alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/CloudFront/Function.ts

@@ -172,43 +172,95 @@ export const FunctionProvider = () =>
           }
           return toAttrs(current.FunctionSummary, current.ETag, name);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const name = yield* createName(id, news);
-          const created = yield* cloudfront
-            .createFunction({
-              Name: name,
-              FunctionConfig: {
-                Comment: news.comment ?? "",
-                Runtime: news.runtime ?? "cloudfront-js-2.0",
-                KeyValueStoreAssociations: toKvAssociations(
-                  news.keyValueStoreArns,
-                ),
-              },
-              FunctionCode: new TextEncoder().encode(news.code),
-            })
-            .pipe(
-              Effect.catchTag("FunctionAlreadyExists", () =>
-                describe(name, "DEVELOPMENT").pipe(
-                  Effect.flatMap((existing) =>
-                    existing
-                      ? Effect.succeed(existing)
-                      : Effect.die(
-                          `CloudFront Function '${name}' already exists but could not be recovered`,
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = output?.functionName ?? (yield* createName(id, news));
+
+          // Observe — describe the function (LIVE stage preferred,
+          // DEVELOPMENT fallback). We don't trust `output` because the
+          // function may have been deleted out-of-band.
+          const observedDevelopment = yield* describe(name, "DEVELOPMENT");
+
+          // Ensure — create the function if it's missing. Tolerate
+          // `FunctionAlreadyExists` as a race with a peer reconciler. The
+          // newly created function lives in DEVELOPMENT; we publish it to
+          // LIVE below, in the same flow that handles already-existing
+          // functions.
+          const developmentEtag = observedDevelopment
+            ? observedDevelopment.ETag
+            : yield* Effect.gen(function* () {
+                const created = yield* cloudfront
+                  .createFunction({
+                    Name: name,
+                    FunctionConfig: {
+                      Comment: news.comment ?? "",
+                      Runtime: news.runtime ?? "cloudfront-js-2.0",
+                      KeyValueStoreAssociations: toKvAssociations(
+                        news.keyValueStoreArns,
+                      ),
+                    },
+                    FunctionCode: new TextEncoder().encode(news.code),
+                  })
+                  .pipe(
+                    Effect.catchTag("FunctionAlreadyExists", () =>
+                      describe(name, "DEVELOPMENT").pipe(
+                        Effect.flatMap((existing) =>
+                          existing
+                            ? Effect.succeed(existing)
+                            : Effect.die(
+                                `CloudFront Function '${name}' already exists but could not be recovered`,
+                              ),
                         ),
+                      ),
+                    ),
+                    Effect.retry({
+                      while: (error) =>
+                        error._tag === "InvalidArgument" &&
+                        isKeyValueStoreAssociationPending(
+                          error as { Message?: string },
+                        ),
+                      schedule: cappedCloudFrontRetrySchedule,
+                    }),
+                  );
+                return created.ETag;
+              });
+
+          // Sync — push desired config/code to DEVELOPMENT when the
+          // function already existed. Skip when we just created it (the
+          // creation already used the desired config).
+          let etagToPublish = developmentEtag;
+          if (observedDevelopment) {
+            const updated = yield* cloudfront
+              .updateFunction({
+                Name: name,
+                IfMatch: observedDevelopment.ETag!,
+                FunctionConfig: {
+                  Comment: news.comment ?? "",
+                  Runtime:
+                    news.runtime ??
+                    observedDevelopment.FunctionSummary?.FunctionConfig
+                      .Runtime ??
+                    "cloudfront-js-2.0",
+                  KeyValueStoreAssociations: toKvAssociations(
+                    news.keyValueStoreArns,
                   ),
-                ),
-              ),
-              Effect.retry({
-                while: (error) =>
-                  error._tag === "InvalidArgument" &&
-                  isKeyValueStoreAssociationPending(
-                    error as { Message?: string },
-                  ),
-                schedule: cappedCloudFrontRetrySchedule,
-              }),
-            );
+                },
+                FunctionCode: new TextEncoder().encode(news.code),
+              })
+              .pipe(
+                Effect.retry({
+                  while: (error) =>
+                    error._tag === "InvalidArgument" &&
+                    isKeyValueStoreAssociationPending(
+                      error as { Message?: string },
+                    ),
+                  schedule: cappedCloudFrontRetrySchedule,
+                }),
+              );
+            etagToPublish = updated.ETag;
+          }
 
-          const live = yield* publish(name, created.ETag);
+          // Publish DEVELOPMENT → LIVE so consumers see the desired code.
+          const live = yield* publish(name, etagToPublish);
           if (!live?.FunctionSummary) {
             return yield* Effect.die(
               "publishFunction returned no function summary",
@@ -218,44 +270,6 @@ export const FunctionProvider = () =>
           yield* session.note(name);
           return toAttrs(live.FunctionSummary, live.ETag, name);
         }),
-        update: Effect.fn(function* ({ news, output, session }) {
-          yield* cloudfront
-            .updateFunction({
-              Name: output.functionName,
-              IfMatch: output.etag!,
-              FunctionConfig: {
-                Comment: news.comment ?? "",
-                Runtime: news.runtime ?? output.runtime,
-                KeyValueStoreAssociations: toKvAssociations(
-                  news.keyValueStoreArns,
-                ),
-              },
-              FunctionCode: new TextEncoder().encode(news.code),
-            })
-            .pipe(
-              Effect.retry({
-                while: (error) =>
-                  error._tag === "InvalidArgument" &&
-                  isKeyValueStoreAssociationPending(
-                    error as { Message?: string },
-                  ),
-                schedule: cappedCloudFrontRetrySchedule,
-              }),
-            );
-
-          const developmentEtag = yield* getDevelopmentEtag(
-            output.functionName,
-          );
-          const live = yield* publish(output.functionName, developmentEtag);
-          if (!live?.FunctionSummary) {
-            return yield* Effect.die(
-              "publishFunction returned no function summary",
-            );
-          }
-
-          yield* session.note(output.functionName);
-          return toAttrs(live.FunctionSummary, live.ETag, output.functionName);
-        }),
         delete: Effect.fn(function* ({ output }) {
           yield* Effect.gen(function* () {
             const developmentEtag = yield* getDevelopmentEtag(

package/src/AWS/CloudFront/Invalidation.ts

@@ -171,25 +171,23 @@ export const InvalidationProvider = () =>
             return { action: "replace" } as const;
           }
         }),
-        create: Effect.fn(function* ({ news, session }) {
-          const invalidation = yield* createInvalidation(news);
-          yield* Effect.logInfo(
-            `CloudFront Invalidation create: storing ${invalidation.Id} for distribution=${news.distributionId}`,
-          );
-          yield* session.note(invalidation.Id);
-          return {
-            invalidationId: invalidation.Id,
-            distributionId: news.distributionId,
-            version: news.version,
-            status: invalidation.Status ?? "InProgress",
-            paths: news.paths ?? defaultPaths,
-            createTime: invalidation.CreateTime,
-          };
-        }),
-        update: Effect.fn(function* ({ news, session }) {
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          // An invalidation is an immutable ledger entry, not a mutable
+          // resource. If we already issued one for this logical id and
+          // version, return its attributes unchanged. The `diff` above
+          // forces a `replace` whenever `distributionId` or `version`
+          // changes, so the engine creates a fresh invalidation that way.
+          if (output?.invalidationId) {
+            yield* session.note(output.invalidationId);
+            return output;
+          }
+
+          // Ensure — issue the invalidation. CloudFront uses
+          // `CallerReference` (= `version`) for idempotency: the same
+          // version submitted twice returns the same invalidation.
           const invalidation = yield* createInvalidation(news);
           yield* Effect.logInfo(
-            `CloudFront Invalidation update: storing ${invalidation.Id} for distribution=${news.distributionId}`,
+            `CloudFront Invalidation reconcile: storing ${invalidation.Id} for distribution=${news.distributionId}`,
           );
           yield* session.note(invalidation.Id);
           return {

package/src/AWS/CloudFront/KeyGroup.ts

@@ -152,62 +152,83 @@ export const KeyGroupProvider = () =>
           if (!found) return undefined;
           return toAttrs(found.id, found.config, found.etag);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const name = yield* createName(id, news);
           const items = news.items as string[];
-          const created = yield* cloudfront
-            .createKeyGroup({
-              KeyGroupConfig: buildConfig(name, items, news.comment),
-            })
-            .pipe(
-              Effect.catchTag("KeyGroupAlreadyExists", () =>
-                getByName(name).pipe(
-                  Effect.flatMap((existing) =>
-                    existing
-                      ? Effect.succeed({
-                          KeyGroup: {
-                            Id: existing.id,
-                            LastModifiedTime: new Date(),
-                            KeyGroupConfig: existing.config,
-                          },
-                          ETag: existing.etag,
-                          Location: undefined,
-                        })
-                      : Effect.fail(
-                          new Error(
-                            `Key group '${name}' already exists but could not be recovered`,
+
+          // Observe — locate the key group by id (cached on `output`) or
+          // by name. Trust observed cloud state, not stale `olds`.
+          let observed = output?.keyGroupId
+            ? yield* getById(output.keyGroupId).pipe(
+                Effect.map((found) =>
+                  found ? { id: output.keyGroupId, ...found } : undefined,
+                ),
+              )
+            : undefined;
+          if (!observed) {
+            observed = yield* getByName(name);
+          }
+
+          // Ensure — create the key group if it's missing. Tolerate
+          // `KeyGroupAlreadyExists` (race with a peer reconciler).
+          if (!observed) {
+            const created = yield* cloudfront
+              .createKeyGroup({
+                KeyGroupConfig: buildConfig(name, items, news.comment),
+              })
+              .pipe(
+                Effect.catchTag("KeyGroupAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed({
+                            KeyGroup: {
+                              Id: existing.id,
+                              LastModifiedTime: new Date(),
+                              KeyGroupConfig: existing.config,
+                            },
+                            ETag: existing.etag,
+                            Location: undefined,
+                          })
+                        : Effect.fail(
+                            new Error(
+                              `Key group '${name}' already exists but could not be recovered`,
+                            ),
                           ),
-                        ),
+                    ),
                   ),
                 ),
-              ),
-            );
-          if (!created.KeyGroup?.Id) {
-            return yield* Effect.fail(
-              new Error("createKeyGroup returned no identifier"),
+              );
+            if (!created.KeyGroup?.Id) {
+              return yield* Effect.fail(
+                new Error("createKeyGroup returned no identifier"),
+              );
+            }
+            yield* session.note(created.KeyGroup.Id);
+            return toAttrs(
+              created.KeyGroup.Id,
+              created.KeyGroup.KeyGroupConfig,
+              created.ETag,
             );
           }
-          yield* session.note(created.KeyGroup.Id);
-          return toAttrs(
-            created.KeyGroup.Id,
-            created.KeyGroup.KeyGroupConfig,
-            created.ETag,
-          );
-        }),
-        update: Effect.fn(function* ({ news, output, session }) {
-          const current = yield* getById(output.keyGroupId);
-          const items = news.items as string[];
+
+          // Sync — patch the observed config to the desired state. The
+          // freshly observed ETag handles optimistic concurrency.
           const updated = yield* cloudfront.updateKeyGroup({
-            Id: output.keyGroupId,
-            IfMatch: current?.etag ?? output.etag,
-            KeyGroupConfig: buildConfig(output.name, items, news.comment),
+            Id: observed.id,
+            IfMatch: observed.etag,
+            KeyGroupConfig: buildConfig(
+              observed.config.Name,
+              items,
+              news.comment,
+            ),
           });
           if (!updated.KeyGroup?.Id) {
             return yield* Effect.fail(
               new Error("updateKeyGroup returned no identifier"),
             );
           }
-          yield* session.note(output.keyGroupId);
+          yield* session.note(observed.id);
           return toAttrs(
             updated.KeyGroup.Id,
             updated.KeyGroup.KeyGroupConfig,

package/src/AWS/CloudFront/KeyValueStore.ts

@@ -118,50 +118,63 @@ export const KeyValueStoreProvider = () =>
           }
           return toAttrs(current.KeyValueStore, current.ETag, name);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const name = yield* createName(id, news);
-          const created = yield* cloudfront
-            .createKeyValueStore({
-              Name: name,
-              Comment: news.comment,
-            })
-            .pipe(
-              Effect.catchTag("EntityAlreadyExists", () =>
-                getByName(name).pipe(
-                  Effect.flatMap((existing) =>
-                    existing
-                      ? Effect.succeed(existing)
-                      : Effect.die(
-                          `CloudFront KeyValueStore '${name}' already exists but could not be recovered`,
-                        ),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name =
+            output?.keyValueStoreName ?? (yield* createName(id, news));
+
+          // Observe — describe the store, falling back to a list lookup
+          // by name. Trust live state, not stale `olds`.
+          const observed = yield* cloudfront
+            .describeKeyValueStore({ Name: name })
+            .pipe(Effect.catchTag("EntityNotFound", () => getByName(name)));
+
+          // Ensure — create the store if it's missing. Tolerate
+          // `EntityAlreadyExists` (race with a peer reconciler).
+          if (!observed?.KeyValueStore) {
+            const created = yield* cloudfront
+              .createKeyValueStore({
+                Name: name,
+                Comment: news.comment,
+              })
+              .pipe(
+                Effect.catchTag("EntityAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed(existing)
+                        : Effect.die(
+                            `CloudFront KeyValueStore '${name}' already exists but could not be recovered`,
+                          ),
+                    ),
                   ),
                 ),
-              ),
-            );
-          if (!created.KeyValueStore) {
-            return yield* Effect.die(
-              "createKeyValueStore returned no key value store",
-            );
+              );
+            if (!created.KeyValueStore) {
+              return yield* Effect.die(
+                "createKeyValueStore returned no key value store",
+              );
+            }
+            yield* session.note(created.KeyValueStore.Id);
+            return toAttrs(created.KeyValueStore, created.ETag, name);
           }
-          yield* session.note(created.KeyValueStore.Id);
-          return toAttrs(created.KeyValueStore, created.ETag, name);
-        }),
-        update: Effect.fn(function* ({ news, output, session }) {
+
+          // Sync — patch the observed comment via `updateKeyValueStore`
+          // using the freshly observed ETag.
           const updated = yield* cloudfront.updateKeyValueStore({
-            Name: output.keyValueStoreName,
+            Name: observed.KeyValueStore.Name,
             Comment: news.comment ?? "",
-            IfMatch: output.etag!,
+            IfMatch: observed.ETag!,
           });
           if (!updated.KeyValueStore) {
             return yield* Effect.die(
               "updateKeyValueStore returned no key value store",
             );
           }
-          yield* session.note(output.keyValueStoreId);
+          yield* session.note(updated.KeyValueStore.Id);
           return toAttrs(
             updated.KeyValueStore,
             updated.ETag,
-            output.keyValueStoreName,
+            observed.KeyValueStore.Name,
           );
         }),
         delete: Effect.fn(function* ({ output }) {

package/src/AWS/CloudFront/KvEntries.ts

@@ -200,34 +200,36 @@ export const KvEntriesProvider = () =>
             return output;
           }),
         ),
-        create: withKvsRegionFn(
-          Effect.fn(function* ({ news }) {
+        reconcile: withKvsRegionFn(
+          Effect.fn(function* ({ news, output }) {
             return yield* retryForKvsReadiness(
               Effect.gen(function* () {
                 const entries = resolveEntries(news.entries);
-                yield* upload(news.store, news.namespace, entries, undefined);
-                return {
-                  store: news.store,
-                  namespace: news.namespace,
+
+                // Observe — diff against the prior persisted entries so
+                // we only `Put` keys whose values actually changed. When
+                // the store identity changes (or there's no prior
+                // output), treat every key as new.
+                const priorEntries =
+                  output && output.store === news.store
+                    ? resolveEntries(output.entries)
+                    : undefined;
+
+                // Sync entries — push the changed keys.
+                yield* upload(
+                  news.store,
+                  news.namespace,
                   entries,
-                };
-              }),
-            );
-          }),
-        ),
-        update: withKvsRegionFn(
-          Effect.fn(function* ({ news, olds }) {
-            return yield* retryForKvsReadiness(
-              Effect.gen(function* () {
-                const entries = resolveEntries(news.entries);
-                const oldEntries =
-                  news.store !== olds.store
-                    ? undefined
-                    : resolveEntries(olds.entries);
-                yield* upload(news.store, news.namespace, entries, oldEntries);
+                  priorEntries,
+                );
+
+                // Sync stale keys — when `purge` is set, list every key
+                // under the namespace and delete anything not in the
+                // desired set. This converges adopted/drifted state.
                 if (news.purge) {
                   yield* purge(news.store, news.namespace, entries);
                 }
+
                 return {
                   store: news.store,
                   namespace: news.namespace,