alchemy 2.0.0-beta.30 → 2.0.0-beta.31

package/lib/AWS/IAM/SAMLProvider.js

@@ -56,82 +56,95 @@ export const SAMLProviderProvider = () => Provider.succeed(SAMLProvider, {
             tags: toTagRecord(tags.Tags),
         };
     }),
-    create: Effect.fn(function* ({ id, news, session }) {
+    reconcile: Effect.fn(function* ({ id, news, output, session }) {
         const internalTags = yield* createInternalTags(id);
-        const tags = {
+        const desiredTags = {
             ...internalTags,
             ...news.tags,
         };
-        const response = yield* iam
-            .createSAMLProvider({
-            Name: news.name,
-            SAMLMetadataDocument: news.samlMetadataDocument,
-            AssertionEncryptionMode: news.assertionEncryptionMode,
-            AddPrivateKey: news.addPrivateKey
-                ? unwrapRedactedString(news.addPrivateKey)
-                : undefined,
-            Tags: Object.entries(tags).map(([Key, Value]) => ({
-                Key,
-                Value,
-            })),
-        })
-            .pipe(Effect.catchTag("EntityAlreadyExistsException", () => Effect.gen(function* () {
-            const accountId = (yield* AWSEnvironment).accountId;
-            const existingArn = `arn:aws:iam::${accountId}:saml-provider/${news.name}`;
-            const existingTags = yield* iam.listSAMLProviderTags({
-                SAMLProviderArn: existingArn,
+        const accountId = (yield* AWSEnvironment).accountId;
+        const samlProviderArn = output?.samlProviderArn ??
+            `arn:aws:iam::${accountId}:saml-provider/${news.name}`;
+        // Observe — `getSAMLProvider` returns the metadata, encryption
+        // mode, and UUID; absence is `NoSuchEntityException`.
+        let observed = yield* iam
+            .getSAMLProvider({ SAMLProviderArn: samlProviderArn })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+        // Ensure — create when missing. Race with a peer is recovered by
+        // verifying alchemy ownership tags on the existing provider.
+        if (!observed) {
+            const created = yield* iam
+                .createSAMLProvider({
+                Name: news.name,
+                SAMLMetadataDocument: news.samlMetadataDocument,
+                AssertionEncryptionMode: news.assertionEncryptionMode,
+                AddPrivateKey: news.addPrivateKey
+                    ? unwrapRedactedString(news.addPrivateKey)
+                    : undefined,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                    Key,
+                    Value,
+                })),
+            })
+                .pipe(Effect.catchTag("EntityAlreadyExistsException", () => Effect.gen(function* () {
+                const existingTags = yield* iam.listSAMLProviderTags({
+                    SAMLProviderArn: samlProviderArn,
+                });
+                if (!hasTags(internalTags, existingTags.Tags)) {
+                    return yield* Effect.fail(new Error(`SAML provider '${news.name}' already exists and is not managed by alchemy`));
+                }
+                return { SAMLProviderArn: samlProviderArn };
+            })));
+            observed = yield* iam.getSAMLProvider({
+                SAMLProviderArn: created.SAMLProviderArn ?? samlProviderArn,
             });
-            if (!hasTags(internalTags, existingTags.Tags)) {
-                return yield* Effect.fail(new Error(`SAML provider '${news.name}' already exists and is not managed by alchemy`));
+        }
+        else {
+            // Sync metadata / encryption mode — `updateSAMLProvider` is a
+            // partial update; only push the doc when it actually differs.
+            if ((observed.SAMLMetadataDocument ?? undefined) !==
+                news.samlMetadataDocument ||
+                observed.AssertionEncryptionMode !== news.assertionEncryptionMode ||
+                news.addPrivateKey !== undefined) {
+                yield* iam.updateSAMLProvider({
+                    SAMLProviderArn: samlProviderArn,
+                    SAMLMetadataDocument: (observed.SAMLMetadataDocument ?? undefined) !==
+                        news.samlMetadataDocument
+                        ? news.samlMetadataDocument
+                        : undefined,
+                    AssertionEncryptionMode: news.assertionEncryptionMode,
+                    AddPrivateKey: news.addPrivateKey
+                        ? unwrapRedactedString(news.addPrivateKey)
+                        : undefined,
+                });
             }
-            return { SAMLProviderArn: existingArn };
-        })));
-        const samlProviderArn = response.SAMLProviderArn ?? news.name;
-        yield* session.note(samlProviderArn);
-        return {
-            samlProviderArn,
-            name: news.name,
-            samlProviderUUID: undefined,
-            samlMetadataDocument: news.samlMetadataDocument,
-            assertionEncryptionMode: news.assertionEncryptionMode,
-            tags,
-        };
-    }),
-    update: Effect.fn(function* ({ id, news, olds, output, session }) {
-        yield* iam.updateSAMLProvider({
-            SAMLProviderArn: output.samlProviderArn,
-            SAMLMetadataDocument: news.samlMetadataDocument !== olds.samlMetadataDocument
-                ? news.samlMetadataDocument
-                : undefined,
-            AssertionEncryptionMode: news.assertionEncryptionMode,
-            AddPrivateKey: news.addPrivateKey
-                ? unwrapRedactedString(news.addPrivateKey)
-                : undefined,
+        }
+        // Sync tags against the cloud's actual tags.
+        const observedTagsResp = yield* iam.listSAMLProviderTags({
+            SAMLProviderArn: samlProviderArn,
         });
-        const internalTags = yield* createInternalTags(id);
-        const oldTags = { ...internalTags, ...(olds.tags ?? {}) };
-        const newTags = { ...internalTags, ...(news.tags ?? {}) };
-        const { removed, upsert } = diffTags(oldTags, newTags);
+        const observedTags = toTagRecord(observedTagsResp.Tags);
+        const { removed, upsert } = diffTags(observedTags, desiredTags);
         if (upsert.length > 0) {
             yield* iam.tagSAMLProvider({
-                SAMLProviderArn: output.samlProviderArn,
+                SAMLProviderArn: samlProviderArn,
                 Tags: upsert,
             });
         }
         if (removed.length > 0) {
             yield* iam.untagSAMLProvider({
-                SAMLProviderArn: output.samlProviderArn,
+                SAMLProviderArn: samlProviderArn,
                 TagKeys: removed,
             });
         }
-        yield* session.note(output.samlProviderArn);
+        yield* session.note(samlProviderArn);
         return {
-            samlProviderArn: output.samlProviderArn,
-            name: output.name,
-            samlProviderUUID: output.samlProviderUUID,
+            samlProviderArn,
+            name: news.name,
+            samlProviderUUID: observed?.SAMLProviderUUID ?? output?.samlProviderUUID,
             samlMetadataDocument: news.samlMetadataDocument,
             assertionEncryptionMode: news.assertionEncryptionMode,
-            tags: newTags,
+            tags: desiredTags,
         };
     }),
     delete: Effect.fn(function* ({ output }) {

package/lib/AWS/IAM/SAMLProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"SAMLProvider.js","sourceRoot":"","sources":["../../../src/AWS/IAM/SAMLProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAwChE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAe,sBAAsB,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE;IAC7B,OAAO,EAAE,CAAC,iBAAiB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,eAAe,CAAC;YACf,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAC3C,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;QACH,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;SAC7B,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QAChD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG;YACX,GAAG,YAAY;YACf,GAAG,IAAI,CAAC,IAAI;SACb,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,kBAAkB,CAAC;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,aAAa,EAAE,IAAI,CAAC,aAAa;gBAC/B,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC;gBAC1C,CAAC,CAAC,SAAS;YACb,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,GAAG;gBACH,KAAK;aACN,CAAC,CAAC;SACJ,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC;YACpD,MAAM,WAAW,GAAG,gBAAgB,SAAS,kBAAkB,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3E,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;gBACnD,eAAe,EAAE,WAAW;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,kBAAkB,IAAI,CAAC,IAAI,gDAAgD,CAC5E,CACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC;QAC1C,CAAC,CAAC,CACH,CACF,CAAC;QACJ,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC;QAC9D,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACrC,OAAO;YACL,eAAe;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,SAAS;YAC3B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,IAAI;SACL,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAC9D,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC5B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,oBAAoB,EAClB,IAAI,CAAC,oBAAoB,KAAK,IAAI,CAAC,oBAAoB;gBACrD,CAAC,CAAC,IAAI,CAAC,oBAAoB;gBAC3B,CAAC,CAAC,SAAS;YACf,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,aAAa,EAAE,IAAI,CAAC,aAAa;gBAC/B,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC;gBAC1C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;gBACzB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC5C,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,IAAI,EAAE,OAAO;SACd,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,GAAG;aACP,kBAAkB,CAAC;YAClB,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC;CACH,CAAC,CAAC"}
+{"version":3,"file":"SAMLProvider.js","sourceRoot":"","sources":["../../../src/AWS/IAM/SAMLProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAwChE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAe,sBAAsB,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE;IAC7B,OAAO,EAAE,CAAC,iBAAiB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,eAAe,CAAC;YACf,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAC3C,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;QACH,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;SAC7B,CAAC;IACJ,CAAC,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3D,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG;YAClB,GAAG,YAAY;YACf,GAAG,IAAI,CAAC,IAAI;SACb,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC;QACpD,MAAM,eAAe,GACnB,MAAM,EAAE,eAAe;YACvB,gBAAgB,SAAS,kBAAkB,IAAI,CAAC,IAAI,EAAE,CAAC;QAEzD,+DAA+D;QAC/D,sDAAsD;QACtD,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACtB,eAAe,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;aACrD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QAEJ,iEAAiE;QACjE,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG;iBACvB,kBAAkB,CAAC;gBAClB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;gBAC/C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;gBACrD,aAAa,EAAE,IAAI,CAAC,aAAa;oBAC/B,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC;oBAC1C,CAAC,CAAC,SAAS;gBACb,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;oBACvD,GAAG;oBACH,KAAK;iBACN,CAAC,CAAC;aACJ,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBACnD,eAAe,EAAE,eAAe;iBACjC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,kBAAkB,IAAI,CAAC,IAAI,gDAAgD,CAC5E,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;YAC9C,CAAC,CAAC,CACH,CACF,CAAC;YACJ,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;gBACpC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,eAAe;aAC5D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,8DAA8D;YAC9D,8DAA8D;YAC9D,IACE,CAAC,QAAQ,CAAC,oBAAoB,IAAI,SAAS,CAAC;gBAC1C,IAAI,CAAC,oBAAoB;gBAC3B,QAAQ,CAAC,uBAAuB,KAAK,IAAI,CAAC,uBAAuB;gBACjE,IAAI,CAAC,aAAa,KAAK,SAAS,EAChC,CAAC;gBACD,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;oBAC5B,eAAe,EAAE,eAAe;oBAChC,oBAAoB,EAClB,CAAC,QAAQ,CAAC,oBAAoB,IAAI,SAAS,CAAC;wBAC5C,IAAI,CAAC,oBAAoB;wBACvB,CAAC,CAAC,IAAI,CAAC,oBAAoB;wBAC3B,CAAC,CAAC,SAAS;oBACf,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,aAAa,EAAE,IAAI,CAAC,aAAa;wBAC/B,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC;wBAC1C,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACvD,eAAe,EAAE,eAAe;SACjC,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;gBACzB,eAAe,EAAE,eAAe;gBAChC,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAC3B,eAAe,EAAE,eAAe;gBAChC,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACrC,OAAO;YACL,eAAe;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EACd,QAAQ,EAAE,gBAAgB,IAAI,MAAM,EAAE,gBAAgB;YACxD,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,IAAI,EAAE,WAAW;SAClB,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,GAAG;aACP,kBAAkB,CAAC;YAClB,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC;CACH,CAAC,CAAC"}

package/lib/AWS/IAM/SSHPublicKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SSHPublicKey.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/SSHPublicKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAGhD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,sBAAsB,EACtB,iBAAiB,EACjB;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,SAAS,CAAC;CAC9B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,yDAAiD,CAAC;AAE3E,eAAO,MAAM,oBAAoB,0OA4F7B,CAAC"}
+{"version":3,"file":"SSHPublicKey.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/SSHPublicKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAGhD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,sBAAsB,EACtB,iBAAiB,EACjB;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,SAAS,CAAC;CAC9B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,yDAAiD,CAAC;AAE3E,eAAO,MAAM,oBAAoB,0OAsG7B,CAAC"}

package/lib/AWS/IAM/SSHPublicKey.js

@@ -56,45 +56,49 @@ export const SSHPublicKeyProvider = () => Provider.succeed(SSHPublicKey, {
             uploadDate: response.SSHPublicKey.UploadDate,
         };
     }),
-    create: Effect.fn(function* ({ news, session }) {
-        const created = yield* iam.uploadSSHPublicKey({
-            UserName: news.userName,
-            SSHPublicKeyBody: news.sshPublicKeyBody,
-        });
-        if (!created.SSHPublicKey?.SSHPublicKeyId) {
-            return yield* Effect.fail(new Error(`uploadSSHPublicKey returned no key id`));
-        }
-        if (news.status !== undefined &&
-            created.SSHPublicKey.Status !== news.status) {
-            yield* iam.updateSSHPublicKey({
+    reconcile: Effect.fn(function* ({ news, output, session }) {
+        // Observe — SSH key ids are AWS-generated; we can only locate the
+        // existing key when we have its id from a prior output. The body
+        // and identity are immutable (`diff` triggers replacement on body
+        // change), so a missing key always means we need to upload.
+        const observed = output
+            ? yield* iam
+                .getSSHPublicKey({
+                UserName: output.userName,
+                SSHPublicKeyId: output.sshPublicKeyId,
+                Encoding: "SSH",
+            })
+                .pipe(Effect.map((r) => r.SSHPublicKey), Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)))
+            : undefined;
+        // Ensure — upload when missing.
+        let key = observed;
+        if (!key?.SSHPublicKeyId) {
+            const uploaded = yield* iam.uploadSSHPublicKey({
                 UserName: news.userName,
-                SSHPublicKeyId: created.SSHPublicKey.SSHPublicKeyId,
-                Status: news.status,
+                SSHPublicKeyBody: news.sshPublicKeyBody,
             });
+            if (!uploaded.SSHPublicKey?.SSHPublicKeyId) {
+                return yield* Effect.fail(new Error(`uploadSSHPublicKey returned no key id`));
+            }
+            key = uploaded.SSHPublicKey;
         }
-        yield* session.note(created.SSHPublicKey.SSHPublicKeyId);
-        return {
-            userName: created.SSHPublicKey.UserName,
-            sshPublicKeyId: created.SSHPublicKey.SSHPublicKeyId,
-            fingerprint: created.SSHPublicKey.Fingerprint,
-            sshPublicKeyBody: created.SSHPublicKey.SSHPublicKeyBody,
-            status: news.status ?? created.SSHPublicKey.Status,
-            uploadDate: created.SSHPublicKey.UploadDate,
-        };
-    }),
-    update: Effect.fn(function* ({ news, output, session }) {
-        const status = news.status ?? output.status;
-        if (status !== output.status) {
+        // Sync — apply the desired status when it differs from observed.
+        const desiredStatus = news.status ?? key.Status;
+        if (desiredStatus !== key.Status) {
             yield* iam.updateSSHPublicKey({
-                UserName: output.userName,
-                SSHPublicKeyId: output.sshPublicKeyId,
-                Status: status,
+                UserName: news.userName,
+                SSHPublicKeyId: key.SSHPublicKeyId,
+                Status: desiredStatus,
             });
         }
-        yield* session.note(output.sshPublicKeyId);
+        yield* session.note(key.SSHPublicKeyId);
         return {
-            ...output,
-            status,
+            userName: key.UserName,
+            sshPublicKeyId: key.SSHPublicKeyId,
+            fingerprint: key.Fingerprint,
+            sshPublicKeyBody: key.SSHPublicKeyBody,
+            status: desiredStatus,
+            uploadDate: key.UploadDate,
         };
     }),
     delete: Effect.fn(function* ({ output }) {

package/lib/AWS/IAM/SSHPublicKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSHPublicKey.js","sourceRoot":"","sources":["../../../src/AWS/IAM/SSHPublicKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAkC7C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAe,sBAAsB,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE;IAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,IACE,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAC/B,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB,EAC/C,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,eAAe,CAAC;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,KAAK;SAChB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ;YACxC,cAAc,EAAE,QAAQ,CAAC,YAAY,CAAC,cAAc;YACpD,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,WAAW;YAC9C,gBAAgB,EAAE,QAAQ,CAAC,YAAY,CAAC,gBAAgB;YACxD,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM;YACpC,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,UAAU;SAC7C,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,uCAAuC,CAAC,CACnD,CAAC;QACJ,CAAC;QACD,IACE,IAAI,CAAC,MAAM,KAAK,SAAS;YACzB,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAC3C,CAAC;YACD,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,cAAc;gBACnD,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QACzD,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,QAAQ;YACvC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,cAAc;YACnD,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW;YAC7C,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC,gBAAgB;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM;YAClD,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,UAAU;SAC5C,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QAC5C,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7B,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC3C,OAAO;YACL,GAAG,MAAM;YACT,MAAM;SACP,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,GAAG;aACP,kBAAkB,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC;CACH,CAAC,CAAC"}
+{"version":3,"file":"SSHPublicKey.js","sourceRoot":"","sources":["../../../src/AWS/IAM/SSHPublicKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAkC7C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAe,sBAAsB,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE;IAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,IACE,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAC/B,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB,EAC/C,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,eAAe,CAAC;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,KAAK;SAChB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ;YACxC,cAAc,EAAE,QAAQ,CAAC,YAAY,CAAC,cAAc;YACpD,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,WAAW;YAC9C,gBAAgB,EAAE,QAAQ,CAAC,YAAY,CAAC,gBAAgB;YACxD,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM;YACpC,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,UAAU;SAC7C,CAAC;IACJ,CAAC,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QACvD,kEAAkE;QAClE,iEAAiE;QACjE,kEAAkE;QAClE,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,MAAM;YACrB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG;iBACP,eAAe,CAAC;gBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,QAAQ,EAAE,KAAK;aAChB,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EACjC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF;YACL,CAAC,CAAC,SAAS,CAAC;QAEd,gCAAgC;QAChC,IAAI,GAAG,GAAG,QAAQ,CAAC;QACnB,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,uCAAuC,CAAC,CACnD,CAAC;YACJ,CAAC;YACD,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC;QAC9B,CAAC;QAED,iEAAiE;QACjE,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;QAChD,IAAI,aAAa,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACjC,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,GAAG,CAAC,cAAe;gBACnC,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAe,CAAC,CAAC;QACzC,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,cAAc,EAAE,GAAG,CAAC,cAAe;YACnC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,GAAG;aACP,kBAAkB,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC;CACH,CAAC,CAAC"}

package/lib/AWS/IAM/ServerCertificate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServerCertificate.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/ServerCertificate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AASjD,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC/C;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,2BAA2B,EAC3B,sBAAsB,EACtB;IACE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,UAAU,EAAE,IAAI,GAAG,SAAS,CAAC;IAC7B,UAAU,EAAE,IAAI,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,8DAE7B,CAAC;AAEF,eAAO,MAAM,yBAAyB,iTAoLnC,CAAC"}
+{"version":3,"file":"ServerCertificate.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/ServerCertificate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AASjD,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC/C;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,2BAA2B,EAC3B,sBAAsB,EACtB;IACE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,UAAU,EAAE,IAAI,GAAG,SAAS,CAAC;IAC7B,UAAU,EAAE,IAAI,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,8DAE7B,CAAC;AAEF,eAAO,MAAM,yBAAyB,iTA+KnC,CAAC"}

package/lib/AWS/IAM/ServerCertificate.js

@@ -78,89 +78,79 @@ export const ServerCertificateProvider = () => Provider.effect(ServerCertificate
                 tags: toTagRecord(tags.Tags),
             };
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-            const name = yield* toName(id, news);
-            const tags = {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+            const name = output?.serverCertificateName ?? (yield* toName(id, news));
+            const desiredTags = {
                 ...(yield* createInternalTags(id)),
                 ...news.tags,
             };
-            const created = yield* iam
-                .uploadServerCertificate({
-                Path: news.path,
-                ServerCertificateName: name,
-                CertificateBody: news.certificateBody,
-                PrivateKey: typeof news.privateKey === "string"
-                    ? news.privateKey
-                    : Redacted.value(news.privateKey),
-                CertificateChain: news.certificateChain,
-                Tags: createTagsList(tags),
-            })
-                .pipe(Effect.catchTag("EntityAlreadyExistsException", () => Effect.gen(function* () {
-                const existing = yield* readCertificate(name);
-                if (!existing?.ServerCertificateMetadata?.Arn) {
-                    return yield* Effect.fail(new Error(`Server certificate '${name}' already exists but could not be described`));
-                }
-                if (!hasTags(tags, existing.Tags)) {
-                    return yield* Effect.fail(new Error(`Server certificate '${name}' already exists and is not managed by alchemy`));
+            // Observe — `getServerCertificate` returns the live cert (or
+            // absence). The cert body / chain are immutable (`diff`
+            // triggers replacement), so we never re-upload during sync.
+            let cert = yield* readCertificate(name);
+            // Ensure — upload when missing. On race, verify alchemy
+            // ownership tags; bail out otherwise.
+            if (!cert?.ServerCertificateMetadata?.Arn) {
+                const created = yield* iam
+                    .uploadServerCertificate({
+                    Path: news.path,
+                    ServerCertificateName: name,
+                    CertificateBody: news.certificateBody,
+                    PrivateKey: typeof news.privateKey === "string"
+                        ? news.privateKey
+                        : Redacted.value(news.privateKey),
+                    CertificateChain: news.certificateChain,
+                    Tags: createTagsList(desiredTags),
+                })
+                    .pipe(Effect.catchTag("EntityAlreadyExistsException", () => Effect.gen(function* () {
+                    const existing = yield* readCertificate(name);
+                    if (!existing?.ServerCertificateMetadata?.Arn) {
+                        return yield* Effect.fail(new Error(`Server certificate '${name}' already exists but could not be described`));
+                    }
+                    if (!hasTags(desiredTags, existing.Tags)) {
+                        return yield* Effect.fail(new Error(`Server certificate '${name}' already exists and is not managed by alchemy`));
+                    }
+                    return {
+                        ServerCertificateMetadata: existing.ServerCertificateMetadata,
+                    };
+                })));
+                if (!created.ServerCertificateMetadata?.Arn) {
+                    return yield* Effect.fail(new Error(`uploadServerCertificate returned no metadata`));
                 }
-                return {
-                    ServerCertificateMetadata: existing.ServerCertificateMetadata,
-                };
-            })));
-            const metadata = created.ServerCertificateMetadata;
-            if (!metadata?.Arn || !metadata.ServerCertificateName) {
-                return yield* Effect.fail(new Error(`uploadServerCertificate returned no metadata`));
+                cert = yield* readCertificate(name);
             }
-            yield* session.note(metadata.Arn);
-            return {
-                serverCertificateArn: metadata.Arn,
-                serverCertificateName: metadata.ServerCertificateName,
-                serverCertificateId: metadata.ServerCertificateId,
-                path: metadata.Path,
-                certificateBody: news.certificateBody,
-                certificateChain: news.certificateChain,
-                uploadDate: metadata.UploadDate,
-                expiration: metadata.Expiration,
-                tags,
-            };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-            const oldTags = {
-                ...(yield* createInternalTags(id)),
-                ...olds.tags,
-            };
-            const newTags = {
-                ...(yield* createInternalTags(id)),
-                ...news.tags,
-            };
-            const { removed, upsert } = diffTags(oldTags, newTags);
+            // Sync tags against the cloud's actual tags.
+            const observedTags = toTagRecord(cert?.Tags);
+            const { removed, upsert } = diffTags(observedTags, desiredTags);
             if (upsert.length > 0) {
                 yield* iam.tagServerCertificate({
-                    ServerCertificateName: output.serverCertificateName,
+                    ServerCertificateName: name,
                     Tags: upsert,
                 });
             }
             if (removed.length > 0) {
                 yield* iam.untagServerCertificate({
-                    ServerCertificateName: output.serverCertificateName,
+                    ServerCertificateName: name,
                     TagKeys: removed,
                 });
             }
-            const cert = yield* readCertificate(output.serverCertificateName);
-            yield* session.note(output.serverCertificateArn);
+            // Re-read for fresh metadata.
+            const fresh = yield* readCertificate(name);
+            const metadata = fresh?.ServerCertificateMetadata;
+            if (!metadata?.Arn || !metadata.ServerCertificateName) {
+                return yield* Effect.fail(new Error(`Server certificate '${name}' was not readable after sync`));
+            }
+            yield* session.note(metadata.Arn);
             return {
-                serverCertificateArn: cert?.ServerCertificateMetadata?.Arn ??
-                    output.serverCertificateArn,
-                serverCertificateName: cert?.ServerCertificateMetadata?.ServerCertificateName ??
-                    output.serverCertificateName,
-                serverCertificateId: cert?.ServerCertificateMetadata?.ServerCertificateId ??
-                    output.serverCertificateId,
-                path: cert?.ServerCertificateMetadata?.Path ?? output.path,
-                certificateBody: cert?.CertificateBody ?? output.certificateBody,
-                certificateChain: cert?.CertificateChain ?? output.certificateChain,
-                uploadDate: cert?.ServerCertificateMetadata?.UploadDate ?? output.uploadDate,
-                expiration: cert?.ServerCertificateMetadata?.Expiration ?? output.expiration,
-                tags: newTags,
+                serverCertificateArn: metadata.Arn,
+                serverCertificateName: metadata.ServerCertificateName,
+                serverCertificateId: metadata.ServerCertificateId,
+                path: metadata.Path,
+                certificateBody: fresh?.CertificateBody ?? news.certificateBody,
+                certificateChain: fresh?.CertificateChain ?? news.certificateChain,
+                uploadDate: metadata.UploadDate,
+                expiration: metadata.Expiration,
+                tags: desiredTags,
             };
         }),
         delete: Effect.fn(function* ({ output }) {

package/lib/AWS/IAM/ServerCertificate.js.map

@@ -1 +1 @@
-{"version":3,"file":"ServerCertificate.js","sourceRoot":"","sources":["../../../src/AWS/IAM/ServerCertificate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,OAAO,GACR,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgD1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CACvC,2BAA2B,CAC5B,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,EAAE,CAC5C,QAAQ,CAAC,MAAM,CACb,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,KAA6B,EAAE,EAAE,CAC3D,KAAK,CAAC,qBAAqB;QACzB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC;QAC7C,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAEjD,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAY;QACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,oBAAoB,CAAC;YACpB,qBAAqB,EAAE,IAAI;SAC5B,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,OAAO,QAAQ,EAAE,iBAAiB,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE;YACP,sBAAsB;YACtB,uBAAuB;YACvB,qBAAqB;SACtB;QACD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IACE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAK,EAA6B,CAAC,CAAC;gBACzD,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC3B,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;gBACzC,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;gBAC7C,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB,EAC/C,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,IAAI,GACR,MAAM,EAAE,qBAAqB;gBAC7B,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAK,EAA6B,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAAC;gBAC1C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC;gBAChD,qBAAqB,EAAE,IAAI;aAC5B,CAAC,CAAC;YACH,OAAO;gBACL,oBAAoB,EAAE,IAAI,CAAC,yBAAyB,CAAC,GAAG;gBACxD,qBAAqB,EACnB,IAAI,CAAC,yBAAyB,CAAC,qBAAqB;gBACtD,mBAAmB,EACjB,IAAI,CAAC,yBAAyB,CAAC,mBAAmB;gBACpD,IAAI,EAAE,IAAI,CAAC,yBAAyB,CAAC,IAAI;gBACzC,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,UAAU,EAAE,IAAI,CAAC,yBAAyB,CAAC,UAAU;gBACrD,UAAU,EAAE,IAAI,CAAC,yBAAyB,CAAC,UAAU;gBACrD,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;aAC7B,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG;gBACX,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YACF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG;iBACvB,uBAAuB,CAAC;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,qBAAqB,EAAE,IAAI;gBAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,UAAU,EACR,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;oBACjC,CAAC,CAAC,IAAI,CAAC,UAAU;oBACjB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;gBACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;aAC3B,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAC9C,IAAI,CAAC,QAAQ,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAAC;oBAC9C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,uBAAuB,IAAI,6CAA6C,CACzE,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,uBAAuB,IAAI,gDAAgD,CAC5E,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,yBAAyB,EACvB,QAAQ,CAAC,yBAAyB;iBACrC,CAAC;YACJ,CAAC,CAAC,CACH,CACF,CAAC;YACJ,MAAM,QAAQ,GAAG,OAAO,CAAC,yBAAyB,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;gBACtD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAC1D,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClC,OAAO;gBACL,oBAAoB,EAAE,QAAQ,CAAC,GAAG;gBAClC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;gBACrD,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;gBACjD,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,IAAI;aACL,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9D,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YACF,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YACF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBAC9B,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;oBACnD,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;oBAChC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;oBACnD,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAClE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACjD,OAAO;gBACL,oBAAoB,EAClB,IAAI,EAAE,yBAAyB,EAAE,GAAG;oBACpC,MAAM,CAAC,oBAAoB;gBAC7B,qBAAqB,EACnB,IAAI,EAAE,yBAAyB,EAAE,qBAAqB;oBACtD,MAAM,CAAC,qBAAqB;gBAC9B,mBAAmB,EACjB,IAAI,EAAE,yBAAyB,EAAE,mBAAmB;oBACpD,MAAM,CAAC,mBAAmB;gBAC5B,IAAI,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;gBAC1D,eAAe,EAAE,IAAI,EAAE,eAAe,IAAI,MAAM,CAAC,eAAe;gBAChE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,IAAI,MAAM,CAAC,gBAAgB;gBACnE,UAAU,EACR,IAAI,EAAE,yBAAyB,EAAE,UAAU,IAAI,MAAM,CAAC,UAAU;gBAClE,UAAU,EACR,IAAI,EAAE,yBAAyB,EAAE,UAAU,IAAI,MAAM,CAAC,UAAU;gBAClE,IAAI,EAAE,OAAO;aACd,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,GAAG;iBACP,uBAAuB,CAAC;gBACvB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;aACpD,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}
+{"version":3,"file":"ServerCertificate.js","sourceRoot":"","sources":["../../../src/AWS/IAM/ServerCertificate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,OAAO,GACR,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgD1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CACvC,2BAA2B,CAC5B,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,EAAE,CAC5C,QAAQ,CAAC,MAAM,CACb,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,KAA6B,EAAE,EAAE,CAC3D,KAAK,CAAC,qBAAqB;QACzB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC;QAC7C,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAEjD,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAY;QACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,oBAAoB,CAAC;YACpB,qBAAqB,EAAE,IAAI;SAC5B,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,OAAO,QAAQ,EAAE,iBAAiB,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE;YACP,sBAAsB;YACtB,uBAAuB;YACvB,qBAAqB;SACtB;QACD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IACE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAK,EAA6B,CAAC,CAAC;gBACzD,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC3B,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;gBACzC,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;gBAC7C,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB,EAC/C,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,IAAI,GACR,MAAM,EAAE,qBAAqB;gBAC7B,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAK,EAA6B,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAAC;gBAC1C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC;gBAChD,qBAAqB,EAAE,IAAI;aAC5B,CAAC,CAAC;YACH,OAAO;gBACL,oBAAoB,EAAE,IAAI,CAAC,yBAAyB,CAAC,GAAG;gBACxD,qBAAqB,EACnB,IAAI,CAAC,yBAAyB,CAAC,qBAAqB;gBACtD,mBAAmB,EACjB,IAAI,CAAC,yBAAyB,CAAC,mBAAmB;gBACpD,IAAI,EAAE,IAAI,CAAC,yBAAyB,CAAC,IAAI;gBACzC,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,UAAU,EAAE,IAAI,CAAC,yBAAyB,CAAC,UAAU;gBACrD,UAAU,EAAE,IAAI,CAAC,yBAAyB,CAAC,UAAU;gBACrD,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;aAC7B,CAAC;QACJ,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3D,MAAM,IAAI,GACR,MAAM,EAAE,qBAAqB,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG;gBAClB,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YAEF,6DAA6D;YAC7D,wDAAwD;YACxD,4DAA4D;YAC5D,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAExC,wDAAwD;YACxD,sCAAsC;YACtC,IAAI,CAAC,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG;qBACvB,uBAAuB,CAAC;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,qBAAqB,EAAE,IAAI;oBAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;oBACrC,UAAU,EACR,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;wBACjC,CAAC,CAAC,IAAI,CAAC,UAAU;wBACjB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;oBACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC;iBAClC,CAAC;qBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;oBAC9C,IAAI,CAAC,QAAQ,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAAC;wBAC9C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,uBAAuB,IAAI,6CAA6C,CACzE,CACF,CAAC;oBACJ,CAAC;oBACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;wBACzC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,uBAAuB,IAAI,gDAAgD,CAC5E,CACF,CAAC;oBACJ,CAAC;oBACD,OAAO;wBACL,yBAAyB,EACvB,QAAQ,CAAC,yBAAyB;qBACrC,CAAC;gBACJ,CAAC,CAAC,CACH,CACF,CAAC;gBACJ,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC;oBAC5C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAC1D,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;YAED,6CAA6C;YAC7C,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBAC9B,qBAAqB,EAAE,IAAI;oBAC3B,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;oBAChC,qBAAqB,EAAE,IAAI;oBAC3B,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,8BAA8B;YAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,yBAAyB,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;gBACtD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,uBAAuB,IAAI,+BAA+B,CAC3D,CACF,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClC,OAAO;gBACL,oBAAoB,EAAE,QAAQ,CAAC,GAAG;gBAClC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;gBACrD,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;gBACjD,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,eAAe,EAAE,KAAK,EAAE,eAAe,IAAI,IAAI,CAAC,eAAe;gBAC/D,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,IAAI,IAAI,CAAC,gBAAgB;gBAClE,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,IAAI,EAAE,WAAW;aAClB,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,GAAG;iBACP,uBAAuB,CAAC;gBACvB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;aACpD,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/AWS/IAM/ServiceSpecificCredential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServiceSpecificCredential.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/ServiceSpecificCredential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAEhD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,yBAA0B,SAAQ,QAAQ,CACzD,mCAAmC,EACnC,8BAA8B,EAC9B;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,2BAA2B,EAAE,MAAM,CAAC;IACpC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,SAAS,CAAC;IAC7B,cAAc,EAAE,IAAI,GAAG,SAAS,CAAC;IACjC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACvD,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CAChE,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,yBAAyB,sEAErC,CAAC;AAEF,eAAO,MAAM,iCAAiC,uPAsG1C,CAAC"}
+{"version":3,"file":"ServiceSpecificCredential.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/ServiceSpecificCredential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAEhD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,yBAA0B,SAAQ,QAAQ,CACzD,mCAAmC,EACnC,8BAA8B,EAC9B;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,2BAA2B,EAAE,MAAM,CAAC;IACpC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,SAAS,CAAC;IAC7B,cAAc,EAAE,IAAI,GAAG,SAAS,CAAC;IACjC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACvD,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CAChE,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,yBAAyB,sEAErC,CAAC;AAEF,eAAO,MAAM,iCAAiC,uPA2J1C,CAAC"}

package/lib/AWS/IAM/ServiceSpecificCredential.js

@@ -64,50 +64,80 @@ export const ServiceSpecificCredentialProvider = () => Provider.succeed(ServiceS
             serviceCredentialSecret: output.serviceCredentialSecret,
         };
     }),
-    create: Effect.fn(function* ({ news, session }) {
-        const created = yield* iam.createServiceSpecificCredential({
-            UserName: news.userName,
-            ServiceName: news.serviceName,
-            CredentialAgeDays: news.credentialAgeDays,
-        });
-        const credential = created.ServiceSpecificCredential;
-        if (!credential?.ServiceSpecificCredentialId) {
-            return yield* Effect.fail(new Error(`createServiceSpecificCredential returned no credential id`));
-        }
-        if (news.status !== undefined && credential.Status !== news.status) {
-            yield* iam.updateServiceSpecificCredential({
+    reconcile: Effect.fn(function* ({ news, output, session }) {
+        // Observe — credential ids are AWS-generated; we can only locate
+        // the existing record via the prior output. The credential's
+        // identity (userName, serviceName, age) is immutable (`diff`
+        // triggers replacement on change), so a missing credential always
+        // requires recreation.
+        const observed = output
+            ? yield* iam
+                .listServiceSpecificCredentials({
+                UserName: output.userName,
+                ServiceName: output.serviceName,
+            })
+                .pipe(Effect.map((r) => r.ServiceSpecificCredentials?.find((entry) => entry.ServiceSpecificCredentialId ===
+                output.serviceSpecificCredentialId)), Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)))
+            : undefined;
+        // Ensure — create when missing. The secret fields are only
+        // returned on first creation, so adoption preserves the prior
+        // redacted values.
+        let credentialId = observed?.ServiceSpecificCredentialId ??
+            output?.serviceSpecificCredentialId;
+        let userName = observed?.UserName ?? output?.userName ?? news.userName;
+        let serviceName = observed?.ServiceName ?? output?.serviceName ?? news.serviceName;
+        let createDate = observed?.CreateDate ?? output?.createDate;
+        let expirationDate = observed?.ExpirationDate ?? output?.expirationDate;
+        let serviceUserName = observed?.ServiceUserName ?? output?.serviceUserName;
+        let serviceCredentialAlias = observed?.ServiceCredentialAlias ?? output?.serviceCredentialAlias;
+        let servicePassword = output?.servicePassword;
+        let serviceCredentialSecret = output?.serviceCredentialSecret;
+        let observedStatus = observed?.Status ?? output?.status;
+        if (!observed) {
+            const created = yield* iam.createServiceSpecificCredential({
                 UserName: news.userName,
-                ServiceSpecificCredentialId: credential.ServiceSpecificCredentialId,
-                Status: news.status,
+                ServiceName: news.serviceName,
+                CredentialAgeDays: news.credentialAgeDays,
             });
+            const credential = created.ServiceSpecificCredential;
+            if (!credential?.ServiceSpecificCredentialId) {
+                return yield* Effect.fail(new Error(`createServiceSpecificCredential returned no credential id`));
+            }
+            credentialId = credential.ServiceSpecificCredentialId;
+            userName = credential.UserName;
+            serviceName = credential.ServiceName;
+            createDate = credential.CreateDate;
+            expirationDate = credential.ExpirationDate;
+            serviceUserName = credential.ServiceUserName;
+            serviceCredentialAlias = credential.ServiceCredentialAlias;
+            servicePassword = toRedactedString(credential.ServicePassword);
+            serviceCredentialSecret = toRedactedString(credential.ServiceCredentialSecret);
+            observedStatus = credential.Status;
         }
-        yield* session.note(credential.ServiceSpecificCredentialId);
-        return {
-            userName: credential.UserName,
-            serviceName: credential.ServiceName,
-            serviceSpecificCredentialId: credential.ServiceSpecificCredentialId,
-            status: news.status ?? credential.Status,
-            createDate: credential.CreateDate,
-            expirationDate: credential.ExpirationDate,
-            serviceUserName: credential.ServiceUserName,
-            serviceCredentialAlias: credential.ServiceCredentialAlias,
-            servicePassword: toRedactedString(credential.ServicePassword),
-            serviceCredentialSecret: toRedactedString(credential.ServiceCredentialSecret),
-        };
-    }),
-    update: Effect.fn(function* ({ news, output, session }) {
-        const status = news.status ?? output.status;
-        if (status !== output.status) {
+        if (!credentialId) {
+            return yield* Effect.fail(new Error(`ServiceSpecificCredential for user '${news.userName}' has no id`));
+        }
+        // Sync — apply the desired status when it differs from observed.
+        const desiredStatus = news.status ?? observedStatus ?? "Active";
+        if (desiredStatus !== observedStatus) {
             yield* iam.updateServiceSpecificCredential({
-                UserName: output.userName,
-                ServiceSpecificCredentialId: output.serviceSpecificCredentialId,
-                Status: status,
+                UserName: userName,
+                ServiceSpecificCredentialId: credentialId,
+                Status: desiredStatus,
             });
         }
-        yield* session.note(output.serviceSpecificCredentialId);
+        yield* session.note(credentialId);
         return {
-            ...output,
-            status,
+            userName,
+            serviceName,
+            serviceSpecificCredentialId: credentialId,
+            status: desiredStatus,
+            createDate,
+            expirationDate,
+            serviceUserName,
+            serviceCredentialAlias,
+            servicePassword,
+            serviceCredentialSecret,
         };
     }),
     delete: Effect.fn(function* ({ output }) {