alchemy 2.0.0-beta.30 → 2.0.0-beta.31

package/src/AWS/EC2/VpcEndpoint.ts

@@ -310,158 +310,172 @@ export const VpcEndpointProvider = () =>
           // Other properties can be updated in-place
         }),
 
-        create: Effect.fn(function* ({ id, news, session }) {
-          yield* session.note(
-            `Creating VPC Endpoint for ${news.serviceName}...`,
-          );
-
-          const result = yield* ec2.createVpcEndpoint({
-            VpcId: news.vpcId as string,
-            ServiceName: news.serviceName,
-            VpcEndpointType: news.vpcEndpointType ?? "Gateway",
-            RouteTableIds: news.routeTableIds as string[] | undefined,
-            SubnetIds: news.subnetIds as string[] | undefined,
-            SecurityGroupIds: news.securityGroupIds as string[] | undefined,
-            PrivateDnsEnabled: news.privateDnsEnabled,
-            PolicyDocument: news.policyDocument,
-            IpAddressType: news.ipAddressType,
-            DnsOptions: news.dnsOptions
-              ? {
-                  DnsRecordIpType: news.dnsOptions.dnsRecordIpType,
-                  PrivateDnsOnlyForInboundResolverEndpoint:
-                    news.dnsOptions.privateDnsOnlyForInboundResolverEndpoint,
-                }
-              : undefined,
-            TagSpecifications: [
-              {
-                ResourceType: "vpc-endpoint",
-                Tags: createTagsList(yield* createTags(id, news.tags)),
-              },
-            ],
-            DryRun: false,
-          });
-
-          const vpcEndpointId = result.VpcEndpoint!.VpcEndpointId!;
-          yield* session.note(`VPC Endpoint created: ${vpcEndpointId}`);
-
-          // Wait for endpoint to be available (for Interface endpoints)
-          if (
-            news.vpcEndpointType === "Interface" ||
-            news.vpcEndpointType === "GatewayLoadBalancer"
-          ) {
-            yield* waitForVpcEndpointAvailable(vpcEndpointId, session);
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const desiredTags = yield* createTags(id, news.tags);
+
+          // Observe — find the VPC endpoint via cached id, else fall through
+          // to create.
+          let ep: ec2.VpcEndpoint | undefined;
+          if (output?.vpcEndpointId) {
+            const lookup = yield* ec2
+              .describeVpcEndpoints({
+                VpcEndpointIds: [output.vpcEndpointId],
+              })
+              .pipe(
+                Effect.catchTag("InvalidVpcEndpointId.NotFound", () =>
+                  Effect.succeed({ VpcEndpoints: [] }),
+                ),
+              );
+            ep = lookup.VpcEndpoints?.[0];
+            if (ep && (ep.State === "deleted" || ep.State === "deleting")) {
+              ep = undefined;
+            }
           }
 
-          const ep = yield* describeVpcEndpoint(vpcEndpointId);
-          return toAttrs(ep);
-        }),
+          // Ensure — create the endpoint when missing.
+          if (ep === undefined) {
+            yield* session.note(
+              `Creating VPC Endpoint for ${news.serviceName}...`,
+            );
+            const result = yield* ec2.createVpcEndpoint({
+              VpcId: news.vpcId as string,
+              ServiceName: news.serviceName,
+              VpcEndpointType: news.vpcEndpointType ?? "Gateway",
+              RouteTableIds: news.routeTableIds as string[] | undefined,
+              SubnetIds: news.subnetIds as string[] | undefined,
+              SecurityGroupIds: news.securityGroupIds as string[] | undefined,
+              PrivateDnsEnabled: news.privateDnsEnabled,
+              PolicyDocument: news.policyDocument,
+              IpAddressType: news.ipAddressType,
+              DnsOptions: news.dnsOptions
+                ? {
+                    DnsRecordIpType: news.dnsOptions.dnsRecordIpType,
+                    PrivateDnsOnlyForInboundResolverEndpoint:
+                      news.dnsOptions.privateDnsOnlyForInboundResolverEndpoint,
+                  }
+                : undefined,
+              TagSpecifications: [
+                {
+                  ResourceType: "vpc-endpoint",
+                  Tags: createTagsList(desiredTags),
+                },
+              ],
+              DryRun: false,
+            });
+            const newEpId = result.VpcEndpoint!.VpcEndpointId!;
+            yield* session.note(`VPC Endpoint created: ${newEpId}`);
+            if (
+              news.vpcEndpointType === "Interface" ||
+              news.vpcEndpointType === "GatewayLoadBalancer"
+            ) {
+              yield* waitForVpcEndpointAvailable(newEpId, session);
+            }
+            ep = yield* describeVpcEndpoint(newEpId);
+          }
 
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          const vpcEndpointId = output.vpcEndpointId;
+          const vpcEndpointId = ep.VpcEndpointId!;
+          const observedType = ep.VpcEndpointType ?? news.vpcEndpointType;
 
-          // Modify endpoint if needed
+          // Sync mutable configuration — diff observed cloud state against
+          // desired, then issue a single modifyVpcEndpoint call carrying only
+          // the deltas.
           const modifications: Parameters<typeof ec2.modifyVpcEndpoint>[0] = {
             VpcEndpointId: vpcEndpointId,
             DryRun: false,
           };
-
           let hasModifications = false;
 
-          // Handle route table changes (for Gateway endpoints)
-          if (news.vpcEndpointType === "Gateway" || !news.vpcEndpointType) {
-            const oldRouteTableIds = new Set(olds.routeTableIds ?? []);
-            const newRouteTableIds = new Set(news.routeTableIds ?? []);
-
-            const addRouteTableIds = [...newRouteTableIds].filter(
-              (id) => !oldRouteTableIds.has(id),
+          if (observedType === "Gateway") {
+            const observedRtIds = new Set(ep.RouteTableIds ?? []);
+            const desiredRtIds = new Set(
+              (news.routeTableIds as string[] | undefined) ?? [],
             );
-            const removeRouteTableIds = [...oldRouteTableIds].filter(
-              (id) => !newRouteTableIds.has(id),
+            const addRouteTableIds = [...desiredRtIds].filter(
+              (rt) => !observedRtIds.has(rt),
+            );
+            const removeRouteTableIds = [...observedRtIds].filter(
+              (rt) => !desiredRtIds.has(rt),
             );
-
             if (addRouteTableIds.length > 0) {
-              modifications.AddRouteTableIds = addRouteTableIds as string[];
+              modifications.AddRouteTableIds = addRouteTableIds;
               hasModifications = true;
             }
             if (removeRouteTableIds.length > 0) {
-              modifications.RemoveRouteTableIds =
-                removeRouteTableIds as string[];
+              modifications.RemoveRouteTableIds = removeRouteTableIds;
               hasModifications = true;
             }
           }
 
-          // Handle subnet changes (for Interface endpoints)
           if (
-            news.vpcEndpointType === "Interface" ||
-            news.vpcEndpointType === "GatewayLoadBalancer"
+            observedType === "Interface" ||
+            observedType === "GatewayLoadBalancer"
           ) {
-            const oldSubnetIds = new Set(olds.subnetIds ?? []);
-            const newSubnetIds = new Set(news.subnetIds ?? []);
-
-            const addSubnetIds = [...newSubnetIds].filter(
-              (id) => !oldSubnetIds.has(id),
+            const observedSubnetIds = new Set(ep.SubnetIds ?? []);
+            const desiredSubnetIds = new Set(
+              (news.subnetIds as string[] | undefined) ?? [],
             );
-            const removeSubnetIds = [...oldSubnetIds].filter(
-              (id) => !newSubnetIds.has(id),
+            const addSubnetIds = [...desiredSubnetIds].filter(
+              (s) => !observedSubnetIds.has(s),
+            );
+            const removeSubnetIds = [...observedSubnetIds].filter(
+              (s) => !desiredSubnetIds.has(s),
             );
-
             if (addSubnetIds.length > 0) {
-              modifications.AddSubnetIds = addSubnetIds as string[];
+              modifications.AddSubnetIds = addSubnetIds;
               hasModifications = true;
             }
             if (removeSubnetIds.length > 0) {
-              modifications.RemoveSubnetIds = removeSubnetIds as string[];
+              modifications.RemoveSubnetIds = removeSubnetIds;
               hasModifications = true;
             }
 
-            // Handle security group changes
-            const oldSecurityGroupIds = new Set(olds.securityGroupIds ?? []);
-            const newSecurityGroupIds = new Set(news.securityGroupIds ?? []);
-
-            const addSecurityGroupIds = [...newSecurityGroupIds].filter(
-              (id) => !oldSecurityGroupIds.has(id),
+            const observedSgIds = new Set(
+              (ep.Groups ?? [])
+                .map((g) => g.GroupId)
+                .filter((g): g is string => Boolean(g)),
             );
-            const removeSecurityGroupIds = [...oldSecurityGroupIds].filter(
-              (id) => !newSecurityGroupIds.has(id),
+            const desiredSgIds = new Set(
+              (news.securityGroupIds as string[] | undefined) ?? [],
+            );
+            const addSecurityGroupIds = [...desiredSgIds].filter(
+              (g) => !observedSgIds.has(g),
+            );
+            const removeSecurityGroupIds = [...observedSgIds].filter(
+              (g) => !desiredSgIds.has(g),
             );
-
             if (addSecurityGroupIds.length > 0) {
-              modifications.AddSecurityGroupIds =
-                addSecurityGroupIds as string[];
+              modifications.AddSecurityGroupIds = addSecurityGroupIds;
               hasModifications = true;
             }
             if (removeSecurityGroupIds.length > 0) {
-              modifications.RemoveSecurityGroupIds =
-                removeSecurityGroupIds as string[];
+              modifications.RemoveSecurityGroupIds = removeSecurityGroupIds;
               hasModifications = true;
             }
 
-            // Handle private DNS change
-            if (news.privateDnsEnabled !== olds.privateDnsEnabled) {
+            if (ep.PrivateDnsEnabled !== news.privateDnsEnabled) {
               modifications.PrivateDnsEnabled = news.privateDnsEnabled;
               hasModifications = true;
             }
           }
 
-          // Handle policy document change
-          if (news.policyDocument !== olds.policyDocument) {
+          if ((ep.PolicyDocument ?? undefined) !== news.policyDocument) {
             modifications.PolicyDocument = news.policyDocument ?? "";
             modifications.ResetPolicy = !news.policyDocument;
             hasModifications = true;
           }
 
-          // Handle IP address type change
-          if (news.ipAddressType !== olds.ipAddressType) {
+          if (ep.IpAddressType !== news.ipAddressType) {
             modifications.IpAddressType = news.ipAddressType;
             hasModifications = true;
           }
 
-          // Handle DNS options change
+          const observedDnsRecordIpType = ep.DnsOptions?.DnsRecordIpType;
+          const observedPrivateDnsOnly =
+            ep.DnsOptions?.PrivateDnsOnlyForInboundResolverEndpoint;
           if (
-            news.dnsOptions?.dnsRecordIpType !==
-              olds.dnsOptions?.dnsRecordIpType ||
-            news.dnsOptions?.privateDnsOnlyForInboundResolverEndpoint !==
-              olds.dnsOptions?.privateDnsOnlyForInboundResolverEndpoint
+            observedDnsRecordIpType !== news.dnsOptions?.dnsRecordIpType ||
+            observedPrivateDnsOnly !==
+              news.dnsOptions?.privateDnsOnlyForInboundResolverEndpoint
           ) {
             modifications.DnsOptions = news.dnsOptions
               ? {
@@ -476,29 +490,19 @@ export const VpcEndpointProvider = () =>
           if (hasModifications) {
             yield* ec2.modifyVpcEndpoint(modifications);
             yield* session.note("Updated VPC Endpoint configuration");
+            if (
+              observedType === "Interface" ||
+              observedType === "GatewayLoadBalancer"
+            ) {
+              yield* waitForVpcEndpointAvailable(vpcEndpointId, session);
+            }
           }
 
-          // Handle tag updates
-          const newTags = yield* createTags(id, news.tags);
-          const oldTags =
-            (yield* ec2
-              .describeTags({
-                Filters: [
-                  { Name: "resource-id", Values: [vpcEndpointId] },
-                  { Name: "resource-type", Values: ["vpc-endpoint"] },
-                ],
-              })
-              .pipe(
-                Effect.map(
-                  (r) =>
-                    Object.fromEntries(
-                      r.Tags?.map((t) => [t.Key!, t.Value!]) ?? [],
-                    ) as Record<string, string>,
-                ),
-              )) ?? {};
-
-          const { removed, upsert } = diffTags(oldTags, newTags);
-
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (ep.Tags ?? []).map((t) => [t.Key!, t.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
           if (removed.length > 0) {
             yield* ec2.deleteTags({
               Resources: [vpcEndpointId],
@@ -512,20 +516,11 @@ export const VpcEndpointProvider = () =>
               Tags: upsert,
               DryRun: false,
             });
-            yield* session.note("Updated tags");
           }
 
-          // Wait for endpoint to be available if we made modifications
-          if (
-            hasModifications &&
-            (news.vpcEndpointType === "Interface" ||
-              news.vpcEndpointType === "GatewayLoadBalancer")
-          ) {
-            yield* waitForVpcEndpointAvailable(vpcEndpointId, session);
-          }
-
-          const ep = yield* describeVpcEndpoint(vpcEndpointId);
-          return toAttrs(ep);
+          // Re-read final state.
+          const final = yield* describeVpcEndpoint(vpcEndpointId);
+          return toAttrs(final);
         }),
 
         delete: Effect.fn(function* ({ output, session }) {

package/src/AWS/EC2/hosted.ts

@@ -73,15 +73,15 @@ export interface Ec2HostedCleanupState {
  * Deploy-time / plan-time host context for EC2-backed platforms that bundle a
  * long-lived program (`exports.program`) and collect background work via `run`.
  */
-export interface Ec2HostExecutionContext extends ProcessContext {
+export interface Ec2HostRuntimeContext extends ProcessContext {
   exports: Effect.Effect<{
     readonly program: Effect.Effect<void, never, any>;
   }>;
 }
 
-export const createEc2HostExecutionContext =
+export const createEc2HostRuntimeContext =
   (type: string) =>
-  (id: string): Ec2HostExecutionContext => {
+  (id: string): Ec2HostRuntimeContext => {
     const runners: Effect.Effect<void, never, any>[] = [];
     const env: Record<string, any> = {};
 
@@ -120,7 +120,7 @@ export const createEc2HostExecutionContext =
       exports: Effect.sync(() => ({
         program: Effect.all(runners, { concurrency: "unbounded" }),
       })),
-    } satisfies Ec2HostExecutionContext;
+    } satisfies Ec2HostRuntimeContext;
   };
 
 export const createEc2HostedSupport = ({
@@ -242,7 +242,7 @@ const platform = Layer.mergeAll(
 );
 
 const program = handler.pipe(
-  Effect.flatMap((instance) => instance.ExecutionContext.exports.program),
+  Effect.flatMap((instance) => instance.RuntimeContext.exports.program),
   Effect.provide(
     Layer.effect(
       Stack,

package/src/AWS/ECR/Repository.ts

@@ -1,5 +1,6 @@
 import * as ecr from "@distilled.cloud/aws/ecr";
 import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
@@ -116,7 +117,10 @@ export const RepositoryProvider = () =>
           if (!repository?.repositoryArn || !repository.repositoryUri) {
             return undefined;
           }
-          return {
+          const listedTags = yield* ecr.listTagsForResource({
+            resourceArn: repository.repositoryArn,
+          });
+          const attrs = {
             repositoryName,
             repositoryArn: repository.repositoryArn as RepositoryArn,
             repositoryUri: repository.repositoryUri as RepositoryUri,
@@ -128,116 +132,115 @@ export const RepositoryProvider = () =>
             lifecyclePolicyText: output?.lifecyclePolicyText,
             tags: output?.tags ?? {},
           };
+          return (yield* hasAlchemyTags(id, listedTags.tags ?? []))
+            ? attrs
+            : Unowned(attrs);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, session }) {
           const repositoryName = yield* toRepositoryName(id, news);
-          const tags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const created = yield* ecr
-            .createRepository({
-              repositoryName,
-              imageTagMutability: news.imageTagMutability,
-              imageScanningConfiguration: news.scanOnPush
-                ? { scanOnPush: true }
-                : undefined,
-              tags: Object.entries(tags).map(([Key, Value]) => ({
-                Key,
-                Value,
-              })),
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live cloud state. We never trust prior `output`
+          // blindly: the repository may have been deleted out-of-band.
+          let described = yield* ecr
+            .describeRepositories({
+              repositoryNames: [repositoryName],
             })
             .pipe(
-              Effect.catchTag("RepositoryAlreadyExistsException", () =>
-                Effect.gen(function* () {
-                  const existing = yield* ecr.describeRepositories({
-                    repositoryNames: [repositoryName],
-                  });
-                  const repo = existing.repositories?.[0];
-                  if (!repo?.repositoryArn) {
-                    return yield* Effect.fail(
-                      new Error(
-                        `Repository '${repositoryName}' already exists`,
-                      ),
-                    );
-                  }
-                  const listedTags = yield* ecr.listTagsForResource({
-                    resourceArn: repo.repositoryArn,
-                  });
-                  if (!(yield* hasAlchemyTags(id, listedTags.tags ?? []))) {
-                    return yield* Effect.fail(
-                      new Error(
-                        `Repository '${repositoryName}' already exists and is not managed by alchemy`,
-                      ),
-                    );
-                  }
-                  return {
-                    repository: repo,
-                  };
-                }),
+              Effect.catchTag("RepositoryNotFoundException", () =>
+                Effect.succeed(undefined),
               ),
             );
+          let repository = described?.repositories?.[0];
 
-          if (news.lifecyclePolicyText) {
-            yield* ecr.putLifecyclePolicy({
-              repositoryName,
-              lifecyclePolicyText: news.lifecyclePolicyText,
-            });
+          // Ensure — create the repository if missing. Tolerate
+          // `RepositoryAlreadyExistsException` as a race with a peer
+          // reconciler: re-describe and continue with the sync path.
+          if (!repository?.repositoryArn || !repository.repositoryUri) {
+            const created = yield* ecr
+              .createRepository({
+                repositoryName,
+                imageTagMutability: news.imageTagMutability,
+                imageScanningConfiguration: news.scanOnPush
+                  ? { scanOnPush: true }
+                  : undefined,
+                tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag("RepositoryAlreadyExistsException", () =>
+                  ecr
+                    .describeRepositories({
+                      repositoryNames: [repositoryName],
+                    })
+                    .pipe(
+                      Effect.map((res) => ({
+                        repository: res.repositories?.[0],
+                      })),
+                    ),
+                ),
+              );
+            repository = created.repository;
+            if (!repository?.repositoryArn || !repository.repositoryUri) {
+              return yield* Effect.fail(
+                new Error(
+                  `Failed to create or read repository ${repositoryName}`,
+                ),
+              );
+            }
           }
 
-          const repository = created.repository!;
-          yield* session.note(repository.repositoryArn!);
+          const repositoryArn = repository.repositoryArn as RepositoryArn;
 
-          return {
-            repositoryName,
-            repositoryArn: repository.repositoryArn as RepositoryArn,
-            repositoryUri: repository.repositoryUri as RepositoryUri,
-            registryId: repository.registryId!,
-            imageTagMutability: news.imageTagMutability ?? "MUTABLE",
-            lifecyclePolicyText: news.lifecyclePolicyText,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          if (
-            news.lifecyclePolicyText !== undefined &&
-            news.lifecyclePolicyText !== olds.lifecyclePolicyText
-          ) {
+          // Sync lifecycle policy — observed ↔ desired.
+          if (news.lifecyclePolicyText) {
             yield* ecr.putLifecyclePolicy({
-              repositoryName: output.repositoryName,
+              repositoryName,
               lifecyclePolicyText: news.lifecyclePolicyText,
             });
           }
 
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
+          // Sync tags — diff observed cloud tags against desired.
+          const listedTags = yield* ecr.listTagsForResource({
+            resourceArn: repositoryArn,
+          });
+          const observedTags = Object.fromEntries(
+            (listedTags.tags ?? [])
+              .filter(
+                (t): t is { Key: string; Value: string } =>
+                  typeof t.Key === "string" && typeof t.Value === "string",
+              )
+              .map((t) => [t.Key, t.Value]),
+          );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
           if (upsert.length > 0) {
             yield* ecr.tagResource({
-              resourceArn: output.repositoryArn,
+              resourceArn: repositoryArn,
               tags: upsert,
             });
           }
           if (removed.length > 0) {
             yield* ecr.untagResource({
-              resourceArn: output.repositoryArn,
+              resourceArn: repositoryArn,
               tagKeys: removed,
             });
           }
 
-          yield* session.note(output.repositoryArn);
+          yield* session.note(repositoryArn);
           return {
-            ...output,
+            repositoryName,
+            repositoryArn,
+            repositoryUri: repository.repositoryUri as RepositoryUri,
+            registryId: repository.registryId!,
             imageTagMutability:
-              news.imageTagMutability ?? output.imageTagMutability,
+              news.imageTagMutability ??
+              repository.imageTagMutability ??
+              "MUTABLE",
             lifecyclePolicyText: news.lifecyclePolicyText,
-            tags: newTags,
+            tags: desiredTags,
           };
         }),
         delete: Effect.fn(function* ({ output }) {