alchemy 2.0.0-beta.64 → 2.0.0-beta.66

package/src/AWS/Bedrock/LanguageModelHttp.ts

@@ -0,0 +1,36 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { Converse } from "./Converse.ts";
+import { ConverseHttp } from "./ConverseHttp.ts";
+import { ConverseStream } from "./ConverseStream.ts";
+import { ConverseStreamHttp } from "./ConverseStreamHttp.ts";
+import {
+  LanguageModel,
+  type LanguageModelOptions,
+  makeLanguageModelLayer,
+} from "./LanguageModel.ts";
+
+/**
+ * HTTP implementation of {@link LanguageModel}. Composes the {@link Converse}
+ * and {@link ConverseStream} bindings, so binding a model registers both
+ * `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream` scoped to
+ * exactly that model.
+ */
+export const LanguageModelHttp = Layer.effect(
+  LanguageModel,
+  Effect.gen(function* () {
+    const converse = yield* Converse;
+    const converseStream = yield* ConverseStream;
+    return Effect.fn(function* (
+      model: string | readonly [string, ...string[]],
+      options?: LanguageModelOptions,
+    ) {
+      const [first, ...rest] = typeof model === "string" ? [model] : model;
+      return makeLanguageModelLayer({
+        converse: yield* converse(first, ...rest),
+        converseStream: yield* converseStream(first, ...rest),
+        parameters: options?.parameters,
+      });
+    });
+  }),
+).pipe(Layer.provide(Layer.mergeAll(ConverseHttp, ConverseStreamHttp)));

package/src/AWS/Bedrock/index.ts

@@ -26,6 +26,8 @@ export * from "./InvokeModelHttp.ts";
 export * from "./InvokeModelWithResponseStream.ts";
 export * from "./InvokeModelWithResponseStreamHttp.ts";
 export * from "./KnowledgeBase.ts";
+export * from "./LanguageModel.ts";
+export * from "./LanguageModelHttp.ts";
 export * from "./ListIngestionJobs.ts";
 export * from "./ListIngestionJobsHttp.ts";
 export * from "./ListKnowledgeBaseDocuments.ts";

package/src/AWS/CloudFront/Distribution.ts

@@ -954,7 +954,10 @@ export const DistributionProvider = () =>
           // Sync config — diff observed config against desired and patch
           // via `updateDistribution` with the freshly observed ETag. We
           // keep the observed `CallerReference` because CloudFront does
-          // not allow it to change.
+          // not allow it to change, and fill every member the props don't
+          // express from the observed config: UpdateDistribution replaces
+          // the whole config and rejects requests with missing members
+          // (see `mergeWithObservedConfig`).
           yield* Effect.logInfo(
             `CloudFront Distribution reconcile: updating config for ${observed.distribution.Id} with etag=${observed.etag ?? "missing"}`,
           );
@@ -962,9 +965,9 @@ export const DistributionProvider = () =>
             .updateDistribution({
               Id: observed.distribution.Id,
               IfMatch: observed.etag,
-              DistributionConfig: toConfig(
-                observed.config.CallerReference,
-                news,
+              DistributionConfig: mergeWithObservedConfig(
+                toConfig(observed.config.CallerReference, news),
+                observed.config,
               ),
             })
             .pipe(
@@ -1146,8 +1149,16 @@ const toBehavior = (
   CachePolicyId: behavior.cachePolicyId,
   OriginRequestPolicyId: behavior.originRequestPolicyId,
   ResponseHeadersPolicyId: behavior.responseHeadersPolicyId,
-  ForwardedValues: behavior.forwardedValues,
-  MinTTL: toWireSeconds(behavior.minTtl),
+  // Without a cache policy, CloudFront is in legacy mode and rejects the
+  // request unless both ForwardedValues and MinTTL are present.
+  ForwardedValues:
+    behavior.forwardedValues ??
+    (behavior.cachePolicyId === undefined
+      ? { QueryString: false, Cookies: { Forward: "none" } }
+      : undefined),
+  MinTTL:
+    toWireSeconds(behavior.minTtl) ??
+    (behavior.cachePolicyId === undefined ? 0 : undefined),
   DefaultTTL: toWireSeconds(behavior.defaultTtl),
   MaxTTL: toWireSeconds(behavior.maxTtl),
   TrustedKeyGroups: behavior.trustedKeyGroups
@@ -1277,6 +1288,105 @@ const toOrigin = (origin: DistributionOrigin): cloudfront.Origin => {
   };
 };
 
+/**
+ * Recursively fills `undefined` members of `desired` from `observed`.
+ * Defined values in `desired` always win; arrays are taken from `desired`
+ * wholesale (item-level merging is the caller's concern).
+ */
+const fillUndefined = <T>(desired: T, observed: T): T => {
+  if (desired === undefined) return observed;
+  if (
+    desired === null ||
+    typeof desired !== "object" ||
+    Array.isArray(desired) ||
+    observed === null ||
+    typeof observed !== "object" ||
+    Array.isArray(observed)
+  ) {
+    return desired;
+  }
+  const out: Record<string, unknown> = {
+    ...(desired as Record<string, unknown>),
+  };
+  const desiredObj = desired as Record<string, unknown>;
+  for (const key of Object.keys(observed as Record<string, unknown>)) {
+    // CloudFront list shapes pair `Quantity` with `Items`. A desired node
+    // that declares a `Quantity` but no `Items` (e.g. a geo restriction of
+    // `{ RestrictionType: "none", Quantity: 0 }`) is fully specified —
+    // filling `Items` from the observed config would desynchronize the two
+    // and CloudFront rejects the update with `InconsistentQuantities`.
+    if (
+      key === "Items" &&
+      typeof desiredObj.Quantity === "number" &&
+      desiredObj.Items === undefined
+    ) {
+      continue;
+    }
+    out[key] = fillUndefined(
+      desiredObj[key],
+      (observed as Record<string, unknown>)[key],
+    );
+  }
+  return out as T;
+};
+
+/**
+ * Completes a desired `DistributionConfig` with the freshly observed live
+ * config before an `updateDistribution` call.
+ *
+ * CloudFront's `UpdateDistribution` replaces the ENTIRE distribution config:
+ * any member missing from the request is rejected with `IllegalUpdate`
+ * (observed in practice: "Default root object is missing for the resource",
+ * "The 'OriginCustomHeaders' field is missing"). `toConfig` emits only the
+ * members the props express, so updating a live distribution fails on every
+ * member the props don't model — some of which (e.g. per-origin
+ * `CustomHeaders`, per-behavior `TrustedSigners`) are nested inside
+ * collections and not expressible as props at all.
+ *
+ * The standard CloudFront update pattern is read-modify-write, which the
+ * delete path here already uses (`{ ...current.config, Enabled: false }`).
+ * This applies the same idea to updates: desired values always win — the
+ * declared props still fully control drift — and only `undefined` members
+ * are carried over from the observed config. `Origins` and `CacheBehaviors`
+ * items are additionally merged by identity (`Id` / `PathPattern`) so their
+ * nested unexpressed members carry over too.
+ *
+ * Exported for unit tests.
+ */
+export const mergeWithObservedConfig = (
+  desired: cloudfront.DistributionConfig,
+  observed: cloudfront.DistributionConfig,
+): cloudfront.DistributionConfig => {
+  const merged = fillUndefined(desired, observed);
+  if (merged.Origins?.Items && observed.Origins?.Items) {
+    const observedOrigins = observed.Origins.Items;
+    merged.Origins = {
+      ...merged.Origins,
+      Items: merged.Origins.Items.map((item) =>
+        fillUndefined(
+          item,
+          observedOrigins.find((origin) => origin.Id === item.Id) ?? item,
+        ),
+      ),
+    };
+  }
+  if (merged.CacheBehaviors?.Items && observed.CacheBehaviors?.Items) {
+    const observedBehaviors = observed.CacheBehaviors.Items;
+    merged.CacheBehaviors = {
+      ...merged.CacheBehaviors,
+      Items: merged.CacheBehaviors.Items.map((item) =>
+        fillUndefined(
+          item,
+          observedBehaviors.find(
+            (behavior) => behavior.PathPattern === item.PathPattern,
+          ) ?? item,
+        ),
+      ),
+    };
+  }
+  return merged;
+};
+
 const toConfig = (
   callerReference: string,
   props: DistributionProps,

package/src/AWS/CostExplorer/common.ts

@@ -1,5 +1,6 @@
 import * as ce from "@distilled.cloud/aws/cost-explorer";
 import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
 import { diffTags } from "../../Tags.ts";
 import { Region } from "../Region.ts";
 
@@ -11,8 +12,28 @@ import { Region } from "../Region.ts";
 // (same pattern as CloudFront KVS / ECR Public / WAFv2 / GlobalAccelerator).
 export const CE_REGION = "us-east-1" as const;
 
-export const pinCe = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-  effect.pipe(Effect.provideService(Region, Effect.succeed(CE_REGION)));
+// Cost Explorer's control-plane rate limits are extremely low and shared
+// account-wide, so concurrent deploys readily trip `LimitExceededException:
+// Rate limit exceeded`. Retry it with capped exponential backoff, bounded
+// (~47s total) so a genuine quota LimitExceeded still surfaces quickly.
+const ceThrottleRetrySchedule = Schedule.max([
+  Schedule.min([
+    Schedule.exponential("1 second"),
+    Schedule.spaced("8 seconds"),
+  ]),
+  Schedule.recurs(8),
+]);
+
+export const pinCe = <A, E extends { _tag: string }, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, E, R> =>
+  effect.pipe(
+    Effect.provideService(Region, Effect.succeed(CE_REGION)),
+    Effect.retry({
+      while: (e) => e._tag === "LimitExceededException",
+      schedule: ceThrottleRetrySchedule,
+    }),
+  );
 
 /** Convert a plain tag record to Cost Explorer's `ResourceTag` list shape. */
 export const toResourceTags = (

package/src/AWS/DataSync/Task.ts

@@ -1,5 +1,6 @@
 import * as datasync from "@distilled.cloud/aws/datasync";
 import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
@@ -201,21 +202,35 @@ export const TaskProvider = () =>
 
           // 2. ENSURE — create if missing.
           if (t === undefined) {
-            const created = yield* datasync.createTask({
-              SourceLocationArn: news.sourceLocationArn,
-              DestinationLocationArn: news.destinationLocationArn,
-              Name: name,
-              Options: news.options,
-              Excludes: news.excludes,
-              Includes: news.includes,
-              Schedule: news.schedule,
-              CloudWatchLogGroupArn: news.cloudWatchLogGroupArn,
-              TaskMode: news.taskMode,
-              Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
-                Key,
-                Value,
-              })),
-            });
+            const created = yield* datasync
+              .createTask({
+                SourceLocationArn: news.sourceLocationArn,
+                DestinationLocationArn: news.destinationLocationArn,
+                Name: name,
+                Options: news.options,
+                Excludes: news.excludes,
+                Includes: news.includes,
+                Schedule: news.schedule,
+                CloudWatchLogGroupArn: news.cloudWatchLogGroupArn,
+                TaskMode: news.taskMode,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                // createTask synchronously probes the locations' S3 access,
+                // and a freshly-created location role's IAM policy can lag
+                // (typed `LocationAccessTestFailed`). Retry bounded through
+                // the propagation window.
+                Effect.retry({
+                  while: (e) => e._tag === "LocationAccessTestFailed",
+                  schedule: Schedule.max([
+                    Schedule.spaced("5 seconds"),
+                    Schedule.recurs(9),
+                  ]),
+                }),
+              );
             arn = created.TaskArn!;
             t = yield* describe(arn);
           } else {

package/src/AWS/EC2/InternetGateway.ts

@@ -396,9 +396,12 @@ export const InternetGatewayProvider = () =>
                     while: (e) => {
                       return e._tag === "DependencyViolation";
                     },
+                    // Public addresses on a draining EKS/HyperPod control
+                    // plane's ENIs can take several minutes to release —
+                    // 5s x 60 = ~5 min.
                     schedule: Schedule.max([
                       Schedule.fixed(5000),
-                      Schedule.recurs(10),
+                      Schedule.recurs(60),
                     ]).pipe(
                       Schedule.tap(({ attempt }) =>
                         session.note(
@@ -424,7 +427,9 @@ export const InternetGatewayProvider = () =>
                 "InvalidInternetGatewayID.NotFound",
                 () => Effect.void,
               ),
-              // Retry on dependency violations
+              // Retry on dependency violations. Public addresses on a
+              // draining EKS/HyperPod control plane's ENIs can take
+              // several minutes to release — 5s x 60 = ~5 min.
               Effect.retry({
                 while: (e) => {
                   return (
@@ -435,7 +440,7 @@ export const InternetGatewayProvider = () =>
                 },
                 schedule: Schedule.max([
                   Schedule.fixed(5000),
-                  Schedule.recurs(10),
+                  Schedule.recurs(60),
                 ]).pipe(
                   Schedule.tap(({ attempt }) =>
                     session.note(

package/src/AWS/EC2/LingeringEnis.ts

@@ -0,0 +1,169 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+
+/**
+ * Shared teardown accelerator for network interfaces that AWS releases
+ * *asynchronously* after their owning resource is deleted.
+ *
+ * The canonical case is a VPC-attached Lambda Function: `DeleteFunction`
+ * returns immediately, but the function's Hyperplane ENIs stay `in-use` in
+ * their subnets/security groups for several minutes, and Lambda's own reaper
+ * may not delete the detached ENI for up to ~20 minutes. Until the ENI is
+ * gone, `DeleteSubnet`/`DeleteSecurityGroup` fail with `DependencyViolation`
+ * — historically forcing users to run `destroy` twice, minutes apart.
+ *
+ * `retryWhileLingeringEnis` wraps a subnet/security-group delete call:
+ * on every `DependencyViolation` it observes the ENIs still occupying the
+ * resource, explicitly deletes any *detached* (status `available`) Lambda
+ * ENI instead of waiting for Lambda's reaper, and — while the blockers are
+ * exclusively Lambda ENIs that are provably on their way out — keeps waiting
+ * on an extended budget that covers AWS's worst-case release window. Any
+ * other lingering dependency keeps today's shorter budget.
+ */
+
+/**
+ * ENIs that their owning service tears down asynchronously and that are safe
+ * for us to delete once detached. Only Lambda Hyperplane ENIs qualify today:
+ * every other managed type (NAT gateways, VPC endpoints, ELB, EFS mount
+ * targets, ECS task ENIs) is deleted by the API call that deletes its owner
+ * — and their owners are proper alchemy resources ordered ahead of the
+ * subnet/SG by the deletion graph.
+ *
+ * Matching note (observed live): while attached, a Hyperplane ENI reports
+ * `InterfaceType: "lambda"` — but the moment Lambda detaches it, the type
+ * flips to plain `"interface"` and only the description (`AWS Lambda VPC
+ * ENI-{functionName}`) still identifies it. Match both, like Terraform does.
+ */
+const isReapableEni = (eni: ec2.NetworkInterface): boolean =>
+  eni.InterfaceType === "lambda" ||
+  (eni.Description?.startsWith("AWS Lambda VPC ENI") ?? false);
+
+export interface LingeringEniScope {
+  /** ENI filter naming the resource being deleted. */
+  readonly name: "subnet-id" | "group-id";
+  readonly value: string;
+}
+
+/**
+ * Observe ENIs still occupying the resource and delete any detached
+ * reapable ones. Best-effort by design: the reaper only accelerates the
+ * outer DependencyViolation retry, so an account that cannot describe or
+ * delete ENIs degrades to plain waiting instead of failing the destroy.
+ */
+const reapLingeringEnis = Effect.fn(function* (
+  scope: LingeringEniScope,
+  session: { note: (note: string) => Effect.Effect<void> },
+) {
+  const described = yield* ec2
+    .describeNetworkInterfaces({
+      Filters: [{ Name: scope.name, Values: [scope.value] }],
+    })
+    .pipe(Effect.catch(() => Effect.succeed({ NetworkInterfaces: [] })));
+
+  const lingering = (described.NetworkInterfaces ?? []).filter(isReapableEni);
+
+  let reaped = 0;
+  let pending = 0;
+  for (const eni of lingering) {
+    if (eni.Status !== "available" || eni.NetworkInterfaceId === undefined) {
+      pending += 1;
+      continue;
+    }
+    const outcome = yield* ec2
+      .deleteNetworkInterface({
+        NetworkInterfaceId: eni.NetworkInterfaceId,
+      })
+      .pipe(
+        Effect.as("deleted" as const),
+        // Already gone counts as progress; anything else (raced back to
+        // in-use, throttle, missing IAM permission) must not fail the
+        // destroy — reaping is purely an accelerator, so degrade to the
+        // outer retry's plain waiting.
+        Effect.catchTag("InvalidNetworkInterfaceID.NotFound", () =>
+          Effect.succeed("deleted" as const),
+        ),
+        Effect.catch(() => Effect.succeed("pending" as const)),
+      );
+    if (outcome === "deleted") {
+      yield* session.note(
+        `Deleted detached Lambda ENI ${eni.NetworkInterfaceId}`,
+      );
+      reaped += 1;
+    } else {
+      pending += 1;
+    }
+  }
+
+  return {
+    /** Reapable ENIs still occupying the resource after this pass. */
+    pendingReapable: pending,
+    /** Detached reapable ENIs actually deleted this pass. */
+    reaped,
+  };
+});
+
+/**
+ * Retry `deleteCall` while it fails with a dependency violation, reaping
+ * lingering ENIs between attempts.
+ *
+ * - Base budget (~12 min) matches the historical subnet schedule: fast
+ *   exponential start, capped at 30-second steps.
+ * - While the observed blockers include reapable ENIs (attached or just
+ *   reaped), the budget extends to ~25 min — Lambda's documented worst-case
+ *   ENI release window — because those blockers are guaranteed to clear.
+ */
+export const retryWhileLingeringEnis = <A, E extends { _tag: string }, R>(
+  deleteCall: Effect.Effect<A, E, R>,
+  options: {
+    scope: LingeringEniScope;
+    isDependencyViolation: (error: E) => boolean;
+    session: { note: (note: string) => Effect.Effect<void> };
+  },
+) =>
+  Effect.gen(function* () {
+    const BASE_BUDGET_MILLIS = 12 * 60 * 1000;
+    const EXTENDED_BUDGET_MILLIS = 25 * 60 * 1000;
+
+    let elapsedMillis = 0;
+    let sawReapable = false;
+
+    for (let attempt = 1; ; attempt++) {
+      const result = yield* Effect.result(deleteCall);
+      if (Result.isSuccess(result)) {
+        return result.success;
+      }
+      const error = result.failure;
+      if (!options.isDependencyViolation(error)) {
+        return yield* Effect.fail(error);
+      }
+
+      const { pendingReapable, reaped } = yield* reapLingeringEnis(
+        options.scope,
+        options.session,
+      );
+      if (reaped > 0) {
+        // An ENI just left — the next attempt has a real chance; skip the
+        // backoff sleep and try immediately.
+        continue;
+      }
+      sawReapable ||= pendingReapable > 0;
+
+      const budget = sawReapable ? EXTENDED_BUDGET_MILLIS : BASE_BUDGET_MILLIS;
+      if (elapsedMillis >= budget) {
+        return yield* Effect.fail(error);
+      }
+
+      yield* options.session.note(
+        pendingReapable > 0
+          ? `Waiting for AWS to release ${pendingReapable} lingering ENI(s)... (attempt ${attempt})`
+          : `Waiting for dependencies to clear... (attempt ${attempt})`,
+      );
+
+      // Fast exponential start capped at 30-second steps (the historical
+      // subnet schedule).
+      const delayMillis = Math.min(1000 * 1.5 ** (attempt - 1), 30_000);
+      yield* Effect.sleep(delayMillis);
+      elapsedMillis += delayMillis;
+    }
+  });

package/src/AWS/EC2/SecurityGroup.ts

@@ -11,6 +11,7 @@ import type { AccountID } from "../Environment.ts";
 import { AWSEnvironment } from "../Environment.ts";
 import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
+import { retryWhileLingeringEnis } from "./LingeringEnis.ts";
 import type { VpcId } from "./Vpc.ts";
 
 export type SecurityGroupId<ID extends string = string> = `sg-${ID}`;
@@ -681,34 +682,29 @@ export const SecurityGroupProvider = () =>
 
           yield* session.note(`Deleting Security Group: ${groupId}`);
 
-          yield* ec2
-            .deleteSecurityGroup({
-              GroupId: groupId,
-              DryRun: false,
-            })
-            .pipe(
-              Effect.catchTag("InvalidGroup.NotFound", () => Effect.void),
-              // Retry on dependency violations (e.g., ENIs still using the security group)
-              Effect.retry({
-                while: (e) => {
-                  return (
-                    e._tag === "DependencyViolation" ||
-                    (e._tag === "ValidationError" &&
-                      e.message?.includes("DependencyViolation"))
-                  );
-                },
-                schedule: Schedule.max([
-                  Schedule.fixed(5000),
-                  Schedule.recurs(30),
-                ]).pipe(
-                  Schedule.tap(({ attempt }) =>
-                    session.note(
-                      `Waiting for dependencies to clear... (attempt ${attempt})`,
-                    ),
-                  ),
-                ),
-              }),
-            );
+          // DependencyViolation means ENIs still reference the group — ALB,
+          // ECS task, or VPC-attached Lambda ENIs release minutes after the
+          // owning resource is deleted. Lambda Hyperplane ENIs are reaped
+          // explicitly between attempts (they otherwise linger up to ~20
+          // minutes and used to force a second `destroy` run).
+          yield* retryWhileLingeringEnis(
+            ec2
+              .deleteSecurityGroup({
+                GroupId: groupId,
+                DryRun: false,
+              })
+              .pipe(
+                Effect.catchTag("InvalidGroup.NotFound", () => Effect.void),
+              ),
+            {
+              scope: { name: "group-id", value: groupId },
+              isDependencyViolation: (e) =>
+                e._tag === "DependencyViolation" ||
+                (e._tag === "ValidationError" &&
+                  (e.message?.includes("DependencyViolation") ?? false)),
+              session,
+            },
+          );
 
           yield* session.note(`Security Group ${groupId} deleted`);
         }),

package/src/AWS/EC2/Subnet.ts

@@ -7,6 +7,7 @@ import * as Stream from "effect/Stream";
 
 import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
 import { isResolved, somePropsAreDifferent } from "../../Diff.ts";
+import { retryWhileLingeringEnis } from "./LingeringEnis.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
@@ -597,40 +598,28 @@ export const SubnetProvider = () =>
 
           yield* session.note(`Deleting subnet: ${subnetId}`);
 
-          // 1. Attempt to delete subnet
-          yield* ec2
-            .deleteSubnet({
-              SubnetId: subnetId,
-              DryRun: false,
-            })
-            .pipe(
-              Effect.tapError(Effect.logDebug),
-              Effect.catchTag("InvalidSubnetID.NotFound", () => Effect.void),
-              // Retry on dependency violations (resources still being deleted).
-              // ENIs from a just-deleted ALB or CloudFront VPC origin can take
-              // several minutes to detach after the owning resource is gone, so
-              // budget ~12 min (fast exponential start, capped at 30s steps).
-              Effect.retry({
-                while: (e) => {
-                  // DependencyViolation means there are still dependent resources
-                  // This can happen if ENIs/instances are being deleted concurrently
-                  return e._tag === "DependencyViolation";
-                },
-                schedule: Schedule.max([
-                  Schedule.min([
-                    Schedule.exponential(1000, 1.5),
-                    Schedule.spaced("30 seconds"),
-                  ]),
-                  Schedule.recurs(30),
-                ]).pipe(
-                  Schedule.tap(({ attempt }) =>
-                    session.note(
-                      `Waiting for dependencies to clear... (attempt ${attempt})`,
-                    ),
-                  ),
-                ),
-              }),
-            );
+          // 1. Attempt to delete subnet. DependencyViolation means resources
+          // still occupy it — ENIs from a just-deleted ALB, CloudFront VPC
+          // origin, or a VPC-attached Lambda can take minutes to release
+          // after the owning resource is gone. Lambda Hyperplane ENIs are
+          // reaped explicitly between attempts (they otherwise linger up to
+          // ~20 minutes and used to force a second `destroy` run).
+          yield* retryWhileLingeringEnis(
+            ec2
+              .deleteSubnet({
+                SubnetId: subnetId,
+                DryRun: false,
+              })
+              .pipe(
+                Effect.tapError(Effect.logDebug),
+                Effect.catchTag("InvalidSubnetID.NotFound", () => Effect.void),
+              ),
+            {
+              scope: { name: "subnet-id", value: subnetId },
+              isDependencyViolation: (e) => e._tag === "DependencyViolation",
+              session,
+            },
+          );
 
           // 2. Wait for subnet to be fully deleted
           yield* waitForSubnetDeleted(subnetId, session);