alchemy 2.0.0-beta.65 → 2.0.0-beta.67

package/src/AWS/Bedrock/LanguageModelHttp.ts

@@ -0,0 +1,36 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { Converse } from "./Converse.ts";
+import { ConverseHttp } from "./ConverseHttp.ts";
+import { ConverseStream } from "./ConverseStream.ts";
+import { ConverseStreamHttp } from "./ConverseStreamHttp.ts";
+import {
+  LanguageModel,
+  type LanguageModelOptions,
+  makeLanguageModelLayer,
+} from "./LanguageModel.ts";
+
+/**
+ * HTTP implementation of {@link LanguageModel}. Composes the {@link Converse}
+ * and {@link ConverseStream} bindings, so binding a model registers both
+ * `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream` scoped to
+ * exactly that model.
+ */
+export const LanguageModelHttp = Layer.effect(
+  LanguageModel,
+  Effect.gen(function* () {
+    const converse = yield* Converse;
+    const converseStream = yield* ConverseStream;
+    return Effect.fn(function* (
+      model: string | readonly [string, ...string[]],
+      options?: LanguageModelOptions,
+    ) {
+      const [first, ...rest] = typeof model === "string" ? [model] : model;
+      return makeLanguageModelLayer({
+        converse: yield* converse(first, ...rest),
+        converseStream: yield* converseStream(first, ...rest),
+        parameters: options?.parameters,
+      });
+    });
+  }),
+).pipe(Layer.provide(Layer.mergeAll(ConverseHttp, ConverseStreamHttp)));

package/src/AWS/Bedrock/index.ts

@@ -26,6 +26,8 @@ export * from "./InvokeModelHttp.ts";
 export * from "./InvokeModelWithResponseStream.ts";
 export * from "./InvokeModelWithResponseStreamHttp.ts";
 export * from "./KnowledgeBase.ts";
+export * from "./LanguageModel.ts";
+export * from "./LanguageModelHttp.ts";
 export * from "./ListIngestionJobs.ts";
 export * from "./ListIngestionJobsHttp.ts";
 export * from "./ListKnowledgeBaseDocuments.ts";

package/src/AWS/CloudFront/Distribution.ts

@@ -954,7 +954,10 @@ export const DistributionProvider = () =>
           // Sync config — diff observed config against desired and patch
           // via `updateDistribution` with the freshly observed ETag. We
           // keep the observed `CallerReference` because CloudFront does
-          // not allow it to change.
+          // not allow it to change, and fill every member the props don't
+          // express from the observed config: UpdateDistribution replaces
+          // the whole config and rejects requests with missing members
+          // (see `mergeWithObservedConfig`).
           yield* Effect.logInfo(
             `CloudFront Distribution reconcile: updating config for ${observed.distribution.Id} with etag=${observed.etag ?? "missing"}`,
           );
@@ -962,9 +965,9 @@ export const DistributionProvider = () =>
             .updateDistribution({
               Id: observed.distribution.Id,
               IfMatch: observed.etag,
-              DistributionConfig: toConfig(
-                observed.config.CallerReference,
-                news,
+              DistributionConfig: mergeWithObservedConfig(
+                toConfig(observed.config.CallerReference, news),
+                observed.config,
               ),
             })
             .pipe(
@@ -1146,8 +1149,16 @@ const toBehavior = (
   CachePolicyId: behavior.cachePolicyId,
   OriginRequestPolicyId: behavior.originRequestPolicyId,
   ResponseHeadersPolicyId: behavior.responseHeadersPolicyId,
-  ForwardedValues: behavior.forwardedValues,
-  MinTTL: toWireSeconds(behavior.minTtl),
+  // Without a cache policy, CloudFront is in legacy mode and rejects the
+  // request unless both ForwardedValues and MinTTL are present.
+  ForwardedValues:
+    behavior.forwardedValues ??
+    (behavior.cachePolicyId === undefined
+      ? { QueryString: false, Cookies: { Forward: "none" } }
+      : undefined),
+  MinTTL:
+    toWireSeconds(behavior.minTtl) ??
+    (behavior.cachePolicyId === undefined ? 0 : undefined),
   DefaultTTL: toWireSeconds(behavior.defaultTtl),
   MaxTTL: toWireSeconds(behavior.maxTtl),
   TrustedKeyGroups: behavior.trustedKeyGroups
@@ -1277,6 +1288,105 @@ const toOrigin = (origin: DistributionOrigin): cloudfront.Origin => {
   };
 };
 
+/**
+ * Recursively fills `undefined` members of `desired` from `observed`.
+ * Defined values in `desired` always win; arrays are taken from `desired`
+ * wholesale (item-level merging is the caller's concern).
+ */
+const fillUndefined = <T>(desired: T, observed: T): T => {
+  if (desired === undefined) return observed;
+  if (
+    desired === null ||
+    typeof desired !== "object" ||
+    Array.isArray(desired) ||
+    observed === null ||
+    typeof observed !== "object" ||
+    Array.isArray(observed)
+  ) {
+    return desired;
+  }
+  const out: Record<string, unknown> = {
+    ...(desired as Record<string, unknown>),
+  };
+  const desiredObj = desired as Record<string, unknown>;
+  for (const key of Object.keys(observed as Record<string, unknown>)) {
+    // CloudFront list shapes pair `Quantity` with `Items`. A desired node
+    // that declares a `Quantity` but no `Items` (e.g. a geo restriction of
+    // `{ RestrictionType: "none", Quantity: 0 }`) is fully specified —
+    // filling `Items` from the observed config would desynchronize the two
+    // and CloudFront rejects the update with `InconsistentQuantities`.
+    if (
+      key === "Items" &&
+      typeof desiredObj.Quantity === "number" &&
+      desiredObj.Items === undefined
+    ) {
+      continue;
+    }
+    out[key] = fillUndefined(
+      desiredObj[key],
+      (observed as Record<string, unknown>)[key],
+    );
+  }
+  return out as T;
+};
+
+/**
+ * Completes a desired `DistributionConfig` with the freshly observed live
+ * config before an `updateDistribution` call.
+ *
+ * CloudFront's `UpdateDistribution` replaces the ENTIRE distribution config:
+ * any member missing from the request is rejected with `IllegalUpdate`
+ * (observed in practice: "Default root object is missing for the resource",
+ * "The 'OriginCustomHeaders' field is missing"). `toConfig` emits only the
+ * members the props express, so updating a live distribution fails on every
+ * member the props don't model — some of which (e.g. per-origin
+ * `CustomHeaders`, per-behavior `TrustedSigners`) are nested inside
+ * collections and not expressible as props at all.
+ *
+ * The standard CloudFront update pattern is read-modify-write, which the
+ * delete path here already uses (`{ ...current.config, Enabled: false }`).
+ * This applies the same idea to updates: desired values always win — the
+ * declared props still fully control drift — and only `undefined` members
+ * are carried over from the observed config. `Origins` and `CacheBehaviors`
+ * items are additionally merged by identity (`Id` / `PathPattern`) so their
+ * nested unexpressed members carry over too.
+ *
+ * Exported for unit tests.
+ */
+export const mergeWithObservedConfig = (
+  desired: cloudfront.DistributionConfig,
+  observed: cloudfront.DistributionConfig,
+): cloudfront.DistributionConfig => {
+  const merged = fillUndefined(desired, observed);
+  if (merged.Origins?.Items && observed.Origins?.Items) {
+    const observedOrigins = observed.Origins.Items;
+    merged.Origins = {
+      ...merged.Origins,
+      Items: merged.Origins.Items.map((item) =>
+        fillUndefined(
+          item,
+          observedOrigins.find((origin) => origin.Id === item.Id) ?? item,
+        ),
+      ),
+    };
+  }
+  if (merged.CacheBehaviors?.Items && observed.CacheBehaviors?.Items) {
+    const observedBehaviors = observed.CacheBehaviors.Items;
+    merged.CacheBehaviors = {
+      ...merged.CacheBehaviors,
+      Items: merged.CacheBehaviors.Items.map((item) =>
+        fillUndefined(
+          item,
+          observedBehaviors.find(
+            (behavior) => behavior.PathPattern === item.PathPattern,
+          ) ?? item,
+        ),
+      ),
+    };
+  }
+  return merged;
+};
+
 const toConfig = (
   callerReference: string,
   props: DistributionProps,

package/src/AWS/CostExplorer/common.ts

@@ -1,5 +1,6 @@
 import * as ce from "@distilled.cloud/aws/cost-explorer";
 import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
 import { diffTags } from "../../Tags.ts";
 import { Region } from "../Region.ts";
 
@@ -11,8 +12,28 @@ import { Region } from "../Region.ts";
 // (same pattern as CloudFront KVS / ECR Public / WAFv2 / GlobalAccelerator).
 export const CE_REGION = "us-east-1" as const;
 
-export const pinCe = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-  effect.pipe(Effect.provideService(Region, Effect.succeed(CE_REGION)));
+// Cost Explorer's control-plane rate limits are extremely low and shared
+// account-wide, so concurrent deploys readily trip `LimitExceededException:
+// Rate limit exceeded`. Retry it with capped exponential backoff, bounded
+// (~47s total) so a genuine quota LimitExceeded still surfaces quickly.
+const ceThrottleRetrySchedule = Schedule.max([
+  Schedule.min([
+    Schedule.exponential("1 second"),
+    Schedule.spaced("8 seconds"),
+  ]),
+  Schedule.recurs(8),
+]);
+
+export const pinCe = <A, E extends { _tag: string }, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, E, R> =>
+  effect.pipe(
+    Effect.provideService(Region, Effect.succeed(CE_REGION)),
+    Effect.retry({
+      while: (e) => e._tag === "LimitExceededException",
+      schedule: ceThrottleRetrySchedule,
+    }),
+  );
 
 /** Convert a plain tag record to Cost Explorer's `ResourceTag` list shape. */
 export const toResourceTags = (

package/src/AWS/DataSync/Task.ts

@@ -1,5 +1,6 @@
 import * as datasync from "@distilled.cloud/aws/datasync";
 import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
@@ -201,21 +202,35 @@ export const TaskProvider = () =>
 
           // 2. ENSURE — create if missing.
           if (t === undefined) {
-            const created = yield* datasync.createTask({
-              SourceLocationArn: news.sourceLocationArn,
-              DestinationLocationArn: news.destinationLocationArn,
-              Name: name,
-              Options: news.options,
-              Excludes: news.excludes,
-              Includes: news.includes,
-              Schedule: news.schedule,
-              CloudWatchLogGroupArn: news.cloudWatchLogGroupArn,
-              TaskMode: news.taskMode,
-              Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
-                Key,
-                Value,
-              })),
-            });
+            const created = yield* datasync
+              .createTask({
+                SourceLocationArn: news.sourceLocationArn,
+                DestinationLocationArn: news.destinationLocationArn,
+                Name: name,
+                Options: news.options,
+                Excludes: news.excludes,
+                Includes: news.includes,
+                Schedule: news.schedule,
+                CloudWatchLogGroupArn: news.cloudWatchLogGroupArn,
+                TaskMode: news.taskMode,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                // createTask synchronously probes the locations' S3 access,
+                // and a freshly-created location role's IAM policy can lag
+                // (typed `LocationAccessTestFailed`). Retry bounded through
+                // the propagation window.
+                Effect.retry({
+                  while: (e) => e._tag === "LocationAccessTestFailed",
+                  schedule: Schedule.max([
+                    Schedule.spaced("5 seconds"),
+                    Schedule.recurs(9),
+                  ]),
+                }),
+              );
             arn = created.TaskArn!;
             t = yield* describe(arn);
           } else {

package/src/AWS/EC2/Vpc.ts

@@ -408,27 +408,41 @@ export const VpcProvider = () =>
           }
 
           if (vpc === undefined) {
-            const createResult = yield* ec2.createVpc({
-              // TODO(sam): add all properties
-              AmazonProvidedIpv6CidrBlock: news.amazonProvidedIpv6CidrBlock,
-              InstanceTenancy: news.instanceTenancy,
-              CidrBlock: news.cidrBlock,
-              Ipv4IpamPoolId: news.ipv4IpamPoolId,
-              Ipv4NetmaskLength: news.ipv4NetmaskLength,
-              Ipv6Pool: news.ipv6Pool,
-              Ipv6CidrBlock: news.ipv6CidrBlock,
-              Ipv6IpamPoolId: news.ipv6IpamPoolId,
-              Ipv6NetmaskLength: news.ipv6NetmaskLength,
-              Ipv6CidrBlockNetworkBorderGroup:
-                news.ipv6CidrBlockNetworkBorderGroup,
-              TagSpecifications: [
-                {
-                  ResourceType: "vpc",
-                  Tags: createTagsList(desiredTags),
-                },
-              ],
-              DryRun: false,
-            });
+            const createResult = yield* ec2
+              .createVpc({
+                // TODO(sam): add all properties
+                AmazonProvidedIpv6CidrBlock: news.amazonProvidedIpv6CidrBlock,
+                InstanceTenancy: news.instanceTenancy,
+                CidrBlock: news.cidrBlock,
+                Ipv4IpamPoolId: news.ipv4IpamPoolId,
+                Ipv4NetmaskLength: news.ipv4NetmaskLength,
+                Ipv6Pool: news.ipv6Pool,
+                Ipv6CidrBlock: news.ipv6CidrBlock,
+                Ipv6IpamPoolId: news.ipv6IpamPoolId,
+                Ipv6NetmaskLength: news.ipv6NetmaskLength,
+                Ipv6CidrBlockNetworkBorderGroup:
+                  news.ipv6CidrBlockNetworkBorderGroup,
+                TagSpecifications: [
+                  {
+                    ResourceType: "vpc",
+                    Tags: createTagsList(desiredTags),
+                  },
+                ],
+                DryRun: false,
+              })
+              .pipe(
+                // The per-region VPC quota (default 5) is a shared pool;
+                // concurrent deploys transiently exhaust it while their VPCs
+                // are being torn down. Ride out the burst with a bounded
+                // spaced retry (~90s) before surfacing the quota error.
+                Effect.retry({
+                  while: (e) => e._tag === "VpcLimitExceeded",
+                  schedule: Schedule.max([
+                    Schedule.spaced("10 seconds"),
+                    Schedule.recurs(9),
+                  ]),
+                }),
+              );
             const newVpcId = createResult.Vpc!.VpcId! as VpcId;
             yield* session.note(`VPC created: ${newVpcId}`);
             vpc = yield* waitForVpcAvailable(newVpcId, session);

package/src/AWS/EC2/hosted.ts

@@ -218,6 +218,7 @@ import { BunServices } from "@effect/platform-bun";
 import { BunHttpServer } from "alchemy/Http";
 import { Stack } from "alchemy/Stack";
 import { reifyBoundConfigProvider } from "alchemy/Runtime";
+import { provideProcessTelemetry } from "alchemy/Telemetry";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Credentials from "@distilled.cloud/aws/Credentials";
@@ -239,8 +240,15 @@ const platform = Layer.mergeAll(
 // and run it with a Bun HTTP server bound to PORT, so a returned { fetch }
 // handler is actually served and host.run loops stay alive.
 const program = handler.pipe(
-  Effect.flatMap((instance) => instance.RuntimeContext.exports),
-  Effect.flatMap((exports) => exports.program),
+  // Process-lifetime telemetry: built once into the root scope; exporters
+  // batch on their intervals and flush when the scope closes on graceful
+  // shutdown.
+  Effect.flatMap((instance) =>
+    instance.RuntimeContext.exports.pipe(
+      Effect.flatMap((exports) => exports.program),
+      provideProcessTelemetry(instance.RuntimeContext),
+    ),
+  ),
   Effect.provide(
     Layer.effect(
       Stack,

package/src/AWS/ECR/ImageSource.ts

@@ -271,6 +271,7 @@ import { BunServices } from "@effect/platform-bun";
 import { BunHttpServer } from "alchemy/Http";
 import { Stack } from "alchemy/Stack";
 import { makeEntrypointLayer, reifyBoundConfigProvider } from "alchemy/Runtime";
+import { provideProcessTelemetry } from "alchemy/Telemetry";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Context from "effect/Context";
@@ -317,8 +318,15 @@ const stack = Layer.effect(
 // handler is actually served and host.run loops stay alive. A pure one-shot
 // { run } program completes and the process exits 0.
 const program = tag.pipe(
-  Effect.flatMap((task) => task.RuntimeContext.exports),
-  Effect.flatMap((exports) => exports.program),
+  // Process-lifetime telemetry: built once into the root scope; exporters
+  // batch on their intervals and flush when the scope closes on graceful
+  // shutdown.
+  Effect.flatMap((task) =>
+    task.RuntimeContext.exports.pipe(
+      Effect.flatMap((exports) => exports.program),
+      provideProcessTelemetry(task.RuntimeContext),
+    ),
+  ),
   Effect.provide(
     layer.pipe(
       Layer.provideMerge(stack),

package/src/AWS/ECR/Repository.ts

@@ -67,6 +67,8 @@ export interface Repository extends Resource<
     registryId: string;
     /** Whether image tags are `MUTABLE` or `IMMUTABLE`. */
     imageTagMutability: ecr.ImageTagMutability;
+    /** Whether repository images are scanned when they are pushed. */
+    scanOnPush: boolean;
     /** The JSON lifecycle policy applied to the repository, if any. */
     lifecyclePolicyText?: string;
     /** The JSON repository permissions policy, if any. */
@@ -219,6 +221,10 @@ export const RepositoryProvider = () =>
               repository.imageTagMutability ??
               output?.imageTagMutability ??
               "MUTABLE",
+            scanOnPush:
+              repository.imageScanningConfiguration?.scanOnPush ??
+              output?.scanOnPush ??
+              false,
             lifecyclePolicyText: output?.lifecyclePolicyText,
             policy: yield* readPolicy(repositoryName),
             tags: output?.tags ?? {},
@@ -289,6 +295,34 @@ export const RepositoryProvider = () =>
 
           const repositoryArn = repository.repositoryArn as RepositoryArn;
 
+          // Sync mutable repository settings against OBSERVED cloud state.
+          // These must converge for adopted repositories and out-of-band
+          // drift, not only when createRepository happens to run.
+          const desiredImageTagMutability =
+            news.imageTagMutability ?? "MUTABLE";
+          if (
+            (repository.imageTagMutability ?? "MUTABLE") !==
+            desiredImageTagMutability
+          ) {
+            yield* ecr.putImageTagMutability({
+              repositoryName,
+              imageTagMutability: desiredImageTagMutability,
+            });
+          }
+
+          const desiredScanOnPush = news.scanOnPush ?? false;
+          if (
+            (repository.imageScanningConfiguration?.scanOnPush ?? false) !==
+            desiredScanOnPush
+          ) {
+            yield* ecr.putImageScanningConfiguration({
+              repositoryName,
+              imageScanningConfiguration: {
+                scanOnPush: desiredScanOnPush,
+              },
+            });
+          }
+
           // Sync lifecycle policy — observed ↔ desired.
           if (news.lifecyclePolicyText) {
             yield* ecr.putLifecyclePolicy({
@@ -333,10 +367,8 @@ export const RepositoryProvider = () =>
             repositoryArn,
             repositoryUri: repository.repositoryUri as RepositoryUri,
             registryId: repository.registryId!,
-            imageTagMutability:
-              news.imageTagMutability ??
-              repository.imageTagMutability ??
-              "MUTABLE",
+            imageTagMutability: desiredImageTagMutability,
+            scanOnPush: desiredScanOnPush,
             lifecyclePolicyText: news.lifecyclePolicyText,
             policy: desiredPolicy,
             tags: desiredTags,
@@ -398,6 +430,9 @@ export const RepositoryProvider = () =>
                     registryId: repository.registryId!,
                     imageTagMutability:
                       repository.imageTagMutability ?? "MUTABLE",
+                    scanOnPush:
+                      repository.imageScanningConfiguration?.scanOnPush ??
+                      false,
                     lifecyclePolicyText,
                     policy: yield* readPolicy(repository.repositoryName),
                     tags,