alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/ECS/Task.ts

@@ -168,55 +168,53 @@ export type TaskServices = Credentials | Region | ServerHost;
 
 export type TaskShape = Main<TaskServices>;
 
-export interface TaskExecutionContext extends ProcessContext {
+export interface TaskRuntimeContext extends ProcessContext {
   readonly Type: "AWS.ECS.Task";
 }
 
-export const Task: Platform<
-  Task,
-  TaskServices,
-  TaskShape,
-  TaskExecutionContext
-> = Platform("AWS.ECS.Task", {
-  createExecutionContext: (id): TaskExecutionContext => {
-    const runners: Effect.Effect<void, never, any>[] = [];
-    const env: Record<string, any> = {};
-
-    return {
-      Type: "AWS.ECS.Task",
-      id,
-      env,
-      set: (bindingId: string, output: Output.Output) =>
-        Effect.sync(() => {
-          const key = bindingId.replaceAll(/[^a-zA-Z0-9]/g, "_");
-          env[key] = output.pipe(Output.map((value) => JSON.stringify(value)));
-          return key;
-        }),
-      get: <T>(key: string) =>
-        Config.string(key)
-          .asEffect()
-          .pipe(
-            Effect.flatMap((value) =>
-              Effect.try({
-                try: () => JSON.parse(value) as T,
-                catch: (error) => error as Error,
-              }),
-            ),
-            Effect.catch((cause) =>
-              Effect.die(
-                new Error(`Failed to get environment variable: ${key}`, {
-                  cause,
+export const Task: Platform<Task, TaskServices, TaskShape, TaskRuntimeContext> =
+  Platform("AWS.ECS.Task", {
+    createRuntimeContext: (id): TaskRuntimeContext => {
+      const runners: Effect.Effect<void, never, any>[] = [];
+      const env: Record<string, any> = {};
+
+      return {
+        Type: "AWS.ECS.Task",
+        id,
+        env,
+        set: (bindingId: string, output: Output.Output) =>
+          Effect.sync(() => {
+            const key = bindingId.replaceAll(/[^a-zA-Z0-9]/g, "_");
+            env[key] = output.pipe(
+              Output.map((value) => JSON.stringify(value)),
+            );
+            return key;
+          }),
+        get: <T>(key: string) =>
+          Config.string(key)
+            .asEffect()
+            .pipe(
+              Effect.flatMap((value) =>
+                Effect.try({
+                  try: () => JSON.parse(value) as T,
+                  catch: (error) => error as Error,
                 }),
               ),
+              Effect.catch((cause) =>
+                Effect.die(
+                  new Error(`Failed to get environment variable: ${key}`, {
+                    cause,
+                  }),
+                ),
+              ),
             ),
-          ),
-      run: (effect: Effect.Effect<void, never, any>) =>
-        Effect.sync(() => {
-          runners.push(effect);
-        }),
-    };
-  },
-});
+        run: (effect: Effect.Effect<void, never, any>) =>
+          Effect.sync(() => {
+            runners.push(effect);
+          }),
+      };
+    },
+  });
 
 export const TaskProvider = () =>
   Provider.effect(
@@ -505,7 +503,7 @@ const platform = Layer.mergeAll(
 );
 
 const program = handler.pipe(
-  Effect.flatMap((task) => task.ExecutionContext.exports.program),
+  Effect.flatMap((task) => task.RuntimeContext.exports.program),
   Effect.provide(
     Layer.effect(
       Stack,
@@ -739,10 +737,19 @@ await Effect.runPromise(program);
                 ?.containerPort ?? output.port,
           };
         }),
-        create: Effect.fn(function* ({ id, news, bindings, output, session }) {
+        reconcile: Effect.fn(function* ({
+          id,
+          news,
+          bindings,
+          output,
+          session,
+        }) {
           const family = yield* toTaskFamily(id, news);
-          const taskRoleName = yield* createRoleName(id, "task-role");
-          const executionRoleName = yield* createRoleName(id, "execution-role");
+          const taskRoleName =
+            output?.taskRoleName ?? (yield* createRoleName(id, "task-role"));
+          const executionRoleName =
+            output?.executionRoleName ??
+            (yield* createRoleName(id, "execution-role"));
           const taskPolicyName = yield* createPolicyName(id, "task-policy");
           const repositoryName =
             output?.repositoryName ?? (yield* createRepositoryName(id));
@@ -753,6 +760,9 @@ await Effect.runPromise(program);
             ...news.tags,
           };
 
+          // Ensure roles, repository, and log group. Each helper is
+          // idempotent (creates on miss, adopts on race) so the same
+          // sequence runs on initial create, adoption, or update.
           const taskRoleArn =
             output?.taskRoleArn ??
             (yield* createTaskRoleIfNotExists({ id, roleName: taskRoleName }));
@@ -765,10 +775,14 @@ await Effect.runPromise(program);
             }));
 
           for (const policyArn of news.taskRoleManagedPolicyArns ?? []) {
-            yield* iam.attachRolePolicy({
-              RoleName: taskRoleName,
-              PolicyArn: policyArn,
-            });
+            yield* iam
+              .attachRolePolicy({
+                RoleName: taskRoleName,
+                PolicyArn: policyArn,
+              })
+              .pipe(
+                Effect.catchTag("LimitExceededException", () => Effect.void),
+              );
           }
 
           const bindingEnv = yield* attachBindings({
@@ -777,11 +791,16 @@ await Effect.runPromise(program);
             bindings,
           });
 
-          const { repositoryUri } = yield* ensureRepository({
-            id,
-            repositoryName,
-            tags,
-          });
+          const { repositoryUri } =
+            output?.repositoryUri && output?.repositoryName === repositoryName
+              ? {
+                  repositoryUri: output.repositoryUri,
+                }
+              : yield* ensureRepository({
+                  id,
+                  repositoryName,
+                  tags,
+                });
           const logGroupArn =
             output?.logGroupArn ??
             (yield* ensureLogGroup({
@@ -789,6 +808,10 @@ await Effect.runPromise(program);
               logGroupName,
             }));
 
+          // Build, push, and register a new task definition revision. Task
+          // definitions are versioned in AWS, so registering a new revision
+          // is the unit of "update" — the prior revision is deregistered
+          // only on `delete` of the resource.
           const { code, hash } = yield* bundleProgram(id, news);
           const imageUri = yield* buildAndPushImage({
             id,
@@ -826,7 +849,7 @@ await Effect.runPromise(program);
             taskFamily: family,
             containerName:
               taskDefinition.containerDefinitions?.[0]?.name ?? family,
-            port: news.port ?? 3000,
+            port: news.port ?? output?.port ?? 3000,
             imageUri,
             repositoryName,
             repositoryUri,
@@ -841,63 +864,6 @@ await Effect.runPromise(program);
             },
           };
         }),
-        update: Effect.fn(function* ({ id, news, bindings, output, session }) {
-          const family = yield* toTaskFamily(id, news);
-          const taskPolicyName = yield* createPolicyName(id, "task-policy");
-
-          const bindingEnv = yield* attachBindings({
-            roleName: output.taskRoleName,
-            policyName: taskPolicyName,
-            bindings,
-          });
-
-          const { code, hash } = yield* bundleProgram(id, news);
-          const imageUri = yield* buildAndPushImage({
-            id,
-            repositoryUri: output.repositoryUri,
-            hash,
-            code,
-            props: {
-              ...news,
-              env: {
-                ...bindingEnv,
-                ...alchemyEnv,
-                ...news.env,
-              },
-            },
-          });
-
-          const taskDefinition = yield* registerTaskDefinition({
-            props: {
-              ...news,
-              env: {
-                ...bindingEnv,
-                ...alchemyEnv,
-                ...news.env,
-              },
-            },
-            family,
-            imageUri,
-            taskRoleArn: output.taskRoleArn,
-            executionRoleArn: output.executionRoleArn,
-            logGroupName: output.logGroupName,
-          });
-
-          yield* session.note(taskDefinition.taskDefinitionArn!);
-          return {
-            ...output,
-            taskDefinitionArn: taskDefinition.taskDefinitionArn!,
-            taskFamily: family,
-            containerName:
-              taskDefinition.containerDefinitions?.[0]?.name ??
-              output.containerName,
-            port: news.port ?? output.port,
-            imageUri,
-            code: {
-              hash,
-            },
-          };
-        }),
         delete: Effect.fn(function* ({ output }) {
           yield* ecs
             .deregisterTaskDefinition({

package/src/AWS/EKS/AccessEntry.ts

@@ -1,5 +1,6 @@
 import * as eks from "@distilled.cloud/aws/eks";
 import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import type { Input } from "../../Input.ts";
 import * as Provider from "../../Provider.ts";
@@ -110,158 +111,132 @@ export const AccessEntryProvider = () =>
         return { action: "replace" } as const;
       }
     }),
-    read: Effect.fn(function* ({ olds, output }) {
-      return yield* readAccessEntry({
+    read: Effect.fn(function* ({ id, olds, output }) {
+      const state = yield* readAccessEntry({
         clusterName: (output?.clusterName ?? olds.clusterName) as string,
         principalArn: (output?.principalArn ?? olds.principalArn) as string,
       });
+      if (!state) return undefined;
+      return (yield* hasAlchemyTags(id, state.tags)) ? state : Unowned(state);
     }),
-    create: Effect.fn(function* ({ id, news, session }) {
-      const tags = {
+    reconcile: Effect.fn(function* ({ id, news, session }) {
+      const clusterName = news.clusterName as string;
+      const principalArn = news.principalArn as string;
+      const desiredTags = {
         ...(yield* createInternalTags(id)),
         ...news.tags,
       };
 
-      yield* eks
-        .createAccessEntry({
-          clusterName: news.clusterName as string,
-          principalArn: news.principalArn as string,
-          kubernetesGroups: news.kubernetesGroups,
-          username: news.username,
-          type: news.type,
-          tags,
-        })
-        .pipe(
-          Effect.catchTag("ResourceInUseException", () =>
-            readAccessEntry({
-              clusterName: news.clusterName as string,
-              principalArn: news.principalArn as string,
-            }).pipe(
-              Effect.flatMap((existing) =>
-                existing && hasAlchemyTags(id, existing.tags)
-                  ? Effect.succeed(existing)
-                  : Effect.fail(
-                      new Error(
-                        `AccessEntry '${news.principalArn as string}' already exists and is not managed by alchemy`,
-                      ),
-                    ),
-              ),
-            ),
-          ),
-        );
+      // Observe — fetch live cloud state by (clusterName, principalArn).
+      let state = yield* readAccessEntry({
+        clusterName,
+        principalArn,
+      });
 
-      for (const policy of normalizeAccessPolicies(news.accessPolicies)) {
-        yield* eks.associateAccessPolicy({
-          clusterName: news.clusterName as string,
-          principalArn: news.principalArn as string,
-          policyArn: policy.policyArn,
-          accessScope: policy.accessScope,
+      // Ensure — create the entry if missing. Tolerate
+      // `ResourceInUseException` as a race with a peer reconciler.
+      if (!state) {
+        yield* eks
+          .createAccessEntry({
+            clusterName,
+            principalArn,
+            kubernetesGroups: news.kubernetesGroups,
+            username: news.username,
+            type: news.type,
+            tags: desiredTags,
+          })
+          .pipe(Effect.catchTag("ResourceInUseException", () => Effect.void));
+
+        state = yield* readAccessEntry({
+          clusterName,
+          principalArn,
         });
-      }
-
-      yield* session.note(
-        `${news.clusterName as string}:${news.principalArn as string}`,
-      );
 
-      return yield* readAccessEntry({
-        clusterName: news.clusterName as string,
-        principalArn: news.principalArn as string,
-      }).pipe(
-        Effect.flatMap((state) =>
-          state
-            ? Effect.succeed(state)
-            : Effect.fail(
-                new Error(
-                  `AccessEntry '${news.principalArn as string}' could not be read after creation`,
-                ),
-              ),
-        ),
-      );
-    }),
-    update: Effect.fn(function* ({ id, olds, news, output, session }) {
-      const oldGroups = olds.kubernetesGroups ?? [];
-      const newGroups = news.kubernetesGroups ?? [];
+        if (!state) {
+          return yield* Effect.fail(
+            new Error(
+              `AccessEntry '${principalArn}' could not be read after creation`,
+            ),
+          );
+        }
+      }
 
+      // Sync kubernetesGroups + username — observed ↔ desired.
+      const observedGroups = state.kubernetesGroups ?? [];
+      const desiredGroups = news.kubernetesGroups ?? [];
       if (
-        JSON.stringify(oldGroups) !== JSON.stringify(newGroups) ||
-        olds.username !== news.username
+        JSON.stringify(observedGroups) !== JSON.stringify(desiredGroups) ||
+        state.username !== news.username
       ) {
         yield* eks.updateAccessEntry({
-          clusterName: output.clusterName,
-          principalArn: output.principalArn,
-          kubernetesGroups: newGroups,
+          clusterName,
+          principalArn,
+          kubernetesGroups: desiredGroups,
           username: news.username,
         });
       }
 
-      const oldTags = {
-        ...(yield* createInternalTags(id)),
-        ...olds.tags,
-      };
-      const newTags = {
-        ...(yield* createInternalTags(id)),
-        ...news.tags,
-      };
-      const { removed, upsert } = diffTags(oldTags, newTags);
-
+      // Sync tags — diff observed cloud tags against desired.
+      const { removed, upsert } = diffTags(state.tags, desiredTags);
       if (upsert.length > 0) {
         yield* eks.tagResource({
-          resourceArn: output.accessEntryArn,
+          resourceArn: state.accessEntryArn,
           tags: Object.fromEntries(
             upsert.map((tag) => [tag.Key, tag.Value] as const),
           ),
         });
       }
-
       if (removed.length > 0) {
         yield* eks.untagResource({
-          resourceArn: output.accessEntryArn,
+          resourceArn: state.accessEntryArn,
           tagKeys: removed,
         });
       }
 
-      const oldPolicies = normalizeAccessPolicies(olds.accessPolicies);
-      const newPolicies = normalizeAccessPolicies(news.accessPolicies);
-      const oldPolicyMap = new Map(
-        oldPolicies.map((policy) => [policyKey(policy), policy]),
+      // Sync access policy associations — diff observed against desired.
+      const observedPolicies = state.accessPolicies;
+      const desiredPolicies = normalizeAccessPolicies(news.accessPolicies);
+      const observedPolicyMap = new Map(
+        observedPolicies.map((policy) => [policyKey(policy), policy]),
       );
-      const newPolicyMap = new Map(
-        newPolicies.map((policy) => [policyKey(policy), policy]),
+      const desiredPolicyMap = new Map(
+        desiredPolicies.map((policy) => [policyKey(policy), policy]),
       );
 
-      for (const [key, policy] of newPolicyMap) {
-        if (!oldPolicyMap.has(key)) {
+      for (const [key, policy] of desiredPolicyMap) {
+        if (!observedPolicyMap.has(key)) {
           yield* eks.associateAccessPolicy({
-            clusterName: output.clusterName,
-            principalArn: output.principalArn,
+            clusterName,
+            principalArn,
             policyArn: policy.policyArn,
             accessScope: policy.accessScope,
           });
         }
       }
 
-      for (const [key, policy] of oldPolicyMap) {
-        if (!newPolicyMap.has(key)) {
+      for (const [key, policy] of observedPolicyMap) {
+        if (!desiredPolicyMap.has(key)) {
           yield* eks.disassociateAccessPolicy({
-            clusterName: output.clusterName,
-            principalArn: output.principalArn,
+            clusterName,
+            principalArn,
             policyArn: policy.policyArn,
           });
         }
       }
 
-      yield* session.note(output.accessEntryArn);
+      yield* session.note(state.accessEntryArn);
 
+      // Re-read final state so returned attributes reflect post-sync.
       return yield* readAccessEntry({
-        clusterName: output.clusterName,
-        principalArn: output.principalArn,
+        clusterName,
+        principalArn,
       }).pipe(
-        Effect.flatMap((state) =>
-          state
-            ? Effect.succeed(state)
+        Effect.flatMap((finalState) =>
+          finalState
+            ? Effect.succeed(finalState)
             : Effect.fail(
                 new Error(
-                  `AccessEntry '${output.principalArn}' could not be read after update`,
+                  `AccessEntry '${principalArn}' could not be read after reconcile`,
                 ),
               ),
         ),