alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/SNS/Subscription.ts

@@ -100,64 +100,119 @@ export const SubscriptionProvider = () =>
         return { action: "replace" } as const;
       }
     }),
-    create: Effect.fn(function* ({ news, session }) {
-      const response = yield* sns.subscribe({
-        TopicArn: news.topicArn as string,
-        Protocol: news.protocol,
-        Endpoint: news.endpoint as string | undefined,
-        Attributes: news.attributes,
-        ReturnSubscriptionArn: news.returnSubscriptionArn ?? true,
-      });
-
-      const subscriptionArn = response.SubscriptionArn;
+    reconcile: Effect.fn(function* ({ news, output, session }) {
+      const topicArn = news.topicArn as string;
+      const protocol = news.protocol;
+      const endpoint = news.endpoint as string | undefined;
+      const desiredAttributes = toAttributeMap(news.attributes);
+
+      // Observe — derive the live SubscriptionArn. We can't trust a
+      // pending-confirmation ARN from `output`, since the user may have
+      // confirmed it out of band. Cached ARN is preferred when concrete;
+      // otherwise we list-and-match by (topicArn, protocol, endpoint).
+      let subscriptionArn: string | undefined;
+      if (
+        output?.subscriptionArn &&
+        !isPendingConfirmation(output.subscriptionArn)
+      ) {
+        const observed = yield* sns
+          .getSubscriptionAttributes({
+            SubscriptionArn: output.subscriptionArn,
+          })
+          .pipe(
+            Effect.catchTag("NotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+            Effect.catchTag("InvalidParameterException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        if (observed) {
+          subscriptionArn = output.subscriptionArn;
+        }
+      } else {
+        subscriptionArn = yield* findSubscription({
+          topicArn,
+          protocol,
+          endpoint,
+        });
+      }
 
+      // Ensure — subscribe if no live subscription matches.
       if (!subscriptionArn) {
-        return yield* Effect.die(new Error(`subscribe returned no ARN`));
+        const response = yield* sns.subscribe({
+          TopicArn: topicArn,
+          Protocol: protocol,
+          Endpoint: endpoint,
+          Attributes: news.attributes,
+          ReturnSubscriptionArn: news.returnSubscriptionArn ?? true,
+        });
+        if (!response.SubscriptionArn) {
+          return yield* Effect.die(new Error(`subscribe returned no ARN`));
+        }
+        subscriptionArn = response.SubscriptionArn;
+        yield* session.note(subscriptionArn);
+        return {
+          subscriptionArn,
+          topicArn,
+          protocol,
+          endpoint,
+          owner: undefined,
+          pendingConfirmation: isPendingConfirmation(subscriptionArn),
+          attributes: desiredAttributes,
+        };
       }
 
-      yield* session.note(subscriptionArn);
-
-      return {
-        subscriptionArn,
-        topicArn: news.topicArn as string,
-        protocol: news.protocol,
-        endpoint: news.endpoint as string | undefined,
-        owner: undefined,
-        pendingConfirmation: isPendingConfirmation(subscriptionArn),
-        attributes: toAttributeMap(news.attributes),
-      };
-    }),
-    update: Effect.fn(function* ({ news, olds, output, session }) {
-      const oldAttributes = toAttributeMap(olds.attributes);
-      const newAttributes = toAttributeMap(news.attributes);
+      // Sync attributes — fetch observed cloud attributes (FilterPolicy,
+      // RawMessageDelivery, etc.) and apply only the delta. We can only
+      // do this once the subscription is confirmed (pending confirmation
+      // returns no real ARN to mutate against).
+      const attrsResponse = yield* sns
+        .getSubscriptionAttributes({ SubscriptionArn: subscriptionArn })
+        .pipe(
+          Effect.catchTag("NotFoundException", () => Effect.succeed(undefined)),
+          Effect.catchTag("InvalidParameterException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      const observedAttributes = toAttributeMap(attrsResponse?.Attributes);
 
-      for (const [name, value] of Object.entries(newAttributes)) {
-        if (oldAttributes[name] !== value) {
+      for (const [name, value] of Object.entries(desiredAttributes)) {
+        if (observedAttributes[name] !== value) {
           yield* sns.setSubscriptionAttributes({
-            SubscriptionArn: output.subscriptionArn,
+            SubscriptionArn: subscriptionArn,
             AttributeName: name,
             AttributeValue: value,
           });
         }
       }
 
-      for (const name of Object.keys(oldAttributes)) {
-        if (!(name in newAttributes)) {
+      // Reset attributes the user no longer specifies. We only clear
+      // user-specified keys (those present in `news.attributes`/`olds`),
+      // not all observed keys, because SNS exposes many read-only system
+      // attributes we should not touch.
+      const previousKeys = new Set(
+        Object.keys(toAttributeMap(output?.attributes)),
+      );
+      for (const name of previousKeys) {
+        if (!(name in desiredAttributes)) {
           yield* sns.setSubscriptionAttributes({
-            SubscriptionArn: output.subscriptionArn,
+            SubscriptionArn: subscriptionArn,
             AttributeName: name,
           });
         }
       }
 
-      yield* session.note(output.subscriptionArn);
+      yield* session.note(subscriptionArn);
 
       return {
-        ...output,
-        topicArn: news.topicArn as string,
-        protocol: news.protocol,
-        endpoint: news.endpoint as string | undefined,
-        attributes: newAttributes,
+        subscriptionArn,
+        topicArn,
+        protocol,
+        endpoint,
+        owner: output?.owner,
+        pendingConfirmation: isPendingConfirmation(subscriptionArn),
+        attributes: desiredAttributes,
       };
     }),
     delete: Effect.fn(function* ({ olds, output }) {

package/src/AWS/SNS/Topic.ts

@@ -1,11 +1,12 @@
 import * as sns from "@distilled.cloud/aws/sns";
 import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
-import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.ts";
 import type { AccountID } from "../Environment.ts";
 import type { RegionID } from "../Region.ts";
 
@@ -137,11 +138,13 @@ export const TopicProvider = () =>
       const topicName =
         output?.topicName ?? (yield* toTopicName(id, olds ?? {}));
 
-      return yield* readTopic({
+      const state = yield* readTopic({
         id,
         topicArn: output?.topicArn,
         topicName,
       });
+      if (!state) return undefined;
+      return (yield* hasAlchemyTags(id, state.tags)) ? state : Unowned(state);
     }),
     stables: ["topicArn", "topicName", "fifo"],
     diff: Effect.fn(function* ({ id, news = {}, olds = {} }) {
@@ -164,109 +167,126 @@ export const TopicProvider = () =>
         return { action: "replace" } as const;
       }
     }),
-    create: Effect.fn(function* ({ id, news = {}, session }) {
+    reconcile: Effect.fn(function* ({ id, news = {}, olds, output, session }) {
       const topicName = yield* toTopicName(id, news);
-      const tags = {
-        ...(yield* createInternalTags(id)),
-        ...news.tags,
-      };
-
-      const response = yield* sns.createTopic({
+      const internalTags = yield* createInternalTags(id);
+      const desiredTags = { ...internalTags, ...news.tags };
+      const desiredAttributes = toAttributes(news);
+      const isFifo = news.fifo ?? false;
+
+      // Observe + ensure — `createTopic` is idempotent for an identical
+      // (name, FifoTopic) pair, so we use it both to ensure-on-greenfield
+      // and to fetch the ARN for adoption. We deliberately pass ONLY the
+      // FifoTopic attribute (which is stable at create time): AWS rejects
+      // createTopic for an existing topic if any other attribute, tag,
+      // or DataProtectionPolicy differs from what's already attached.
+      // Mutable attributes are reconciled below against observed state.
+      const createResponse = yield* sns.createTopic({
         Name: topicName,
-        Attributes: toAttributes(news),
-        Tags: createTagsList(tags),
-        DataProtectionPolicy: news.dataProtectionPolicy,
+        Attributes: isFifo ? { FifoTopic: "true" } : undefined,
       });
-
-      const topicArn = response.TopicArn;
-
+      const topicArn = createResponse.TopicArn;
       if (!topicArn) {
         return yield* Effect.die(new Error(`createTopic returned no ARN`));
       }
 
-      yield* session.note(topicArn);
+      // Sync attributes — fetch observed cloud attributes and apply only
+      // the delta.
+      const observedState = yield* sns
+        .getTopicAttributes({ TopicArn: topicArn })
+        .pipe(
+          Effect.catchTag("NotFoundException", () => Effect.succeed(undefined)),
+        );
+      const observedAttributes = toAttributeMap(observedState?.Attributes);
 
-      return {
-        topicArn: topicArn as TopicArn,
-        topicName,
-        fifo: news.fifo ?? false,
-        attributes: toAttributes(news),
-        dataProtectionPolicy: news.dataProtectionPolicy,
-        tags,
-      };
-    }),
-    update: Effect.fn(function* ({
-      id,
-      news = {},
-      olds = {},
-      output,
-      session,
-    }) {
-      const newAttributes = toAttributes(news);
-      const oldAttributes = toAttributes(olds);
-
-      for (const [name, value] of Object.entries(newAttributes)) {
-        if (oldAttributes[name] !== value) {
+      for (const [name, value] of Object.entries(desiredAttributes)) {
+        if (observedAttributes[name] !== value) {
           yield* sns.setTopicAttributes({
-            TopicArn: output.topicArn,
+            TopicArn: topicArn,
             AttributeName: name,
             AttributeValue: value,
           });
         }
       }
 
-      for (const name of Object.keys(oldAttributes)) {
-        if (!(name in newAttributes)) {
+      // Reset previously-user-specified attributes that the user no
+      // longer specifies. Use `olds.attributes` (the prior props) — NOT
+      // `output.attributes`, which on adoption holds every attribute SNS
+      // returns and would erroneously try to reset SNS-managed values
+      // like the auto-generated Policy.
+      const previouslyManaged = olds?.attributes ?? {};
+      for (const name of Object.keys(previouslyManaged)) {
+        if (!(name in desiredAttributes) && name !== "FifoTopic") {
           yield* sns.setTopicAttributes({
-            TopicArn: output.topicArn,
+            TopicArn: topicArn,
             AttributeName: name,
           });
         }
       }
 
-      const newTags = {
-        ...(yield* createInternalTags(id)),
-        ...news.tags,
-      };
-      const oldTags = {
-        ...(yield* createInternalTags(id)),
-        ...olds.tags,
-      };
-      const { removed, upsert } = diffTags(oldTags, newTags);
+      // Sync tags — diff observed cloud tags against desired so that an
+      // adoption-takeover (cloud tags identify a different logical id)
+      // correctly rewrites ownership tags.
+      const observedTagsResp = yield* sns
+        .listTagsForResource({ ResourceArn: topicArn })
+        .pipe(
+          Effect.catchTag("ResourceNotFoundException", () =>
+            Effect.succeed({ Tags: [] as sns.Tag[] }),
+          ),
+        );
+      const observedTags = toTagMap(observedTagsResp.Tags);
+      const { removed, upsert } = diffTags(observedTags, desiredTags);
 
       if (upsert.length > 0) {
         yield* sns.tagResource({
-          ResourceArn: output.topicArn,
+          ResourceArn: topicArn,
           Tags: upsert,
         });
       }
 
       if (removed.length > 0) {
         yield* sns.untagResource({
-          ResourceArn: output.topicArn,
+          ResourceArn: topicArn,
           TagKeys: removed,
         });
       }
 
+      // Sync data protection policy — observed ↔ desired. SNS rejects
+      // getDataProtectionPolicy on FIFO topics, so we skip it there.
+      let observedPolicy: string | undefined;
+      if (!isFifo) {
+        observedPolicy = yield* sns
+          .getDataProtectionPolicy({ ResourceArn: topicArn })
+          .pipe(
+            Effect.map((r) => r.DataProtectionPolicy),
+            Effect.catchTag("NotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+            Effect.catchTag("InvalidParameterException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+      }
       if (
+        !isFifo &&
         news.dataProtectionPolicy !== undefined &&
-        news.dataProtectionPolicy !== olds.dataProtectionPolicy
+        news.dataProtectionPolicy !== observedPolicy
       ) {
         yield* sns.putDataProtectionPolicy({
-          ResourceArn: output.topicArn,
+          ResourceArn: topicArn,
           DataProtectionPolicy: news.dataProtectionPolicy,
         });
       }
 
-      yield* session.note(output.topicArn);
+      yield* session.note(topicArn);
 
       return {
-        ...output,
-        fifo: news.fifo ?? false,
-        attributes: newAttributes,
-        dataProtectionPolicy:
-          news.dataProtectionPolicy ?? output.dataProtectionPolicy,
-        tags: newTags,
+        topicArn: topicArn as TopicArn,
+        topicName,
+        fifo: isFifo,
+        attributes: desiredAttributes,
+        dataProtectionPolicy: news.dataProtectionPolicy ?? observedPolicy,
+        tags: desiredTags,
       };
     }),
     delete: Effect.fn(function* ({ output }) {
@@ -390,15 +410,13 @@ const readTopic = Effect.fn(function* ({
 
   const topicAttributes = toAttributeMap(attributes.Attributes);
 
+  const apiTags = toTagMap(tags.Tags);
   return {
     topicArn: resolvedTopicArn as TopicArn,
     topicName: topicAttributes.TopicArn?.split(":").at(-1) ?? topicName,
     fifo: topicAttributes.FifoTopic === "true",
     attributes: topicAttributes,
     dataProtectionPolicy,
-    tags: {
-      ...(yield* createInternalTags(id)),
-      ...toTagMap(tags.Tags),
-    },
+    tags: apiTags,
   };
 });

package/src/AWS/SQS/Queue.ts

@@ -2,10 +2,12 @@ import { Region } from "@distilled.cloud/aws/Region";
 import * as sqs from "@distilled.cloud/aws/sqs";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource, type ResourceBinding } from "../../Resource.ts";
+import { createInternalTags, hasAlchemyTags } from "../../Tags.ts";
 import { AWSEnvironment, type AccountID } from "../Environment.ts";
 import type { PolicyStatement } from "../IAM/Policy.ts";
 import type { Providers } from "../Providers.ts";
@@ -213,6 +215,29 @@ export const QueueProvider = () =>
       };
       return Queue.Provider.of({
         stables: ["queueName", "queueUrl", "queueArn"],
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const queueName =
+            output?.queueName ?? (yield* createQueueName(id, olds ?? {}));
+          const url = yield* sqs.getQueueUrl({ QueueName: queueName }).pipe(
+            Effect.map((r) => r.QueueUrl),
+            Effect.catchTag("QueueDoesNotExist", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+          if (!url) return undefined;
+          const queueArn =
+            `arn:aws:sqs:${region}:${accountId}:${queueName}` as const;
+          const tagsResp = yield* sqs.listQueueTags({ QueueUrl: url }).pipe(
+            Effect.map((r) => r.Tags ?? {}),
+            Effect.catch(() => Effect.succeed({} as Record<string, string>)),
+          );
+          const attrs = {
+            queueName,
+            queueUrl: url,
+            queueArn,
+          };
+          return (yield* hasAlchemyTags(id, tagsResp)) ? attrs : Unowned(attrs);
+        }),
         diff: Effect.fn(function* ({ id, news = {}, olds = {} }) {
           if (!isResolved(news)) return undefined;
           const oldFifo = olds.fifo ?? false;
@@ -227,46 +252,116 @@ export const QueueProvider = () =>
           }
           // Return undefined to allow update function to be called for other attribute changes
         }),
-        create: Effect.fn(function* ({ id, news = {}, session, bindings }) {
-          const queueName = yield* createQueueName(id, news);
-          const response = yield* sqs
-            .createQueue({
-              QueueName: queueName,
-              Attributes: createAttributes(news, bindings),
-            })
-            .pipe(
-              Effect.retry({
-                while: (e) => e._tag === "QueueDeletedRecently",
-                schedule: Schedule.fixed(1000).pipe(
-                  Schedule.tapOutput((i) =>
-                    session.note(
-                      `Queue was deleted recently, retrying... ${i + 1}s`,
+        reconcile: Effect.fn(function* ({
+          id,
+          news = {},
+          output,
+          session,
+          bindings,
+        }) {
+          const queueName =
+            output?.queueName ?? (yield* createQueueName(id, news));
+          const queueArn =
+            output?.queueArn ??
+            (`arn:aws:sqs:${region}:${accountId}:${queueName}` as const);
+          const desiredAttributes = createAttributes(news, bindings);
+          const internalTags = yield* createInternalTags(id);
+
+          // Observe — find the queue's URL or create it.
+          //
+          // We never trust a stale `output.queueUrl` blindly: if the queue was
+          // deleted out-of-band, downstream API calls fail with
+          // `QueueDoesNotExist` and we recreate. This keeps the reconciler
+          // convergent regardless of the starting cloud state.
+          let queueUrl = yield* sqs.getQueueUrl({ QueueName: queueName }).pipe(
+            Effect.map((r) => r.QueueUrl!),
+            Effect.catchTag("QueueDoesNotExist", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+
+          if (queueUrl === undefined) {
+            // `createQueue` is idempotent for identical params; with different
+            // params it raises `QueueNameExists`. We pass the desired attrs so
+            // first-create lands fully configured, and tolerate the race where
+            // a peer reconciler created it concurrently.
+            queueUrl = yield* sqs
+              .createQueue({
+                QueueName: queueName,
+                Attributes: desiredAttributes,
+                tags: internalTags,
+              })
+              .pipe(
+                Effect.retry({
+                  while: (e) => e._tag === "QueueDeletedRecently",
+                  schedule: Schedule.fixed(1000).pipe(
+                    Schedule.tapOutput((i) =>
+                      session.note(
+                        `Queue was deleted recently, retrying... ${i + 1}s`,
+                      ),
                     ),
                   ),
+                }),
+                Effect.catchTag("QueueNameExists", () =>
+                  sqs.getQueueUrl({ QueueName: queueName }),
                 ),
-              }),
+                Effect.map((r) => r.QueueUrl!),
+              );
+          }
+
+          // Sync attributes — diff observed cloud state against desired and
+          // apply only the delta. SQS returns all attribute values as strings,
+          // and `desiredAttributes` is already string-shaped, so equality
+          // comparison is direct.
+          const currentAttributes = yield* sqs
+            .getQueueAttributes({
+              QueueUrl: queueUrl,
+              AttributeNames: ["All"],
+            })
+            .pipe(Effect.map((r) => r.Attributes ?? {}));
+
+          const attributeDelta: Record<string, string> = {};
+          for (const [key, value] of Object.entries(desiredAttributes)) {
+            if (value === undefined) continue;
+            if (
+              currentAttributes[key as keyof typeof currentAttributes] !== value
+            ) {
+              attributeDelta[key] = value;
+            }
+          }
+          if (Object.keys(attributeDelta).length > 0) {
+            yield* sqs.setQueueAttributes({
+              QueueUrl: queueUrl,
+              Attributes: attributeDelta,
+            });
+          }
+
+          // Sync alchemy-owned tags. The `tags` parameter on `createQueue`
+          // only applies on first create, so on adoption (or after a queue
+          // was created without our tags) we fix them up here.
+          const currentTags = yield* sqs
+            .listQueueTags({ QueueUrl: queueUrl })
+            .pipe(
+              Effect.map((r) => r.Tags ?? {}),
+              Effect.catch(() => Effect.succeed({} as Record<string, string>)),
             );
-          const queueArn =
-            `arn:aws:sqs:${region}:${accountId}:${queueName}` as const;
-          const queueUrl = response.QueueUrl!;
+          const tagDelta: Record<string, string> = {};
+          for (const [key, value] of Object.entries(internalTags)) {
+            if (currentTags[key] !== value) {
+              tagDelta[key] = value;
+            }
+          }
+          if (Object.keys(tagDelta).length > 0) {
+            yield* sqs.tagQueue({ QueueUrl: queueUrl, Tags: tagDelta });
+          }
+
           yield* session.note(queueUrl);
           return {
             queueName,
             queueUrl,
-            queueArn: queueArn,
+            queueArn,
           };
         }),
-        update: Effect.fn(function* ({ news = {}, output, session, bindings }) {
-          const attributes = createAttributes(news, bindings);
-          if (Object.values(attributes).some((a) => a !== undefined)) {
-            yield* sqs.setQueueAttributes({
-              QueueUrl: output.queueUrl,
-              Attributes: attributes,
-            });
-          }
-          yield* session.note(output.queueUrl);
-          return output;
-        }),
         delete: Effect.fn(function* (input) {
           yield* sqs
             .deleteQueue({