alchemy 2.0.0-beta.74 → 2.0.0-beta.76

package/src/AWS/Route53/HostedZoneLookup.ts

@@ -0,0 +1,63 @@
+import * as route53 from "@distilled.cloud/aws/route-53";
+import * as Effect from "effect/Effect";
+
+/**
+ * Find the most specific PUBLIC Route 53 hosted zone containing
+ * `domainName`, walking up its labels (`svc.api.example.com` →
+ * `api.example.com` → `example.com`). Wildcard labels (`*`) never name a
+ * zone, so they fall through to the parent naturally. Returns the bare
+ * zone id (no `/hostedzone/` prefix), or `undefined` when no public zone
+ * matches.
+ *
+ * Shared by every provider that infers a hosted zone from a hostname
+ * (Route 53 Record/Records, ACM Certificate validation, ECS Service DNS).
+ */
+export const findPublicHostedZoneId = Effect.fn("findPublicHostedZoneId")(
+  function* (domainName: string) {
+    const labels = domainName
+      .replace(/\.$/, "")
+      .split(".")
+      .filter((label) => label.length > 0);
+    for (let i = 0; i < labels.length - 1; i++) {
+      const candidate = `${labels.slice(i).join(".")}.`;
+      const listed = yield* route53.listHostedZonesByName({
+        DNSName: candidate,
+        MaxItems: 1,
+      });
+      const zone = listed.HostedZones?.[0];
+      if (
+        zone?.Id !== undefined &&
+        zone.Name === candidate &&
+        zone.Config?.PrivateZone !== true
+      ) {
+        return zone.Id.replace(/^\/hostedzone\//, "");
+      }
+    }
+    return undefined;
+  },
+);
+
+/**
+ * Resolve the hosted zone for `domainName`: the explicit id when given,
+ * otherwise the most specific public zone in the account (see
+ * {@link findPublicHostedZoneId}). Fails with an actionable error when
+ * neither yields a zone.
+ */
+export const resolveHostedZoneId = Effect.fn("resolveHostedZoneId")(function* (
+  hostedZoneId: string | undefined,
+  domainName: string,
+) {
+  if (hostedZoneId !== undefined) {
+    return hostedZoneId;
+  }
+  const inferred = yield* findPublicHostedZoneId(domainName);
+  if (inferred === undefined) {
+    return yield* Effect.fail(
+      new Error(
+        `No public Route 53 hosted zone in this account contains "${domainName}" — ` +
+          `create the zone first or pass "hostedZoneId" explicitly.`,
+      ),
+    );
+  }
+  return inferred;
+});

package/src/AWS/Route53/Record.ts

@@ -8,6 +8,7 @@ import type { Input } from "../../Input.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { durationToSeconds } from "../IAM/common.ts";
+import { resolveHostedZoneId } from "./HostedZoneLookup.ts";
 import type { Providers } from "../Providers.ts";
 
 export interface RecordAliasTarget {
@@ -89,9 +90,13 @@ export interface RecordCidrRoutingConfig {
 
 export interface RecordProps {
   /**
-   * Hosted zone that owns the record.
+   * Hosted zone that owns the record. When omitted, the most specific
+   * PUBLIC hosted zone in the account containing `name` is inferred by
+   * walking the name's parent domains (`svc.api.example.com` →
+   * `api.example.com` → `example.com`); the deploy fails actionably when
+   * no zone matches.
    */
-  hostedZoneId: string;
+  hostedZoneId?: string;
   /**
    * Record name.
    */
@@ -545,9 +550,12 @@ export const RecordProvider = () =>
         );
       });
 
-      const upsertRecord = Effect.fn(function* (props: RecordProps) {
+      const upsertRecord = Effect.fn(function* (
+        hostedZoneId: string,
+        props: RecordProps,
+      ) {
         const response = yield* route53.changeResourceRecordSets({
-          HostedZoneId: normalizeHostedZoneId(props.hostedZoneId),
+          HostedZoneId: normalizeHostedZoneId(hostedZoneId),
           ChangeBatch: {
             Comment: "Alchemy Route53 record upsert",
             Changes: [
@@ -628,7 +636,11 @@ export const RecordProvider = () =>
           // (they deserialize as `undefined`), and an unknown old identity
           // must fall through to the create/update recovery path.
           if (
+            // An undefined side means "inferred" — reconcile resolves it
+            // against the live account, so only two explicit, differing
+            // zones are a replacement.
             (olds.hostedZoneId !== undefined &&
+              news.hostedZoneId !== undefined &&
               normalizeHostedZoneId(olds.hostedZoneId) !==
                 normalizeHostedZoneId(news.hostedZoneId)) ||
             (olds.name !== undefined &&
@@ -666,16 +678,24 @@ export const RecordProvider = () =>
 
           return toAttrs(recordSet, hostedZoneId);
         }),
-        reconcile: Effect.fn(function* ({ news, session }) {
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          // Resolve the zone: explicit prop, else the zone this resource
+          // already resolved to (stable across reconciles), else infer the
+          // most specific public zone containing the record name.
+          const hostedZoneId = yield* resolveHostedZoneId(
+            news.hostedZoneId ?? output?.hostedZoneId,
+            news.name,
+          );
+
           // Route 53 `changeResourceRecordSets` with `UPSERT` is naturally
           // reconciler-friendly: it creates the record if missing and
           // overwrites it if present. There's no separate ensure/sync split
           // — one call converges to the desired record set.
-          yield* upsertRecord(news);
+          yield* upsertRecord(hostedZoneId, news);
 
           // Re-read so the returned attributes reflect the actual current
           // record (including server-applied defaults).
-          const recordSet = yield* findRecord(news.hostedZoneId, news);
+          const recordSet = yield* findRecord(hostedZoneId, news);
 
           if (!recordSet) {
             return yield* Effect.die(
@@ -684,7 +704,7 @@ export const RecordProvider = () =>
           }
 
           yield* session.note(`${news.type} ${normalizeName(news.name)}`);
-          return toAttrs(recordSet, news.hostedZoneId);
+          return toAttrs(recordSet, hostedZoneId);
         }),
         delete: Effect.fn(function* ({ output }) {
           yield* route53

package/src/AWS/Route53/Records.ts

@@ -7,6 +7,7 @@ import * as Provider from "../../Provider.ts";
 import { Resource, type ResourceBinding } from "../../Resource.ts";
 import { durationToSeconds } from "../IAM/common.ts";
 import type { Providers } from "../Providers.ts";
+import { resolveHostedZoneId } from "./HostedZoneLookup.ts";
 import {
   normalizeHostedZoneId,
   normalizeName,
@@ -30,9 +31,13 @@ export type RecordsBinding = {
 
 export interface RecordsProps {
   /**
-   * Hosted zone that owns the records.
+   * Hosted zone that owns the records. When omitted, the most specific
+   * PUBLIC hosted zone in the account containing the set's first name is
+   * inferred by walking its parent domains; the deploy fails actionably
+   * when no zone matches. Every name in the set lives in the one zone
+   * either way.
    */
-  hostedZoneId: string;
+  hostedZoneId?: string;
   /**
    * Record type shared by every record in the set.
    */
@@ -62,9 +67,11 @@ export interface Records extends Resource<
   RecordsProps,
   {
     /**
-     * Hosted zone that owns the records.
+     * Hosted zone that owns the records. `undefined` only while the set
+     * is empty with no explicit zone — resolved (explicit or inferred) on
+     * the first reconcile that has a name.
      */
-    hostedZoneId: string;
+    hostedZoneId: string | undefined;
     /**
      * Record type shared by every record in the set.
      */
@@ -290,7 +297,11 @@ export const RecordsProvider = () =>
           // themselves are mutable — prop/binding deltas fall through to
           // the engine's default update logic.
           if (
+            // An undefined side means "inferred" — reconcile resolves it
+            // against the live account, so only two explicit, differing
+            // zones are a replacement.
             (olds.hostedZoneId !== undefined &&
+              news.hostedZoneId !== undefined &&
               normalizeHostedZoneId(olds.hostedZoneId) !==
                 normalizeHostedZoneId(news.hostedZoneId)) ||
             olds.type !== news.type
@@ -305,6 +316,10 @@ export const RecordsProvider = () =>
             // reconcile (upserts converge on any half-created records).
             return undefined;
           }
+          if (output.hostedZoneId === undefined) {
+            // An empty set that never resolved a zone — nothing to observe.
+            return output;
+          }
           const found: string[] = [];
           let recordSet: route53.ResourceRecordSet | undefined;
           for (const name of output.names) {
@@ -331,6 +346,26 @@ export const RecordsProvider = () =>
         }),
         reconcile: Effect.fn(function* ({ news, output, session, bindings }) {
           const desired = resolveDesiredNames(news.names, bindings);
+          // Resolve the zone: explicit prop, else the zone this set already
+          // resolved to, else infer from the first name in the set. A set
+          // that is still empty with no explicit zone stays unresolved —
+          // the zone materializes on the first reconcile that has a name.
+          const explicitZoneId = news.hostedZoneId ?? output?.hostedZoneId;
+          if (explicitZoneId === undefined && desired.length === 0) {
+            yield* session.note(`${news.type} × 0 record(s)`);
+            return {
+              hostedZoneId: undefined,
+              type: news.type,
+              names: [],
+              ttl: undefined,
+              records: undefined,
+              aliasTarget: undefined,
+            };
+          }
+          const hostedZoneId = yield* resolveHostedZoneId(
+            explicitZoneId,
+            desired[0] ?? "",
+          );
           // `output.names` is the cache of which records this resource
           // managed before — the only way to know what to garbage-collect
           // (Route 53 records carry no tags to observe ownership from).
@@ -346,14 +381,14 @@ export const RecordsProvider = () =>
           const changes: route53.Change[] = [];
           for (const name of desired) {
             const target = desiredRecordSet(news, name);
-            const live = yield* findRecord(news.hostedZoneId, name, news.type);
+            const live = yield* findRecord(hostedZoneId, name, news.type);
             if (!live || !matchesDesired(live, target)) {
               changes.push({ Action: "UPSERT", ResourceRecordSet: target });
             }
           }
           if (changes.length > 0) {
             const response = yield* route53.changeResourceRecordSets({
-              HostedZoneId: normalizeHostedZoneId(news.hostedZoneId),
+              HostedZoneId: normalizeHostedZoneId(hostedZoneId),
               ChangeBatch: {
                 Comment: "Alchemy Route53 record-set upsert",
                 Changes: changes,
@@ -363,7 +398,7 @@ export const RecordsProvider = () =>
           }
 
           // Garbage-collect names that left the set.
-          yield* deleteNames(news.hostedZoneId, news.type, stale);
+          yield* deleteNames(hostedZoneId, news.type, stale);
 
           yield* session.note(
             `${news.type} × ${desired.length} record(s)` +
@@ -372,10 +407,10 @@ export const RecordsProvider = () =>
 
           const sample =
             desired.length > 0
-              ? yield* findRecord(news.hostedZoneId, desired[0]!, news.type)
+              ? yield* findRecord(hostedZoneId, desired[0]!, news.type)
               : undefined;
           return {
-            hostedZoneId: normalizeHostedZoneId(news.hostedZoneId),
+            hostedZoneId: normalizeHostedZoneId(hostedZoneId),
             type: news.type,
             names: desired.map((name) => normalizeName(name)),
             ttl: sample?.TTL,
@@ -384,6 +419,10 @@ export const RecordsProvider = () =>
           };
         }),
         delete: Effect.fn(function* ({ output }) {
+          if (output.hostedZoneId === undefined) {
+            // The set never resolved a zone — it never created records.
+            return;
+          }
           yield* deleteNames(output.hostedZoneId, output.type, output.names);
         }),
       };

package/src/AWS/Website/AssetDeployment.ts

@@ -1,10 +1,11 @@
 import * as s3 from "@distilled.cloud/aws/s3";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
 import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
 import { createHash } from "node:crypto";
-import { readdir, readFile } from "node:fs/promises";
-import path from "node:path";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { initialCwd } from "../../Util/Node.ts";
@@ -162,6 +163,8 @@ export const AssetDeploymentProvider = () =>
     AssetDeployment,
     Effect.gen(function* () {
       const reconcileSync = Effect.fn(function* (news: AssetDeploymentProps) {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
         const bucketName = news.bucket.bucketName;
         const prefix = normalizePrefix(news.prefix);
         // Resolve against the process's INITIAL cwd, never the live cwd:
@@ -169,74 +172,79 @@ export const AssetDeploymentProvider = () =>
         // framework build may transiently chdir this shared process while
         // the upload walks the tree.
         const root = path.resolve(initialCwd, news.sourcePath);
-        const files = yield* Effect.tryPromise(() => walk(root));
-        const hash = createHash("sha256");
-        const desiredKeys = new Set<string>();
-        const uploadedFiles: string[] = [];
-
-        // Observe — list every key already under the prefix and capture
-        // its ETag (S3 ETag for non-multipart PUTs is the hex MD5 of the
-        // body) so we can skip re-uploads when the content already matches.
+        const files = yield* walkFiles(root);
         const observed = yield* listObjects(
           bucketName,
           prefix ? `${prefix}/` : prefix,
         );
-
-        for (const relativePath of files.sort((a, b) => a.localeCompare(b))) {
-          const body = yield* Effect.tryPromise(() =>
-            readFile(path.join(root, relativePath)),
-          );
-          const normalizedRelativePath = toPosix(relativePath);
-          const key = prefix
-            ? `${prefix}/${normalizedRelativePath}`
-            : normalizedRelativePath;
-          const options = getFileOptions(
-            normalizedRelativePath,
-            news.fileOptions,
-            news.textEncoding,
-          );
-
-          hash.update(normalizedRelativePath);
-          hash.update(body);
-          hash.update(options.contentType);
-          hash.update(options.cacheControl);
-
-          desiredKeys.add(key);
-          uploadedFiles.push(normalizedRelativePath);
-
-          // Sync — diff observed object hash against desired body hash,
-          // and only PUT when the content has changed. ETag is wrapped in
-          // quotes by S3 and is lower-case hex.
-          const expectedETag = createHash("md5").update(body).digest("hex");
-          const observedETag = observed.get(key)?.replace(/^"|"$/g, "");
-          if (observedETag === expectedETag) {
-            continue;
+        const prepared = yield* Effect.all(
+          files.map((relativePath) =>
+            Effect.gen(function* () {
+              const body = yield* fs.readFile(path.join(root, relativePath));
+              const normalizedRelativePath = toPosix(relativePath);
+              const key = prefix
+                ? `${prefix}/${normalizedRelativePath}`
+                : normalizedRelativePath;
+              const options = getFileOptions(
+                normalizedRelativePath,
+                news.fileOptions,
+                news.textEncoding,
+              );
+              return {
+                relative: normalizedRelativePath,
+                key,
+                body,
+                contentType: options.contentType,
+                cacheControl: options.cacheControl,
+              };
+            }),
+          ),
+          { concurrency: "unbounded" },
+        );
+        const version = yield* Effect.sync(() => {
+          const hash = createHash("sha256");
+          for (const file of prepared) {
+            hash.update(file.relative);
+            hash.update(file.body);
+            hash.update(file.contentType);
+            hash.update(file.cacheControl);
           }
+          return hash.digest("hex");
+        });
+        const desiredKeys = new Set(prepared.map((file) => file.key));
+        yield* Effect.all(
+          prepared.flatMap((file) => {
+            const expectedETag = createHash("md5")
+              .update(file.body)
+              .digest("hex");
+            const observedETag = observed.get(file.key)?.replace(/^"|"$/g, "");
+            if (observedETag === expectedETag) return [];
+            return [
+              s3.putObject({
+                Bucket: bucketName,
+                Key: file.key,
+                Body: file.body,
+                ContentType: file.contentType,
+                CacheControl: file.cacheControl,
+              }),
+            ];
+          }),
+          { concurrency: 16 },
+        );
 
-          yield* s3.putObject({
-            Bucket: bucketName,
-            Key: key,
-            Body: body,
-            ContentType: options.contentType,
-            CacheControl: options.cacheControl,
-          });
-        }
-
-        // Sync purge — delete observed keys that aren't in the desired
-        // set. Reuses the same observation rather than re-listing.
         if (news.purge ?? false) {
-          const staleKeys = [...observed.keys()].filter(
-            (key) => !desiredKeys.has(key),
+          yield* deleteKeys(
+            bucketName,
+            [...observed.keys()].filter((key) => !desiredKeys.has(key)),
           );
-          yield* deleteKeys(bucketName, staleKeys);
         }
 
         return {
           bucketName,
           prefix,
-          version: hash.digest("hex"),
+          version,
           fileCount: files.length,
-          files: uploadedFiles,
+          files: prepared.map((file) => file.relative),
         };
       });
 
@@ -276,7 +284,13 @@ export const AssetDeploymentProvider = () =>
 const normalizePrefix = (prefix: string | undefined) =>
   prefix ? prefix.replace(/^\/+|\/+$/g, "") : "";
 
-const toPosix = (value: string) => value.split(path.sep).join("/");
+const toPosix = (value: string) => value.replaceAll("\\", "/");
+
+const extname = (file: string) => {
+  const base = toPosix(file).split("/").pop() ?? file;
+  const dot = base.lastIndexOf(".");
+  return dot > 0 ? base.slice(dot).toLowerCase() : "";
+};
 
 const withCharset = (mimeType: string, textEncoding: WebsiteTextEncoding) =>
   textEncoding === "none" ? mimeType : `${mimeType}; charset=${textEncoding}`;
@@ -285,7 +299,7 @@ const inferContentType = (
   file: string,
   textEncoding: WebsiteTextEncoding = "utf-8",
 ) => {
-  const ext = path.extname(file).toLowerCase();
+  const ext = extname(file);
   switch (ext) {
     case ".html":
       return withCharset("text/html", textEncoding);
@@ -323,7 +337,7 @@ const inferContentType = (
 };
 
 const defaultCacheControlFor = (file: string) =>
-  path.extname(file).toLowerCase() === ".html"
+  extname(file) === ".html"
     ? defaultHtmlCacheControl
     : defaultAssetCacheControl;
 
@@ -366,63 +380,56 @@ const getFileOptions = (
   };
 };
 
-const walk = async (root: string, dir = ""): Promise<string[]> => {
-  const entries = await readdir(path.join(root, dir), { withFileTypes: true });
-  const files = await Promise.all(
-    entries.map(async (entry) => {
-      const relative = path.join(dir, entry.name);
-      if (entry.isDirectory()) {
-        return walk(root, relative);
-      }
-      return [relative];
-    }),
+const walkFiles = Effect.fn(function* (root: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  if (!(yield* fs.exists(root))) return [] as string[];
+  const names = yield* fs.readDirectory(root, { recursive: true });
+  const files = yield* Effect.all(
+    names.map((name) =>
+      Effect.gen(function* () {
+        const full = path.join(root, name);
+        const stat = yield* fs.stat(full);
+        return stat.type === "File" ? toPosix(name) : undefined;
+      }),
+    ),
+    { concurrency: "unbounded" },
   );
-  return files.flat();
-};
-
-const listKeys = Effect.fn(function* (bucketName: string, prefix: string) {
-  let continuationToken: string | undefined;
-  const keys: string[] = [];
+  return files
+    .filter((name): name is string => name !== undefined)
+    .sort((a, b) => a.localeCompare(b));
+});
 
-  do {
-    const response = yield* s3.listObjectsV2({
+const listObjectPages = (bucketName: string, prefix: string) =>
+  s3.listObjectsV2
+    .pages({
       Bucket: bucketName,
       Prefix: prefix || undefined,
-      ContinuationToken: continuationToken,
-    });
-    keys.push(
-      ...(response.Contents ?? []).flatMap((item) =>
-        item.Key ? [item.Key] : [],
-      ),
-    );
-    continuationToken = response.NextContinuationToken;
-  } while (continuationToken);
-
-  return keys;
-});
+    })
+    .pipe(Stream.flatMap((page) => Stream.fromIterable(page.Contents ?? [])));
+
+const listKeys = (bucketName: string, prefix: string) =>
+  listObjectPages(bucketName, prefix).pipe(
+    Stream.map((object) => object.Key),
+    Stream.filter((key): key is string => key !== undefined),
+    Stream.runCollect,
+    Effect.map((keys) => Array.from(keys)),
+  );
 
 /** List `{key -> ETag}` pairs under `prefix`. ETag from S3 is wrapped in
  * quotes; for non-multipart uploads it is the hex MD5 of the object body. */
-const listObjects = Effect.fn(function* (bucketName: string, prefix: string) {
-  let continuationToken: string | undefined;
-  const out = new Map<string, string>();
-
-  do {
-    const response = yield* s3.listObjectsV2({
-      Bucket: bucketName,
-      Prefix: prefix || undefined,
-      ContinuationToken: continuationToken,
-    });
-    for (const item of response.Contents ?? []) {
-      if (item.Key && item.ETag) {
-        out.set(item.Key, item.ETag);
-      }
-    }
-    continuationToken = response.NextContinuationToken;
-  } while (continuationToken);
-
-  return out;
-});
+const listObjects = (bucketName: string, prefix: string) =>
+  listObjectPages(bucketName, prefix).pipe(
+    Stream.runFold(
+      () => new Map<string, string>(),
+      (out, item) => {
+        if (item.Key && item.ETag) {
+          out.set(item.Key, item.ETag);
+        }
+        return out;
+      },
+    ),
+  );
 
 const deleteKeys = Effect.fn(function* (bucketName: string, keys: string[]) {
   for (let i = 0; i < keys.length; i += 1000) {