alchemy 2.0.0-beta.30 → 2.0.0-beta.31

package/src/AWS/AutoScaling/ScalingPolicy.ts

@@ -160,11 +160,17 @@ export const ScalingPolicyProvider = () =>
           });
           return policy ? toAttributes(policy) : undefined;
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const autoScalingGroupName = toAutoScalingGroupName(
-            news.autoScalingGroup,
-          );
-          const policyName = yield* toName(id, news);
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const autoScalingGroupName =
+            output?.autoScalingGroupName ??
+            toAutoScalingGroupName(news.autoScalingGroup);
+          const policyName = output?.policyName ?? (yield* toName(id, news));
+
+          // Ensure + Sync — `putScalingPolicy` is the single
+          // create-or-update API for a scaling policy. It's idempotent on
+          // matching params and overwrites policy type / target tracking
+          // config / estimated warmup on differences, so we issue it
+          // unconditionally.
           yield* autoscaling.putScalingPolicy({
             AutoScalingGroupName: autoScalingGroupName,
             PolicyName: policyName,
@@ -178,6 +184,10 @@ export const ScalingPolicyProvider = () =>
             },
             EstimatedInstanceWarmup: news.estimatedInstanceWarmup,
           } as any);
+
+          // Observe final state — re-read so the returned attributes
+          // reflect the live cloud state (including the generated
+          // policyArn and any associated alarm names).
           const policy = yield* describePolicy({
             autoScalingGroupName,
             policyName,
@@ -187,7 +197,7 @@ export const ScalingPolicyProvider = () =>
                 ? Effect.succeed(policy)
                 : Effect.fail(
                     new Error(
-                      `Scaling policy '${policyName}' was not readable after create`,
+                      `Scaling policy '${policyName}' was not readable after reconcile`,
                     ),
                   ),
             ),
@@ -195,37 +205,6 @@ export const ScalingPolicyProvider = () =>
           yield* session.note(policyName);
           return toAttributes(policy);
         }),
-        update: Effect.fn(function* ({ news, output, session }) {
-          yield* autoscaling.putScalingPolicy({
-            AutoScalingGroupName: output.autoScalingGroupName,
-            PolicyName: output.policyName,
-            PolicyType: news.policyType ?? "TargetTrackingScaling",
-            TargetTrackingConfiguration: {
-              PredefinedMetricSpecification: {
-                PredefinedMetricType: news.predefinedMetricType,
-              },
-              TargetValue: news.targetValue,
-              DisableScaleIn: news.disableScaleIn,
-            },
-            EstimatedInstanceWarmup: news.estimatedInstanceWarmup,
-          } as any);
-          const policy = yield* describePolicy({
-            autoScalingGroupName: output.autoScalingGroupName,
-            policyName: output.policyName,
-          }).pipe(
-            Effect.flatMap((policy) =>
-              policy
-                ? Effect.succeed(policy)
-                : Effect.fail(
-                    new Error(
-                      `Scaling policy '${output.policyName}' was not readable after update`,
-                    ),
-                  ),
-            ),
-          );
-          yield* session.note(output.policyName);
-          return toAttributes(policy);
-        }),
         delete: Effect.fn(function* ({ output }) {
           yield* autoscaling.deletePolicy({
             AutoScalingGroupName: output.autoScalingGroupName,

package/src/AWS/CloudFront/CachePolicy.ts

@@ -196,58 +196,80 @@ export const CachePolicyProvider = () =>
           if (!found) return undefined;
           return toAttrs(found.id, found.config, found.etag);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const name = yield* createName(id, news);
-          const created = yield* cloudfront
-            .createCachePolicy({ CachePolicyConfig: buildConfig(name, news) })
-            .pipe(
-              Effect.catchTag("CachePolicyAlreadyExists", () =>
-                getByName(name).pipe(
-                  Effect.flatMap((existing) =>
-                    existing
-                      ? Effect.succeed({
-                          CachePolicy: {
-                            Id: existing.id,
-                            LastModifiedTime: new Date(),
-                            CachePolicyConfig: existing.config,
-                          },
-                          ETag: existing.etag,
-                          Location: undefined,
-                        })
-                      : Effect.fail(
-                          new Error(
-                            `Cache policy '${name}' already exists but could not be recovered`,
+
+          // Observe — locate the policy by id (cached on `output`) or by
+          // name. Trust observed cloud state, not stale `olds`.
+          let observed = output?.cachePolicyId
+            ? yield* getById(output.cachePolicyId).pipe(
+                Effect.map((found) =>
+                  found ? { id: output.cachePolicyId, ...found } : undefined,
+                ),
+              )
+            : undefined;
+          if (!observed) {
+            observed = yield* getByName(name);
+          }
+
+          // Ensure — create the policy if it's missing. Tolerate
+          // `CachePolicyAlreadyExists` as a race with a peer reconciler:
+          // re-read by name and continue with the sync path.
+          if (!observed) {
+            const created = yield* cloudfront
+              .createCachePolicy({
+                CachePolicyConfig: buildConfig(name, news),
+              })
+              .pipe(
+                Effect.catchTag("CachePolicyAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed({
+                            CachePolicy: {
+                              Id: existing.id,
+                              LastModifiedTime: new Date(),
+                              CachePolicyConfig: existing.config,
+                            },
+                            ETag: existing.etag,
+                            Location: undefined,
+                          })
+                        : Effect.fail(
+                            new Error(
+                              `Cache policy '${name}' already exists but could not be recovered`,
+                            ),
                           ),
-                        ),
+                    ),
                   ),
                 ),
-              ),
-            );
-          if (!created.CachePolicy?.Id) {
-            return yield* Effect.fail(
-              new Error("createCachePolicy returned no identifier"),
+              );
+            if (!created.CachePolicy?.Id) {
+              return yield* Effect.fail(
+                new Error("createCachePolicy returned no identifier"),
+              );
+            }
+            yield* session.note(created.CachePolicy.Id);
+            return toAttrs(
+              created.CachePolicy.Id,
+              created.CachePolicy.CachePolicyConfig,
+              created.ETag,
             );
           }
-          yield* session.note(created.CachePolicy.Id);
-          return toAttrs(
-            created.CachePolicy.Id,
-            created.CachePolicy.CachePolicyConfig,
-            created.ETag,
-          );
-        }),
-        update: Effect.fn(function* ({ news, output, session }) {
-          const current = yield* getById(output.cachePolicyId);
+
+          // Sync — diff observed config against desired and patch via
+          // `updateCachePolicy` with the freshly observed ETag.
+          const desired = buildConfig(observed.config.Name, news);
           const updated = yield* cloudfront.updateCachePolicy({
-            Id: output.cachePolicyId,
-            IfMatch: current?.etag ?? output.etag,
-            CachePolicyConfig: buildConfig(output.name, news),
+            Id: observed.id,
+            IfMatch: observed.etag,
+            CachePolicyConfig: desired,
           });
           if (!updated.CachePolicy?.Id) {
             return yield* Effect.fail(
               new Error("updateCachePolicy returned no identifier"),
             );
           }
-          yield* session.note(output.cachePolicyId);
+          yield* session.note(observed.id);
           return toAttrs(
             updated.CachePolicy.Id,
             updated.CachePolicy.CachePolicyConfig,

package/src/AWS/CloudFront/Distribution.ts

@@ -460,164 +460,176 @@ export const DistributionProvider = () =>
 
           return toAttrs(current.distribution, current.etag, current.tags);
         }),
-        create: Effect.fn(function* ({ id, instanceId, news, session }) {
-          const tags = {
+        reconcile: Effect.fn(function* ({
+          id,
+          instanceId,
+          news,
+          output,
+          session,
+        }) {
+          const desiredTags = {
             ...(yield* createInternalTags(id)),
             ...news.tags,
           };
-
           const callerReference = instanceId;
-          const config = toConfig(callerReference, news);
-          yield* Effect.logInfo(
-            `CloudFront Distribution create: callerReference=${callerReference} aliases=${news.aliases?.length ?? 0} origins=${(news.origins as DistributionOrigin[]).length} tags=${Object.keys(tags).length}`,
-          );
-          yield* Effect.logInfo(
-            `CloudFront Distribution create: creating distribution with tags for callerReference=${callerReference}`,
-          );
-          const created = yield* cloudfront
-            .createDistributionWithTags({
-              DistributionConfigWithTags: {
-                DistributionConfig: config,
-                Tags: {
-                  Items: createTagsList(tags),
+
+          // Observe — locate an existing distribution by id (cached on
+          // `output`) or by caller reference, which lets us recover from a
+          // create that succeeded in the cloud but failed to persist its
+          // attributes locally.
+          let observed = output?.distributionId
+            ? yield* getCurrent(output.distributionId)
+            : undefined;
+          if (!observed) {
+            observed = yield* getByCallerReference(callerReference);
+          }
+
+          // Ensure — create the distribution if it's missing. Tolerate
+          // `DistributionAlreadyExists` (race with a peer reconciler) by
+          // re-reading via caller reference. Tags are applied at create
+          // time when permissions allow; otherwise we fall back to
+          // create-then-tag and the sync path below converges them.
+          if (!observed) {
+            const config = toConfig(callerReference, news);
+            yield* Effect.logInfo(
+              `CloudFront Distribution reconcile: callerReference=${callerReference} aliases=${news.aliases?.length ?? 0} origins=${(news.origins as DistributionOrigin[]).length} tags=${Object.keys(desiredTags).length}`,
+            );
+            const created = yield* cloudfront
+              .createDistributionWithTags({
+                DistributionConfigWithTags: {
+                  DistributionConfig: config,
+                  Tags: {
+                    Items: createTagsList(desiredTags),
+                  },
                 },
-              },
-            })
-            .pipe(
-              Effect.catch((error) =>
-                isAccessDenied(error)
-                  ? Effect.gen(function* () {
-                      yield* Effect.logInfo(
-                        `CloudFront Distribution create: createDistributionWithTags denied, retrying without tags for callerReference=${callerReference}`,
-                      );
-                      const created = yield* cloudfront.createDistribution({
-                        DistributionConfig: config,
-                      });
-
-                      if (
-                        created.Distribution?.ARN &&
-                        Object.keys(tags).length > 0
-                      ) {
+              })
+              .pipe(
+                Effect.catch((error) =>
+                  isAccessDenied(error)
+                    ? Effect.gen(function* () {
                         yield* Effect.logInfo(
-                          `CloudFront Distribution create: tagging distribution ${created.Distribution.Id} after fallback`,
+                          `CloudFront Distribution reconcile: createDistributionWithTags denied, retrying without tags for callerReference=${callerReference}`,
                         );
-                        yield* cloudfront.tagResource({
-                          Resource: created.Distribution.ARN,
-                          Tags: {
-                            Items: createTagsList(tags),
-                          },
+                        const created = yield* cloudfront.createDistribution({
+                          DistributionConfig: config,
                         });
-                      }
 
-                      return created;
-                    })
-                  : Effect.gen(function* () {
-                      yield* Effect.logInfo(
-                        `CloudFront Distribution create: createDistributionWithTags failed for callerReference=${callerReference} error=${String(error)}`,
-                      );
-                      return yield* Effect.fail(error);
-                    }),
-              ),
-            )
-            .pipe(
-              Effect.map((created) => ({
-                distributionId: created.Distribution?.Id,
-                etag: created.ETag,
-                tags,
-              })),
-              Effect.catchTag("DistributionAlreadyExists", () =>
-                Effect.gen(function* () {
-                  yield* Effect.logInfo(
-                    `CloudFront Distribution create: callerReference=${callerReference} already exists, attempting recovery`,
-                  );
-                  const recovered =
-                    yield* getByCallerReference(callerReference);
-                  if (!recovered?.distribution.Id) {
-                    return yield* Effect.fail(
-                      new Error(
-                        `CloudFront distribution with caller reference '${callerReference}' already exists but could not be recovered`,
-                      ),
+                        if (
+                          created.Distribution?.ARN &&
+                          Object.keys(desiredTags).length > 0
+                        ) {
+                          yield* Effect.logInfo(
+                            `CloudFront Distribution reconcile: tagging distribution ${created.Distribution.Id} after fallback`,
+                          );
+                          yield* cloudfront.tagResource({
+                            Resource: created.Distribution.ARN,
+                            Tags: {
+                              Items: createTagsList(desiredTags),
+                            },
+                          });
+                        }
+
+                        return created;
+                      })
+                    : Effect.gen(function* () {
+                        yield* Effect.logInfo(
+                          `CloudFront Distribution reconcile: createDistributionWithTags failed for callerReference=${callerReference} error=${String(error)}`,
+                        );
+                        return yield* Effect.fail(error);
+                      }),
+                ),
+              )
+              .pipe(
+                Effect.map((created) => ({
+                  distributionId: created.Distribution?.Id,
+                  etag: created.ETag,
+                  tags: desiredTags,
+                })),
+                Effect.catchTag("DistributionAlreadyExists", () =>
+                  Effect.gen(function* () {
+                    yield* Effect.logInfo(
+                      `CloudFront Distribution reconcile: callerReference=${callerReference} already exists, attempting recovery`,
                     );
-                  }
-                  return {
-                    distributionId: recovered.distribution.Id,
-                    etag: recovered.etag,
-                    tags: recovered.tags,
-                  };
-                }),
-              ),
-              Effect.catchTag(
-                "InvalidArgument",
-                (
-                  error,
-                ): Effect.Effect<
-                  never,
-                  | cloudfront.InvalidArgument
-                  | DistributionFunctionAssociationPending
-                > =>
-                  isFunctionAssociationPending(error)
-                    ? Effect.logInfo(
-                        "CloudFront Distribution create: function association not yet ready, retrying",
-                      ).pipe(
-                        Effect.andThen(
-                          Effect.fail(
-                            new DistributionFunctionAssociationPending({
-                              message:
-                                error.Message ??
-                                "CloudFront function association pending",
-                            }),
-                          ),
+                    const recovered =
+                      yield* getByCallerReference(callerReference);
+                    if (!recovered?.distribution.Id) {
+                      return yield* Effect.fail(
+                        new Error(
+                          `CloudFront distribution with caller reference '${callerReference}' already exists but could not be recovered`,
                         ),
-                      )
-                    : Effect.fail(error),
-              ),
-              Effect.retry({
-                while: (error) =>
-                  error instanceof DistributionFunctionAssociationPending,
-                schedule: Schedule.fixed("5 seconds").pipe(
-                  Schedule.both(Schedule.recurs(24)),
+                      );
+                    }
+                    return {
+                      distributionId: recovered.distribution.Id,
+                      etag: recovered.etag,
+                      tags: recovered.tags,
+                    };
+                  }),
                 ),
-              }),
-            );
+                Effect.catchTag(
+                  "InvalidArgument",
+                  (
+                    error,
+                  ): Effect.Effect<
+                    never,
+                    | cloudfront.InvalidArgument
+                    | DistributionFunctionAssociationPending
+                  > =>
+                    isFunctionAssociationPending(error)
+                      ? Effect.logInfo(
+                          "CloudFront Distribution reconcile: function association not yet ready, retrying",
+                        ).pipe(
+                          Effect.andThen(
+                            Effect.fail(
+                              new DistributionFunctionAssociationPending({
+                                message:
+                                  error.Message ??
+                                  "CloudFront function association pending",
+                              }),
+                            ),
+                          ),
+                        )
+                      : Effect.fail(error),
+                ),
+                Effect.retry({
+                  while: (error) =>
+                    error instanceof DistributionFunctionAssociationPending,
+                  schedule: Schedule.fixed("5 seconds").pipe(
+                    Schedule.both(Schedule.recurs(24)),
+                  ),
+                }),
+              );
 
-          if (!created.distributionId) {
-            return yield* Effect.fail(
-              new Error("createDistribution returned no distribution"),
-            );
-          }
+            if (!created.distributionId) {
+              return yield* Effect.fail(
+                new Error("createDistribution returned no distribution"),
+              );
+            }
 
-          yield* Effect.logInfo(
-            `CloudFront Distribution create: created ${created.distributionId} etag=${created.etag ?? "missing"}, waiting for deployment`,
-          );
-          const deployed = yield* waitForDeployment(created.distributionId);
-          yield* Effect.logInfo(
-            `CloudFront Distribution create: deployed ${created.distributionId} domain=${deployed.DomainName}`,
-          );
-          yield* session.note(created.distributionId);
-          return toAttrs(deployed, created.etag, created.tags);
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          yield* Effect.logInfo(
-            `CloudFront Distribution update: distribution=${output.distributionId} aliases=${news.aliases?.length ?? 0}`,
-          );
-          const current = yield* getCurrent(output.distributionId);
-          if (!current) {
-            return yield* Effect.fail(
-              new Error(
-                `CloudFront distribution '${output.distributionId}' was not found`,
-              ),
+            yield* Effect.logInfo(
+              `CloudFront Distribution reconcile: created ${created.distributionId} etag=${created.etag ?? "missing"}, waiting for deployment`,
+            );
+            const deployed = yield* waitForDeployment(created.distributionId);
+            yield* Effect.logInfo(
+              `CloudFront Distribution reconcile: deployed ${created.distributionId} domain=${deployed.DomainName}`,
             );
+            yield* session.note(created.distributionId);
+            return toAttrs(deployed, created.etag, created.tags);
           }
 
+          // Sync config — diff observed config against desired and patch
+          // via `updateDistribution` with the freshly observed ETag. We
+          // keep the observed `CallerReference` because CloudFront does
+          // not allow it to change.
           yield* Effect.logInfo(
-            `CloudFront Distribution update: updating config for ${output.distributionId} with etag=${current.etag ?? "missing"}`,
+            `CloudFront Distribution reconcile: updating config for ${observed.distribution.Id} with etag=${observed.etag ?? "missing"}`,
           );
           const updated = yield* cloudfront
             .updateDistribution({
-              Id: output.distributionId,
-              IfMatch: current.etag,
+              Id: observed.distribution.Id,
+              IfMatch: observed.etag,
               DistributionConfig: toConfig(
-                current.config.CallerReference,
+                observed.config.CallerReference,
                 news,
               ),
             })
@@ -633,7 +645,7 @@ export const DistributionProvider = () =>
                 > =>
                   isFunctionAssociationPending(error)
                     ? Effect.logInfo(
-                        "CloudFront Distribution update: function association not yet ready, retrying",
+                        "CloudFront Distribution reconcile: function association not yet ready, retrying",
                       ).pipe(
                         Effect.andThen(
                           Effect.fail(
@@ -656,26 +668,26 @@ export const DistributionProvider = () =>
               }),
             );
 
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
+          if (!updated.Distribution?.Id) {
+            return yield* Effect.fail(
+              new Error("updateDistribution returned no distribution"),
+            );
+          }
 
+          // Sync tags — diff observed cloud tags against desired and apply
+          // only the delta. `observed.tags` is fetched fresh, so we don't
+          // rely on stale `olds.tags`.
+          const { removed, upsert } = diffTags(observed.tags, desiredTags);
           yield* Effect.logInfo(
-            `CloudFront Distribution update: distribution=${output.distributionId} upsertTags=${upsert.length} removedTags=${removed.length}`,
+            `CloudFront Distribution reconcile: distribution=${observed.distribution.Id} upsertTags=${upsert.length} removedTags=${removed.length}`,
           );
 
           if (upsert.length > 0) {
             yield* Effect.logInfo(
-              `CloudFront Distribution update: tagging ${output.distributionId} with ${upsert.length} tag(s)`,
+              `CloudFront Distribution reconcile: tagging ${observed.distribution.Id} with ${upsert.length} tag(s)`,
             );
             yield* cloudfront.tagResource({
-              Resource: output.distributionArn,
+              Resource: observed.distribution.ARN,
               Tags: {
                 Items: upsert,
               },
@@ -684,31 +696,25 @@ export const DistributionProvider = () =>
 
           if (removed.length > 0) {
             yield* Effect.logInfo(
-              `CloudFront Distribution update: removing ${removed.length} tag(s) from ${output.distributionId}`,
+              `CloudFront Distribution reconcile: removing ${removed.length} tag(s) from ${observed.distribution.Id}`,
             );
             yield* cloudfront.untagResource({
-              Resource: output.distributionArn,
+              Resource: observed.distribution.ARN,
               TagKeys: {
                 Items: removed,
               },
             });
           }
 
-          if (!updated.Distribution?.Id) {
-            return yield* Effect.fail(
-              new Error("updateDistribution returned no distribution"),
-            );
-          }
-
           yield* Effect.logInfo(
-            `CloudFront Distribution update: updated ${output.distributionId} etag=${updated.ETag ?? "missing"}, waiting for deployment`,
+            `CloudFront Distribution reconcile: updated ${observed.distribution.Id} etag=${updated.ETag ?? "missing"}, waiting for deployment`,
           );
           const deployed = yield* waitForDeployment(updated.Distribution.Id);
           yield* Effect.logInfo(
-            `CloudFront Distribution update: deployed ${output.distributionId} domain=${deployed.DomainName}`,
+            `CloudFront Distribution reconcile: deployed ${observed.distribution.Id} domain=${deployed.DomainName}`,
           );
-          yield* session.note(output.distributionId);
-          return toAttrs(deployed, updated.ETag, newTags);
+          yield* session.note(observed.distribution.Id);
+          return toAttrs(deployed, updated.ETag, desiredTags);
         }),
         delete: Effect.fn(function* ({ output }) {
           yield* Effect.logInfo(