @@ const matchesConfiguredExternal = (
  * for plain handler patterns, or the
  * [Lambda guide](/aws/compute/lambda)
  * for the full Effect-based approach with bindings, event sources, and sinks.
+ *
+ * :::caution[Request finalizers block the response — there is no `waitUntil` on Lambda]
+ * `Effect.addFinalizer` in a handler runs **before the response is
+ * returned**: a buffered invocation's response is not released until the
+ * Invoke phase completes, and no deferral scheme is reliable (dangling
+ * promises are dropped on crash/timeout resets and their sockets rarely
+ * survive the freeze — silent data loss). Keep request finalizers cheap
+ * (closing a pool is milliseconds), and write anything that must not be
+ * lost durably — a queue, a table — inside the handler itself. Init-level
+ * finalizers instead run in the 500 ms `SIGTERM` window at sandbox
+ * shutdown, which the generated entry obtains by registering an internal
+ * extension. See
+ * [Sandbox scope vs invocation scope](/aws/compute/lambda#sandbox-scope-vs-invocation-scope).
+ * :::
  * @resource
  * @section Async Functions
  * Point `main` at a file that exports a standard Lambda handler. No
@@ -567,55 +586,17 @@ export const Function: Platform<
       set: (id: string, output: Output.Output) =>
         Effect.sync(() => {
           // Key is already canonical (see RuntimeContext.sanitizeKey); store it
-          // verbatim.
+          // verbatim. `packEnvValue` marker-packs Redacted values so they
+          // survive the Output → Lambda env var round-trip.
           const key = id;
-          // Preserve `Redacted`-ness across the Output → Lambda env var
-          // round-trip. `JSON.stringify(Redacted)` would emit the literal
-          // string `"<redacted>"` and lose the value, so secrets are
-          // serialized with a `{_tag: "Redacted", value: ...}` marker
-          // that the runtime `get` path detects and rebuilds.
-          env[key] = output.pipe(
-            Output.map((value) =>
-              Redacted.isRedacted(value)
-                ? JSON.stringify({
-                    _tag: "Redacted",
-                    value: Redacted.value(value),
-                  })
-                : JSON.stringify(value),
-            ),
-          );
+          env[key] = output.pipe(Output.map(packEnvValue));
           return key;
         }),
       get: <T>(key: string) =>
-        // Read the captured value straight from `process.env`. We must NOT
-        // resolve through `Config.string` here: at runtime the ambient
-        // `ConfigProvider` is the interceptor installed in `Platform.ts`,
-        // whose runtime branch calls back into `ctx.get(key)`. Going through
-        // `Config` would re-enter that interceptor for the same key and
-        // recurse forever, allocating until the Lambda init OOMs. The Worker
-        // runtime reads from `WorkerEnvironment` for the same reason.
-        Effect.sync(() => {
-          // Key is already canonical (see RuntimeContext.sanitizeKey).
-          const val = process.env[key];
-          if (val === undefined) {
-            return undefined;
-          }
-          try {
-            const value = JSON.parse(val);
-            if (
-              typeof value === "object" &&
-              value?._tag === "Redacted" &&
-              "value" in value
-            ) {
-              return Redacted.make(
-                (value as { value: unknown }).value,
-              ) as unknown as T;
-            }
-            return value as T;
-          } catch {
-            return val as unknown as T; // assume it's just a string
-          }
-        }),
+        // Key is already canonical (see RuntimeContext.sanitizeKey). Read
+        // straight from `process.env` — see `unpackEnvValue` for why this
+        // must never resolve through `Config.string`.
+        Effect.sync(() => unpackEnvValue<T>(process.env[key])),
       serve: (handler: HttpEffect) =>
         // @ts-ignore
         ctx.listen(makeFunctionHttpHandler(handler)),
@@ -641,11 +622,39 @@ export const Function: Platform<
               for (const handler of handlers) {
                 const eff = handler(event);
                 if (Effect.isEffect(eff)) {
-                  return await eff.pipe(
-                    Effect.provideService(HandlerContext, context),
+                  // Each invocation gets a fresh request scope, matching the
+                  // Worker / Durable Object / Workflow bridges. The scope is
+                  // settled inline before returning: a buffered Lambda
+                  // response is not released to the caller until the Invoke
+                  // phase completes, so deferring cleanup (e.g. via an
+                  // INVOKE-subscribed extension window) shows up as response
+                  // latency anyway — keep request finalizers fast. A failing
+                  // finalizer is logged and ignored so it can't mask the
+                  // invocation's outcome.
+                  const scope = Scope.makeUnsafe();
+                  const exit = await eff.pipe(
+                    Effect.provide(
+                      Layer.mergeAll(
+                        Layer.succeed(HandlerContext, context),
+                        Layer.succeed(Scope.Scope, scope),
+                      ),
+                    ),
                     Effect.tap(Effect.logDebug),
-                    Effect.runPromise,
+                    Effect.runPromiseExit,
                   );
+                  if (!isScopeEjected(scope)) {
+                    await Scope.close(scope, exit).pipe(
+                      Effect.ignoreCause({
+                        log: "Warn",
+                        message: "Lambda invocation scope close failed",
+                      }),
+                      Effect.runPromise,
+                    );
+                  }
+                  if (Exit.isSuccess(exit)) {
+                    return exit.value;
+                  }
+                  throw Cause.squash(exit.cause);
                 }
               }
               throw new Error("No event handler found");
@@ -894,20 +903,34 @@ export const FunctionProvider = () =>
                 (importPath) => `
 import { layer as nodeServicesLayer } from "@effect/platform-node/NodeServices";
 import { Stack } from "alchemy/Stack";
-import { makeEntrypointLayer } from "alchemy/Runtime";
+import { makeEntrypointLayer, reifyBoundConfigProvider } from "alchemy/Runtime";
+import { registerLambdaExtension } from "alchemy/AWS/Lambda/RuntimeExtension";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Credentials from "@distilled.cloud/aws/Credentials";
 import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
 import { layer as fetchHttpClientLayer } from "effect/unstable/http/FetchHttpClient";
 import * as Layer from "effect/Layer";
 import * as Logger from "effect/Logger";
 import * as Region from "@distilled.cloud/aws/Region";
 import * as Context from "effect/Context";
+import * as Scope from "effect/Scope";
 import { MinimumLogLevel } from "effect/References";
 
 import entrypoint from ${JSON.stringify(importPath)};
 
+// Register the internal extension: it buys the Shutdown phase (SIGTERM +
+// 500 ms) — without any registered extension the sandbox is killed with no
+// signal at all, and init-level finalizers would never run.
+await registerLambdaExtension();
+
+// Instance scope: the sandbox-lifetime layer build lives under it, and it is
+// closed on SIGTERM (Lambda's Shutdown phase) so init-level finalizers run
+// before the sandbox dies. Each invocation still gets its own request scope
+// from the handler dispatch.
+const instanceScope = Scope.makeUnsafe();
+
 const tag = Context.Service("${Self.key}")
 const layer = makeEntrypointLayer(tag, entrypoint);
 
@@ -933,33 +956,55 @@ const stack = Layer.effect(
   )
 );
 
-const handlerEffect = tag.pipe(
-  Effect.flatMap(func => func.RuntimeContext.exports),
-  Effect.flatMap(exports => exports.handler),
-  Effect.provide(
-    layer.pipe(
-      Layer.provideMerge(stack),
-      Layer.provideMerge(Credentials.fromEnv()),
-      Layer.provideMerge(Region.fromEnv()),
-      Layer.provideMerge(platform),
-      Layer.provideMerge(
-        Layer.succeed(
-          ConfigProvider.ConfigProvider,
-          ConfigProvider.fromEnv()
-        )
-      ),
-      Layer.provideMerge(
-        Layer.succeed(
-          MinimumLogLevel,
-          process.env.DEBUG ? "Debug" : "Info",
-        )
-      ),
+const entryLayer = layer.pipe(
+  Layer.provideMerge(stack),
+  Layer.provideMerge(Credentials.fromEnv()),
+  Layer.provideMerge(Region.fromEnv()),
+  Layer.provideMerge(platform),
+  Layer.provideMerge(
+    Layer.succeed(
+      ConfigProvider.ConfigProvider,
+      // Auto-bound \`Config\` values arrive in the env as
+      // \`{"_tag":"Redacted","value":...}\` markers; reify them so a \`Config\`
+      // re-read inside a handler decodes the raw source value.
+      reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env)
+    )
+  ),
+  Layer.provideMerge(
+    Layer.succeed(
+      MinimumLogLevel,
+      process.env.DEBUG ? "Debug" : "Info",
     )
   ),
-  Effect.scoped
 );
 
-export default await Effect.runPromise(handlerEffect)
+// Build the layer stack against the instance scope (not a transient
+// \`Effect.provide\`/\`Effect.scoped\` region) so services and init-level
+// finalizers live for the sandbox and are released at Shutdown.
+const handlerEffect = Layer.buildWithScope(entryLayer, instanceScope).pipe(
+  Effect.flatMap((context) =>
+    tag.pipe(
+      Effect.flatMap(func => func.RuntimeContext.exports),
+      Effect.flatMap(exports => exports.handler),
+      Effect.provideContext(context),
+    )
+  ),
+  Scope.provide(instanceScope),
+);
+
+const handler = await Effect.runPromise(handlerEffect);
+
+// Lambda's Shutdown phase: close the instance scope so init-level
+// finalizers run, then exit inside the 500 ms budget. SIGKILL follows if we
+// overstay, so finalizers must be fast and best-effort.
+process.on("SIGTERM", () => {
+  console.log("[alchemy] SIGTERM — closing instance scope");
+  Effect.runPromise(Scope.close(instanceScope, Exit.void))
+    .catch((error) => console.error("[alchemy] shutdown finalizers failed", error))
+    .finally(() => process.exit(0));
+});
+
+export default handler;
 `,
               ),
             );
@@ -1057,9 +1102,10 @@ export default await Effect.runPromise(handlerEffect)
         while: (e: any) =>
           e._tag === "ResourceConflictException" ||
           e._tag === "TooManyRequestsException",
-        schedule: Schedule.exponential(100).pipe(
-          Schedule.both(Schedule.recurs(30)),
-        ),
+        schedule: Schedule.max([
+          Schedule.exponential(100),
+          Schedule.recurs(30),
+        ]),
       }) as <A, R, Err>(
         self: Effect.Effect<A, Err, R>,
       ) => Effect.Effect<A, Err, R>;
@@ -1295,7 +1341,7 @@ export default await Effect.runPromise(handlerEffect)
           Effect.retry({
             while: (e) => isRolePropagationError(e),
             schedule: Schedule.fixed(1000).pipe(
-              Schedule.tapOutput(() => noteRolePropagationWait()),
+              Schedule.tap(() => noteRolePropagationWait()),
             ),
           }),
           Effect.catchTags({