alchemy 2.0.0-beta.30 → 2.0.0-beta.31

package/src/AWS/CloudFront/ResponseHeadersPolicy.ts

@@ -226,60 +226,84 @@ export const ResponseHeadersPolicyProvider = () =>
           if (!found) return undefined;
           return toAttrs(found.id, found.config, found.etag);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const name = yield* createName(id, news);
-          const created = yield* cloudfront
-            .createResponseHeadersPolicy({
-              ResponseHeadersPolicyConfig: buildConfig(name, news),
-            })
-            .pipe(
-              Effect.catchTag("ResponseHeadersPolicyAlreadyExists", () =>
-                getByName(name).pipe(
-                  Effect.flatMap((existing) =>
-                    existing
-                      ? Effect.succeed({
-                          ResponseHeadersPolicy: {
-                            Id: existing.id,
-                            LastModifiedTime: new Date(),
-                            ResponseHeadersPolicyConfig: existing.config,
-                          },
-                          ETag: existing.etag,
-                          Location: undefined,
-                        })
-                      : Effect.fail(
-                          new Error(
-                            `Response headers policy '${name}' already exists but could not be recovered`,
+
+          // Observe — locate the policy by id (cached on `output`) or
+          // by name. Trust observed cloud state, not stale `olds`.
+          let observed = output?.responseHeadersPolicyId
+            ? yield* getById(output.responseHeadersPolicyId).pipe(
+                Effect.map((found) =>
+                  found
+                    ? { id: output.responseHeadersPolicyId, ...found }
+                    : undefined,
+                ),
+              )
+            : undefined;
+          if (!observed) {
+            observed = yield* getByName(name);
+          }
+
+          // Ensure — create the policy if it's missing. Tolerate
+          // `ResponseHeadersPolicyAlreadyExists` (race with a peer
+          // reconciler).
+          if (!observed) {
+            const created = yield* cloudfront
+              .createResponseHeadersPolicy({
+                ResponseHeadersPolicyConfig: buildConfig(name, news),
+              })
+              .pipe(
+                Effect.catchTag("ResponseHeadersPolicyAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed({
+                            ResponseHeadersPolicy: {
+                              Id: existing.id,
+                              LastModifiedTime: new Date(),
+                              ResponseHeadersPolicyConfig: existing.config,
+                            },
+                            ETag: existing.etag,
+                            Location: undefined,
+                          })
+                        : Effect.fail(
+                            new Error(
+                              `Response headers policy '${name}' already exists but could not be recovered`,
+                            ),
                           ),
-                        ),
+                    ),
                   ),
                 ),
-              ),
-            );
-          if (!created.ResponseHeadersPolicy?.Id) {
-            return yield* Effect.fail(
-              new Error("createResponseHeadersPolicy returned no identifier"),
+              );
+            if (!created.ResponseHeadersPolicy?.Id) {
+              return yield* Effect.fail(
+                new Error("createResponseHeadersPolicy returned no identifier"),
+              );
+            }
+            yield* session.note(created.ResponseHeadersPolicy.Id);
+            return toAttrs(
+              created.ResponseHeadersPolicy.Id,
+              created.ResponseHeadersPolicy.ResponseHeadersPolicyConfig,
+              created.ETag,
             );
           }
-          yield* session.note(created.ResponseHeadersPolicy.Id);
-          return toAttrs(
-            created.ResponseHeadersPolicy.Id,
-            created.ResponseHeadersPolicy.ResponseHeadersPolicyConfig,
-            created.ETag,
-          );
-        }),
-        update: Effect.fn(function* ({ news, output, session }) {
-          const current = yield* getById(output.responseHeadersPolicyId);
+
+          // Sync — patch the observed config to the desired state. The
+          // freshly observed ETag handles optimistic concurrency.
           const updated = yield* cloudfront.updateResponseHeadersPolicy({
-            Id: output.responseHeadersPolicyId,
-            IfMatch: current?.etag ?? output.etag,
-            ResponseHeadersPolicyConfig: buildConfig(output.name, news),
+            Id: observed.id,
+            IfMatch: observed.etag,
+            ResponseHeadersPolicyConfig: buildConfig(
+              observed.config.Name,
+              news,
+            ),
           });
           if (!updated.ResponseHeadersPolicy?.Id) {
             return yield* Effect.fail(
               new Error("updateResponseHeadersPolicy returned no identifier"),
             );
           }
-          yield* session.note(output.responseHeadersPolicyId);
+          yield* session.note(observed.id);
           return toAttrs(
             updated.ResponseHeadersPolicy.Id,
             updated.ResponseHeadersPolicy.ResponseHeadersPolicyConfig,

package/src/AWS/CloudWatch/Alarm.ts

@@ -1,15 +1,16 @@
 import { Region } from "@distilled.cloud/aws/Region";
 import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
 import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
 import type { Providers } from "../Providers.ts";
 import { AWSEnvironment, type AccountID } from "../Environment.ts";
 import type { RegionID } from "../Region.ts";
 import {
   createName,
-  ensureOwnedByAlchemy,
   readResourceTags,
   retryConcurrent,
   updateResourceTags,
@@ -124,16 +125,22 @@ export const AlarmProvider = () =>
         read: Effect.fn(function* ({ id, olds, output }) {
           const name =
             output?.alarmName ?? (yield* createAlarmName(id, olds ?? {}));
-          return yield* readAlarm(name);
+          const state = yield* readAlarm(name);
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const name = yield* createAlarmName(id, news);
+        reconcile: Effect.fn(function* ({ id, news, olds, output, session }) {
+          // Observe — derive the alarm name and read whatever is currently
+          // in CloudWatch under that name. `output.alarmName` wins when
+          // present so an existing physical resource is never renamed.
+          const name = output?.alarmName ?? (yield* createAlarmName(id, news));
           const existing = yield* readAlarm(name);
 
-          if (existing) {
-            yield* ensureOwnedByAlchemy(id, name, existing.tags, "alarm");
-          }
-
+          // Ensure — `putMetricAlarm` is an upsert; we always send the full
+          // desired config so the cloud converges to `news` regardless of
+          // whether the alarm pre-existed.
           yield* retryConcurrent(
             cloudwatch.putMetricAlarm({
               ...news,
@@ -141,10 +148,13 @@ export const AlarmProvider = () =>
             }),
           );
 
+          // Sync tags — diff observed (or prior) tags against desired and
+          // apply only the delta. On adoption `olds` is undefined, so we
+          // fall back to whatever we just observed.
           const tags = yield* updateResourceTags({
             id,
             resourceArn: alarmArn(name),
-            olds: existing?.tags,
+            olds: olds?.tags ?? existing?.tags,
             news: news.tags,
           });
 
@@ -153,36 +163,7 @@ export const AlarmProvider = () =>
           const state = yield* readAlarm(name);
           if (!state) {
             return yield* Effect.fail(
-              new Error(`failed to read created alarm '${name}'`),
-            );
-          }
-
-          return {
-            ...state,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          yield* retryConcurrent(
-            cloudwatch.putMetricAlarm({
-              ...news,
-              AlarmName: output.alarmName,
-            }),
-          );
-
-          const tags = yield* updateResourceTags({
-            id,
-            resourceArn: output.alarmArn,
-            olds: olds.tags,
-            news: news.tags,
-          });
-
-          yield* session.note(output.alarmArn);
-
-          const state = yield* readAlarm(output.alarmName);
-          if (!state) {
-            return yield* Effect.fail(
-              new Error(`failed to read updated alarm '${output.alarmName}'`),
+              new Error(`failed to read reconciled alarm '${name}'`),
             );
           }
 

package/src/AWS/CloudWatch/AlarmMuteRule.ts

@@ -117,8 +117,15 @@ export const AlarmMuteRuleProvider = () =>
             (yield* createMuteRuleName(id, olds ?? {}));
           return yield* readAlarmMuteRule(name);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const name = yield* createMuteRuleName(id, news);
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          // Observe — pin the physical name from `output` if we already
+          // have one; otherwise derive it from desired props.
+          const name =
+            output?.alarmMuteRuleName ?? (yield* createMuteRuleName(id, news));
+
+          // Ensure — `putAlarmMuteRule` is an upsert. The CloudWatch API
+          // accepts `Tags` on every put, so we send the full managed tag
+          // set every reconcile and let the API converge it.
           const tags = yield* createManagedTags(id, news.tags);
 
           yield* retryConcurrent(
@@ -137,37 +144,7 @@ export const AlarmMuteRuleProvider = () =>
           const state = yield* readAlarmMuteRule(name);
           if (!state) {
             return yield* Effect.fail(
-              new Error(`failed to read created alarm mute rule '${name}'`),
-            );
-          }
-
-          return {
-            ...state,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, output, session }) {
-          const tags = yield* createManagedTags(id, news.tags);
-
-          yield* retryConcurrent(
-            cloudwatch.putAlarmMuteRule({
-              ...news,
-              Name: output.alarmMuteRuleName,
-              Tags: Object.entries(tags).map(([Key, Value]) => ({
-                Key,
-                Value,
-              })),
-            }),
-          );
-
-          yield* session.note(output.alarmMuteRuleArn);
-
-          const state = yield* readAlarmMuteRule(output.alarmMuteRuleName);
-          if (!state) {
-            return yield* Effect.fail(
-              new Error(
-                `failed to read updated alarm mute rule '${output.alarmMuteRuleName}'`,
-              ),
+              new Error(`failed to read reconciled alarm mute rule '${name}'`),
             );
           }
 

package/src/AWS/CloudWatch/AnomalyDetector.ts

@@ -166,46 +166,18 @@ export const AnomalyDetectorProvider = () =>
         anomalyDetector: detector,
       };
     }),
-    create: Effect.fn(function* ({ news, session }) {
-      yield* retryConcurrent(cloudwatch.putAnomalyDetector(news));
-      const detectorId = detectorIdentity(news);
-      yield* session.note(detectorId);
-
-      let attempt = 0;
-      const state = yield* Effect.suspend(() => {
-        attempt += 1;
-        return describeDetector(news, {
-          resourceId: "AnomalyDetector",
-          attempt,
-          logMisses: true,
-        }).pipe(
-          Effect.flatMap((state) =>
-            state
-              ? Effect.succeed(state)
-              : Effect.fail(
-                  new AnomalyDetectorNotVisible({
-                    message: "Anomaly detector not yet visible",
-                  }),
-                ),
-          ),
-        );
-      }).pipe(
-        Effect.retry({
-          while: (error) => error._tag === "AnomalyDetectorNotVisible",
-          schedule: detectorReadinessSchedule,
-        }),
-      );
-
-      return {
-        detectorId,
-        anomalyDetector: state,
-      };
-    }),
-    update: Effect.fn(function* ({ news, session }) {
+    reconcile: Effect.fn(function* ({ news, session }) {
+      // Ensure — `putAnomalyDetector` is an upsert keyed by the detector's
+      // identity (Namespace+MetricName+Dimensions+Stat or MetricMath
+      // expression). Sending desired props every reconcile converges the
+      // cloud regardless of whether this is first-create or an update.
       yield* retryConcurrent(cloudwatch.putAnomalyDetector(news));
       const detectorId = detectorIdentity(news);
       yield* session.note(detectorId);
 
+      // Sync — describe the detector after the put. CloudWatch is
+      // eventually consistent for `DescribeAnomalyDetectors`, so we retry
+      // until the detector matching our identity is visible.
       let attempt = 0;
       const state = yield* Effect.suspend(() => {
         attempt += 1;

package/src/AWS/CloudWatch/CompositeAlarm.ts

@@ -1,15 +1,16 @@
 import { Region } from "@distilled.cloud/aws/Region";
 import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
 import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
 import type { Providers } from "../Providers.ts";
 import { AWSEnvironment } from "../Environment.ts";
 import type { AlarmArn } from "./Alarm.ts";
 import {
   createName,
-  ensureOwnedByAlchemy,
   readResourceTags,
   retryConcurrent,
   updateResourceTags,
@@ -117,21 +118,22 @@ export const CompositeAlarmProvider = () =>
         read: Effect.fn(function* ({ id, olds, output }) {
           const name =
             output?.alarmName ?? (yield* createAlarmName(id, olds ?? {}));
-          return yield* readCompositeAlarm(name);
+          const state = yield* readCompositeAlarm(name);
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const name = yield* createAlarmName(id, news);
+        reconcile: Effect.fn(function* ({ id, news, olds, output, session }) {
+          // Observe — pin the physical name from `output` if present so we
+          // never rename an existing alarm; otherwise derive from desired
+          // props.
+          const name = output?.alarmName ?? (yield* createAlarmName(id, news));
           const existing = yield* readCompositeAlarm(name);
 
-          if (existing) {
-            yield* ensureOwnedByAlchemy(
-              id,
-              name,
-              existing.tags,
-              "composite alarm",
-            );
-          }
-
+          // Ensure — `putCompositeAlarm` is an upsert. We always send the
+          // full desired config so the cloud converges to `news` whether
+          // the alarm pre-existed or not.
           yield* retryConcurrent(
             cloudwatch.putCompositeAlarm({
               ...news,
@@ -139,10 +141,13 @@ export const CompositeAlarmProvider = () =>
             }),
           );
 
+          // Sync tags — diff observed (or prior) tags against desired.
+          // `olds` is undefined on adoption, so fall back to what we just
+          // observed.
           const tags = yield* updateResourceTags({
             id,
             resourceArn: alarmArn(name),
-            olds: existing?.tags,
+            olds: olds?.tags ?? existing?.tags,
             news: news.tags,
           });
 
@@ -151,38 +156,7 @@ export const CompositeAlarmProvider = () =>
           const state = yield* readCompositeAlarm(name);
           if (!state) {
             return yield* Effect.fail(
-              new Error(`failed to read created composite alarm '${name}'`),
-            );
-          }
-
-          return {
-            ...state,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          yield* retryConcurrent(
-            cloudwatch.putCompositeAlarm({
-              ...news,
-              AlarmName: output.alarmName,
-            }),
-          );
-
-          const tags = yield* updateResourceTags({
-            id,
-            resourceArn: output.alarmArn,
-            olds: olds.tags,
-            news: news.tags,
-          });
-
-          yield* session.note(output.alarmArn);
-
-          const state = yield* readCompositeAlarm(output.alarmName);
-          if (!state) {
-            return yield* Effect.fail(
-              new Error(
-                `failed to read updated composite alarm '${output.alarmName}'`,
-              ),
+              new Error(`failed to read reconciled composite alarm '${name}'`),
             );
           }
 

package/src/AWS/CloudWatch/Dashboard.ts

@@ -215,9 +215,16 @@ export const DashboardProvider = () =>
             (yield* createDashboardName(id, olds ?? {}));
           return yield* readDashboard(name);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const name = yield* createDashboardName(id, news);
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          // Observe — pin the physical name from `output` if present so we
+          // never rename an existing dashboard; otherwise derive from
+          // desired props.
+          const name =
+            output?.dashboardName ?? (yield* createDashboardName(id, news));
 
+          // Ensure — `putDashboard` is a pure upsert. The CloudWatch
+          // dashboard API has no separate update path, so we always send
+          // the full body and let the API converge.
           yield* retryConcurrent(
             cloudwatch.putDashboard({
               DashboardName: name,
@@ -230,31 +237,17 @@ export const DashboardProvider = () =>
           const state = yield* readDashboard(name);
           if (!state) {
             return yield* Effect.fail(
-              new Error(`failed to read created dashboard '${name}'`),
+              new Error(`failed to read reconciled dashboard '${name}'`),
             );
           }
 
+          // Dashboards do not support the generic CloudWatch tagging APIs,
+          // so `tags` is always returned as an empty record.
           return {
             ...state,
             tags: {},
           };
         }),
-        update: Effect.fn(function* ({ news, output, session }) {
-          yield* retryConcurrent(
-            cloudwatch.putDashboard({
-              DashboardName: output.dashboardName,
-              DashboardBody: serializeDashboardBody(news.DashboardBody),
-            }),
-          );
-
-          yield* session.note(output.dashboardArn);
-
-          return {
-            ...output,
-            dashboardBody: news.DashboardBody,
-            tags: {},
-          };
-        }),
         delete: Effect.fn(function* ({ output }) {
           yield* retryConcurrent(
             cloudwatch.deleteDashboards({

package/src/AWS/CloudWatch/InsightRule.ts

@@ -3,16 +3,17 @@ import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Stream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import type { Input } from "../../Input.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
 import type { Providers } from "../Providers.ts";
 import { AWSEnvironment, type AccountID } from "../Environment.ts";
 import type { RegionID } from "../Region.ts";
 import {
   createName,
-  ensureOwnedByAlchemy,
   readResourceTags,
   retryConcurrent,
   updateResourceTags,
@@ -183,21 +184,21 @@ export const InsightRuleProvider = () =>
         read: Effect.fn(function* ({ id, olds, output }) {
           const name =
             output?.ruleName ?? (yield* createRuleName(id, olds ?? {}));
-          return yield* readInsightRule(name);
+          const state = yield* readInsightRule(name);
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const name = yield* createRuleName(id, news);
+        reconcile: Effect.fn(function* ({ id, news, olds, output, session }) {
+          // Observe — pin the physical name from `output` if present;
+          // otherwise derive from desired props. Read whatever exists in
+          // CloudWatch so we have a baseline for tag-diffing on adoption.
+          const name = output?.ruleName ?? (yield* createRuleName(id, news));
           const existing = yield* readInsightRule(name);
 
-          if (existing) {
-            yield* ensureOwnedByAlchemy(
-              id,
-              name,
-              existing.tags,
-              "insight rule",
-            );
-          }
-
+          // Ensure — `putInsightRule` is an upsert; sending the full
+          // desired config every reconcile converges the cloud.
           yield* retryConcurrent(
             cloudwatch.putInsightRule({
               ...toPutInsightRuleInput(news),
@@ -205,10 +206,13 @@ export const InsightRuleProvider = () =>
             }),
           );
 
+          // Sync tags — diff against `olds.tags` when we have prior state,
+          // otherwise fall back to what we observed. Adoption flows take
+          // the latter path.
           const tags = yield* updateResourceTags({
             id,
             resourceArn: ruleArn(name),
-            olds: existing?.tags,
+            olds: olds?.tags ?? existing?.tags,
             news: news.tags,
           });
 
@@ -217,38 +221,7 @@ export const InsightRuleProvider = () =>
           const state = yield* readInsightRule(name);
           if (!state) {
             return yield* Effect.fail(
-              new Error(`failed to read created insight rule '${name}'`),
-            );
-          }
-
-          return {
-            ...state,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          yield* retryConcurrent(
-            cloudwatch.putInsightRule({
-              ...toPutInsightRuleInput(news),
-              RuleName: output.ruleName,
-            }),
-          );
-
-          const tags = yield* updateResourceTags({
-            id,
-            resourceArn: output.ruleArn,
-            olds: olds.tags,
-            news: news.tags,
-          });
-
-          yield* session.note(output.ruleArn);
-
-          const state = yield* readInsightRule(output.ruleName);
-          if (!state) {
-            return yield* Effect.fail(
-              new Error(
-                `failed to read updated insight rule '${output.ruleName}'`,
-              ),
+              new Error(`failed to read reconciled insight rule '${name}'`),
             );
           }