alchemy 2.0.0-beta.74 → 2.0.0-beta.76

package/src/AWS/EC2/NetworkAcl.ts

@@ -229,20 +229,25 @@ export const NetworkAclProvider = () =>
 
         list: () =>
           Effect.gen(function* () {
-            const acls = yield* ec2.describeNetworkAcls.pages({}).pipe(
-              Stream.runCollect,
-              Effect.map((chunk) =>
-                Array.from(chunk).flatMap((page) =>
-                  (page.NetworkAcls ?? []).filter(
-                    (acl): acl is ec2.NetworkAcl & { NetworkAclId: string } =>
-                      acl.NetworkAclId != null &&
-                      // Each VPC's default NACL is AWS-managed and cannot be
-                      // deleted (InvalidParameterValue) — don't enumerate it.
-                      acl.IsDefault !== true,
+            // Filter default NACLs at the API: every VPC has one, they
+            // cannot be deleted, and paging through them under a concurrent
+            // suite stalls the list test past the per-test timeout — which
+            // then skips destroy and leaks the custom ACL + VPC.
+            const acls = yield* ec2.describeNetworkAcls
+              .pages({
+                Filters: [{ Name: "default", Values: ["false"] }],
+              })
+              .pipe(
+                Stream.runCollect,
+                Effect.map((chunk) =>
+                  Array.from(chunk).flatMap((page) =>
+                    (page.NetworkAcls ?? []).filter(
+                      (acl): acl is ec2.NetworkAcl & { NetworkAclId: string } =>
+                        acl.NetworkAclId != null && acl.IsDefault !== true,
+                    ),
                   ),
                 ),
-              ),
-            );
+              );
             return yield* Effect.forEach(acls, (acl) => toAttrs(acl));
           }),
 

package/src/AWS/EC2/hosted.ts

@@ -194,7 +194,7 @@ export const createEc2HostedSupport = ({
             ...((props.build?.input?.external as string[] | undefined) ?? []),
           ],
           resolve: {
-            conditionNames: ["bun", "import", "module", "default"],
+            conditionNames: [...Bundle.BUN_CONDITION_NAMES],
             ...props.build?.input?.resolve,
           },
           plugins: [props.build?.input?.plugins, plugins],
@@ -216,79 +216,10 @@ export const createEc2HostedSupport = ({
           realMain,
           virtualEntryPlugin(
             (importPath) => `
-import { BunServices } from "@effect/platform-bun";
-import { BunHttpServer } from "alchemy/Http";
-import { Stack } from "alchemy/Stack";
-import { reifyBoundConfigProvider } from "alchemy/Runtime";
-import { provideProcessTelemetry } from "alchemy/Telemetry";
-import * as Config from "effect/Config";
-import * as ConfigProvider from "effect/ConfigProvider";
-import * as Credentials from "@distilled.cloud/aws/Credentials";
-import * as Effect from "effect/Effect";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
-import * as Region from "@distilled.cloud/aws/Region";
-
-import { ${handler} as handler } from ${JSON.stringify(importPath)};
-
-const platform = Layer.mergeAll(
-  BunServices.layer,
-  FetchHttpClient.layer,
-  Logger.layer([Logger.consolePretty()]),
-);
-
-// Resolve the bundled program (the runners registered via host.run / serve)
-// and run it with a Bun HTTP server bound to PORT, so a returned { fetch }
-// handler is actually served and host.run loops stay alive.
-const program = handler.pipe(
-  // Process-lifetime telemetry: built once into the root scope; exporters
-  // batch on their intervals and flush when the scope closes on graceful
-  // shutdown.
-  Effect.flatMap((instance) =>
-    instance.RuntimeContext.exports.pipe(
-      Effect.flatMap((exports) => exports.program),
-      provideProcessTelemetry(instance.RuntimeContext),
-    ),
-  ),
-  Effect.provide(
-    Layer.effect(
-      Stack,
-      Effect.all([
-        Config.string("ALCHEMY_STACK_NAME"),
-        Config.string("ALCHEMY_STAGE")
-      ]).pipe(
-        Effect.map(([name, stage]) => ({
-          name,
-          stage,
-          bindings: {},
-          resources: {}
-        }))
-      )
-    ).pipe(
-      // The instance authenticates via its instance profile (IMDS), which
-      // only the full provider chain resolves — env-only credentials never
-      // exist on a hosted EC2 box.
-      Layer.provideMerge(Credentials.fromChain()),
-      Layer.provideMerge(Region.fromEnv()),
-      Layer.provideMerge(BunHttpServer()),
-      Layer.provideMerge(platform),
-      Layer.provideMerge(
-        Layer.succeed(
-          ConfigProvider.ConfigProvider,
-          reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env)
-        )
-      ),
-    )
-  ),
-  Effect.scoped
-);
-
-console.log("Instance bootstrap starting...");
-await Effect.runPromise(program).catch((err) => {
-  console.error("Instance bootstrap failed:", err);
-  process.exit(1);
-});
+import { bootstrap } from "alchemy/Runtime/Bootstrap/Ec2";
+import { ${handler} as entrypoint } from ${JSON.stringify(importPath)};
+
+await bootstrap(entrypoint);
 `,
           ),
         );
@@ -813,7 +744,7 @@ systemctl enable --now ${unitName}.service
             Bucket: yield* Assets.BucketName,
             Key: key,
           })
-          .pipe(Effect.catchTag("NotFound", () => Effect.void));
+          .pipe(Effect.catchTag("NoSuchKey", () => Effect.void));
       }
     }
 

package/src/AWS/ECR/Image.ts

@@ -1,11 +1,8 @@
 import * as ecr from "@distilled.cloud/aws/ecr";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
-import * as Path from "effect/Path";
 import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
-import * as crypto from "node:crypto";
 import { isResolved } from "../../Diff.ts";
 import { Docker } from "../../Docker/Docker.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
@@ -13,6 +10,10 @@ import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { createInternalTags } from "../../Tags.ts";
 import type { Providers } from "../Providers.ts";
+import {
+  hashDockerBuildInputs,
+  resolveDockerBuildPaths,
+} from "../../Docker/BuildHash.ts";
 
 /**
  * Docker login credentials for the account's private ECR registry, in the
@@ -72,6 +73,8 @@ export const buildAndPushEcrImage = Effect.fn(function* (
     platform?: string;
     /** Docker build arguments. */
     buildArgs?: Record<string, string>;
+    /** Additional arguments appended to `docker image build`. */
+    args?: string[];
   },
 ) {
   const credentials = yield* getEcrRegistryCredentials;
@@ -81,6 +84,7 @@ export const buildAndPushEcrImage = Effect.fn(function* (
     file: options.dockerfile,
     platform: options.platform,
     "build-arg": options.buildArgs,
+    args: options.args,
   });
   // Pushes are idempotent; transient registry-transport failures (Docker
   // Desktop's embedded proxy timing out under load, ECR 503s, credential
@@ -209,8 +213,6 @@ export const ImageProvider = () =>
     Image,
     Effect.gen(function* () {
       const docker = yield* Docker;
-      const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
 
       const toOwnedRepositoryName = (id: string) =>
         createPhysicalName({
@@ -219,62 +221,21 @@ export const ImageProvider = () =>
           lowercase: true,
         });
 
-      const resolveBuildPaths = Effect.fn(function* (props: ImageProps) {
-        const context = path.resolve(props.context);
-        const dockerfile = props.dockerfile
-          ? path.isAbsolute(props.dockerfile)
-            ? props.dockerfile
-            : path.resolve(context, props.dockerfile)
-          : path.resolve(context, "Dockerfile");
-        if (!(yield* fs.exists(context))) {
-          return yield* Effect.fail(
-            new Error(`Docker build context does not exist: ${context}`),
-          );
-        }
-        if (!(yield* fs.exists(dockerfile))) {
-          return yield* Effect.fail(
-            new Error(`Dockerfile does not exist: ${dockerfile}`),
-          );
-        }
-        return { context, dockerfile };
-      });
-
       // Content hash over everything that affects the built image: the
       // Dockerfile, every file in the build context (relative path + bytes),
       // the target platform, and the build args. Absolute paths deliberately
       // do NOT participate, so relocating an identical context (e.g. a temp
       // dir) produces the same tag.
-      const hashBuildInputs = Effect.fn(function* (props: ImageProps) {
-        const { context, dockerfile } = yield* resolveBuildPaths(props);
-        const hasher = yield* Effect.sync(() => crypto.createHash("sha256"));
-        yield* Effect.sync(() =>
-          hasher.update(
-            JSON.stringify({
-              platform: props.platform ?? "linux/amd64",
-              buildArgs: Object.entries(props.buildArgs ?? {}).sort(
-                ([a], [b]) => (a < b ? -1 : a > b ? 1 : 0),
-              ),
-            }),
-          ),
+      const hashBuildInputs = (props: ImageProps) =>
+        hashDockerBuildInputs(
+          {
+            context: props.context,
+            dockerfile: props.dockerfile ?? "Dockerfile",
+            platform: props.platform ?? "linux/amd64",
+            buildArgs: props.buildArgs,
+          },
+          "all",
         );
-        const dockerfileContent = yield* fs.readFile(dockerfile);
-        yield* Effect.sync(() => {
-          hasher.update("Dockerfile\0");
-          hasher.update(dockerfileContent);
-        });
-        const entries = yield* fs.readDirectory(context, { recursive: true });
-        for (const entry of [...entries].sort()) {
-          const full = path.join(context, entry);
-          const info = yield* fs.stat(full);
-          if (info.type !== "File") continue;
-          const content = yield* fs.readFile(full);
-          yield* Effect.sync(() => {
-            hasher.update(`${entry}\0`);
-            hasher.update(content);
-          });
-        }
-        return (yield* Effect.sync(() => hasher.digest("hex"))).slice(0, 32);
-      });
 
       // Observe the pushed image in ECR. Missing repository or tag → undefined.
       const describeImage = Effect.fn(function* (
@@ -377,7 +338,10 @@ export const ImageProvider = () =>
               return { repositoryName, repositoryUri, ownsRepository: true };
             });
 
-          const { context, dockerfile } = yield* resolveBuildPaths(news);
+          const { context, dockerfile } = yield* resolveDockerBuildPaths({
+            context: news.context,
+            dockerfile: news.dockerfile ?? "Dockerfile",
+          });
           const imageTag = yield* hashBuildInputs(news);
           const imageUri = `${repositoryUri}:${imageTag}`;
 
@@ -404,6 +368,11 @@ export const ImageProvider = () =>
             dockerfile,
             platform: news.platform ?? "linux/amd64",
             buildArgs: news.buildArgs,
+            // Engines using the containerd image store attach provenance
+            // attestations by default, turning the pushed tag into an OCI
+            // image index — which Lambda (a valid consumer of these images)
+            // rejects. Disable: single-manifest pushes work everywhere.
+            args: ["--provenance=false"],
           });
 
           const pushed = yield* describeImage(repositoryName, imageTag);

package/src/AWS/ECR/ImageSource.ts

@@ -13,7 +13,6 @@ import {
 } from "../../Bundle/TempRoot.ts";
 import { hashDirectory } from "../../Command/Memo.ts";
 import { Docker } from "../../Docker/Docker.ts";
-import { Self } from "../../Self.ts";
 import {
   isInlineDockerfile,
   type InlineDockerfile,
@@ -260,108 +259,22 @@ export interface ResolveImageOptions {
 }
 
 /**
- * The standard bun bootstrap used by `AWS.ECS.Task` / `AWS.ECS.Service`
- * generated entries: resolves the bundled program's registered runners
- * (`host.run` loops and served `fetch`/`run` handlers) and runs them with a
- * Bun HTTP server bound to `PORT`.
+ * The generated entry for `AWS.ECS.Task` / `AWS.ECS.Service` containers: a
+ * shim importing only `alchemy/Runtime/Bootstrap/Ecs` (resolvable from any
+ * consumer — `alchemy` is its direct dependency) plus the user's `main`.
+ * Everything the runtime needs lives in that real module, so the virtual
+ * entry never imports alchemy's own dependencies (`@distilled.cloud/*`,
+ * `@effect/platform-bun`), which an isolated install cannot resolve from
+ * the consumer's project.
  */
 export const makeBunBootstrap =
   (handler: string) =>
   (importPath: string): string =>
     `
-import { BunServices } from "@effect/platform-bun";
-import { BunHttpServer } from "alchemy/Http";
-import { Stack } from "alchemy/Stack";
-import { makeEntrypointLayer, reifyBoundConfigProvider } from "alchemy/Runtime";
-import { provideProcessTelemetry } from "alchemy/Telemetry";
-import * as Config from "effect/Config";
-import * as ConfigProvider from "effect/ConfigProvider";
-import * as Context from "effect/Context";
-import * as Credentials from "@distilled.cloud/aws/Credentials";
-import * as Effect from "effect/Effect";
-import * as Endpoint from "@distilled.cloud/aws/Endpoint";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
-import * as Region from "@distilled.cloud/aws/Region";
-
+import { bootstrap } from "alchemy/Runtime/Bootstrap/Ecs";
 import { ${handler} as entrypoint } from ${JSON.stringify(importPath)};
 
-// Normalize the entrypoint export: an inline-effect class default export is
-// an Effect resolving the platform instance, while the tagged form
-// (X.make(props, impl)) exports a Layer providing the Self tag. Both fold
-// into a Layer via makeEntrypointLayer (same pattern as the Lambda and
-// Cloudflare Container bridges).
-const tag = Context.Service("${Self.key}");
-const layer = makeEntrypointLayer(tag, entrypoint);
-
-const platform = Layer.mergeAll(
-  BunServices.layer,
-  FetchHttpClient.layer,
-  Logger.layer([Logger.consolePretty()]),
-);
-
-const stack = Layer.effect(
-  Stack,
-  Effect.all([
-    Config.string("ALCHEMY_STACK_NAME"),
-    Config.string("ALCHEMY_STAGE")
-  ]).pipe(
-    Effect.map(([name, stage]) => ({
-      name,
-      stage,
-      bindings: {},
-      resources: {}
-    }))
-  )
-);
-
-// Resolve the bundled program (the runners registered via host.run / serve)
-// and run it with a Bun HTTP server bound to PORT, so a returned { fetch }
-// handler is actually served and host.run loops stay alive. A pure one-shot
-// { run } program completes and the process exits 0.
-const program = tag.pipe(
-  // Process-lifetime telemetry: built once into the root scope; exporters
-  // batch on their intervals and flush when the scope closes on graceful
-  // shutdown.
-  Effect.flatMap((task) =>
-    task.RuntimeContext.exports.pipe(
-      Effect.flatMap((exports) => exports.program),
-      provideProcessTelemetry(task.RuntimeContext),
-    ),
-  ),
-  Effect.provide(
-    layer.pipe(
-      Layer.provideMerge(stack),
-      // Full provider chain, not fromEnv: Fargate tasks receive credentials
-      // from the container-credentials endpoint
-      // (AWS_CONTAINER_CREDENTIALS_RELATIVE_URI), not environment variables.
-      Layer.provideMerge(Credentials.fromChain()),
-      Layer.provideMerge(Region.fromEnv()),
-      // AWS_ENDPOINT_URL is the LocalStack-standard override injected by
-      // local emulators (floci) into task containers — without it, runtime
-      // bindings in \`alchemy dev\` would call REAL AWS with dummy
-      // credentials. Resolves undefined when unset, so live deploys are
-      // unaffected.
-      Layer.provideMerge(Endpoint.fromEnv()),
-      Layer.provideMerge(BunHttpServer()),
-      Layer.provideMerge(platform),
-      Layer.provideMerge(
-        Layer.succeed(
-          ConfigProvider.ConfigProvider,
-          reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env)
-        )
-      ),
-    )
-  ),
-  Effect.scoped
-);
-
-console.log("Task bootstrap starting...");
-await Effect.runPromise(program).catch((err) => {
-  console.error("Task bootstrap failed:", err);
-  process.exit(1);
-});
+await bootstrap(entrypoint);
 `;
 
 /**
@@ -484,7 +397,7 @@ export const makeImageSource = Effect.gen(function* () {
         ...((source.build?.input?.external as string[] | undefined) ?? []),
       ],
       resolve: {
-        conditionNames: ["bun", "import", "module", "default"],
+        conditionNames: [...Bundle.BUN_CONDITION_NAMES],
         ...source.build?.input?.resolve,
       },
       plugins: [source.build?.input?.plugins, plugins],

package/src/AWS/ECS/EcsDevWatch.ts

@@ -9,96 +9,8 @@
 
 import * as ecs from "@distilled.cloud/aws/ecs";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
-import * as Path from "effect/Path";
-import * as Stream from "effect/Stream";
-import * as Bundle from "../../Bundle/Bundle.ts";
-import { isInlineDockerfile } from "../../Docker/Dockerfile.ts";
-import {
-  imageSourceKind,
-  makeBunBootstrap,
-  makeImageSource,
-  type BundledImageSource,
-  type ImageSourceLike,
-} from "../ECR/ImageSource.ts";
 
-/**
- * A stream of "the image source changed" triggers for a props bag:
- *
- * - `main` — a `Bundle.watch` over the exact module graph the deploy
- *   bundles (rebuild successes are the trigger; rebuild errors are logged
- *   and swallowed);
- * - `context` — a debounced recursive `fs.watch` of the build context (and
- *   the Dockerfile's directory when it lives outside the context);
- * - `image` (registry ref) / inline-dockerfile-only — nothing local to
- *   watch: an empty stream.
- */
-export const imageSourceTrigger = Effect.fn(function* (options: {
-  /** Logical id, for log prefixes. */
-  id: string;
-  source: ImageSourceLike;
-  isExternal: boolean | undefined;
-}) {
-  const { id, source } = options;
-  const kind = imageSourceKind(source);
-
-  if (kind === "main") {
-    const imageSource = yield* makeImageSource;
-    const plan = yield* imageSource.watchMain({
-      source: source as BundledImageSource,
-      isExternal: options.isExternal,
-      bootstrap: makeBunBootstrap(source.handler ?? "default"),
-    });
-    return Bundle.watch(plan.inputOptions, plan.outputOptions, plan.extra).pipe(
-      Stream.tap((event) =>
-        event._tag === "Error"
-          ? Effect.logWarning(
-              `[alchemy dev] ${id}: rebuild failed: ${event.error.message}`,
-            )
-          : Effect.void,
-      ),
-      Stream.filter((event) => event._tag === "Success"),
-      Stream.debounce("200 millis"),
-      Stream.map(() => undefined),
-    ) as Stream.Stream<void>;
-  }
-
-  if (kind === "context") {
-    if (source.context === undefined) {
-      // Inline-dockerfile-only builds have no local files to watch — the
-      // content is a prop, and prop changes flow through the dev diff.
-      return Stream.empty as Stream.Stream<void>;
-    }
-    const fs = yield* FileSystem.FileSystem;
-    const path = yield* Path.Path;
-    const context = path.resolve(source.context);
-    const streams: Stream.Stream<unknown, any>[] = [
-      fs.watch(context, { recursive: true }),
-    ];
-    // A path Dockerfile living OUTSIDE the context dir is watched too.
-    if (
-      source.dockerfile !== undefined &&
-      !isInlineDockerfile(source.dockerfile)
-    ) {
-      const dockerfile = path.resolve(source.dockerfile);
-      if (!dockerfile.startsWith(`${context}/`)) {
-        streams.push(fs.watch(path.dirname(dockerfile)));
-      }
-    }
-    return Stream.mergeAll(streams, { concurrency: streams.length }).pipe(
-      Stream.debounce("300 millis"),
-      Stream.map(() => undefined),
-      Stream.catchCause((cause) =>
-        Stream.fromEffect(
-          Effect.logWarning(`[alchemy dev] ${id}: context watch failed`, cause),
-        ).pipe(Stream.drain),
-      ),
-    ) as Stream.Stream<void>;
-  }
-
-  // Registry `image` refs have nothing local to watch.
-  return Stream.empty as Stream.Stream<void>;
-});
+export { imageSourceTrigger } from "../Local/ImageSourceTrigger.ts";
 
 /** The family segment of a task definition revision ARN. */
 const familyOfArn = (arn: string | undefined) =>

package/src/AWS/ECS/FlociServiceProvider.ts

@@ -20,10 +20,16 @@
  *   content-addressed image pipeline pushes a new `<repositoryUri>:<hash>`
  *   tag, registers a new task definition revision, and `updateService`
  *   points the service at it. Floci swaps the service's task definition in
- *   place WITHOUT restarting running containers (probed), so the watcher
- *   then stops the old-revision tasks and the floci service scheduler
+ *   place WITHOUT restarting running containers (probed), so the
+ *   old-revision tasks are stopped and the floci service scheduler
  *   relaunches them on the new revision (~6s observed end-to-end for a
  *   container relaunch).
+ * - **Task roll** lives in the skeleton's `onReconciled` hook — NOT in the
+ *   watch loop — so it also fires for engine-driven reconciles. Prop-only
+ *   changes (an inline `dockerfile` edit, a new env var) never produce a
+ *   file event: before the hook, they registered a new revision and
+ *   `updateService`d onto it, but the running containers kept serving the
+ *   old one until the next source edit.
  */
 
 import * as Effect from "effect/Effect";
@@ -108,6 +114,39 @@ export const FlociServiceProvider = () =>
           }
           return undefined;
         }),
+      // Fires on every reconcile — watcher-triggered AND engine-driven
+      // (prop changes never produce a file event, so rolling only from the
+      // watch loop left the service's containers on the old revision).
+      onReconciled: ({ id, previous, attrs }) =>
+        Effect.gen(function* () {
+          if (
+            attrs.taskFamily === undefined ||
+            attrs.taskDefinitionArn === undefined ||
+            previous?.taskDefinitionArn === attrs.taskDefinitionArn
+          ) {
+            return;
+          }
+          const startedAt = Date.now();
+          // `updateService` (inside the reconcile) pointed the service at
+          // the new revision, but floci's in-place swap keeps the old
+          // containers running — stop them so the scheduler relaunches on
+          // the new revision.
+          const restarted = yield* restartFamilyTasks({
+            family: attrs.taskFamily,
+            nextTaskDefinitionArn: attrs.taskDefinitionArn,
+            serviceManaged: true,
+          });
+          yield* Effect.logInfo(
+            `[alchemy dev] ${attrs.serviceName}: task definition swapped (${restarted} service task(s) rolling) in ${Date.now() - startedAt}ms`,
+          );
+        }).pipe(
+          Effect.catchCause((cause) =>
+            Effect.logWarning(
+              `[alchemy dev] ${id}: service roll failed`,
+              cause,
+            ),
+          ),
+        ),
       startWatch: (ctx) =>
         Effect.gen(function* () {
           if (taskRefOf(ctx.news) !== undefined) {
@@ -121,31 +160,11 @@ export const FlociServiceProvider = () =>
             isExternal: ctx.news.isExternal,
           });
           yield* trigger.pipe(
+            // The reconcile registers the new revision and `updateService`s
+            // onto it; the `onReconciled` hook (shared with engine-driven
+            // updates) rolls the running tasks.
             Stream.runForEach(() =>
-              Effect.gen(function* () {
-                const startedAt = Date.now();
-                const previous = yield* ctx.currentAttrs;
-                const attrs = yield* ctx.rerunReconcile;
-                if (
-                  attrs.code?.hash === undefined ||
-                  attrs.code.hash === previous.code?.hash ||
-                  attrs.taskFamily === undefined
-                ) {
-                  return;
-                }
-                // `updateService` (inside the reconcile) pointed the service
-                // at the new revision, but floci's in-place swap keeps the
-                // old containers running — stop them so the scheduler
-                // relaunches on the new revision.
-                const restarted = yield* restartFamilyTasks({
-                  family: attrs.taskFamily,
-                  nextTaskDefinitionArn: attrs.taskDefinitionArn,
-                  serviceManaged: true,
-                });
-                yield* Effect.logInfo(
-                  `[alchemy dev] ${attrs.serviceName}: image swapped (${restarted} service task(s) rolling) in ${Date.now() - startedAt}ms`,
-                );
-              }).pipe(
+              ctx.rerunReconcile.pipe(
                 Effect.catchCause((cause) =>
                   Effect.logWarning(
                     `[alchemy dev] ${ctx.id}: image swap failed`,