alchemy 2.0.0-beta.30 → 2.0.0-beta.31

package/src/AWS/CloudFront/KvRoutesUpdate.ts

@@ -165,7 +165,7 @@ export const KvRoutesUpdateProvider = () =>
         });
       });
 
-      const createOp = (
+      const deleteOp = (
         props: KvRoutesUpdateProps,
       ): Effect.Effect<
         void,
@@ -176,10 +176,12 @@ export const KvRoutesUpdateProvider = () =>
           const fullKey = `${props.namespace}:${props.key}`;
           const etag = yield* getKvsEtag(props.store);
           const { routes, chunkNum } = yield* getRoutes(props.store, fullKey);
-          if (!routes.includes(props.entry)) {
-            routes.push(props.entry);
+          const filtered = routes.filter((r) => r !== props.entry);
+          if (filtered.length === 0) {
+            yield* deleteKey(props.store, etag, fullKey, chunkNum);
+          } else {
+            yield* setRoutes(props.store, etag, fullKey, filtered, chunkNum);
           }
-          yield* setRoutes(props.store, etag, fullKey, routes, chunkNum);
         }).pipe(
           Effect.retry({
             while: (error) =>
@@ -191,23 +193,27 @@ export const KvRoutesUpdateProvider = () =>
           }),
         );
 
-      const deleteOp = (
-        props: KvRoutesUpdateProps,
+      const upsertEntry = (
+        store: string,
+        fullKey: string,
+        entryToAdd: string,
+        entryToRemove: string | undefined,
       ): Effect.Effect<
         void,
         kvs.UpdateKeysError,
-        Credentials | Region | HttpClient
+        HttpClient | Region | Credentials
       > =>
         Effect.gen(function* () {
-          const fullKey = `${props.namespace}:${props.key}`;
-          const etag = yield* getKvsEtag(props.store);
-          const { routes, chunkNum } = yield* getRoutes(props.store, fullKey);
-          const filtered = routes.filter((r) => r !== props.entry);
-          if (filtered.length === 0) {
-            yield* deleteKey(props.store, etag, fullKey, chunkNum);
-          } else {
-            yield* setRoutes(props.store, etag, fullKey, filtered, chunkNum);
+          const etag = yield* getKvsEtag(store);
+          const { routes, chunkNum } = yield* getRoutes(store, fullKey);
+          const filtered =
+            entryToRemove !== undefined
+              ? routes.filter((r) => r !== entryToRemove)
+              : routes.slice();
+          if (!filtered.includes(entryToAdd)) {
+            filtered.push(entryToAdd);
           }
+          yield* setRoutes(store, etag, fullKey, filtered, chunkNum);
         }).pipe(
           Effect.retry({
             while: (error) =>
@@ -225,68 +231,42 @@ export const KvRoutesUpdateProvider = () =>
             return output;
           }),
         ),
-        create: withKvsRegionFn(
-          Effect.fn(function* ({ news }) {
+        reconcile: withKvsRegionFn(
+          Effect.fn(function* ({ news, output }) {
             return yield* retryForKvsReadiness(
               Effect.gen(function* () {
-                yield* createOp(news);
-                return {
-                  store: news.store,
-                  namespace: news.namespace,
-                  key: news.key,
-                  entry: news.entry,
-                };
-              }),
-            );
-          }),
-        ),
-        update: withKvsRegionFn(
-          Effect.fn(function* ({ news, olds }) {
-            return yield* retryForKvsReadiness(
-              Effect.gen(function* () {
-                if (
-                  news.store !== olds.store ||
-                  news.namespace !== olds.namespace ||
-                  news.key !== olds.key
-                ) {
-                  yield* deleteOp(olds);
-                  yield* createOp(news);
-                } else {
-                  const fullKey = `${news.namespace}:${news.key}`;
-                  const updateInPlace = (): Effect.Effect<
-                    void,
-                    kvs.UpdateKeysError,
-                    HttpClient | Region | Credentials
-                  > =>
-                    Effect.gen(function* () {
-                      const etag = yield* getKvsEtag(news.store);
-                      const { routes, chunkNum } = yield* getRoutes(
-                        news.store,
-                        fullKey,
-                      );
-                      const filtered = routes.filter((r) => r !== olds.entry);
-                      if (!filtered.includes(news.entry)) {
-                        filtered.push(news.entry);
-                      }
-                      yield* setRoutes(
-                        news.store,
-                        etag,
-                        fullKey,
-                        filtered,
-                        chunkNum,
-                      );
-                    }).pipe(
-                      Effect.retry({
-                        while: (error) =>
-                          error._tag === "ValidationException" &&
-                          isKvsPreconditionFailed(error),
-                        schedule: Schedule.exponential("100 millis").pipe(
-                          Schedule.both(Schedule.recurs(24)),
-                        ),
-                      }),
-                    );
-                  yield* updateInPlace();
+                // Observe — figure out whether the prior entry lived at a
+                // different location. When location changes (or this is
+                // the first reconcile), we strip the old entry from the
+                // old routes array first, then add the new one to the
+                // new array.
+                const movedLocation =
+                  output !== undefined &&
+                  (output.store !== news.store ||
+                    output.namespace !== news.namespace ||
+                    output.key !== news.key);
+
+                if (movedLocation) {
+                  yield* deleteOp(output);
                 }
+
+                // Sync — append the desired entry to the routes array at
+                // the new location. If the entry was previously at the
+                // same location, drop the old value from the in-memory
+                // array before re-appending so a value change is treated
+                // as upsert-by-replace.
+                const fullKey = `${news.namespace}:${news.key}`;
+                const previousEntry =
+                  !movedLocation && output !== undefined
+                    ? output.entry
+                    : undefined;
+                yield* upsertEntry(
+                  news.store,
+                  fullKey,
+                  news.entry,
+                  previousEntry,
+                );
+
                 return {
                   store: news.store,
                   namespace: news.namespace,

package/src/AWS/CloudFront/OriginAccessControl.ts

@@ -168,54 +168,76 @@ export const OriginAccessControlProvider = () =>
             yield* createName(id, olds ?? {}),
           );
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const name = yield* createName(id, news);
-          const created = yield* cloudfront
-            .createOriginAccessControl({
-              OriginAccessControlConfig: {
-                Name: name,
-                Description: news.description,
-                OriginAccessControlOriginType: news.originType ?? "s3",
-                SigningBehavior: news.signingBehavior ?? "always",
-                SigningProtocol: news.signingProtocol ?? "sigv4",
-              },
-            })
-            .pipe(
-              Effect.catchTag("OriginAccessControlAlreadyExists", () =>
-                getByName(name).pipe(
-                  Effect.flatMap((existing) =>
-                    existing
-                      ? Effect.succeed(existing)
-                      : Effect.fail(
-                          new Error(
-                            `Origin access control '${name}' already exists but could not be recovered`,
+
+          // Observe — locate the OAC by id (cached on `output`) or by
+          // name. Trust observed cloud state, not stale `olds`.
+          const observed =
+            (yield* getCurrent(output)) ?? (yield* getByName(name));
+
+          // Ensure — create the OAC if it's missing. Tolerate
+          // `OriginAccessControlAlreadyExists` (race with a peer
+          // reconciler).
+          if (!observed?.OriginAccessControl?.Id) {
+            const created = yield* cloudfront
+              .createOriginAccessControl({
+                OriginAccessControlConfig: {
+                  Name: name,
+                  Description: news.description,
+                  OriginAccessControlOriginType: news.originType ?? "s3",
+                  SigningBehavior: news.signingBehavior ?? "always",
+                  SigningProtocol: news.signingProtocol ?? "sigv4",
+                },
+              })
+              .pipe(
+                Effect.catchTag("OriginAccessControlAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed(existing)
+                        : Effect.fail(
+                            new Error(
+                              `Origin access control '${name}' already exists but could not be recovered`,
+                            ),
                           ),
-                        ),
+                    ),
                   ),
                 ),
-              ),
-            );
+              );
 
-          if (!created.OriginAccessControl?.Id) {
-            return yield* Effect.fail(
-              new Error("createOriginAccessControl returned no identifier"),
-            );
+            if (!created.OriginAccessControl?.Id) {
+              return yield* Effect.fail(
+                new Error("createOriginAccessControl returned no identifier"),
+              );
+            }
+
+            yield* session.note(created.OriginAccessControl.Id);
+            return toAttrs(created.OriginAccessControl, created.ETag, name);
           }
 
-          yield* session.note(created.OriginAccessControl.Id);
-          return toAttrs(created.OriginAccessControl, created.ETag, name);
-        }),
-        update: Effect.fn(function* ({ news, output, session }) {
+          // Sync — patch the observed config to the desired state. The
+          // freshly observed ETag handles optimistic concurrency.
+          const observedConfig =
+            observed.OriginAccessControl.OriginAccessControlConfig;
           const updated = yield* cloudfront.updateOriginAccessControl({
-            Id: output.originAccessControlId,
-            IfMatch: output.etag,
+            Id: observed.OriginAccessControl.Id,
+            IfMatch: observed.ETag,
             OriginAccessControlConfig: {
-              Name: output.name,
+              Name: observedConfig?.Name ?? name,
               Description: news.description,
               OriginAccessControlOriginType:
-                news.originType ?? output.originType,
-              SigningBehavior: news.signingBehavior ?? output.signingBehavior,
-              SigningProtocol: news.signingProtocol ?? output.signingProtocol,
+                news.originType ??
+                observedConfig?.OriginAccessControlOriginType ??
+                "s3",
+              SigningBehavior:
+                news.signingBehavior ??
+                observedConfig?.SigningBehavior ??
+                "always",
+              SigningProtocol:
+                news.signingProtocol ??
+                observedConfig?.SigningProtocol ??
+                "sigv4",
             },
           });
 
@@ -225,11 +247,11 @@ export const OriginAccessControlProvider = () =>
             );
           }
 
-          yield* session.note(output.originAccessControlId);
+          yield* session.note(observed.OriginAccessControl.Id);
           return toAttrs(
             updated.OriginAccessControl,
             updated.ETag,
-            output.name,
+            observedConfig?.Name ?? name,
           );
         }),
         delete: Effect.fn(function* ({ output }) {

package/src/AWS/CloudFront/OriginRequestPolicy.ts

@@ -180,60 +180,81 @@ export const OriginRequestPolicyProvider = () =>
           if (!found) return undefined;
           return toAttrs(found.id, found.config, found.etag);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const name = yield* createName(id, news);
-          const created = yield* cloudfront
-            .createOriginRequestPolicy({
-              OriginRequestPolicyConfig: buildConfig(name, news),
-            })
-            .pipe(
-              Effect.catchTag("OriginRequestPolicyAlreadyExists", () =>
-                getByName(name).pipe(
-                  Effect.flatMap((existing) =>
-                    existing
-                      ? Effect.succeed({
-                          OriginRequestPolicy: {
-                            Id: existing.id,
-                            LastModifiedTime: new Date(),
-                            OriginRequestPolicyConfig: existing.config,
-                          },
-                          ETag: existing.etag,
-                          Location: undefined,
-                        })
-                      : Effect.fail(
-                          new Error(
-                            `Origin request policy '${name}' already exists but could not be recovered`,
+
+          // Observe — locate the policy by id (cached on `output`) or
+          // by name. Trust observed cloud state, not stale `olds`.
+          let observed = output?.originRequestPolicyId
+            ? yield* getById(output.originRequestPolicyId).pipe(
+                Effect.map((found) =>
+                  found
+                    ? { id: output.originRequestPolicyId, ...found }
+                    : undefined,
+                ),
+              )
+            : undefined;
+          if (!observed) {
+            observed = yield* getByName(name);
+          }
+
+          // Ensure — create the policy if it's missing. Tolerate
+          // `OriginRequestPolicyAlreadyExists` (race with a peer
+          // reconciler).
+          if (!observed) {
+            const created = yield* cloudfront
+              .createOriginRequestPolicy({
+                OriginRequestPolicyConfig: buildConfig(name, news),
+              })
+              .pipe(
+                Effect.catchTag("OriginRequestPolicyAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed({
+                            OriginRequestPolicy: {
+                              Id: existing.id,
+                              LastModifiedTime: new Date(),
+                              OriginRequestPolicyConfig: existing.config,
+                            },
+                            ETag: existing.etag,
+                            Location: undefined,
+                          })
+                        : Effect.fail(
+                            new Error(
+                              `Origin request policy '${name}' already exists but could not be recovered`,
+                            ),
                           ),
-                        ),
+                    ),
                   ),
                 ),
-              ),
-            );
-          if (!created.OriginRequestPolicy?.Id) {
-            return yield* Effect.fail(
-              new Error("createOriginRequestPolicy returned no identifier"),
+              );
+            if (!created.OriginRequestPolicy?.Id) {
+              return yield* Effect.fail(
+                new Error("createOriginRequestPolicy returned no identifier"),
+              );
+            }
+            yield* session.note(created.OriginRequestPolicy.Id);
+            return toAttrs(
+              created.OriginRequestPolicy.Id,
+              created.OriginRequestPolicy.OriginRequestPolicyConfig,
+              created.ETag,
             );
           }
-          yield* session.note(created.OriginRequestPolicy.Id);
-          return toAttrs(
-            created.OriginRequestPolicy.Id,
-            created.OriginRequestPolicy.OriginRequestPolicyConfig,
-            created.ETag,
-          );
-        }),
-        update: Effect.fn(function* ({ news, output, session }) {
-          const current = yield* getById(output.originRequestPolicyId);
+
+          // Sync — patch the observed config to the desired state. The
+          // freshly observed ETag handles optimistic concurrency.
           const updated = yield* cloudfront.updateOriginRequestPolicy({
-            Id: output.originRequestPolicyId,
-            IfMatch: current?.etag ?? output.etag,
-            OriginRequestPolicyConfig: buildConfig(output.name, news),
+            Id: observed.id,
+            IfMatch: observed.etag,
+            OriginRequestPolicyConfig: buildConfig(observed.config.Name, news),
           });
           if (!updated.OriginRequestPolicy?.Id) {
             return yield* Effect.fail(
               new Error("updateOriginRequestPolicy returned no identifier"),
             );
           }
-          yield* session.note(output.originRequestPolicyId);
+          yield* session.note(observed.id);
           return toAttrs(
             updated.OriginRequestPolicy.Id,
             updated.OriginRequestPolicy.OriginRequestPolicyConfig,

package/src/AWS/CloudFront/PublicKey.ts

@@ -161,56 +161,77 @@ export const PublicKeyProvider = () =>
           if (!found) return undefined;
           return toAttrs(found.id, found.config, found.etag);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const name = yield* createName(id, news);
-          const callerReference = name;
-          const created = yield* cloudfront
-            .createPublicKey({
-              PublicKeyConfig: buildConfig(name, callerReference, news),
-            })
-            .pipe(
-              Effect.catchTag("PublicKeyAlreadyExists", () =>
-                getByName(name).pipe(
-                  Effect.flatMap((existing) =>
-                    existing
-                      ? Effect.succeed({
-                          PublicKey: {
-                            Id: existing.id,
-                            CreatedTime: new Date(),
-                            PublicKeyConfig: existing.config,
-                          },
-                          ETag: existing.etag,
-                          Location: undefined,
-                        })
-                      : Effect.fail(
-                          new Error(
-                            `Public key '${name}' already exists but could not be recovered`,
+
+          // Observe — locate the public key by id (cached on `output`)
+          // or by name. Trust observed cloud state, not stale `olds`.
+          let observed = output?.publicKeyId
+            ? yield* getById(output.publicKeyId).pipe(
+                Effect.map((found) =>
+                  found ? { id: output.publicKeyId, ...found } : undefined,
+                ),
+              )
+            : undefined;
+          if (!observed) {
+            observed = yield* getByName(name);
+          }
+
+          // Ensure — create the public key if it's missing. Tolerate
+          // `PublicKeyAlreadyExists` (race with a peer reconciler).
+          if (!observed) {
+            const callerReference = name;
+            const created = yield* cloudfront
+              .createPublicKey({
+                PublicKeyConfig: buildConfig(name, callerReference, news),
+              })
+              .pipe(
+                Effect.catchTag("PublicKeyAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed({
+                            PublicKey: {
+                              Id: existing.id,
+                              CreatedTime: new Date(),
+                              PublicKeyConfig: existing.config,
+                            },
+                            ETag: existing.etag,
+                            Location: undefined,
+                          })
+                        : Effect.fail(
+                            new Error(
+                              `Public key '${name}' already exists but could not be recovered`,
+                            ),
                           ),
-                        ),
+                    ),
                   ),
                 ),
-              ),
-            );
-          if (!created.PublicKey?.Id) {
-            return yield* Effect.fail(
-              new Error("createPublicKey returned no identifier"),
+              );
+            if (!created.PublicKey?.Id) {
+              return yield* Effect.fail(
+                new Error("createPublicKey returned no identifier"),
+              );
+            }
+            yield* session.note(created.PublicKey.Id);
+            return toAttrs(
+              created.PublicKey.Id,
+              created.PublicKey.PublicKeyConfig,
+              created.ETag,
             );
           }
-          yield* session.note(created.PublicKey.Id);
-          return toAttrs(
-            created.PublicKey.Id,
-            created.PublicKey.PublicKeyConfig,
-            created.ETag,
-          );
-        }),
-        update: Effect.fn(function* ({ news, output, session }) {
-          const current = yield* getById(output.publicKeyId);
+
+          // Sync — patch the comment via `updatePublicKey`. The key body
+          // is immutable (replacement is forced in `diff`), and the
+          // CallerReference is observed from the live config rather than
+          // re-derived. The freshly observed ETag handles optimistic
+          // concurrency.
           const updated = yield* cloudfront.updatePublicKey({
-            Id: output.publicKeyId,
-            IfMatch: current?.etag ?? output.etag,
+            Id: observed.id,
+            IfMatch: observed.etag,
             PublicKeyConfig: buildConfig(
-              output.name,
-              output.callerReference,
+              observed.config.Name,
+              observed.config.CallerReference,
               news,
             ),
           });
@@ -219,7 +240,7 @@ export const PublicKeyProvider = () =>
               new Error("updatePublicKey returned no identifier"),
             );
           }
-          yield* session.note(output.publicKeyId);
+          yield* session.note(observed.id);
           return toAttrs(
             updated.PublicKey.Id,
             updated.PublicKey.PublicKeyConfig,