alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/RDS/DBProxyTargetGroup.ts

@@ -98,60 +98,42 @@ export const DBProxyTargetGroupProvider = () =>
         dbInstanceIdentifiers: props.dbInstanceIdentifiers ?? [],
       });
 
-      const applyTargets = Effect.fn(function* ({
-        olds,
-        news,
+      const readTargets = Effect.fn(function* ({
+        dbProxyName,
+        targetGroupName,
       }: {
-        olds?: DBProxyTargetGroupProps;
-        news: DBProxyTargetGroupProps;
+        dbProxyName: string;
+        targetGroupName: string;
       }) {
-        const oldClusters = new Set(olds?.dbClusterIdentifiers ?? []);
-        const newClusters = new Set(news.dbClusterIdentifiers ?? []);
-        const oldInstances = new Set(olds?.dbInstanceIdentifiers ?? []);
-        const newInstances = new Set(news.dbInstanceIdentifiers ?? []);
-
-        const addClusters = [...newClusters].filter(
-          (id) => !oldClusters.has(id),
-        );
-        const removeClusters = [...oldClusters].filter(
-          (id) => !newClusters.has(id),
-        );
-        const addInstances = [...newInstances].filter(
-          (id) => !oldInstances.has(id),
-        );
-        const removeInstances = [...oldInstances].filter(
-          (id) => !newInstances.has(id),
-        );
-
-        if (news.connectionPoolConfig) {
-          yield* rds.modifyDBProxyTargetGroup({
-            DBProxyName: news.dbProxyName,
-            TargetGroupName: toTargetGroupName(news),
-            ConnectionPoolConfig: news.connectionPoolConfig,
-          });
-        }
-
-        if (addClusters.length > 0 || addInstances.length > 0) {
-          yield* rds.registerDBProxyTargets({
-            DBProxyName: news.dbProxyName,
-            TargetGroupName: toTargetGroupName(news),
-            DBClusterIdentifiers:
-              addClusters.length > 0 ? addClusters : undefined,
-            DBInstanceIdentifiers:
-              addInstances.length > 0 ? addInstances : undefined,
-          });
-        }
-
-        if (removeClusters.length > 0 || removeInstances.length > 0) {
-          yield* rds.deregisterDBProxyTargets({
-            DBProxyName: news.dbProxyName,
-            TargetGroupName: toTargetGroupName(news),
-            DBClusterIdentifiers:
-              removeClusters.length > 0 ? removeClusters : undefined,
-            DBInstanceIdentifiers:
-              removeInstances.length > 0 ? removeInstances : undefined,
-          });
+        const response = yield* rds
+          .describeDBProxyTargets({
+            DBProxyName: dbProxyName,
+            TargetGroupName: targetGroupName,
+          })
+          .pipe(
+            Effect.catchTag("DBProxyTargetNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+            Effect.catchTag("DBProxyTargetGroupNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+            Effect.catchTag("DBProxyNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        const targets = response?.Targets ?? [];
+        const observedClusters: string[] = [];
+        const observedInstances: string[] = [];
+        for (const target of targets) {
+          const id = target.RdsResourceId;
+          if (!id) continue;
+          if (target.Type === "TRACKED_CLUSTER") {
+            observedClusters.push(id);
+          } else if (target.Type === "RDS_INSTANCE") {
+            observedInstances.push(id);
+          }
         }
+        return { observedClusters, observedInstances };
       });
 
       return {
@@ -185,37 +167,93 @@ export const DBProxyTargetGroupProvider = () =>
           }
           return toAttrs({ group, props });
         }),
-        create: Effect.fn(function* ({ news, session }) {
-          yield* applyTargets({ news });
-          const group = yield* readGroup({
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          const targetGroupName = toTargetGroupName(news);
+
+          // Observe — the "default" target group is created automatically
+          // by RDS when the parent DBProxy is created, so we don't `Ensure`
+          // a target group ourselves. We just describe it to confirm the
+          // proxy is ready and to read connection-pool config.
+          let observedGroup = yield* readGroup({
             dbProxyName: news.dbProxyName,
-            targetGroupName: toTargetGroupName(news),
+            targetGroupName,
           });
-          if (!group?.TargetGroupName) {
-            return yield* Effect.fail(
-              new Error(
-                `DB proxy target group '${toTargetGroupName(news)}' not found`,
-              ),
-            );
+
+          // Sync connection pool config — push desired shape if provided.
+          // `modifyDBProxyTargetGroup` is idempotent for unchanged config.
+          if (news.connectionPoolConfig) {
+            yield* rds.modifyDBProxyTargetGroup({
+              DBProxyName: news.dbProxyName,
+              TargetGroupName: targetGroupName,
+              ConnectionPoolConfig: news.connectionPoolConfig,
+            });
           }
-          yield* session.note(group.TargetGroupArn ?? group.TargetGroupName);
-          return toAttrs({ group, props: news });
-        }),
-        update: Effect.fn(function* ({ olds, news, output, session }) {
-          yield* applyTargets({ olds, news });
-          const group = yield* readGroup({
-            dbProxyName: output.dbProxyName,
-            targetGroupName: output.targetGroupName,
+
+          // Sync registered targets — diff observed live targets against
+          // desired and apply only the delta. We trust live cloud state
+          // over `output`/`olds` so adoption and drift converge.
+          const { observedClusters, observedInstances } = yield* readTargets({
+            dbProxyName: news.dbProxyName,
+            targetGroupName,
           });
-          if (!group?.TargetGroupName) {
+          const desiredClusters = new Set(news.dbClusterIdentifiers ?? []);
+          const desiredInstances = new Set(news.dbInstanceIdentifiers ?? []);
+          const observedClusterSet = new Set(observedClusters);
+          const observedInstanceSet = new Set(observedInstances);
+
+          const addClusters = [...desiredClusters].filter(
+            (id) => !observedClusterSet.has(id),
+          );
+          const removeClusters = [...observedClusterSet].filter(
+            (id) => !desiredClusters.has(id),
+          );
+          const addInstances = [...desiredInstances].filter(
+            (id) => !observedInstanceSet.has(id),
+          );
+          const removeInstances = [...observedInstanceSet].filter(
+            (id) => !desiredInstances.has(id),
+          );
+
+          if (addClusters.length > 0 || addInstances.length > 0) {
+            yield* rds.registerDBProxyTargets({
+              DBProxyName: news.dbProxyName,
+              TargetGroupName: targetGroupName,
+              DBClusterIdentifiers:
+                addClusters.length > 0 ? addClusters : undefined,
+              DBInstanceIdentifiers:
+                addInstances.length > 0 ? addInstances : undefined,
+            });
+          }
+
+          if (removeClusters.length > 0 || removeInstances.length > 0) {
+            yield* rds.deregisterDBProxyTargets({
+              DBProxyName: news.dbProxyName,
+              TargetGroupName: targetGroupName,
+              DBClusterIdentifiers:
+                removeClusters.length > 0 ? removeClusters : undefined,
+              DBInstanceIdentifiers:
+                removeInstances.length > 0 ? removeInstances : undefined,
+            });
+          }
+
+          // Re-read so returned attrs reflect post-sync state. If the
+          // target group still isn't visible, surface the failure (the
+          // parent DBProxy must be up).
+          observedGroup = yield* readGroup({
+            dbProxyName: news.dbProxyName,
+            targetGroupName,
+          });
+          if (!observedGroup?.TargetGroupName) {
             return yield* Effect.fail(
-              new Error(
-                `DB proxy target group '${output.targetGroupName}' not found`,
-              ),
+              new Error(`DB proxy target group '${targetGroupName}' not found`),
             );
           }
-          yield* session.note(output.targetGroupArn ?? output.targetGroupName);
-          return toAttrs({ group, props: news });
+          yield* session.note(
+            observedGroup.TargetGroupArn ??
+              output?.targetGroupArn ??
+              observedGroup.TargetGroupName,
+          );
+          return toAttrs({ group: observedGroup, props: news });
         }),
         delete: Effect.fn(function* ({ output }) {
           if (

package/src/AWS/RDS/DBSubnetGroup.ts

@@ -105,98 +105,94 @@ export const DBSubnetGroupProvider = () =>
             tags: output?.tags ?? {},
           };
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const dbSubnetGroupName = yield* toName(id, news);
-          const tags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const dbSubnetGroupName =
+            output?.dbSubnetGroupName ?? (yield* toName(id, news));
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live subnet-group state.
+          let observed = yield* readGroup(dbSubnetGroupName);
 
-          const created = yield* rds
-            .createDBSubnetGroup({
+          // Ensure — create if missing. Tolerate
+          // `DBSubnetGroupAlreadyExistsFault` as a race with a peer
+          // reconciler by re-reading.
+          if (!observed?.DBSubnetGroupName) {
+            yield* rds
+              .createDBSubnetGroup({
+                DBSubnetGroupName: dbSubnetGroupName,
+                DBSubnetGroupDescription:
+                  news.description ?? "Managed by Alchemy",
+                SubnetIds: news.subnetIds,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag(
+                  "DBSubnetGroupAlreadyExistsFault",
+                  () => Effect.void,
+                ),
+              );
+            observed = yield* readGroup(dbSubnetGroupName);
+            if (!observed?.DBSubnetGroupName) {
+              return yield* Effect.fail(
+                new Error(
+                  `Failed to create DB subnet group '${dbSubnetGroupName}'`,
+                ),
+              );
+            }
+          } else {
+            // Sync description and subnet membership — `modifyDBSubnetGroup`
+            // accepts the full desired set and is idempotent for unchanged
+            // input.
+            yield* rds.modifyDBSubnetGroup({
               DBSubnetGroupName: dbSubnetGroupName,
               DBSubnetGroupDescription:
                 news.description ?? "Managed by Alchemy",
               SubnetIds: news.subnetIds,
-              Tags: Object.entries(tags).map(([Key, Value]) => ({
-                Key,
-                Value,
-              })),
-            })
-            .pipe(
-              Effect.catchTag("DBSubnetGroupAlreadyExistsFault", () =>
-                rds.describeDBSubnetGroups({
-                  DBSubnetGroupName: dbSubnetGroupName,
-                }),
-              ),
-            );
-
-          const group =
-            "DBSubnetGroup" in created
-              ? created.DBSubnetGroup
-              : (created as rds.DBSubnetGroupMessage).DBSubnetGroups?.[0];
-          if (!group?.DBSubnetGroupName) {
-            return yield* Effect.fail(
-              new Error(
-                `Failed to create DB subnet group '${dbSubnetGroupName}'`,
-              ),
-            );
+            });
+            observed = yield* readGroup(dbSubnetGroupName);
+            if (!observed?.DBSubnetGroupName) {
+              return yield* Effect.fail(
+                new Error(
+                  `DB subnet group '${dbSubnetGroupName}' not found after update`,
+                ),
+              );
+            }
           }
 
-          yield* session.note(group.DBSubnetGroupArn ?? dbSubnetGroupName);
-          return {
-            dbSubnetGroupName: group.DBSubnetGroupName,
-            dbSubnetGroupArn: group.DBSubnetGroupArn,
-            vpcId: group.VpcId,
-            subnetIds: news.subnetIds,
-            status: group.SubnetGroupStatus,
-            supportedNetworkTypes: group.SupportedNetworkTypes,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          yield* rds.modifyDBSubnetGroup({
-            DBSubnetGroupName: output.dbSubnetGroupName,
-            DBSubnetGroupDescription: news.description ?? "Managed by Alchemy",
-            SubnetIds: news.subnetIds,
-          });
+          const dbSubnetGroupArn = observed.DBSubnetGroupArn;
 
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
-          if (upsert.length > 0 && output.dbSubnetGroupArn) {
+          // Sync tags — diff prior recorded tags against desired (describe
+          // does not surface tags inline).
+          const observedTags = output?.tags ?? {};
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0 && dbSubnetGroupArn) {
             yield* rds.addTagsToResource({
-              ResourceName: output.dbSubnetGroupArn,
+              ResourceName: dbSubnetGroupArn,
               Tags: upsert,
             });
           }
-          if (removed.length > 0 && output.dbSubnetGroupArn) {
+          if (removed.length > 0 && dbSubnetGroupArn) {
             yield* rds.removeTagsFromResource({
-              ResourceName: output.dbSubnetGroupArn,
+              ResourceName: dbSubnetGroupArn,
               TagKeys: removed,
             });
           }
 
-          const group = yield* readGroup(output.dbSubnetGroupName);
-          yield* session.note(
-            output.dbSubnetGroupArn ?? output.dbSubnetGroupName,
-          );
+          yield* session.note(dbSubnetGroupArn ?? dbSubnetGroupName);
           return {
-            dbSubnetGroupName: output.dbSubnetGroupName,
-            dbSubnetGroupArn:
-              group?.DBSubnetGroupArn ?? output.dbSubnetGroupArn,
-            vpcId: group?.VpcId ?? output.vpcId,
-            subnetIds: news.subnetIds,
-            status: group?.SubnetGroupStatus ?? output.status,
-            supportedNetworkTypes:
-              group?.SupportedNetworkTypes ?? output.supportedNetworkTypes,
-            tags: newTags,
+            dbSubnetGroupName: observed.DBSubnetGroupName,
+            dbSubnetGroupArn,
+            vpcId: observed.VpcId,
+            subnetIds: (observed.Subnets ?? []).flatMap((subnet) =>
+              subnet.SubnetIdentifier ? [subnet.SubnetIdentifier] : [],
+            ),
+            status: observed.SubnetGroupStatus,
+            supportedNetworkTypes: observed.SupportedNetworkTypes,
+            tags: desiredTags,
           };
         }),
         delete: Effect.fn(function* ({ output }) {

package/src/AWS/Route53/Record.ts

@@ -276,26 +276,20 @@ export const RecordProvider = () =>
 
           return toAttrs(recordSet, output?.hostedZoneId ?? olds!.hostedZoneId);
         }),
-        create: Effect.fn(function* ({ news, session }) {
+        reconcile: Effect.fn(function* ({ news, session }) {
+          // Route 53 `changeResourceRecordSets` with `UPSERT` is naturally
+          // reconciler-friendly: it creates the record if missing and
+          // overwrites it if present. There's no separate ensure/sync split
+          // — one call converges to the desired record set.
           yield* upsertRecord(news);
-          const recordSet = yield* findRecord(news.hostedZoneId, news);
-
-          if (!recordSet) {
-            return yield* Effect.die(
-              new Error("Route53 record was not found after create"),
-            );
-          }
 
-          yield* session.note(`${news.type} ${normalizeName(news.name)}`);
-          return toAttrs(recordSet, news.hostedZoneId);
-        }),
-        update: Effect.fn(function* ({ news, session }) {
-          yield* upsertRecord(news);
+          // Re-read so the returned attributes reflect the actual current
+          // record (including server-applied defaults).
           const recordSet = yield* findRecord(news.hostedZoneId, news);
 
           if (!recordSet) {
             return yield* Effect.die(
-              new Error("Route53 record was not found after update"),
+              new Error("Route53 record was not found after upsert"),
             );
           }
 

package/src/AWS/S3/Bucket.ts

@@ -339,6 +339,22 @@ export const BucketProvider = () =>
         };
       });
 
+      const fetchBucketTags = (
+        bucketName: string,
+      ): Effect.Effect<Record<string, string>, never, any> =>
+        s3.getBucketTagging({ Bucket: bucketName }).pipe(
+          Effect.map(
+            (r) =>
+              Object.fromEntries(
+                (r.TagSet ?? []).map((t) => [t.Key!, t.Value!]),
+              ) as Record<string, string>,
+          ),
+          Effect.catchTag("NoSuchTagSet", () =>
+            Effect.succeed({} as Record<string, string>),
+          ),
+          Effect.catch(() => Effect.succeed({} as Record<string, string>)),
+        );
+
       const syncBucketTags = Effect.fnUntraced(function* ({
         bucketName,
         oldTags,
@@ -352,7 +368,10 @@ export const BucketProvider = () =>
         session: ScopedPlanStatusSession;
         operation: "create" | "update";
       }) {
-        const previousTags = oldTags ?? {};
+        // Compare against the cloud's actual tags so drift surfaces
+        // correctly even after a cold-start adoption (where olds.tags
+        // equals news.tags and would otherwise look like a no-op).
+        const previousTags = oldTags ?? (yield* fetchBucketTags(bucketName));
         const desiredTags = newTags ?? {};
         const { removed, upsert } = diffTags(previousTags, desiredTags);
         const canSkip = oldTags !== undefined;
@@ -458,6 +477,31 @@ export const BucketProvider = () =>
 
       return {
         stables: ["bucketName", "bucketArn", "region", "accountId"],
+        // S3 bucket names are globally unique. `headBucket` succeeds only when
+        // the bucket exists in our account, so a successful response is itself
+        // proof of account-level ownership — there is no separate ownership
+        // signal to surface as `Unowned`.
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const bucketName =
+            output?.bucketName ?? (yield* createBucketName(id, olds ?? {}));
+          const region = yield* Region;
+          const { accountId } = yield* AWSEnvironment;
+          const exists = yield* s3.headBucket({ Bucket: bucketName }).pipe(
+            Effect.map(() => true),
+            Effect.catchTag("NotFound", () => Effect.succeed(false)),
+            Effect.catch(() => Effect.succeed(false)),
+          );
+          if (!exists) return undefined;
+          return {
+            bucketName,
+            bucketArn: `arn:aws:s3:::${bucketName}` as const,
+            bucketDomainName: `${bucketName}.s3.amazonaws.com` as const,
+            bucketRegionalDomainName:
+              `${bucketName}.s3.${region}.amazonaws.com` as const,
+            region,
+            accountId,
+          };
+        }),
         diff: Effect.fn(function* ({ id, news = {}, olds = {} }) {
           if (!isResolved(news)) return undefined;
           const oldBucketName = yield* createBucketName(id, olds);
@@ -483,50 +527,38 @@ export const BucketProvider = () =>
           }
         }),
         precreate: (props) => ensureBucketExists(props),
-        create: Effect.fn(function* ({ id, news = {}, session, bindings }) {
-          const output = yield* ensureBucketExists({ id, news });
-
-          yield* syncBucketTags({
-            bucketName: output.bucketName,
-            newTags: news.tags,
-            session,
-            operation: "create",
-          });
-
-          yield* syncBucketPolicy({
-            bucketName: output.bucketName,
-            bindings,
-            session,
-            operation: "create",
-          });
-
-          yield* session.note(`Ensured bucket: ${output.bucketName}`);
-
-          return output;
-        }),
-        update: Effect.fn(function* ({
+        reconcile: Effect.fn(function* ({
+          id,
           news = {},
-          olds = {},
           output,
           session,
           bindings,
         }) {
+          const operation = output === undefined ? "create" : "update";
+          const resolved = output ?? (yield* ensureBucketExists({ id, news }));
+
           yield* syncBucketTags({
-            bucketName: output.bucketName,
-            oldTags: olds.tags,
+            bucketName: resolved.bucketName,
+            // Omit `oldTags` so syncBucketTags fetches the cloud's actual
+            // current tags. This makes drift detection correct even after
+            // a cold-start adoption where olds.tags would equal news.tags.
             newTags: news.tags,
             session,
-            operation: "update",
+            operation,
           });
 
           yield* syncBucketPolicy({
-            bucketName: output.bucketName,
+            bucketName: resolved.bucketName,
             bindings,
             session,
-            operation: "update",
+            operation,
           });
 
-          return output;
+          if (operation === "create") {
+            yield* session.note(`Ensured bucket: ${resolved.bucketName}`);
+          }
+
+          return resolved;
         }),
         delete: Effect.fn(function* ({ olds = {}, output, session }) {
           yield* Effect.logInfo(