alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/IAM/InstanceProfile.ts

@@ -160,107 +160,103 @@ export const InstanceProfileProvider = () =>
             tags: toTagRecord(profile.Tags),
           };
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const name = yield* toName(id, news);
-          const tags = {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = output?.instanceProfileName ?? (yield* toName(id, news));
+          const desiredTags = {
             ...(yield* createInternalTags(id)),
             ...news.tags,
           };
-          yield* iam
-            .createInstanceProfile({
-              InstanceProfileName: name,
-              Path: news.path,
-              Tags: createTagsList(tags),
-            })
-            .pipe(
-              Effect.catchTag("EntityAlreadyExistsException", () =>
-                Effect.gen(function* () {
-                  const existing = yield* readInstanceProfile(name);
-                  if (!existing?.Arn) {
-                    return yield* Effect.fail(
-                      new Error(
-                        `Instance profile '${name}' already exists but could not be described`,
-                      ),
-                    );
-                  }
-                  if (!hasTags(tags, existing.Tags)) {
-                    return yield* Effect.fail(
-                      new Error(
-                        `Instance profile '${name}' already exists and is not managed by alchemy`,
-                      ),
-                    );
-                  }
-                }),
-              ),
-            );
 
-          yield* syncRole({
-            profileName: name,
-            currentRoleName: undefined,
-            nextRoleName: news.roleName as string | undefined,
-          });
+          // Observe — fetch the live instance profile (or absence).
+          let profile = yield* readInstanceProfile(name);
 
-          const profile = yield* readInstanceProfile(name);
-          if (!profile?.Arn || !profile.InstanceProfileName) {
-            return yield* Effect.fail(
-              new Error(
-                `Instance profile '${name}' was not readable after create`,
-              ),
-            );
+          // Ensure — create the profile when it is missing. Tolerate races
+          // and surface a clear error when an unrelated foreign profile
+          // already owns the name.
+          if (!profile?.Arn) {
+            yield* iam
+              .createInstanceProfile({
+                InstanceProfileName: name,
+                Path: news.path,
+                Tags: createTagsList(desiredTags),
+              })
+              .pipe(
+                Effect.catchTag("EntityAlreadyExistsException", () =>
+                  Effect.gen(function* () {
+                    const existing = yield* readInstanceProfile(name);
+                    if (!existing?.Arn) {
+                      return yield* Effect.fail(
+                        new Error(
+                          `Instance profile '${name}' already exists but could not be described`,
+                        ),
+                      );
+                    }
+                    if (!hasTags(desiredTags, existing.Tags)) {
+                      return yield* Effect.fail(
+                        new Error(
+                          `Instance profile '${name}' already exists and is not managed by alchemy`,
+                        ),
+                      );
+                    }
+                  }),
+                ),
+              );
+            profile = yield* readInstanceProfile(name);
+            if (!profile?.Arn || !profile.InstanceProfileName) {
+              return yield* Effect.fail(
+                new Error(
+                  `Instance profile '${name}' was not readable after create`,
+                ),
+              );
+            }
           }
 
-          yield* session.note(profile.Arn);
-          return {
-            instanceProfileArn: profile.Arn,
-            instanceProfileName: profile.InstanceProfileName,
-            instanceProfileId: profile.InstanceProfileId,
-            path: profile.Path,
-            roleName: profile.Roles?.[0]?.RoleName,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
+          // Sync role attachment — diff the observed role on the profile
+          // against the desired role and only swap when they differ.
+          const observedRoleName = profile.Roles?.[0]?.RoleName;
+          const desiredRoleName = news.roleName as string | undefined;
           yield* syncRole({
-            profileName: output.instanceProfileName,
-            currentRoleName: olds.roleName as string | undefined,
-            nextRoleName: news.roleName as string | undefined,
+            profileName: name,
+            currentRoleName: observedRoleName,
+            nextRoleName: desiredRoleName,
           });
 
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
+          // Sync tags — use the cloud's actual tags as the baseline so
+          // adoption / out-of-band tag changes converge correctly.
+          const observedTags = toTagRecord(profile.Tags);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
           if (upsert.length > 0) {
             yield* iam.tagInstanceProfile({
-              InstanceProfileName: output.instanceProfileName,
+              InstanceProfileName: name,
               Tags: upsert,
             });
           }
           if (removed.length > 0) {
             yield* iam.untagInstanceProfile({
-              InstanceProfileName: output.instanceProfileName,
+              InstanceProfileName: name,
               TagKeys: removed,
             });
           }
 
-          const profile = yield* readInstanceProfile(
-            output.instanceProfileName,
-          );
-          yield* session.note(output.instanceProfileArn);
+          // Re-read for fresh attributes (the profile's `Roles` array
+          // changes after `syncRole`).
+          const fresh = yield* readInstanceProfile(name);
+          if (!fresh?.Arn || !fresh.InstanceProfileName) {
+            return yield* Effect.fail(
+              new Error(
+                `Instance profile '${name}' was not readable after sync`,
+              ),
+            );
+          }
+
+          yield* session.note(fresh.Arn);
           return {
-            instanceProfileArn: profile?.Arn ?? output.instanceProfileArn,
-            instanceProfileName:
-              profile?.InstanceProfileName ?? output.instanceProfileName,
-            instanceProfileId:
-              profile?.InstanceProfileId ?? output.instanceProfileId,
-            path: profile?.Path ?? output.path,
-            roleName: profile?.Roles?.[0]?.RoleName,
-            tags: newTags,
+            instanceProfileArn: fresh.Arn,
+            instanceProfileName: fresh.InstanceProfileName,
+            instanceProfileId: fresh.InstanceProfileId,
+            path: fresh.Path,
+            roleName: fresh.Roles?.[0]?.RoleName,
+            tags: desiredTags,
           };
         }),
         delete: Effect.fn(function* ({ output }) {

package/src/AWS/IAM/LoginProfile.ts

@@ -87,48 +87,57 @@ export const LoginProfileProvider = () =>
         passwordResetRequired: response.LoginProfile.PasswordResetRequired,
       };
     }),
-    create: Effect.fn(function* ({ news, session }) {
-      const response = yield* iam
-        .createLoginProfile({
-          UserName: news.userName,
-          Password: unwrapRedactedString(news.password),
-          PasswordResetRequired: news.passwordResetRequired,
-        })
+    reconcile: Effect.fn(function* ({ news, session }) {
+      // Observe — read the live login profile (or absence) for the user.
+      const observed = yield* iam
+        .getLoginProfile({ UserName: news.userName })
         .pipe(
-          Effect.catchTag("EntityAlreadyExistsException", () =>
-            Effect.gen(function* () {
-              yield* iam.updateLoginProfile({
-                UserName: news.userName,
-                Password: unwrapRedactedString(news.password),
-                PasswordResetRequired: news.passwordResetRequired,
-              });
-              return yield* iam.getLoginProfile({
-                UserName: news.userName,
-              });
-            }),
+          Effect.catchTag("NoSuchEntityException", () =>
+            Effect.succeed(undefined),
           ),
         );
+
+      // Ensure / Sync — the password is write-only, so we always send the
+      // desired value. Use `createLoginProfile` when the profile is
+      // missing and `updateLoginProfile` otherwise. A race that turns the
+      // create into `EntityAlreadyExistsException` is recovered by
+      // calling update.
+      let response = observed;
+      if (!observed?.LoginProfile) {
+        response = yield* iam
+          .createLoginProfile({
+            UserName: news.userName,
+            Password: unwrapRedactedString(news.password),
+            PasswordResetRequired: news.passwordResetRequired,
+          })
+          .pipe(
+            Effect.catchTag("EntityAlreadyExistsException", () =>
+              Effect.gen(function* () {
+                yield* iam.updateLoginProfile({
+                  UserName: news.userName,
+                  Password: unwrapRedactedString(news.password),
+                  PasswordResetRequired: news.passwordResetRequired,
+                });
+                return yield* iam.getLoginProfile({
+                  UserName: news.userName,
+                });
+              }),
+            ),
+          );
+      } else {
+        yield* iam.updateLoginProfile({
+          UserName: news.userName,
+          Password: unwrapRedactedString(news.password),
+          PasswordResetRequired: news.passwordResetRequired,
+        });
+        response = yield* iam.getLoginProfile({ UserName: news.userName });
+      }
+
       yield* session.note(news.userName);
       return {
-        userName: response.LoginProfile.UserName,
-        createDate: response.LoginProfile.CreateDate,
-        passwordResetRequired: response.LoginProfile.PasswordResetRequired,
-      };
-    }),
-    update: Effect.fn(function* ({ news, output, session }) {
-      yield* iam.updateLoginProfile({
-        UserName: output.userName,
-        Password: unwrapRedactedString(news.password),
-        PasswordResetRequired: news.passwordResetRequired,
-      });
-      const response = yield* iam.getLoginProfile({
-        UserName: output.userName,
-      });
-      yield* session.note(output.userName);
-      return {
-        userName: response.LoginProfile.UserName,
-        createDate: response.LoginProfile.CreateDate,
-        passwordResetRequired: response.LoginProfile.PasswordResetRequired,
+        userName: response!.LoginProfile.UserName,
+        createDate: response!.LoginProfile.CreateDate,
+        passwordResetRequired: response!.LoginProfile.PasswordResetRequired,
       };
     }),
     delete: Effect.fn(function* ({ output }) {

package/src/AWS/IAM/OpenIDConnectProvider.ts

@@ -108,81 +108,113 @@ export const OpenIDConnectProviderProvider = () =>
             tags: toTagRecord(tags.Tags),
           };
         }),
-        create: Effect.fn(function* ({ news, session }) {
-          const created = yield* iam.createOpenIDConnectProvider({
-            Url: news.url,
-            ClientIDList: news.clientIDList,
-            ThumbprintList: news.thumbprintList,
-            Tags: Object.entries(news.tags ?? {}).map(([Key, Value]) => ({
-              Key,
-              Value,
-            })),
-          });
-
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          // The OIDC provider's ARN is deterministic from its URL, so we
+          // can observe with or without prior output.
           const providerArn =
-            created.OpenIDConnectProviderArn ?? oidcArnFromUrl(news.url);
-          yield* session.note(providerArn);
-          return {
-            openIDConnectProviderArn: providerArn,
-            url: news.url,
-            clientIDList: news.clientIDList ?? [],
-            thumbprintList: news.thumbprintList ?? [],
-            tags: news.tags ?? {},
-          };
-        }),
-        update: Effect.fn(function* ({ news, olds, output, session }) {
-          const oldClientIds = new Set(olds.clientIDList ?? []);
-          const newClientIds = new Set(news.clientIDList ?? []);
-          for (const clientId of news.clientIDList ?? []) {
-            if (!oldClientIds.has(clientId)) {
+            output?.openIDConnectProviderArn ?? oidcArnFromUrl(news.url);
+
+          // Observe — read the live provider; absent when missing.
+          let observed = yield* readProvider(providerArn);
+          let observedClientIds: string[] = [];
+          let observedThumbprints: string[] = [];
+          let observedTags: Record<string, string> = {};
+
+          if (observed?.Url) {
+            observedClientIds = observed.ClientIDList ?? [];
+            observedThumbprints = observed.ThumbprintList ?? [];
+            const tagsResp = yield* iam.listOpenIDConnectProviderTags({
+              OpenIDConnectProviderArn: providerArn,
+            });
+            observedTags = toTagRecord(tagsResp.Tags);
+          }
+
+          // Ensure — create the provider when it is missing. The API does
+          // not return idempotently for OIDC, but the deterministic ARN
+          // means a race manifests as `EntityAlreadyExistsException`.
+          if (!observed?.Url) {
+            yield* iam
+              .createOpenIDConnectProvider({
+                Url: news.url,
+                ClientIDList: news.clientIDList,
+                ThumbprintList: news.thumbprintList,
+                Tags: Object.entries(news.tags ?? {}).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag(
+                  "EntityAlreadyExistsException",
+                  () => Effect.void,
+                ),
+              );
+            observed = yield* readProvider(providerArn);
+            observedClientIds = observed?.ClientIDList ?? [];
+            observedThumbprints = observed?.ThumbprintList ?? [];
+            const tagsResp = yield* iam.listOpenIDConnectProviderTags({
+              OpenIDConnectProviderArn: providerArn,
+            });
+            observedTags = toTagRecord(tagsResp.Tags);
+          }
+
+          // Sync client IDs against the observed list.
+          const desiredClientIds = news.clientIDList ?? [];
+          const observedClientSet = new Set(observedClientIds);
+          const desiredClientSet = new Set(desiredClientIds);
+          for (const clientId of desiredClientIds) {
+            if (!observedClientSet.has(clientId)) {
               yield* iam.addClientIDToOpenIDConnectProvider({
-                OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+                OpenIDConnectProviderArn: providerArn,
                 ClientID: clientId,
               });
             }
           }
-          for (const clientId of olds.clientIDList ?? []) {
-            if (!newClientIds.has(clientId)) {
+          for (const clientId of observedClientIds) {
+            if (!desiredClientSet.has(clientId)) {
               yield* iam.removeClientIDFromOpenIDConnectProvider({
-                OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+                OpenIDConnectProviderArn: providerArn,
                 ClientID: clientId,
               });
             }
           }
+
+          // Sync thumbprints — `updateOpenIDConnectProviderThumbprint`
+          // replaces the entire list, so call it whenever the set differs.
+          const desiredThumbprints = news.thumbprintList ?? [];
           if (
-            JSON.stringify(olds.thumbprintList ?? []) !==
-            JSON.stringify(news.thumbprintList ?? [])
+            JSON.stringify([...observedThumbprints].sort()) !==
+            JSON.stringify([...desiredThumbprints].sort())
           ) {
             yield* iam.updateOpenIDConnectProviderThumbprint({
-              OpenIDConnectProviderArn: output.openIDConnectProviderArn,
-              ThumbprintList: news.thumbprintList ?? [],
+              OpenIDConnectProviderArn: providerArn,
+              ThumbprintList: desiredThumbprints,
             });
           }
 
-          const { removed, upsert } = diffTags(
-            olds.tags ?? {},
-            news.tags ?? {},
-          );
+          // Sync tags against the observed cloud tags.
+          const desiredTags = news.tags ?? {};
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
           if (upsert.length > 0) {
             yield* iam.tagOpenIDConnectProvider({
-              OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+              OpenIDConnectProviderArn: providerArn,
               Tags: upsert,
             });
           }
           if (removed.length > 0) {
             yield* iam.untagOpenIDConnectProvider({
-              OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+              OpenIDConnectProviderArn: providerArn,
               TagKeys: removed,
             });
           }
 
-          yield* session.note(output.openIDConnectProviderArn);
+          yield* session.note(providerArn);
           return {
-            openIDConnectProviderArn: output.openIDConnectProviderArn,
-            url: output.url,
-            clientIDList: news.clientIDList ?? [],
-            thumbprintList: news.thumbprintList ?? [],
-            tags: news.tags ?? {},
+            openIDConnectProviderArn: providerArn,
+            url: news.url,
+            clientIDList: desiredClientIds,
+            thumbprintList: desiredThumbprints,
+            tags: desiredTags,
           };
         }),
         delete: Effect.fn(function* ({ output }) {

package/src/AWS/IAM/Policy.ts

@@ -234,129 +234,132 @@ export const PolicyProvider = () =>
             tags: toTagRecord(tags.Tags),
           };
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const policyName = yield* toPolicyName(id, news);
-          const policyArn = yield* toPolicyArn(id, news);
-          const tags = {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const policyName =
+            output?.policyName ?? (yield* toPolicyName(id, news));
+          const policyArn = output?.policyArn ?? (yield* toPolicyArn(id, news));
+          const desiredTags = {
             ...(yield* createInternalTags(id)),
             ...news.tags,
           };
 
-          const created = yield* iam
-            .createPolicy({
-              PolicyName: policyName,
-              Path: news.path,
-              PolicyDocument: stringifyPolicyDocument(news.policyDocument),
-              Description: news.description,
-              Tags: createTagsList(tags),
-            })
-            .pipe(
-              Effect.catchTag("EntityAlreadyExistsException", () =>
-                Effect.gen(function* () {
-                  const existing = yield* readPolicy(policyArn);
-                  if (!existing?.Arn) {
-                    return yield* Effect.fail(
-                      new Error(
-                        `Policy '${policyName}' already exists but could not be described`,
-                      ),
-                    );
-                  }
-                  const existingTags = yield* iam.listPolicyTags({
-                    PolicyArn: existing.Arn,
-                  });
-                  if (!hasTags(tags, existingTags.Tags)) {
-                    return yield* Effect.fail(
-                      new Error(
-                        `Policy '${policyName}' already exists and is not managed by alchemy`,
-                      ),
-                    );
-                  }
-                  return { Policy: existing };
-                }),
-              ),
-            );
+          // Observe — fetch the policy metadata, current default-version
+          // document, and tags. Each piece feeds an independent sync step.
+          let observed = yield* readPolicy(policyArn);
 
-          yield* session.note(created.Policy?.Arn ?? policyArn);
+          // Ensure — create the managed policy when it is missing. We
+          // pass the desired document as the initial version so first
+          // create lands fully configured. On race, adopt by reading
+          // existing.
+          if (!observed?.Arn) {
+            const created = yield* iam
+              .createPolicy({
+                PolicyName: policyName,
+                Path: news.path,
+                PolicyDocument: stringifyPolicyDocument(news.policyDocument),
+                Description: news.description,
+                Tags: createTagsList(desiredTags),
+              })
+              .pipe(
+                Effect.catchTag("EntityAlreadyExistsException", () =>
+                  Effect.gen(function* () {
+                    const existing = yield* readPolicy(policyArn);
+                    if (!existing?.Arn) {
+                      return yield* Effect.fail(
+                        new Error(
+                          `Policy '${policyName}' already exists but could not be described`,
+                        ),
+                      );
+                    }
+                    const existingTags = yield* iam.listPolicyTags({
+                      PolicyArn: existing.Arn,
+                    });
+                    if (!hasTags(desiredTags, existingTags.Tags)) {
+                      return yield* Effect.fail(
+                        new Error(
+                          `Policy '${policyName}' already exists and is not managed by alchemy`,
+                        ),
+                      );
+                    }
+                    return { Policy: existing };
+                  }),
+                ),
+              );
+            observed = created.Policy;
+          }
 
-          return {
-            policyArn: (created.Policy?.Arn ?? policyArn) as PolicyArn,
-            policyName,
-            policyId: created.Policy?.PolicyId,
-            path: created.Policy?.Path ?? news.path ?? "/",
-            defaultVersionId: created.Policy?.DefaultVersionId,
-            attachmentCount: created.Policy?.AttachmentCount,
-            permissionsBoundaryUsageCount:
-              created.Policy?.PermissionsBoundaryUsageCount,
-            isAttachable: created.Policy?.IsAttachable,
-            description: created.Policy?.Description ?? news.description,
-            policyDocument: news.policyDocument,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
+          // Sync default-version document — IAM managed policies are
+          // immutable per version, so any document change requires
+          // creating a new default version (and pruning the oldest non-
+          // default if we're at the 5-version cap).
+          const observedDocument = yield* readPolicyDocument({
+            policyArn,
+            versionId: observed?.DefaultVersionId,
+          });
           if (
-            JSON.stringify(news.policyDocument) !==
-            JSON.stringify(olds.policyDocument)
+            JSON.stringify(observedDocument ?? null) !==
+            JSON.stringify(news.policyDocument)
           ) {
-            yield* prunePolicyVersions(output.policyArn);
+            yield* prunePolicyVersions(policyArn);
             const createdVersion = yield* iam.createPolicyVersion({
-              PolicyArn: output.policyArn,
+              PolicyArn: policyArn,
               PolicyDocument: stringifyPolicyDocument(news.policyDocument),
               SetAsDefault: true,
             });
             if (createdVersion.PolicyVersion?.VersionId) {
               yield* iam.setDefaultPolicyVersion({
-                PolicyArn: output.policyArn,
+                PolicyArn: policyArn,
                 VersionId: createdVersion.PolicyVersion.VersionId,
               });
             }
           }
 
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
+          // Sync tags against the cloud's actual tags so adoption /
+          // out-of-band tag changes converge.
+          const observedTagsResp = yield* iam.listPolicyTags({
+            PolicyArn: policyArn,
+          });
+          const observedTags = toTagRecord(observedTagsResp.Tags);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
           if (upsert.length > 0) {
             yield* iam.tagPolicy({
-              PolicyArn: output.policyArn,
+              PolicyArn: policyArn,
               Tags: upsert,
             });
           }
           if (removed.length > 0) {
             yield* iam.untagPolicy({
-              PolicyArn: output.policyArn,
+              PolicyArn: policyArn,
               TagKeys: removed,
             });
           }
 
-          const policy = yield* readPolicy(output.policyArn);
-          const policyDocument =
+          // Re-read for fresh metadata and the now-current document.
+          const fresh = yield* readPolicy(policyArn);
+          const freshDocument =
             (yield* readPolicyDocument({
-              policyArn: output.policyArn,
-              versionId: policy?.DefaultVersionId,
+              policyArn,
+              versionId: fresh?.DefaultVersionId,
             })) ?? news.policyDocument;
 
-          yield* session.note(output.policyArn);
+          yield* session.note(policyArn);
           return {
-            policyArn: output.policyArn,
-            policyName: output.policyName,
-            policyId: policy?.PolicyId ?? output.policyId,
-            path: policy?.Path ?? output.path,
+            policyArn,
+            policyName,
+            policyId: fresh?.PolicyId ?? observed?.PolicyId,
+            path: fresh?.Path ?? observed?.Path ?? news.path ?? "/",
             defaultVersionId:
-              policy?.DefaultVersionId ?? output.defaultVersionId,
-            attachmentCount: policy?.AttachmentCount ?? output.attachmentCount,
+              fresh?.DefaultVersionId ?? observed?.DefaultVersionId,
+            attachmentCount:
+              fresh?.AttachmentCount ?? observed?.AttachmentCount,
             permissionsBoundaryUsageCount:
-              policy?.PermissionsBoundaryUsageCount ??
-              output.permissionsBoundaryUsageCount,
-            isAttachable: policy?.IsAttachable ?? output.isAttachable,
-            description: policy?.Description ?? output.description,
-            policyDocument,
-            tags: newTags,
+              fresh?.PermissionsBoundaryUsageCount ??
+              observed?.PermissionsBoundaryUsageCount,
+            isAttachable: fresh?.IsAttachable ?? observed?.IsAttachable,
+            description:
+              fresh?.Description ?? observed?.Description ?? news.description,
+            policyDocument: freshDocument,
+            tags: desiredTags,
           };
         }),
         delete: Effect.fn(function* ({ output }) {