alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/Logs/LogGroup.ts

@@ -108,51 +108,57 @@ export const LogGroupProvider = () =>
             tags: output?.tags ?? {},
           };
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const logGroupName = yield* toLogGroupName(id, news);
-          const tags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const logGroupName =
+            output?.logGroupName ?? (yield* toLogGroupName(id, news));
+          const arn = (output?.logGroupArn ??
+            `arn:aws:logs:${region}:${accountId}:log-group:${logGroupName}`) as LogGroupArn;
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
 
-          yield* logs
-            .createLogGroup({
-              logGroupName,
-              kmsKeyId: news.kmsKeyId,
-              tags,
-            })
-            .pipe(
-              Effect.catchTag(
-                "ResourceAlreadyExistsException",
-                () => Effect.void,
-              ),
-            );
+          // Observe — fetch live state. `describeLogGroups` returns
+          // retention/kms info so we can diff against desired without
+          // trusting `olds` or `output`.
+          const described = yield* logs.describeLogGroups({
+            logGroupNamePrefix: logGroupName,
+            limit: 1,
+          });
+          let observed = (described.logGroups ?? []).find(
+            (group) => group.logGroupName === logGroupName,
+          );
 
-          if (news.retentionInDays !== undefined) {
-            yield* logs.putRetentionPolicy({
-              logGroupName,
-              retentionInDays: news.retentionInDays,
+          // Ensure — create if missing. `createLogGroup` accepts tags and
+          // kmsKeyId on first create; tolerate `ResourceAlreadyExistsException`
+          // (race with peer reconciler) and re-read.
+          if (!observed?.arn) {
+            yield* logs
+              .createLogGroup({
+                logGroupName,
+                kmsKeyId: news.kmsKeyId,
+                tags: desiredTags,
+              })
+              .pipe(
+                Effect.catchTag(
+                  "ResourceAlreadyExistsException",
+                  () => Effect.void,
+                ),
+              );
+            const reread = yield* logs.describeLogGroups({
+              logGroupNamePrefix: logGroupName,
+              limit: 1,
             });
+            observed = (reread.logGroups ?? []).find(
+              (group) => group.logGroupName === logGroupName,
+            );
           }
 
-          const arn =
-            `arn:aws:logs:${region}:${accountId}:log-group:${logGroupName}` as LogGroupArn;
-          yield* session.note(arn);
-
-          return {
-            logGroupName,
-            logGroupArn: arn,
-            retentionInDays: news.retentionInDays,
-            kmsKeyId: news.kmsKeyId,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          if (news.retentionInDays !== olds.retentionInDays) {
+          // Sync retention — observed ↔ desired.
+          const observedRetention = observed?.retentionInDays;
+          if (news.retentionInDays !== observedRetention) {
             if (news.retentionInDays === undefined) {
               yield* logs
                 .deleteRetentionPolicy({
-                  logGroupName: output.logGroupName,
+                  logGroupName,
                 })
                 .pipe(
                   Effect.catchTag(
@@ -162,24 +168,32 @@ export const LogGroupProvider = () =>
                 );
             } else {
               yield* logs.putRetentionPolicy({
-                logGroupName: output.logGroupName,
+                logGroupName,
                 retentionInDays: news.retentionInDays,
               });
             }
           }
 
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
+          // Sync tags — list observed tags then diff against desired so
+          // adoption rewrites ownership tags correctly.
+          const observedTags = yield* logs
+            .listTagsForResource({ resourceArn: arn })
+            .pipe(
+              Effect.map(
+                (r): Record<string, string> =>
+                  Object.fromEntries(
+                    Object.entries(r.tags ?? {}).filter(
+                      (entry): entry is [string, string] =>
+                        typeof entry[1] === "string",
+                    ),
+                  ),
+              ),
+              Effect.catch(() => Effect.succeed({} as Record<string, string>)),
+            );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
           if (upsert.length > 0) {
             yield* logs.tagResource({
-              resourceArn: output.logGroupArn,
+              resourceArn: arn,
               tags: Object.fromEntries(
                 upsert.map((tag) => [tag.Key, tag.Value]),
               ),
@@ -187,17 +201,19 @@ export const LogGroupProvider = () =>
           }
           if (removed.length > 0) {
             yield* logs.untagResource({
-              resourceArn: output.logGroupArn,
+              resourceArn: arn,
               tagKeys: removed,
             });
           }
 
-          yield* session.note(output.logGroupArn);
+          yield* session.note(arn);
+
           return {
-            ...output,
+            logGroupName,
+            logGroupArn: arn,
             retentionInDays: news.retentionInDays,
             kmsKeyId: news.kmsKeyId,
-            tags: newTags,
+            tags: desiredTags,
           };
         }),
         delete: Effect.fn(function* ({ output }) {

package/src/AWS/Organizations/Account.ts

@@ -2,13 +2,14 @@ import * as accountManagement from "@distilled.cloud/aws/account";
 import * as organizations from "@distilled.cloud/aws/organizations";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
 import type { Providers } from "../Providers.ts";
 import {
   collectPages,
-  ensureOwnedByAlchemy,
   readResourceTags,
   retryOrganizations,
   updateResourceTags,
@@ -83,34 +84,37 @@ export const AccountProvider = () =>
             return { action: "update" } as const;
           }
         }),
-        read: Effect.fn(function* ({ olds, output }) {
-          if (output?.accountId) {
-            return yield* readAccountById(output.accountId);
-          }
-
-          if (!olds) {
-            return undefined;
-          }
-
-          return yield* readAccountByNameOrEmail({
-            name: olds.name,
-            email: olds.email,
-          });
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const state = output?.accountId
+            ? yield* readAccountById(output.accountId)
+            : olds
+              ? yield* readAccountByNameOrEmail({
+                  name: olds.name,
+                  email: olds.email,
+                })
+              : undefined;
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const existing = yield* readAccountByNameOrEmail({
-            name: news.name,
-            email: news.email,
-          });
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          // Observe — locate the account by ID if known, else by
+          // name/email. We always fetch fresh: state persistence may have
+          // failed after a prior `createAccount`, leaving an account on AWS
+          // we have no record of.
+          let state = output?.accountId
+            ? yield* readAccountById(output.accountId)
+            : yield* readAccountByNameOrEmail({
+                name: news.name,
+                email: news.email,
+              });
 
-          if (existing) {
-            yield* ensureOwnedByAlchemy(
-              id,
-              existing.accountId,
-              existing.tags,
-              "account",
-            );
-          } else {
+          // Ensure — create the account if it doesn't exist. Account
+          // creation is asynchronous: `createAccount` returns a
+          // `CreateAccountStatus` which we poll until the account ID is
+          // assigned (or the request fails).
+          if (!state) {
             const createResponse = yield* retryOrganizations(
               organizations.createAccount({
                 Email: news.email,
@@ -125,78 +129,63 @@ export const AccountProvider = () =>
               const status = yield* waitForCreateAccount(requestId);
               yield* session.note(status.AccountId ?? requestId);
             }
-          }
 
-          let created = yield* readAccountByNameOrEmail({
-            name: news.name,
-            email: news.email,
-          });
-
-          if (!created) {
-            return yield* Effect.fail(
-              new Error(`account '${news.name}' not found after create`),
-            );
-          }
-
-          if (created.parentId !== news.parentId && created.parentId) {
-            yield* retryOrganizations(
-              organizations.moveAccount({
-                AccountId: created.accountId,
-                SourceParentId: created.parentId,
-                DestinationParentId: news.parentId,
-              }),
-            );
-            created = (yield* readAccountById(created.accountId)) ?? created;
+            state = yield* readAccountByNameOrEmail({
+              name: news.name,
+              email: news.email,
+            });
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(`account '${news.name}' not found after create`),
+              );
+            }
           }
 
-          const tags = yield* updateResourceTags({
-            id,
-            resourceId: created.accountId,
-            olds: created.tags,
-            news: news.tags,
-          });
-
-          yield* session.note(created.accountArn);
-          return {
-            ...created,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          if (output.name !== news.name) {
+          // Sync name — observed ↔ desired. Account name lives on the
+          // account-management service, not Organizations. The diff has
+          // already short-circuited any email change as a replacement.
+          if (state.name !== news.name) {
             yield* retryAccountManagement(
               accountManagement.putAccountName({
-                AccountId: output.accountId,
+                AccountId: state.accountId,
                 AccountName: news.name,
               }),
             );
           }
 
-          if (output.parentId && output.parentId !== news.parentId) {
+          // Sync parent — move the account if its observed parent differs
+          // from desired. We only move when we know the source parent (the
+          // API requires it).
+          if (state.parentId && state.parentId !== news.parentId) {
             yield* retryOrganizations(
               organizations.moveAccount({
-                AccountId: output.accountId,
-                SourceParentId: output.parentId,
+                AccountId: state.accountId,
+                SourceParentId: state.parentId,
                 DestinationParentId: news.parentId,
               }),
             );
           }
 
+          // Sync tags — diff observed cloud tags against desired so
+          // adoption and drift converge. We baseline against `state.tags`
+          // (fetched fresh) instead of stale `olds`.
           const tags = yield* updateResourceTags({
             id,
-            resourceId: output.accountId,
-            olds: olds.tags,
+            resourceId: state.accountId,
+            olds: state.tags,
             news: news.tags,
           });
 
-          const updated = yield* readAccountById(output.accountId);
+          const updated = yield* readAccountById(state.accountId);
           if (!updated) {
             return yield* Effect.fail(
-              new Error(`account '${output.accountId}' not found after update`),
+              new Error(
+                `account '${state.accountId}' not found after reconcile`,
+              ),
             );
           }
 
-          yield* session.note(output.accountArn);
+          yield* session.note(updated.accountArn);
           return {
             ...updated,
             tags,

package/src/AWS/Organizations/DelegatedAdministrator.ts

@@ -61,8 +61,16 @@ export const DelegatedAdministratorProvider = () =>
               output?.servicePrincipal ?? olds!.servicePrincipal,
           });
         }),
-        create: Effect.fn(function* ({ news, session }) {
-          if (!(yield* readDelegatedAdministrator(news))) {
+        reconcile: Effect.fn(function* ({ news, session }) {
+          // Observe — look up the live delegation. Replacement-only props
+          // (`accountId`, `servicePrincipal`) mean the diff handles identity
+          // changes; we just check whether the registration exists.
+          let state = yield* readDelegatedAdministrator(news);
+
+          // Ensure — register if missing. Tolerate
+          // `AccountAlreadyRegisteredException` for idempotency under races
+          // between observe and register.
+          if (!state) {
             yield* retryOrganizations(
               organizations
                 .registerDelegatedAdministrator({
@@ -76,24 +84,19 @@ export const DelegatedAdministratorProvider = () =>
                   ),
                 ),
             );
-          }
-
-          const state = yield* readDelegatedAdministrator(news);
-          if (!state) {
-            return yield* Effect.fail(
-              new Error(
-                `delegated administrator '${news.accountId}' for '${news.servicePrincipal}' not found after create`,
-              ),
-            );
+            state = yield* readDelegatedAdministrator(news);
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(
+                  `delegated administrator '${news.accountId}' for '${news.servicePrincipal}' not found after create`,
+                ),
+              );
+            }
           }
 
           yield* session.note(`${state.accountId}:${state.servicePrincipal}`);
           return state;
         }),
-        update: Effect.fn(function* ({ output, session }) {
-          yield* session.note(`${output.accountId}:${output.servicePrincipal}`);
-          return output;
-        }),
         delete: Effect.fn(function* ({ output }) {
           if (
             !(yield* readDelegatedAdministrator({

package/src/AWS/Organizations/Organization.ts

@@ -64,49 +64,48 @@ export const OrganizationProvider = () =>
           const org = yield* readOrganization();
           return org?.Id && org.Arn ? toAttrs(org) : undefined;
         }),
-        create: Effect.fn(function* ({ news, session }) {
+        reconcile: Effect.fn(function* ({ news, session }) {
           const desiredFeatureSet = news.featureSet ?? "ALL";
-          const existing = yield* readOrganization();
-          const org = existing
-            ? yield* ensureFeatureSet({
-                desired: desiredFeatureSet,
-                current: existing,
-              })
-            : yield* retryOrganizations(
-                organizations.createOrganization({
-                  FeatureSet: desiredFeatureSet,
-                }),
-              ).pipe(
-                Effect.map((response) => response.Organization),
-                Effect.catchTag("AlreadyInOrganizationException", () =>
-                  readOrganization(),
-                ),
-              );
 
-          if (!org?.Id || !org.Arn) {
-            return yield* Effect.fail(
-              new Error("failed to resolve organization after create"),
+          // Observe — fetch the live singleton organization. There's at most
+          // one organization per management account, and `read` may have
+          // surfaced an existing one for adoption.
+          let org = yield* readOrganization();
+
+          // Ensure — create the organization if it's missing. Tolerate
+          // `AlreadyInOrganizationException` as a race with a concurrent
+          // creator (e.g. another tool, or a peer reconciler).
+          if (!org) {
+            org = yield* retryOrganizations(
+              organizations.createOrganization({
+                FeatureSet: desiredFeatureSet,
+              }),
+            ).pipe(
+              Effect.map((response) => response.Organization),
+              Effect.catchTag("AlreadyInOrganizationException", () =>
+                readOrganization(),
+              ),
             );
           }
 
-          yield* session.note(org.Arn);
-          return toAttrs(org);
-        }),
-        update: Effect.fn(function* ({ news, output, session }) {
-          const current = yield* readOrganization();
-          if (!current?.Id || !current.Arn) {
+          if (!org?.Id || !org.Arn) {
             return yield* Effect.fail(
-              new Error("organization not found during update"),
+              new Error("failed to resolve organization after reconcile"),
             );
           }
 
-          const updated = yield* ensureFeatureSet({
-            desired: news.featureSet,
-            current,
+          const orgArn = org.Arn;
+
+          // Sync feature set — observed ↔ desired. `ensureFeatureSet`
+          // handles the only legal transition (CONSOLIDATED_BILLING -> ALL)
+          // and rejects anything else.
+          org = yield* ensureFeatureSet({
+            desired: desiredFeatureSet,
+            current: org,
           });
 
-          yield* session.note(output.organizationArn);
-          return toAttrs(updated);
+          yield* session.note(orgArn);
+          return toAttrs(org);
         }),
         delete: Effect.fn(function* () {
           yield* retryOrganizations(

package/src/AWS/Organizations/OrganizationResourcePolicy.ts

@@ -62,38 +62,39 @@ export const OrganizationResourcePolicyProvider = () =>
         read: Effect.fn(function* () {
           return yield* readResourcePolicy();
         }),
-        create: Effect.fn(function* ({ news, session }) {
-          yield* retryOrganizations(
-            organizations.putResourcePolicy({
-              Content: JSON.stringify(news.document),
-            }),
-          );
+        reconcile: Effect.fn(function* ({ news, session }) {
+          const desiredContent = JSON.stringify(news.document);
 
-          const state = yield* readResourcePolicy();
-          if (!state) {
-            return yield* Effect.fail(
-              new Error("organization resource policy not found after create"),
+          // Observe — fetch the live resource policy (or absence).
+          let state = yield* readResourcePolicy();
+
+          // Sync — `putResourcePolicy` is a single upsert that handles both
+          // first-create and update. We diff observed content against
+          // desired so the call only fires when there's drift. Reading by
+          // ID isn't possible (resource is a singleton with a server-issued
+          // ID), so we compare the JSON-stringified document.
+          const observedContent = state
+            ? JSON.stringify(state.document)
+            : undefined;
+
+          if (observedContent !== desiredContent) {
+            yield* retryOrganizations(
+              organizations.putResourcePolicy({
+                Content: desiredContent,
+              }),
             );
+            state = yield* readResourcePolicy();
           }
 
-          yield* session.note(state.resourcePolicyArn);
-          return state;
-        }),
-        update: Effect.fn(function* ({ news, output, session }) {
-          yield* retryOrganizations(
-            organizations.putResourcePolicy({
-              Content: JSON.stringify(news.document),
-            }),
-          );
-
-          const state = yield* readResourcePolicy();
           if (!state) {
             return yield* Effect.fail(
-              new Error("organization resource policy not found after update"),
+              new Error(
+                "organization resource policy not found after reconcile",
+              ),
             );
           }
 
-          yield* session.note(output.resourcePolicyArn);
+          yield* session.note(state.resourcePolicyArn);
           return state;
         }),
         delete: Effect.fn(function* () {