alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/Lambda/Function.ts

@@ -13,6 +13,7 @@ import * as Option from "effect/Option";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import type * as rolldown from "rolldown";
+import { Unowned } from "../../AdoptPolicy.ts";
 import * as Bundle from "../../Bundle/Bundle.ts";
 import * as TempRoot from "../../Bundle/TempRoot.ts";
 import { isResolved } from "../../Diff.ts";
@@ -26,7 +27,12 @@ import { Resource, type ResourceBinding } from "../../Resource.ts";
 import { Self } from "../../Self.ts";
 import * as Serverless from "../../Serverless/index.ts";
 import { Stack } from "../../Stack.ts";
-import { createInternalTags, createTagsList, hasTags } from "../../Tags.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  hasAlchemyTags,
+  hasTags,
+} from "../../Tags.ts";
 import { sha256 } from "../../Util/sha256.ts";
 import { zipCode } from "../../Util/zip.ts";
 import { Assets } from "../Assets.ts";
@@ -351,7 +357,7 @@ export const Function: Platform<
   FunctionShape,
   Serverless.FunctionContext
 > = Platform(FunctionTypeId, {
-  createExecutionContext: (id: string): Serverless.FunctionContext => {
+  createRuntimeContext: (id: string): Serverless.FunctionContext => {
     const listeners: Effect.Effect<Serverless.FunctionListener>[] = [];
     const env: Record<string, any> = {};
 
@@ -533,6 +539,9 @@ export const FunctionProvider = () =>
       }) {
         yield* Effect.logDebug(`creating role ${id}`);
         const tags = yield* createInternalTags(id);
+        // Engine has cleared us via `read` — foreign-tagged functions are
+        // surfaced as `Unowned` and require `--adopt`. On a race between
+        // read and create, treat `EntityAlreadyExistsException` as adoption.
         const role = yield* iam
           .createRole({
             RoleName: roleName,
@@ -552,19 +561,9 @@ export const FunctionProvider = () =>
           })
           .pipe(
             Effect.catchTag("EntityAlreadyExistsException", () =>
-              iam
-                .getRole({
-                  RoleName: roleName,
-                })
-                .pipe(
-                  Effect.filterOrFail(
-                    (role) => hasTags(tags, role.Role?.Tags),
-                    () =>
-                      new Error(
-                        `Role ${roleName} exists but has incorrect tags`,
-                      ),
-                  ),
-                ),
+              iam.getRole({
+                RoleName: roleName,
+              }),
             ),
           );
 
@@ -684,7 +683,7 @@ const stack = Layer.effect(
 );
 
 const handlerEffect = tag.asEffect().pipe(
-  Effect.flatMap(func => func.ExecutionContext.exports),
+  Effect.flatMap(func => func.RuntimeContext.exports),
   Effect.flatMap(exports => exports.handler),
   Effect.provide(
     layer.pipe(
@@ -1002,6 +1001,7 @@ export default await Effect.runPromise(handlerEffect)
             StatementId: "FunctionURLAllowPublicInvoke",
             Action: "lambda:InvokeFunction",
             Principal: "*",
+            InvokedViaFunctionUrl: true,
           } as const;
           const upsertPermission = (permission: Lambda.AddPermissionRequest) =>
             Lambda.addPermission(permission).pipe(
@@ -1098,31 +1098,55 @@ export default await Effect.runPromise(handlerEffect)
             return { action: "update" };
           }
         }),
-        read: Effect.fnUntraced(function* ({ id, output }) {
-          if (output) {
-            yield* Effect.logDebug(`reading function ${id}`);
-            // example: refresh the function URL from the API
-            return {
-              ...output,
-              functionUrl: (yield* Lambda.getFunctionUrlConfig({
-                FunctionName: yield* createFunctionName(
-                  id,
-                  output.functionName,
-                ),
-              }).pipe(
-                Effect.map((f) => f.FunctionUrl),
-                Effect.retry({
-                  // TODO(sam): did we lose this error? Is it missing for a good
-                  while: (e: any) => e._tag === "ResourceConflictException",
-                  schedule: Schedule.exponential(100),
-                }),
-                Effect.catchTag("ResourceNotFoundException", () =>
-                  Effect.succeed(undefined),
-                ),
-              )) as any,
-            };
+        read: Effect.fnUntraced(function* ({ id, olds, output }) {
+          const functionName =
+            output?.functionName ??
+            (yield* createFunctionName(id, olds?.functionName));
+          yield* Effect.logDebug(`reading function ${functionName}`);
+          const fn = yield* Lambda.getFunction({
+            FunctionName: functionName,
+          }).pipe(
+            Effect.map((r) => r.Configuration),
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+          if (!fn?.FunctionArn || !fn.FunctionName || !fn.Role) {
+            return undefined;
           }
-          return output;
+          const tagsResult = yield* Lambda.listTags({
+            Resource: fn.FunctionArn,
+          }).pipe(
+            Effect.map((r) => r.Tags ?? {}),
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed({} as Record<string, string>),
+            ),
+          );
+          const functionUrl = yield* Lambda.getFunctionUrlConfig({
+            FunctionName: fn.FunctionName,
+          }).pipe(
+            Effect.map((f) => f.FunctionUrl),
+            Effect.retry({
+              while: (e: any) => e._tag === "ResourceConflictException",
+              schedule: Schedule.exponential(100),
+            }),
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+          // Reuse the persisted output where we have it (e.g. code hash) so
+          // diff doesn't see drift it can't reconstruct from the API.
+          const attrs = {
+            ...(output ?? {}),
+            functionArn: fn.FunctionArn,
+            functionName: fn.FunctionName,
+            functionUrl,
+            roleArn: fn.Role,
+            roleName: output?.roleName ?? fn.Role.split("/").pop()!,
+          } as any;
+          return (yield* hasAlchemyTags(id, tagsResult))
+            ? attrs
+            : Unowned(attrs);
         }),
 
         precreate: Effect.fnUntraced(function* ({ id, news, session }) {
@@ -1163,9 +1187,10 @@ export default await Effect.runPromise(handlerEffect)
             roleArn,
           };
         }),
-        create: Effect.fnUntraced(function* ({
+        reconcile: Effect.fnUntraced(function* ({
           id,
           news,
+          olds,
           bindings,
           output,
           session,
@@ -1206,11 +1231,13 @@ export default await Effect.runPromise(handlerEffect)
           const functionUrl = yield* createOrUpdateFunctionUrl({
             functionName,
             url: news.url,
+            oldUrl: olds?.url,
           });
 
           yield* session.note(summary({ code }));
 
           return {
+            ...(output ?? {}),
             functionArn,
             functionName,
             functionUrl: functionUrl as any,
@@ -1221,61 +1248,6 @@ export default await Effect.runPromise(handlerEffect)
             },
           };
         }),
-        update: Effect.fnUntraced(function* ({
-          id,
-          news,
-          olds,
-          bindings,
-          output,
-          session,
-        }) {
-          const { roleName, policyName, functionName, functionArn } =
-            yield* createNames(id, news.functionName);
-
-          const env = yield* attachBindings({
-            roleName,
-            policyName,
-            functionArn,
-            functionName,
-            bindings,
-          });
-
-          const { archive, code, hash } = yield* bundleCode(id, news);
-
-          yield* createOrUpdateFunction({
-            id,
-            news,
-            roleArn: output.roleArn,
-            archive,
-            hash,
-            env: {
-              ...env,
-              ...news.env,
-            },
-            functionName,
-            session,
-          });
-
-          const functionUrl = yield* createOrUpdateFunctionUrl({
-            functionName,
-            url: news.url,
-            oldUrl: olds.url,
-          });
-
-          yield* session.note(summary({ code }));
-
-          return {
-            ...output,
-            functionArn,
-            functionName,
-            functionUrl: functionUrl as any,
-            roleName,
-            roleArn: output.roleArn,
-            code: {
-              hash,
-            },
-          };
-        }),
         delete: Effect.fnUntraced(function* ({ output }) {
           yield* iam
             .listRolePolicies({

package/src/AWS/Lambda/HttpServer.ts

@@ -1,4 +1,6 @@
 import type {
+  APIGatewayProxyEvent,
+  APIGatewayProxyResult,
   LambdaFunctionURLEvent,
   LambdaFunctionURLResult,
 } from "aws-lambda";
@@ -15,11 +17,25 @@ export const isFunctionURLEvent = (
   return event.requestContext?.http?.method !== undefined;
 };
 
+/**
+ * REST API (v1) AWS_PROXY events have a top-level `httpMethod` and a
+ * `requestContext.resourcePath` field. They lack the `requestContext.http.*`
+ * shape of Function URL / HTTP API (v2) events.
+ */
+export const isApiGatewayProxyEvent = (
+  event: any,
+): event is APIGatewayProxyEvent => {
+  return (
+    typeof event?.httpMethod === "string" &&
+    event?.requestContext?.resourcePath !== undefined
+  );
+};
+
 export const makeFunctionHttpHandler = <Req>(handler: Http.HttpEffect<Req>) => {
   const safeHandler = Http.safeHttpEffect(handler);
   return (event: any) => {
     if (isFunctionURLEvent(event)) {
-      const webRequest = toWebRequest(event);
+      const webRequest = functionUrlEventToWebRequest(event);
       const request = HttpServerRequest.fromWeb(webRequest).modify({
         url: webRequest.url,
         remoteAddress: Option.some(event.requestContext.http.sourceIp),
@@ -36,10 +52,32 @@ export const makeFunctionHttpHandler = <Req>(handler: Http.HttpEffect<Req>) => {
         >
       >;
     }
+    if (isApiGatewayProxyEvent(event)) {
+      const webRequest = apiGatewayProxyEventToWebRequest(event);
+      const request = HttpServerRequest.fromWeb(webRequest).modify({
+        url: webRequest.url,
+        remoteAddress: Option.fromNullishOr(
+          event.requestContext?.identity?.sourceIp,
+        ),
+      });
+      return safeHandler.pipe(
+        Effect.provideService(HttpServerRequest.HttpServerRequest, request),
+        Effect.flatMap(toApiGatewayProxyResult),
+      ) as Effect.Effect<
+        APIGatewayProxyResult,
+        never,
+        Exclude<
+          Effect.Services<typeof handler>,
+          HttpServerRequest.HttpServerRequest | Scope
+        >
+      >;
+    }
   };
 };
 
-const toWebRequest = (event: LambdaFunctionURLEvent): Request => {
+const functionUrlEventToWebRequest = (
+  event: LambdaFunctionURLEvent,
+): Request => {
   const protocol =
     event.headers["x-forwarded-proto"] ??
     event.requestContext.http.protocol ??
@@ -71,6 +109,83 @@ const toWebRequest = (event: LambdaFunctionURLEvent): Request => {
   });
 };
 
+const apiGatewayProxyEventToWebRequest = (
+  event: APIGatewayProxyEvent,
+): Request => {
+  const headers = new Headers();
+  if (event.multiValueHeaders) {
+    for (const [key, values] of Object.entries(event.multiValueHeaders)) {
+      if (!values) continue;
+      for (const value of values) {
+        if (value !== undefined && value !== null) {
+          headers.append(key, value);
+        }
+      }
+    }
+  }
+  if (event.headers) {
+    for (const [key, value] of Object.entries(event.headers)) {
+      if (value !== undefined && value !== null && !headers.has(key)) {
+        headers.set(key, value);
+      }
+    }
+  }
+
+  const protocol =
+    headers.get("x-forwarded-proto") ??
+    headers.get("X-Forwarded-Proto") ??
+    "https";
+  const host =
+    headers.get("host") ??
+    headers.get("Host") ??
+    event.requestContext.domainName ??
+    "lambda";
+  const stage = event.requestContext.stage;
+  // API Gateway prefixes paths with the stage when invoked via the default
+  // execute-api endpoint; `event.path` already contains that. Use it as-is.
+  const path = event.path ?? "/";
+
+  const queryParts: string[] = [];
+  if (event.multiValueQueryStringParameters) {
+    for (const [k, vs] of Object.entries(
+      event.multiValueQueryStringParameters,
+    )) {
+      if (!vs) continue;
+      for (const v of vs) {
+        queryParts.push(
+          `${encodeURIComponent(k)}=${encodeURIComponent(v ?? "")}`,
+        );
+      }
+    }
+  } else if (event.queryStringParameters) {
+    for (const [k, v] of Object.entries(event.queryStringParameters)) {
+      if (v === undefined || v === null) continue;
+      queryParts.push(`${encodeURIComponent(k)}=${encodeURIComponent(v)}`);
+    }
+  }
+  const queryString = queryParts.length > 0 ? `?${queryParts.join("&")}` : "";
+
+  const url = `${protocol}://${host}${path}${queryString}`;
+  const method = event.httpMethod;
+
+  let body: string | ArrayBuffer | undefined;
+  if (event.body !== null && event.body !== undefined) {
+    body = event.isBase64Encoded
+      ? Uint8Array.from(atob(event.body), (c) => c.charCodeAt(0)).buffer
+      : event.body;
+  }
+
+  // Reference `stage` so static analysis sees it as used; the variable is
+  // useful when constructing fully-qualified URLs in downstream code.
+  void stage;
+
+  return new Request(url, {
+    method,
+    headers,
+    body: body && method !== "GET" && method !== "HEAD" ? body : undefined,
+  });
+};
+
 const toLambdaFunctionURLResult = (
   response: HttpServerResponse.HttpServerResponse,
 ): Effect.Effect<LambdaFunctionURLResult> =>
@@ -111,6 +226,55 @@ const toLambdaFunctionURLResult = (
     };
   });
 
+const toApiGatewayProxyResult = (
+  response: HttpServerResponse.HttpServerResponse,
+): Effect.Effect<APIGatewayProxyResult> =>
+  Effect.gen(function* () {
+    const context = yield* Effect.context();
+    const webResponse = HttpServerResponse.toWeb(response, { context });
+    const headers = new Headers(webResponse.headers);
+
+    const multiValueHeaders: { [name: string]: string[] } = {};
+    const singleHeaders: { [name: string]: string } = {};
+    for (const [key, value] of headers.entries()) {
+      if (multiValueHeaders[key]) {
+        multiValueHeaders[key].push(value);
+      } else {
+        multiValueHeaders[key] = [value];
+        singleHeaders[key] = value;
+      }
+    }
+
+    if (!webResponse.body) {
+      return {
+        statusCode: webResponse.status,
+        headers: singleHeaders,
+        multiValueHeaders,
+        body: "",
+      };
+    }
+
+    const bytes = new Uint8Array(
+      yield* Effect.promise(() => webResponse.arrayBuffer()),
+    );
+    const isTextual = isTextualContentType(headers.get("content-type"));
+    const isBase64 = bytes.length > 0 && !isTextual;
+    const body =
+      bytes.length === 0
+        ? ""
+        : isTextual
+          ? new TextDecoder().decode(bytes)
+          : Buffer.from(bytes).toString("base64");
+
+    return {
+      statusCode: webResponse.status,
+      headers: singleHeaders,
+      multiValueHeaders,
+      body,
+      isBase64Encoded: isBase64,
+    };
+  });
+
 const isTextualContentType = (contentType: string | null): boolean => {
   if (!contentType) {
     return false;

package/src/AWS/Lambda/Permission.ts

@@ -134,9 +134,17 @@ export const PermissionProvider = () =>
             return { action: "replace" } as const;
           }
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const statementId = yield* createStatementId(id);
-
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          // Observe — derive identity. The statementId is deterministic from
+          // the logical id, so we always use it whether this is a first
+          // reconciliation, an adoption, or a re-run after a partial create.
+          const statementId =
+            output?.statementId ?? (yield* createStatementId(id));
+
+          // Ensure + sync — addPermission has no "update" API, so we
+          // unconditionally re-add. Tolerate `ResourceConflictException`
+          // (statement already exists) by removing and re-adding so the
+          // permission ends up matching `news`.
           yield* Lambda.addPermission({
             FunctionName: news.functionName,
             StatementId: statementId,
@@ -146,6 +154,7 @@ export const PermissionProvider = () =>
             SourceAccount: news.sourceAccount,
             EventSourceToken: news.eventSourceToken,
             FunctionUrlAuthType: news.functionUrlAuthType,
+            InvokedViaFunctionUrl: news.invokedViaFunctionUrl,
             PrincipalOrgID: news.principalOrgID,
           }).pipe(
             Effect.catchTag("ResourceConflictException", () =>
@@ -153,7 +162,12 @@ export const PermissionProvider = () =>
                 yield* Lambda.removePermission({
                   FunctionName: news.functionName,
                   StatementId: statementId,
-                });
+                }).pipe(
+                  Effect.catchTag(
+                    "ResourceNotFoundException",
+                    () => Effect.void,
+                  ),
+                );
                 yield* Lambda.addPermission({
                   FunctionName: news.functionName,
                   StatementId: statementId,
@@ -163,6 +177,7 @@ export const PermissionProvider = () =>
                   SourceAccount: news.sourceAccount,
                   EventSourceToken: news.eventSourceToken,
                   FunctionUrlAuthType: news.functionUrlAuthType,
+                  InvokedViaFunctionUrl: news.invokedViaFunctionUrl,
                   PrincipalOrgID: news.principalOrgID,
                 });
               }),
@@ -178,37 +193,6 @@ export const PermissionProvider = () =>
             functionName: news.functionName,
           };
         }),
-        update: Effect.fn(function* ({ news, output, session }) {
-          const statementId = output.statementId;
-
-          yield* Lambda.removePermission({
-            FunctionName: output.functionName,
-            StatementId: statementId,
-          }).pipe(
-            Effect.catchTag("ResourceNotFoundException", () => Effect.void),
-          );
-
-          yield* Lambda.addPermission({
-            FunctionName: news.functionName,
-            StatementId: statementId,
-            Action: news.action,
-            Principal: news.principal,
-            SourceArn: news.sourceArn,
-            SourceAccount: news.sourceAccount,
-            EventSourceToken: news.eventSourceToken,
-            FunctionUrlAuthType: news.functionUrlAuthType,
-            PrincipalOrgID: news.principalOrgID,
-          });
-
-          yield* session.note(
-            `Updated permission ${statementId} on ${news.functionName}`,
-          );
-
-          return {
-            statementId,
-            functionName: news.functionName,
-          };
-        }),
         delete: Effect.fn(function* ({ output }) {
           yield* Lambda.removePermission({
             FunctionName: output.functionName,