alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/EKS/PodIdentityAssociation.ts

@@ -1,5 +1,6 @@
 import * as eks from "@distilled.cloud/aws/eks";
 import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import type { Input } from "../../Input.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
@@ -127,123 +128,115 @@ export const PodIdentityAssociationProvider = () =>
             serviceAccount: olds.serviceAccount,
           });
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const tags = {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const clusterName = news.clusterName as string;
+          const desiredTags = {
             ...(yield* createInternalTags(id)),
             ...news.tags,
           };
 
-          yield* eks
-            .createPodIdentityAssociation({
-              clusterName: news.clusterName as string,
+          // Observe — locate the association either by stored
+          // associationId or by listing on (cluster, namespace, sa).
+          let state = output?.associationId
+            ? yield* readAssociationById({
+                clusterName,
+                associationId: output.associationId,
+              })
+            : yield* findAssociation({
+                id,
+                clusterName,
+                namespace: news.namespace,
+                serviceAccount: news.serviceAccount,
+              });
+
+          // Ensure — create if missing. Tolerate `ResourceInUseException`
+          // as a race with a peer reconciler.
+          if (!state) {
+            yield* eks
+              .createPodIdentityAssociation({
+                clusterName,
+                namespace: news.namespace,
+                serviceAccount: news.serviceAccount,
+                roleArn: news.roleArn as string,
+                disableSessionTags: news.disableSessionTags,
+                targetRoleArn: news.targetRoleArn as string | undefined,
+                policy: news.policy,
+                tags: desiredTags,
+                clientRequestToken: yield* toClientRequestToken(id, "create"),
+              })
+              .pipe(
+                Effect.catchTag("ResourceInUseException", () => Effect.void),
+              );
+
+            state = yield* findAssociation({
+              id,
+              clusterName,
               namespace: news.namespace,
               serviceAccount: news.serviceAccount,
-              roleArn: news.roleArn as string,
-              disableSessionTags: news.disableSessionTags,
-              targetRoleArn: news.targetRoleArn as string | undefined,
-              policy: news.policy,
-              tags,
-              clientRequestToken: yield* toClientRequestToken(id, "create"),
-            })
-            .pipe(
-              Effect.catchTag("ResourceInUseException", () =>
-                findAssociation({
-                  id,
-                  clusterName: news.clusterName as string,
-                  namespace: news.namespace,
-                  serviceAccount: news.serviceAccount,
-                }).pipe(
-                  Effect.flatMap((existing) =>
-                    existing
-                      ? Effect.succeed(existing)
-                      : Effect.fail(
-                          new Error(
-                            `PodIdentityAssociation '${news.namespace}/${news.serviceAccount}' already exists and is not managed by alchemy`,
-                          ),
-                        ),
-                  ),
-                  Effect.asVoid,
-                ),
-              ),
-            );
-
-          const state = yield* findAssociation({
-            id,
-            clusterName: news.clusterName as string,
-            namespace: news.namespace,
-            serviceAccount: news.serviceAccount,
-          });
+            });
 
-          if (!state) {
-            return yield* Effect.fail(
-              new Error(
-                `PodIdentityAssociation '${news.namespace}/${news.serviceAccount}' could not be read after creation`,
-              ),
-            );
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(
+                  `PodIdentityAssociation '${news.namespace}/${news.serviceAccount}' could not be read after creation`,
+                ),
+              );
+            }
           }
 
-          yield* session.note(state.associationArn);
-          return state;
-        }),
-        update: Effect.fn(function* ({ id, olds, news, output, session }) {
+          // Sync mutable fields — observed ↔ desired.
+          const desiredRoleArn = news.roleArn as string;
+          const desiredTargetRoleArn = news.targetRoleArn as string | undefined;
+          const desiredDisableSessionTags = news.disableSessionTags ?? false;
           if (
-            olds.roleArn !== news.roleArn ||
-            olds.disableSessionTags !== news.disableSessionTags ||
-            olds.targetRoleArn !== news.targetRoleArn ||
-            olds.policy !== news.policy
+            state.roleArn !== desiredRoleArn ||
+            state.disableSessionTags !== desiredDisableSessionTags ||
+            state.targetRoleArn !== desiredTargetRoleArn ||
+            state.policy !== news.policy
           ) {
             yield* eks.updatePodIdentityAssociation({
-              clusterName: output.clusterName,
-              associationId: output.associationId,
-              roleArn: news.roleArn as string,
+              clusterName,
+              associationId: state.associationId,
+              roleArn: desiredRoleArn,
               disableSessionTags: news.disableSessionTags,
-              targetRoleArn: news.targetRoleArn as string | undefined,
+              targetRoleArn: desiredTargetRoleArn,
               policy: news.policy,
               clientRequestToken: yield* toClientRequestToken(id, "update"),
             });
           }
 
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
-
+          // Sync tags — diff observed cloud tags against desired.
+          const { removed, upsert } = diffTags(state.tags, desiredTags);
           if (upsert.length > 0) {
             yield* eks.tagResource({
-              resourceArn: output.associationArn,
+              resourceArn: state.associationArn,
               tags: Object.fromEntries(
                 upsert.map((tag) => [tag.Key, tag.Value] as const),
               ),
             });
           }
-
           if (removed.length > 0) {
             yield* eks.untagResource({
-              resourceArn: output.associationArn,
+              resourceArn: state.associationArn,
               tagKeys: removed,
             });
           }
 
-          const state = yield* readAssociationById({
-            clusterName: output.clusterName,
-            associationId: output.associationId,
+          // Re-read final state for fresh attributes.
+          const final = yield* readAssociationById({
+            clusterName,
+            associationId: state.associationId,
           });
-
-          if (!state) {
+          if (!final) {
             return yield* Effect.fail(
               new Error(
-                `PodIdentityAssociation '${output.associationId}' could not be read after update`,
+                `PodIdentityAssociation '${state.associationId}' could not be read after reconcile`,
               ),
             );
           }
 
-          yield* session.note(output.associationArn);
-          return state;
+          yield* session.note(final.associationArn);
+          return final;
         }),
         delete: Effect.fn(function* ({ output }) {
           yield* eks
@@ -326,6 +319,21 @@ const findAssociation = Effect.fn(function* ({
   serviceAccount: string;
 }) {
   let nextToken: string | undefined;
+  type Association = {
+    associationArn: string;
+    associationId: string;
+    clusterName: string;
+    namespace: string;
+    serviceAccount: string;
+    roleArn: string;
+    disableSessionTags: boolean;
+    targetRoleArn: string | undefined;
+    externalId: string | undefined;
+    ownerArn: string | undefined;
+    policy: string | undefined;
+    tags: Record<string, string>;
+  };
+  let firstMatch: Association | undefined;
 
   while (true) {
     const response = yield* eks.listPodIdentityAssociations({
@@ -345,13 +353,16 @@ const findAssociation = Effect.fn(function* ({
         associationId: summary.associationId,
       });
 
-      if (association && (yield* hasAlchemyTags(id, association.tags))) {
-        return association;
+      if (!association) continue;
+
+      if (yield* hasAlchemyTags(id, association.tags)) {
+        return association as Association;
       }
+      firstMatch ??= association as Association;
     }
 
     if (!response.nextToken) {
-      return undefined;
+      return firstMatch ? Unowned(firstMatch) : undefined;
     }
 
     nextToken = response.nextToken;

package/src/AWS/ELBv2/Listener.ts

@@ -76,42 +76,81 @@ export const ListenerProvider = () =>
         protocol: listener.Protocol!,
       };
     }),
-    create: Effect.fn(function* ({ news, session }) {
-      const created = yield* elbv2.createListener({
-        LoadBalancerArn: news.loadBalancerArn as string,
-        Port: news.port,
-        Protocol: news.protocol ?? "HTTP",
-        Certificates: news.certificateArn
-          ? [{ CertificateArn: news.certificateArn }]
-          : undefined,
-        SslPolicy: news.sslPolicy,
-        DefaultActions: [
-          {
-            Type: "forward",
-            TargetGroupArn: news.targetGroupArn as string,
-          },
-        ],
-      });
-      const listener = created.Listeners?.[0];
+    reconcile: Effect.fn(function* ({ news, output, session }) {
+      const loadBalancerArn = news.loadBalancerArn as LoadBalancerArn;
+      const desiredTargetGroupArn = news.targetGroupArn as TargetGroupArn;
+      const desiredProtocol = news.protocol ?? "HTTP";
+
+      // Observe — describe the listener if we have a prior ARN; otherwise
+      // list listeners on the load balancer and find one matching port.
+      let listener: elbv2.Listener | undefined;
+      if (output?.listenerArn) {
+        const described = yield* elbv2
+          .describeListeners({
+            ListenerArns: [output.listenerArn],
+          })
+          .pipe(
+            Effect.catchTag("ListenerNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        listener = described?.Listeners?.[0];
+      }
       if (!listener?.ListenerArn) {
-        return yield* Effect.die(
-          new Error("createListener returned no listener"),
-        );
+        const listed = yield* elbv2
+          .describeListeners({
+            LoadBalancerArn: loadBalancerArn,
+          })
+          .pipe(
+            Effect.catchTag("LoadBalancerNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+            Effect.catchTag("ListenerNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        listener = listed?.Listeners?.find((l) => l.Port === news.port);
       }
-      yield* session.note(listener.ListenerArn);
-      return {
-        listenerArn: listener.ListenerArn as ListenerArn,
-        loadBalancerArn: listener.LoadBalancerArn as LoadBalancerArn,
-        targetGroupArn: news.targetGroupArn as TargetGroupArn,
-        port: listener.Port!,
-        protocol: listener.Protocol!,
-      };
-    }),
-    update: Effect.fn(function* ({ news, output, session }) {
+
+      // Ensure — create if missing.
+      if (!listener?.ListenerArn) {
+        const created = yield* elbv2.createListener({
+          LoadBalancerArn: loadBalancerArn,
+          Port: news.port,
+          Protocol: desiredProtocol,
+          Certificates: news.certificateArn
+            ? [{ CertificateArn: news.certificateArn }]
+            : undefined,
+          SslPolicy: news.sslPolicy,
+          DefaultActions: [
+            {
+              Type: "forward",
+              TargetGroupArn: desiredTargetGroupArn,
+            },
+          ],
+        });
+        listener = created.Listeners?.[0];
+        if (!listener?.ListenerArn) {
+          return yield* Effect.die(
+            new Error("createListener returned no listener"),
+          );
+        }
+        yield* session.note(listener.ListenerArn);
+        return {
+          listenerArn: listener.ListenerArn as ListenerArn,
+          loadBalancerArn: listener.LoadBalancerArn as LoadBalancerArn,
+          targetGroupArn: desiredTargetGroupArn,
+          port: listener.Port!,
+          protocol: listener.Protocol!,
+        };
+      }
+
+      // Sync — apply mutable fields (port, protocol, certificates,
+      // sslPolicy, defaultActions). modifyListener fully replaces these.
       const modified = yield* elbv2.modifyListener({
-        ListenerArn: output.listenerArn,
+        ListenerArn: listener.ListenerArn,
         Port: news.port,
-        Protocol: news.protocol ?? "HTTP",
+        Protocol: desiredProtocol,
         Certificates: news.certificateArn
           ? [{ CertificateArn: news.certificateArn }]
           : undefined,
@@ -119,18 +158,18 @@ export const ListenerProvider = () =>
         DefaultActions: [
           {
             Type: "forward",
-            TargetGroupArn: news.targetGroupArn as string,
+            TargetGroupArn: desiredTargetGroupArn,
           },
         ],
       });
-      const listener = modified.Listeners?.[0];
-      yield* session.note(output.listenerArn);
+      const final = modified.Listeners?.[0] ?? listener;
+      yield* session.note(listener.ListenerArn);
       return {
-        listenerArn: output.listenerArn,
-        loadBalancerArn: output.loadBalancerArn,
-        targetGroupArn: news.targetGroupArn as TargetGroupArn,
-        port: listener?.Port ?? news.port,
-        protocol: listener?.Protocol ?? news.protocol ?? "HTTP",
+        listenerArn: listener.ListenerArn as ListenerArn,
+        loadBalancerArn: listener.LoadBalancerArn as LoadBalancerArn,
+        targetGroupArn: desiredTargetGroupArn,
+        port: final.Port ?? news.port,
+        protocol: final.Protocol ?? desiredProtocol,
       };
     }),
     delete: Effect.fn(function* ({ output }) {

package/src/AWS/ELBv2/LoadBalancer.ts

@@ -124,30 +124,59 @@ export const LoadBalancerProvider = () =>
               ) ?? [],
           };
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
+        reconcile: Effect.fn(function* ({ id, news, session }) {
           const name = yield* toName(id, news);
-          const tags = {
+          const desiredTags = {
             ...(yield* createInternalTags(id)),
             ...news.tags,
           };
-          const created = yield* elbv2.createLoadBalancer({
-            Name: name,
-            Scheme: news.scheme ?? "internet-facing",
-            Type: news.type ?? "application",
-            Subnets: news.subnets as string[],
-            SecurityGroups: news.securityGroups as string[] | undefined,
-            IpAddressType: news.ipAddressType,
-            Tags: Object.entries(tags).map(([Key, Value]) => ({ Key, Value })),
-          });
-          const loadBalancer = created.LoadBalancers?.[0];
-          if (!loadBalancer?.LoadBalancerArn) {
-            return yield* Effect.die(
-              new Error("createLoadBalancer returned no load balancer"),
+
+          // Observe — look up by deterministic name.
+          let described = yield* elbv2
+            .describeLoadBalancers({
+              Names: [name],
+            })
+            .pipe(
+              Effect.catchTag("LoadBalancerNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
             );
+          let loadBalancer = described?.LoadBalancers?.[0];
+
+          // Ensure — create if missing. The replacement axes (scheme, type,
+          // subnets, securityGroups, ipAddressType) are handled by diff so
+          // we don't need to deal with mismatches here.
+          if (!loadBalancer?.LoadBalancerArn) {
+            const created = yield* elbv2.createLoadBalancer({
+              Name: name,
+              Scheme: news.scheme ?? "internet-facing",
+              Type: news.type ?? "application",
+              Subnets: news.subnets as string[],
+              SecurityGroups: news.securityGroups as string[] | undefined,
+              IpAddressType: news.ipAddressType,
+              Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                Key,
+                Value,
+              })),
+            });
+            loadBalancer = created.LoadBalancers?.[0];
+            if (!loadBalancer?.LoadBalancerArn) {
+              return yield* Effect.die(
+                new Error("createLoadBalancer returned no load balancer"),
+              );
+            }
           }
+
+          const loadBalancerArn =
+            loadBalancer.LoadBalancerArn as LoadBalancerArn;
+
+          // Sync attributes — observed ↔ desired. We always apply when
+          // desired attrs are non-empty; AWS rejects an empty list anyway,
+          // and reading observed attributes is an extra round-trip we
+          // don't need for convergence.
           if (news.attributes && Object.keys(news.attributes).length > 0) {
             yield* elbv2.modifyLoadBalancerAttributes({
-              LoadBalancerArn: loadBalancer.LoadBalancerArn,
+              LoadBalancerArn: loadBalancerArn,
               Attributes: Object.entries(news.attributes).map(
                 ([Key, Value]) => ({
                   Key,
@@ -156,9 +185,36 @@ export const LoadBalancerProvider = () =>
               ),
             });
           }
-          yield* session.note(loadBalancer.LoadBalancerArn);
+
+          // Sync tags — diff observed cloud tags against desired.
+          const tagDescriptions = yield* elbv2.describeTags({
+            ResourceArns: [loadBalancerArn],
+          });
+          const observedTags = Object.fromEntries(
+            (tagDescriptions.TagDescriptions?.[0]?.Tags ?? [])
+              .filter(
+                (t): t is { Key: string; Value: string } =>
+                  typeof t.Key === "string" && typeof t.Value === "string",
+              )
+              .map((t) => [t.Key, t.Value]),
+          );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* elbv2.addTags({
+              ResourceArns: [loadBalancerArn],
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* elbv2.removeTags({
+              ResourceArns: [loadBalancerArn],
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(loadBalancerArn);
           return {
-            loadBalancerArn: loadBalancer.LoadBalancerArn as LoadBalancerArn,
+            loadBalancerArn,
             loadBalancerName: loadBalancer.LoadBalancerName!,
             dnsName: loadBalancer.DNSName!,
             canonicalHostedZoneId: loadBalancer.CanonicalHostedZoneId!,
@@ -170,49 +226,7 @@ export const LoadBalancerProvider = () =>
               loadBalancer.AvailabilityZones?.flatMap((zone) =>
                 zone.SubnetId ? [zone.SubnetId] : [],
               ) ?? [],
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          if (
-            JSON.stringify(news.attributes ?? {}) !==
-            JSON.stringify(olds.attributes ?? {})
-          ) {
-            yield* elbv2.modifyLoadBalancerAttributes({
-              LoadBalancerArn: output.loadBalancerArn,
-              Attributes: Object.entries(news.attributes ?? {}).map(
-                ([Key, Value]) => ({
-                  Key,
-                  Value,
-                }),
-              ),
-            });
-          }
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
-          if (upsert.length > 0) {
-            yield* elbv2.addTags({
-              ResourceArns: [output.loadBalancerArn],
-              Tags: upsert,
-            });
-          }
-          if (removed.length > 0) {
-            yield* elbv2.removeTags({
-              ResourceArns: [output.loadBalancerArn],
-              TagKeys: removed,
-            });
-          }
-          yield* session.note(output.loadBalancerArn);
-          return {
-            ...output,
-            tags: newTags,
+            tags: desiredTags,
           };
         }),
         delete: Effect.fn(function* ({ output }) {