alchemy 2.0.0-beta.81 → 2.0.0-beta.83

package/src/AWS/DynamoDB/Table.ts

@@ -211,6 +211,8 @@ export interface Table extends Resource<
     tableName: TableName;
     /** The ARN of the table. */
     tableArn: TableArn;
+    /** The AWS region the table lives in. */
+    region: RegionID;
     /** The partition (hash) key attribute name. */
     partitionKey: string;
     /** The sort (range) key attribute name, if defined. */
@@ -355,6 +357,39 @@ export interface Table extends Resource<
  * };
  * ```
  *
+ * **Example:** Read and write items from a Cloudflare Worker
+ *
+ * The `*Http` layers also run on a Cloudflare Worker. Alchemy creates an
+ * IAM user, access key, and least-privilege role for the Worker, binds the
+ * key onto it, and signs each request with the assumed role in the table's
+ * region. The Stack needs both provider sets:
+ * `Layer.mergeAll(Cloudflare.providers(), AWS.providers())`.
+ * ```typescript
+ * export default class Api extends Cloudflare.Worker<Api>()(
+ *   "Api",
+ *   { main: import.meta.url },
+ *   Effect.gen(function* () {
+ *     const table = yield* AWS.DynamoDB.Table("Links", {
+ *       partitionKey: "id",
+ *       attributes: { id: "S" },
+ *     });
+ *     const getItem = yield* AWS.DynamoDB.GetItem(table);
+ *     const putItem = yield* AWS.DynamoDB.PutItem(table);
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         yield* putItem({ Item: { id: { S: "a" }, url: { S: "https://alchemy.run" } } });
+ *         const { Item } = yield* getItem({ Key: { id: { S: "a" } } });
+ *         return yield* HttpServerResponse.json(Item);
+ *       }).pipe(Effect.orDie),
+ *     };
+ *   }).pipe(
+ *     Effect.provide(
+ *       Layer.mergeAll(AWS.DynamoDB.GetItemHttp, AWS.DynamoDB.PutItemHttp),
+ *     ),
+ *   ),
+ * ) {}
+ * ```
+ *
  * ### Table Features
  * **Example:** Resource Policy
  * ```typescript
@@ -573,16 +608,14 @@ export const TableProvider = () =>
 
           const [first, ...rest] = requested;
           if (!first?.StreamViewType) {
-            return yield* Effect.fail(new MissingStreamViewType());
+            return yield* new MissingStreamViewType();
           }
 
           for (const spec of rest) {
             if (spec.StreamViewType !== first.StreamViewType) {
-              return yield* Effect.fail(
-                new ConflictingStreamViewTypes({
-                  requested: requested.map((item) => item.StreamViewType),
-                }),
-              );
+              return yield* new ConflictingStreamViewTypes({
+                requested: requested.map((item) => item.StreamViewType),
+              });
             }
           }
 
@@ -736,7 +769,7 @@ export const TableProvider = () =>
           });
           const destinations = response.KinesisDataStreamDestinations ?? [];
           if (destinations.some(isKinesisDestinationTransitioning)) {
-            return yield* Effect.fail(new KinesisDestinationNotSettled());
+            return yield* new KinesisDestinationNotSettled();
           }
           return destinations;
         }).pipe(
@@ -827,7 +860,7 @@ export const TableProvider = () =>
           });
           const status = response.ContributorInsightsStatus ?? "DISABLED";
           if (status === "ENABLING" || status === "DISABLING") {
-            return yield* Effect.fail(new ContributorInsightsNotSettled());
+            return yield* new ContributorInsightsNotSettled();
           }
           return status;
         }).pipe(
@@ -881,7 +914,7 @@ export const TableProvider = () =>
         Effect.gen(function* () {
           const remaining = yield* listContributorInsightsRules(tableName);
           if (remaining.length > 0) {
-            return yield* Effect.fail(new ContributorInsightsNotSettled());
+            return yield* new ContributorInsightsNotSettled();
           }
         }).pipe(
           Effect.retry({
@@ -934,7 +967,7 @@ export const TableProvider = () =>
           });
           if (response.Table?.TableStatus !== "ACTIVE") {
             progressMessage = `DynamoDB Table provider: table ${tableName} not active yet (status=${response.Table?.TableStatus ?? "undefined"} gsiStatuses=${formatGlobalSecondaryIndexStatuses(response.Table?.GlobalSecondaryIndexes)})`;
-            return yield* Effect.fail(new TableNotActive());
+            return yield* new TableNotActive();
           }
           yield* session.note(
             `DynamoDB Table provider: table ${tableName} is ACTIVE (${formatPollingElapsed(elapsedSeconds)})`,
@@ -979,7 +1012,7 @@ export const TableProvider = () =>
 
           if (JSON.stringify(actualIndexNames) !== JSON.stringify(expected) || !allActive) {
             progressMessage = `DynamoDB Table provider: GSIs for ${tableName} not stable yet (expected=${JSON.stringify(expected)} actual=${JSON.stringify(actualIndexNames)} statuses=${JSON.stringify((table?.GlobalSecondaryIndexes ?? []).map((index) => ({ name: index.IndexName, status: index.IndexStatus })))} tableStatus=${table?.TableStatus ?? "undefined"})`;
-            return yield* Effect.fail(new TableIndexesNotStable());
+            return yield* new TableIndexesNotStable();
           }
 
           yield* session.note(
@@ -1014,13 +1047,13 @@ export const TableProvider = () =>
             TableName: tableName,
           });
           progressMessage = `DynamoDB Table provider: table ${tableName} still deleting (status=${response.Table?.TableStatus ?? "undefined"})`;
-          return yield* Effect.fail(new TableStillDeleting());
+          return yield* new TableStillDeleting();
         }).pipe(
-          Effect.catchTag("ResourceNotFoundException", () => {
-            return session.note(
+          Effect.catchTag("ResourceNotFoundException", () =>
+            session.note(
               `DynamoDB Table provider: table ${tableName} deletion confirmed (${formatPollingElapsed(elapsedSeconds)})`,
-            );
-          }),
+            ),
+          ),
           Effect.retry({
             while: (error) =>
               error._tag === "TableStillDeleting" || isRetryableControlPlaneError(error),
@@ -1222,6 +1255,7 @@ export const TableProvider = () =>
         tableId: state.table.TableId!,
         tableName: state.table.TableName!,
         tableArn: state.table.TableArn! as TableArn,
+        region: state.table.TableArn!.split(":")[3] as RegionID,
         partitionKey:
           state.table.KeySchema?.find((key) => key.KeyType === "HASH")?.AttributeName ?? "",
         sortKey: state.table.KeySchema?.find((key) => key.KeyType === "RANGE")?.AttributeName,
@@ -1395,7 +1429,7 @@ export const TableProvider = () =>
       };
 
       return Table.Provider.of({
-        stables: ["tableName", "tableId", "tableArn"],
+        stables: ["tableName", "tableId", "tableArn", "region"],
         // Enumerate every table in the ambient account/region. `listTables`
         // returns only names, so each is hydrated to the full Attributes shape
         // via the same multi-API read helper (`readTableState`) `read` uses.
@@ -1823,14 +1857,12 @@ export const TableProvider = () =>
               (destination) => destination.StreamArn === desiredKinesisDestination.streamArn,
             );
             if (settledDestination?.DestinationStatus !== "ACTIVE") {
-              return yield* Effect.fail(
-                new KinesisStreamingDestinationFailed({
-                  tableName,
-                  streamArn: desiredKinesisDestination.streamArn,
-                  status: settledDestination?.DestinationStatus,
-                  description: settledDestination?.DestinationStatusDescription,
-                }),
-              );
+              return yield* new KinesisStreamingDestinationFailed({
+                tableName,
+                streamArn: desiredKinesisDestination.streamArn,
+                status: settledDestination?.DestinationStatus,
+                description: settledDestination?.DestinationStatusDescription,
+              });
             }
           }
 
@@ -1940,12 +1972,10 @@ export const TableProvider = () =>
               .pipe(
                 Effect.timeout(1000),
                 Effect.as("accepted" as const),
-                Effect.catchTag("ResourceNotFoundException", () =>
-                  Effect.succeed("already-deleted" as const),
-                ),
-                Effect.catchTag("ResourceInUseException", () =>
-                  Effect.succeed("delete-gsis-first" as const),
-                ),
+                Effect.catchTags({
+                  ResourceNotFoundException: () => Effect.succeed("already-deleted" as const),
+                  ResourceInUseException: () => Effect.succeed("delete-gsis-first" as const),
+                }),
                 Effect.retry({
                   while: (error) =>
                     error._tag === "InternalServerError" || error._tag === "TimeoutError",

package/src/AWS/DynamoDB/TableSinkHttp.ts

@@ -1,10 +1,9 @@
 import type * as DynamoDB from "@distilled.cloud/aws/dynamodb";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as Binding from "../../Binding.ts";
 import { makeBatchedSink } from "../internal/BatchedSink.ts";
-import { isBindingHost } from "../Lambda/Function.ts";
 import { BatchWriteItem } from "./BatchWriteItem.ts";
+import { grantTables } from "./BindingHttp.ts";
 import type { Table } from "./Table.ts";
 import { TableSink, type TableSinkEntry } from "./TableSink.ts";
 
@@ -51,20 +50,14 @@ export const TableSinkHttp = Layer.effect(
     const batchWriteItem = yield* BatchWriteItem;
 
     return Effect.fn(function* (table: Table) {
-      if (!globalThis.__ALCHEMY_RUNTIME__) {
-        const host = yield* Binding.Host;
-        if (isBindingHost(host)) {
-          yield* host.bind`Allow(${host}, AWS.DynamoDB.TableSink(${table}))`({
-            policyStatements: [
-              {
-                Effect: "Allow",
-                Action: ["dynamodb:BatchWriteItem"],
-                Resource: [table.tableArn],
-              },
-            ],
-          });
-        }
-      }
+      // Requests are signed by the provided `BatchWriteItem` implementation.
+      yield* grantTables(`AWS.DynamoDB.TableSink(${table.LogicalId})`, () => [
+        {
+          Effect: "Allow",
+          Action: ["dynamodb:BatchWriteItem"],
+          Resource: [table.tableArn],
+        },
+      ]);
       const write = yield* batchWriteItem(table);
       return makeBatchedSink<
         TableSinkEntry,

package/src/AWS/DynamoDB/TransactGetItemsHttp.ts

@@ -1,8 +1,7 @@
 import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as Binding from "../../Binding.ts";
-import { isBindingHost } from "../Lambda/Function.ts";
+import { grantTables, signed, tablesRegion } from "./BindingHttp.ts";
 import {
   TransactGetItems,
   type TransactGetItemsRequest,
@@ -12,8 +11,6 @@ import {
 export const TransactGetItemsHttp = Layer.effect(
   TransactGetItems,
   Effect.gen(function* () {
-    const transactGetItems = yield* DynamoDB.transactGetItems;
-
     return Effect.fn(function* (...tables: TransactGetItemsTables) {
       const sortedTables = sortTables(tables);
       const tableNames = new Map(
@@ -34,20 +31,17 @@ export const TransactGetItemsHttp = Layer.effect(
         return yield* TableName;
       });
 
-      if (!globalThis.__ALCHEMY_RUNTIME__) {
-        const host = yield* Binding.Host;
-        if (isBindingHost(host)) {
-          yield* host.bind`Allow(${host}, AWS.DynamoDB.TransactGetItems(${sortedTables}))`({
-            policyStatements: [
-              {
-                Effect: "Allow",
-                Action: ["dynamodb:GetItem"],
-                Resource: sortedTables.map((table) => table.tableArn),
-              },
-            ],
-          });
-        }
-      }
+      const access = yield* grantTables(
+        `AWS.DynamoDB.TransactGetItems(${sortedTables.map((table) => table.LogicalId).join(", ")})`,
+        () => [
+          {
+            Effect: "Allow",
+            Action: ["dynamodb:GetItem"],
+            Resource: sortedTables.map((table) => table.tableArn),
+          },
+        ],
+      );
+      const region = yield* tablesRegion(access, sortedTables);
 
       return Effect.fn(`AWS.DynamoDB.TransactGetItems(${sortedTables})`)(function* (
         request: TransactGetItemsRequest,
@@ -63,10 +57,14 @@ export const TransactGetItemsHttp = Layer.effect(
           }),
         );
 
-        return yield* transactGetItems({
-          ...request,
-          TransactItems: transactItems,
-        });
+        return yield* signed(
+          access,
+          region,
+          DynamoDB.transactGetItems({
+            ...request,
+            TransactItems: transactItems,
+          }),
+        );
       });
     });
   }),

package/src/AWS/DynamoDB/TransactWriteItemsHttp.ts

@@ -1,8 +1,7 @@
 import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as Binding from "../../Binding.ts";
-import { isBindingHost } from "../Lambda/Function.ts";
+import { grantTables, signed, tablesRegion } from "./BindingHttp.ts";
 import {
   TransactWriteItems,
   type TransactWriteItemsRequest,
@@ -12,8 +11,6 @@ import {
 export const TransactWriteItemsHttp = Layer.effect(
   TransactWriteItems,
   Effect.gen(function* () {
-    const transactWriteItems = yield* DynamoDB.transactWriteItems;
-
     return Effect.fn(function* (...tables: TransactWriteItemsTables) {
       const sortedTables = sortTables(tables);
       const tableNames = new Map(
@@ -34,25 +31,22 @@ export const TransactWriteItemsHttp = Layer.effect(
         return yield* TableName;
       });
 
-      if (!globalThis.__ALCHEMY_RUNTIME__) {
-        const host = yield* Binding.Host;
-        if (isBindingHost(host)) {
-          yield* host.bind`Allow(${host}, AWS.DynamoDB.TransactWriteItems(${sortedTables}))`({
-            policyStatements: [
-              {
-                Effect: "Allow",
-                Action: [
-                  "dynamodb:ConditionCheckItem",
-                  "dynamodb:DeleteItem",
-                  "dynamodb:PutItem",
-                  "dynamodb:UpdateItem",
-                ],
-                Resource: sortedTables.map((table) => table.tableArn),
-              },
+      const access = yield* grantTables(
+        `AWS.DynamoDB.TransactWriteItems(${sortedTables.map((table) => table.LogicalId).join(", ")})`,
+        () => [
+          {
+            Effect: "Allow",
+            Action: [
+              "dynamodb:ConditionCheckItem",
+              "dynamodb:DeleteItem",
+              "dynamodb:PutItem",
+              "dynamodb:UpdateItem",
             ],
-          });
-        }
-      }
+            Resource: sortedTables.map((table) => table.tableArn),
+          },
+        ],
+      );
+      const region = yield* tablesRegion(access, sortedTables);
 
       return Effect.fn(`AWS.DynamoDB.TransactWriteItems(${sortedTables})`)(function* (
         request: TransactWriteItemsRequest,
@@ -97,10 +91,14 @@ export const TransactWriteItemsHttp = Layer.effect(
           }),
         );
 
-        return yield* transactWriteItems({
-          ...request,
-          TransactItems: transactItems,
-        });
+        return yield* signed(
+          access,
+          region,
+          DynamoDB.transactWriteItems({
+            ...request,
+            TransactItems: transactItems,
+          }),
+        );
       });
     });
   }),

package/src/AWS/EC2/ClientVpnEndpoint.ts

@@ -1,6 +1,7 @@
 import * as EC2 from "@distilled.cloud/aws/ec2";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import { Unowned } from "../../AdoptPolicy.ts";
 import { deepEqual, isResolved } from "../../Diff.ts";
@@ -507,7 +508,22 @@ export const ClientVpnEndpointProvider = () =>
                   Tags: createTagsList(tags),
                 },
               ],
-            });
+            }).pipe(
+              // A just-created VPC can take a moment to become visible to Client
+              // VPN; a VPC that is really gone fails within a minute. EC2 also
+              // creates one endpoint per account at a time. The ClientToken
+              // keeps the retried create idempotent.
+              Effect.retry({
+                while: (error) => error._tag === "InvalidVpcID.NotFound",
+                schedule: Schedule.spaced("5 seconds"),
+                times: 12,
+              }),
+              (effect) =>
+                retryClientVpn(
+                  effect,
+                  (error) => error._tag === "ClientVpnEndpointCreationInProgress",
+                ),
+            );
             const endpointId = created.ClientVpnEndpointId!;
             endpoint = yield* describe(endpointId).pipe(
               Effect.flatMap((value) =>
@@ -583,9 +599,7 @@ export const ClientVpnEndpointProvider = () =>
           if (upsert.length) yield* EC2.createTags({ Resources: [endpointId], Tags: upsert });
           const final = yield* describe(endpointId);
           if (!final)
-            return yield* Effect.fail(
-              new ClientVpnEndpointNotReady({ endpointId, status: "missing" }),
-            );
+            return yield* new ClientVpnEndpointNotReady({ endpointId, status: "missing" });
           return yield* toAttrs(final);
         }),
         delete: Effect.fn(function* ({ output }) {
@@ -593,6 +607,39 @@ export const ClientVpnEndpointProvider = () =>
           const endpoint = yield* describe(endpointId);
           if (!endpoint) return;
           if (endpoint.Status?.Code !== "deleting") {
+            // AWS refuses to delete an endpoint with live target networks. They
+            // can't outlive the endpoint, so release any the stack lost track of.
+            const associations = yield* EC2.describeClientVpnTargetNetworks
+              .items({ ClientVpnEndpointId: endpointId })
+              .pipe(
+                Stream.filter(
+                  (network) =>
+                    network.Status?.Code !== "disassociating" &&
+                    network.Status?.Code !== "disassociated",
+                ),
+                Stream.runCollect,
+                Effect.catchTag("InvalidClientVpnEndpointId.NotFound", () =>
+                  Effect.succeed([] as EC2.TargetNetwork[]),
+                ),
+              );
+            yield* Effect.forEach(
+              associations,
+              (network) =>
+                EC2.disassociateClientVpnTargetNetwork({
+                  ClientVpnEndpointId: endpointId,
+                  AssociationId: network.AssociationId!,
+                }).pipe(
+                  Effect.catchTag(
+                    [
+                      "InvalidClientVpnEndpointId.NotFound",
+                      "InvalidClientVpnAssociationIdNotFound",
+                    ],
+                    () => Effect.void,
+                  ),
+                  (effect) => retryClientVpn(effect, (error) => error._tag === "IncorrectState"),
+                ),
+              { concurrency: "unbounded", discard: true },
+            );
             yield* EC2.deleteClientVpnEndpoint({
               ClientVpnEndpointId: endpointId,
             }).pipe(Effect.catchTag("InvalidClientVpnEndpointId.NotFound", () => Effect.void));

package/src/AWS/EC2/DhcpOptions.ts

@@ -177,8 +177,10 @@ export const DhcpOptionsProvider = () =>
       const describeDhcpOptions = (dhcpOptionsId: string) =>
         ec2.describeDhcpOptions({ DhcpOptionsIds: [dhcpOptionsId] }).pipe(
           Effect.map((r) => r.DhcpOptions?.[0]),
-          Effect.catchTag("InvalidDhcpOptionID.NotFound", () => Effect.succeed(undefined)),
-          Effect.catchTag("InvalidDhcpOptionsID.NotFound", () => Effect.succeed(undefined)),
+          Effect.catchTags({
+            "InvalidDhcpOptionID.NotFound": () => Effect.succeed(undefined),
+            "InvalidDhcpOptionsID.NotFound": () => Effect.succeed(undefined),
+          }),
         );
 
       const waitUntilDhcpOptionsGone = (dhcpOptionsId: string) =>
@@ -369,8 +371,10 @@ export const DhcpOptionsProvider = () =>
 
           yield* session.note(`Deleting DHCP options set: ${dhcpOptionsId}`);
           yield* ec2.deleteDhcpOptions({ DhcpOptionsId: dhcpOptionsId }).pipe(
-            Effect.catchTag("InvalidDhcpOptionID.NotFound", () => Effect.void),
-            Effect.catchTag("InvalidDhcpOptionsID.NotFound", () => Effect.void),
+            Effect.catchTags({
+              "InvalidDhcpOptionID.NotFound": () => Effect.void,
+              "InvalidDhcpOptionsID.NotFound": () => Effect.void,
+            }),
             // A VPC association may still be clearing.
             Effect.retry({
               while: (e: { _tag: string }) => e._tag === "DependencyViolation",

package/src/AWS/EC2/EIP.ts

@@ -338,20 +338,19 @@ export const EIPProvider = () =>
               DryRun: false,
             })
             .pipe(
-              Effect.catchTag("InvalidAllocationID.NotFound", () => Effect.void),
-              Effect.catchTag("AuthFailure", () => Effect.void),
+              Effect.catchTags({
+                "InvalidAllocationID.NotFound": () => Effect.void,
+                AuthFailure: () => Effect.void,
+              }),
               Effect.tapError(Effect.logDebug),
               // Retry when EIP is still in use (e.g., NAT Gateway being deleted)
               Effect.retry({
-                while: (e) => {
-                  return (
-                    // TODO(sam): not sure if the API will actually throw this
-                    // e._tag === "DependencyViolation" ||
-                    // this throws if the address hasn't been disassociated from all resources
-                    // we will retry it assuming that another resource provider is dissassociating it (e.g. a NAT Gateway resource is being deleted)
-                    e._tag === "InvalidIPAddress.InUse"
-                  );
-                },
+                while: (e) =>
+                  // TODO(sam): not sure if the API will actually throw this
+                  // e._tag === "DependencyViolation" ||
+                  // this throws if the address hasn't been disassociated from all resources
+                  // we will retry it assuming that another resource provider is dissassociating it (e.g. a NAT Gateway resource is being deleted)
+                  e._tag === "InvalidIPAddress.InUse",
                 schedule: Schedule.max([Schedule.exponential(1000, 1.5), Schedule.recurs(20)]).pipe(
                   Schedule.tap(({ attempt }) =>
                     session.note(`EIP still in use, waiting for release... (attempt ${attempt})`),

package/src/AWS/EC2/EgressOnlyInternetGateway.ts

@@ -331,8 +331,10 @@ export const EgressOnlyInternetGatewayProvider = () =>
                   ? Effect.fail(new EigwDeleteFailed({ eigwId }))
                   : Effect.void,
               ),
-              Effect.catchTag("InvalidGatewayID.NotFound", () => Effect.void),
-              Effect.catchTag("InvalidEgressOnlyInternetGatewayId.NotFound", () => Effect.void),
+              Effect.catchTags({
+                "InvalidGatewayID.NotFound": () => Effect.void,
+                "InvalidEgressOnlyInternetGatewayId.NotFound": () => Effect.void,
+              }),
               // Retry on dependency violations (e.g., routes still using the EIGW)
               Effect.retry({
                 while: (e) => e._tag === "DependencyViolation" || e._tag === "EigwDeleteFailed",