alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/ELBv2/TargetGroup.ts

@@ -107,67 +107,69 @@ export const TargetGroupProvider = () =>
             vpcId: targetGroup.VpcId!,
           };
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, session }) {
           const name = yield* toName(id, news);
-          const tags = {
+          const desiredTags = {
             ...(yield* createInternalTags(id)),
             ...news.tags,
           };
-          const created = yield* elbv2.createTargetGroup({
-            Name: name,
-            Port: news.port,
-            Protocol: news.protocol ?? "HTTP",
-            VpcId: news.vpcId,
-            TargetType: news.targetType ?? "ip",
-            HealthCheckPath: news.healthCheckPath,
-            HealthCheckPort: news.healthCheckPort,
-            HealthCheckProtocol: news.healthCheckProtocol,
-            Matcher: news.matcher,
-            Tags: Object.entries(tags).map(([Key, Value]) => ({ Key, Value })),
-          });
-          const targetGroup = created.TargetGroups?.[0];
-          if (!targetGroup?.TargetGroupArn) {
-            return yield* Effect.die(
-              new Error("createTargetGroup returned no target group"),
-            );
-          }
-          if (news.attributes && Object.keys(news.attributes).length > 0) {
-            yield* elbv2.modifyTargetGroupAttributes({
-              TargetGroupArn: targetGroup.TargetGroupArn,
-              Attributes: Object.entries(news.attributes).map(
-                ([Key, Value]) => ({
-                  Key,
-                  Value,
-                }),
+
+          // Observe — look up by deterministic name.
+          let described = yield* elbv2
+            .describeTargetGroups({
+              Names: [name],
+            })
+            .pipe(
+              Effect.catchTag("TargetGroupNotFoundException", () =>
+                Effect.succeed(undefined),
               ),
+            );
+          let targetGroup = described?.TargetGroups?.[0];
+
+          // Ensure — create if missing. Stable axes (vpcId, port, protocol,
+          // targetType) are handled by diff so we don't deal with mismatch.
+          if (!targetGroup?.TargetGroupArn) {
+            const created = yield* elbv2.createTargetGroup({
+              Name: name,
+              Port: news.port,
+              Protocol: news.protocol ?? "HTTP",
+              VpcId: news.vpcId,
+              TargetType: news.targetType ?? "ip",
+              HealthCheckPath: news.healthCheckPath,
+              HealthCheckPort: news.healthCheckPort,
+              HealthCheckProtocol: news.healthCheckProtocol,
+              Matcher: news.matcher,
+              Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                Key,
+                Value,
+              })),
             });
+            targetGroup = created.TargetGroups?.[0];
+            if (!targetGroup?.TargetGroupArn) {
+              return yield* Effect.die(
+                new Error("createTargetGroup returned no target group"),
+              );
+            }
           }
-          yield* session.note(targetGroup.TargetGroupArn);
-          return {
-            targetGroupArn: targetGroup.TargetGroupArn as TargetGroupArn,
-            targetGroupName: targetGroup.TargetGroupName!,
-            port: targetGroup.Port!,
-            protocol: targetGroup.Protocol!,
-            targetType: targetGroup.TargetType!,
-            vpcId: targetGroup.VpcId!,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
+
+          const targetGroupArn = targetGroup.TargetGroupArn as TargetGroupArn;
+
+          // Sync health check — modifyTargetGroup fully replaces these
+          // mutable fields.
           yield* elbv2.modifyTargetGroup({
-            TargetGroupArn: output.targetGroupArn,
+            TargetGroupArn: targetGroupArn,
             HealthCheckPath: news.healthCheckPath,
             HealthCheckPort: news.healthCheckPort,
             HealthCheckProtocol: news.healthCheckProtocol,
             Matcher: news.matcher,
           });
-          if (
-            JSON.stringify(news.attributes ?? {}) !==
-            JSON.stringify(olds.attributes ?? {})
-          ) {
+
+          // Sync attributes — observed ↔ desired. Always apply when desired
+          // attrs are non-empty.
+          if (news.attributes && Object.keys(news.attributes).length > 0) {
             yield* elbv2.modifyTargetGroupAttributes({
-              TargetGroupArn: output.targetGroupArn,
-              Attributes: Object.entries(news.attributes ?? {}).map(
+              TargetGroupArn: targetGroupArn,
+              Attributes: Object.entries(news.attributes).map(
                 ([Key, Value]) => ({
                   Key,
                   Value,
@@ -175,31 +177,42 @@ export const TargetGroupProvider = () =>
               ),
             });
           }
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
+
+          // Sync tags — diff observed cloud tags against desired.
+          const tagDescriptions = yield* elbv2.describeTags({
+            ResourceArns: [targetGroupArn],
+          });
+          const observedTags = Object.fromEntries(
+            (tagDescriptions.TagDescriptions?.[0]?.Tags ?? [])
+              .filter(
+                (t): t is { Key: string; Value: string } =>
+                  typeof t.Key === "string" && typeof t.Value === "string",
+              )
+              .map((t) => [t.Key, t.Value]),
+          );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
           if (upsert.length > 0) {
             yield* elbv2.addTags({
-              ResourceArns: [output.targetGroupArn],
+              ResourceArns: [targetGroupArn],
               Tags: upsert,
             });
           }
           if (removed.length > 0) {
             yield* elbv2.removeTags({
-              ResourceArns: [output.targetGroupArn],
+              ResourceArns: [targetGroupArn],
               TagKeys: removed,
             });
           }
-          yield* session.note(output.targetGroupArn);
+
+          yield* session.note(targetGroupArn);
           return {
-            ...output,
-            tags: newTags,
+            targetGroupArn,
+            targetGroupName: targetGroup.TargetGroupName!,
+            port: targetGroup.Port!,
+            protocol: targetGroup.Protocol!,
+            targetType: targetGroup.TargetType!,
+            vpcId: targetGroup.VpcId!,
+            tags: desiredTags,
           };
         }),
         delete: Effect.fn(function* ({ output }) {

package/src/AWS/EventBridge/EventBus.ts

@@ -2,6 +2,7 @@ import { Region } from "@distilled.cloud/aws/Region";
 import * as eventbridge from "@distilled.cloud/aws/eventbridge";
 import * as Effect from "effect/Effect";
 
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
@@ -164,69 +165,80 @@ export const EventBusProvider = () =>
             return undefined;
           }
 
-          return {
+          const { Tags } = yield* eventbridge.listTagsForResource({
+            ResourceARN: described.Arn,
+          });
+          const attrs = {
             eventBusName: described.Name,
             eventBusArn: described.Arn as EventBusArn,
             description: described.Description,
           };
+          return (yield* hasAlchemyTags(id, Tags ?? []))
+            ? attrs
+            : Unowned(attrs);
         }),
-        create: Effect.fn(function* ({ id, news = {}, session }) {
-          const eventBusName = yield* createEventBusName(id, news);
+        reconcile: Effect.fn(function* ({ id, news = {}, output, session }) {
+          const eventBusName =
+            output?.eventBusName ?? (yield* createEventBusName(id, news));
+          const eventBusArn = (output?.eventBusArn ??
+            `arn:aws:events:${region}:${accountId}:event-bus/${eventBusName}`) as EventBusArn;
           const internalTags = yield* createInternalTags(id);
-          const allTags = {
+          const desiredTags = {
             ...internalTags,
             ...(news.tags as Record<string, string> | undefined),
           };
 
-          const eventBusArn =
-            `arn:aws:events:${region}:${accountId}:event-bus/${eventBusName}` as const;
-
-          yield* eventbridge
-            .createEventBus({
+          // Observe — fetch live cloud state. We don't trust `output`
+          // blindly: a bus deleted out of band shows up as missing and we
+          // recreate. Foreign-tagged buses have already been screened by
+          // `read` upstream.
+          let described = yield* eventbridge
+            .describeEventBus({
               Name: eventBusName,
-              EventSourceName: news.eventSourceName,
-              Description: news.description,
-              KmsKeyIdentifier: news.kmsKeyIdentifier as string | undefined,
-              DeadLetterConfig: news.deadLetterConfig
-                ? { Arn: news.deadLetterConfig.Arn as string | undefined }
-                : undefined,
-              LogConfig: news.logConfig,
-              Tags: createTagsList(allTags),
             })
             .pipe(
-              Effect.catchTag("ResourceAlreadyExistsException", () =>
-                Effect.gen(function* () {
-                  const { Tags } = yield* eventbridge.listTagsForResource({
-                    ResourceARN: eventBusArn,
-                  });
-                  if (!(yield* hasAlchemyTags(id, Tags ?? []))) {
-                    return yield* Effect.fail(
-                      new eventbridge.ResourceAlreadyExistsException({
-                        message: `Event bus '${eventBusName}' already exists and is not managed by alchemy`,
-                      }),
-                    );
-                  }
-                }),
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed(undefined),
               ),
             );
 
-          yield* session.note(eventBusArn);
+          // Ensure — create the bus if missing. Tolerate
+          // `ResourceAlreadyExistsException` as a race with a peer
+          // reconciler: re-read and continue with the sync path.
+          if (!described?.Arn) {
+            yield* eventbridge
+              .createEventBus({
+                Name: eventBusName,
+                EventSourceName: news.eventSourceName,
+                Description: news.description,
+                KmsKeyIdentifier: news.kmsKeyIdentifier as string | undefined,
+                DeadLetterConfig: news.deadLetterConfig
+                  ? { Arn: news.deadLetterConfig.Arn as string | undefined }
+                  : undefined,
+                LogConfig: news.logConfig,
+                Tags: createTagsList(desiredTags),
+              })
+              .pipe(
+                Effect.catchTag(
+                  "ResourceAlreadyExistsException",
+                  () => Effect.void,
+                ),
+              );
 
-          return {
-            eventBusName,
-            eventBusArn,
-            description: news.description,
-          };
-        }),
-        update: Effect.fn(function* ({
-          id,
-          news = {},
-          olds = {},
-          output,
-          session,
-        }) {
-          const eventBusName = output.eventBusName;
+            described = yield* eventbridge
+              .describeEventBus({
+                Name: eventBusName,
+              })
+              .pipe(
+                Effect.catchTag("ResourceNotFoundException", () =>
+                  Effect.succeed(undefined),
+                ),
+              );
+          }
 
+          // Sync mutable bus configuration — `updateEventBus` overwrites
+          // `description`, KMS key, DLQ, and log config in one shot, so we
+          // call it unconditionally (idempotent for matching values).
           yield* eventbridge.updateEventBus({
             Name: eventBusName,
             Description: news.description,
@@ -237,34 +249,40 @@ export const EventBusProvider = () =>
             LogConfig: news.logConfig,
           });
 
-          const internalTags = yield* createInternalTags(id);
-          const oldTags = {
-            ...internalTags,
-            ...(olds.tags as Record<string, string> | undefined),
-          };
-          const newTags = {
-            ...internalTags,
-            ...(news.tags as Record<string, string> | undefined),
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
+          // Sync tags — diff observed cloud tags against desired. Adoption
+          // may bring us a bus with its own tag set; diffing against the
+          // freshly-fetched tags lets the reconciler converge regardless.
+          const observedTagsList = yield* eventbridge
+            .listTagsForResource({
+              ResourceARN: eventBusArn,
+            })
+            .pipe(Effect.map((r) => r.Tags ?? []));
+          const observedTags: Record<string, string> = {};
+          for (const tag of observedTagsList) {
+            if (tag.Key && tag.Value !== undefined) {
+              observedTags[tag.Key] = tag.Value;
+            }
+          }
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
 
           if (removed.length > 0) {
             yield* eventbridge.untagResource({
-              ResourceARN: output.eventBusArn,
+              ResourceARN: eventBusArn,
               TagKeys: removed,
             });
           }
 
           if (upsert.length > 0) {
             yield* eventbridge.tagResource({
-              ResourceARN: output.eventBusArn,
+              ResourceARN: eventBusArn,
               Tags: upsert,
             });
           }
 
-          yield* session.note(output.eventBusArn);
+          yield* session.note(eventBusArn);
           return {
-            ...output,
+            eventBusName,
+            eventBusArn,
             description: news.description,
           };
         }),

package/src/AWS/EventBridge/Permission.ts

@@ -89,54 +89,43 @@ export const PermissionProvider = () =>
             return { action: "replace" } as const;
           }
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const statementId = yield* toStatementId(id, news);
-          const eventBusName = news.eventBusName ?? "default";
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const statementId =
+            output?.statementId ?? (yield* toStatementId(id, news));
+          const eventBusName =
+            output?.eventBusName ?? news.eventBusName ?? "default";
+          const eventBusParam =
+            eventBusName !== "default" ? eventBusName : undefined;
 
-          yield* eventbridge.putPermission({
-            EventBusName: eventBusName !== "default" ? eventBusName : undefined,
-            Action: news.action ?? "events:PutEvents",
-            Principal: news.principal,
-            StatementId: statementId,
-            Condition: news.condition,
-          });
-
-          yield* session.note(`EventBridge permission ${statementId}`);
-
-          return {
-            statementId,
-            eventBusName,
-          };
-        }),
-        update: Effect.fn(function* ({ news, output, session }) {
+          // Observe + Ensure for an existence-only resource: there is no
+          // server-side `describePermission` for a single statement, so we
+          // remove-then-put unconditionally. `removePermission` tolerates
+          // missing statements; `putPermission` is idempotent on identical
+          // params and overwrites on different ones — this is the official
+          // recommended update path.
           yield* eventbridge
             .removePermission({
-              EventBusName:
-                output.eventBusName !== "default"
-                  ? output.eventBusName
-                  : undefined,
-              StatementId: output.statementId,
+              EventBusName: eventBusParam,
+              StatementId: statementId,
             })
             .pipe(
               Effect.catchTag("ResourceNotFoundException", () => Effect.void),
             );
 
           yield* eventbridge.putPermission({
-            EventBusName:
-              output.eventBusName !== "default"
-                ? output.eventBusName
-                : undefined,
+            EventBusName: eventBusParam,
             Action: news.action ?? "events:PutEvents",
             Principal: news.principal,
-            StatementId: output.statementId,
+            StatementId: statementId,
             Condition: news.condition,
           });
 
-          yield* session.note(
-            `Updated EventBridge permission ${output.statementId}`,
-          );
+          yield* session.note(`EventBridge permission ${statementId}`);
 
-          return output;
+          return {
+            statementId,
+            eventBusName,
+          };
         }),
         delete: Effect.fn(function* ({ output }) {
           yield* eventbridge