@homeflare/alchemy 0.1.0

package/dist/openbao/forgejo-bootstrap-parse.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Reading what the Forgejo CLI prints, for the forgejo-provision bootstrap (forgejo-bootstrap.ts).
+ *
+ * ★ PURE, SO THE ONE PART THAT TOUCHES THE PASSWORD IS TESTED WITHOUT ONE. Every format below was
+ *   read off the running 16.0.3 daemon or its source on 2026-09-14, not assumed.
+ */
+/** Where the mini's Forgejo keeps its state (hosts/macmini/modules/forgejo.nix:235, app.ini:14). */
+export declare const FORGEJO_WORK_PATH = "/opt/homeflare/forgejo";
+/** The file the launchd runner renders at every start (forgejo.nix:78). Readable by tim, who runs Forgejo. */
+export declare const FORGEJO_CONFIG = "/opt/homeflare/forgejo/custom/conf/app.ini";
+/**
+ * The binary of the RUNNING server, so the CLI writes the same schema as the daemon serving it.
+ *
+ * ★ MEASURED: `ps -axo command` shows
+ *   `/nix/store/<hash>-forgejo-16.0.3/bin/forgejo web --work-path /opt/homeflare/forgejo`. A
+ *   `forgejo` found on PATH could be a different version from the one holding the database.
+ */
+export declare const runningForgejoBinary: (psCommands: string) => string | undefined;
+/**
+ * Usernames from `forgejo admin user list`: a tabwriter table whose header is
+ * `ID Username Email IsActive IsAdmin 2FA` (measured, six columns).
+ *
+ * ⛔ AN UNEXPECTED HEADER THROWS. Parsing a changed table as "no such user" would let the bootstrap
+ *   create over an account it failed to see.
+ */
+export declare const usernamesFrom: (table: string) => string[];
+/** What `admin user create --random-password` printed on stdout. */
+export type CreateOutput = {
+    readonly created: boolean;
+    /** ⛔ Never logged, never returned past the one OpenBao write. */
+    readonly password: string | undefined;
+    /** Every other non-empty stdout line, safe to echo. */
+    readonly rest: readonly string[];
+};
+/**
+ * ★ THE TWO LINES, FROM forgejo v16.0 cmd/admin_user_create.go:
+ *     generated random password is '%s'
+ *     New user '%s' has been successfully created!
+ * ⚠️ THE PATTERN IS GREEDY TO THE LAST QUOTE ON PURPOSE. Forgejo's generator can draw a `'` when
+ *   PASSWORD_COMPLEXITY includes `spec`, and a lazy match would silently store a truncated password
+ *   that no mint could ever use. The generator never draws a newline, so one line is one password.
+ */
+export declare const readCreateOutput: (stdout: string, username: string) => CreateOutput;
+/** The last few lines of a CLI's stderr, for a failure message. Forgejo prints no secret there. */
+export declare const tailOf: (text: string, lines?: number) => string;
+//# sourceMappingURL=forgejo-bootstrap-parse.d.ts.map

package/dist/openbao/forgejo-bootstrap-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forgejo-bootstrap-parse.d.ts","sourceRoot":"","sources":["../../src/openbao/forgejo-bootstrap-parse.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,oGAAoG;AACpG,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAC1D,8GAA8G;AAC9G,eAAO,MAAM,cAAc,+CAA6C,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,eAAgB,MAAM,KAAG,MAAM,GAAG,SAYlE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,UAAW,MAAM,KAAG,MAAM,EAYnD,CAAC;AAEF,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,WAAY,MAAM,YAAY,MAAM,KAAG,YAcnE,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,MAAM,SAAU,MAAM,qBAAc,MACmB,CAAC"}

package/dist/openbao/forgejo-bootstrap.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The forgejo-provision service account: created once, by a person, with its password handed
+ * straight to the Forgejo engine's role and nowhere else.
+ *
+ * ★ TIM'S CALL, 2026-09-14: "Random password, piped", and membership of the HomeFlare Owners team
+ *   (house/forgejo, Forgejo.TeamMember). Forgejo has no service-account type and no app.ini setting
+ *   that creates users — the bot type is database-only (codeberg issue 8136) — so this is an
+ *   ordinary user made by `forgejo admin user create`.
+ *
+ * ⛔ AN AGENT DOES NOT RUN THIS. Creating an account is a human step (32-forgejo-provision.hcl).
+ *   Everything around it is not: the engine, its config, the team membership and the mint proof.
+ *
+ * ⛔ THE PASSWORD EXISTS IN THIS PROCESS AND IN ONE OPENBAO WRITE, AND NOWHERE ELSE.
+ *   - Forgejo generates it (`--random-password`), so it is never in argv, where `ps` shows it.
+ *   - Its stdout line is parsed and never echoed (forgejo-bootstrap-parse.ts).
+ *   - It lands in `forgejo/roles/provision` as `mint_password`, which the engine never returns on a
+ *     read (plugin-forgejo path_roles.go:63-71, :219-227).
+ *   - It is never a file, an environment variable, a log line or an Alchemy prop.
+ *
+ * ★ EVERYTHING THAT CAN FAIL IS CHECKED BEFORE THE ACCOUNT EXISTS. An account whose password was
+ *   lost between the CLI and OpenBao is the one failure a rerun cannot fix. So the preflight runs
+ *   first, and if the write still fails after that, the account is deleted again so a rerun starts
+ *   clean.
+ */
+import * as Effect from 'effect/Effect';
+export declare const PROVISION_USER = "forgejo-provision";
+export declare const ROLE_PATH = "forgejo/roles/provision";
+export declare const bootstrapProvisionAccount: Effect.Effect<undefined, import("./bao-status.ts").BaoError | Error, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=forgejo-bootstrap.d.ts.map

package/dist/openbao/forgejo-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forgejo-bootstrap.d.ts","sourceRoot":"","sources":["../../src/openbao/forgejo-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAWxC,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAGlD,eAAO,MAAM,SAAS,4BAA4B,CAAC;AA6BnD,eAAO,MAAM,yBAAyB,4HAiHpC,CAAC"}

package/dist/openbao/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * OpenBao providers for Alchemy.
+ *
+ * ⛔ THIS BARREL IS THE PUBLIC API, AND IT IS DELIBERATELY SMALLER THAN THE DIRECTORY.
+ *   These are the symbols a real stack consumes; the rest of the files are internals a
+ *   provider needs but a consumer should not depend on. An `export *` here would publish
+ *   every helper as API and make the next refactor a breaking change.
+ * ★ Anything unlisted is still reachable by path if you genuinely need it — that is a
+ *   deliberate, visible act rather than an accident of barrelling.
+ */
+export { BaoAuthRoleProvider } from './auth-role.ts';
+export { BaoCloudflareRoleProvider } from './cloudflare-role.ts';
+export { BaoMountProvider } from './mount.ts';
+export { BaoPkiRoleProvider } from './pki-role.ts';
+export { BaoPolicy, BaoPolicyProvider } from './policy.ts';
+export { BaoProxmoxRole, BaoProxmoxRoleProvider } from './proxmox-role.ts';
+export { BaoSshRoleProvider } from './ssh-role.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/openbao/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/openbao/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}