feat(aws): broad patches from AWS fan-out

[sam-goodwin]

Every SDK gap surfaced by the alchemy AWS resource-factory run (alchemy-run/alchemy#797), fixed at the source. Started as Wave 1A and accreted the full run: protocol/core capabilities (SigV2 auth, Smithy hostPrefix, syntheticErrors, rest-xml member-wrapped lists, eventstream + rest-json fixes, a generator fix for per-op @http derivation on shared input shapes), a hand-written simpledb module, the Presign module, and per-service typed-error/schema patches from every live-test wave — through the final convergence loop (typed Amplify front-door TimeoutException).

The sections below document the original Wave 1A scope:

Schema & error patches (per-service)

• sqs: Successful/Failed optional on SendMessageBatchResult, DeleteMessageBatchResult, ChangeMessageVisibilityBatchResult — the JSON protocol omits empty lists; the required members crashed response decoding inside deployed Lambdas (SchemaError: Missing key ["Failed"])
• cloudwatch: typed describeAlarmContributors wire error (ValidationException with empty message when an alarm has no contributor data)
• rds: typed createDBInstance rejection for cluster-member instances given VpcSecurityGroupIds
• ec2: typed UnauthorizedOperation (EC2's generic authz failure, previously an UnknownAwsError)
• cloudflare/workers: restore RouteScriptNotFound (code 10019) on createRoute — the patch entry was lost in a spec bump and packages/alchemy already handles the tag

Paginator fix (aws + core)

Empty-string terminal tokens (NextToken: "" from SSM/CloudWatch-Logs-style APIs) were treated as live tokens, re-requesting the first page forever. Both aws/src/client/api.ts (isTerminalPageToken) and core/src/pagination.ts (isTerminalToken, token + cursor modes) now stop on any falsy token, matching aws-sdk-js-v3. Unit tests cover empty-string, absent, and object (DynamoDB LastEvaluatedKey) tokens.

ValidationException message

The common AWS ValidationException declared no fields, so real AWS validation messages were invisible. It now carries optional message, reason, fieldList.

New: @distilled.cloud/aws/Presign

SigV4 query-string presigning over the same aws4fetch signer + Credentials/Region services the client uses:

import * as Presign from "@distilled.cloud/aws/Presign";

const url = yield* Presign.presignS3Url({
  method: "PUT",
  bucket, key,
  expiresIn: 300,
  contentType: "text/plain",
});

presignUrl is the generic low-level form (any service/host/path); presignS3Url handles virtual-hosted vs path-style. Deterministic via injectable datetime; 9 pure unit tests plus a live alchemy round-trip (real presigned PUT/GET against S3, content-type mismatch 403, expiry rejection).

Two pre-existing unrelated test failures (core test/server-retry-hint-cap.test.ts, aws test/protocols/rest-xml.test.ts responseAlgorithms) verified present without these changes.

🤖 Generated with Claude Code

[alchemy-version-bot]

Install the packages built from this commit:

@distilled.cloud/core

bun add @distilled.cloud/core@https://pkg.distilled.cloud/core/6ed69ca

@distilled.cloud/aws

bun add @distilled.cloud/aws@https://pkg.distilled.cloud/aws/6ed69ca

@distilled.cloud/axiom

bun add @distilled.cloud/axiom@https://pkg.distilled.cloud/axiom/6ed69ca

@distilled.cloud/azure

bun add @distilled.cloud/azure@https://pkg.distilled.cloud/azure/6ed69ca

@distilled.cloud/cloudflare

bun add @distilled.cloud/cloudflare@https://pkg.distilled.cloud/cloudflare/6ed69ca

@distilled.cloud/coinbase

bun add @distilled.cloud/coinbase@https://pkg.distilled.cloud/coinbase/6ed69ca

@distilled.cloud/expo-eas

bun add @distilled.cloud/expo-eas@https://pkg.distilled.cloud/expo-eas/6ed69ca

@distilled.cloud/fly-io

bun add @distilled.cloud/fly-io@https://pkg.distilled.cloud/fly-io/6ed69ca

@distilled.cloud/gcp

bun add @distilled.cloud/gcp@https://pkg.distilled.cloud/gcp/6ed69ca

@distilled.cloud/kubernetes

bun add @distilled.cloud/kubernetes@https://pkg.distilled.cloud/kubernetes/6ed69ca

@distilled.cloud/mongodb-atlas

bun add @distilled.cloud/mongodb-atlas@https://pkg.distilled.cloud/mongodb-atlas/6ed69ca

@distilled.cloud/neon

bun add @distilled.cloud/neon@https://pkg.distilled.cloud/neon/6ed69ca

@distilled.cloud/planetscale

bun add @distilled.cloud/planetscale@https://pkg.distilled.cloud/planetscale/6ed69ca

@distilled.cloud/posthog

bun add @distilled.cloud/posthog@https://pkg.distilled.cloud/posthog/6ed69ca

@distilled.cloud/prisma-postgres

bun add @distilled.cloud/prisma-postgres@https://pkg.distilled.cloud/prisma-postgres/6ed69ca

@distilled.cloud/stripe

bun add @distilled.cloud/stripe@https://pkg.distilled.cloud/stripe/6ed69ca

@distilled.cloud/supabase

bun add @distilled.cloud/supabase@https://pkg.distilled.cloud/supabase/6ed69ca

@distilled.cloud/turso

bun add @distilled.cloud/turso@https://pkg.distilled.cloud/turso/6ed69ca

@distilled.cloud/typesense

bun add @distilled.cloud/typesense@https://pkg.distilled.cloud/typesense/6ed69ca

@distilled.cloud/workos

bun add @distilled.cloud/workos@https://pkg.distilled.cloud/workos/6ed69ca