alchemy 2.0.0-beta.74 → 2.0.0-beta.76

package/src/AWS/Lambda/MicrovmBundle.ts

@@ -4,7 +4,6 @@ import * as Path from "effect/Path";
 import type * as rolldown from "rolldown";
 import * as Bundle from "../../Bundle/Bundle.ts";
 import { findCwdForBundle } from "../../Bundle/TempRoot.ts";
-import { Self } from "../../Self.ts";
 import { Stack } from "../../Stack.ts";
 
 /**
@@ -105,8 +104,8 @@ export const bundleMicrovmProgram = Effect.fn(function* ({
         resolve: {
           conditionNames:
             runtime === "bun"
-              ? ["bun", "import", "module", "default"]
-              : ["node", "import", "module", "default"],
+              ? [...Bundle.BUN_CONDITION_NAMES]
+              : [...Bundle.NODE_CONDITION_NAMES],
           ...build?.input?.resolve,
         },
         plugins: [build?.input?.plugins, plugins],
@@ -132,71 +131,18 @@ export const bundleMicrovmProgram = Effect.fn(function* ({
         realMain,
         virtualEntryPlugin(
           (importPath) => `
-${
-  runtime === "bun"
-    ? `import { BunServices } from "@effect/platform-bun";
-import { BunHttpServer } from "alchemy/Http";
-const HttpServer = BunHttpServer;`
-    : `import { NodeServices } from "@effect/platform-node";
-import { NodeHttpServer } from "alchemy/Http";
-const HttpServer = NodeHttpServer;`
-}
-import { Stack } from "alchemy/Stack";
-import { makeEntrypointLayer } from "alchemy/Runtime";
-import { provideProcessTelemetry } from "alchemy/Telemetry";
-import * as Effect from "effect/Effect";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
-import * as Context from "effect/Context";
-import { MinimumLogLevel } from "effect/References";
-
+import { bootstrap } from ${JSON.stringify(
+            runtime === "bun"
+              ? "alchemy/Runtime/Bootstrap/MicrovmBun"
+              : "alchemy/Runtime/Bootstrap/MicrovmNode",
+          )};
 import ${handler === "default" ? "entrypoint" : `{ ${handler} as entrypoint }`} from ${JSON.stringify(importPath)};
 
-const tag = Context.Service("${Self.key}")
-const layer = makeEntrypointLayer(tag, entrypoint);
-
-const platform = Layer.mergeAll(
-  ${runtime === "bun" ? "BunServices.layer" : "NodeServices.layer"},
-  FetchHttpClient.layer,
-  Logger.layer([Logger.consolePretty()]),
-);
-
-const stack = Layer.succeed(Stack, {
-  name: ${JSON.stringify(stack.name)},
-  stage: ${JSON.stringify(stack.stage)},
-  bindings: {},
-  resources: {}
-});
-
-const serverEffect = tag.pipe(
-  // Process-lifetime telemetry: built once into the root scope; exporters
-  // batch on their intervals and flush when the scope closes on graceful
-  // shutdown.
-  Effect.flatMap((func) =>
-    func.RuntimeContext.exports.pipe(
-      Effect.flatMap((exports) => exports.default),
-      provideProcessTelemetry(func.RuntimeContext),
-    ),
-  ),
-  Effect.provide(
-    layer.pipe(
-      Layer.provideMerge(stack),
-      Layer.provideMerge(HttpServer({ port: Number(process.env.PORT ?? ${port}) })),
-      Layer.provideMerge(platform),
-      Layer.provideMerge(
-        Layer.succeed(MinimumLogLevel, process.env.DEBUG ? "Debug" : "Info")
-      ),
-    )
-  ),
-  Effect.scoped
-);
-
-console.log("MicroVM bootstrap starting on port ${port}...");
-await Effect.runPromise(serverEffect).catch((err) => {
-  console.error("MicroVM bootstrap failed:", err);
-  process.exit(1);
-})`,
+await bootstrap(entrypoint, ${JSON.stringify({
+            port,
+            stack: { name: stack.name, stage: stack.stage },
+          })});
+`,
         ),
       );
 

package/src/AWS/Lambda/MicrovmImage.ts

@@ -204,8 +204,12 @@ export interface MicrovmImage extends Resource<
     createdAt?: string;
     /** When the image was last updated (ISO 8601). */
     updatedAt?: string;
-    /** The resolved code artifact and its build identity hash. */
-    codeArtifact?: { uri?: string; hash?: string };
+    /**
+     * The resolved code artifact and its build identity hash. `contentHash`
+     * covers only the bundled program / packaged context (no props), so a
+     * content-only edit is detectable at plan time before the props resolve.
+     */
+    codeArtifact?: { uri?: string; hash?: string; contentHash?: string };
   },
   {
     env?: Record<string, any>;

package/src/AWS/Lambda/MicrovmProvider.ts

@@ -8,8 +8,10 @@ import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 
 import type { ValidationException } from "@distilled.cloud/aws/Errors";
+import * as Artifacts from "../../Artifacts.ts";
 import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
 import { isResolved } from "../../Diff.ts";
+import type { Input, InputProps } from "../../Input.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { createInternalTags, diffTags } from "../../Tags.ts";
@@ -86,8 +88,73 @@ const buildPropsIdentity = (news: MicrovmImageProps) =>
 interface ResolvedArtifact {
   uri: string;
   hash: string;
+  contentHash: string;
 }
 
+/**
+ * The content half of an image's artifact identity, before any upload: the
+ * bundled program (or packaged context) plus the hash that names THAT —
+ * independent of the props, which fold into the full `hash` later.
+ */
+type ArtifactContent = {
+  /** Stored on the attrs; compared by `diff`. */
+  readonly contentHash: string;
+  /**
+   * The raw content identity the full `hash` is derived from — kept
+   * separate so that formula stays byte-identical to what deployed images
+   * already carry (`sha256(identity + ":" + propsId)`).
+   */
+  readonly identity: string;
+} & ({ readonly archive: Uint8Array } | { readonly uri: string });
+
+/** The props that decide what the artifact's CONTENT is. */
+type ContentInputs = Pick<
+  MicrovmImageProps,
+  | "main"
+  | "context"
+  | "codeArtifact"
+  | "runtime"
+  | "port"
+  | "dockerfile"
+  | "isExternal"
+  | "external"
+  | "build"
+>;
+
+/**
+ * Pick the content inputs off the plan-time props, or `undefined` when they
+ * cannot be read yet. At plan time the props may be unresolved — the build
+ * role, env, … are Outputs, and the whole object may itself be an
+ * Output/Effect/Config — so only a plain object whose content inputs have
+ * all resolved qualifies.
+ */
+const resolvedContentInputs = (
+  news: Input<MicrovmImageProps>,
+): ContentInputs | undefined => {
+  if (typeof news !== "object" || news === null) return undefined;
+  const n = news as InputProps<MicrovmImageProps>;
+  const picked: Input<ContentInputs> = {
+    main: n.main,
+    context: n.context,
+    codeArtifact: n.codeArtifact,
+    runtime: n.runtime,
+    port: n.port,
+    dockerfile: n.dockerfile,
+    isExternal: n.isExternal,
+    external: n.external,
+    build: n.build,
+  };
+  if (!isResolved(picked)) return undefined;
+  // `isResolved` has verified every field; the cast only re-states that
+  // for a type the guard cannot express on a mapped `Input<…>` object.
+  const resolved = picked as ContentInputs;
+  // An Effect/Config-shaped props object has none of these set.
+  if (!resolved.main && !resolved.context && !resolved.codeArtifact?.uri) {
+    return undefined;
+  }
+  return resolved;
+};
+
 const resolveName = (id: string, name?: string) =>
   name
     ? Effect.succeed(name)
@@ -132,72 +199,107 @@ const defaultBaseImageArn = Effect.fn(function* () {
   return base.imageArn;
 });
 
-// Materialize + upload the code artifact and compute its build identity hash.
+/**
+ * Bundle (or package) the image's code and hash the result. Nothing is
+ * uploaded here and no prop outside {@link contentInputs} is read: `diff`
+ * calls this before the props have resolved (the build role is an Output
+ * at plan time) to see a content-only edit of the in-VM program, and
+ * `reconcile` calls it again for the archive to upload. Memoized per
+ * resource for the run so a diff→reconcile cycle bundles once.
+ */
+const artifactContent = (
+  id: string,
+  news: ContentInputs,
+  note: (message: string) => Effect.Effect<void>,
+) =>
+  Effect.gen(function* (): Generator<any, ArtifactContent, any> {
+    if (news.main) {
+      const runtime = news.runtime ?? "node";
+      const port = news.port ?? DEFAULT_MICROVM_PORT;
+      yield* note("Bundling MicroVM program...");
+      const { files, hash: bundleHash } = yield* bundleMicrovmProgram({
+        main: news.main,
+        runtime,
+        isExternal: news.isExternal ?? false,
+        external: news.external,
+        port,
+        build: news.build,
+      });
+      const dockerfile = buildMicrovmDockerfile(news.dockerfile, runtime, port);
+      const identity = `${bundleHash}:${dockerfile}`;
+      const contentHash = yield* sha256(identity);
+      const archive = yield* zipFiles([
+        { path: "Dockerfile", content: dockerfile },
+        ...files,
+      ]);
+      return { contentHash, identity, archive };
+    }
+
+    if (news.context) {
+      const path = yield* Path.Path;
+      const fs = yield* FileSystem.FileSystem;
+      yield* note("Packaging MicroVM build context...");
+      const files = yield* readContextDirectory(news.context);
+      // Ensure a Dockerfile is present (resolve from `dockerfile` path or default).
+      const dockerfileName = news.dockerfile ?? "Dockerfile";
+      const hasDockerfile = files.some((f) => f.path === dockerfileName);
+      if (!hasDockerfile) {
+        const dockerfilePath = path.join(news.context, dockerfileName);
+        const content = yield* fs
+          .readFile(dockerfilePath)
+          .pipe(Effect.catch(() => Effect.succeed(undefined)));
+        if (content) files.push({ path: "Dockerfile", content });
+      }
+      // Hash the BYTES, not `path:byteLength` — a same-length edit (a
+      // flipped version string, a swapped constant) must count as a change.
+      const contentId = (yield* Effect.forEach(
+        [...files].sort((a, b) => (a.path < b.path ? -1 : 1)),
+        (f) => Effect.map(sha256(f.content), (hash) => `${f.path}:${hash}`),
+      )).join("|");
+      const archive = yield* zipFiles(files);
+      return {
+        contentHash: yield* sha256(contentId),
+        identity: contentId,
+        archive,
+      };
+    }
+
+    if (news.codeArtifact?.uri) {
+      const uri: string = news.codeArtifact.uri;
+      return { contentHash: yield* sha256(uri), identity: uri, uri };
+    }
+
+    return yield* Effect.die(
+      "MicrovmImage requires one of `main`, `context`, or `codeArtifact.uri`.",
+    );
+  }).pipe(Artifacts.cached(`microvm-image-content:${id}`));
+
+// Materialize + upload the code artifact and compute its build identity hash
+// (content + props). The `hash` formulas are unchanged from before
+// `contentHash` existed, so images deployed earlier are not rebuilt once.
 const resolveArtifact = Effect.fn(function* (
+  id: string,
   news: MicrovmImageProps,
   session: ScopedPlanStatusSession,
 ) {
   const propsId = buildPropsIdentity(news);
-
-  if (news.main) {
-    const runtime = news.runtime ?? "node";
-    const port = news.port ?? DEFAULT_MICROVM_PORT;
-    yield* session.note("Bundling MicroVM program...");
-    const { files, hash: bundleHash } = yield* bundleMicrovmProgram({
-      main: news.main,
-      runtime,
-      isExternal: news.isExternal ?? false,
-      external: news.external,
-      port,
-      build: news.build,
-    });
-    const dockerfile = buildMicrovmDockerfile(news.dockerfile, runtime, port);
-    const hash = yield* sha256(`${bundleHash}:${dockerfile}:${propsId}`);
-    const archive = yield* zipFiles([
-      { path: "Dockerfile", content: dockerfile },
-      ...files,
-    ]);
-    const assets = yield* Assets;
-    const key = yield* assets.uploadAsset(hash, archive);
-    const bucket = yield* assets.bucketName;
-    return { uri: `s3://${bucket}/${key}`, hash };
-  }
-
-  if (news.context) {
-    const path = yield* Path.Path;
-    const fs = yield* FileSystem.FileSystem;
-    yield* session.note("Packaging MicroVM build context...");
-    const files = yield* readContextDirectory(news.context);
-    // Ensure a Dockerfile is present (resolve from `dockerfile` path or default).
-    const dockerfileName = news.dockerfile ?? "Dockerfile";
-    const hasDockerfile = files.some((f) => f.path === dockerfileName);
-    if (!hasDockerfile) {
-      const dockerfilePath = path.join(news.context, dockerfileName);
-      const content = yield* fs
-        .readFile(dockerfilePath)
-        .pipe(Effect.catch(() => Effect.succeed(undefined)));
-      if (content) files.push({ path: "Dockerfile", content });
-    }
-    const contentId = files
-      .map((f) => `${f.path}:${f.content.byteLength}`)
-      .sort()
-      .join("|");
-    const hash = yield* sha256(`${contentId}:${propsId}`);
-    const archive = yield* zipFiles(files);
-    const assets = yield* Assets;
-    const key = yield* assets.uploadAsset(hash, archive);
-    const bucket = yield* assets.bucketName;
-    return { uri: `s3://${bucket}/${key}`, hash };
-  }
-
-  if (news.codeArtifact?.uri) {
-    const hash = yield* sha256(`${news.codeArtifact.uri}:${propsId}`);
-    return { uri: news.codeArtifact.uri, hash };
+  const content = yield* artifactContent(id, news, session.note);
+  const hash = yield* sha256(`${content.identity}:${propsId}`);
+  if ("uri" in content) {
+    return {
+      uri: content.uri,
+      hash,
+      contentHash: content.contentHash,
+    } satisfies ResolvedArtifact;
   }
-
-  return yield* Effect.die(
-    "MicrovmImage requires one of `main`, `context`, or `codeArtifact.uri`.",
-  );
+  const assets = yield* Assets;
+  const key = yield* assets.uploadAsset(hash, content.archive);
+  const bucket = yield* assets.bucketName;
+  return {
+    uri: `s3://${bucket}/${key}`,
+    hash,
+    contentHash: content.contentHash,
+  } satisfies ResolvedArtifact;
 });
 
 const toAttrs = (
@@ -214,7 +316,11 @@ const toAttrs = (
   createdAt: toIso(image.createdAt),
   updatedAt: toIso(image.updatedAt),
   codeArtifact: artifact
-    ? { uri: artifact.uri, hash: artifact.hash }
+    ? {
+        uri: artifact.uri,
+        hash: artifact.hash,
+        contentHash: artifact.contentHash,
+      }
     : undefined,
 });
 
@@ -316,7 +422,27 @@ export const MicrovmImageProvider = () =>
   Provider.succeed(MicrovmImage, {
     stables: ["imageArn", "name"],
 
-    diff: Effect.fn(function* ({ id, olds, news }) {
+    diff: Effect.fn(function* ({ id, olds, news, output }) {
+      // A content-only edit of the in-VM program changes none of the props,
+      // so the engine's structural diff would call it a noop and the image
+      // would never rebuild. Bundle (memoized for the run) and compare the
+      // CONTENT hash, exactly as the Lambda Function diff does. This runs
+      // before the props resolve — the build role is an Output at plan
+      // time — which is fine because only the plain content inputs are
+      // read. Rows persisted before `contentHash` existed skip the check
+      // until their next reconcile stamps it.
+      const previousContentHash = output?.codeArtifact?.contentHash;
+      const content = resolvedContentInputs(news);
+      if (previousContentHash !== undefined && content !== undefined) {
+        const { contentHash } = yield* artifactContent(
+          id,
+          content,
+          () => Effect.void,
+        );
+        if (contentHash !== previousContentHash) {
+          return { action: "update" } as const;
+        }
+      }
       if (!isResolved(news)) return;
       const oldName = yield* resolveName(id, olds.name);
       const newName = yield* resolveName(id, news.name);
@@ -360,7 +486,7 @@ export const MicrovmImageProvider = () =>
         resolveBaseImageArn(news) ?? (yield* defaultBaseImageArn());
 
       // Resolve + upload the artifact and compute its build identity.
-      const artifact = yield* resolveArtifact(news, session);
+      const artifact = yield* resolveArtifact(id, news, session);
 
       // Observe — prefer the cached ARN; otherwise look up by name (a name
       // is not a valid `getMicrovmImage` identifier).

package/src/AWS/Lambda/index.ts

@@ -15,6 +15,7 @@ export * from "./EventBridgeEventSource.ts";
 export * from "./EventInvokeConfig.ts";
 export * from "./EventSourceMapping.ts";
 export * from "./FlociFunctionProvider.ts";
+export * from "./FlociMicrovmImageProvider.ts";
 export * from "./Function.ts";
 export * from "./GetAccountSettings.ts";
 export * from "./GetAccountSettingsHttp.ts";

package/src/AWS/Local/DevWatchProvider.ts

@@ -112,6 +112,42 @@ export interface DevWatchSpec<Props, Attrs> {
    * {@link canonicalHash}. `news` arrives {@link stripEffects}-stripped.
    */
   readonly watchConfigOf: (news: Props, attrs: Attrs) => unknown;
+  /**
+   * Transform the resolved props before EVERY delegated reconcile —
+   * engine-driven and watcher-driven alike — inside the per-id lock, with
+   * the floci override services provided. This is where a provider swaps a
+   * build-here artifact form for a build-locally one (e.g. the MicroVM dev
+   * provider docker-builds the image on the HOST and hands the live
+   * reconcile a `codeArtifact: { uri: "docker://…" }` instead of `main`/
+   * `context`, so the emulator never zips, uploads, or builds anything).
+   * The untransformed props stay in the watch registry, so restarts and
+   * watch-config comparisons see the user's real inputs.
+   */
+  readonly transformReconcileNews?: (input: {
+    id: string;
+    news: Props;
+  }) => Effect.Effect<Props, unknown, any>;
+  /**
+   * Called after EVERY successful reconcile — engine-driven (a prop
+   * change, a fresh session's converge) and watcher-driven
+   * ({@link DevWatchContext.rerunReconcile}) alike — inside the per-id
+   * lock, with the floci override services provided. This is where a
+   * provider makes the emulator's RUNNING state follow the new revision
+   * (e.g. ECS restarting tasks): the watch trigger only fires for FILE
+   * changes, so restart logic that lives only in the watch loop silently
+   * skips prop-driven updates (an inline dockerfile edit, a new env var)
+   * and running tasks keep serving the old revision until the next source
+   * edit.
+   *
+   * `previous` is the attrs before this reconcile — `undefined` on a
+   * greenfield create.
+   */
+  readonly onReconciled?: (input: {
+    id: string;
+    news: Props;
+    previous: Attrs | undefined;
+    attrs: Attrs;
+  }) => Effect.Effect<void, unknown, any>;
   /**
    * Resource-specific replacement rules, mirroring the LIVE diff's cheap
    * checks (never bundling/building). Checked before the generic dev policy.
@@ -166,7 +202,7 @@ export const makeDevWatchProvider = <
   Props = R["Props"],
   Attrs = R["Attributes"],
 >(
-  cls: ResourceClassLike<R> | Platform<R, any, any, any, any>,
+  cls: ResourceClassLike<R> | Platform<R, any, any, any, any, any>,
   serverEntryUrl: string,
   spec: DevWatchSpec<Props, Attrs>,
 ) =>
@@ -272,14 +308,35 @@ export const makeDevWatchProvider = <
           currentAttrs: Effect.sync(() => entry.attrs as Attrs),
           rerunReconcile: withLock(input.id)(
             Effect.gen(function* () {
+              const previous = entry.attrs as Attrs | undefined;
+              const rerunNews =
+                spec.transformReconcileNews !== undefined
+                  ? yield* spec
+                      .transformReconcileNews({
+                        id: input.id,
+                        news: stripEffects(entry.lastInput.news) as Props,
+                      })
+                      .pipe(Effect.provide(services))
+                  : entry.lastInput.news;
               const fresh = yield* wrapped.reconcile(
                 withSafeSession({
                   ...entry.lastInput,
+                  news: rerunNews,
                   olds: entry.lastInput.news,
                   output: entry.attrs,
                 }) as any,
               );
               entry.attrs = fresh;
+              if (spec.onReconciled !== undefined) {
+                yield* spec
+                  .onReconciled({
+                    id: input.id,
+                    news: stripEffects(entry.lastInput.news) as Props,
+                    previous,
+                    attrs: fresh as Attrs,
+                  })
+                  .pipe(Effect.provide(services));
+              }
               return fresh as Attrs;
             }),
           ) as Effect.Effect<Attrs, unknown>,
@@ -337,8 +394,30 @@ export const makeDevWatchProvider = <
           }
           // A fresh dev session has state rows but no running watcher (and
           // possibly a wiped emulator) — force a reconcile to converge floci
-          // and (re)start the watch loop.
-          if (!watches.has(id)) return { action: "update" as const };
+          // and (re)start the watch loop. A DEAD watcher (its loop exited or
+          // was interrupted) counts as none: nothing is handling content
+          // changes for this id anymore.
+          const entry = watches.get(id);
+          if (
+            entry === undefined ||
+            (entry.fiber !== undefined &&
+              entry.fiber.pollUnsafe() !== undefined)
+          ) {
+            return { action: "update" as const };
+          }
+          // The watcher may have swapped content SINCE state was last
+          // persisted (its rerunReconcile updates the emulator and the
+          // sidecar's in-memory attrs, not the state store). If the
+          // persisted attrs drifted from the watcher's current attrs, plan
+          // an update — the content-addressed reconcile is cheap, the
+          // engine persists the fresh attrs, and downstream consumers
+          // (stack outputs, Actions keyed on `code.hash`) see the swap
+          // instead of replaying stale state forever.
+          const persistedHash = yield* canonicalHash(output as object);
+          const watcherHash = yield* canonicalHash(entry.attrs as object);
+          if (persistedHash !== watcherHash) {
+            return { action: "update" as const };
+          }
           if (!havePropsChanged(normalize(olds), normalize(news)!)) {
             // Content-only changes are the watch loop's job — the dev diff
             // never bundles or builds.
@@ -349,10 +428,31 @@ export const makeDevWatchProvider = <
         reconcile: Effect.fn(function* (input: any) {
           return yield* withLock(input.id)(
             Effect.gen(function* () {
+              const previous = (input.output ??
+                watches.get(input.id)?.attrs) as Attrs | undefined;
+              const reconcileNews =
+                spec.transformReconcileNews !== undefined
+                  ? yield* spec
+                      .transformReconcileNews({
+                        id: input.id,
+                        news: stripEffects(input.news) as Props,
+                      })
+                      .pipe(Effect.provide(services))
+                  : input.news;
               const attrs = yield* wrapped.reconcile(
-                withSafeSession(input) as any,
+                withSafeSession({ ...input, news: reconcileNews }) as any,
               );
               yield* ensureWatch(input, attrs);
+              if (spec.onReconciled !== undefined) {
+                yield* spec
+                  .onReconciled({
+                    id: input.id,
+                    news: stripEffects(input.news) as Props,
+                    previous,
+                    attrs: attrs as Attrs,
+                  })
+                  .pipe(Effect.provide(services));
+              }
               return attrs;
             }),
           );

package/src/AWS/Local/FlociServices.ts

@@ -102,4 +102,8 @@ export const flociDual = <
   ProviderLayer.dual(cls, {
     live,
     local: () => provideProviderContext(live(), flociServices()),
+    // Registered as the resource's local data plane so deploy-time binding
+    // clients (Action bodies, plan-time `execute`) route their API calls to
+    // the emulator whenever the bound resource resolves to local mode.
+    dataPlane: flociServices,
   });