alchemy 2.0.0-beta.74 → 2.0.0-beta.76

package/src/AWS/Batch/JobDefinition.ts

@@ -588,10 +588,15 @@ export const JobDefinitionProvider = () =>
       const createRoleName = (id: string, suffix: string) =>
         createPhysicalName({ id: `${id}-${suffix}`, maxLength: 64 });
 
+      // Batch caps `containerProperties.image` at 255 characters, and the
+      // image ref is `<account>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>`
+      // — up to 52 characters of registry prefix plus the 16-character
+      // content tag — so the repository name (ECR itself allows 256) must
+      // stop at 180 to fit in every region.
       const createRepositoryName = (id: string) =>
         createPhysicalName({
           id: `${id}-repo`,
-          maxLength: 256,
+          maxLength: 180,
           lowercase: true,
         });
 
@@ -917,7 +922,7 @@ export const JobDefinitionProvider = () =>
                   []),
               ],
               resolve: {
-                conditionNames: ["bun", "import", "module", "default"],
+                conditionNames: [...Bundle.BUN_CONDITION_NAMES],
                 ...props.build?.input?.resolve,
               },
               plugins: [props.build?.input?.plugins, plugins],
@@ -939,72 +944,10 @@ export const JobDefinitionProvider = () =>
               realMain,
               virtualEntryPlugin(
                 (importPath) => `
-import { BunServices } from "@effect/platform-bun";
-import { Stack } from "alchemy/Stack";
-import * as Config from "effect/Config";
-import * as ConfigProvider from "effect/ConfigProvider";
-import * as Credentials from "@distilled.cloud/aws/Credentials";
-import * as Effect from "effect/Effect";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
-import * as Region from "@distilled.cloud/aws/Region";
-
-import { ${handler} as handler } from ${JSON.stringify(importPath)};
-
-const platform = Layer.mergeAll(
-  BunServices.layer,
-  FetchHttpClient.layer,
-  Logger.layer([Logger.consolePretty()]),
-);
-
-// Resolve the bundled program (the \`run\` Effect registered by the job's
-// impl shape plus any host.run loops) and run it TO COMPLETION — a Batch
-// job is not a server. Exit 0 on success (job SUCCEEDED) and 1 on failure
-// (job FAILED, subject to the definition's retry strategy).
-const program = handler.pipe(
-  Effect.flatMap((job) => job.RuntimeContext.exports),
-  Effect.flatMap((exports) => exports.program),
-  Effect.provide(
-    Layer.effect(
-      Stack,
-      Effect.all([
-        Config.string("ALCHEMY_STACK_NAME"),
-        Config.string("ALCHEMY_STAGE")
-      ]).pipe(
-        Effect.map(([name, stage]) => ({
-          name,
-          stage,
-          bindings: {},
-          resources: {}
-        }))
-      )
-    ).pipe(
-      Layer.provideMerge(Credentials.fromEnv()),
-      Layer.provideMerge(Region.fromEnv()),
-      Layer.provideMerge(platform),
-      Layer.provideMerge(
-        Layer.succeed(
-          ConfigProvider.ConfigProvider,
-          ConfigProvider.fromEnv()
-        )
-      ),
-    )
-  ),
-  Effect.scoped
-);
-
-console.log("Batch job bootstrap starting...");
-await Effect.runPromise(program).then(
-  () => {
-    console.log("Batch job completed.");
-    process.exit(0);
-  },
-  (err) => {
-    console.error("Batch job failed:", err);
-    process.exit(1);
-  },
-);
+import { bootstrap } from "alchemy/Runtime/Bootstrap/Batch";
+import { ${handler} as entrypoint } from ${JSON.stringify(importPath)};
+
+await bootstrap(entrypoint);
 `,
               ),
             );
@@ -1020,7 +963,10 @@ await Effect.runPromise(program).then(
               : file.content,
         }));
 
-        return { files, hash: bundleOutput.hash };
+        // 16 hex characters of the content hash, like the ECS/App Runner image
+        // sources: the full sha256 as a tag pushed long repository names over
+        // Batch's 255-character `image` limit.
+        return { files, hash: bundleOutput.hash.slice(0, 16) };
       });
 
       /** Build + push the container image for the bundled program. */

package/src/AWS/CloudFront/KvEntries.ts

@@ -9,6 +9,7 @@ import {
   extractValue,
   getKvsEtag,
   isKvsPreconditionFailed,
+  cappedKvsRetrySchedule,
   retryForKvsReadiness,
   withKvsRegionFn,
 } from "./common.ts";
@@ -128,7 +129,7 @@ export const KvEntriesProvider = () =>
       ) {
         let remainingPuts = puts;
         let remainingDeletes = deletes;
-        let currentEtag = etag ?? (yield* getKvsEtag(store));
+        let currentEtag: string | undefined = etag;
 
         while (remainingPuts.length > 0 || remainingDeletes.length > 0) {
           const batchPuts = remainingPuts.slice(0, BATCH_SIZE);
@@ -137,20 +138,28 @@ export const KvEntriesProvider = () =>
             BATCH_SIZE - batchPuts.length,
           );
 
-          const resp = yield* sendBatch(
-            store,
-            currentEtag,
-            batchPuts,
-            batchDeletes,
-          ).pipe(
+          // A precondition failure means a concurrent writer (another
+          // KvEntries / KvRoutesUpdate on the same store) advanced the
+          // etag between our read and this batch — the retry MUST re-read
+          // the etag or it can never succeed. `stale` drops the cached
+          // etag on the failed attempt so the retried generator fetches a
+          // fresh one.
+          let stale = currentEtag;
+          const resp = yield* Effect.gen(function* () {
+            const attemptEtag = stale ?? (yield* getKvsEtag(store));
+            stale = undefined;
+            return yield* sendBatch(
+              store,
+              attemptEtag,
+              batchPuts,
+              batchDeletes,
+            );
+          }).pipe(
             Effect.retry({
               while: (error) =>
                 error._tag === "ValidationException" &&
                 isKvsPreconditionFailed(error),
-              schedule: Schedule.max([
-                Schedule.exponential("100 millis"),
-                Schedule.recurs(24),
-              ]),
+              schedule: cappedKvsRetrySchedule,
             }),
           );
 

package/src/AWS/CloudFront/KvRoutesUpdate.ts

@@ -11,6 +11,7 @@ import {
   extractValue,
   getKvsEtag,
   isKvsPreconditionFailed,
+  cappedKvsRetrySchedule,
   retryForKvsReadiness,
   withKvsRegionFn,
 } from "./common.ts";
@@ -200,10 +201,7 @@ export const KvRoutesUpdateProvider = () =>
             while: (error) =>
               error._tag === "ValidationException" &&
               isKvsPreconditionFailed(error),
-            schedule: Schedule.max([
-              Schedule.exponential("100 millis"),
-              Schedule.recurs(24),
-            ]),
+            schedule: cappedKvsRetrySchedule,
           }),
         );
 
@@ -233,10 +231,7 @@ export const KvRoutesUpdateProvider = () =>
             while: (error) =>
               error._tag === "ValidationException" &&
               isKvsPreconditionFailed(error),
-            schedule: Schedule.max([
-              Schedule.exponential("100 millis"),
-              Schedule.recurs(24),
-            ]),
+            schedule: cappedKvsRetrySchedule,
           }),
         );
 

package/src/AWS/CloudFront/common.ts

@@ -30,7 +30,15 @@ const isKvsNotReady = (error: unknown) => {
   return tag === "ResourceNotFoundException" || tag === "ConflictException";
 };
 
-const cappedKvsRetrySchedule = Schedule.max([
+/**
+ * Bounded KVS retry: exponential backoff with the per-attempt delay capped
+ * at 2s and at most 24 recurrences (~45s worst case). NEVER use a bare
+ * `Schedule.max([Schedule.exponential(...), Schedule.recurs(n)])` for KVS
+ * retries — `recurs` bounds the COUNT, not the TIME, and an uncapped
+ * exponential makes the tail attempts wait minutes-to-hours (24 attempts
+ * at 100ms doubling total ~19 days), which reads as a silent hang.
+ */
+export const cappedKvsRetrySchedule = Schedule.max([
   Schedule.exponential("100 millis"),
   Schedule.recurs(24),
 ]).pipe(

package/src/AWS/Cognito/ManagedLoginBranding.ts

@@ -0,0 +1,339 @@
+import * as cip from "@distilled.cloud/aws/cognito-identity-provider";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+/**
+ * An image asset (logo, favicon, background, …) attached to a managed login
+ * branding style, per color mode.
+ */
+export interface ManagedLoginBrandingAsset {
+  /** Which slot of the managed login pages the asset fills. */
+  category:
+    | "FAVICON_ICO"
+    | "FAVICON_SVG"
+    | "EMAIL_GRAPHIC"
+    | "SMS_GRAPHIC"
+    | "AUTH_APP_GRAPHIC"
+    | "PASSWORD_GRAPHIC"
+    | "PASSKEY_GRAPHIC"
+    | "PAGE_HEADER_LOGO"
+    | "PAGE_HEADER_BACKGROUND"
+    | "PAGE_FOOTER_LOGO"
+    | "PAGE_FOOTER_BACKGROUND"
+    | "PAGE_BACKGROUND"
+    | "FORM_BACKGROUND"
+    | "FORM_LOGO"
+    | "IDP_BUTTON_ICON";
+  /** The color scheme the asset applies to. */
+  colorMode: "LIGHT" | "DARK" | "DYNAMIC";
+  /** The file type of the asset. */
+  extension: "ICO" | "JPEG" | "PNG" | "SVG" | "WEBP";
+  /** The image file, as bytes (max 2 MB). */
+  bytes?: Uint8Array;
+  /** For `IDP_BUTTON_ICON` assets, the identity provider the icon is for. */
+  resourceId?: string;
+}
+
+export interface ManagedLoginBrandingProps {
+  /**
+   * The ID of the user pool the branding style belongs to. Changing this
+   * triggers a replacement.
+   */
+  userPoolId: string;
+  /**
+   * The ID of the app client the branding style is assigned to. Each app
+   * client can have exactly one style. Changing this triggers a
+   * replacement.
+   */
+  clientId: string;
+  /**
+   * Apply Cognito's default branding instead of custom `settings` /
+   * `assets`. This is what makes a fresh pool's managed login pages render
+   * without a one-time console step.
+   * @default true when neither `settings` nor `assets` is provided
+   */
+  useCognitoProvidedValues?: boolean;
+  /**
+   * The branding settings JSON document (colors, component styles, …) in
+   * the shape produced by the managed login branding designer / returned by
+   * `DescribeManagedLoginBranding`.
+   */
+  settings?: Record<string, unknown>;
+  /**
+   * Image assets for the branding style (logos, favicons, backgrounds),
+   * one per category + color mode.
+   */
+  assets?: ManagedLoginBrandingAsset[];
+}
+
+export interface ManagedLoginBranding extends Resource<
+  "AWS.Cognito.ManagedLoginBranding",
+  ManagedLoginBrandingProps,
+  {
+    /** The generated ID of the branding style. */
+    managedLoginBrandingId: string;
+    /** The ID of the user pool the style belongs to. */
+    userPoolId: string;
+    /** The ID of the app client the style is assigned to. */
+    clientId: string;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A managed login branding style for an Amazon Cognito user pool app
+ * client. Assigning a style (even just Cognito's provided defaults) is what
+ * activates the hosted managed login pages — a `UserPoolDomain` with
+ * `managedLoginVersion: 2` serves them end-to-end without any console step.
+ * ### Activating Managed Login
+ * **Example:** Default Branding for a Hosted Login Domain
+ * ```typescript
+ * import * as Cognito from "alchemy/AWS/Cognito";
+ *
+ * const pool = yield* Cognito.UserPool("Users", {});
+ * const client = yield* Cognito.UserPoolClient("Web", {
+ *   userPoolId: pool.userPoolId,
+ *   callbackUrls: ["https://example.com/callback"],
+ *   allowedOAuthFlowsUserPoolClient: true,
+ *   allowedOAuthFlows: ["code"],
+ *   allowedOAuthScopes: ["openid", "email"],
+ * });
+ * const domain = yield* Cognito.UserPoolDomain("AuthDomain", {
+ *   userPoolId: pool.userPoolId,
+ *   managedLoginVersion: 2,
+ * });
+ * yield* Cognito.ManagedLoginBranding("Branding", {
+ *   userPoolId: pool.userPoolId,
+ *   clientId: client.clientId,
+ * });
+ * ```
+ *
+ * ### Custom Branding
+ * **Example:** Custom Settings and a Logo Asset
+ * ```typescript
+ * yield* Cognito.ManagedLoginBranding("Branding", {
+ *   userPoolId: pool.userPoolId,
+ *   clientId: client.clientId,
+ *   settings: brandingSettings, // designer-exported JSON document
+ *   assets: [{
+ *     category: "FORM_LOGO",
+ *     colorMode: "LIGHT",
+ *     extension: "PNG",
+ *     bytes: logoBytes,
+ *   }],
+ * });
+ * ```
+ *
+ * @resource
+ */
+export const ManagedLoginBranding = Resource<ManagedLoginBranding>(
+  "AWS.Cognito.ManagedLoginBranding",
+);
+
+const toWireAssets = (
+  assets: ManagedLoginBrandingAsset[] | undefined,
+): cip.AssetType[] | undefined =>
+  assets?.map((asset) => ({
+    Category: asset.category,
+    ColorMode: asset.colorMode,
+    Extension: asset.extension,
+    Bytes: asset.bytes,
+    ResourceId: asset.resourceId,
+  }));
+
+/** Canonicalize an asset list for order-insensitive comparison; bytes are
+ * folded to base64. */
+const canonicalAssets = (assets: cip.AssetType[] | undefined) =>
+  (assets ?? [])
+    .map((asset) =>
+      [
+        asset.Category,
+        asset.ColorMode,
+        asset.Extension,
+        asset.ResourceId ?? "",
+        asset.Bytes === undefined
+          ? ""
+          : Buffer.from(asset.Bytes).toString("base64"),
+      ].join(":"),
+    )
+    .sort()
+    .join(",");
+
+/**
+ * Whether the style should carry Cognito's provided default values: an
+ * explicit prop wins, otherwise defaults to `true` exactly when no custom
+ * settings/assets are declared.
+ */
+const desiredUseProvidedValues = (news: ManagedLoginBrandingProps) =>
+  news.useCognitoProvidedValues ??
+  (news.settings === undefined && news.assets === undefined);
+
+/**
+ * Bounded retry over the concurrent-modification window (branding updates
+ * can race domain/pool operations). Explicitly typed so the conditional
+ * `Retry.Return` type never leaks into declaration emit.
+ */
+const retryWhileConcurrent = <A, E extends { _tag: string }, R>(
+  self: Effect.Effect<A, E, R>,
+): Effect.Effect<A, E, R> =>
+  Effect.retry(self, {
+    while: (e) => e._tag === "ConcurrentModificationException",
+    schedule: Schedule.max([Schedule.fixed("2 seconds"), Schedule.recurs(10)]),
+  });
+
+export const ManagedLoginBrandingProvider = () =>
+  Provider.effect(
+    ManagedLoginBranding,
+    Effect.gen(function* () {
+      const describeById = Effect.fn(function* (
+        userPoolId: string,
+        managedLoginBrandingId: string,
+      ) {
+        return yield* cip
+          .describeManagedLoginBranding({
+            UserPoolId: userPoolId,
+            ManagedLoginBrandingId: managedLoginBrandingId,
+          })
+          .pipe(
+            Effect.map((r) => r.ManagedLoginBranding),
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+      });
+
+      const describeByClient = Effect.fn(function* (
+        userPoolId: string,
+        clientId: string,
+      ) {
+        return yield* cip
+          .describeManagedLoginBrandingByClient({
+            UserPoolId: userPoolId,
+            ClientId: clientId,
+          })
+          .pipe(
+            Effect.map((r) => r.ManagedLoginBranding),
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+      });
+
+      return ManagedLoginBranding.Provider.of({
+        stables: ["managedLoginBrandingId", "userPoolId", "clientId"],
+
+        // Sub-resource keyed entirely by its user pool (userPoolId) with no
+        // global enumeration API of its own — nuke reaches it through the
+        // parent's deletion, so enumeration returns empty per the
+        // ProviderService doctrine.
+        list: () => Effect.succeed([]),
+
+        read: Effect.fn(function* ({ olds, output }) {
+          const userPoolId = output?.userPoolId ?? olds?.userPoolId;
+          const clientId = output?.clientId ?? olds?.clientId;
+          if (userPoolId === undefined) return undefined;
+          const observed =
+            output?.managedLoginBrandingId !== undefined
+              ? yield* describeById(userPoolId, output.managedLoginBrandingId)
+              : clientId !== undefined
+                ? yield* describeByClient(userPoolId, clientId)
+                : undefined;
+          if (observed?.ManagedLoginBrandingId === undefined) return undefined;
+          return {
+            managedLoginBrandingId: observed.ManagedLoginBrandingId,
+            userPoolId,
+            clientId: clientId!,
+          };
+        }),
+
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            olds?.userPoolId !== news?.userPoolId ||
+            olds?.clientId !== news?.clientId
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          const { userPoolId, clientId } = news;
+          const useProvided = desiredUseProvidedValues(news);
+
+          // 1. OBSERVE — output.managedLoginBrandingId is only a cache;
+          //    fall back to the by-client lookup so state loss converges.
+          let observed =
+            output?.managedLoginBrandingId !== undefined
+              ? yield* describeById(userPoolId, output.managedLoginBrandingId)
+              : undefined;
+          if (observed === undefined) {
+            observed = yield* describeByClient(userPoolId, clientId);
+          }
+
+          // 2. ENSURE — create when missing; a branding created out-of-band
+          //    (or by a concurrent run) for the same client surfaces as
+          //    ManagedLoginBrandingExistsException and is taken over.
+          if (observed === undefined) {
+            observed = yield* cip
+              .createManagedLoginBranding({
+                UserPoolId: userPoolId,
+                ClientId: clientId,
+                UseCognitoProvidedValues: useProvided,
+                Settings: news.settings,
+                Assets: toWireAssets(news.assets),
+              })
+              .pipe(
+                Effect.map((r) => r.ManagedLoginBranding),
+                Effect.catchTag("ManagedLoginBrandingExistsException", () =>
+                  describeByClient(userPoolId, clientId),
+                ),
+              );
+          }
+
+          const managedLoginBrandingId = observed?.ManagedLoginBrandingId!;
+
+          // 3. SYNC — diff observed style against desired; skip the update
+          //    entirely on no-op.
+          const drift =
+            (observed?.UseCognitoProvidedValues ?? false) !== useProvided ||
+            (news.settings !== undefined &&
+              JSON.stringify(news.settings) !==
+                JSON.stringify(observed?.Settings)) ||
+            (news.assets !== undefined &&
+              canonicalAssets(toWireAssets(news.assets)) !==
+                canonicalAssets(observed?.Assets));
+          if (drift) {
+            yield* cip
+              .updateManagedLoginBranding({
+                UserPoolId: userPoolId,
+                ManagedLoginBrandingId: managedLoginBrandingId,
+                UseCognitoProvidedValues: useProvided,
+                Settings: news.settings,
+                Assets: toWireAssets(news.assets),
+              })
+              .pipe(retryWhileConcurrent);
+          }
+
+          yield* session.note(managedLoginBrandingId);
+          return { managedLoginBrandingId, userPoolId, clientId };
+        }),
+
+        delete: Effect.fn(function* ({ output }) {
+          yield* cip
+            .deleteManagedLoginBranding({
+              UserPoolId: output.userPoolId,
+              ManagedLoginBrandingId: output.managedLoginBrandingId,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+              retryWhileConcurrent,
+            );
+        }),
+      });
+    }),
+  );