alchemy 2.0.0-beta.81 → 2.0.0-beta.82

package/src/AWS/EC2/Instance.ts

@@ -39,14 +39,11 @@ export const InstanceId = <ID extends string>(id: ID): ID & InstanceId<ID> =>
 export type InstanceArn<ID extends InstanceId = InstanceId> =
   `arn:aws:ec2:${RegionID}:${AccountID}:instance/${ID}`;
 
-export const isInstance = (value: any): value is Instance => {
-  return (
-    typeof value === "object" &&
-    value !== null &&
-    "Type" in value &&
-    value.Type === "AWS.EC2.Instance"
-  );
-};
+export const isInstance = (value: any): value is Instance =>
+  typeof value === "object" &&
+  value !== null &&
+  "Type" in value &&
+  value.Type === "AWS.EC2.Instance";
 
 export interface InstanceProps extends PlatformProps {
   /**
@@ -76,6 +73,8 @@ export interface InstanceProps extends PlatformProps {
   instanceProfileName?: string;
   /**
    * User data script to provide at launch time.
+   * Changes force replacement — EC2 does not re-run user data on an
+   * in-place update.
    */
   userData?: string;
   /**
@@ -188,6 +187,19 @@ export interface Instance extends Resource<
      * The public DNS name, if assigned.
      */
     publicDnsName?: string;
+    /**
+     * HTTP URL of the hosted process
+     * (`http://{publicDnsName|publicIpAddress}:{port}`).
+     *
+     * Set when the instance is hosted (`main` / `port`). Under
+     * `alchemy dev` the emulator's public address is
+     * `{instanceId}.localhost.floci.io`, which resolves to 127.0.0.1
+     * and is served by a per-port host-routing mux — reading `url`
+     * instead of interpolating `publicIpAddress` is what makes the
+     * instance reachable from the host. On AWS this is the public
+     * IP/DNS and the process port.
+     */
+    url?: string;
     /**
      * The key pair name used for SSH access.
      */
@@ -394,7 +406,29 @@ export const InstanceProvider = () =>
             .map((tag) => [tag.Key, tag.Value]),
         );
 
-      const toAttributes = Effect.fn(function* (instance: ec2.Instance) {
+      const publicHost = (instance: ec2.Instance) =>
+        instance.PublicDnsName || instance.PublicIpAddress;
+
+      const hostedListenPort = (props: { main?: unknown; port?: number }) =>
+        props.main !== undefined || props.port !== undefined ? (props.port ?? 3000) : undefined;
+
+      const instanceUrl = (instance: ec2.Instance, port?: number) => {
+        const host = publicHost(instance);
+        if (!host || port === undefined) return undefined;
+        return `http://${host}:${port}`;
+      };
+
+      const portFromUrl = (url?: string) => {
+        if (!url) return undefined;
+        try {
+          const parsed = new URL(url);
+          return parsed.port ? Number(parsed.port) : undefined;
+        } catch {
+          return undefined;
+        }
+      };
+
+      const toAttributes = Effect.fn(function* (instance: ec2.Instance, port?: number) {
         return {
           instanceId: instance.InstanceId as InstanceId,
           instanceArn: yield* toInstanceArn(instance.InstanceId as InstanceId),
@@ -411,6 +445,7 @@ export const InstanceProvider = () =>
           publicIpAddress: instance.PublicIpAddress,
           privateDnsName: instance.PrivateDnsName,
           publicDnsName: instance.PublicDnsName,
+          url: instanceUrl(instance, port),
           keyName: instance.KeyName,
           instanceProfileArn: instance.IamInstanceProfile?.Arn,
           instanceProfileId: instance.IamInstanceProfile?.Id,
@@ -544,8 +579,10 @@ export const InstanceProvider = () =>
             // minutes; the prior ~64s budget timed out intermittently.
             schedule: Schedule.max([Schedule.spaced("5 seconds"), Schedule.recurs(48)]),
           }),
-          Effect.catchTag("InvalidInstanceID.NotFound", () => Effect.void),
-          Effect.catchTag("InstanceNotFound", () => Effect.void),
+          Effect.catchTags({
+            "InvalidInstanceID.NotFound": () => Effect.void,
+            InstanceNotFound: () => Effect.void,
+          }),
         );
       });
 
@@ -559,26 +596,24 @@ export const InstanceProvider = () =>
           instanceProfileName?: string;
         },
         tags: Record<string, string>,
-      ): ec2.RunInstancesRequest => {
-        return {
-          ...hosted.buildLaunchTemplateData(
-            {
-              imageId: news.imageId,
-              instanceType: news.instanceType,
-              keyName: news.keyName as string | undefined,
-              subnetId: news.subnetId as string | undefined,
-              securityGroupIds: news.securityGroupIds as string[] | undefined,
-              associatePublicIpAddress: news.associatePublicIpAddress,
-              privateIpAddress: news.privateIpAddress,
-              availabilityZone: news.availabilityZone,
-              tags,
-            },
-            runtime,
-          ),
-          MinCount: 1,
-          MaxCount: 1,
-        };
-      };
+      ): ec2.RunInstancesRequest => ({
+        ...hosted.buildLaunchTemplateData(
+          {
+            imageId: news.imageId,
+            instanceType: news.instanceType,
+            keyName: news.keyName as string | undefined,
+            subnetId: news.subnetId as string | undefined,
+            securityGroupIds: news.securityGroupIds as string[] | undefined,
+            associatePublicIpAddress: news.associatePublicIpAddress,
+            privateIpAddress: news.privateIpAddress,
+            availabilityZone: news.availabilityZone,
+            tags,
+          },
+          runtime,
+        ),
+        MinCount: 1,
+        MaxCount: 1,
+      });
 
       return {
         stables: ["instanceId", "instanceArn", "vpcId", "subnetId"],
@@ -601,6 +636,39 @@ export const InstanceProvider = () =>
             );
           }),
         diff: Effect.fn(function* ({ id, news, olds, output }) {
+          const raw = news as unknown as Record<string, unknown>;
+          // Launch-time properties cannot be mutated in place. Check them
+          // even when OTHER props are still unresolved Outputs (e.g.
+          // `userData` interpolating an ECR Image URI that's being rebuilt):
+          // bailing on `isResolved(news)` lets the engine default the change
+          // to `update`, which keeps the same instance ID and never re-runs
+          // user data. An unresolved replace-trigger is itself a replacement
+          // — the upstream's new value is unknown at plan time, so we can't
+          // prove the launch config didn't change.
+          const launchConfigChanged = (next: unknown, prev: unknown) =>
+            !isResolved(next) || prev !== next;
+          const hostModeChanged = Boolean(olds.main) !== Boolean(raw.main);
+          if (
+            hostModeChanged ||
+            launchConfigChanged(raw.imageId, olds.imageId) ||
+            launchConfigChanged(raw.subnetId, olds.subnetId) ||
+            launchConfigChanged(raw.keyName, olds.keyName) ||
+            launchConfigChanged(raw.instanceProfileName, olds.instanceProfileName) ||
+            launchConfigChanged(raw.userData, olds.userData) ||
+            launchConfigChanged(raw.associatePublicIpAddress, olds.associatePublicIpAddress) ||
+            launchConfigChanged(raw.privateIpAddress, olds.privateIpAddress) ||
+            launchConfigChanged(raw.availabilityZone, olds.availabilityZone)
+          ) {
+            // A primary private IP cannot belong to two instances in the
+            // same subnet. An omitted subnet may still resolve to that subnet.
+            const reusesFixedPrivateIp =
+              raw.privateIpAddress !== undefined &&
+              (output?.privateIpAddress ?? olds.privateIpAddress) === raw.privateIpAddress &&
+              (raw.subnetId === undefined || (output?.subnetId ?? olds.subnetId) === raw.subnetId);
+            return reusesFixedPrivateIp
+              ? ({ action: "replace", deleteFirst: true } as const)
+              : ({ action: "replace" } as const);
+          }
           // The hosted bundle hash must participate in planning even while
           // OTHER props are unresolved Outputs (an `imageId` AMI lookup, a
           // subnet reference): a content-only edit changes no prop at all,
@@ -608,7 +676,6 @@ export const InstanceProvider = () =>
           // content inputs are plain — gate on THEM, not on the whole bag
           // (the same isResolved-defeats-content-diff bug the MicroVM image
           // diff had).
-          const raw = news as unknown as Record<string, unknown>;
           const contentInputs = {
             main: raw.main,
             handler: raw.handler,
@@ -633,29 +700,6 @@ export const InstanceProvider = () =>
             }
           }
           if (!isResolved(news)) return;
-          const reusesFixedPrivateIp =
-            news.privateIpAddress !== undefined &&
-            (output?.privateIpAddress ?? olds.privateIpAddress) === news.privateIpAddress &&
-            (news.subnetId === undefined || (output?.subnetId ?? olds.subnetId) === news.subnetId);
-
-          const hostModeChanged = Boolean(olds.main) !== Boolean(news.main);
-          if (
-            hostModeChanged ||
-            olds.imageId !== news.imageId ||
-            olds.subnetId !== news.subnetId ||
-            olds.keyName !== news.keyName ||
-            olds.instanceProfileName !== news.instanceProfileName ||
-            olds.userData !== news.userData ||
-            olds.associatePublicIpAddress !== news.associatePublicIpAddress ||
-            olds.privateIpAddress !== news.privateIpAddress ||
-            olds.availabilityZone !== news.availabilityZone
-          ) {
-            // A primary private IP cannot belong to two instances in the
-            // same subnet. An omitted subnet may still resolve to that subnet.
-            return reusesFixedPrivateIp
-              ? ({ action: "replace", deleteFirst: true } as const)
-              : ({ action: "replace" } as const);
-          }
 
           if (
             olds.instanceType !== news.instanceType ||
@@ -684,13 +728,15 @@ export const InstanceProvider = () =>
         read: Effect.fn(function* ({ id, instanceId, output }) {
           const instance = output?.instanceId
             ? yield* describeInstance(output.instanceId).pipe(
-                Effect.catchTag("InvalidInstanceID.NotFound", () => Effect.succeed(undefined)),
-                Effect.catchTag("InstanceNotFound", () => Effect.succeed(undefined)),
+                Effect.catchTags({
+                  "InvalidInstanceID.NotFound": () => Effect.succeed(undefined),
+                  InstanceNotFound: () => Effect.succeed(undefined),
+                }),
               )
             : yield* findInstanceByTags(id, instanceId);
           return instance
             ? {
-                ...(yield* toAttributes(instance)),
+                ...(yield* toAttributes(instance, portFromUrl(output?.url))),
                 instanceProfileName: output?.instanceProfileName,
                 roleArn: output?.roleArn,
                 roleName: output?.roleName,
@@ -729,8 +775,10 @@ export const InstanceProvider = () =>
           // record before deciding whether to launch a new one.
           let instance: ec2.Instance | undefined = output?.instanceId
             ? yield* describeInstance(output.instanceId).pipe(
-                Effect.catchTag("InvalidInstanceID.NotFound", () => Effect.succeed(undefined)),
-                Effect.catchTag("InstanceNotFound", () => Effect.succeed(undefined)),
+                Effect.catchTags({
+                  "InvalidInstanceID.NotFound": () => Effect.succeed(undefined),
+                  InstanceNotFound: () => Effect.succeed(undefined),
+                }),
               )
             : yield* findInstanceByTags(id, generation);
 
@@ -867,7 +915,7 @@ export const InstanceProvider = () =>
           // Re-read final state so attributes reflect the post-sync cloud.
           const final = yield* describeInstance(instanceId);
           return {
-            ...(yield* toAttributes(final)),
+            ...(yield* toAttributes(final, hostedListenPort(news))),
             instanceProfileName: runtime.instanceProfileName ?? output?.instanceProfileName,
             roleArn: runtime.roleArn ?? output?.roleArn,
             roleName: runtime.roleName ?? output?.roleName,

package/src/AWS/EC2/InternetGateway.ts

@@ -360,8 +360,10 @@ export const InternetGatewayProvider = () =>
                   })
                   .pipe(
                     Effect.tapError(Effect.logDebug),
-                    Effect.catchTag("Gateway.NotAttached", () => Effect.void),
-                    Effect.catchTag("InvalidInternetGatewayID.NotFound", () => Effect.void),
+                    Effect.catchTags({
+                      "Gateway.NotAttached": () => Effect.void,
+                      "InvalidInternetGatewayID.NotFound": () => Effect.void,
+                    }),
                   ),
                 {
                   scope: { name: "vpc-id", value: attachment.VpcId! },
@@ -386,12 +388,9 @@ export const InternetGatewayProvider = () =>
               // draining EKS/HyperPod control plane's ENIs can take
               // several minutes to release — 5s x 60 = ~5 min.
               Effect.retry({
-                while: (e) => {
-                  return (
-                    e._tag === "DependencyViolation" ||
-                    (e._tag === "ValidationError" && e.message?.includes("DependencyViolation"))
-                  );
-                },
+                while: (e) =>
+                  e._tag === "DependencyViolation" ||
+                  (e._tag === "ValidationError" && e.message?.includes("DependencyViolation")),
                 schedule: Schedule.max([Schedule.fixed(5000), Schedule.recurs(60)]).pipe(
                   Schedule.tap(({ attempt }) =>
                     session.note(`Waiting for dependencies to clear... (attempt ${attempt})`),
@@ -436,6 +435,10 @@ const describeInternetGateway = (internetGatewayId: string) =>
     }),
   );
 
+class InternetGatewayStillListed extends Data.TaggedError("InternetGatewayStillListed")<{
+  internetGatewayId: string;
+}> {}
+
 class InternetGatewayNotVisible extends Data.TaggedError("InternetGatewayNotVisible")<{
   internetGatewayId: string;
 }> {}
@@ -484,31 +487,32 @@ const waitForInternetGatewayDeleted = (
   internetGatewayId: string,
   session: ScopedPlanStatusSession,
 ) =>
-  Effect.gen(function* () {
-    yield* Effect.retry(
-      Effect.gen(function* () {
-        const result = yield* ec2
-          .describeInternetGateways({ InternetGatewayIds: [internetGatewayId] })
-          .pipe(
-            Effect.tapError(Effect.logDebug),
-            Effect.catchTag("InvalidInternetGatewayID.NotFound", () =>
-              Effect.succeed({ InternetGateways: [] }),
-            ),
-          );
+  Effect.retry(
+    Effect.gen(function* () {
+      const result = yield* ec2
+        .describeInternetGateways({ InternetGatewayIds: [internetGatewayId] })
+        .pipe(
+          Effect.tapError(Effect.logDebug),
+          Effect.catchTag("InvalidInternetGatewayID.NotFound", () =>
+            Effect.succeed({ InternetGateways: [] }),
+          ),
+        );
 
-        if (!result.InternetGateways || result.InternetGateways.length === 0) {
-          return; // Successfully deleted
-        }
+      if (!result.InternetGateways || result.InternetGateways.length === 0) {
+        return; // Successfully deleted
+      }
 
-        // Still exists, fail to trigger retry
-        return yield* Effect.fail(new Error("Internet gateway still exists"));
-      }),
-      {
-        schedule: Schedule.max([Schedule.fixed(2000), Schedule.recurs(15)]).pipe(
-          Schedule.tap(({ attempt }) =>
-            session.note(`Waiting for internet gateway deletion... (${attempt * 2}s)`),
-          ),
+      // Still listed: EC2 is eventually consistent after a delete.
+      return yield* new InternetGatewayStillListed({ internetGatewayId });
+    }),
+    {
+      while: (error) => error._tag === "InternetGatewayStillListed",
+      // EC2 can keep listing a deleted gateway for minutes, so bound the
+      // wait like NatGateway: 5s x 60 = ~5 min.
+      schedule: Schedule.max([Schedule.fixed(5000), Schedule.recurs(60)]).pipe(
+        Schedule.tap(({ attempt }) =>
+          session.note(`Waiting for internet gateway deletion... (${attempt * 5}s)`),
         ),
-      },
-    );
-  });
+      ),
+    },
+  );

package/src/AWS/EC2/LingeringEnis.ts

@@ -60,7 +60,7 @@ const reapLingeringEnis = Effect.fn(function* (
     .describeNetworkInterfaces({
       Filters: [{ Name: scope.name, Values: [scope.value] }],
     })
-    .pipe(Effect.catch(() => Effect.succeed({ NetworkInterfaces: [] })));
+    .pipe(Effect.orElseSucceed(() => ({ NetworkInterfaces: [] })));
 
   const lingering = (described.NetworkInterfaces ?? []).filter(isReapableEni);
 
@@ -84,7 +84,7 @@ const reapLingeringEnis = Effect.fn(function* (
         Effect.catchTag("InvalidNetworkInterfaceID.NotFound", () =>
           Effect.succeed("deleted" as const),
         ),
-        Effect.catch(() => Effect.succeed("pending" as const)),
+        Effect.orElseSucceed(() => "pending" as const),
       );
     if (outcome === "deleted") {
       yield* session.note(`Deleted detached Lambda ENI ${eni.NetworkInterfaceId}`);

package/src/AWS/EC2/Network.ts

@@ -209,6 +209,21 @@ export const Network = (id: string, props: NetworkProps) =>
         );
       }
 
+      // A "public subnet" is usable for public IPv4 only after both its
+      // route-table association and the route through the internet gateway
+      // exist. Preserve those dependencies in the IDs handed to NAT gateways
+      // and downstream resources. Besides preventing a launch/readiness race,
+      // this makes teardown order those consumers before the route and IGW;
+      // EC2 refuses to detach an IGW while a NAT gateway (or an instance) in
+      // the VPC still maps a public IPv4 address.
+      const publicSubnetIds = publicSubnets.map((subnet, index) =>
+        Output.all(
+          subnet.subnetId,
+          publicRouteAssociations[index].associationId,
+          publicInternetRoute.routeTableId,
+        ).pipe(Output.map(([subnetId]) => subnetId)),
+      );
+
       const nat = props.nat ?? "none";
       const elasticIps: EIPResource[] = [];
       const natGateways: NatGatewayResource[] = [];
@@ -217,7 +232,7 @@ export const Network = (id: string, props: NetworkProps) =>
       const privateRouteAssociations: RouteTableAssociationResource[] = [];
 
       if (nat === "per-az") {
-        for (const [index, subnet] of publicSubnets.entries()) {
+        for (const index of publicSubnets.keys()) {
           const eip = yield* EIP(`NatEip${index + 1}`, {
             domain: "vpc",
             tags,
@@ -225,7 +240,7 @@ export const Network = (id: string, props: NetworkProps) =>
           elasticIps.push(eip);
 
           const natGateway = yield* NatGateway(`NatGateway${index + 1}`, {
-            subnetId: subnet.subnetId,
+            subnetId: publicSubnetIds[index],
             allocationId: eip.allocationId,
             connectivityType: "public",
             tags,
@@ -274,7 +289,7 @@ export const Network = (id: string, props: NetworkProps) =>
           elasticIps.push(eip);
 
           const natGateway = yield* NatGateway("NatGateway", {
-            subnetId: publicSubnets[0].subnetId,
+            subnetId: publicSubnetIds[0],
             allocationId: eip.allocationId,
             connectivityType: "public",
             tags,
@@ -338,20 +353,7 @@ export const Network = (id: string, props: NetworkProps) =>
         privateRouteAssociations,
         gatewayEndpoints,
         vpcId: vpc.vpcId,
-        // A "public subnet" is usable for public IPv4 only after both its
-        // route-table association and the route through the internet gateway
-        // exist. Preserve those dependencies in the convenience IDs returned
-        // to downstream resources. Besides preventing a launch/readiness race,
-        // this makes teardown order those consumers before the route and IGW;
-        // EC2 refuses to detach an IGW while an instance in the VPC still owns
-        // a public IPv4 address.
-        publicSubnetIds: publicSubnets.map((subnet, index) =>
-          Output.all(
-            subnet.subnetId,
-            publicRouteAssociations[index].associationId,
-            publicInternetRoute.routeTableId,
-          ).pipe(Output.map(([subnetId]) => subnetId)),
-        ),
+        publicSubnetIds,
         privateSubnetIds: privateSubnets.map((subnet) => subnet.subnetId),
       } satisfies NetworkResources;
     }).pipe(Effect.orDie),

package/src/AWS/EC2/NetworkAcl.ts

@@ -330,9 +330,7 @@ export const NetworkAclProvider = () =>
               Effect.catchTag("InvalidNetworkAclID.NotFound", () => Effect.void),
               // Retry on dependency violations (e.g., associations still being removed)
               Effect.retry({
-                while: (e) => {
-                  return e._tag === "DependencyViolation";
-                },
+                while: (e) => e._tag === "DependencyViolation",
                 schedule: Schedule.max([Schedule.exponential(1000, 1.5), Schedule.recurs(15)]).pipe(
                   Schedule.tap(({ attempt }) =>
                     session.note(`Waiting for dependencies to clear... (attempt ${attempt})`),

package/src/AWS/EC2/NetworkAclEntry.ts

@@ -401,8 +401,10 @@ export const NetworkAclEntryProvider = () =>
               DryRun: false,
             })
             .pipe(
-              Effect.catchTag("InvalidNetworkAclEntry.NotFound", () => Effect.void),
-              Effect.catchTag("InvalidNetworkAclID.NotFound", () => Effect.void),
+              Effect.catchTags({
+                "InvalidNetworkAclEntry.NotFound": () => Effect.void,
+                "InvalidNetworkAclID.NotFound": () => Effect.void,
+              }),
             );
 
           // Delete success is only an acknowledgement. Observe the exact

package/src/AWS/EC2/Route.ts

@@ -484,8 +484,10 @@ export const RouteProvider = () =>
             })
             .pipe(
               Effect.tapError(Effect.logDebug),
-              Effect.catchTag("InvalidRoute.NotFound", () => Effect.void),
-              Effect.catchTag("InvalidRouteTableID.NotFound", () => Effect.void),
+              Effect.catchTags({
+                "InvalidRoute.NotFound": () => Effect.void,
+                "InvalidRouteTableID.NotFound": () => Effect.void,
+              }),
             );
 
           yield* session.note(`Route ${dest} deleted successfully`);

package/src/AWS/EC2/RouteTable.ts

@@ -450,9 +450,7 @@ export const RouteTableProvider = () =>
               // Retry on dependency violations (associations still being deleted)
               Effect.retry({
                 // DependencyViolation means there are still dependent resources
-                while: (e) => {
-                  return e._tag === "DependencyViolation";
-                },
+                while: (e) => e._tag === "DependencyViolation",
                 schedule: Schedule.max([Schedule.fixed(3000), Schedule.recurs(10)]).pipe(
                   Schedule.tap(({ attempt }) =>
                     session.note(`Waiting for dependencies to clear... (attempt ${attempt})`),
@@ -505,29 +503,25 @@ class RouteTableNotVisible extends Data.TaggedError("RouteTableNotVisible")<{
  * Wait for route table to be deleted
  */
 const waitForRouteTableDeleted = (routeTableId: string, session: ScopedPlanStatusSession) =>
-  Effect.gen(function* () {
-    yield* Effect.retry(
-      Effect.gen(function* () {
-        const result = yield* ec2.describeRouteTables({ RouteTableIds: [routeTableId] }).pipe(
-          Effect.tapError(Effect.logDebug),
-          Effect.catchTag("InvalidRouteTableID.NotFound", () =>
-            Effect.succeed({ RouteTables: [] }),
-          ),
-        );
+  Effect.retry(
+    Effect.gen(function* () {
+      const result = yield* ec2.describeRouteTables({ RouteTableIds: [routeTableId] }).pipe(
+        Effect.tapError(Effect.logDebug),
+        Effect.catchTag("InvalidRouteTableID.NotFound", () => Effect.succeed({ RouteTables: [] })),
+      );
 
-        if (!result.RouteTables || result.RouteTables.length === 0) {
-          return; // Successfully deleted
-        }
+      if (!result.RouteTables || result.RouteTables.length === 0) {
+        return; // Successfully deleted
+      }
 
-        // Still exists, fail to trigger retry
-        return yield* Effect.fail(new Error("Route table still exists"));
-      }),
-      {
-        schedule: Schedule.max([Schedule.fixed(2000), Schedule.recurs(10)]).pipe(
-          Schedule.tap(({ attempt }) =>
-            session.note(`Waiting for route table deletion... (${attempt * 2}s)`),
-          ),
+      // Still exists, fail to trigger retry
+      return yield* Effect.fail(new Error("Route table still exists"));
+    }),
+    {
+      schedule: Schedule.max([Schedule.fixed(2000), Schedule.recurs(10)]).pipe(
+        Schedule.tap(({ attempt }) =>
+          session.note(`Waiting for route table deletion... (${attempt * 2}s)`),
         ),
-      },
-    );
-  });
+      ),
+    },
+  );

package/src/AWS/EC2/SecurityGroup.ts

@@ -18,6 +18,7 @@ import type { AccountID } from "../Environment.ts";
 import { AWSEnvironment } from "../Environment.ts";
 import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
+import { getDefaultVpcEmrManagedSecurityGroupIds, getDefaultVpcScope } from "./defaultVpcScope.ts";
 import { retryWhileLingeringEnis } from "./LingeringEnis.ts";
 import {
   declaredSecurityGroupRuleIds,
@@ -692,6 +693,8 @@ export const SecurityGroupProvider = () =>
 
         list: () =>
           Effect.gen(function* () {
+            const defaultVpc = yield* getDefaultVpcScope;
+            const emrManaged = yield* getDefaultVpcEmrManagedSecurityGroupIds(defaultVpc.vpcId);
             const groups = yield* ec2.describeSecurityGroups.pages({}).pipe(
               Stream.runCollect,
               Effect.map((chunk) =>
@@ -701,7 +704,9 @@ export const SecurityGroupProvider = () =>
                       sg.GroupId != null &&
                       // Every VPC's `default` group is AWS-managed and can
                       // never be deleted (CannotDelete) — don't enumerate it.
-                      sg.GroupName !== "default",
+                      sg.GroupName !== "default" &&
+                      // EMR's shared default-VPC groups (see helper).
+                      !emrManaged.has(sg.GroupId),
                   ),
                 ),
               ),
@@ -883,7 +888,7 @@ export const SecurityGroupProvider = () =>
             }),
           );
           if (!matches(finalRules)) {
-            return yield* Effect.fail(new SecurityGroupRulesNotSettled({ groupId }));
+            return yield* new SecurityGroupRulesNotSettled({ groupId });
           }
           return yield* toAttrs(finalSg, finalRules);
         }),

package/src/AWS/EC2/SecurityGroupRule.ts

@@ -12,7 +12,11 @@ import { State, isActionState } from "../../State/State.ts";
 import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
 import { canonicalCidr } from "../../Utils/ip-address.ts";
 import type { Providers } from "../Providers.ts";
-import { getDefaultVpcDefaultSecurityGroupId, getDefaultVpcScope } from "./defaultVpcScope.ts";
+import {
+  getDefaultVpcDefaultSecurityGroupId,
+  getDefaultVpcEmrManagedSecurityGroupIds,
+  getDefaultVpcScope,
+} from "./defaultVpcScope.ts";
 import type { SecurityGroupId, SecurityGroupRuleData } from "./SecurityGroup.ts";
 
 export type SecurityGroupRuleId<ID extends string = string> = `sgr-${ID}`;
@@ -410,6 +414,7 @@ export const SecurityGroupRuleProvider = () =>
             // default VPC are still listed.
             const defaultVpc = yield* getDefaultVpcScope;
             const defaultSgId = yield* getDefaultVpcDefaultSecurityGroupId(defaultVpc.vpcId);
+            const emrManaged = yield* getDefaultVpcEmrManagedSecurityGroupIds(defaultVpc.vpcId);
             return yield* ec2.describeSecurityGroupRules.pages({}).pipe(
               Stream.runCollect,
               Effect.map((chunk) =>
@@ -423,6 +428,7 @@ export const SecurityGroupRuleProvider = () =>
                       } => rule.SecurityGroupRuleId != null,
                     )
                     .filter((rule) => defaultSgId === undefined || rule.GroupId !== defaultSgId)
+                    .filter((rule) => rule.GroupId === undefined || !emrManaged.has(rule.GroupId))
                     .map((rule) => toAttrs(rule)),
                 ),
               ),
@@ -620,7 +626,7 @@ export const SecurityGroupRuleProvider = () =>
             }),
           );
           if (!matches(final)) {
-            return yield* Effect.fail(new SecurityGroupRuleNotConverged({ ruleId }));
+            return yield* new SecurityGroupRuleNotConverged({ ruleId });
           }
           return toAttrs(final);
         }),

package/src/AWS/EC2/Subnet.ts

@@ -425,7 +425,7 @@ export const SubnetProvider = () =>
                     // carries our ownership tags; a foreign subnet re-fails
                     // with the typed conflict.
                     if (news.cidrBlock === undefined) {
-                      return yield* Effect.fail(error);
+                      return yield* error;
                     }
                     const existing = yield* ec2.describeSubnets
                       .items({
@@ -445,7 +445,7 @@ export const SubnetProvider = () =>
                         Effect.map(Option.getOrUndefined),
                       );
                     if (existing?.SubnetId === undefined) {
-                      return yield* Effect.fail(error);
+                      return yield* error;
                     }
                     const existingId = existing.SubnetId as SubnetId;
                     yield* session.note(

package/src/AWS/EC2/VolumeAttachment.ts

@@ -248,8 +248,10 @@ export const VolumeAttachmentProvider = () =>
                           DryRun: false,
                         })
                         .pipe(
-                          Effect.catchTag("InvalidVolume.NotFound", () => Effect.void),
-                          Effect.catchTag("IncorrectState", () => Effect.void),
+                          Effect.catchTags({
+                            "InvalidVolume.NotFound": () => Effect.void,
+                            IncorrectState: () => Effect.void,
+                          }),
                         )
                     : Effect.fail(e),
               ),