feat: fully functioning ALB

packages/api/src/adapter-aws/AwsComputeAdapter.test.ts

@@ -18,6 +18,7 @@ const baseInstance: Ec2Instance = {
     architecture: 'x86_64',
     platform: undefined,
     securityGroups: [{id: 'sg-abc', name: 'default'}],
+    networkInterfaces: [],
     tags: [{key: 'Name', value: 'web-server-1'}],
 }
 
@@ -25,14 +26,12 @@ function fakeService(overrides: Partial<{
     listInstances: () => Promise<Ec2Instance[]>
     describeInstance: (id: string) => Promise<Ec2Instance>
     terminateInstance: (id: string) => Promise<void>
-    listAmis: () => Promise<[]>
     runInstance: (input: RunInstanceInput) => Promise<Ec2Instance>
 }> = {}) {
     return {
         listInstances: async () => [baseInstance],
         describeInstance: async (_id: string) => baseInstance,
         terminateInstance: async (_id: string) => {},
-        listAmis: async () => [] as [],
         runInstance: async (_input: RunInstanceInput) => baseInstance,
         ...overrides,
     }
@@ -80,6 +79,20 @@ describe('AwsComputeAdapter', () => {
         expect(result).toHaveLength(2)
     })
 
+    test('list filters instances by their EC2 lifecycle state', async () => {
+        const adapter = new AwsComputeAdapter(fakeService({
+            listInstances: async () => [
+                baseInstance,
+                {...baseInstance, instanceId: 'i-stopped', state: 'stopped'},
+            ],
+        }))
+
+        const result = await adapter.list({state: 'stopped'})
+
+        expect(result).toHaveLength(1)
+        expect(result[0]).toMatchObject({id: 'i-stopped', status: 'stopped', type: 'instance'})
+    })
+
     test('get returns null when instance has 404 http status', async () => {
         const err = Object.assign(new Error('Not found'), {$metadata: {httpStatusCode: 404}})
         const adapter = new AwsComputeAdapter(fakeService({

packages/api/src/adapter-aws/AwsComputeAdapter.ts

@@ -7,13 +7,12 @@ import type {
     ResourceQuery,
     ServiceSchema,
 } from '../cloud-spi/types'
-import {ec2Service, type Ec2Image, type Ec2Instance, type RunInstanceInput} from '../services/ec2'
+import {ec2Service, type Ec2Instance, type RunInstanceInput} from '../services/ec2'
 
 type Ec2ServiceShape = {
     listInstances(): Promise<Ec2Instance[]>
     describeInstance(instanceId: string): Promise<Ec2Instance>
     terminateInstance(instanceId: string): Promise<void>
-    listAmis(): Promise<Ec2Image[]>
     runInstance(input: RunInstanceInput): Promise<Ec2Instance>
 }
 
@@ -28,15 +27,10 @@ export class AwsComputeAdapter implements CloudServiceAdapter {
     }
 
     async list(query: ResourceQuery = {}): Promise<CloudResource[]> {
-        const [instances, images] = await Promise.all([
-            this.service_.listInstances(),
-            this.service_.listAmis(),
-        ])
-        const resources = [
-            ...instances.map(instanceToResource),
-            ...images.map(imageToResource),
-        ]
-        return filterBySearch(resources, query.search)
+        const resources = (await this.service_.listInstances()).map(instanceToResource)
+        return filterBySearch(resources, query.search).filter((resource) =>
+            !query.state || resource.status?.toLowerCase() === query.state.toLowerCase(),
+        )
     }
 
     async get(id: string): Promise<CloudResource | null> {
@@ -105,27 +99,6 @@ function instanceToResource(instance: Ec2Instance): CloudResource {
     }
 }
 
-function imageToResource(image: Ec2Image): CloudResource {
-    return {
-        id: image.imageId,
-        name: image.name,
-        cloud: 'aws',
-        service: 'compute',
-        type: 'image',
-        region: null,
-        createdAt: image.createdAt ?? null,
-        status: image.state ?? null,
-        metadata: {
-            architecture: image.architecture,
-            rootDeviceType: image.rootDeviceType,
-            virtualizationType: image.virtualizationType,
-            ownerId: image.ownerId,
-            public: image.public,
-            tags: image.tags,
-        },
-    }
-}
-
 function filterBySearch(resources: CloudResource[], search?: string): CloudResource[] {
     const normalized = search?.trim().toLowerCase()
     if (!normalized) return resources

packages/api/src/adapter-aws/AwsEcrAdapter.test.ts

@@ -0,0 +1,130 @@
+import {describe, expect, test} from 'bun:test'
+import {
+    BatchDeleteImageCommand,
+    CreateRepositoryCommand,
+    DeleteRepositoryCommand,
+    DescribeImagesCommand,
+    DescribeRepositoriesCommand,
+    type ECRClient,
+} from '@aws-sdk/client-ecr'
+import {AwsEcrAdapter} from './AwsEcrAdapter'
+
+type Command = BatchDeleteImageCommand | CreateRepositoryCommand | DeleteRepositoryCommand | DescribeImagesCommand | DescribeRepositoriesCommand
+
+function fakeClient(send: (command: Command) => Promise<unknown>): ECRClient {
+    return {send} as unknown as ECRClient
+}
+
+describe('AwsEcrAdapter', () => {
+    test('lists and filters repositories across pages', async () => {
+        const client = fakeClient(async (command) => {
+            expect(command).toBeInstanceOf(DescribeRepositoriesCommand)
+            const input = (command as DescribeRepositoriesCommand).input
+            return input.nextToken
+                ? {repositories: [{repositoryName: 'platform/api'}]}
+                : {
+                    repositories: [{
+                        repositoryName: 'platform/web',
+                        repositoryArn: 'arn:aws:ecr:eu-west-2:000000000000:repository/platform/web',
+                        repositoryUri: '000000000000.dkr.ecr.eu-west-2.amazonaws.com/platform/web',
+                        createdAt: new Date('2026-09-25T10:00:00.000Z'),
+                        imageTagMutability: 'MUTABLE',
+                    }],
+                    nextToken: 'page-2',
+                }
+        })
+
+        const repositories = await new AwsEcrAdapter(client).list({search: 'api'})
+
+        expect(repositories).toEqual([expect.objectContaining({
+            id: 'platform/api', service: 'ecr', type: 'repository', region: null,
+        })])
+    })
+
+    test('gets a repository and returns null when it is absent', async () => {
+        const adapter = new AwsEcrAdapter(fakeClient(async (command) => {
+            expect(command).toBeInstanceOf(DescribeRepositoriesCommand)
+            if ((command as DescribeRepositoriesCommand).input.repositoryNames?.[0] === 'missing') {
+                throw Object.assign(new Error('missing'), {name: 'RepositoryNotFoundException'})
+            }
+            return {repositories: [{repositoryName: 'orders'}]}
+        }))
+
+        await expect(adapter.get('orders')).resolves.toMatchObject({id: 'orders'})
+        await expect(adapter.get('missing')).resolves.toBeNull()
+    })
+
+    test('creates and deletes repositories with ECR commands', async () => {
+        let create: CreateRepositoryCommand | undefined
+        let deleteCommand: DeleteRepositoryCommand | undefined
+        const adapter = new AwsEcrAdapter(fakeClient(async (command) => {
+            if (command instanceof CreateRepositoryCommand) {
+                create = command
+                return {repository: {repositoryName: 'platform/api'}}
+            }
+            if (command instanceof DeleteRepositoryCommand) {
+                deleteCommand = command
+                return {}
+            }
+            throw new Error('Unexpected command')
+        }))
+
+        await expect(adapter.create({values: {repositoryName: 'platform/api'}})).resolves.toMatchObject({id: 'platform/api'})
+        await adapter.delete('platform/api')
+
+        expect(create?.input).toEqual({repositoryName: 'platform/api'})
+        expect(deleteCommand?.input).toEqual({repositoryName: 'platform/api', force: false})
+    })
+
+    test('rejects invalid repository names before calling ECR', async () => {
+        let called = false
+        const adapter = new AwsEcrAdapter(fakeClient(async () => {
+            called = true
+            return {}
+        }))
+
+        await expect(adapter.create({values: {repositoryName: 'Uppercase'}})).rejects.toThrow('Use a valid ECR repository name')
+        expect(called).toBe(false)
+    })
+
+    test('lists image details and deletes an image by digest', async () => {
+        let deleteCommand: BatchDeleteImageCommand | undefined
+        const adapter = new AwsEcrAdapter(fakeClient(async (command) => {
+            if (command instanceof DescribeImagesCommand) {
+                expect(command.input).toEqual({repositoryName: 'platform/api', nextToken: 'cursor', maxResults: 50})
+                return {
+                    imageDetails: [{
+                        imageDigest: 'sha256:abc123',
+                        imageTags: ['latest', 'v1'],
+                        imageSizeInBytes: 1024,
+                        imagePushedAt: new Date('2026-09-25T10:00:00.000Z'),
+                    }],
+                    nextToken: 'next',
+                }
+            }
+            if (command instanceof BatchDeleteImageCommand) {
+                deleteCommand = command
+                return {}
+            }
+            throw new Error('Unexpected command')
+        }))
+
+        const images = await adapter.items.listItems('platform/api', {cursor: 'cursor', limit: 50})
+        await adapter.items.deleteItem?.('platform/api', 'sha256:abc123')
+
+        expect(images).toEqual({
+            items: [expect.objectContaining({
+                id: 'sha256:abc123', timestamp: '2026-09-25T10:00:00.000Z',
+                body: expect.objectContaining({imageTags: ['latest', 'v1'], imageSizeInBytes: 1024}),
+            })],
+            nextCursor: 'next',
+        })
+        expect(deleteCommand?.input).toEqual({repositoryName: 'platform/api', imageIds: [{imageDigest: 'sha256:abc123'}]})
+    })
+
+    test('surfaces ECR batch deletion failures', async () => {
+        const adapter = new AwsEcrAdapter(fakeClient(async () => ({failures: [{failureReason: 'ImageNotFound'}]})))
+
+        await expect(adapter.items.deleteItem?.('platform/api', 'sha256:missing')).rejects.toThrow('ImageNotFound')
+    })
+})

packages/api/src/adapter-aws/AwsEcrAdapter.ts

@@ -0,0 +1,155 @@
+import {
+    BatchDeleteImageCommand,
+    CreateRepositoryCommand,
+    DeleteRepositoryCommand,
+    DescribeImagesCommand,
+    DescribeRepositoriesCommand,
+    type ECRClient,
+    type ImageDetail,
+    type Repository,
+} from '@aws-sdk/client-ecr'
+import type {ChildItem, CollectionPage, ItemStoreAdapter, PageQuery} from '../cloud-spi/childCollections'
+import {RuntimeError, ValidationError} from '../cloud-spi/errors'
+import {ecr as defaultEcr} from '../aws'
+import {awsEcrSchema} from '../cloud-spi/ecrSchema'
+import type {CloudResource, CloudServiceAdapter, CreateResourceInput, ResourceQuery, ServiceSchema} from '../cloud-spi/types'
+
+const ECR_REPOSITORY_NAME = /^(?:[a-z0-9]+(?:[._-][a-z0-9]+)*\/)*[a-z0-9]+(?:[._-][a-z0-9]+)*$/
+
+export class AwsEcrAdapter implements CloudServiceAdapter {
+    readonly cloud = 'aws' as const
+    readonly service = 'ecr' as const
+    readonly items: ItemStoreAdapter
+
+    constructor(private readonly ecr: ECRClient = defaultEcr) {
+        this.items = new EcrImageStore(ecr)
+    }
+
+    schema(): ServiceSchema {
+        return awsEcrSchema()
+    }
+
+    async list(query: ResourceQuery = {}): Promise<CloudResource[]> {
+        const repositories: Repository[] = []
+        let nextToken: string | undefined
+        do {
+            const response = await this.ecr.send(new DescribeRepositoriesCommand({nextToken}))
+            repositories.push(...(response.repositories ?? []))
+            nextToken = response.nextToken
+        } while (nextToken)
+
+        const search = query.search?.trim().toLowerCase()
+        return repositories
+            .filter((repository) => !search || repository.repositoryName?.toLowerCase().includes(search))
+            .map(toResource)
+    }
+
+    async get(id: string): Promise<CloudResource | null> {
+        try {
+            const response = await this.ecr.send(new DescribeRepositoriesCommand({repositoryNames: [id]}))
+            const repository = response.repositories?.[0]
+            return repository ? toResource(repository) : null
+        } catch (error) {
+            if (isRepositoryNotFound(error)) return null
+            throw error
+        }
+    }
+
+    async create(input: CreateResourceInput): Promise<CloudResource> {
+        const repositoryName = stringValue(input.values.repositoryName)
+        if (!repositoryName) throw new ValidationError('repositoryName is required')
+        if (repositoryName.length < 2 || repositoryName.length > 256 || !ECR_REPOSITORY_NAME.test(repositoryName)) {
+            throw new ValidationError('Use a valid ECR repository name.')
+        }
+
+        const response = await this.ecr.send(new CreateRepositoryCommand({repositoryName}))
+        return toResource(response.repository ?? {repositoryName})
+    }
+
+    async delete(id: string): Promise<void> {
+        await this.ecr.send(new DeleteRepositoryCommand({repositoryName: id, force: false}))
+    }
+}
+
+class EcrImageStore implements ItemStoreAdapter {
+    constructor(private readonly ecr: ECRClient) {}
+
+    async listItems(resourceId: string, page: PageQuery = {}): Promise<CollectionPage<ChildItem>> {
+        const response = await this.ecr.send(new DescribeImagesCommand({
+            repositoryName: resourceId,
+            nextToken: page.cursor,
+            maxResults: page.limit,
+        }))
+        return {
+            items: (response.imageDetails ?? []).flatMap(toItem),
+            nextCursor: response.nextToken ?? null,
+        }
+    }
+
+    async deleteItem(resourceId: string, itemId: string): Promise<void> {
+        const response = await this.ecr.send(new BatchDeleteImageCommand({
+            repositoryName: resourceId,
+            imageIds: [{imageDigest: itemId}],
+        }))
+        const failure = response.failures?.[0]
+        if (failure) throw new RuntimeError(failure.failureReason ?? `Unable to delete image ${itemId}`)
+    }
+}
+
+function toResource(repository: Repository): CloudResource {
+    const name = repository.repositoryName ?? ''
+    return {
+        id: name,
+        name,
+        cloud: 'aws',
+        service: 'ecr',
+        type: 'repository',
+        region: regionFromArn(repository.repositoryArn),
+        createdAt: repository.createdAt?.toISOString() ?? null,
+        metadata: {
+            arn: repository.repositoryArn,
+            registryId: repository.registryId,
+            repositoryUri: repository.repositoryUri,
+            imageTagMutability: repository.imageTagMutability,
+            imageScanningConfiguration: repository.imageScanningConfiguration,
+            encryptionConfiguration: repository.encryptionConfiguration,
+        },
+    }
+}
+
+function toItem(image: ImageDetail): ChildItem[] {
+    if (!image.imageDigest) return []
+    return [{
+        id: image.imageDigest,
+        collectionId: null,
+        timestamp: image.imagePushedAt?.toISOString() ?? null,
+        body: {
+            imageDigest: image.imageDigest,
+            imageTags: image.imageTags ?? [],
+            imageSizeInBytes: image.imageSizeInBytes ?? null,
+            imagePushedAt: image.imagePushedAt?.toISOString() ?? null,
+            imageManifestMediaType: image.imageManifestMediaType ?? null,
+            artifactMediaType: image.artifactMediaType ?? null,
+        },
+        metadata: {
+            imageScanStatus: image.imageScanStatus,
+            imageScanFindingsSummary: image.imageScanFindingsSummary,
+            registryId: image.registryId,
+            repositoryName: image.repositoryName,
+        },
+    }]
+}
+
+function stringValue(value: unknown): string {
+    return typeof value === 'string' ? value.trim() : ''
+}
+
+function regionFromArn(arn?: string): string | null {
+    return arn?.split(':')[3] || null
+}
+
+function isRepositoryNotFound(error: unknown): boolean {
+    return typeof error === 'object' && error !== null
+        && 'name' in error
+        && (error as {name?: string}).name === 'RepositoryNotFoundException'
+}

packages/api/src/adapter-aws/AwsLoadBalancingAdapter.test.ts

@@ -1,10 +1,15 @@
 import {describe, expect, test} from 'bun:test'
 import {
+    CreateListenerCommand,
     CreateLoadBalancerCommand,
+    DeleteListenerCommand,
     DeleteLoadBalancerCommand,
+    DescribeListenersCommand,
     DescribeLoadBalancersCommand,
+    SetSecurityGroupsCommand,
     type ElasticLoadBalancingV2Client,
 } from '@aws-sdk/client-elastic-load-balancing-v2'
+import {DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, type EC2Client} from '@aws-sdk/client-ec2'
 import {AwsLoadBalancingAdapter} from './AwsLoadBalancingAdapter'
 import {ValidationError} from '../cloud-spi/errors'
 
@@ -48,11 +53,26 @@ function runtimeStub() {
     })
 }
 
-const validValues = {name: 'web', subnets: 'subnet-default-b, subnet-default-c'}
+function stubEc2() {
+    return {
+        async send(command: object) {
+            if (command instanceof DescribeSubnetsCommand) return {Subnets: [
+                {SubnetId: 'subnet-default-b', VpcId: 'vpc-default', AvailabilityZone: 'us-east-1b', CidrBlock: '10.0.1.0/24'},
+                {SubnetId: 'subnet-default-c', VpcId: 'vpc-default', AvailabilityZone: 'us-east-1c', CidrBlock: '10.0.2.0/24'},
+            ]}
+            if (command instanceof DescribeVpcsCommand) return {Vpcs: [{VpcId: 'vpc-default', CidrBlock: '10.0.0.0/16'}]}
+            if (command instanceof DescribeSecurityGroupsCommand) return {SecurityGroups: [{GroupId: 'sg-1', VpcId: 'vpc-default', GroupName: 'web'}]}
+            return {}
+        },
+    } as unknown as EC2Client
+}
+
+const validValues = {name: 'web', subnets: 'subnet-default-b, subnet-default-c', securityGroups: 'sg-1'}
+const LISTENER_ARN = 'arn:aws:elasticloadbalancing:us-east-1:000000000000:listener/app/web/77aa388f69144785/aabbccddeeff0011'
 
 describe('AwsLoadBalancingAdapter', () => {
     test('identifies itself as the AWS load balancing adapter', () => {
-        const adapter = new AwsLoadBalancingAdapter(runtimeStub().client)
+        const adapter = new AwsLoadBalancingAdapter(runtimeStub().client, stubEc2())
 
         expect(adapter.cloud).toBe('aws')
         expect(adapter.service).toBe('loadbalancing')
@@ -61,7 +81,7 @@ describe('AwsLoadBalancingAdapter', () => {
 
     test('lists load balancers and reads the nested state code', async () => {
         const {client, sent} = runtimeStub()
-        const [resource] = await new AwsLoadBalancingAdapter(client).list()
+        const [resource] = await new AwsLoadBalancingAdapter(client, stubEc2()).list()
 
         expect(sent[0]).toBeInstanceOf(DescribeLoadBalancersCommand)
         expect(resource).toMatchObject({
@@ -96,7 +116,7 @@ describe('AwsLoadBalancingAdapter', () => {
             return {LoadBalancers: [{...balancer, LoadBalancerName: 'api', LoadBalancerArn: `${ARN}-2`}]}
         })
 
-        const resources = await new AwsLoadBalancingAdapter(client).list()
+        const resources = await new AwsLoadBalancingAdapter(client, stubEc2()).list()
 
         expect(resources.map((r) => r.name)).toEqual(['web', 'api'])
         expect((sent[1] as DescribeLoadBalancersCommand).input.Marker).toBe('page-2')
@@ -112,12 +132,12 @@ describe('AwsLoadBalancingAdapter', () => {
             return {LoadBalancers: [balancer], NextMarker: ''}
         })
 
-        await expect(new AwsLoadBalancingAdapter(client).list()).resolves.toHaveLength(1)
+        await expect(new AwsLoadBalancingAdapter(client, stubEc2()).list()).resolves.toHaveLength(1)
         expect(call).toBe(1)
     })
 
     test('filters by name and ARN', async () => {
-        const adapter = new AwsLoadBalancingAdapter(runtimeStub().client)
+        const adapter = new AwsLoadBalancingAdapter(runtimeStub().client, stubEc2())
 
         await expect(adapter.list({search: 'we'})).resolves.toHaveLength(1)
         await expect(adapter.list({search: 'loadbalancer/app'})).resolves.toHaveLength(1)
@@ -126,7 +146,7 @@ describe('AwsLoadBalancingAdapter', () => {
 
     test('inspects a load balancer by ARN', async () => {
         const {client, sent} = runtimeStub()
-        const resource = await new AwsLoadBalancingAdapter(client).get(ARN)
+        const resource = await new AwsLoadBalancingAdapter(client, stubEc2()).get(ARN)
 
         expect((sent[0] as DescribeLoadBalancersCommand).input.LoadBalancerArns).toEqual([ARN])
         expect(resource?.id).toBe(ARN)
@@ -141,7 +161,7 @@ describe('AwsLoadBalancingAdapter', () => {
                 $metadata: {httpStatusCode: 400},
             })
         })
-        await expect(new AwsLoadBalancingAdapter(client).get(ARN)).resolves.toBeNull()
+        await expect(new AwsLoadBalancingAdapter(client, stubEc2()).get(ARN)).resolves.toBeNull()
     })
 
     test('also returns null for the SDK-modelled exception name', async () => {
@@ -154,12 +174,12 @@ describe('AwsLoadBalancingAdapter', () => {
                 $metadata: {httpStatusCode: 400},
             })
         })
-        await expect(new AwsLoadBalancingAdapter(client).get(ARN)).resolves.toBeNull()
+        await expect(new AwsLoadBalancingAdapter(client, stubEc2()).get(ARN)).resolves.toBeNull()
     })
 
     test('returns null when the runtime answers with no load balancers', async () => {
         const {client} = stubElb(() => ({LoadBalancers: []}))
-        await expect(new AwsLoadBalancingAdapter(client).get(ARN)).resolves.toBeNull()
+        await expect(new AwsLoadBalancingAdapter(client, stubEc2()).get(ARN)).resolves.toBeNull()
     })
 
     test('rethrows a failure that is not a missing load balancer', async () => {
@@ -169,17 +189,18 @@ describe('AwsLoadBalancingAdapter', () => {
                 $metadata: {httpStatusCode: 403},
             })
         })
-        await expect(new AwsLoadBalancingAdapter(client).get(ARN)).rejects.toThrow('AccessDenied')
+        await expect(new AwsLoadBalancingAdapter(client, stubEc2()).get(ARN)).rejects.toThrow('AccessDenied')
     })
 
     test('creates a load balancer, splitting the comma separated subnets', async () => {
         const {client, sent} = runtimeStub()
-        const resource = await new AwsLoadBalancingAdapter(client).create({values: validValues})
+        const resource = await new AwsLoadBalancingAdapter(client, stubEc2()).create({values: validValues})
 
         const command = sent[0] as CreateLoadBalancerCommand
         expect(command).toBeInstanceOf(CreateLoadBalancerCommand)
         expect(command.input.Name).toBe('web')
         expect(command.input.Subnets).toEqual(['subnet-default-b', 'subnet-default-c'])
+        expect(command.input.SecurityGroups).toEqual(['sg-1'])
         expect(command.input.Type).toBe('application')
         expect(command.input.Scheme).toBe('internet-facing')
         expect(resource.id).toBe(ARN)
@@ -188,7 +209,7 @@ describe('AwsLoadBalancingAdapter', () => {
     test('requires at least two subnet ids', async () => {
         // Only the count is enforced. The AZ requirement is ELB's, and checking it
         // would mean calling EC2 from this adapter, so the message must not claim it.
-        const adapter = new AwsLoadBalancingAdapter(runtimeStub().client)
+        const adapter = new AwsLoadBalancingAdapter(runtimeStub().client, stubEc2())
 
         await expect(adapter.create({values: {...validValues, subnets: 'subnet-only'}})).rejects.toThrow(
             new ValidationError('subnets must list at least two subnet ids'),
@@ -196,7 +217,7 @@ describe('AwsLoadBalancingAdapter', () => {
     })
 
     test('requires the fields the schema marks required', async () => {
-        const adapter = new AwsLoadBalancingAdapter(runtimeStub().client)
+        const adapter = new AwsLoadBalancingAdapter(runtimeStub().client, stubEc2())
 
         await expect(adapter.create({values: {}})).rejects.toThrow(new ValidationError('name is required'))
         await expect(adapter.create({values: {name: 'web'}})).rejects.toThrow(
@@ -205,19 +226,55 @@ describe('AwsLoadBalancingAdapter', () => {
     })
 
     test('rejects values the runtime would refuse', async () => {
-        const adapter = new AwsLoadBalancingAdapter(runtimeStub().client)
+        const adapter = new AwsLoadBalancingAdapter(runtimeStub().client, stubEc2())
 
         for (const name of ['-web', 'web-', 'has spaces', 'a'.repeat(33)]) {
             await expect(adapter.create({values: {...validValues, name}}), name).rejects.toThrow(ValidationError)
         }
-        await expect(adapter.create({values: {...validValues, type: 'gateway'}})).rejects.toThrow(ValidationError)
         await expect(adapter.create({values: {...validValues, scheme: 'sideways'}})).rejects.toThrow(ValidationError)
     })
 
     test('deletes a load balancer by ARN', async () => {
         const {client, sent} = runtimeStub()
-        await new AwsLoadBalancingAdapter(client).delete(ARN)
+        await new AwsLoadBalancingAdapter(client, stubEc2()).delete(ARN)
 
         expect((sent[0] as DeleteLoadBalancerCommand).input.LoadBalancerArn).toBe(ARN)
     })
+
+    test('returns VPC dependencies from the account-scoped EC2 client', async () => {
+        const dependencies = await new AwsLoadBalancingAdapter(runtimeStub().client, stubEc2()).dependencies()
+
+        expect(dependencies.vpcs).toEqual([{id: 'vpc-default', cidrBlock: '10.0.0.0/16'}])
+        expect(dependencies.subnets).toHaveLength(2)
+        expect(dependencies.securityGroups).toEqual([{id: 'sg-1', vpcId: 'vpc-default', name: 'web', description: ''}])
+    })
+
+    test('sets security groups and returns the refreshed load balancer', async () => {
+        const {client, sent} = runtimeStub()
+        await new AwsLoadBalancingAdapter(client, stubEc2()).update(ARN, {values: {securityGroups: 'sg-1'}})
+
+        expect(sent[0]).toBeInstanceOf(SetSecurityGroupsCommand)
+        expect((sent[0] as SetSecurityGroupsCommand).input.SecurityGroups).toEqual(['sg-1'])
+    })
+
+    test('manages listeners through the generic flat-item extension', async () => {
+        const {client, sent} = stubElb((command) => {
+            if (command instanceof DescribeListenersCommand) {
+                return {Listeners: [{ListenerArn: LISTENER_ARN, Protocol: 'HTTP', Port: 80, DefaultActions: [{Type: 'forward', TargetGroupArn: 'target-group-arn'}]}]}
+            }
+            if (command instanceof CreateListenerCommand) {
+                return {Listeners: [{ListenerArn: LISTENER_ARN, Protocol: 'HTTP', Port: 8080, DefaultActions: [{Type: 'forward', TargetGroupArn: 'target-group-arn'}]}]}
+            }
+            return {}
+        })
+        const items = new AwsLoadBalancingAdapter(client, stubEc2()).items
+
+        await expect(items.listItems(ARN)).resolves.toMatchObject({items: [{id: LISTENER_ARN, body: {protocol: 'HTTP', port: 80, targetGroupArn: 'target-group-arn'}}]})
+        await expect(items.putItem!(ARN, {port: '8080', targetGroupArn: 'target-group-arn'})).resolves.toMatchObject({id: LISTENER_ARN})
+        await items.deleteItem!(ARN, LISTENER_ARN)
+
+        expect((sent[0] as DescribeListenersCommand).input.LoadBalancerArn).toBe(ARN)
+        expect((sent[1] as CreateListenerCommand).input).toMatchObject({LoadBalancerArn: ARN, Protocol: 'HTTP', Port: 8080, DefaultActions: [{Type: 'forward', TargetGroupArn: 'target-group-arn'}]})
+        expect((sent[2] as DeleteListenerCommand).input.ListenerArn).toBe(LISTENER_ARN)
+    })
 })

packages/api/src/adapter-aws/AwsLoadBalancingAdapter.ts

@@ -1,12 +1,19 @@
 import {
+    CreateListenerCommand,
     CreateLoadBalancerCommand,
+    DeleteListenerCommand,
     DeleteLoadBalancerCommand,
+    DescribeListenersCommand,
     DescribeLoadBalancersCommand,
+    SetSecurityGroupsCommand,
     type ElasticLoadBalancingV2Client,
+    type Listener,
     type LoadBalancer,
 } from '@aws-sdk/client-elastic-load-balancing-v2'
+import {DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, type EC2Client} from '@aws-sdk/client-ec2'
+import type {ChildItem, CollectionPage, ItemStoreAdapter, PageQuery} from '../cloud-spi/childCollections'
 import {RuntimeError, ValidationError} from '../cloud-spi/errors'
-import {ELB_NAME_PATTERN, ELB_SCHEMES, ELB_TYPES, awsLoadBalancingSchema} from '../cloud-spi/loadBalancingSchema'
+import {ELB_NAME_PATTERN, ELB_SCHEMES, awsLoadBalancingSchema} from '../cloud-spi/loadBalancingSchema'
 import type {
     CloudResource,
     CloudServiceAdapter,
@@ -39,8 +46,11 @@ import type {
 export class AwsLoadBalancingAdapter implements CloudServiceAdapter {
     readonly cloud = 'aws' as const
     readonly service = 'loadbalancing' as const
+    readonly items: ItemStoreAdapter
 
-    constructor(private readonly elb: ElasticLoadBalancingV2Client) {}
+    constructor(private readonly elb: ElasticLoadBalancingV2Client, private readonly ec2: EC2Client) {
+        this.items = new ListenerStore(elb)
+    }
 
     schema(): ServiceSchema {
         return awsLoadBalancingSchema()
@@ -78,32 +88,93 @@ export class AwsLoadBalancingAdapter implements CloudServiceAdapter {
             )
         }
 
-        // Only the count is enforced. Whether the subnets sit in different
-        // availability zones is ELB's rule, and checking it here would mean calling
-        // EC2 DescribeSubnets from the load balancing adapter — real coupling for a
-        // validation nicety. So the message claims only what this check does; the
-        // schema field carries the AZ requirement as guidance.
         const subnets = splitIds(requiredString(input.values.subnets, 'subnets'))
-        if (subnets.length < 2) {
-            throw new ValidationError('subnets must list at least two subnet ids')
-        }
-
-        const type = optionalOneOf(input.values.type, ELB_TYPES, 'type') ?? 'application'
+        const securityGroups = splitIds(requiredString(input.values.securityGroups, 'securityGroups'))
+        await this.validateSubnets(subnets)
+        if (securityGroups.length === 0) throw new ValidationError('securityGroups must list at least one security group id')
         const scheme = optionalOneOf(input.values.scheme, ELB_SCHEMES, 'scheme') ?? 'internet-facing'
 
         const res = await this.elb.send(
-            new CreateLoadBalancerCommand({Name: name, Subnets: subnets, Type: type, Scheme: scheme}),
+            new CreateLoadBalancerCommand({Name: name, Subnets: subnets, SecurityGroups: securityGroups, Type: 'application', Scheme: scheme}),
         )
         const created = res.LoadBalancers?.[0]
         if (!created) throw new RuntimeError(`ELB did not return the created load balancer for ${name}`)
         return toResource(created)
     }
 
+    async dependencies(): Promise<Record<string, unknown>> {
+        const [vpcs, subnets, securityGroups] = await Promise.all([
+            this.ec2.send(new DescribeVpcsCommand({})),
+            this.ec2.send(new DescribeSubnetsCommand({})),
+            this.ec2.send(new DescribeSecurityGroupsCommand({})),
+        ])
+        return {
+            vpcs: (vpcs.Vpcs ?? []).map((vpc) => ({id: vpc.VpcId ?? '', cidrBlock: vpc.CidrBlock ?? ''})),
+            subnets: (subnets.Subnets ?? []).map((subnet) => ({id: subnet.SubnetId ?? '', vpcId: subnet.VpcId ?? '', availabilityZone: subnet.AvailabilityZone ?? '', cidrBlock: subnet.CidrBlock ?? ''})),
+            securityGroups: (securityGroups.SecurityGroups ?? []).map((group) => ({id: group.GroupId ?? '', vpcId: group.VpcId ?? '', name: group.GroupName ?? '', description: group.Description ?? ''})),
+        }
+    }
+
+    async update(id: string, input: CreateResourceInput): Promise<CloudResource> {
+        const securityGroups = splitIds(requiredString(input.values.securityGroups, 'securityGroups'))
+        if (securityGroups.length === 0) throw new ValidationError('securityGroups must list at least one security group id')
+        await this.elb.send(new SetSecurityGroupsCommand({LoadBalancerArn: id, SecurityGroups: securityGroups}))
+        const updated = await this.get(id)
+        if (!updated) throw new RuntimeError(`ELB did not return the updated load balancer ${id}`)
+        return updated
+    }
+
+    private async validateSubnets(subnetIds: string[]): Promise<void> {
+        if (subnetIds.length < 2) throw new ValidationError('subnets must list at least two subnet ids')
+        const res = await this.ec2.send(new DescribeSubnetsCommand({SubnetIds: subnetIds}))
+        const zones = new Set((res.Subnets ?? []).map((subnet) => subnet.AvailabilityZone).filter(Boolean))
+        if (res.Subnets?.length !== subnetIds.length || zones.size < 2) {
+            throw new ValidationError('subnets must include at least two subnets in distinct availability zones')
+        }
+    }
+
     async delete(id: string): Promise<void> {
         await this.elb.send(new DeleteLoadBalancerCommand({LoadBalancerArn: id}))
     }
 }
 
+class ListenerStore implements ItemStoreAdapter {
+    constructor(private readonly elb: ElasticLoadBalancingV2Client) {}
+
+    async listItems(resourceId: string, _page: PageQuery = {}): Promise<CollectionPage<ChildItem>> {
+        const listeners: Listener[] = []
+        let marker: string | undefined
+
+        do {
+            const response = await this.elb.send(new DescribeListenersCommand({LoadBalancerArn: resourceId, ...(marker ? {Marker: marker} : {})}))
+            listeners.push(...(response.Listeners ?? []))
+            marker = response.NextMarker || undefined
+        } while (marker)
+
+        return {items: listeners.flatMap(toListenerItem), nextCursor: null}
+    }
+
+    async putItem(resourceId: string, body: Record<string, unknown>): Promise<ChildItem> {
+        const port = requiredPort(body.port)
+        const targetGroupArn = requiredString(body.targetGroupArn, 'targetGroupArn')
+        const response = await this.elb.send(new CreateListenerCommand({
+            LoadBalancerArn: resourceId,
+            Protocol: 'HTTP',
+            Port: port,
+            DefaultActions: [{Type: 'forward', TargetGroupArn: targetGroupArn}],
+        }))
+        const listener = response.Listeners?.[0]
+        if (!listener) throw new RuntimeError(`ELB did not return the listener created on ${resourceId}`)
+        const item = toListenerItem(listener)[0]
+        if (!item) throw new RuntimeError(`ELB returned a listener without an ARN for ${resourceId}`)
+        return item
+    }
+
+    async deleteItem(_resourceId: string, itemId: string): Promise<void> {
+        await this.elb.send(new DeleteListenerCommand({ListenerArn: itemId}))
+    }
+}
+
 function toResource(balancer: LoadBalancer): CloudResource {
     const arn = balancer.LoadBalancerArn ?? ''
     const zones = balancer.AvailabilityZones ?? []
@@ -134,6 +205,24 @@ function toResource(balancer: LoadBalancer): CloudResource {
     }
 }
 
+function toListenerItem(listener: Listener): ChildItem[] {
+    const arn = listener.ListenerArn
+    if (!arn) return []
+    const action = listener.DefaultActions?.find((candidate) => candidate.Type === 'forward')
+    return [{
+        id: arn,
+        collectionId: null,
+        timestamp: null,
+        body: {
+            arn,
+            protocol: listener.Protocol ?? null,
+            port: listener.Port ?? null,
+            targetGroupArn: action?.TargetGroupArn ?? null,
+        },
+        metadata: {},
+    }]
+}
+
 /** `arn:aws:elasticloadbalancing:us-east-1:...` — region is field 4. */
 function regionFromArn(arn: string): string | null {
     return arn.split(':')[3] || null
@@ -176,6 +265,15 @@ function requiredString(value: unknown, field: string): string {
     return trimmed
 }
 
+function requiredPort(value: unknown): number {
+    if (typeof value !== 'string' && typeof value !== 'number') throw new ValidationError('port is required')
+    const port = typeof value === 'number' ? value : Number(value.trim())
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new ValidationError('port must be an integer from 1 to 65535')
+    }
+    return port
+}
+
 function optionalOneOf<T extends readonly string[]>(value: unknown, allowed: T, field: string): T[number] | undefined {
     if (value === undefined || value === null || value === '') return undefined
     if (typeof value !== 'string') throw new ValidationError(`${field} must be a string`)

packages/api/src/adapter-aws/AwsTargetGroupAdapter.test.ts

@@ -0,0 +1,202 @@
+import {describe, expect, test} from 'bun:test'
+import {
+    CreateTargetGroupCommand,
+    DeregisterTargetsCommand,
+    DescribeTargetHealthCommand,
+    DeleteTargetGroupCommand,
+    DescribeTargetGroupsCommand,
+    RegisterTargetsCommand,
+    type ElasticLoadBalancingV2Client,
+} from '@aws-sdk/client-elastic-load-balancing-v2'
+import {DescribeInstancesCommand, type EC2Client} from '@aws-sdk/client-ec2'
+import {AwsTargetGroupAdapter} from './AwsTargetGroupAdapter'
+import {ValidationError} from '../cloud-spi/errors'
+
+type SendResult = Record<string, unknown>
+
+function stubElb(handler: (command: object) => SendResult | Promise<SendResult>) {
+    const sent: object[] = []
+    const client = {
+        async send(command: object) {
+            sent.push(command)
+            return handler(command)
+        },
+    } as unknown as ElasticLoadBalancingV2Client
+    return {client, sent}
+}
+
+function stubEc2(handler: (command: object) => SendResult | Promise<SendResult> = () => ({})) {
+    return {async send(command: object) { return handler(command) }} as unknown as EC2Client
+}
+
+const ARN = 'arn:aws:elasticloadbalancing:us-east-1:000000000000:targetgroup/api/77aa388f69144785'
+const targetGroup = {
+    TargetGroupArn: ARN,
+    TargetGroupName: 'api',
+    Protocol: 'HTTP',
+    ProtocolVersion: 'HTTP1',
+    Port: 8080,
+    TargetType: 'ip',
+    VpcId: 'vpc-default',
+    LoadBalancerArns: ['arn:aws:elasticloadbalancing:us-east-1:000000000000:loadbalancer/app/web/123'],
+    HealthCheckProtocol: 'HTTP',
+    HealthCheckPath: '/health',
+}
+
+function runtimeStub() {
+    return stubElb((command) => {
+        if (command instanceof CreateTargetGroupCommand) return {TargetGroups: [targetGroup]}
+        if (command instanceof DescribeTargetGroupsCommand) return {TargetGroups: [targetGroup]}
+        return {}
+    })
+}
+
+describe('AwsTargetGroupAdapter', () => {
+    test('identifies itself as the AWS target groups adapter', () => {
+        const adapter = new AwsTargetGroupAdapter(runtimeStub().client, stubEc2())
+
+        expect(adapter.cloud).toBe('aws')
+        expect(adapter.service).toBe('targetgroups')
+        expect(adapter.schema().displayName).toBe('AWS ELB Target Groups')
+    })
+
+    test('lists target groups with their table metadata', async () => {
+        const {client, sent} = runtimeStub()
+        const [resource] = await new AwsTargetGroupAdapter(client, stubEc2()).list()
+
+        expect(sent[0]).toBeInstanceOf(DescribeTargetGroupsCommand)
+        expect(resource).toMatchObject({
+            id: ARN,
+            name: 'api',
+            cloud: 'aws',
+            service: 'targetgroups',
+            type: 'target-group',
+            region: 'us-east-1',
+            createdAt: null,
+        })
+        expect(resource?.metadata).toMatchObject({
+            protocol: 'HTTP',
+            port: 8080,
+            targetType: 'ip',
+            vpcId: 'vpc-default',
+            loadBalancerArns: ['arn:aws:elasticloadbalancing:us-east-1:000000000000:loadbalancer/app/web/123'],
+        })
+    })
+
+    test('follows a non-empty pagination marker and stops at an empty marker', async () => {
+        let call = 0
+        const {client, sent} = stubElb((command) => {
+            if (!(command instanceof DescribeTargetGroupsCommand)) return {}
+            call += 1
+            if (call === 1) return {TargetGroups: [targetGroup], NextMarker: 'page-2'}
+            return {TargetGroups: [{...targetGroup, TargetGroupName: 'worker', TargetGroupArn: `${ARN}-2`}], NextMarker: ''}
+        })
+
+        const resources = await new AwsTargetGroupAdapter(client, stubEc2()).list()
+
+        expect(resources.map((resource) => resource.name)).toEqual(['api', 'worker'])
+        expect((sent[1] as DescribeTargetGroupsCommand).input.Marker).toBe('page-2')
+    })
+
+    test('filters by name and ARN', async () => {
+        const adapter = new AwsTargetGroupAdapter(runtimeStub().client, stubEc2())
+
+        await expect(adapter.list({search: 'ap'})).resolves.toHaveLength(1)
+        await expect(adapter.list({search: 'targetgroup/api'})).resolves.toHaveLength(1)
+        await expect(adapter.list({search: 'nope'})).resolves.toHaveLength(0)
+    })
+
+    test('inspects by ARN and returns null for a missing target group', async () => {
+        const {client, sent} = runtimeStub()
+        const adapter = new AwsTargetGroupAdapter(client, stubEc2())
+
+        await expect(adapter.get(ARN)).resolves.toMatchObject({id: ARN})
+        expect((sent[0] as DescribeTargetGroupsCommand).input.TargetGroupArns).toEqual([ARN])
+
+        const missing = new AwsTargetGroupAdapter(stubElb(() => {
+            throw Object.assign(new Error('One or more target groups not found.'), {name: 'TargetGroupNotFound', $metadata: {httpStatusCode: 400}})
+        }).client, stubEc2())
+        await expect(missing.get(ARN)).resolves.toBeNull()
+    })
+
+    test('creates with required and supported optional SDK fields', async () => {
+        const {client, sent} = runtimeStub()
+        const resource = await new AwsTargetGroupAdapter(client, stubEc2()).create({
+            values: {
+                name: 'api',
+                protocol: 'HTTP',
+                port: '8080',
+                targetType: 'ip',
+                vpcId: 'vpc-default',
+                healthCheckProtocol: 'HTTP',
+                healthCheckPath: '/health',
+            },
+        })
+
+        const command = sent[0] as CreateTargetGroupCommand
+        expect(command.input).toMatchObject({
+            Name: 'api',
+            Protocol: 'HTTP',
+            Port: 8080,
+            TargetType: 'ip',
+            VpcId: 'vpc-default',
+            HealthCheckProtocol: 'HTTP',
+            HealthCheckPath: '/health',
+        })
+        expect(resource.id).toBe(ARN)
+    })
+
+    test('requires valid name, protocol, and port', async () => {
+        const adapter = new AwsTargetGroupAdapter(runtimeStub().client, stubEc2())
+
+        await expect(adapter.create({values: {}})).rejects.toThrow(new ValidationError('name is required'))
+        await expect(adapter.create({values: {name: 'api'}})).rejects.toThrow(new ValidationError('protocol is required'))
+        await expect(adapter.create({values: {name: 'api', protocol: 'HTTP'}})).rejects.toThrow(
+            new ValidationError('port is required'),
+        )
+        await expect(adapter.create({values: {name: '-api', protocol: 'HTTP', port: 80}})).rejects.toThrow(ValidationError)
+        await expect(adapter.create({values: {name: 'api', protocol: 'HTTP', port: '70000'}})).rejects.toThrow(
+            new ValidationError('port must be an integer from 1 to 65535'),
+        )
+    })
+
+    test('deletes by target group ARN', async () => {
+        const {client, sent} = runtimeStub()
+        await new AwsTargetGroupAdapter(client, stubEc2()).delete(ARN)
+
+        expect((sent[0] as DeleteTargetGroupCommand).input.TargetGroupArn).toBe(ARN)
+    })
+
+    test('lists running account instances and target health through the AWS SDK', async () => {
+        const {client, sent} = stubElb((command) => {
+            if (command instanceof DescribeTargetHealthCommand) return {
+                TargetHealthDescriptions: [{
+                    Target: {Id: 'i-123', Port: 8080},
+                    TargetHealth: {State: 'healthy', Reason: 'Success', Description: 'Health checks passed'},
+                }],
+            }
+            return {}
+        })
+        const adapter = new AwsTargetGroupAdapter(client, stubEc2((command) => {
+            if (command instanceof DescribeInstancesCommand) return {
+                Reservations: [{Instances: [{InstanceId: 'i-123', PrivateIpAddress: '10.0.0.5', Tags: [{Key: 'Name', Value: 'api'}]}]}],
+            }
+            return {}
+        }))
+
+        await expect(adapter.dependencies()).resolves.toEqual({instances: [{id: 'i-123', name: 'api', privateIp: '10.0.0.5'}]})
+        await expect(adapter.items.listItems(ARN)).resolves.toMatchObject({items: [{id: 'i-123:8080', body: {state: 'healthy', reason: 'Success'}}]})
+        expect((sent[0] as DescribeTargetHealthCommand).input.TargetGroupArn).toBe(ARN)
+    })
+
+    test('registers and deregisters targets with the selected port', async () => {
+        const {client, sent} = stubElb(() => ({}))
+        const store = new AwsTargetGroupAdapter(client, stubEc2()).items
+
+        await store.putItem?.(ARN, {id: 'i-123', port: '8080'})
+        await store.deleteItem?.(ARN, 'i-123:8080')
+
+        expect((sent[0] as RegisterTargetsCommand).input).toEqual({TargetGroupArn: ARN, Targets: [{Id: 'i-123', Port: 8080}]})
+        expect((sent[1] as DeregisterTargetsCommand).input).toEqual({TargetGroupArn: ARN, Targets: [{Id: 'i-123', Port: 8080}]})
+    })
+})

packages/api/src/adapter-aws/AwsTargetGroupAdapter.ts

@@ -0,0 +1,224 @@
+import {
+    CreateTargetGroupCommand,
+    DeleteTargetGroupCommand,
+    DeregisterTargetsCommand,
+    DescribeTargetHealthCommand,
+    DescribeTargetGroupsCommand,
+    RegisterTargetsCommand,
+    type CreateTargetGroupCommandInput,
+    type ElasticLoadBalancingV2Client,
+    type TargetGroup,
+} from '@aws-sdk/client-elastic-load-balancing-v2'
+import {DescribeInstancesCommand, type EC2Client} from '@aws-sdk/client-ec2'
+import type {ChildItem, CollectionPage, ItemStoreAdapter, PageQuery} from '../cloud-spi/childCollections'
+import {RuntimeError, ValidationError} from '../cloud-spi/errors'
+import {ELB_NAME_PATTERN} from '../cloud-spi/loadBalancingSchema'
+import {awsTargetGroupsSchema} from '../cloud-spi/targetGroupsSchema'
+import type {CloudResource, CloudServiceAdapter, CreateResourceInput, ResourceQuery, ServiceSchema} from '../cloud-spi/types'
+
+type TargetGroupProtocol = NonNullable<CreateTargetGroupCommandInput['Protocol']>
+type TargetGroupType = NonNullable<CreateTargetGroupCommandInput['TargetType']>
+
+export class AwsTargetGroupAdapter implements CloudServiceAdapter {
+    readonly cloud = 'aws' as const
+    readonly service = 'targetgroups' as const
+    readonly items: ItemStoreAdapter
+
+    constructor(private readonly elb: ElasticLoadBalancingV2Client, private readonly ec2: EC2Client) {
+        this.items = new TargetHealthStore(elb)
+    }
+
+    schema(): ServiceSchema {
+        return awsTargetGroupsSchema()
+    }
+
+    async list(query: ResourceQuery = {}): Promise<CloudResource[]> {
+        const groups: TargetGroup[] = []
+        let marker: string | undefined
+
+        do {
+            const response = await this.elb.send(new DescribeTargetGroupsCommand(marker ? {Marker: marker} : {}))
+            groups.push(...(response.TargetGroups ?? []))
+            marker = response.NextMarker || undefined
+        } while (marker)
+
+        return filterBySearch(groups.map(toResource), query.search)
+    }
+
+    async get(id: string): Promise<CloudResource | null> {
+        try {
+            const response = await this.elb.send(new DescribeTargetGroupsCommand({TargetGroupArns: [id]}))
+            const group = response.TargetGroups?.[0]
+            return group ? toResource(group) : null
+        } catch (error) {
+            if (isMissing(error)) return null
+            throw error
+        }
+    }
+
+    async create(input: CreateResourceInput): Promise<CloudResource> {
+        const name = requiredString(input.values.name, 'name')
+        if (!new RegExp(ELB_NAME_PATTERN).test(name)) {
+            throw new ValidationError(
+                'name must be up to 32 characters of letters, digits and hyphens, not starting or ending with a hyphen',
+            )
+        }
+
+        const protocol = requiredString(input.values.protocol, 'protocol') as TargetGroupProtocol
+        const port = requiredPort(input.values.port)
+        const response = await this.elb.send(new CreateTargetGroupCommand({
+            Name: name,
+            Protocol: protocol,
+            Port: port,
+            TargetType: optionalString(input.values.targetType, 'targetType') as TargetGroupType | undefined,
+            VpcId: optionalString(input.values.vpcId, 'vpcId'),
+            HealthCheckProtocol: optionalString(input.values.healthCheckProtocol, 'healthCheckProtocol') as TargetGroupProtocol | undefined,
+            HealthCheckPath: optionalString(input.values.healthCheckPath, 'healthCheckPath'),
+        }))
+        const group = response.TargetGroups?.[0]
+        if (!group) throw new RuntimeError(`ELB did not return the created target group for ${name}`)
+        return toResource(group)
+    }
+
+    async delete(id: string): Promise<void> {
+        await this.elb.send(new DeleteTargetGroupCommand({TargetGroupArn: id}))
+    }
+
+    async dependencies(): Promise<Record<string, unknown>> {
+        const instances: Array<{id: string; name: string; privateIp: string | null}> = []
+        let nextToken: string | undefined
+        do {
+            const response = await this.ec2.send(new DescribeInstancesCommand({
+                Filters: [{Name: 'instance-state-name', Values: ['running']}],
+                NextToken: nextToken,
+            }))
+            for (const reservation of response.Reservations ?? []) {
+                for (const instance of reservation.Instances ?? []) {
+                    if (!instance.InstanceId) continue
+                    instances.push({
+                        id: instance.InstanceId,
+                        name: instance.Tags?.find((tag) => tag.Key === 'Name')?.Value ?? instance.InstanceId,
+                        privateIp: instance.PrivateIpAddress ?? null,
+                    })
+                }
+            }
+            nextToken = response.NextToken
+        } while (nextToken)
+        return {instances}
+    }
+}
+
+class TargetHealthStore implements ItemStoreAdapter {
+    constructor(private readonly elb: ElasticLoadBalancingV2Client) {}
+
+    async listItems(resourceId: string, _page: PageQuery = {}): Promise<CollectionPage<ChildItem>> {
+        const response = await this.elb.send(new DescribeTargetHealthCommand({TargetGroupArn: resourceId}))
+        return {items: (response.TargetHealthDescriptions ?? []).flatMap(toHealthItem), nextCursor: null}
+    }
+
+    async putItem(resourceId: string, body: Record<string, unknown>): Promise<ChildItem> {
+        const id = requiredString(body.id, 'id')
+        const port = requiredPort(body.port)
+        await this.elb.send(new RegisterTargetsCommand({TargetGroupArn: resourceId, Targets: [{Id: id, Port: port}]}))
+        return {id: targetKey(id, port), collectionId: null, timestamp: null, body: {id, port}, metadata: {}}
+    }
+
+    async deleteItem(resourceId: string, itemId: string): Promise<void> {
+        const target = parseTargetKey(itemId)
+        await this.elb.send(new DeregisterTargetsCommand({TargetGroupArn: resourceId, Targets: [target]}))
+    }
+}
+
+function toResource(group: TargetGroup): CloudResource {
+    const arn = group.TargetGroupArn ?? ''
+    return {
+        id: arn,
+        name: group.TargetGroupName ?? '',
+        cloud: 'aws',
+        service: 'targetgroups',
+        type: 'target-group',
+        region: arn.split(':')[3] || null,
+        createdAt: null,
+        metadata: {
+            arn,
+            protocol: group.Protocol,
+            protocolVersion: group.ProtocolVersion,
+            port: group.Port,
+            targetType: group.TargetType,
+            vpcId: group.VpcId,
+            loadBalancerArns: group.LoadBalancerArns,
+            healthCheckProtocol: group.HealthCheckProtocol,
+            healthCheckPath: group.HealthCheckPath,
+        },
+    }
+}
+
+function filterBySearch(resources: CloudResource[], search?: string): CloudResource[] {
+    const normalized = search?.trim().toLowerCase()
+    if (!normalized) return resources
+    return resources.filter((resource) => resource.name.toLowerCase().includes(normalized) || resource.id.toLowerCase().includes(normalized))
+}
+
+function isMissing(error: unknown): boolean {
+    if (typeof error !== 'object' || error === null) return false
+    const name = (error as {name?: string}).name
+    return name === 'TargetGroupNotFound' || name === 'TargetGroupNotFoundException'
+}
+
+function requiredString(value: unknown, field: string): string {
+    if (value === undefined || value === null || value === '') throw new ValidationError(`${field} is required`)
+    if (typeof value !== 'string') throw new ValidationError(`${field} must be a string`)
+    const trimmed = value.trim()
+    if (!trimmed) throw new ValidationError(`${field} is required`)
+    return trimmed
+}
+
+function optionalString(value: unknown, field: string): string | undefined {
+    if (value === undefined || value === null || value === '') return undefined
+    if (typeof value !== 'string') throw new ValidationError(`${field} must be a string`)
+    const trimmed = value.trim()
+    return trimmed || undefined
+}
+
+function requiredPort(value: unknown): number {
+    if (typeof value !== 'string' && typeof value !== 'number') throw new ValidationError('port is required')
+    const port = typeof value === 'number' ? value : Number(value.trim())
+    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new ValidationError('port must be an integer from 1 to 65535')
+    return port
+}
+
+function toHealthItem(description: {Target?: {Id?: string; Port?: number}; TargetHealth?: {State?: string; Reason?: string; Description?: string}}): ChildItem[] {
+    const id = description.Target?.Id
+    if (!id) return []
+    const port = description.Target?.Port
+    return [{
+        id: targetKey(id, port),
+        collectionId: null,
+        timestamp: null,
+        body: {
+            id,
+            port: port ?? null,
+            state: description.TargetHealth?.State ?? null,
+            reason: description.TargetHealth?.Reason ?? null,
+            description: description.TargetHealth?.Description ?? null,
+        },
+        metadata: {},
+    }]
+}
+
+function targetKey(id: string, port?: number): string {
+    return `${id}:${port ?? ''}`
+}
+
+function parseTargetKey(key: string): {Id: string; Port?: number} {
+    const separator = key.lastIndexOf(':')
+    if (separator < 1) {
+        throw new ValidationError('target id must include a valid port')
+    }
+    const id = key.slice(0, separator)
+    const port = Number(key.slice(separator + 1))
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new ValidationError('target id must include a valid port')
+    }
+    return {Id: id, Port: port}
+}