alchemy 2.0.0-beta.30 → 2.0.0-beta.31

package/src/AWS/ECS/CapacityProvider.ts

@@ -1,8 +1,7 @@
 import * as ecs from "@distilled.cloud/aws/ecs";
 import { Region } from "@distilled.cloud/aws/Region";
 import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
-import { AdoptPolicy } from "../../AdoptPolicy.ts";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import type { Input } from "../../Input.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
@@ -103,6 +102,10 @@ export interface CapacityProvider extends Resource<
  * ```
  *
  * @section Adopting Existing Capacity Providers
+ * Foreign-tagged capacity providers (i.e. providers that exist in AWS but were
+ * not created by this stack/stage/logical-id) are surfaced as `Unowned` by
+ * `read`, and the engine fails with `OwnedBySomeoneElse` unless adoption is
+ * explicitly opted in via `--adopt` or {@link adopt}.
  * @example Adopt an existing provider
  * ```typescript
  * import { adopt } from "alchemy/AdoptPolicy";
@@ -121,10 +124,6 @@ export const CapacityProviderProvider = () =>
   Provider.effect(
     CapacityProvider,
     Effect.gen(function* () {
-      const adoptPolicy = yield* Effect.serviceOption(AdoptPolicy).pipe(
-        Effect.map(Option.getOrElse(() => false)),
-      );
-
       const toEcsTags = (tags: Record<string, string>): ecs.Tag[] =>
         Object.entries(tags).map(([key, value]) => ({ key, value }));
 
@@ -181,7 +180,9 @@ export const CapacityProviderProvider = () =>
           if (!found?.name || !found.capacityProviderArn) {
             return undefined;
           }
-          return {
+          const internalTags = yield* createInternalTags(id);
+          const existingTags = fromEcsTags(found.tags);
+          const attrs = {
             capacityProviderArn:
               found.capacityProviderArn as CapacityProviderArn,
             name: found.name,
@@ -193,97 +194,55 @@ export const CapacityProviderProvider = () =>
             managedTerminationProtection:
               found.autoScalingGroupProvider?.managedTerminationProtection,
             managedDraining: found.autoScalingGroupProvider?.managedDraining,
-            tags: fromEcsTags(found.tags),
+            tags: existingTags,
           };
+          return hasTags(internalTags, existingTags) ? attrs : Unowned(attrs);
         }),
 
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, session }) {
           const region = yield* Region;
           const { accountId } = yield* AWSEnvironment;
           const name = yield* toName(id, news);
           const internalTags = yield* createInternalTags(id);
-          const tags = { ...internalTags, ...news.tags };
-
-          const existing = yield* describe(name);
-          if (existing?.name && existing.capacityProviderArn) {
-            // The provider already exists. Only adopt when AdoptPolicy is true.
-            if (!adoptPolicy) {
-              return yield* Effect.die(
-                new Error(
-                  `ECS capacity provider "${name}" already exists. ` +
-                    `Provide adopt() on the resource or stack to adopt it.`,
-                ),
-              );
-            }
-            yield* session.note(
-              `Adopting existing ECS capacity provider ${name}`,
-            );
+          const desiredTags = { ...internalTags, ...news.tags };
+          const autoScalingGroupArn = news.autoScalingGroupArn as string;
 
-            // If we own it (tags match), leave tags as-is. Otherwise apply
-            // our internal tags so future operations can identify ownership.
-            if (!hasTags(internalTags, fromEcsTags(existing.tags))) {
-              yield* ecs.tagResource({
-                resourceArn: existing.capacityProviderArn,
-                tags: toEcsTags(tags),
-              });
-            }
+          // Observe — fetch live cloud state. We fetch fresh on every
+          // reconcile so adoption, drift, and partial-prior-runs all
+          // converge.
+          let existing = yield* describe(name);
 
-            return {
-              capacityProviderArn:
-                existing.capacityProviderArn as CapacityProviderArn,
-              name: existing.name,
-              status: (existing.status ??
-                "ACTIVE") as ecs.CapacityProviderStatus,
-              updateStatus: existing.updateStatus,
-              autoScalingGroupArn:
-                existing.autoScalingGroupProvider?.autoScalingGroupArn ?? "",
-              managedScaling: existing.autoScalingGroupProvider?.managedScaling,
-              managedTerminationProtection:
-                existing.autoScalingGroupProvider?.managedTerminationProtection,
-              managedDraining:
-                existing.autoScalingGroupProvider?.managedDraining,
-              tags: { ...fromEcsTags(existing.tags), ...tags },
-            };
+          // Ensure — create the capacity provider if missing.
+          if (!existing?.name || !existing.capacityProviderArn) {
+            yield* ecs
+              .createCapacityProvider({
+                name,
+                autoScalingGroupProvider: {
+                  autoScalingGroupArn,
+                  managedScaling: news.managedScaling,
+                  managedTerminationProtection:
+                    news.managedTerminationProtection,
+                  managedDraining: news.managedDraining,
+                },
+                tags: toEcsTags(desiredTags),
+              })
+              .pipe(
+                // ECS may surface concurrent creation either as
+                // `LimitExceededException` or a generic `ClientException`
+                // with name conflict semantics — re-describe and continue.
+                Effect.catchTag("LimitExceededException", () => Effect.void),
+              );
+            existing = yield* describe(name);
           }
 
-          const autoScalingGroupArn = news.autoScalingGroupArn as string;
-          const created = yield* ecs.createCapacityProvider({
-            name,
-            autoScalingGroupProvider: {
-              autoScalingGroupArn,
-              managedScaling: news.managedScaling,
-              managedTerminationProtection: news.managedTerminationProtection,
-              managedDraining: news.managedDraining,
-            },
-            tags: toEcsTags(tags),
-          });
-
-          const provider = created.capacityProvider;
-          const capacityProviderArn = (provider?.capacityProviderArn ??
+          const capacityProviderArn = (existing?.capacityProviderArn ??
             `arn:aws:ecs:${region}:${accountId}:capacity-provider/${name}`) as CapacityProviderArn;
-          yield* session.note(capacityProviderArn);
-
-          return {
-            capacityProviderArn,
-            name,
-            status: (provider?.status ??
-              "ACTIVE") as ecs.CapacityProviderStatus,
-            updateStatus: provider?.updateStatus,
-            autoScalingGroupArn,
-            managedScaling: news.managedScaling,
-            managedTerminationProtection: news.managedTerminationProtection,
-            managedDraining: news.managedDraining,
-            tags,
-          };
-        }),
-
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          const internalTags = yield* createInternalTags(id);
-          const newTags = { ...internalTags, ...news.tags };
-          const oldTags = { ...internalTags, ...olds.tags };
 
+          // Sync managed scaling — observed ↔ desired. ECS
+          // updateCapacityProvider only mutates managed* fields; ASG ARN is
+          // immutable (replacement-triggering, handled in diff).
           yield* ecs.updateCapacityProvider({
-            name: output.name,
+            name,
             autoScalingGroupProvider: {
               managedScaling: news.managedScaling,
               managedTerminationProtection: news.managedTerminationProtection,
@@ -291,27 +250,34 @@ export const CapacityProviderProvider = () =>
             },
           });
 
-          const { removed, upsert } = diffTags(oldTags, newTags);
+          // Sync tags — diff observed cloud tags against desired.
+          const observedTags = fromEcsTags(existing?.tags);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
           if (upsert.length > 0) {
             yield* ecs.tagResource({
-              resourceArn: output.capacityProviderArn,
+              resourceArn: capacityProviderArn,
               tags: upsert.map((t) => ({ key: t.Key, value: t.Value })),
             });
           }
           if (removed.length > 0) {
             yield* ecs.untagResource({
-              resourceArn: output.capacityProviderArn,
+              resourceArn: capacityProviderArn,
               tagKeys: removed,
             });
           }
 
-          const found = yield* describe(output.name);
-          yield* session.note(output.capacityProviderArn);
+          // Re-read to capture status / updateStatus reflecting our changes.
+          const found = yield* describe(name);
+          yield* session.note(capacityProviderArn);
+
           return {
-            ...output,
-            status: (found?.status ??
-              output.status) as ecs.CapacityProviderStatus,
-            updateStatus: found?.updateStatus ?? output.updateStatus,
+            capacityProviderArn,
+            name,
+            status: (found?.status ?? "ACTIVE") as ecs.CapacityProviderStatus,
+            updateStatus: found?.updateStatus,
+            autoScalingGroupArn:
+              found?.autoScalingGroupProvider?.autoScalingGroupArn ??
+              autoScalingGroupArn,
             managedScaling:
               found?.autoScalingGroupProvider?.managedScaling ??
               news.managedScaling,
@@ -321,7 +287,7 @@ export const CapacityProviderProvider = () =>
             managedDraining:
               found?.autoScalingGroupProvider?.managedDraining ??
               news.managedDraining,
-            tags: newTags,
+            tags: desiredTags,
           };
         }),
 

package/src/AWS/ECS/Cluster.ts

@@ -154,90 +154,90 @@ export const ClusterProvider = () =>
             tags: output?.tags ?? {},
           };
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, session }) {
           const clusterName = yield* toClusterName(id, news);
-          const tags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const created = yield* ecs.createCluster({
-            clusterName,
-            settings: news.settings,
-            configuration: news.configuration,
-            serviceConnectDefaults: news.serviceConnectDefaults,
-            tags: toEcsTags(tags),
-          });
-          yield* applyCapacityProviders({
-            cluster: clusterName,
-            capacityProviders: news.capacityProviders,
-            defaultCapacityProviderStrategy:
-              news.defaultCapacityProviderStrategy,
+          const clusterArn =
+            `arn:aws:ecs:${region}:${accountId}:cluster/${clusterName}` as ClusterArn;
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live cloud state.
+          let described = yield* ecs.describeClusters({
+            clusters: [clusterArn],
+            include: ["SETTINGS", "TAGS", "CONFIGURATIONS"],
           });
+          let cluster = described.clusters?.find(
+            (c) =>
+              c.clusterName === clusterName &&
+              (c.status === "ACTIVE" || c.status === "PROVISIONING"),
+          );
 
-          const cluster = created.cluster;
-          const clusterArn = (cluster?.clusterArn ??
-            `arn:aws:ecs:${region}:${accountId}:cluster/${clusterName}`) as ClusterArn;
-          yield* session.note(clusterArn);
+          // Ensure — create if missing. ECS createCluster is idempotent for
+          // identical params and returns the existing cluster on conflict;
+          // we always sync below regardless.
+          if (!cluster?.clusterArn) {
+            const created = yield* ecs.createCluster({
+              clusterName,
+              settings: news.settings,
+              configuration: news.configuration,
+              serviceConnectDefaults: news.serviceConnectDefaults,
+              tags: toEcsTags(desiredTags),
+            });
+            cluster = created.cluster;
+          }
 
-          return {
-            clusterArn,
-            clusterName,
-            status: cluster?.status ?? "ACTIVE",
-            settings: news.settings ?? [],
-            configuration: news.configuration,
-            capacityProviders: news.capacityProviders ?? [],
-            defaultCapacityProviderStrategy:
-              news.defaultCapacityProviderStrategy ?? [],
-            serviceConnectDefaults: news.serviceConnectDefaults,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
+          // Sync cluster config — call updateCluster to converge settings,
+          // configuration, and serviceConnectDefaults to desired state.
           yield* ecs.updateCluster({
-            cluster: output.clusterArn,
+            cluster: clusterArn,
             settings: news.settings,
             configuration: news.configuration,
             serviceConnectDefaults: news.serviceConnectDefaults,
           });
+
+          // Sync capacity providers — observed ↔ desired.
           yield* applyCapacityProviders({
-            cluster: output.clusterArn,
+            cluster: clusterArn,
             capacityProviders: news.capacityProviders,
             defaultCapacityProviderStrategy:
               news.defaultCapacityProviderStrategy,
           });
 
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
+          // Sync tags — diff observed cloud tags against desired.
+          const observedTags = Object.fromEntries(
+            (cluster?.tags ?? [])
+              .filter(
+                (t): t is { key: string; value: string } =>
+                  typeof t.key === "string" && typeof t.value === "string",
+              )
+              .map((t) => [t.key, t.value]),
+          );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
           if (upsert.length > 0) {
             yield* ecs.tagResource({
-              resourceArn: output.clusterArn,
+              resourceArn: clusterArn,
               tags: upsert.map((tag) => ({ key: tag.Key, value: tag.Value })),
             });
           }
           if (removed.length > 0) {
             yield* ecs.untagResource({
-              resourceArn: output.clusterArn,
+              resourceArn: clusterArn,
               tagKeys: removed,
             });
           }
 
-          yield* session.note(output.clusterArn);
+          yield* session.note(clusterArn);
           return {
-            ...output,
+            clusterArn,
+            clusterName,
+            status: cluster?.status ?? "ACTIVE",
             settings: news.settings ?? [],
             configuration: news.configuration,
             capacityProviders: news.capacityProviders ?? [],
             defaultCapacityProviderStrategy:
               news.defaultCapacityProviderStrategy ?? [],
             serviceConnectDefaults: news.serviceConnectDefaults,
-            tags: newTags,
+            tags: desiredTags,
           };
         }),
         delete: Effect.fn(function* ({ output }) {

package/src/AWS/ECS/Service.ts

@@ -449,61 +449,107 @@ export const ServiceProvider = () =>
             status: service.status ?? "ACTIVE",
           };
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const serviceName = yield* toServiceName(id, news);
-          const ingress = news.public
-            ? yield* createIngress({ id, news })
-            : undefined;
-          const tags = {
+          const clusterArn = clusterArnOf(news.cluster) as ClusterArn;
+          const desiredTags = {
             ...(yield* createInternalTags(id)),
             ...news.tags,
           };
 
-          const created = yield* ecs.createService({
-            ...serviceInput(news),
-            serviceName,
-            cluster: clusterArnOf(news.cluster),
-            loadBalancers: ingress
-              ? [
-                  {
-                    targetGroupArn: ingress.targetGroupArn,
-                    containerName: news.task.containerName,
-                    containerPort: news.task.port ?? 3000,
-                  },
-                ]
-              : undefined,
-            tags: toEcsTags(tags),
-            enableECSManagedTags: true,
-          });
-          const service = created.service;
-          if (!service?.serviceArn) {
-            return yield* Effect.die(
-              new Error("createService returned no service"),
+          // Observe — describe service in target cluster. The cluster may
+          // not yet exist on first reconcile, so we tolerate
+          // `ClusterNotFoundException`.
+          const described = yield* ecs
+            .describeServices({
+              cluster: clusterArn,
+              services: [serviceName],
+              include: ["TAGS"],
+            })
+            .pipe(
+              Effect.catchTag("ClusterNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
             );
+          const observed = described?.services?.find(
+            (s) =>
+              s.serviceName === serviceName &&
+              s.status !== "INACTIVE" &&
+              s.status !== "DRAINING",
+          );
+
+          // Ensure — create if missing. Provision public ingress if
+          // requested and not already in `output`. Replacement (e.g. cluster
+          // change) is handled by diff returning `{ action: "replace" }`,
+          // so within reconcile we trust `output` for ingress identity.
+          let ingress:
+            | {
+                loadBalancerArn?: string;
+                targetGroupArn?: string;
+                listenerArn?: string;
+                url?: string;
+              }
+            | undefined = output?.targetGroupArn
+            ? {
+                loadBalancerArn: output.loadBalancerArn,
+                targetGroupArn: output.targetGroupArn,
+                listenerArn: output.listenerArn,
+                url: output.url,
+              }
+            : undefined;
+
+          if (!observed?.serviceArn) {
+            if (news.public && !ingress) {
+              ingress = yield* createIngress({ id, news });
+            }
+
+            const created = yield* ecs.createService({
+              ...serviceInput(news),
+              serviceName,
+              cluster: clusterArn,
+              loadBalancers: ingress
+                ? [
+                    {
+                      targetGroupArn: ingress.targetGroupArn!,
+                      containerName: news.task.containerName,
+                      containerPort: news.task.port ?? 3000,
+                    },
+                  ]
+                : undefined,
+              tags: toEcsTags(desiredTags),
+              enableECSManagedTags: true,
+            });
+            const service = created.service;
+            if (!service?.serviceArn) {
+              return yield* Effect.die(
+                new Error("createService returned no service"),
+              );
+            }
+            yield* session.note(service.serviceArn);
+            return {
+              serviceArn: service.serviceArn as ServiceArn,
+              serviceName: service.serviceName!,
+              clusterArn: service.clusterArn as ClusterArn,
+              taskDefinitionArn: service.taskDefinition!,
+              status: service.status ?? "ACTIVE",
+              url: ingress?.url,
+              loadBalancerArn: ingress?.loadBalancerArn,
+              targetGroupArn: ingress?.targetGroupArn,
+              listenerArn: ingress?.listenerArn,
+            };
           }
-          yield* session.note(service.serviceArn);
 
-          return {
-            serviceArn: service.serviceArn as ServiceArn,
-            serviceName: service.serviceName!,
-            clusterArn: service.clusterArn as ClusterArn,
-            taskDefinitionArn: service.taskDefinition!,
-            status: service.status ?? "ACTIVE",
-            url: ingress?.url,
-            loadBalancerArn: ingress?.loadBalancerArn,
-            targetGroupArn: ingress?.targetGroupArn,
-            listenerArn: ingress?.listenerArn,
-          };
-        }),
-        update: Effect.fn(function* ({ news, output, session }) {
+          // Sync — apply mutable fields (taskDefinition, desiredCount,
+          // network, deployment) via updateService with a forced new
+          // deployment.
           const updated = yield* ecs.updateService({
             ...serviceInput(news, output),
-            service: output.serviceName,
-            cluster: output.clusterArn,
-            loadBalancers: output.targetGroupArn
+            service: serviceName,
+            cluster: clusterArn,
+            loadBalancers: ingress?.targetGroupArn
               ? [
                   {
-                    targetGroupArn: output.targetGroupArn,
+                    targetGroupArn: ingress.targetGroupArn,
                     containerName: news.task.containerName,
                     containerPort: news.task.port ?? 3000,
                   },
@@ -512,12 +558,21 @@ export const ServiceProvider = () =>
             forceNewDeployment: true,
           });
           const service = updated.service;
-          yield* session.note(output.serviceArn);
+          yield* session.note(observed.serviceArn);
           return {
-            ...output,
+            serviceArn: observed.serviceArn as ServiceArn,
+            serviceName: observed.serviceName!,
+            clusterArn: observed.clusterArn as ClusterArn,
             taskDefinitionArn:
-              service?.taskDefinition ?? output.taskDefinitionArn,
-            status: service?.status ?? output.status,
+              service?.taskDefinition ??
+              observed.taskDefinition ??
+              output?.taskDefinitionArn ??
+              "",
+            status: service?.status ?? observed.status ?? "ACTIVE",
+            url: ingress?.url,
+            loadBalancerArn: ingress?.loadBalancerArn,
+            targetGroupArn: ingress?.targetGroupArn,
+            listenerArn: ingress?.listenerArn,
           };
         }),
         delete: Effect.fn(function* ({ output }) {