alchemy 2.0.0-beta.4 → 2.0.0-beta.41

package/lib/AWS/EC2/Instance.d.ts

@@ -0,0 +1,265 @@
+import type { Credentials } from "@distilled.cloud/aws/Credentials";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as FileSystem from "effect/FileSystem";
+import type * as rolldown from "rolldown";
+import type { Input } from "../../Input.ts";
+import { Platform, type Main, type PlatformProps } from "../../Platform.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { ServerHost } from "../../Server/Process.ts";
+import { Stack } from "../../Stack.ts";
+import { Stage } from "../../Stage.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { PolicyStatement } from "../IAM/Policy.ts";
+import type { Providers } from "../Providers.ts";
+import type { RegionID } from "../Region.ts";
+import { type Ec2HostRuntimeContext } from "./hosted.ts";
+import type { SecurityGroupId } from "./SecurityGroup.ts";
+import type { SubnetId } from "./Subnet.ts";
+import type { VpcId } from "./Vpc.ts";
+export type InstanceId<ID extends string = string> = `i-${ID}`;
+export declare const InstanceId: <ID extends string>(id: ID) => ID & InstanceId<ID>;
+export type InstanceArn<ID extends InstanceId = InstanceId> = `arn:aws:ec2:${RegionID}:${AccountID}:instance/${ID}`;
+export declare const isInstance: (value: any) => value is Instance;
+export interface InstanceProps extends PlatformProps {
+    /**
+     * AMI ID to launch.
+     */
+    imageId: string;
+    /**
+     * EC2 instance type, such as `t3.micro`.
+     */
+    instanceType: string;
+    /**
+     * Optional subnet to launch into.
+     */
+    subnetId?: Input<SubnetId>;
+    /**
+     * Security groups to attach to the primary network interface.
+     */
+    securityGroupIds?: Input<SecurityGroupId>[];
+    /**
+     * Optional EC2 key pair name for SSH access.
+     */
+    keyName?: string;
+    /**
+     * Optional IAM instance profile name to attach at launch.
+     */
+    instanceProfileName?: string;
+    /**
+     * User data script to provide at launch time.
+     */
+    userData?: string;
+    /**
+     * Whether to associate a public IPv4 address on launch.
+     */
+    associatePublicIpAddress?: boolean;
+    /**
+     * Optional private IPv4 address for the primary interface.
+     */
+    privateIpAddress?: string;
+    /**
+     * Optional availability zone override.
+     */
+    availabilityZone?: string;
+    /**
+     * Whether source/destination checking is enabled.
+     * @default true
+     */
+    sourceDestCheck?: boolean;
+    /**
+     * User-defined tags to apply to the instance.
+     */
+    tags?: Record<string, string>;
+    /**
+     * Module entrypoint for the bundled instance program.
+     * When omitted, the instance behaves as a low-level EC2 resource.
+     */
+    main?: string;
+    /**
+     * Named export to load from `main`.
+     * @default "default"
+     */
+    handler?: string;
+    /**
+     * Port exposed by the process, if any.
+     * @default 3000
+     */
+    port?: number;
+    /**
+     * Additional environment variables for the hosted process.
+     */
+    env?: Record<string, any>;
+    /**
+     * Bundler configuration for the hosted process entrypoint.
+     */
+    build?: {
+        input?: Partial<rolldown.InputOptions>;
+        output?: Partial<rolldown.OutputOptions>;
+    };
+    /**
+     * Additional managed policy ARNs for the managed instance role.
+     * This can only be used when Alchemy manages the instance profile.
+     */
+    roleManagedPolicyArns?: string[];
+}
+export interface Instance extends Resource<"AWS.EC2.Instance", InstanceProps, {
+    /**
+     * The ID of the instance.
+     */
+    instanceId: InstanceId;
+    /**
+     * The Amazon Resource Name (ARN) of the instance.
+     */
+    instanceArn: InstanceArn;
+    /**
+     * The AMI ID the instance launched from.
+     */
+    imageId: string;
+    /**
+     * The instance type.
+     */
+    instanceType: string;
+    /**
+     * The current instance state.
+     */
+    state: string;
+    /**
+     * The VPC the instance belongs to, if any.
+     */
+    vpcId?: VpcId;
+    /**
+     * The subnet the instance belongs to, if any.
+     */
+    subnetId?: SubnetId;
+    /**
+     * The availability zone of the instance.
+     */
+    availabilityZone?: string;
+    /**
+     * The attached security group IDs.
+     */
+    securityGroupIds: string[];
+    /**
+     * The primary private IPv4 address.
+     */
+    privateIpAddress?: string;
+    /**
+     * The public IPv4 address, if assigned.
+     */
+    publicIpAddress?: string;
+    /**
+     * The private DNS name.
+     */
+    privateDnsName?: string;
+    /**
+     * The public DNS name, if assigned.
+     */
+    publicDnsName?: string;
+    /**
+     * The key pair name used for SSH access.
+     */
+    keyName?: string;
+    /**
+     * The IAM instance profile ARN attached to the instance, if any.
+     */
+    instanceProfileArn?: string;
+    /**
+     * The IAM instance profile ID attached to the instance, if any.
+     */
+    instanceProfileId?: string;
+    /**
+     * The IAM instance profile name attached to the instance, if known.
+     */
+    instanceProfileName?: string;
+    /**
+     * Whether source/destination checking is enabled.
+     */
+    sourceDestCheck?: boolean;
+    /**
+     * When the instance was launched.
+     */
+    launchTime?: string;
+    /**
+     * Current tags on the instance.
+     */
+    tags: Record<string, string>;
+    /**
+     * Role attached by the hosted runtime, if any.
+     */
+    roleArn?: string;
+    /**
+     * Role name attached by the hosted runtime, if any.
+     */
+    roleName?: string;
+    /**
+     * Inline policy name used for bindings/runtime sync, if any.
+     */
+    policyName?: string;
+    /**
+     * Whether the role/profile were created and owned by Alchemy.
+     */
+    managedIam?: boolean;
+    /**
+     * Deterministic runtime unit name for hosted instances.
+     */
+    runtimeUnitName?: string;
+    /**
+     * Asset prefix for hosted bundles and env files.
+     */
+    assetPrefix?: string;
+    /**
+     * Bundle hash for hosted instances.
+     */
+    code?: {
+        hash: string;
+    };
+}, {
+    env?: Record<string, any>;
+    policyStatements?: PolicyStatement[];
+}, Providers> {
+}
+export type InstanceServices = ServerHost | Credentials | Region;
+export type InstanceShape = Main<InstanceServices>;
+export type InstanceRuntimeContext = Ec2HostRuntimeContext;
+/**
+ * An EC2 instance that can either act as a low-level compute primitive or run
+ * a bundled long-lived Effect program directly on the machine.
+ *
+ * @section Launching Instances
+ * @example Basic Instance
+ * ```typescript
+ * const instance = yield* AWS.EC2.Instance("AppInstance", {
+ *   imageId,
+ *   instanceType: "t3.micro",
+ *   subnetId: subnet.subnetId,
+ * });
+ * ```
+ *
+ * @section Hosting Processes
+ * @example HTTP Server on an Instance
+ * ```typescript
+ * const api = yield* Effect.gen(function* () {
+ *   yield* Http.serve(
+ *     HttpServerResponse.json({ ok: true }),
+ *   );
+ *
+ *   return {
+ *     main: import.meta.filename,
+ *     imageId,
+ *     instanceType: "t3.small",
+ *     subnetId: subnet.subnetId,
+ *     securityGroupIds: [securityGroup.groupId],
+ *     associatePublicIpAddress: true,
+ *     port: 3000,
+ *   };
+ * }).pipe(
+ *   Effect.provide(AWS.EC2.HttpServer),
+ *   AWS.EC2.Instance("ApiInstance"),
+ * );
+ * ```
+ */
+export declare const Instance: Platform<Instance, InstanceServices, InstanceShape, InstanceRuntimeContext>;
+export declare const InstanceProvider: () => import("effect/Layer").Layer<Provider.Provider<Instance>, never, FileSystem.FileSystem | import("effect/Path").Path | Stage | Stack | AWSEnvironment | import("../Assets.ts").AssetsRequirements>;
+//# sourceMappingURL=Instance.d.ts.map

package/lib/AWS/EC2/Instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Instance.d.ts","sourceRoot":"","sources":["../../../src/AWS/EC2/Instance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAEpE,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAGrD,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAIhD,OAAO,KAAK,KAAK,QAAQ,MAAM,UAAU,CAAC;AAI1C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAOvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,MAAM,UAAU,CAAC,EAAE,SAAS,MAAM,GAAG,MAAM,IAAI,KAAK,EAAE,EAAE,CAAC;AAC/D,eAAO,MAAM,UAAU,GAAI,EAAE,SAAS,MAAM,EAAE,IAAI,EAAE,KAAG,EAAE,GAAG,UAAU,CAAC,EAAE,CACvC,CAAC;AAEnC,MAAM,MAAM,WAAW,CAAC,EAAE,SAAS,UAAU,GAAG,UAAU,IACxD,eAAe,QAAQ,IAAI,SAAS,aAAa,EAAE,EAAE,CAAC;AAExD,eAAO,MAAM,UAAU,GAAI,OAAO,GAAG,KAAG,KAAK,IAAI,QAOhD,CAAC;AAEF,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3B;;OAEG;IACH,gBAAgB,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;IAC5C;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B;;OAEG;IACH,KAAK,CAAC,EAAE;QACN,KAAK,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;KAC1C,CAAC;IACF;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,kBAAkB,EAClB,aAAa,EACb;IACE;;OAEG;IACH,UAAU,EAAE,UAAU,CAAC;IACvB;;OAEG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;OAEG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH,EACD;IACE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;CACtC,EACD,SAAS,CACV;CAAG;AAEJ,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,WAAW,GAAG,MAAM,CAAC;AAEjE,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAEnD,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAC7B,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,sBAAsB,CAGtB,CAAC;AAEH,eAAO,MAAM,gBAAgB,yMAmhB1B,CAAC"}

package/lib/AWS/EC2/Instance.js

@@ -0,0 +1,419 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import * as Bundle from "../../Bundle/Bundle.js";
+import { deepEqual, isResolved } from "../../Diff.js";
+import { Platform } from "../../Platform.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { Stack } from "../../Stack.js";
+import { Stage } from "../../Stage.js";
+import { createAlchemyTagFilters, createInternalTags, diffTags, } from "../../Tags.js";
+import { Assets } from "../Assets.js";
+import { AWSEnvironment } from "../Environment.js";
+import { createEc2HostRuntimeContext, createEc2HostedSupport, } from "./hosted.js";
+export const InstanceId = (id) => `i-${id}`;
+export const isInstance = (value) => {
+    return (typeof value === "object" &&
+        value !== null &&
+        "Type" in value &&
+        value.Type === "AWS.EC2.Instance");
+};
+/**
+ * An EC2 instance that can either act as a low-level compute primitive or run
+ * a bundled long-lived Effect program directly on the machine.
+ *
+ * @section Launching Instances
+ * @example Basic Instance
+ * ```typescript
+ * const instance = yield* AWS.EC2.Instance("AppInstance", {
+ *   imageId,
+ *   instanceType: "t3.micro",
+ *   subnetId: subnet.subnetId,
+ * });
+ * ```
+ *
+ * @section Hosting Processes
+ * @example HTTP Server on an Instance
+ * ```typescript
+ * const api = yield* Effect.gen(function* () {
+ *   yield* Http.serve(
+ *     HttpServerResponse.json({ ok: true }),
+ *   );
+ *
+ *   return {
+ *     main: import.meta.filename,
+ *     imageId,
+ *     instanceType: "t3.small",
+ *     subnetId: subnet.subnetId,
+ *     securityGroupIds: [securityGroup.groupId],
+ *     associatePublicIpAddress: true,
+ *     port: 3000,
+ *   };
+ * }).pipe(
+ *   Effect.provide(AWS.EC2.HttpServer),
+ *   AWS.EC2.Instance("ApiInstance"),
+ * );
+ * ```
+ */
+export const Instance = Platform("AWS.EC2.Instance", {
+    createRuntimeContext: createEc2HostRuntimeContext("AWS.EC2.Instance"),
+});
+export const InstanceProvider = () => Provider.effect(Instance, Effect.gen(function* () {
+    const region = yield* Region;
+    const { accountId } = yield* AWSEnvironment;
+    const stack = yield* Stack;
+    const stage = yield* Stage;
+    const fs = yield* FileSystem.FileSystem;
+    const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
+    const assets = (yield* Effect.serviceOption(Assets)).pipe(Option.getOrUndefined);
+    const toInstanceArn = (instanceId) => `arn:aws:ec2:${region}:${accountId}:instance/${instanceId}`;
+    const hosted = createEc2HostedSupport({
+        accountId,
+        region,
+        stackName: stack.name,
+        stage,
+        fs,
+        virtualEntryPlugin,
+        assets,
+        resourceType: "EC2.Instance",
+    });
+    const isPendingInstanceProfileError = (error) => {
+        const tag = error?._tag;
+        if (tag === "InvalidIAMInstanceProfile.NotFound" ||
+            tag === "InvalidParameterValue") {
+            return true;
+        }
+        if (tag !== "UnknownAwsError") {
+            return false;
+        }
+        const unknown = error;
+        const message = unknown.message ??
+            unknown.errorData?.message ??
+            unknown.errorData?.Message ??
+            "";
+        return (unknown.errorTag === "InvalidParameterValue" &&
+            message.includes("iamInstanceProfile.name") &&
+            message.includes("Invalid IAM Instance Profile name"));
+    };
+    const isPendingInstanceLookupError = (error) => {
+        const tag = error?._tag;
+        return (error instanceof InstanceNotFound ||
+            tag === "InvalidInstanceID.NotFound");
+    };
+    const toTagRecord = (tags) => Object.fromEntries((tags ?? [])
+        .filter((tag) => Boolean(tag.Key && tag.Value !== undefined))
+        .map((tag) => [tag.Key, tag.Value]));
+    const toAttributes = (instance) => ({
+        instanceId: instance.InstanceId,
+        instanceArn: toInstanceArn(instance.InstanceId),
+        imageId: instance.ImageId,
+        instanceType: String(instance.InstanceType ?? ""),
+        state: instance.State?.Name ?? "unknown",
+        vpcId: instance.VpcId,
+        subnetId: instance.SubnetId,
+        availabilityZone: instance.Placement?.AvailabilityZone,
+        securityGroupIds: (instance.SecurityGroups ?? [])
+            .map((group) => group.GroupId)
+            .filter((value) => Boolean(value)),
+        privateIpAddress: instance.PrivateIpAddress,
+        publicIpAddress: instance.PublicIpAddress,
+        privateDnsName: instance.PrivateDnsName,
+        publicDnsName: instance.PublicDnsName,
+        keyName: instance.KeyName,
+        instanceProfileArn: instance.IamInstanceProfile?.Arn,
+        instanceProfileId: instance.IamInstanceProfile?.Id,
+        instanceProfileName: undefined,
+        sourceDestCheck: instance.SourceDestCheck,
+        launchTime: instance.LaunchTime instanceof Date
+            ? instance.LaunchTime.toISOString()
+            : instance.LaunchTime,
+        tags: toTagRecord(instance.Tags),
+    });
+    const describeInstance = (instanceId) => ec2
+        .describeInstances({
+        InstanceIds: [instanceId],
+    })
+        .pipe(Effect.map((result) => (result.Reservations ?? []).flatMap((reservation) => reservation.Instances ?? [])[0]), Effect.flatMap((instance) => instance
+        ? Effect.succeed(instance)
+        : Effect.fail(new InstanceNotFound({ instanceId }))));
+    const findInstanceByTags = Effect.fn(function* (id) {
+        const filters = yield* createAlchemyTagFilters(id);
+        return yield* ec2.describeInstances
+            .items({
+            Filters: filters,
+        })
+            .pipe(Stream.flatMap((reservation) => Stream.fromArray(reservation.Instances ?? [])), Stream.filter((instance) => {
+            const state = instance.State?.Name;
+            return (state === "pending" ||
+                state === "running" ||
+                state === "stopping" ||
+                state === "stopped");
+        }), Stream.runCollect, Effect.map((instances) => [...instances].sort((a, b) => {
+            const aTime = a.LaunchTime instanceof Date
+                ? a.LaunchTime.getTime()
+                : Date.parse(String(a.LaunchTime ?? 0));
+            const bTime = b.LaunchTime instanceof Date
+                ? b.LaunchTime.getTime()
+                : Date.parse(String(b.LaunchTime ?? 0));
+            return bTime - aTime;
+        })[0]));
+    });
+    const waitForState = Effect.fn(function* ({ instanceId, states, session, }) {
+        return yield* describeInstance(instanceId).pipe(Effect.tap((instance) => session.note(`Waiting for instance ${instanceId}: ${instance.State?.Name ?? "unknown"}`)), Effect.filterOrFail((instance) => states.includes(instance.State?.Name ?? ""), (instance) => new InstanceStateMismatch({
+            instanceId,
+            actual: instance.State?.Name ?? "unknown",
+            expected: states,
+        })), Effect.retry({
+            while: (error) => error instanceof InstanceStateMismatch ||
+                isPendingInstanceLookupError(error),
+            schedule: Schedule.exponential("250 millis").pipe(Schedule.both(Schedule.recurs(8))),
+        }));
+    });
+    const waitForDeleted = Effect.fn(function* ({ instanceId, session, }) {
+        yield* describeInstance(instanceId).pipe(Effect.tap((instance) => session.note(`Waiting for instance deletion ${instanceId}: ${instance.State?.Name ?? "unknown"}`)), Effect.flatMap((instance) => instance.State?.Name === "terminated"
+            ? Effect.succeed(undefined)
+            : Effect.fail(new InstanceStillExists({ instanceId }))), Effect.retry({
+            while: (error) => error instanceof InstanceStillExists,
+            schedule: Schedule.exponential("250 millis").pipe(Schedule.both(Schedule.recurs(8))),
+        }), Effect.catchTag("InvalidInstanceID.NotFound", () => Effect.void), Effect.catchTag("InstanceNotFound", () => Effect.void));
+    });
+    const resolvedSecurityGroups = (groups) => hosted.normalizeSecurityGroups(groups);
+    const buildRunInstancesRequest = (news, runtime, tags) => {
+        return {
+            ...hosted.buildLaunchTemplateData({
+                imageId: news.imageId,
+                instanceType: news.instanceType,
+                keyName: news.keyName,
+                subnetId: news.subnetId,
+                securityGroupIds: news.securityGroupIds,
+                associatePublicIpAddress: news.associatePublicIpAddress,
+                privateIpAddress: news.privateIpAddress,
+                availabilityZone: news.availabilityZone,
+                tags,
+            }, runtime),
+            MinCount: 1,
+            MaxCount: 1,
+        };
+    };
+    return {
+        stables: ["instanceId", "instanceArn", "vpcId", "subnetId"],
+        diff: Effect.fn(function* ({ news, olds }) {
+            if (!isResolved(news))
+                return;
+            const hostModeChanged = Boolean(olds.main) !== Boolean(news.main);
+            if (hostModeChanged ||
+                olds.imageId !== news.imageId ||
+                olds.subnetId !== news.subnetId ||
+                olds.keyName !== news.keyName ||
+                olds.instanceProfileName !== news.instanceProfileName ||
+                olds.userData !== news.userData ||
+                olds.associatePublicIpAddress !== news.associatePublicIpAddress ||
+                olds.privateIpAddress !== news.privateIpAddress ||
+                olds.availabilityZone !== news.availabilityZone) {
+                return { action: "replace" };
+            }
+            if (olds.instanceType !== news.instanceType ||
+                olds.sourceDestCheck !== news.sourceDestCheck ||
+                olds.main !== news.main ||
+                olds.handler !== news.handler ||
+                olds.port !== news.port ||
+                !deepEqual(olds.env ?? {}, news.env ?? {}) ||
+                !deepEqual(olds.build ?? {}, news.build ?? {}) ||
+                !deepEqual(olds.roleManagedPolicyArns ?? [], news.roleManagedPolicyArns ?? []) ||
+                !deepEqual(resolvedSecurityGroups(olds.securityGroupIds), resolvedSecurityGroups(news.securityGroupIds)) ||
+                !deepEqual(olds.tags ?? {}, news.tags ?? {})) {
+                return {
+                    action: "update",
+                    stables: ["instanceId", "instanceArn", "vpcId", "subnetId"],
+                };
+            }
+        }),
+        read: Effect.fn(function* ({ id, output }) {
+            const instance = output?.instanceId
+                ? yield* describeInstance(output.instanceId).pipe(Effect.catchTag("InvalidInstanceID.NotFound", () => Effect.succeed(undefined)), Effect.catchTag("InstanceNotFound", () => Effect.succeed(undefined)))
+                : yield* findInstanceByTags(id);
+            return instance
+                ? {
+                    ...toAttributes(instance),
+                    instanceProfileName: output?.instanceProfileName,
+                    roleArn: output?.roleArn,
+                    roleName: output?.roleName,
+                    policyName: output?.policyName,
+                    managedIam: output?.managedIam,
+                    runtimeUnitName: output?.runtimeUnitName,
+                    assetPrefix: output?.assetPrefix,
+                    code: output?.code,
+                }
+                : undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, bindings, session, }) {
+            const desiredTags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            const runtime = yield* hosted.resolveHostedRuntime({
+                id,
+                news,
+                bindings,
+                output,
+            });
+            // Observe — try the cached instanceId first, then fall back to the
+            // alchemy-tag search for recovery from interrupted creates. EC2
+            // assigns instance IDs server-side so we always read the live
+            // record before deciding whether to launch a new one.
+            let instance = output?.instanceId
+                ? yield* describeInstance(output.instanceId).pipe(Effect.catchTag("InvalidInstanceID.NotFound", () => Effect.succeed(undefined)), Effect.catchTag("InstanceNotFound", () => Effect.succeed(undefined)))
+                : yield* findInstanceByTags(id);
+            // A terminated instance is a tombstone; treat as missing so we
+            // launch a fresh one.
+            if (instance && instance.State?.Name === "terminated") {
+                instance = undefined;
+            }
+            // Ensure — RunInstances when no live instance was observed. The
+            // initial sourceDestCheck is set here because RunInstances itself
+            // doesn't accept it.
+            if (instance === undefined) {
+                const created = yield* ec2
+                    .runInstances(buildRunInstancesRequest(news, runtime, desiredTags))
+                    .pipe(Effect.retry({
+                    while: isPendingInstanceProfileError,
+                    schedule: Schedule.exponential("500 millis").pipe(Schedule.both(Schedule.recurs(8))),
+                }));
+                const newInstanceId = created.Instances?.[0]?.InstanceId;
+                if (!newInstanceId) {
+                    return yield* Effect.fail(new Error(`RunInstances returned no instance ID for '${id}'`));
+                }
+                yield* session.note(newInstanceId);
+                instance = yield* waitForState({
+                    instanceId: newInstanceId,
+                    states: ["running"],
+                    session,
+                });
+                if (news.sourceDestCheck !== undefined) {
+                    yield* ec2.modifyInstanceAttribute({
+                        InstanceId: newInstanceId,
+                        SourceDestCheck: { Value: news.sourceDestCheck },
+                    });
+                }
+            }
+            const instanceId = instance.InstanceId;
+            let restarted = false;
+            // Sync security groups — observed primary-ENI groups vs desired.
+            const observedSecurityGroups = (instance.SecurityGroups ?? [])
+                .map((g) => g.GroupId)
+                .filter((g) => Boolean(g));
+            const desiredSecurityGroups = resolvedSecurityGroups(news.securityGroupIds);
+            if (desiredSecurityGroups &&
+                JSON.stringify([...observedSecurityGroups].sort()) !==
+                    JSON.stringify([...desiredSecurityGroups].sort())) {
+                yield* ec2.modifyInstanceAttribute({
+                    InstanceId: instanceId,
+                    Groups: desiredSecurityGroups,
+                });
+            }
+            // Sync source/dest check — observed flag vs desired (default true).
+            const desiredSourceDestCheck = news.sourceDestCheck ?? true;
+            if ((instance.SourceDestCheck ?? true) !== desiredSourceDestCheck) {
+                yield* ec2.modifyInstanceAttribute({
+                    InstanceId: instanceId,
+                    SourceDestCheck: { Value: desiredSourceDestCheck },
+                });
+            }
+            // Sync instance type — observed type vs desired. Type changes need
+            // the instance stopped, then we restart it if it was running.
+            if (news.instanceType &&
+                String(instance.InstanceType ?? "") !== news.instanceType) {
+                const wasRunning = instance.State?.Name === "running";
+                if (wasRunning) {
+                    yield* ec2.stopInstances({ InstanceIds: [instanceId] });
+                    yield* waitForState({
+                        instanceId,
+                        states: ["stopped"],
+                        session,
+                    });
+                }
+                yield* ec2.modifyInstanceAttribute({
+                    InstanceId: instanceId,
+                    InstanceType: {
+                        Value: news.instanceType,
+                    },
+                });
+                if (wasRunning) {
+                    yield* ec2.startInstances({ InstanceIds: [instanceId] });
+                    yield* waitForState({
+                        instanceId,
+                        states: ["running"],
+                        session,
+                    });
+                    restarted = true;
+                }
+            }
+            // Sync tags — observed cloud tags vs desired.
+            const currentTags = Object.fromEntries((instance.Tags ?? [])
+                .filter((t) => Boolean(t.Key && t.Value !== undefined))
+                .map((t) => [t.Key, t.Value]));
+            const { removed, upsert } = diffTags(currentTags, desiredTags);
+            if (removed.length > 0) {
+                yield* ec2.deleteTags({
+                    Resources: [instanceId],
+                    Tags: removed.map((key) => ({ Key: key })),
+                });
+            }
+            if (upsert.length > 0) {
+                yield* ec2.createTags({
+                    Resources: [instanceId],
+                    Tags: upsert,
+                });
+            }
+            // Hosted-runtime reboot — picks up new bundle/env without an
+            // explicit instance-type cycle. Skip if the type-change path
+            // already restarted us.
+            if (news.main && !restarted) {
+                yield* ec2.rebootInstances({ InstanceIds: [instanceId] });
+                yield* waitForState({
+                    instanceId,
+                    states: ["running"],
+                    session,
+                });
+            }
+            // Re-read final state so attributes reflect the post-sync cloud.
+            const final = yield* describeInstance(instanceId);
+            return {
+                ...toAttributes(final),
+                instanceProfileName: runtime.instanceProfileName ?? output?.instanceProfileName,
+                roleArn: runtime.roleArn ?? output?.roleArn,
+                roleName: runtime.roleName ?? output?.roleName,
+                policyName: runtime.policyName ?? output?.policyName,
+                managedIam: runtime.managedIam ?? output?.managedIam,
+                runtimeUnitName: runtime.runtimeUnitName ?? output?.runtimeUnitName,
+                assetPrefix: runtime.assetPrefix ?? output?.assetPrefix,
+                code: runtime.code ?? output?.code,
+            };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            yield* ec2
+                .terminateInstances({
+                InstanceIds: [output.instanceId],
+            })
+                .pipe(Effect.catchTag("InvalidInstanceID.NotFound", () => Effect.void));
+            yield* waitForDeleted({
+                instanceId: output.instanceId,
+                session,
+            });
+            yield* hosted.cleanupHostedRuntime({ output });
+        }),
+    };
+}));
+class InstanceNotFound extends Data.TaggedError("InstanceNotFound") {
+}
+class InstanceStillExists extends Data.TaggedError("InstanceStillExists") {
+}
+class InstanceStateMismatch extends Data.TaggedError("InstanceStateMismatch") {
+}
+//# sourceMappingURL=Instance.js.map