alchemy 2.0.0-beta.74 → 2.0.0-beta.76

package/src/AWS/Cognito/UserPool.ts

@@ -104,9 +104,10 @@ export interface UserPoolSchemaAttribute {
 
 /**
  * The user pool Lambda trigger slots that take a plain function ARN — the
- * string-valued keys of the pool's `LambdaConfig`. (`CustomSMSSender` /
- * `CustomEmailSender` take versioned config objects + a KMS key and are
- * out of scope for the trigger event source.)
+ * string-valued keys of the pool's `LambdaConfig`. The versioned custom
+ * sender slots are configured separately: `CustomEmailSender` through
+ * {@link UserPoolProps.customEmailSender} (+ `kmsKeyId`); `CustomSMSSender`
+ * is not modelled yet (an observed one is preserved, never cleared).
  */
 export type UserPoolTriggerName =
   | "PreSignUp"
@@ -164,6 +165,100 @@ export class ConflictingUserPoolTrigger extends Data.TaggedError(
   readonly functionArns: readonly string[];
 }> {}
 
+/**
+ * The user pool's configuration is internally inconsistent (e.g. a custom
+ * email sender without the KMS key Cognito needs to encrypt the codes it
+ * hands to the function). Raised before any API call is made.
+ */
+export class InvalidUserPoolConfiguration extends Data.TaggedError(
+  "InvalidUserPoolConfiguration",
+)<{
+  readonly reason: string;
+}> {}
+
+/**
+ * A first-factor sign-in method for choice-based authentication.
+ */
+export type UserPoolAuthFactor =
+  | "PASSWORD"
+  | "EMAIL_OTP"
+  | "SMS_OTP"
+  | "WEB_AUTHN";
+
+/**
+ * The sign-in policy of the pool — which first-factor authentication
+ * methods users may start with (choice-based authentication). Requires the
+ * `ESSENTIALS` or `PLUS` feature tier.
+ */
+export interface UserPoolSignInPolicy {
+  /**
+   * First-factor sign-in methods the pool allows. `PASSWORD` is the
+   * classic username + password flow; `EMAIL_OTP` / `SMS_OTP` send a
+   * one-time code (email OTP is delivered through `customEmailSender` when
+   * one is configured); `WEB_AUTHN` is passkey sign-in.
+   * Passwordless factors require the `ESSENTIALS` or `PLUS` tier.
+   */
+  allowedFirstAuthFactors?: UserPoolAuthFactor[];
+}
+
+/**
+ * The `CustomEmailSender` Lambda trigger: Cognito invokes this function
+ * instead of sending email itself, passing the verification / OTP code
+ * encrypted with `kmsKeyId` (decrypt it with the AWS Encryption SDK).
+ * Requires {@link UserPoolProps.kmsKeyId}. The function must also grant
+ * `cognito-idp.amazonaws.com` invoke access (`AWS.Lambda.Permission`).
+ */
+export interface UserPoolCustomEmailSender {
+  /** ARN of the Lambda function that delivers the pool's email messages. */
+  lambdaArn: string;
+  /**
+   * The custom sender event version the function understands.
+   * @default "V1_0"
+   */
+  lambdaVersion?: "V1_0";
+}
+
+/**
+ * How the user pool delivers its email messages (verification codes, OTPs,
+ * invitations): either Cognito's built-in, rate-limited delivery
+ * (`COGNITO_DEFAULT`) or your own verified Amazon SES identity
+ * (`DEVELOPER`). With `DEVELOPER`, the SES identity's policy must grant
+ * `cognito-idp.amazonaws.com` permission to send
+ * (`SES.EmailIdentityPolicy`).
+ */
+export interface UserPoolEmailConfiguration {
+  /**
+   * Which sending account delivers the pool's email. `COGNITO_DEFAULT`
+   * uses Cognito's built-in delivery (limited daily volume);
+   * `DEVELOPER` sends through your own SES identity (`sourceArn`
+   * required) at your SES quota.
+   * @default "COGNITO_DEFAULT"
+   */
+  emailSendingAccount?: "COGNITO_DEFAULT" | "DEVELOPER";
+  /**
+   * ARN of a verified SES email identity (address or domain) in a
+   * supported region. Required when `emailSendingAccount` is `DEVELOPER`;
+   * with `COGNITO_DEFAULT` it customizes the FROM address while Cognito
+   * still handles delivery.
+   */
+  sourceArn?: string;
+  /**
+   * The FROM address, either bare (`no-reply@example.com`) or with a
+   * friendly display name (`"My App <no-reply@example.com>"`). Must be
+   * covered by the `sourceArn` identity.
+   */
+  from?: string;
+  /**
+   * The destination for replies to the pool's messages.
+   */
+  replyToEmailAddress?: string;
+  /**
+   * Name of an SES configuration set applied to email sent by the pool
+   * (event publishing, IP pool selection). `DEVELOPER` only.
+   */
+  configurationSet?: string;
+}
+
 /**
  * An account recovery mechanism with its priority (1 is highest).
  */
@@ -210,6 +305,13 @@ export interface UserPoolProps {
    * removing or changing a declared attribute triggers a replacement.
    */
   schema?: UserPoolSchemaAttribute[];
+  /**
+   * Choice-based authentication: the first-factor sign-in methods users may
+   * start with (`PASSWORD`, `EMAIL_OTP`, `SMS_OTP`, `WEB_AUTHN`). Requires
+   * the `ESSENTIALS` or `PLUS` tier when any passwordless factor is listed.
+   * When omitted the observed policy is left untouched.
+   */
+  signInPolicy?: UserPoolSignInPolicy;
   /**
    * Multi-factor authentication mode. `ON` requires SMS or TOTP setup for
    * every user; avoid SMS-based MFA unless the account has SNS spend
@@ -252,6 +354,31 @@ export interface UserPoolProps {
    * Permission and registers the runtime handler.
    */
   lambdaConfig?: UserPoolLambdaConfig;
+  /**
+   * Route the pool's email messages (sign-up / OTP / recovery codes,
+   * temporary passwords) through your own Lambda function instead of
+   * Cognito's built-in delivery. Requires `kmsKeyId`. Omitting this on an
+   * existing pool clears the custom sender (Cognito falls back to its own
+   * email delivery); ordinary triggers and the other pool settings are
+   * never affected by adding or removing it.
+   */
+  customEmailSender?: UserPoolCustomEmailSender;
+  /**
+   * How the pool delivers its email messages: Cognito's built-in delivery
+   * (`COGNITO_DEFAULT`, the service default) or a verified SES identity
+   * (`DEVELOPER`) — no custom sender Lambda required. When omitted, an
+   * observed email configuration is preserved rather than reset to the
+   * service default.
+   */
+  emailConfiguration?: UserPoolEmailConfiguration;
+  /**
+   * ARN of the symmetric KMS key Cognito uses to encrypt the codes it
+   * passes to the custom sender function(s) (`LambdaConfig.KMSKeyID`).
+   * The principal running the deploy must hold `kms:CreateGrant` on the
+   * key — Cognito creates a grant against it when the pool is configured —
+   * and the sender function's role needs `kms:Decrypt`.
+   */
+  kmsKeyId?: string;
   /**
    * Tags to apply to the user pool. Merged with internal Alchemy tags.
    */
@@ -316,6 +443,59 @@ export interface UserPool extends Resource<
  * });
  * ```
  *
+ * ### Sending Email Through SES
+ * **Example:** OTP and Verification Email from a Verified SES Identity
+ * ```typescript
+ * const identity = yield* SES.EmailIdentity("Sender", {
+ *   emailIdentity: "mail.example.com",
+ * });
+ * // allow Cognito to send through the identity
+ * yield* SES.EmailIdentityPolicy("CognitoSend", {
+ *   emailIdentity: identity.emailIdentity,
+ *   policyName: "cognito",
+ *   policy: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Principal: { Service: "cognito-idp.amazonaws.com" },
+ *       Action: ["ses:SendEmail", "ses:SendRawEmail"],
+ *       Resource: identity.identityArn,
+ *     }],
+ *   },
+ * });
+ * const pool = yield* Cognito.UserPool("Users", {
+ *   usernameAttributes: ["email"],
+ *   autoVerifiedAttributes: ["email"],
+ *   emailConfiguration: {
+ *     emailSendingAccount: "DEVELOPER",
+ *     sourceArn: identity.identityArn,
+ *     from: "My App <no-reply@mail.example.com>",
+ *     replyToEmailAddress: "support@example.com",
+ *   },
+ * });
+ * ```
+ *
+ * ### Email OTP with a Custom Email Sender
+ * **Example:** Passwordless Email OTP Delivered by Your Own Lambda
+ * ```typescript
+ * const key = yield* KMS.Key("CodeKey", {});
+ * const sender = yield* Lambda.Function("EmailSender", {
+ *   main: import.meta.url,
+ * });
+ * yield* Lambda.Permission("CognitoInvoke", {
+ *   functionName: sender.functionName,
+ *   action: "lambda:InvokeFunction",
+ *   principal: "cognito-idp.amazonaws.com",
+ * });
+ * const pool = yield* Cognito.UserPool("Auth", {
+ *   tier: "ESSENTIALS",
+ *   usernameAttributes: ["email"],
+ *   signInPolicy: { allowedFirstAuthFactors: ["PASSWORD", "EMAIL_OTP"] },
+ *   customEmailSender: { lambdaArn: sender.functionArn },
+ *   kmsKeyId: key.keyArn,
+ * });
+ * ```
+ *
  * ### App Clients and Auth
  * **Example:** Pool with an App Client
  * ```typescript
@@ -381,6 +561,85 @@ const toWireAccountRecovery = (
         })),
       };
 
+const toWireSignInPolicy = (policy: UserPoolSignInPolicy | undefined) =>
+  policy === undefined
+    ? undefined
+    : { AllowedFirstAuthFactors: policy.allowedFirstAuthFactors };
+
+const toWireEmailConfiguration = (
+  config: UserPoolEmailConfiguration | undefined,
+): cip.EmailConfigurationType | undefined =>
+  config === undefined
+    ? undefined
+    : {
+        EmailSendingAccount: config.emailSendingAccount ?? "COGNITO_DEFAULT",
+        SourceArn: config.sourceArn,
+        From: config.from,
+        ReplyToEmailAddress: config.replyToEmailAddress,
+        ConfigurationSet: config.configurationSet,
+      };
+
+/** Observed/desired email configuration with the service default filled in,
+ * for order- and absence-insensitive comparison (`JSON.stringify` drops the
+ * `undefined` members on both sides). */
+const normalizedEmailConfiguration = (
+  config: cip.EmailConfigurationType | undefined,
+) => ({
+  emailSendingAccount: config?.EmailSendingAccount ?? "COGNITO_DEFAULT",
+  sourceArn: config?.SourceArn,
+  from: config?.From,
+  replyToEmailAddress: config?.ReplyToEmailAddress,
+  configurationSet: config?.ConfigurationSet,
+});
+
+const toWireCustomEmailSender = (
+  sender: UserPoolCustomEmailSender | undefined,
+): cip.CustomEmailLambdaVersionConfigType | undefined =>
+  sender === undefined
+    ? undefined
+    : {
+        LambdaArn: sender.lambdaArn,
+        LambdaVersion: sender.lambdaVersion ?? "V1_0",
+      };
+
+const PASSWORDLESS_AUTH_FACTORS: readonly UserPoolAuthFactor[] = [
+  "EMAIL_OTP",
+  "SMS_OTP",
+  "WEB_AUTHN",
+];
+
+/**
+ * Reject configurations Cognito would refuse (or silently mangle) before
+ * any API call is made.
+ */
+const validateProps = (props: UserPoolProps) =>
+  props.customEmailSender !== undefined && props.kmsKeyId === undefined
+    ? Effect.fail(
+        new InvalidUserPoolConfiguration({
+          reason:
+            "customEmailSender requires kmsKeyId — Cognito encrypts the codes it passes to the custom sender with that KMS key",
+        }),
+      )
+    : props.emailConfiguration?.emailSendingAccount === "DEVELOPER" &&
+        props.emailConfiguration.sourceArn === undefined
+      ? Effect.fail(
+          new InvalidUserPoolConfiguration({
+            reason:
+              "emailConfiguration with emailSendingAccount DEVELOPER requires sourceArn — the ARN of the verified SES identity Cognito sends from",
+          }),
+        )
+      : props.tier === "LITE" &&
+          (props.signInPolicy?.allowedFirstAuthFactors ?? []).some((factor) =>
+            PASSWORDLESS_AUTH_FACTORS.includes(factor),
+          )
+        ? Effect.fail(
+            new InvalidUserPoolConfiguration({
+              reason:
+                "passwordless first-auth factors (EMAIL_OTP / SMS_OTP / WEB_AUTHN) require the ESSENTIALS or PLUS tier, not LITE",
+            }),
+          )
+        : Effect.void;
+
 const tagRecordOf = (
   tags: { [key: string]: string | undefined } | undefined,
 ): Record<string, string> =>
@@ -456,14 +715,12 @@ export const UserPoolProvider = () =>
       });
 
       /**
-       * The pool's desired `LambdaConfig`: `props.lambdaConfig` merged with
+       * The pool's desired trigger slots: `props.lambdaConfig` merged with
        * the trigger entries contributed through the binding contract
        * (`Cognito.onUserPoolTrigger` and friends). Fails when two different
-       * function ARNs target the same trigger slot. Returns `undefined`
-       * when no triggers are desired (omitting `LambdaConfig` clears it on
-       * both create and update).
+       * function ARNs target the same trigger slot.
        */
-      const resolveLambdaConfig = Effect.fn(function* (
+      const resolveTriggers = Effect.fn(function* (
         news: UserPoolProps,
         bindings: ReadonlyArray<UserPoolBinding | { data?: UserPoolBinding }>,
       ) {
@@ -493,32 +750,115 @@ export const UserPoolProvider = () =>
             merged[trigger] = arn;
           }
         }
-        return Object.keys(merged).length > 0
-          ? (merged as UserPoolLambdaConfig)
-          : undefined;
+        return merged as UserPoolLambdaConfig;
       });
 
+      /**
+       * The full desired `LambdaConfig` wire shape: the string trigger slots
+       * plus the versioned `CustomEmailSender` + `KMSKeyID` from props. The
+       * provider owns `LambdaConfig` outright, so a trigger or custom sender
+       * removed from the program is cleared on the pool. The one exception
+       * is `CustomSMSSender`, which the props cannot express yet: an
+       * observed one (and the KMS key it needs) is carried over rather than
+       * wiped by an unrelated update. Returns `undefined` when nothing is
+       * desired (omitting `LambdaConfig` clears it on both create and
+       * update).
+       */
+      const desiredLambdaConfig = (
+        news: UserPoolProps,
+        triggers: UserPoolLambdaConfig,
+        observed: cip.LambdaConfigType | undefined,
+      ): cip.LambdaConfigType | undefined => {
+        const customSMSSender = observed?.CustomSMSSender;
+        const config: cip.LambdaConfigType = {
+          ...triggers,
+          CustomEmailSender: toWireCustomEmailSender(news.customEmailSender),
+          CustomSMSSender: customSMSSender,
+          KMSKeyID:
+            news.kmsKeyId ??
+            (customSMSSender !== undefined ? observed?.KMSKeyID : undefined),
+        };
+        const present = Object.fromEntries(
+          Object.entries(config).filter(([, value]) => value !== undefined),
+        ) as cip.LambdaConfigType;
+        return Object.keys(present).length > 0 ? present : undefined;
+      };
+
+      /** True when the managed parts of the observed `LambdaConfig` differ
+       * from the desired one. */
+      const lambdaConfigDrifted = (
+        desired: cip.LambdaConfigType | undefined,
+        observed: cip.LambdaConfigType | undefined,
+      ) => {
+        for (const trigger of USER_POOL_TRIGGER_NAMES) {
+          if (desired?.[trigger] !== observed?.[trigger]) return true;
+        }
+        if (
+          desired?.CustomEmailSender?.LambdaArn !==
+            observed?.CustomEmailSender?.LambdaArn ||
+          desired?.CustomEmailSender?.LambdaVersion !==
+            observed?.CustomEmailSender?.LambdaVersion
+        ) {
+          return true;
+        }
+        return desired?.KMSKeyID !== observed?.KMSKeyID;
+      };
+
       /** The update body sent to `updateUserPool` — always the full desired
-       * state, because Cognito resets any omitted field to its default. */
+       * state, because Cognito resets any omitted field to its default.
+       * Props the user left undefined are "don't care" (see `hasDrift`), so
+       * their OBSERVED value is echoed back rather than dropped — an update
+       * to one setting must not reset another to its default. */
       const desiredUpdate = (
         news: UserPoolProps,
-        lambdaConfig: UserPoolLambdaConfig | undefined,
-      ) => ({
-        LambdaConfig: lambdaConfig,
-        Policies:
+        observed: cip.UserPoolType,
+        lambdaConfig: cip.LambdaConfigType | undefined,
+      ): Omit<cip.UpdateUserPoolRequest, "UserPoolId"> => {
+        const PasswordPolicy =
           news.passwordPolicy === undefined
-            ? undefined
-            : { PasswordPolicy: toWirePasswordPolicy(news.passwordPolicy) },
-        DeletionProtection: news.deletionProtection ? "ACTIVE" : "INACTIVE",
-        AutoVerifiedAttributes: news.autoVerifiedAttributes,
-        MfaConfiguration: news.mfaConfiguration ?? "OFF",
-        AdminCreateUserConfig:
-          news.adminCreateUserOnly === undefined
-            ? undefined
-            : { AllowAdminCreateUserOnly: news.adminCreateUserOnly },
-        AccountRecoverySetting: toWireAccountRecovery(news.accountRecovery),
-        UserPoolTier: news.tier,
-      });
+            ? observed.Policies?.PasswordPolicy
+            : toWirePasswordPolicy(news.passwordPolicy);
+        const SignInPolicy =
+          news.signInPolicy === undefined
+            ? observed.Policies?.SignInPolicy
+            : toWireSignInPolicy(news.signInPolicy);
+        return {
+          LambdaConfig: lambdaConfig,
+          // updateUserPool resets an omitted EmailConfiguration to the
+          // service default — echo the OBSERVED configuration back when the
+          // prop is undefined so unrelated updates never clear it.
+          EmailConfiguration:
+            news.emailConfiguration === undefined
+              ? observed.EmailConfiguration
+              : toWireEmailConfiguration(news.emailConfiguration),
+          Policies:
+            PasswordPolicy === undefined && SignInPolicy === undefined
+              ? undefined
+              : { PasswordPolicy, SignInPolicy },
+          DeletionProtection: news.deletionProtection ? "ACTIVE" : "INACTIVE",
+          AutoVerifiedAttributes:
+            news.autoVerifiedAttributes ?? observed.AutoVerifiedAttributes,
+          MfaConfiguration: news.mfaConfiguration ?? "OFF",
+          AdminCreateUserConfig:
+            news.adminCreateUserOnly === undefined
+              ? observed.AdminCreateUserConfig === undefined
+                ? undefined
+                : {
+                    // never echo the deprecated UnusedAccountValidityDays —
+                    // Cognito rejects it next to TemporaryPasswordValidityDays
+                    AllowAdminCreateUserOnly:
+                      observed.AdminCreateUserConfig.AllowAdminCreateUserOnly,
+                    InviteMessageTemplate:
+                      observed.AdminCreateUserConfig.InviteMessageTemplate,
+                  }
+              : { AllowAdminCreateUserOnly: news.adminCreateUserOnly },
+          AccountRecoverySetting:
+            news.accountRecovery === undefined
+              ? observed.AccountRecoverySetting
+              : toWireAccountRecovery(news.accountRecovery),
+          UserPoolTier: news.tier ?? observed.UserPoolTier,
+        };
+      };
 
       /** Canonicalize a recovery-mechanism list for order-insensitive
        * comparison. */
@@ -563,17 +903,27 @@ export const UserPoolProvider = () =>
       /** True when the observed pool differs from the desired mutable state.
        * Props the user left undefined are "don't care" and never drift —
        * except `LambdaConfig`, which the provider owns outright (bindings
-       * contribute to it), so a trigger removed from the program is drift
-       * that clears the observed entry. */
+       * contribute to it), so a trigger or custom sender removed from the
+       * program is drift that clears the observed entry. */
       const hasDrift = (
         news: UserPoolProps,
         observed: cip.UserPoolType,
-        lambdaConfig: UserPoolLambdaConfig | undefined,
+        lambdaConfig: cip.LambdaConfigType | undefined,
       ) => {
-        for (const trigger of USER_POOL_TRIGGER_NAMES) {
-          if (lambdaConfig?.[trigger] !== observed.LambdaConfig?.[trigger]) {
-            return true;
-          }
+        if (lambdaConfigDrifted(lambdaConfig, observed.LambdaConfig)) {
+          return true;
+        }
+        if (
+          news.signInPolicy?.allowedFirstAuthFactors !== undefined &&
+          [...news.signInPolicy.allowedFirstAuthFactors].sort().join(",") !==
+            [
+              ...(observed.Policies?.SignInPolicy?.AllowedFirstAuthFactors ??
+                []),
+            ]
+              .sort()
+              .join(",")
+        ) {
+          return true;
         }
         if (news.passwordPolicy !== undefined) {
           const desired = normalizedPasswordPolicy({
@@ -616,6 +966,19 @@ export const UserPoolProvider = () =>
         ) {
           return true;
         }
+        if (
+          news.emailConfiguration !== undefined &&
+          JSON.stringify(
+            normalizedEmailConfiguration(
+              toWireEmailConfiguration(news.emailConfiguration),
+            ),
+          ) !==
+            JSON.stringify(
+              normalizedEmailConfiguration(observed.EmailConfiguration),
+            )
+        ) {
+          return true;
+        }
         if (
           news.adminCreateUserOnly !== undefined &&
           news.adminCreateUserOnly !==
@@ -714,10 +1077,11 @@ export const UserPoolProvider = () =>
           session,
           bindings,
         }) {
+          yield* validateProps(news);
           const name = output?.userPoolName ?? (yield* createName(id, news));
           const internalTags = yield* createInternalTags(id);
           const desiredTags = { ...news.tags, ...internalTags };
-          const lambdaConfig = yield* resolveLambdaConfig(news, bindings);
+          const triggers = yield* resolveTriggers(news, bindings);
 
           // 1. OBSERVE — output.userPoolId is only a cache; fall back to a
           //    name search so out-of-band deletes and adoption converge.
@@ -745,18 +1109,23 @@ export const UserPoolProvider = () =>
             observed = yield* cip
               .createUserPool({
                 PoolName: name,
-                LambdaConfig: lambdaConfig,
+                LambdaConfig: desiredLambdaConfig(news, triggers, undefined),
                 Policies:
-                  news.passwordPolicy === undefined
+                  news.passwordPolicy === undefined &&
+                  news.signInPolicy === undefined
                     ? undefined
                     : {
                         PasswordPolicy: toWirePasswordPolicy(
                           news.passwordPolicy,
                         ),
+                        SignInPolicy: toWireSignInPolicy(news.signInPolicy),
                       },
                 DeletionProtection: news.deletionProtection
                   ? "ACTIVE"
                   : "INACTIVE",
+                EmailConfiguration: toWireEmailConfiguration(
+                  news.emailConfiguration,
+                ),
                 UsernameAttributes: news.usernameAttributes,
                 AliasAttributes: news.aliasAttributes,
                 AutoVerifiedAttributes: news.autoVerifiedAttributes,
@@ -781,10 +1150,15 @@ export const UserPoolProvider = () =>
             // 3. SYNC — updateUserPool resets omitted fields to defaults, so
             //    the body is always the full desired mutable state; skip the
             //    call entirely when nothing drifted.
+            const lambdaConfig = desiredLambdaConfig(
+              news,
+              triggers,
+              observed.LambdaConfig,
+            );
             if (hasDrift(news, observed, lambdaConfig)) {
               yield* cip.updateUserPool({
                 UserPoolId: observed.Id!,
-                ...desiredUpdate(news, lambdaConfig),
+                ...desiredUpdate(news, observed, lambdaConfig),
               });
             }
 

package/src/AWS/Cognito/index.ts

@@ -6,6 +6,7 @@ export * from "./IdentityPoolAuth.ts";
 export * from "./IdentityPoolAuthHttp.ts";
 export * from "./IdentityPoolRoleAttachment.ts";
 export * from "./IdentityProvider.ts";
+export * from "./ManagedLoginBranding.ts";
 export * from "./ResourceServer.ts";
 export * from "./User.ts";
 export * from "./UserPool.ts";

package/src/AWS/EC2/Instance.ts

@@ -27,6 +27,7 @@ import type { PolicyStatement } from "../IAM/Policy.ts";
 import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
 import {
+  type Ec2HostedProps,
   createEc2HostRuntimeContext,
   createEc2HostedSupport,
   type Ec2HostRuntimeContext,
@@ -654,6 +655,41 @@ export const InstanceProvider = () =>
             );
           }),
         diff: Effect.fn(function* ({ id, news, olds, output }) {
+          // The hosted bundle hash must participate in planning even while
+          // OTHER props are unresolved Outputs (an `imageId` AMI lookup, a
+          // subnet reference): a content-only edit changes no prop at all,
+          // so bailing on full resolution silently no-ops the update. The
+          // content inputs are plain — gate on THEM, not on the whole bag
+          // (the same isResolved-defeats-content-diff bug the MicroVM image
+          // diff had).
+          const raw = news as unknown as Record<string, unknown>;
+          const contentInputs = {
+            main: raw.main,
+            handler: raw.handler,
+            build: raw.build,
+            port: raw.port,
+            // `isExternal` chooses the bundler entry (raw file vs virtual
+            // `export default` wrapper). Omitting it here re-bundles an
+            // external program as an Effect entrypoint and fails the plan
+            // with MISSING_EXPORT when the source has no default export.
+            isExternal: raw.isExternal,
+          };
+          if (
+            isResolved(contentInputs) &&
+            contentInputs.main !== undefined &&
+            output?.code?.hash
+          ) {
+            const { hash } = yield* hosted.bundleProgram(
+              id,
+              contentInputs as unknown as Ec2HostedProps,
+            );
+            if (hash !== output.code.hash) {
+              return {
+                action: "update",
+                stables: ["instanceId", "instanceArn", "vpcId", "subnetId"],
+              } as const;
+            }
+          }
           if (!isResolved(news)) return;
           const hostModeChanged = Boolean(olds.main) !== Boolean(news.main);
           if (
@@ -694,20 +730,8 @@ export const InstanceProvider = () =>
             } as const;
           }
 
-          // The hosted bundle hash participates in planning: a change confined
-          // to the runtime program (or its imports) leaves every prop equal, so
-          // re-bundle and compare against the deployed hash. A mismatch plans
-          // an in-place update, whose reconcile re-uploads the bundle and
-          // reboots the instance.
-          if (news.main && output?.code?.hash) {
-            const { hash } = yield* hosted.bundleProgram(id, news);
-            if (hash !== output.code.hash) {
-              return {
-                action: "update",
-                stables: ["instanceId", "instanceArn", "vpcId", "subnetId"],
-              } as const;
-            }
-          }
+          // Content-only changes were already handled by the resolved-subset
+          // bundle-hash check above.
         }),
         read: Effect.fn(function* ({ id, instanceId, output }) {
           const instance = output?.instanceId