alchemy 2.0.0-beta.3 → 2.0.0-beta.31

package/src/AWS/EC2/EIP.ts

@@ -7,8 +7,8 @@ import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
 import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
-import type { AccountID } from "../Account.ts";
-import { Account } from "../Account.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import type { RegionID } from "../Region.ts";
 
 export type EIPArn =
@@ -110,7 +110,7 @@ export const EIPProvider = () =>
     EIP,
     Effect.gen(function* () {
       const region = yield* Region;
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
 
       const createTags = Effect.fn(function* (
         id: string,
@@ -166,64 +166,59 @@ export const EIPProvider = () =>
           // Tags can be updated in-place
         }),
 
-        create: Effect.fn(function* ({ id, news = {}, session }) {
-          yield* session.note("Allocating Elastic IP address...");
-
-          const result = yield* ec2.allocateAddress({
-            Domain: news.domain ?? "vpc",
-            PublicIpv4Pool: news.publicIpv4Pool,
-            NetworkBorderGroup: news.networkBorderGroup,
-            CustomerOwnedIpv4Pool: news.customerOwnedIpv4Pool,
-            TagSpecifications: [
-              {
-                ResourceType: "elastic-ip",
-                Tags: createTagsList(yield* createTags(id, news.tags)),
-              },
-            ],
-            DryRun: false,
-          });
-
-          const allocationId = result.AllocationId! as AllocationId;
-          yield* session.note(`Elastic IP allocated: ${allocationId}`);
+        reconcile: Effect.fn(function* ({ id, news = {}, output, session }) {
+          const desiredTags = yield* createTags(id, news.tags);
 
-          return {
-            allocationId,
-            eipArn:
-              `arn:aws:ec2:${region}:${accountId}:elastic-ip/${allocationId}` as EIPArn,
-            publicIp: result.PublicIp!,
-            publicIpv4Pool: result.PublicIpv4Pool,
-            domain: (result.Domain as "vpc" | "standard") ?? "vpc",
-            networkBorderGroup: result.NetworkBorderGroup,
-            customerOwnedIp: result.CustomerOwnedIp,
-            customerOwnedIpv4Pool: result.CustomerOwnedIpv4Pool,
-            carrierIp: result.CarrierIp,
-          } satisfies EIP["Attributes"];
-        }),
-
-        update: Effect.fn(function* ({ id, news = {}, output, session }) {
-          const allocationId = output.allocationId;
-
-          // Handle tag updates
-          const newTags = yield* createTags(id, news.tags);
-          const oldTags =
-            (yield* ec2
-              .describeTags({
-                Filters: [
-                  { Name: "resource-id", Values: [allocationId] },
-                  { Name: "resource-type", Values: ["elastic-ip"] },
-                ],
-              })
+          // Observe — try to find an existing EIP via the cached allocationId.
+          // If it was released out-of-band, fall through to allocate.
+          let address: ec2.Address | undefined;
+          if (output?.allocationId) {
+            const lookup = yield* ec2
+              .describeAddresses({ AllocationIds: [output.allocationId] })
               .pipe(
-                Effect.map(
-                  (r) =>
-                    Object.fromEntries(
-                      r.Tags?.map((t) => [t.Key!, t.Value!]) ?? [],
-                    ) as Record<string, string>,
+                Effect.catchTag("InvalidAllocationID.NotFound", () =>
+                  Effect.succeed({ Addresses: [] }),
                 ),
-              )) ?? {};
+              );
+            address = lookup.Addresses?.[0];
+          }
+
+          // Ensure — allocate a new EIP when none was observed.
+          if (address === undefined) {
+            yield* session.note("Allocating Elastic IP address...");
+            const result = yield* ec2.allocateAddress({
+              Domain: news.domain ?? "vpc",
+              PublicIpv4Pool: news.publicIpv4Pool,
+              NetworkBorderGroup: news.networkBorderGroup,
+              CustomerOwnedIpv4Pool: news.customerOwnedIpv4Pool,
+              TagSpecifications: [
+                {
+                  ResourceType: "elastic-ip",
+                  Tags: createTagsList(desiredTags),
+                },
+              ],
+              DryRun: false,
+            });
+            const allocationId = result.AllocationId! as AllocationId;
+            yield* session.note(`Elastic IP allocated: ${allocationId}`);
+            const lookup = yield* ec2.describeAddresses({
+              AllocationIds: [allocationId],
+            });
+            address = lookup.Addresses?.[0];
+            if (!address) {
+              return yield* Effect.fail(
+                new Error(`EIP ${allocationId} disappeared after allocation`),
+              );
+            }
+          }
 
-          const { removed, upsert } = diffTags(oldTags, newTags);
+          const allocationId = address.AllocationId! as AllocationId;
 
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (address.Tags ?? []).map((t) => [t.Key!, t.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
           if (removed.length > 0) {
             yield* ec2.deleteTags({
               Resources: [allocationId],
@@ -237,10 +232,20 @@ export const EIPProvider = () =>
               Tags: upsert,
               DryRun: false,
             });
-            yield* session.note("Updated tags");
           }
 
-          return output;
+          return {
+            allocationId,
+            eipArn:
+              `arn:aws:ec2:${region}:${accountId}:elastic-ip/${allocationId}` as EIPArn,
+            publicIp: address.PublicIp!,
+            publicIpv4Pool: address.PublicIpv4Pool,
+            domain: (address.Domain as "vpc" | "standard") ?? "vpc",
+            networkBorderGroup: address.NetworkBorderGroup,
+            customerOwnedIp: address.CustomerOwnedIp,
+            customerOwnedIpv4Pool: address.CustomerOwnedIpv4Pool,
+            carrierIp: address.CarrierIp,
+          } satisfies EIP["Attributes"];
         }),
 
         delete: Effect.fn(function* ({ output, session }) {

package/src/AWS/EC2/EgressOnlyInternetGateway.ts

@@ -7,8 +7,8 @@ import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
 import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
-import type { AccountID } from "../Account.ts";
-import { Account } from "../Account.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import type { RegionID } from "../Region.ts";
 import type { VpcId } from "./Vpc.ts";
 
@@ -75,7 +75,7 @@ export const EgressOnlyInternetGatewayProvider = () =>
     EgressOnlyInternetGateway,
     Effect.gen(function* () {
       const region = yield* Region;
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
 
       const createTags = Effect.fn(function* (
         id: string,
@@ -140,36 +140,52 @@ export const EgressOnlyInternetGatewayProvider = () =>
           // Tags can be updated in-place
         }),
 
-        create: Effect.fn(function* ({ id, news, session }) {
-          yield* session.note("Creating Egress-Only Internet Gateway...");
-
-          const result = yield* ec2.createEgressOnlyInternetGateway({
-            VpcId: news.vpcId as string,
-            TagSpecifications: [
-              {
-                ResourceType: "egress-only-internet-gateway",
-                Tags: createTagsList(yield* createTags(id, news.tags)),
-              },
-            ],
-            DryRun: false,
-          });
-
-          const eigwId =
-            result.EgressOnlyInternetGateway!.EgressOnlyInternetGatewayId!;
-          yield* session.note(
-            `Egress-Only Internet Gateway created: ${eigwId}`,
-          );
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const desiredTags = yield* createTags(id, news.tags);
 
-          const gw = yield* describeEgressOnlyInternetGateway(eigwId);
-          return toAttrs(gw);
-        }),
+          // Observe — find the EIGW via cached id, else fall through to create.
+          let gw: ec2.EgressOnlyInternetGateway | undefined;
+          if (output?.egressOnlyInternetGatewayId) {
+            const lookup = yield* ec2
+              .describeEgressOnlyInternetGateways({
+                EgressOnlyInternetGatewayIds: [
+                  output.egressOnlyInternetGatewayId,
+                ],
+              })
+              .pipe(
+                Effect.catchTag(
+                  "InvalidEgressOnlyInternetGatewayId.NotFound",
+                  () => Effect.succeed({ EgressOnlyInternetGateways: [] }),
+                ),
+              );
+            gw = lookup.EgressOnlyInternetGateways?.[0];
+          }
 
-        update: Effect.fn(function* ({ id, news, output, session }) {
-          const eigwId = output.egressOnlyInternetGatewayId;
+          // Ensure — create the EIGW if it isn't there yet.
+          if (gw === undefined) {
+            yield* session.note("Creating Egress-Only Internet Gateway...");
+            const result = yield* ec2.createEgressOnlyInternetGateway({
+              VpcId: news.vpcId as string,
+              TagSpecifications: [
+                {
+                  ResourceType: "egress-only-internet-gateway",
+                  Tags: createTagsList(desiredTags),
+                },
+              ],
+              DryRun: false,
+            });
+            const newGwId =
+              result.EgressOnlyInternetGateway!.EgressOnlyInternetGatewayId!;
+            yield* session.note(
+              `Egress-Only Internet Gateway created: ${newGwId}`,
+            );
+            gw = yield* describeEgressOnlyInternetGateway(newGwId);
+          }
 
-          // Handle tag updates
-          const newTags = yield* createTags(id, news.tags);
-          const oldTags =
+          const eigwId = gw.EgressOnlyInternetGatewayId!;
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags =
             (yield* ec2
               .describeTags({
                 Filters: [
@@ -188,9 +204,7 @@ export const EgressOnlyInternetGatewayProvider = () =>
                     ) as Record<string, string>,
                 ),
               )) ?? {};
-
-          const { removed, upsert } = diffTags(oldTags, newTags);
-
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
           if (removed.length > 0) {
             yield* ec2.deleteTags({
               Resources: [eigwId],
@@ -204,11 +218,11 @@ export const EgressOnlyInternetGatewayProvider = () =>
               Tags: upsert,
               DryRun: false,
             });
-            yield* session.note("Updated tags");
           }
 
-          const gw = yield* describeEgressOnlyInternetGateway(eigwId);
-          return toAttrs(gw);
+          // Re-read to reflect current cloud state in the returned attributes.
+          const final = yield* describeEgressOnlyInternetGateway(eigwId);
+          return toAttrs(final);
         }),
 
         delete: Effect.fn(function* ({ output, session }) {

package/src/AWS/EC2/Instance.ts

@@ -15,7 +15,6 @@ import type { Input } from "../../Input.ts";
 import { Platform, type Main, type PlatformProps } from "../../Platform.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
 import type { ServerHost } from "../../Server/Process.ts";
 import { Stack } from "../../Stack.ts";
 import { Stage } from "../../Stage.ts";
@@ -24,15 +23,16 @@ import {
   createInternalTags,
   diffTags,
 } from "../../Tags.ts";
-import type { AccountID } from "../Account.ts";
-import { Account } from "../Account.ts";
 import { Assets } from "../Assets.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import type { PolicyStatement } from "../IAM/Policy.ts";
+import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
 import {
-  createEc2HostExecutionContext,
+  createEc2HostRuntimeContext,
   createEc2HostedSupport,
-  type Ec2HostExecutionContext,
+  type Ec2HostRuntimeContext,
 } from "./hosted.ts";
 import type { SecurityGroupId } from "./SecurityGroup.ts";
 import type { SubnetId } from "./Subnet.ts";
@@ -263,7 +263,7 @@ export type InstanceServices = ServerHost | Credentials | Region;
 
 export type InstanceShape = Main<InstanceServices>;
 
-export type InstanceExecutionContext = Ec2HostExecutionContext;
+export type InstanceRuntimeContext = Ec2HostRuntimeContext;
 
 /**
  * An EC2 instance that can either act as a low-level compute primitive or run
@@ -306,9 +306,9 @@ export const Instance: Platform<
   Instance,
   InstanceServices,
   InstanceShape,
-  InstanceExecutionContext
+  InstanceRuntimeContext
 > = Platform("AWS.EC2.Instance", {
-  createExecutionContext: createEc2HostExecutionContext("AWS.EC2.Instance"),
+  createRuntimeContext: createEc2HostRuntimeContext("AWS.EC2.Instance"),
 });
 
 export const InstanceProvider = () =>
@@ -316,7 +316,7 @@ export const InstanceProvider = () =>
     Instance,
     Effect.gen(function* () {
       const region = yield* Region;
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
       const stack = yield* Stack;
       const stage = yield* Stage;
       const fs = yield* FileSystem.FileSystem;
@@ -637,8 +637,14 @@ export const InstanceProvider = () =>
               }
             : undefined;
         }),
-        create: Effect.fn(function* ({ id, news, output, bindings, session }) {
-          const tags = {
+        reconcile: Effect.fn(function* ({
+          id,
+          news,
+          output,
+          bindings,
+          session,
+        }) {
+          const desiredTags = {
             ...(yield* createInternalTags(id)),
             ...news.tags,
           };
@@ -649,7 +655,11 @@ export const InstanceProvider = () =>
             output,
           });
 
-          const existing = output?.instanceId
+          // Observe — try the cached instanceId first, then fall back to the
+          // alchemy-tag search for recovery from interrupted creates. EC2
+          // assigns instance IDs server-side so we always read the live
+          // record before deciding whether to launch a new one.
+          let instance: ec2.Instance | undefined = output?.instanceId
             ? yield* describeInstance(output.instanceId).pipe(
                 Effect.catchTag("InvalidInstanceID.NotFound", () =>
                   Effect.succeed(undefined),
@@ -660,143 +670,105 @@ export const InstanceProvider = () =>
               )
             : yield* findInstanceByTags(id);
 
-          if (existing) {
-            return {
-              ...toAttributes(existing),
-              instanceProfileName:
-                runtime.instanceProfileName ?? output?.instanceProfileName,
-              roleArn: runtime.roleArn,
-              roleName: runtime.roleName,
-              policyName: runtime.policyName,
-              managedIam: runtime.managedIam,
-              runtimeUnitName: runtime.runtimeUnitName,
-              assetPrefix: runtime.assetPrefix,
-              code: runtime.code,
-            };
-          }
-
-          const created = yield* ec2
-            .runInstances(buildRunInstancesRequest(news, runtime, tags))
-            .pipe(
-              Effect.retry({
-                while: isPendingInstanceProfileError,
-                schedule: Schedule.exponential("500 millis").pipe(
-                  Schedule.both(Schedule.recurs(8)),
-                ),
-              }),
-            );
-
-          const instanceId = created.Instances?.[0]?.InstanceId as
-            | InstanceId
-            | undefined;
-          if (!instanceId) {
-            return yield* Effect.fail(
-              new Error(`RunInstances returned no instance ID for '${id}'`),
-            );
+          // A terminated instance is a tombstone; treat as missing so we
+          // launch a fresh one.
+          if (instance && instance.State?.Name === "terminated") {
+            instance = undefined;
           }
 
-          yield* session.note(instanceId);
-          const instance = yield* waitForState({
-            instanceId,
-            states: ["running"],
-            session,
-          });
-
-          if (news.sourceDestCheck !== undefined) {
-            yield* ec2.modifyInstanceAttribute({
-              InstanceId: instanceId,
-              SourceDestCheck: {
-                Value: news.sourceDestCheck,
-              },
+          // Ensure — RunInstances when no live instance was observed. The
+          // initial sourceDestCheck is set here because RunInstances itself
+          // doesn't accept it.
+          if (instance === undefined) {
+            const created = yield* ec2
+              .runInstances(
+                buildRunInstancesRequest(news, runtime, desiredTags),
+              )
+              .pipe(
+                Effect.retry({
+                  while: isPendingInstanceProfileError,
+                  schedule: Schedule.exponential("500 millis").pipe(
+                    Schedule.both(Schedule.recurs(8)),
+                  ),
+                }),
+              );
+            const newInstanceId = created.Instances?.[0]?.InstanceId as
+              | InstanceId
+              | undefined;
+            if (!newInstanceId) {
+              return yield* Effect.fail(
+                new Error(`RunInstances returned no instance ID for '${id}'`),
+              );
+            }
+            yield* session.note(newInstanceId);
+            instance = yield* waitForState({
+              instanceId: newInstanceId,
+              states: ["running"],
+              session,
             });
+            if (news.sourceDestCheck !== undefined) {
+              yield* ec2.modifyInstanceAttribute({
+                InstanceId: newInstanceId,
+                SourceDestCheck: { Value: news.sourceDestCheck },
+              });
+            }
           }
 
-          const refreshed = yield* describeInstance(instanceId).pipe(
-            Effect.catchTag("InvalidInstanceID.NotFound", () =>
-              Effect.succeed(undefined),
-            ),
-            Effect.catchTag("InstanceNotFound", () =>
-              Effect.succeed(undefined),
-            ),
-          );
-          return {
-            ...toAttributes(refreshed ?? instance),
-            instanceProfileName: runtime.instanceProfileName,
-            roleArn: runtime.roleArn,
-            roleName: runtime.roleName,
-            policyName: runtime.policyName,
-            managedIam: runtime.managedIam,
-            runtimeUnitName: runtime.runtimeUnitName,
-            assetPrefix: runtime.assetPrefix,
-            code: runtime.code,
-          };
-        }),
-        update: Effect.fn(function* ({
-          id,
-          news,
-          olds,
-          output,
-          bindings,
-          session,
-        }) {
-          const desiredTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const runtime = yield* hosted.resolveHostedRuntime({
-            id,
-            news,
-            bindings,
-            output,
-          });
+          const instanceId = instance.InstanceId as InstanceId;
           let restarted = false;
 
+          // Sync security groups — observed primary-ENI groups vs desired.
+          const observedSecurityGroups = (instance.SecurityGroups ?? [])
+            .map((g) => g.GroupId)
+            .filter((g): g is string => Boolean(g));
+          const desiredSecurityGroups = resolvedSecurityGroups(
+            news.securityGroupIds,
+          );
           if (
-            JSON.stringify(resolvedSecurityGroups(olds.securityGroupIds)) !==
-            JSON.stringify(resolvedSecurityGroups(news.securityGroupIds))
+            desiredSecurityGroups &&
+            JSON.stringify([...observedSecurityGroups].sort()) !==
+              JSON.stringify([...desiredSecurityGroups].sort())
           ) {
             yield* ec2.modifyInstanceAttribute({
-              InstanceId: output.instanceId,
-              Groups: resolvedSecurityGroups(news.securityGroupIds),
+              InstanceId: instanceId,
+              Groups: desiredSecurityGroups,
             });
           }
 
-          if (olds.sourceDestCheck !== news.sourceDestCheck) {
+          // Sync source/dest check — observed flag vs desired (default true).
+          const desiredSourceDestCheck = news.sourceDestCheck ?? true;
+          if ((instance.SourceDestCheck ?? true) !== desiredSourceDestCheck) {
             yield* ec2.modifyInstanceAttribute({
-              InstanceId: output.instanceId,
-              SourceDestCheck: {
-                Value: news.sourceDestCheck ?? true,
-              },
+              InstanceId: instanceId,
+              SourceDestCheck: { Value: desiredSourceDestCheck },
             });
           }
 
-          if (olds.instanceType !== news.instanceType) {
-            const before = yield* describeInstance(output.instanceId);
-            const wasRunning = before.State?.Name === "running";
+          // Sync instance type — observed type vs desired. Type changes need
+          // the instance stopped, then we restart it if it was running.
+          if (
+            news.instanceType &&
+            String(instance.InstanceType ?? "") !== news.instanceType
+          ) {
+            const wasRunning = instance.State?.Name === "running";
             if (wasRunning) {
-              yield* ec2.stopInstances({
-                InstanceIds: [output.instanceId],
-              });
+              yield* ec2.stopInstances({ InstanceIds: [instanceId] });
               yield* waitForState({
-                instanceId: output.instanceId,
+                instanceId,
                 states: ["stopped"],
                 session,
               });
             }
-
             yield* ec2.modifyInstanceAttribute({
-              InstanceId: output.instanceId,
+              InstanceId: instanceId,
               InstanceType: {
                 Value: news.instanceType as ec2.InstanceType,
               },
             });
-
             if (wasRunning) {
-              yield* ec2.startInstances({
-                InstanceIds: [output.instanceId],
-              });
+              yield* ec2.startInstances({ InstanceIds: [instanceId] });
               yield* waitForState({
-                instanceId: output.instanceId,
+                instanceId,
                 states: ["running"],
                 session,
               });
@@ -804,46 +776,53 @@ export const InstanceProvider = () =>
             }
           }
 
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, desiredTags);
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (instance.Tags ?? [])
+              .filter((t): t is { Key: string; Value: string } =>
+                Boolean(t.Key && t.Value !== undefined),
+              )
+              .map((t) => [t.Key, t.Value]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
           if (removed.length > 0) {
             yield* ec2.deleteTags({
-              Resources: [output.instanceId],
+              Resources: [instanceId],
               Tags: removed.map((key) => ({ Key: key })),
             });
           }
           if (upsert.length > 0) {
             yield* ec2.createTags({
-              Resources: [output.instanceId],
+              Resources: [instanceId],
               Tags: upsert,
             });
           }
 
+          // Hosted-runtime reboot — picks up new bundle/env without an
+          // explicit instance-type cycle. Skip if the type-change path
+          // already restarted us.
           if (news.main && !restarted) {
-            yield* ec2.rebootInstances({
-              InstanceIds: [output.instanceId],
-            });
+            yield* ec2.rebootInstances({ InstanceIds: [instanceId] });
             yield* waitForState({
-              instanceId: output.instanceId,
+              instanceId,
               states: ["running"],
               session,
             });
           }
 
+          // Re-read final state so attributes reflect the post-sync cloud.
+          const final = yield* describeInstance(instanceId);
           return {
-            ...toAttributes(yield* describeInstance(output.instanceId)),
+            ...toAttributes(final),
             instanceProfileName:
-              runtime.instanceProfileName ?? output.instanceProfileName,
-            roleArn: runtime.roleArn ?? output.roleArn,
-            roleName: runtime.roleName ?? output.roleName,
-            policyName: runtime.policyName ?? output.policyName,
-            managedIam: runtime.managedIam ?? output.managedIam,
-            runtimeUnitName: runtime.runtimeUnitName ?? output.runtimeUnitName,
-            assetPrefix: runtime.assetPrefix ?? output.assetPrefix,
-            code: runtime.code ?? output.code,
+              runtime.instanceProfileName ?? output?.instanceProfileName,
+            roleArn: runtime.roleArn ?? output?.roleArn,
+            roleName: runtime.roleName ?? output?.roleName,
+            policyName: runtime.policyName ?? output?.policyName,
+            managedIam: runtime.managedIam ?? output?.managedIam,
+            runtimeUnitName: runtime.runtimeUnitName ?? output?.runtimeUnitName,
+            assetPrefix: runtime.assetPrefix ?? output?.assetPrefix,
+            code: runtime.code ?? output?.code,
           };
         }),
         delete: Effect.fn(function* ({ output, session }) {