alchemy 2.0.0-beta.81 → 2.0.0-beta.82

package/lib/AWS/Lambda/Function.d.ts

@@ -1,8 +1,6 @@
 import type { Credentials } from "@distilled.cloud/aws/Credentials";
 import * as Lambda from "@distilled.cloud/aws/lambda";
 import { Region } from "@distilled.cloud/aws/Region";
-import type * as lambda from "aws-lambda";
-import * as Context from "effect/Context";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import type { HttpClient } from "effect/http/HttpClient";
@@ -18,15 +16,13 @@ import { Stack } from "../../Stack.ts";
 import { Stage } from "../../Stage.ts";
 import { AWSEnvironment } from "../Environment.ts";
 import type { PolicyStatement } from "../IAM/Policy.ts";
+import { type LogRetentionConfig } from "../Logs/LogRetention.ts";
 import type { Providers } from "../Providers.ts";
 import { type EventInvokeConfig } from "./EventInvokeConfig.ts";
 import { type FunctionImageAttributes, type FunctionImageSource } from "./FunctionImage.ts";
 export type { FunctionImageSource } from "./FunctionImage.ts";
 export declare const FunctionTypeId: "AWS.Lambda.Function";
 export type FunctionTypeId = typeof FunctionTypeId;
-declare const HandlerContext_base: Context.ServiceClass<HandlerContext, "AWS.Lambda.HandlerContext", lambda.Context>;
-export declare class HandlerContext extends HandlerContext_base {
-}
 export declare const isFunction: (value: any) => value is Function;
 /**
  * True for any Alchemy host that accepts the `{ env, policyStatements }`
@@ -173,6 +169,25 @@ export interface FunctionCommonProps extends PlatformProps {
      * @default 3 seconds (AWS Lambda default)
      */
     timeout?: Duration.Duration;
+    /**
+     * How long before {@link timeout} telemetry is flushed for an invocation
+     * that is still running. A Lambda that hits its timeout is killed
+     * mid-flight and its buffered spans and logs are lost; at
+     * `timeout - timeoutMargin` the runtime ends the invocation's root span
+     * with an `AWS.Lambda.InvocationTimeoutError`, logs a warning and drains
+     * the exporters, so the trace of the slow invocation is exported instead.
+     *
+     * The handler is never interrupted and the invocation's outcome is never
+     * changed. If it does finish inside the margin, its response goes out
+     * as normal; the root span is still exported once, as the timeout error
+     * marked `aws.lambda.timeout.imminent`.
+     *
+     * Size it for one export round-trip to your telemetry backend. Set to
+     * `Duration.zero` to disable.
+     *
+     * @default 500 millis
+     */
+    timeoutMargin?: Duration.Duration;
     /**
      * Maximum number of concurrent executions reserved for this function.
      * Omit to remove the function-level reserved concurrency limit.
@@ -197,6 +212,15 @@ export interface FunctionCommonProps extends PlatformProps {
      * config to an alias instead.
      */
     eventInvokeConfig?: EventInvokeConfig;
+    /**
+     * Retention for the function's CloudWatch log group
+     * (`/aws/lambda/<functionName>`), e.g. `{ retention: "2 weeks" }` or
+     * `{ retention: "forever" }`. When set, Alchemy creates (or adopts) the
+     * log group so the policy applies before the first invocation, and
+     * deletes it with the function. When omitted the log group is left to
+     * Lambda, which creates it on first invoke with no expiry.
+     */
+    logging?: LogRetentionConfig;
 }
 export interface FunctionZipProps extends FunctionCommonProps {
     /**
@@ -334,7 +358,7 @@ export interface Function extends Resource<FunctionTypeId, FunctionProps, {
     }[];
 }, Providers> {
 }
-export type FunctionServices = Credentials | Region | AWSEnvironment;
+export type FunctionServices = Credentials | Region | AWSEnvironment | Function;
 export type FunctionShape = Main<FunctionServices>;
 export interface NormalizedFunctionUrlConfig {
     authType: Lambda.FunctionUrlAuthType;

package/lib/AWS/Lambda/Function.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Function.d.ts","sourceRoot":"","sources":["../../../src/AWS/Lambda/Function.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAGpE,OAAO,KAAK,MAAM,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,KAAK,KAAK,MAAM,MAAM,YAAY,CAAC;AAE1C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAKtC,OAAO,KAAK,KAAK,QAAQ,MAAM,UAAU,CAAC;AAE1C,OAAO,KAAK,KAAK,MAAM,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAKxE,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAwB,MAAM,mBAAmB,CAAC;AAEnE,OAAO,KAAK,UAAU,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAMvC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAE5B,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,eAAO,MAAM,cAAc,EAAG,qBAA8B,CAAC;AAC7D,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC;;AAuBnD,qBAAa,cAAe,SAAQ,mBAEnC;CAAG;AAEJ,eAAO,MAAM,UAAU,UAAW,GAAG,KAAG,KAAK,IAAI,QAOhD,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,UAAW,GAAG,KAAG,KAAK,IAAI,QAWnD,CAAC;AAEF,MAAM,WAAW,oBACf,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,kBAAkB;IACjE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;CACnD;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,8DAA8D;IAC9D,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,UAAW,QAAQ,KAAG,MACO,CAAC;AAiB5D,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,mBAAmB,CAAC;IACtC;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B;;OAEG;IACH,GAAG,CAAC,EAAE;QACJ,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;KAC5B,CAAC;IACF;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,EAAE;QAClB;;;WAGG;QACH,WAAW,CAAC,EAAE,cAAc,CAAC;QAC7B;;;;WAIG;QACH,GAAG,CAAC,EAAE,MAAM,CAAC;QACb;;;WAGG;QACH,cAAc,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;IACJ;;;;;OAKG;IACH,OAAO,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAC5B;;;OAGG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;IACnC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED,MAAM,WAAW,gBAAiB,SAAQ,mBAAmB;IAC3D;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACtC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC;CACtC;AAED,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,IAAI,CAAC,EAAE,KAAK,CAAC;IACb;;;OAGG;IACH,YAAY,EAAE,oBAAoB,CAAC;IACnC;;;;OAIG;IACH,KAAK,EAAE,mBAAmB,CAAC;IAC3B,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,eAAe,CAAC,EAAE,KAAK,CAAC;IACxB,OAAO,CAAC,EAAE,KAAK,CAAC;IAGhB,aAAa,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAKlE,UAAU,8BAA8B;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,+FA6BxC,CAAC;AA+CF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,YAAa,QAAQ,CAAC,QAAQ,GAAG,SAAS,KAAG,MAAM,GAAG,SAkBlF,CAAC;AAEF,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,cAAc,EACd,aAAa,EACb;IACE,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;KAC/C,CAAC;IACF,4BAA4B,CAAC,EAAE,MAAM,CAAC;CACvC,EACD;IACE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;IACrC;;;;;OAKG;IACH,GAAG,CAAC,EAAE;QACJ,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;KAC5B,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE;QAClB,4CAA4C;QAC5C,GAAG,EAAE,MAAM,CAAC;QACZ,sEAAsE;QACtE,cAAc,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;CACL,EACD,SAAS,CACV;CAAG;AAEJ,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,MAAM,GAAG,cAAc,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAEnD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC,mBAAmB,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CAC/B;AAED,eAAO,MAAM,oBAAoB,SAC1B,aAAa,CAAC,aAAa,CAAC,KAChC,2BAA2B,GAAG,SAehC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmZG;AACH,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAC7B,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,UAAU,CAAC,eAAe,EAC1B,EAAE,EACF,gBAAgB,CA8GhB,CAAC;AAEH,eAAO,MAAM,gBAAgB,gTAgiD1B,CAAC"}
+{"version":3,"file":"Function.d.ts","sourceRoot":"","sources":["../../../src/AWS/Lambda/Function.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAGpE,OAAO,KAAK,MAAM,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAKrD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAKtC,OAAO,KAAK,KAAK,QAAQ,MAAM,UAAU,CAAC;AAE1C,OAAO,KAAK,KAAK,MAAM,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAKxE,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAwB,MAAM,mBAAmB,CAAC;AAEnE,OAAO,KAAK,UAAU,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAMvC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAE5B,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAS5B,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,eAAO,MAAM,cAAc,EAAG,qBAA8B,CAAC;AAC7D,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC;AAyBnD,eAAO,MAAM,UAAU,UAAW,GAAG,KAAG,KAAK,IAAI,QAIX,CAAC;AAEvC;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,UAAW,GAAG,KAAG,KAAK,IAAI,QAQhB,CAAC;AAErC,MAAM,WAAW,oBACf,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,kBAAkB;IACjE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;CACnD;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,8DAA8D;IAC9D,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,UAAW,QAAQ,KAAG,MACO,CAAC;AAoB5D,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,mBAAmB,CAAC;IACtC;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B;;OAEG;IACH,GAAG,CAAC,EAAE;QACJ,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;KAC5B,CAAC;IACF;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,EAAE;QAClB;;;WAGG;QACH,WAAW,CAAC,EAAE,cAAc,CAAC;QAC7B;;;;WAIG;QACH,GAAG,CAAC,EAAE,MAAM,CAAC;QACb;;;WAGG;QACH,cAAc,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;IACJ;;;;;OAKG;IACH,OAAO,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAC5B;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAClC;;;OAGG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;IACnC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAiB,SAAQ,mBAAmB;IAC3D;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACtC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC;CACtC;AAED,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,IAAI,CAAC,EAAE,KAAK,CAAC;IACb;;;OAGG;IACH,YAAY,EAAE,oBAAoB,CAAC;IACnC;;;;OAIG;IACH,KAAK,EAAE,mBAAmB,CAAC;IAC3B,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,eAAe,CAAC,EAAE,KAAK,CAAC;IACxB,OAAO,CAAC,EAAE,KAAK,CAAC;IAGhB,aAAa,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAKlE,UAAU,8BAA8B;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,+FA6BxC,CAAC;AA+CF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,YAAa,QAAQ,CAAC,QAAQ,GAAG,SAAS,KAAG,MAAM,GAAG,SAkBlF,CAAC;AAEF,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,cAAc,EACd,aAAa,EACb;IACE,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;KAC/C,CAAC;IACF,4BAA4B,CAAC,EAAE,MAAM,CAAC;CACvC,EACD;IACE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;IACrC;;;;;OAKG;IACH,GAAG,CAAC,EAAE;QACJ,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;KAC5B,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE;QAClB,4CAA4C;QAC5C,GAAG,EAAE,MAAM,CAAC;QACZ,sEAAsE;QACtE,cAAc,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;CACL,EACD,SAAS,CACV;CAAG;AAEJ,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,MAAM,GACN,cAAc,GAEd,QAAQ,CAAC;AAEb,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAEnD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC,mBAAmB,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CAC/B;AAED,eAAO,MAAM,oBAAoB,SAC1B,aAAa,CAAC,aAAa,CAAC,KAChC,2BAA2B,GAAG,SAehC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmZG;AACH,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAC7B,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,UAAU,CAAC,eAAe,EAC1B,EAAE,EACF,gBAAgB,CAqHhB,CAAC;AAEH,eAAO,MAAM,gBAAgB,gTAkgD1B,CAAC"}

package/lib/AWS/Lambda/Function.js

@@ -14,7 +14,7 @@ import * as Schedule from "effect/Schedule";
 import * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
 import { Unowned } from "../../AdoptPolicy.js";
-import { deepEqual, havePropsChanged, isResolved } from "../../Diff.js";
+import { deepEqual, havePropsChanged, isResolved, stripEffects } from "../../Diff.js";
 import { isScopeEjected } from "../../Http.js";
 import * as Output from "../../Output.js";
 import { createPhysicalName } from "../../PhysicalName.js";
@@ -32,10 +32,12 @@ import { zipCode } from "../../Util/zip.js";
 import { Assets } from "../Assets.js";
 import { AWSEnvironment } from "../Environment.js";
 import * as IAM from "../IAM/index.js";
+import { syncLogGroupRetention } from "../Logs/LogRetention.js";
 import { syncEventInvokeConfig } from "./EventInvokeConfig.js";
 import { makeFunctionBundler } from "./FunctionBundle.js";
 import { decodeFunctionImageSource, makeFunctionImage, } from "./FunctionImage.js";
 import { makeFunctionHttpHandler } from "./HttpServer.js";
+import { HandlerContext, TIMEOUT_MARGIN_ENV, toTimeoutMarginMillis, withInvocationDeadline, } from "./InvocationDeadline.js";
 export const FunctionTypeId = "AWS.Lambda.Function";
 class FunctionUpdatePending extends Data.TaggedError("FunctionUpdatePending") {
     get message() {
@@ -47,14 +49,10 @@ class FunctionUpdateFailed extends Data.TaggedError("FunctionUpdateFailed") {
         return `Lambda function ${this.functionName} update failed: ${this.reason ?? "unknown reason"}`;
     }
 }
-export class HandlerContext extends Context.Service()("AWS.Lambda.HandlerContext") {
-}
-export const isFunction = (value) => {
-    return (typeof value === "object" &&
-        value !== null &&
-        "Type" in value &&
-        value.Type === "AWS.Lambda.Function");
-};
+export const isFunction = (value) => typeof value === "object" &&
+    value !== null &&
+    "Type" in value &&
+    value.Type === "AWS.Lambda.Function";
 /**
  * True for any Alchemy host that accepts the `{ env, policyStatements }`
  * binding contract: the Lambda `Function`, the ECS `Task` and `Service`, and
@@ -70,22 +68,22 @@ export const isFunction = (value) => {
  * `host.LogicalId` are ever touched inside the guarded block, so downstream
  * typing is unchanged while the runtime check widens to all three.
  */
-export const isBindingHost = (value) => {
-    return (typeof value === "object" &&
-        value !== null &&
-        "Type" in value &&
-        (value.Type === "AWS.Lambda.Function" ||
-            value.Type === "AWS.ECS.Task" ||
-            value.Type === "AWS.ECS.Service" ||
-            value.Type === "Kubernetes.Deployment" ||
-            value.Type === "Kubernetes.Job"));
-};
+export const isBindingHost = (value) => typeof value === "object" &&
+    value !== null &&
+    "Type" in value &&
+    (value.Type === "AWS.Lambda.Function" ||
+        value.Type === "AWS.ECS.Task" ||
+        value.Type === "AWS.ECS.Service" ||
+        value.Type === "Kubernetes.Deployment" ||
+        value.Type === "Kubernetes.Job");
 /** Resolve a {@link LayerRef} to its layer version ARN. */
 export const layerVersionArnOf = (layer) => typeof layer === "string" ? layer : layer.layerVersionArn;
 /**
  * Resolve an {@link AccessPointRef} (or the legacy raw-`arn` field) on a
  * `fileSystemConfigs` entry to the access point ARN.
  */
+/** Inline policy denying the execution role `logs:CreateLogGroup` on its own group. */
+const logGroupGuardPolicyName = "AlchemyDenyLogGroupCreate";
 const accessPointArnOf = (config) => typeof config.accessPoint === "string"
     ? config.accessPoint
     : typeof config.accessPoint?.accessPointArn ===
@@ -650,8 +648,14 @@ export const Function = Platform(FunctionTypeId, {
                                 // latency anyway — keep request finalizers fast. A failing
                                 // finalizer is logged and ignored so it can't mask the
                                 // invocation's outcome.
+                                //
+                                // The scope is ALSO what a timeout would take with it: Lambda
+                                // kills the invocation mid-flight and the buffered telemetry
+                                // never flushes. `withInvocationDeadline` flushes it
+                                // `timeoutMargin` before that happens — without touching the
+                                // handler or the invocation's outcome.
                                 const scope = Scope.makeUnsafe();
-                                const exit = await eff.pipe(Effect.provide(Layer.mergeAll(Layer.succeed(HandlerContext, context), Layer.succeed(Scope.Scope, scope), 
+                                const exit = await eff.pipe(withInvocationDeadline, Effect.provide(Layer.mergeAll(Layer.succeed(HandlerContext, context), Layer.succeed(Scope.Scope, scope), 
                                 // The configured telemetry exporters, attached to the
                                 // invocation scope by `buildEventTelemetry` so
                                 // buffered spans/logs/metrics flush when it settles
@@ -837,6 +841,50 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
         yield* Effect.logDebug(`attached policy ${id}`);
         return role;
     });
+    /**
+     * Deny the execution role `logs:CreateLogGroup` on the function's own
+     * `/aws/lambda/<name>` group. The managed `AWSLambdaBasicExecutionRole`
+     * allows it on `*`, which lets Lambda create the group with no tags or
+     * retention on first invoke, and lets a log batch flushed after
+     * `deleteFunction` silently re-create a group we just deleted. With the
+     * Deny, Alchemy owns the group (see {@link ensureLogGroup}): Lambda only
+     * writes into it, and `delete` removes it once.
+     */
+    const syncLogGroupGuard = Effect.fn(function* ({ roleName, functionName, }) {
+        const { accountId, region } = yield* AWSEnvironment.current;
+        const document = JSON.stringify({
+            Version: "2012-10-17",
+            Statement: [
+                {
+                    Effect: "Deny",
+                    Action: "logs:CreateLogGroup",
+                    Resource: `arn:aws:logs:${region}:${accountId}:log-group:/aws/lambda/${functionName}:*`,
+                },
+            ],
+        });
+        const observed = yield* iam
+            .getRolePolicy({ RoleName: roleName, PolicyName: logGroupGuardPolicyName })
+            .pipe(Effect.map((policy) => decodeURIComponent(policy.PolicyDocument)), Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+        if (observed !== document) {
+            yield* iam.putRolePolicy({
+                RoleName: roleName,
+                PolicyName: logGroupGuardPolicyName,
+                PolicyDocument: document,
+            });
+        }
+    });
+    /**
+     * Create (or adopt) `/aws/lambda/<name>` before the function can run.
+     * The execution role cannot create it (see {@link syncLogGroupGuard}),
+     * so without this the function's logs would be dropped.
+     */
+    const ensureLogGroup = Effect.fn(function* ({ id, functionName, retention, }) {
+        const logGroupName = `/aws/lambda/${functionName}`;
+        yield* logs
+            .createLogGroup({ logGroupName, tags: yield* createInternalTags(id) })
+            .pipe(Effect.catchTag("ResourceAlreadyExistsException", () => Effect.void));
+        yield* syncLogGroupRetention({ logGroupName, retention });
+    });
     const withNodeSourceMaps = (env, props) => {
         const sourcemap = props.build?.output?.sourcemap ?? true;
         const uploadSourceMap = props.uploadSourceMap ?? true;
@@ -854,6 +902,13 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
             NODE_OPTIONS: current ? `${current} --enable-source-maps` : "--enable-source-maps",
         };
     };
+    // The runtime reads the invocation deadline margin per invocation
+    // (see `withInvocationDeadline`); only written when set so the
+    // runtime default applies otherwise.
+    const timeoutMarginEnv = (margin) => {
+        const ms = toTimeoutMarginMillis(margin);
+        return ms === undefined ? {} : { [TIMEOUT_MARGIN_ENV]: String(ms) };
+    };
     const retryFunctionMutation = Effect.retry({
         while: (e) => e._tag === "ResourceConflictException" || e._tag === "TooManyRequestsException",
         schedule: Schedule.max([Schedule.exponential(100), Schedule.recurs(30)]),
@@ -867,6 +922,9 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
                 return yield* new FunctionUpdateFailed({
                     functionName,
                     reason: configuration.LastUpdateStatusReason ?? configuration.StateReason,
+                    reasonCode: configuration.LastUpdateStatus === "Failed"
+                        ? configuration.LastUpdateStatusReasonCode
+                        : configuration.StateReasonCode,
                 });
             }
             if (configuration?.State === "Active" &&
@@ -979,7 +1037,7 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
             e.message?.includes("InvalidGroup.NotFound");
         const noteCreateDependencyWait = () => session.note(`Waiting for Lambda creation dependencies to propagate: ${functionName} (${Math.ceil((Date.now() - waitStartedAt) / 1000)}s)`);
         const tags = yield* createInternalTags(id);
-        const codeLocation = yield* Effect.gen(function* () {
+        const resolveCodeLocation = Effect.gen(function* () {
             if (code.packageType === "Image") {
                 return { ImageUri: code.imageUri };
             }
@@ -996,6 +1054,7 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
                 S3Key: key,
             };
         });
+        const codeLocation = yield* resolveCodeLocation;
         const runtimeEnv = isFunctionImageProps(news) ? env : withNodeSourceMaps(env, news);
         const createFunctionRequest = {
             FunctionName: functionName,
@@ -1025,14 +1084,13 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
             Layers: isFunctionImageProps(news)
                 ? undefined
                 : (news.layers ?? []).map(layerVersionArnOf),
-            Environment: runtimeEnv
-                ? {
-                    Variables: {
-                        ...runtimeEnv,
-                        ...alchemyEnv,
-                    },
-                }
-                : undefined,
+            Environment: {
+                Variables: {
+                    ...runtimeEnv,
+                    ...alchemyEnv,
+                    ...timeoutMarginEnv(news.timeoutMargin),
+                },
+            },
             Tags: tags,
             Timeout: toTimeoutSeconds(news.timeout),
             // Always explicit so removing the `tracing` prop converges back to
@@ -1049,6 +1107,7 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
                 : undefined,
             FileSystemConfigs: fileSystemConfigs,
         };
+        // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- erases SDK error/requirement unions; the services are ambient in the lifecycle op
         const getAndUpdate = Lambda.getFunction({
             FunctionName: functionName,
         }).pipe(
@@ -1100,9 +1159,8 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
             }));
             yield* Effect.logDebug(`updated function configuration ${id}`);
         })));
-        const create = Lambda.createFunction(createFunctionRequest).pipe(Effect.tapError((e) => Effect.gen(function* () {
-            yield* Effect.logDebug(e);
-        })), Effect.retry({
+        // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- erases SDK error/requirement unions; the services are ambient in the lifecycle op
+        const create = Lambda.createFunction(createFunctionRequest).pipe(Effect.tapError((e) => Effect.logDebug(e)), Effect.retry({
             while: (e) => isRolePropagationError(e) || isSecurityGroupPropagationError(e),
             schedule: Schedule.fixed(1000).pipe(Schedule.tap(() => noteCreateDependencyWait())),
         }), Effect.catchTags({
@@ -1226,7 +1284,16 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
     };
     return {
         stables: ["functionArn", "functionName", "roleName"],
-        diff: Effect.fn(function* ({ id, olds, news, output }) {
+        diff: Effect.fn(function* ({ id, olds, news: desired, output, oldBindings, newBindings }) {
+            // Effect-native runtime exports remain unevaluated during planning.
+            // Their identity is represented by the bundle hash, so they must not
+            // prevent source changes from reaching the hash comparison below.
+            const news = typeof desired === "object" && desired !== null && "exports" in desired
+                ? {
+                    ...desired,
+                    exports: stripEffects(desired.exports),
+                }
+                : desired;
             if (!isResolved(news))
                 return;
             yield* validateFunctionPackageProps(id, news);
@@ -1301,6 +1368,9 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
             if (toTimeoutSeconds(olds.timeout) !== toTimeoutSeconds(news.timeout)) {
                 return { action: "update" };
             }
+            if (toTimeoutMarginMillis(olds.timeoutMargin) !== toTimeoutMarginMillis(news.timeoutMargin)) {
+                return { action: "update" };
+            }
             if (olds.architecture !== news.architecture) {
                 return { action: "update" };
             }
@@ -1317,6 +1387,12 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
                 layers: (props.layers ?? []).map(layerVersionArnOf),
             });
             if (!havePropsChanged(normalizeLayers(olds), normalizeLayers(news))) {
+                // Bindings (env / policies from `bind`) are not props. An explicit
+                // noop would skip the engine's binding comparison, so defer to it
+                // whenever they may have changed.
+                if (!isResolved(newBindings) || !deepEqual(oldBindings, newBindings)) {
+                    return undefined;
+                }
                 return { action: "noop" };
             }
         }),
@@ -1410,6 +1486,8 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
                 roleName,
                 vpc: news.vpc,
             });
+            yield* syncLogGroupGuard({ roleName, functionName });
+            yield* ensureLogGroup({ id, functionName, retention: news.logging?.retention });
             const prepared = yield* preparePrecreatedFunctionCode({
                 id,
                 props: news,
@@ -1459,6 +1537,8 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
                 vpc: news.vpc,
             });
             const roleArn = ensuredRole.Role.Arn ?? output?.roleArn;
+            yield* syncLogGroupGuard({ roleName, functionName });
+            yield* ensureLogGroup({ id, functionName, retention: news.logging?.retention });
             const { env, vpc: bindingVpc, fileSystemConfigs: bindingFileSystemConfigs, } = yield* attachBindings({
                 roleName,
                 policyName,
@@ -1554,8 +1634,23 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
                         ? []
                         : undefined,
                 session,
-            });
-            yield* waitForFunctionUpdate(functionName, session, vpc !== undefined);
+            }).pipe(Effect.andThen(waitForFunctionUpdate(functionName, session, vpc !== undefined)), 
+            // The create/update call can succeed while Lambda's ASYNC
+            // provisioning (VPC ENIs, EFS mounts) still fails with
+            // `InsufficientRolePermissions` — "The function's execution role
+            // doesn't have permission to perform this operation." — because
+            // the just-attached AWSLambdaVPCAccessExecutionRole /
+            // EFS client policy has not propagated yet. That is IAM eventual
+            // consistency, not a misconfiguration: re-apply the function
+            // (the create path falls through to update on conflict, which
+            // re-triggers provisioning) and wait again, bounded.
+            Effect.tapError((e) => e._tag === "FunctionUpdateFailed" && e.reasonCode === "InsufficientRolePermissions"
+                ? session.note(`Waiting for Lambda execution role permissions to propagate: ${functionName}`)
+                : Effect.void), Effect.retry({
+                while: (e) => e._tag === "FunctionUpdateFailed" && e.reasonCode === "InsufficientRolePermissions",
+                schedule: Schedule.spaced("10 seconds"),
+                times: 6,
+            }));
             const previousImage = output?.code.image;
             const nextImage = "image" in prepared.attributes ? prepared.attributes.image : undefined;
             if (previousImage?.ownsRepository === true &&
@@ -1597,7 +1692,11 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
                 .listRolePolicies({
                 RoleName: output.roleName,
             })
-                .pipe(Effect.flatMap((policies) => Effect.all((policies.PolicyNames ?? []).map((policyName) => iam
+                .pipe(Effect.flatMap((policies) => Effect.all(
+            // The log-group guard stays until the function is deleted.
+            (policies.PolicyNames ?? [])
+                .filter((policyName) => policyName !== logGroupGuardPolicyName)
+                .map((policyName) => iam
                 .deleteRolePolicy({
                 RoleName: output.roleName,
                 PolicyName: policyName,
@@ -1622,137 +1721,26 @@ export const FunctionProvider = () => Provider.effect(Function, Effect.gen(funct
                 // destroy converges on the next run.
                 yield* functionImage.deleteRepository(output.code.image.repositoryName);
             }
-            // Release the execution role before the auxiliary CloudWatch Logs
-            // reap below. A recently invoked function can keep that reap alive
-            // for ~40 seconds while Lambda flushes its final log batches; if the
-            // process is interrupted during that window, leaving role deletion
-            // until afterwards strands the deterministic role. IAM can briefly
-            // report the just-detached role as still in use, so retry those
-            // eventual-consistency conflicts on a bounded schedule.
+            // The managed policies were detached before deleteFunction, so the
+            // role no longer allows logs:CreateLogGroup and the guard can go with
+            // it. IAM can briefly report a just-detached role as still in use, so
+            // retry those eventual-consistency conflicts on a bounded schedule.
+            yield* iam
+                .deleteRolePolicy({ RoleName: output.roleName, PolicyName: logGroupGuardPolicyName })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
             yield* iam.deleteRole({ RoleName: output.roleName }).pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void), Effect.retry({
                 while: (error) => error._tag === "DeleteConflictException" ||
                     error._tag === "ConcurrentModificationException",
                 schedule: Schedule.spaced("2 seconds"),
                 times: 10,
             }));
-            // CloudWatch Logs is not implemented by the floci emulator. The
-            // live reap below (flush watch + observe→delete) would sit on
-            // describe/delete timeouts for minutes; emulator log groups die
-            // with the container anyway.
-            if (yield* AWSEnvironment.isLocalEmulator) {
-                return null;
-            }
-            // Lambda auto-creates /aws/lambda/{name} on the first invoke and
-            // deleteFunction does NOT remove it — without this every deleted
-            // function leaks an orphaned log group. Worse, the Lambda service
-            // flushes the final log batch asynchronously (observed up to ~35s
-            // after the last invoke, even after BOTH the function and its role
-            // are already deleted), silently re-creating a just-deleted group.
-            // The only reliable reap is a bounded watch over that flush window.
-            // A provably-quiescent group (last ingestion > 2 minutes ago —
-            // every pending flush has long since landed) deletes in a single
-            // call, so routine deletes of idle functions stay fast; a group
-            // with recent ingestion — or one that does not exist yet, where a
-            // first flush may still be in flight — is re-reaped on a short
-            // bounded schedule.
-            const logGroupName = `/aws/lambda/${output.functionName}`;
-            const reapLogGroup = logs.deleteLogGroup({ logGroupName }).pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.void), 
-            // CloudWatch Logs can sit in its SDK retry path for minutes
-            // under a full parallel sweep. Log-group cleanup is auxiliary
-            // to the already-completed Lambda delete, so bound each reap
-            // attempt while preserving the t=0/20/40 flush watch below.
-            Effect.timeoutOrElse({
-                duration: "5 seconds",
-                orElse: () => Effect.logWarning(`Timed out reaping Lambda log group ${logGroupName}`),
-            }));
-            const lastIngestion = yield* logs
-                .describeLogStreams({
-                logGroupName,
-                orderBy: "LastEventTime",
-                descending: true,
-                limit: 1,
-            })
-                .pipe(Effect.map((r) => r.logStreams?.[0]?.lastIngestionTime), Effect.catchTag("ResourceNotFoundException", () => Effect.succeed(undefined)), Effect.timeoutOrElse({
-                duration: "5 seconds",
-                orElse: () => Effect.gen(function* () {
-                    yield* Effect.logWarning(`Timed out inspecting Lambda log group ${logGroupName}`);
-                    return undefined;
-                }),
-            }));
-            const now = yield* Effect.sync(() => Date.now());
-            const quiescent = lastIngestion !== undefined && now - lastIngestion > 120_000;
-            if (quiescent) {
-                yield* reapLogGroup;
-            }
-            else {
-                // Reaps at t=0s / 20s / 40s — each attempt is idempotent.
-                yield* reapLogGroup.pipe(Effect.repeat({
-                    schedule: Schedule.spaced("20 seconds"),
-                    times: 2,
-                }));
-            }
-            // A timed-out delete attempt above is not deletion proof, and the
-            // Lambda service keeps flushing buffered logs AFTER the function is
-            // deleted (typically ~35s, occasionally much longer), silently
-            // re-creating a just-deleted group. Converge with a bounded
-            // observe→delete loop: any reappearance is simply deleted again
-            // (every delete is idempotent — ResourceNotFoundException means
-            // done). A recreation we deleted counts as gone; a flush landing
-            // after our final check is inherently unobservable and the next
-            // nuke census is the backstop. We only fail loudly if the group is
-            // still observable at budget exhaustion AND a final delete attempt
-            // did not remove it — i.e. the group is genuinely undeletable.
-            const describeLogGroup = logs
-                .describeLogGroups({
-                logGroupNamePrefix: logGroupName,
-                limit: 1,
-            })
-                .pipe(Effect.map((response) => (response.logGroups ?? []).some((group) => group.logGroupName === logGroupName)));
-            // Loop observation: a describe that can't complete in time (API
-            // throttling under a busy account / saturated test run) is NOT
-            // deletion proof — assume the group is still present and let the
-            // bounded loop keep converging instead of dying on a slow read.
-            const observeLogGroup = describeLogGroup.pipe(Effect.timeoutOrElse({
-                duration: "30 seconds",
-                orElse: () => Effect.logWarning(`Timed out observing Lambda log group ${logGroupName} — assuming still present`).pipe(Effect.as(true)),
-            }));
-            // Final authoritative observation: here a timeout must fail loudly,
-            // since we are about to declare the delete converged.
-            const observeLogGroupOrDie = describeLogGroup.pipe(Effect.timeoutOrElse({
-                duration: "30 seconds",
-                orElse: () => Effect.die(new Error(`Timed out confirming Lambda log group deletion: ${logGroupName}`)),
-            }));
-            const deleteLogGroupAgain = logs.deleteLogGroup({ logGroupName }).pipe(Effect.retry({
-                while: (error) => error._tag === "OperationAbortedException" ||
-                    error._tag === "ServiceUnavailableException",
-                schedule: Schedule.max([Schedule.exponential("250 millis"), Schedule.recurs(8)]),
-            }), Effect.catchTag("ResourceNotFoundException", () => Effect.void), Effect.timeoutOrElse({
-                duration: "45 seconds",
-                orElse: () => Effect.die(new Error(`Timed out deleting Lambda log group ${logGroupName}`)),
-            }));
-            const reapIfObserved = Effect.gen(function* () {
-                const present = yield* observeLogGroup;
-                if (present) {
-                    yield* deleteLogGroupAgain;
-                }
-                return present;
-            });
-            // Happy path (no reappearance): a single describe, done. On a
-            // post-delete flush recreation: delete and re-check every 5s for
-            // up to ~90s after the last reappearance-free observation.
-            const observedAtBudgetEnd = yield* reapIfObserved.pipe(Effect.repeat({
-                schedule: Schedule.spaced("5 seconds"),
-                until: (present) => !present,
-                times: 18,
-            }));
-            // Budget exhausted with the group still reappearing: the last loop
-            // iteration already issued a delete. One final authoritative
-            // observation decides — absent means our delete of the latest
-            // recreation stuck (gone); present means the group survives its own
-            // deletion (denied/undeletable) and must fail loudly.
-            if (observedAtBudgetEnd && (yield* observeLogGroupOrDie)) {
-                yield* Effect.die(new Error(`Lambda log group ${logGroupName} remained observable after delete`));
-            }
+            // Alchemy created /aws/lambda/<name> and the role could never
+            // create it (see `syncLogGroupGuard`), so a late log flush after
+            // deleteFunction is dropped instead of re-creating the group: one
+            // delete is enough.
+            yield* logs
+                .deleteLogGroup({ logGroupName: `/aws/lambda/${output.functionName}` })
+                .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.void));
             return null;
         }),
         tail: ({ output }) => {