alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/Organizations/OrganizationalUnit.ts

@@ -1,13 +1,14 @@
 import * as organizations from "@distilled.cloud/aws/organizations";
 import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
 import type { Providers } from "../Providers.ts";
 import {
   collectPages,
   createName,
-  ensureOwnedByAlchemy,
   readResourceTags,
   retryOrganizations,
   updateResourceTags,
@@ -81,35 +82,37 @@ export const OrganizationalUnitProvider = () =>
           }
         }),
         read: Effect.fn(function* ({ id, olds, output }) {
-          if (output?.ouId) {
-            return yield* readOUById(output.ouId);
-          }
-
-          const parentId = olds?.parentId;
-          if (!parentId) {
-            return undefined;
-          }
-
-          return yield* readOUByParentAndName({
-            parentId,
-            name: yield* toName(id, olds ?? {}),
-          });
+          const state = output?.ouId
+            ? yield* readOUById(output.ouId)
+            : olds?.parentId
+              ? yield* readOUByParentAndName({
+                  parentId: olds.parentId,
+                  name: yield* toName(id, olds ?? {}),
+                })
+              : undefined;
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const name = yield* toName(id, news);
-          const existing = yield* readOUByParentAndName({
-            parentId: news.parentId,
-            name,
-          });
 
-          if (existing) {
-            yield* ensureOwnedByAlchemy(
-              id,
-              existing.ouId,
-              existing.tags,
-              "organizational unit",
-            );
-          } else {
+          // Observe — locate the OU by ID if known, else by parent+name.
+          // We fetch fresh so the reconciler converges over drift, adoption,
+          // and partial prior runs. `output.ouId` is treated only as a
+          // cache.
+          let state = output?.ouId
+            ? yield* readOUById(output.ouId)
+            : yield* readOUByParentAndName({
+                parentId: news.parentId,
+                name,
+              });
+
+          // Ensure — create the OU if missing. Tolerate
+          // `DuplicateOrganizationalUnitException` as adoption when a peer
+          // reconciler created it concurrently.
+          if (!state) {
             yield* retryOrganizations(
               organizations
                 .createOrganizationalUnit({
@@ -123,59 +126,49 @@ export const OrganizationalUnitProvider = () =>
                   ),
                 ),
             );
+            state = yield* readOUByParentAndName({
+              parentId: news.parentId,
+              name,
+            });
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(
+                  `organizational unit '${name}' not found after create`,
+                ),
+              );
+            }
           }
 
-          const created = yield* readOUByParentAndName({
-            parentId: news.parentId,
-            name,
-          });
-          if (!created) {
-            return yield* Effect.fail(
-              new Error(`organizational unit '${name}' not found after create`),
-            );
-          }
-
-          const tags = yield* updateResourceTags({
-            id,
-            resourceId: created.ouId,
-            olds: created.tags,
-            news: news.tags,
-          });
-
-          yield* session.note(created.ouArn);
-          return {
-            ...created,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          const newName = yield* toName(id, news);
-          if (output.name !== newName) {
+          // Sync name — observed ↔ desired. `parentId` is replacement-only,
+          // so the diff has handled any cross-parent move.
+          if (state.name !== name) {
             yield* retryOrganizations(
               organizations.updateOrganizationalUnit({
-                OrganizationalUnitId: output.ouId,
-                Name: newName,
+                OrganizationalUnitId: state.ouId,
+                Name: name,
               }),
             );
           }
 
+          // Sync tags — diff observed cloud tags against desired so
+          // adoption and drift converge correctly without trusting `olds`.
           const tags = yield* updateResourceTags({
             id,
-            resourceId: output.ouId,
-            olds: olds.tags,
+            resourceId: state.ouId,
+            olds: state.tags,
             news: news.tags,
           });
 
-          const updated = yield* readOUById(output.ouId);
+          const updated = yield* readOUById(state.ouId);
           if (!updated) {
             return yield* Effect.fail(
               new Error(
-                `organizational unit '${output.ouId}' not found after update`,
+                `organizational unit '${state.ouId}' not found after reconcile`,
               ),
             );
           }
 
-          yield* session.note(output.ouArn);
+          yield* session.note(updated.ouArn);
           return {
             ...updated,
             tags,

package/src/AWS/Organizations/Policy.ts

@@ -1,14 +1,15 @@
 import * as organizations from "@distilled.cloud/aws/organizations";
 import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
 import type { Providers } from "../Providers.ts";
 import type { PolicyDocument } from "../IAM/Policy.ts";
 import {
   collectPages,
   createName,
-  ensureOwnedByAlchemy,
   readResourceTags,
   retryOrganizations,
   updateResourceTags,
@@ -82,41 +83,45 @@ export const PolicyProvider = () =>
           }
         }),
         read: Effect.fn(function* ({ id, olds, output }) {
-          if (output?.policyId) {
-            return yield* readPolicyById(output.policyId);
-          }
-
-          if (!olds) {
-            return undefined;
-          }
-
-          return yield* readPolicyByName({
-            type: olds.type,
-            name: yield* toName(id, olds),
-          });
+          const state = output?.policyId
+            ? yield* readPolicyById(output.policyId)
+            : olds
+              ? yield* readPolicyByName({
+                  type: olds.type,
+                  name: yield* toName(id, olds),
+                })
+              : undefined;
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const name = yield* toName(id, news);
-          const existing = yield* readPolicyByName({
-            type: news.type,
-            name,
-          });
-
-          if (existing) {
-            yield* ensureOwnedByAlchemy(
-              id,
-              existing.policyId,
-              existing.tags,
-              "policy",
-            );
-          } else {
+          const desiredDescription = news.description ?? "";
+          const desiredContent = JSON.stringify(news.document);
+
+          // Observe — locate the policy by ID if known, else by type+name.
+          // Both `name` (after generation) and `type` are stable, so `diff`
+          // handles renames as a replacement; here we just look up.
+          let state = output?.policyId
+            ? yield* readPolicyById(output.policyId)
+            : yield* readPolicyByName({
+                type: news.type,
+                name,
+              });
+
+          // Ensure — create the policy if missing. Tolerate
+          // `DuplicatePolicyException` as adoption (a peer reconciler beat
+          // us, or our observation lost a race).
+          if (!state) {
             yield* retryOrganizations(
               organizations
                 .createPolicy({
                   Name: name,
-                  Description: news.description ?? "",
+                  Description: desiredDescription,
                   Type: news.type,
-                  Content: JSON.stringify(news.document),
+                  Content: desiredContent,
                 })
                 .pipe(
                   Effect.catchTag(
@@ -125,56 +130,54 @@ export const PolicyProvider = () =>
                   ),
                 ),
             );
+            state = yield* readPolicyByName({
+              type: news.type,
+              name,
+            });
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(`policy '${name}' not found after create`),
+              );
+            }
           }
 
-          const created = yield* readPolicyByName({
-            type: news.type,
-            name,
-          });
-          if (!created) {
-            return yield* Effect.fail(
-              new Error(`policy '${name}' not found after create`),
+          // Sync description + content — diff observed cloud state against
+          // desired. `updatePolicy` requires `Name`; we keep the existing
+          // policy name (rename triggers replacement at the diff level).
+          const observedDescription = state.description ?? "";
+          const observedContent = JSON.stringify(state.document);
+          if (
+            observedDescription !== desiredDescription ||
+            observedContent !== desiredContent
+          ) {
+            yield* retryOrganizations(
+              organizations.updatePolicy({
+                PolicyId: state.policyId,
+                Name: state.name,
+                Description: desiredDescription,
+                Content: desiredContent,
+              }),
             );
           }
 
+          // Sync tags — diff observed cloud tags against desired. Using
+          // `state.tags` (fetched fresh) keeps the reconciler convergent on
+          // adoption and drift.
           const tags = yield* updateResourceTags({
             id,
-            resourceId: created.policyId,
-            olds: created.tags,
-            news: news.tags,
-          });
-
-          yield* session.note(created.policyArn);
-          return {
-            ...created,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          yield* retryOrganizations(
-            organizations.updatePolicy({
-              PolicyId: output.policyId,
-              Name: output.name,
-              Description: news.description ?? "",
-              Content: JSON.stringify(news.document),
-            }),
-          );
-
-          const tags = yield* updateResourceTags({
-            id,
-            resourceId: output.policyId,
-            olds: olds.tags,
+            resourceId: state.policyId,
+            olds: state.tags,
             news: news.tags,
           });
 
-          const updated = yield* readPolicyById(output.policyId);
+          const updated = yield* readPolicyById(state.policyId);
           if (!updated) {
             return yield* Effect.fail(
-              new Error(`policy '${output.policyId}' not found after update`),
+              new Error(`policy '${state.policyId}' not found after reconcile`),
             );
           }
 
-          yield* session.note(output.policyArn);
+          yield* session.note(updated.policyArn);
           return {
             ...updated,
             tags,

package/src/AWS/Organizations/PolicyAttachment.ts

@@ -59,37 +59,42 @@ export const PolicyAttachmentProvider = () =>
             targetId: output?.targetId ?? olds!.targetId,
           });
         }),
-        create: Effect.fn(function* ({ news, session }) {
-          yield* retryOrganizations(
-            organizations
-              .attachPolicy({
-                PolicyId: news.policyId,
-                TargetId: news.targetId,
-              })
-              .pipe(
-                Effect.catchTag(
-                  "DuplicatePolicyAttachmentException",
-                  () => Effect.void,
-                ),
-              ),
-          );
+        reconcile: Effect.fn(function* ({ news, session }) {
+          // Observe — list current attachments to see whether ours is present.
+          // The attachment is identity-only; both `policyId` and `targetId`
+          // are stable, so `diff` handles any change as a replacement.
+          let state = yield* readAttachment(news);
 
-          const state = yield* readAttachment(news);
+          // Ensure — attach if missing. `DuplicatePolicyAttachmentException`
+          // is treated as success (e.g. a peer reconciler attached
+          // concurrently, or our observation lost a race).
           if (!state) {
-            return yield* Effect.fail(
-              new Error(
-                `policy attachment '${news.policyId}' -> '${news.targetId}' not found after create`,
-              ),
+            yield* retryOrganizations(
+              organizations
+                .attachPolicy({
+                  PolicyId: news.policyId,
+                  TargetId: news.targetId,
+                })
+                .pipe(
+                  Effect.catchTag(
+                    "DuplicatePolicyAttachmentException",
+                    () => Effect.void,
+                  ),
+                ),
             );
+            state = yield* readAttachment(news);
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(
+                  `policy attachment '${news.policyId}' -> '${news.targetId}' not found after create`,
+                ),
+              );
+            }
           }
 
           yield* session.note(`${state.policyId}:${state.targetId}`);
           return state;
         }),
-        update: Effect.fn(function* ({ output, session }) {
-          yield* session.note(`${output.policyId}:${output.targetId}`);
-          return output;
-        }),
         delete: Effect.fn(function* ({ output }) {
           yield* retryOrganizations(
             organizations

package/src/AWS/Organizations/Root.ts

@@ -73,41 +73,35 @@ export const RootProvider = () =>
             name: olds?.name,
           });
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const root = yield* readRoot(news);
-          if (!root) {
-            return yield* Effect.fail(new Error("organization root not found"));
-          }
-
-          const tags = yield* updateResourceTags({
-            id,
-            resourceId: root.rootId,
-            olds: root.tags,
-            news: news.tags,
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          // Observe — discover the live root. `Root` is import-only: AWS
+          // creates the root for us when the organization is created, and we
+          // never create or delete it. We always look it up fresh.
+          const root = yield* readRoot({
+            rootId: output?.rootId ?? news.rootId,
+            name: news.name,
           });
-
-          yield* session.note(root.rootArn);
-          return {
-            ...root,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          const root = yield* readRoot({ rootId: output.rootId });
           if (!root) {
             return yield* Effect.fail(
-              new Error(`organization root '${output.rootId}' not found`),
+              new Error(
+                output?.rootId
+                  ? `organization root '${output.rootId}' not found`
+                  : "organization root not found",
+              ),
             );
           }
 
+          // Sync tags — diff observed cloud tags against desired. Using
+          // `root.tags` as the baseline (instead of stale `olds.tags`) keeps
+          // the reconciler convergent even on adoption or after drift.
           const tags = yield* updateResourceTags({
             id,
-            resourceId: output.rootId,
-            olds: olds.tags,
+            resourceId: root.rootId,
+            olds: root.tags,
             news: news.tags,
           });
 
-          yield* session.note(output.rootArn);
+          yield* session.note(root.rootArn);
           return {
             ...root,
             tags,

package/src/AWS/Organizations/RootPolicyType.ts

@@ -58,38 +58,45 @@ export const RootPolicyTypeProvider = () =>
             policyType: output?.policyType ?? olds!.policyType,
           });
         }),
-        create: Effect.fn(function* ({ news, session }) {
-          yield* retryOrganizations(
-            organizations
-              .enablePolicyType({
-                RootId: news.rootId,
-                PolicyType: news.policyType,
-              })
-              .pipe(
-                Effect.catchTag(
-                  "PolicyTypeAlreadyEnabledException",
-                  () => Effect.void,
-                ),
-              ),
-          );
+        reconcile: Effect.fn(function* ({ news, session }) {
+          // Observe — read the root's policy-type list to see whether our
+          // type is already enabled. Both `rootId` and `policyType` are
+          // stable identifiers, so `diff` replaces on any change.
+          let state = yield* readRootPolicyType(news);
 
-          const state = yield* readRootPolicyType(news);
+          // Ensure — enable if missing. Tolerate
+          // `PolicyTypeAlreadyEnabledException` for idempotency. The list
+          // can lag behind the enable call, so we fall back to a
+          // `PENDING_ENABLE` synthetic state when read still returns nothing.
           if (!state) {
-            return {
-              rootId: news.rootId,
-              rootArn: undefined,
-              policyType: news.policyType,
-              status: "PENDING_ENABLE",
-            } satisfies RootPolicyType["Attributes"];
+            yield* retryOrganizations(
+              organizations
+                .enablePolicyType({
+                  RootId: news.rootId,
+                  PolicyType: news.policyType,
+                })
+                .pipe(
+                  Effect.catchTag(
+                    "PolicyTypeAlreadyEnabledException",
+                    () => Effect.void,
+                  ),
+                ),
+            );
+
+            state = yield* readRootPolicyType(news);
+            if (!state) {
+              return {
+                rootId: news.rootId,
+                rootArn: undefined,
+                policyType: news.policyType,
+                status: "PENDING_ENABLE",
+              } satisfies RootPolicyType["Attributes"];
+            }
           }
 
           yield* session.note(state.rootArn ?? state.rootId);
           return state;
         }),
-        update: Effect.fn(function* ({ output, session }) {
-          yield* session.note(output.rootArn ?? output.rootId);
-          return output;
-        }),
         delete: Effect.fn(function* ({ output }) {
           yield* retryOrganizations(
             organizations

package/src/AWS/Organizations/TrustedServiceAccess.ts

@@ -48,31 +48,33 @@ export const TrustedServiceAccessProvider = () =>
             output?.servicePrincipal ?? olds!.servicePrincipal,
           );
         }),
-        create: Effect.fn(function* ({ news, session }) {
-          if (!(yield* readTrustedServiceAccess(news.servicePrincipal))) {
+        reconcile: Effect.fn(function* ({ news, session }) {
+          // Observe — fetch live trusted-access state. We never trust prior
+          // `output` blindly; if access was disabled out-of-band we re-enable.
+          let state = yield* readTrustedServiceAccess(news.servicePrincipal);
+
+          // Ensure — enable trusted access if it's missing. This API is
+          // effectively idempotent for already-enabled principals, but we
+          // gate the call to avoid unnecessary churn.
+          if (!state) {
             yield* retryOrganizations(
               organizations.enableAWSServiceAccess({
                 ServicePrincipal: news.servicePrincipal,
               }),
             );
-          }
-
-          const state = yield* readTrustedServiceAccess(news.servicePrincipal);
-          if (!state) {
-            return yield* Effect.fail(
-              new Error(
-                `trusted service access '${news.servicePrincipal}' not found after create`,
-              ),
-            );
+            state = yield* readTrustedServiceAccess(news.servicePrincipal);
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(
+                  `trusted service access '${news.servicePrincipal}' not found after create`,
+                ),
+              );
+            }
           }
 
           yield* session.note(state.servicePrincipal);
           return state;
         }),
-        update: Effect.fn(function* ({ output, session }) {
-          yield* session.note(output.servicePrincipal);
-          return output;
-        }),
         delete: Effect.fn(function* ({ output }) {
           if (!(yield* readTrustedServiceAccess(output.servicePrincipal))) {
             return;

package/src/AWS/Organizations/common.ts

@@ -2,7 +2,7 @@ import * as organizations from "@distilled.cloud/aws/organizations";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
 import { createPhysicalName } from "../../PhysicalName.ts";
-import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
 
 export type OrganizationsTags = Record<string, string>;
 
@@ -78,21 +78,6 @@ export const readResourceTags = (resourceId: string) =>
     (page) => page.Tags,
   ).pipe(Effect.map(toTagRecord));
 
-export const ensureOwnedByAlchemy = Effect.fn(function* (
-  id: string,
-  resourceId: string,
-  tags: OrganizationsTags,
-  resourceType: string,
-) {
-  if (!(yield* hasAlchemyTags(id, tags))) {
-    return yield* Effect.fail(
-      new Error(
-        `${resourceType} '${resourceId}' already exists and is not managed by this stack`,
-      ),
-    );
-  }
-});
-
 export const updateResourceTags = Effect.fn(function* ({
   id,
   resourceId,