alchemy 2.0.0-beta.64 → 2.0.0-beta.66

package/src/AWS/EC2/Vpc.ts

@@ -408,27 +408,41 @@ export const VpcProvider = () =>
           }
 
           if (vpc === undefined) {
-            const createResult = yield* ec2.createVpc({
-              // TODO(sam): add all properties
-              AmazonProvidedIpv6CidrBlock: news.amazonProvidedIpv6CidrBlock,
-              InstanceTenancy: news.instanceTenancy,
-              CidrBlock: news.cidrBlock,
-              Ipv4IpamPoolId: news.ipv4IpamPoolId,
-              Ipv4NetmaskLength: news.ipv4NetmaskLength,
-              Ipv6Pool: news.ipv6Pool,
-              Ipv6CidrBlock: news.ipv6CidrBlock,
-              Ipv6IpamPoolId: news.ipv6IpamPoolId,
-              Ipv6NetmaskLength: news.ipv6NetmaskLength,
-              Ipv6CidrBlockNetworkBorderGroup:
-                news.ipv6CidrBlockNetworkBorderGroup,
-              TagSpecifications: [
-                {
-                  ResourceType: "vpc",
-                  Tags: createTagsList(desiredTags),
-                },
-              ],
-              DryRun: false,
-            });
+            const createResult = yield* ec2
+              .createVpc({
+                // TODO(sam): add all properties
+                AmazonProvidedIpv6CidrBlock: news.amazonProvidedIpv6CidrBlock,
+                InstanceTenancy: news.instanceTenancy,
+                CidrBlock: news.cidrBlock,
+                Ipv4IpamPoolId: news.ipv4IpamPoolId,
+                Ipv4NetmaskLength: news.ipv4NetmaskLength,
+                Ipv6Pool: news.ipv6Pool,
+                Ipv6CidrBlock: news.ipv6CidrBlock,
+                Ipv6IpamPoolId: news.ipv6IpamPoolId,
+                Ipv6NetmaskLength: news.ipv6NetmaskLength,
+                Ipv6CidrBlockNetworkBorderGroup:
+                  news.ipv6CidrBlockNetworkBorderGroup,
+                TagSpecifications: [
+                  {
+                    ResourceType: "vpc",
+                    Tags: createTagsList(desiredTags),
+                  },
+                ],
+                DryRun: false,
+              })
+              .pipe(
+                // The per-region VPC quota (default 5) is a shared pool;
+                // concurrent deploys transiently exhaust it while their VPCs
+                // are being torn down. Ride out the burst with a bounded
+                // spaced retry (~90s) before surfacing the quota error.
+                Effect.retry({
+                  while: (e) => e._tag === "VpcLimitExceeded",
+                  schedule: Schedule.max([
+                    Schedule.spaced("10 seconds"),
+                    Schedule.recurs(9),
+                  ]),
+                }),
+              );
             const newVpcId = createResult.Vpc!.VpcId! as VpcId;
             yield* session.note(`VPC created: ${newVpcId}`);
             vpc = yield* waitForVpcAvailable(newVpcId, session);

package/src/AWS/EC2/hosted.ts

@@ -218,6 +218,7 @@ import { BunServices } from "@effect/platform-bun";
 import { BunHttpServer } from "alchemy/Http";
 import { Stack } from "alchemy/Stack";
 import { reifyBoundConfigProvider } from "alchemy/Runtime";
+import { provideProcessTelemetry } from "alchemy/Telemetry";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Credentials from "@distilled.cloud/aws/Credentials";
@@ -239,8 +240,15 @@ const platform = Layer.mergeAll(
 // and run it with a Bun HTTP server bound to PORT, so a returned { fetch }
 // handler is actually served and host.run loops stay alive.
 const program = handler.pipe(
-  Effect.flatMap((instance) => instance.RuntimeContext.exports),
-  Effect.flatMap((exports) => exports.program),
+  // Process-lifetime telemetry: built once into the root scope; exporters
+  // batch on their intervals and flush when the scope closes on graceful
+  // shutdown.
+  Effect.flatMap((instance) =>
+    instance.RuntimeContext.exports.pipe(
+      Effect.flatMap((exports) => exports.program),
+      provideProcessTelemetry(instance.RuntimeContext),
+    ),
+  ),
   Effect.provide(
     Layer.effect(
       Stack,

package/src/AWS/ECR/ImageSource.ts

@@ -271,6 +271,7 @@ import { BunServices } from "@effect/platform-bun";
 import { BunHttpServer } from "alchemy/Http";
 import { Stack } from "alchemy/Stack";
 import { makeEntrypointLayer, reifyBoundConfigProvider } from "alchemy/Runtime";
+import { provideProcessTelemetry } from "alchemy/Telemetry";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Context from "effect/Context";
@@ -317,8 +318,15 @@ const stack = Layer.effect(
 // handler is actually served and host.run loops stay alive. A pure one-shot
 // { run } program completes and the process exits 0.
 const program = tag.pipe(
-  Effect.flatMap((task) => task.RuntimeContext.exports),
-  Effect.flatMap((exports) => exports.program),
+  // Process-lifetime telemetry: built once into the root scope; exporters
+  // batch on their intervals and flush when the scope closes on graceful
+  // shutdown.
+  Effect.flatMap((task) =>
+    task.RuntimeContext.exports.pipe(
+      Effect.flatMap((exports) => exports.program),
+      provideProcessTelemetry(task.RuntimeContext),
+    ),
+  ),
   Effect.provide(
     layer.pipe(
       Layer.provideMerge(stack),

package/src/AWS/ECR/Repository.ts

@@ -67,6 +67,8 @@ export interface Repository extends Resource<
     registryId: string;
     /** Whether image tags are `MUTABLE` or `IMMUTABLE`. */
     imageTagMutability: ecr.ImageTagMutability;
+    /** Whether repository images are scanned when they are pushed. */
+    scanOnPush: boolean;
     /** The JSON lifecycle policy applied to the repository, if any. */
     lifecyclePolicyText?: string;
     /** The JSON repository permissions policy, if any. */
@@ -219,6 +221,10 @@ export const RepositoryProvider = () =>
               repository.imageTagMutability ??
               output?.imageTagMutability ??
               "MUTABLE",
+            scanOnPush:
+              repository.imageScanningConfiguration?.scanOnPush ??
+              output?.scanOnPush ??
+              false,
             lifecyclePolicyText: output?.lifecyclePolicyText,
             policy: yield* readPolicy(repositoryName),
             tags: output?.tags ?? {},
@@ -289,6 +295,34 @@ export const RepositoryProvider = () =>
 
           const repositoryArn = repository.repositoryArn as RepositoryArn;
 
+          // Sync mutable repository settings against OBSERVED cloud state.
+          // These must converge for adopted repositories and out-of-band
+          // drift, not only when createRepository happens to run.
+          const desiredImageTagMutability =
+            news.imageTagMutability ?? "MUTABLE";
+          if (
+            (repository.imageTagMutability ?? "MUTABLE") !==
+            desiredImageTagMutability
+          ) {
+            yield* ecr.putImageTagMutability({
+              repositoryName,
+              imageTagMutability: desiredImageTagMutability,
+            });
+          }
+
+          const desiredScanOnPush = news.scanOnPush ?? false;
+          if (
+            (repository.imageScanningConfiguration?.scanOnPush ?? false) !==
+            desiredScanOnPush
+          ) {
+            yield* ecr.putImageScanningConfiguration({
+              repositoryName,
+              imageScanningConfiguration: {
+                scanOnPush: desiredScanOnPush,
+              },
+            });
+          }
+
           // Sync lifecycle policy — observed ↔ desired.
           if (news.lifecyclePolicyText) {
             yield* ecr.putLifecyclePolicy({
@@ -333,10 +367,8 @@ export const RepositoryProvider = () =>
             repositoryArn,
             repositoryUri: repository.repositoryUri as RepositoryUri,
             registryId: repository.registryId!,
-            imageTagMutability:
-              news.imageTagMutability ??
-              repository.imageTagMutability ??
-              "MUTABLE",
+            imageTagMutability: desiredImageTagMutability,
+            scanOnPush: desiredScanOnPush,
             lifecyclePolicyText: news.lifecyclePolicyText,
             policy: desiredPolicy,
             tags: desiredTags,
@@ -398,6 +430,9 @@ export const RepositoryProvider = () =>
                     registryId: repository.registryId!,
                     imageTagMutability:
                       repository.imageTagMutability ?? "MUTABLE",
+                    scanOnPush:
+                      repository.imageScanningConfiguration?.scanOnPush ??
+                      false,
                     lifecyclePolicyText,
                     policy: yield* readPolicy(repository.repositoryName),
                     tags,

package/src/AWS/ECS/Service.ts

@@ -11,6 +11,7 @@ import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
+import type { HttpClient } from "effect/unstable/http/HttpClient";
 import { deepEqual, isResolved } from "../../Diff.ts";
 import * as Namespace from "../../Namespace.ts";
 import * as Output from "../../Output.ts";
@@ -21,7 +22,7 @@ import { Resource } from "../../Resource.ts";
 import type { HostRuntimeContext, ServerHost } from "../../Server/Process.ts";
 import { Stack } from "../../Stack.ts";
 import { createInternalTags, diffTags } from "../../Tags.ts";
-import { toSeconds, toWireSeconds } from "../../Util/Duration.ts";
+import { toMillis, toSeconds, toWireSeconds } from "../../Util/Duration.ts";
 import { Certificate } from "../ACM/Certificate.ts";
 import { ScalableTarget } from "../ApplicationAutoScaling/ScalableTarget.ts";
 import { ScalingPolicy } from "../ApplicationAutoScaling/ScalingPolicy.ts";
@@ -61,6 +62,7 @@ import {
   ensureTaskLogGroup,
   reapSupersededTaskDefinitionRevision,
   registerTaskDefinitionRevision,
+  syncEnvironmentFilesPolicy,
   syncTaskDefinitionTags,
   taskImagePlatform,
   type TaskBindingContract,
@@ -363,6 +365,22 @@ export class RequestCountScalingRequiresLoadBalancer extends Data.TaggedError(
   readonly message: string;
 }> {}
 
+/** An ECS service did not converge to the requested deployment before timeout. */
+export class ServiceDidNotStabilize extends Data.TaggedError(
+  "ServiceDidNotStabilize",
+)<{
+  readonly clusterArn: string;
+  readonly serviceName: string;
+  readonly expectedTaskDefinitionArn: string | undefined;
+  readonly status: string | undefined;
+  readonly desiredCount: number | undefined;
+  readonly runningCount: number | undefined;
+  readonly pendingCount: number | undefined;
+  readonly deploymentCount: number;
+  readonly unhealthyTargetCount: number;
+  readonly message: string;
+}> {}
+
 /**
  * Derive a deterministic listener-rule priority (1–50000) from the rule's
  * namespaced logical id (FNV-1a 32-bit). Stable across deploys for the same
@@ -680,6 +698,14 @@ export interface ServicePropsBase extends PlatformProps {
    */
   deploymentConfiguration?: ecs.DeploymentConfiguration;
 
+  /**
+   * Maximum time to wait for an ECS deployment, old-task drain, and target
+   * health to converge before failing the resource operation. The provider
+   * hard-caps this at 30 minutes so polling always remains bounded.
+   * @default "10 minutes"
+   */
+  deploymentStabilizationTimeout?: Duration.Input;
+
   /**
    * Deployment controller (`ECS`, `CODE_DEPLOY`, `EXTERNAL`). The controller
    * type is immutable — changing it replaces the service.
@@ -2526,6 +2552,219 @@ const resolveServiceVolumes = (
   return { volumes: resolved, mountPoints };
 };
 
+type ServiceConvergenceDependencies = Credentials | HttpClient | Region;
+
+interface ServiceConvergenceSnapshot {
+  readonly service: ecs.Service | undefined;
+  readonly targetGroups: readonly {
+    readonly missing: boolean;
+    readonly states: readonly (string | undefined)[];
+  }[];
+  readonly converged: boolean;
+}
+
+type ServiceConvergenceMode = "stable" | "drained" | "deleted";
+
+/**
+ * Observe the complete service deployment boundary: ECS rollout state,
+ * desired/running/pending counts, superseded deployments, and every target
+ * group's registered target state.
+ */
+const observeServiceConvergence = (input: {
+  clusterArn: string;
+  serviceName: string;
+  expectedTaskDefinitionArn?: string;
+  mode: ServiceConvergenceMode;
+}): Effect.Effect<
+  ServiceConvergenceSnapshot,
+  ecs.DescribeServicesError | elbv2.DescribeTargetHealthError,
+  ServiceConvergenceDependencies
+> =>
+  Effect.gen(function* () {
+    const described = yield* ecs
+      .describeServices({
+        cluster: input.clusterArn,
+        services: [input.serviceName],
+      })
+      .pipe(
+        Effect.catchTag("ClusterNotFoundException", () =>
+          Effect.succeed(undefined),
+        ),
+      );
+    const service = described?.services?.find(
+      (candidate) =>
+        candidate.serviceName === input.serviceName &&
+        candidate.status !== "INACTIVE",
+    );
+
+    if (service === undefined) {
+      return {
+        service,
+        targetGroups: [],
+        converged: input.mode === "drained" || input.mode === "deleted",
+      };
+    }
+
+    const targetGroupArns = [
+      ...new Set(
+        (service.loadBalancers ?? []).flatMap((loadBalancer) =>
+          loadBalancer.targetGroupArn ? [loadBalancer.targetGroupArn] : [],
+        ),
+      ),
+    ];
+    const targetGroups = yield* Effect.forEach(
+      targetGroupArns,
+      (targetGroupArn) =>
+        elbv2.describeTargetHealth({ TargetGroupArn: targetGroupArn }).pipe(
+          Effect.map((health) => ({
+            missing: false,
+            states: (health.TargetHealthDescriptions ?? []).map(
+              (target) => target.TargetHealth?.State,
+            ),
+          })),
+          Effect.catchTag("TargetGroupNotFoundException", () =>
+            Effect.succeed({
+              missing: true,
+              states: [] as (string | undefined)[],
+            }),
+          ),
+        ),
+      { concurrency: 4 },
+    );
+
+    if (input.mode === "deleted") {
+      return { service, targetGroups, converged: false };
+    }
+
+    const runningCount = service.runningCount ?? 0;
+    const pendingCount = service.pendingCount ?? 0;
+    const desiredCount = service.desiredCount ?? 0;
+    const expectedTargetCount =
+      service.schedulingStrategy === "DAEMON" ? runningCount : desiredCount;
+
+    if (input.mode === "drained") {
+      return {
+        service,
+        targetGroups,
+        converged:
+          runningCount === 0 &&
+          pendingCount === 0 &&
+          targetGroups.every(
+            (targetGroup) =>
+              targetGroup.missing || targetGroup.states.length === 0,
+          ),
+      };
+    }
+
+    const deployments = service.deployments ?? [];
+    const primary = deployments.find(
+      (deployment) => deployment.status === "PRIMARY",
+    );
+    const deploymentController = service.deploymentController?.type ?? "ECS";
+    const countsConverged =
+      service.schedulingStrategy === "DAEMON"
+        ? pendingCount === 0
+        : runningCount === desiredCount && pendingCount === 0;
+    const deploymentConverged =
+      deployments.length === 1 &&
+      primary !== undefined &&
+      primary.taskDefinition === input.expectedTaskDefinitionArn &&
+      (deploymentController === "ECS"
+        ? primary.rolloutState === "COMPLETED"
+        : primary.rolloutState === undefined ||
+          primary.rolloutState === "COMPLETED");
+    const targetsConverged = targetGroups.every(
+      (targetGroup) =>
+        !targetGroup.missing &&
+        targetGroup.states.length === expectedTargetCount &&
+        targetGroup.states.every((state) => state === "healthy"),
+    );
+
+    return {
+      service,
+      targetGroups,
+      converged:
+        service.status === "ACTIVE" &&
+        service.taskDefinition === input.expectedTaskDefinitionArn &&
+        countsConverged &&
+        deploymentConverged &&
+        targetsConverged,
+    };
+  });
+
+const waitForServiceConvergence = (input: {
+  clusterArn: string;
+  serviceName: string;
+  expectedTaskDefinitionArn?: string;
+  mode: ServiceConvergenceMode;
+  timeout?: Duration.Input;
+}): Effect.Effect<
+  ServiceConvergenceSnapshot,
+  | ecs.DescribeServicesError
+  | elbv2.DescribeTargetHealthError
+  | ServiceDidNotStabilize,
+  ServiceConvergenceDependencies
+> => {
+  const pollIntervalMillis = 5_000;
+  const timeoutMillis = Math.min(
+    toMillis(input.timeout ?? "10 minutes")!,
+    30 * 60 * 1_000,
+  );
+  const attempts = Math.max(1, Math.ceil(timeoutMillis / pollIntervalMillis));
+
+  return observeServiceConvergence(input).pipe(
+    Effect.repeat({
+      schedule: Schedule.max([
+        Schedule.spaced(pollIntervalMillis),
+        Schedule.recurs(attempts),
+      ]),
+      until: (snapshot) =>
+        snapshot.converged ||
+        snapshot.service?.deployments?.some(
+          (deployment) => deployment.rolloutState === "FAILED",
+        ) === true,
+    }),
+    Effect.flatMap((snapshot) => {
+      if (snapshot.converged) {
+        return Effect.succeed(snapshot);
+      }
+      const service = snapshot.service;
+      const expectedTargetCount =
+        service?.schedulingStrategy === "DAEMON"
+          ? (service.runningCount ?? 0)
+          : (service?.desiredCount ?? 0);
+      const unhealthyTargetCount = snapshot.targetGroups.reduce(
+        (total, targetGroup) =>
+          total +
+          (targetGroup.missing
+            ? Math.max(1, expectedTargetCount)
+            : targetGroup.states.filter((state) => state !== "healthy").length +
+              Math.abs(targetGroup.states.length - expectedTargetCount)),
+        0,
+      );
+      return Effect.fail(
+        new ServiceDidNotStabilize({
+          clusterArn: input.clusterArn,
+          serviceName: input.serviceName,
+          expectedTaskDefinitionArn: input.expectedTaskDefinitionArn,
+          status: service?.status,
+          desiredCount: service?.desiredCount,
+          runningCount: service?.runningCount,
+          pendingCount: service?.pendingCount,
+          deploymentCount: service?.deployments?.length ?? 0,
+          unhealthyTargetCount,
+          message:
+            service?.deployments?.some(
+              (deployment) => deployment.rolloutState === "FAILED",
+            ) === true
+              ? `ECS service ${input.serviceName} reported a failed deployment`
+              : `ECS service ${input.serviceName} did not become ${input.mode} before timeout`,
+        }),
+      );
+    }),
+  );
+};
+
 export const ServiceProvider = () =>
   Provider.effect(
     Service,
@@ -2792,6 +3031,24 @@ export const ServiceProvider = () =>
         const taskRoleArn =
           output?.taskRoleArn ??
           (yield* createTaskRoleIfNotExists({ id, roleName: taskRoleName }));
+
+        // `taskRoleManagedPolicyArns` is part of the inherited
+        // `TaskDefinitionConfig` surface — attach it like the standalone
+        // Task provider does (its sibling `executionRoleManagedPolicyArns`
+        // is already honored below). `attachRolePolicy` is idempotent for
+        // already-attached ARNs; a `LimitExceededException` means the
+        // policy was NOT attached, so it propagates and fails the deploy
+        // rather than silently shipping a role with missing permissions.
+        yield* Effect.all(
+          (news.taskRoleManagedPolicyArns ?? []).map((policyArn) =>
+            iam.attachRolePolicy({
+              RoleName: taskRoleName,
+              PolicyArn: policyArn,
+            }),
+          ),
+          { concurrency: "unbounded" },
+        );
+
         const executionRoleArn =
           output?.executionRoleArn ??
           (yield* ensureTaskExecutionRole({
@@ -2818,6 +3075,13 @@ export const ServiceProvider = () =>
           secretArns: secretEntries.map(([, arn]) => arn),
         });
 
+        // Environment files: the execution role reads the referenced S3
+        // objects at task start.
+        yield* syncEnvironmentFilesPolicy({
+          roleName: executionRoleName,
+          environmentFiles: news.environmentFiles,
+        });
+
         const logGroupArn =
           output?.logGroupArn ??
           (yield* ensureTaskLogGroup({ id, logGroupName }));
@@ -3292,6 +3556,17 @@ export const ServiceProvider = () =>
                 new Error("createService returned no service"),
               );
             }
+            yield* session.note(
+              `Waiting for ECS service ${serviceName} to stabilize`,
+            );
+            const stable = yield* waitForServiceConvergence({
+              clusterArn,
+              serviceName,
+              expectedTaskDefinitionArn: task.taskDefinitionArn,
+              mode: "stable",
+              timeout: news.deploymentStabilizationTimeout,
+            });
+            const stableService = stable.service!;
             // Legacy inline ingress recorded in prior attrs (service itself
             // was missing — e.g. recreated) is stale now: reap it.
             yield* reapLegacyIngress({ output, session });
@@ -3306,11 +3581,11 @@ export const ServiceProvider = () =>
             }
             yield* session.note(service.serviceArn);
             return {
-              serviceArn: service.serviceArn as ServiceArn,
-              serviceName: service.serviceName!,
-              clusterArn: service.clusterArn as ClusterArn,
-              taskDefinitionArn: service.taskDefinition!,
-              status: service.status ?? "ACTIVE",
+              serviceArn: stableService.serviceArn as ServiceArn,
+              serviceName: stableService.serviceName!,
+              clusterArn: stableService.clusterArn as ClusterArn,
+              taskDefinitionArn: stableService.taskDefinition!,
+              status: stableService.status ?? "ACTIVE",
               ...ingressAttrs,
               ...ownedAttributes,
             };
@@ -3319,7 +3594,7 @@ export const ServiceProvider = () =>
           // Sync — apply in-place mutable fields via updateService. Force a new
           // deployment so a changed task definition (same revision-less ARN) or
           // load-balancer wiring rolls out.
-          const updated = yield* ecs
+          yield* ecs
             .updateService({
               ...mutableInput(news, task, network, securityGroups),
               // While autoscaling manages the desired count, leave it
@@ -3359,7 +3634,17 @@ export const ServiceProvider = () =>
                 ]),
               }),
             );
-          const service = updated.service;
+          yield* session.note(
+            `Waiting for ECS service ${serviceName} to stabilize`,
+          );
+          const stable = yield* waitForServiceConvergence({
+            clusterArn,
+            serviceName,
+            expectedTaskDefinitionArn: task.taskDefinitionArn,
+            mode: "stable",
+            timeout: news.deploymentStabilizationTimeout,
+          });
+          const stableService = stable.service!;
 
           // Sync tags — diff observed service tags against desired.
           const observedTags = Object.fromEntries(
@@ -3405,24 +3690,18 @@ export const ServiceProvider = () =>
 
           yield* session.note(observed.serviceArn);
           return {
-            serviceArn: observed.serviceArn as ServiceArn,
-            serviceName: observed.serviceName!,
-            clusterArn: observed.clusterArn as ClusterArn,
-            taskDefinitionArn:
-              service?.taskDefinition ??
-              observed.taskDefinition ??
-              output?.taskDefinitionArn ??
-              "",
-            status: service?.status ?? observed.status ?? "ACTIVE",
+            serviceArn: stableService.serviceArn as ServiceArn,
+            serviceName: stableService.serviceName!,
+            clusterArn: stableService.clusterArn as ClusterArn,
+            taskDefinitionArn: stableService.taskDefinition!,
+            status: stableService.status ?? "ACTIVE",
             ...ingressAttrs,
             ...ownedAttributes,
           };
         }),
         delete: Effect.fn(function* ({ output, session }) {
-          // Scale to zero first so `deleteService` has no running tasks to
-          // drain. If the service is mid-transition (`ServiceNotActiveException`)
-          // we skip the scale-down — `deleteService({ force: true })` below
-          // tears it down regardless.
+          // Scale to zero and prove every task/target has drained before
+          // deleting the service or its dependent task-definition resources.
           yield* ecs
             .updateService({
               cluster: output.clusterArn,
@@ -3430,11 +3709,26 @@ export const ServiceProvider = () =>
               desiredCount: 0,
             })
             .pipe(
+              Effect.retry({
+                while: (error) => error._tag === "ServiceNotActiveException",
+                schedule: Schedule.max([
+                  Schedule.spaced("5 seconds"),
+                  Schedule.recurs(8),
+                ]),
+              }),
               Effect.catchTag("ServiceNotFoundException", () => Effect.void),
               Effect.catchTag("ClusterNotFoundException", () => Effect.void),
-              Effect.catchTag("ServiceNotActiveException", () => Effect.void),
             );
 
+          yield* session.note(
+            `Waiting for ECS service ${output.serviceName} to drain`,
+          );
+          yield* waitForServiceConvergence({
+            clusterArn: output.clusterArn,
+            serviceName: output.serviceName,
+            mode: "drained",
+          });
+
           yield* ecs
             .deleteService({
               cluster: output.clusterArn,
@@ -3446,6 +3740,12 @@ export const ServiceProvider = () =>
               Effect.catchTag("ClusterNotFoundException", () => Effect.void),
             );
 
+          yield* waitForServiceConvergence({
+            clusterArn: output.clusterArn,
+            serviceName: output.serviceName,
+            mode: "deleted",
+          });
+
           // Inline ingress teardown applies ONLY to legacy state rows (no
           // `ingressKind` marker) whose ALB/TG/listener/SG were created
           // inline by the pre-composition provider. Composed ingress is made