@homeflare/alchemy 0.19.0 → 0.20.0

package/dist/linux/index.js

@@ -624,6 +624,7 @@ var tokens = (spec) => {
     end: `${comment} END ${spec.name}`
   };
 };
+var sameRegion = (a, b) => a === undefined || b === undefined ? a === undefined && b === undefined : a.name === b.name && (a.comment ?? DEFAULT_COMMENT) === (b.comment ?? DEFAULT_COMMENT);
 var regionProblems = (spec) => {
   const found = [];
   const comment = spec.comment ?? DEFAULT_COMMENT;
@@ -748,6 +749,16 @@ var identity = async (runner, props) => {
   return { ...uid === undefined ? {} : { uid }, ...gid === undefined ? {} : { gid } };
 };
 var digestOf = (text) => sha256Hex(encoder.encode(text));
+var relocation = (props, output) => {
+  if (props.path !== output.path)
+    return "path";
+  if (sameRegion(props.region, output.region))
+    return "none";
+  if (props.region === undefined || output.region === undefined) {
+    throw refuse3(props.path, `changes between owning the whole file and owning the managed region ` + `${JSON.stringify((props.region ?? output.region)?.name ?? "")} at the same path. Those ` + "are two different claims on one file: destroy this resource and declare a new one.");
+  }
+  return "region";
+};
 var ownedDigest = (file, region) => {
   if (file === undefined)
     return;
@@ -814,7 +825,7 @@ var planWrite = async (runner, props, want) => {
 // src/linux/remote-file-lifecycle.ts
 var diffFile = async (runner, news, output) => {
   const want = await identity(runner, news);
-  if (news.path !== output.path) {
+  if (relocation(news, output) === "path") {
     await runner.checkWrite?.(news.path, { mode: news.mode ?? DEFAULT_MODE2, ...want });
     return { action: "replace" };
   }
@@ -830,8 +841,8 @@ var reconcileFile = async (runner, props, output, adopt = false) => {
   if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {
     throw refuse3(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy through ` + "a root destination or a privileged HostRunner. This provider never calls sudo itself.");
   }
-  const moved = output !== undefined && output.path !== props.path;
-  const prior = moved ? undefined : output;
+  const move = output === undefined ? "none" : relocation(props, output);
+  const prior = move === "none" ? output : undefined;
   const planned = await planWrite(runner, props, want);
   const live = ownedDigest(planned.before, props.region);
   const declared = digestOf(props.content);
@@ -849,9 +860,16 @@ var reconcileFile = async (runner, props, output, adopt = false) => {
     }
     throw refuse3(props.path, "the write returned but the file on disk does not match the declaration");
   }
-  if (moved && output !== undefined)
-    await deleteFile(runner, output);
-  return after;
+  if (move === "none" || output === undefined)
+    return after;
+  await deleteFile(runner, output);
+  if (move === "path")
+    return after;
+  const settled = await readFileAttributes(runner, props.path, props.region);
+  if (settled === undefined || settled.contentSha256 !== declared) {
+    throw refuse3(props.path, "removing the previous managed block did not leave ours intact");
+  }
+  return settled;
 };
 var deleteFile = async (runner, output) => {
   const stat = await runner.stat(output.path);
@@ -914,6 +932,80 @@ import { Unowned as Unowned4 } from "alchemy/AdoptPolicy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 import * as Effect8 from "effect/Effect";
 
+// src/linux/systemctl.ts
+var SYSTEMCTL = "systemctl";
+var SHOW_PROPERTIES = [
+  "Id",
+  "LoadState",
+  "ActiveState",
+  "SubState",
+  "UnitFileState",
+  "FragmentPath",
+  "NeedDaemonReload"
+];
+
+class SystemctlError extends Error {
+  constructor(command, exitCode, stderr) {
+    super(`systemctl ${command} -> ${String(exitCode)}: ${stderr.trim().slice(0, 300)}`);
+    this.name = "SystemctlError";
+  }
+}
+var parseShow = (stdout) => {
+  const fields = new Map;
+  for (const line of stdout.split(`
+`)) {
+    const at = line.indexOf("=");
+    if (at <= 0)
+      continue;
+    const key = line.slice(0, at);
+    if (!fields.has(key))
+      fields.set(key, line.slice(at + 1));
+  }
+  return fields;
+};
+var statusOf = (stdout) => {
+  const fields = parseShow(stdout);
+  const loadState = fields.get("LoadState") ?? "not-found";
+  const unitFileState = fields.get("UnitFileState") ?? "";
+  const fragmentPath = fields.get("FragmentPath") ?? "";
+  const subState = fields.get("SubState") ?? "";
+  return {
+    activeState: fields.get("ActiveState") ?? "inactive",
+    known: loadState !== "not-found" || unitFileState !== "",
+    loadState,
+    needDaemonReload: fields.get("NeedDaemonReload") === "yes",
+    ...subState === "" ? {} : { subState },
+    ...unitFileState === "" ? {} : { unitFileState },
+    ...fragmentPath === "" ? {} : { fragmentPath }
+  };
+};
+var showUnit = async (runner, name) => {
+  const result = await runner.exec([
+    SYSTEMCTL,
+    "show",
+    "--no-pager",
+    "-p",
+    SHOW_PROPERTIES.join(","),
+    "--",
+    name
+  ]);
+  if (result.exitCode !== 0)
+    throw new SystemctlError(`show ${name}`, result.exitCode, result.stderr);
+  return statusOf(result.stdout);
+};
+var run = async (runner, args) => {
+  const result = await runner.exec([SYSTEMCTL, ...args]);
+  if (result.exitCode !== 0) {
+    throw new SystemctlError(args.join(" "), result.exitCode, result.stderr);
+  }
+};
+var daemonReload = (runner) => run(runner, ["daemon-reload"]);
+var enableUnit = (runner, name) => run(runner, ["enable", "--", name]);
+var disableUnit = (runner, name) => run(runner, ["disable", "--", name]);
+var startUnit = (runner, name) => run(runner, ["start", "--", name]);
+var stopUnit = (runner, name) => run(runner, ["stop", "--", name]);
+var restartUnit = (runner, name) => run(runner, ["restart", "--", name]);
+
 // src/linux/unit-form.ts
 var DEFAULT_UNIT_DIRECTORY = "/etc/systemd/system";
 var UNIT_SEARCH_DIRECTORIES = [
@@ -994,80 +1086,6 @@ var textProblems = (text) => {
   return found;
 };
 
-// src/linux/systemctl.ts
-var SYSTEMCTL = "systemctl";
-var SHOW_PROPERTIES = [
-  "Id",
-  "LoadState",
-  "ActiveState",
-  "SubState",
-  "UnitFileState",
-  "FragmentPath",
-  "NeedDaemonReload"
-];
-
-class SystemctlError extends Error {
-  constructor(command, exitCode, stderr) {
-    super(`systemctl ${command} -> ${String(exitCode)}: ${stderr.trim().slice(0, 300)}`);
-    this.name = "SystemctlError";
-  }
-}
-var parseShow = (stdout) => {
-  const fields = new Map;
-  for (const line of stdout.split(`
-`)) {
-    const at = line.indexOf("=");
-    if (at <= 0)
-      continue;
-    const key = line.slice(0, at);
-    if (!fields.has(key))
-      fields.set(key, line.slice(at + 1));
-  }
-  return fields;
-};
-var statusOf = (stdout) => {
-  const fields = parseShow(stdout);
-  const loadState = fields.get("LoadState") ?? "not-found";
-  const unitFileState = fields.get("UnitFileState") ?? "";
-  const fragmentPath = fields.get("FragmentPath") ?? "";
-  const subState = fields.get("SubState") ?? "";
-  return {
-    activeState: fields.get("ActiveState") ?? "inactive",
-    known: loadState !== "not-found" || unitFileState !== "",
-    loadState,
-    needDaemonReload: fields.get("NeedDaemonReload") === "yes",
-    ...subState === "" ? {} : { subState },
-    ...unitFileState === "" ? {} : { unitFileState },
-    ...fragmentPath === "" ? {} : { fragmentPath }
-  };
-};
-var showUnit = async (runner, name) => {
-  const result = await runner.exec([
-    SYSTEMCTL,
-    "show",
-    "--no-pager",
-    "-p",
-    SHOW_PROPERTIES.join(","),
-    "--",
-    name
-  ]);
-  if (result.exitCode !== 0)
-    throw new SystemctlError(`show ${name}`, result.exitCode, result.stderr);
-  return statusOf(result.stdout);
-};
-var run = async (runner, args) => {
-  const result = await runner.exec([SYSTEMCTL, ...args]);
-  if (result.exitCode !== 0) {
-    throw new SystemctlError(args.join(" "), result.exitCode, result.stderr);
-  }
-};
-var daemonReload = (runner) => run(runner, ["daemon-reload"]);
-var enableUnit = (runner, name) => run(runner, ["enable", "--", name]);
-var disableUnit = (runner, name) => run(runner, ["disable", "--", name]);
-var startUnit = (runner, name) => run(runner, ["start", "--", name]);
-var stopUnit = (runner, name) => run(runner, ["stop", "--", name]);
-var restartUnit = (runner, name) => run(runner, ["restart", "--", name]);
-
 // src/linux/unit-settle.ts
 var refuse4 = (name, message) => new Error(`Systemd.Unit ${name}: ${message}`);
 var attributesOf = (props, unitSha256, status) => ({
@@ -1123,21 +1141,13 @@ var settle = async (runner, props, step) => {
   return settled;
 };
 
-// src/linux/unit-lifecycle.ts
-var encoder2 = new TextEncoder;
+// src/linux/unit-preflight.ts
 var decoder2 = new TextDecoder;
 var assertValid = (props, expect) => {
   const found = unitProblems(props, expect);
   if (found.length > 0)
     throw refuse4(props.name, found.join("; "));
 };
-var readUnit = async (runner, props) => {
-  const bytes = await runner.readFile(unitPathFor(props));
-  const status = await showUnit(runner, props.name);
-  if (bytes === undefined && !status.known)
-    return;
-  return attributesOf(props, bytes === undefined ? "" : digestOf2(decoder2.decode(bytes)), status);
-};
 var assertMayWrite = (runner, name) => {
   if (canActAsRoot(runner))
     return;
@@ -1148,10 +1158,40 @@ var assertUsable = (props, status) => {
     throw refuse4(props.name, "is masked. If that is stale, `systemctl unmask` it deliberately, then redeploy. Nothing " + "was written.");
   }
 };
+var assertUnclaimed = async (runner, props) => {
+  const path = unitPathFor(props);
+  const bytes = await runner.readFile(path);
+  const live = bytes === undefined ? undefined : digestOf2(decoder2.decode(bytes));
+  if (live !== undefined && live !== digestOf2(unitText(props))) {
+    throw refuse4(props.name, `${path} is already on this host and is not this resource. Remove it, or declare it as a ` + "new resource and deploy with --adopt.");
+  }
+};
+var assertRenameTarget = async (runner, old, name) => {
+  assertMayWrite(runner, old.name);
+  assertMayWrite(runner, name);
+  assertUsable({ name }, await showUnit(runner, name));
+};
+var assertReplaceable = async (runner, next, old, expect) => {
+  assertValid(next, expect);
+  await assertRenameTarget(runner, old, next.name);
+  await assertUnclaimed(runner, next);
+  await runner.checkWrite?.(unitPathFor(next), UNIT_WRITE);
+};
+
+// src/linux/unit-lifecycle.ts
+var encoder2 = new TextEncoder;
+var decoder3 = new TextDecoder;
+var readUnit = async (runner, props) => {
+  const bytes = await runner.readFile(unitPathFor(props));
+  const status = await showUnit(runner, props.name);
+  if (bytes === undefined && !status.known)
+    return;
+  return attributesOf(props, bytes === undefined ? "" : digestOf2(decoder3.decode(bytes)), status);
+};
 var diffUnit = async (runner, news, output, expect) => {
   assertValid(news, expect);
   if (news.name !== output.name || unitPathFor(news) !== output.unitPath) {
-    assertMayWrite(runner, news.name);
+    await assertReplaceable(runner, news, output, expect);
     return { action: "replace", deleteFirst: true };
   }
   const desired2 = digestOf2(unitText(news));
@@ -1183,8 +1223,10 @@ var reconcileUnit = async (runner, props, output, adopt = false, expect) => {
   const text = unitText(props);
   const desired2 = digestOf2(text);
   const before = await runner.readFile(path);
-  const liveSha = before === undefined ? undefined : digestOf2(decoder2.decode(before));
+  const liveSha = before === undefined ? undefined : digestOf2(decoder3.decode(before));
   const moved = output !== undefined && (output.name !== props.name || output.unitPath !== path);
+  if (moved && output !== undefined)
+    await assertReplaceable(runner, props, output, expect);
   const prior = moved ? undefined : output;
   if (prior === undefined && !(adopt && output === undefined) && liveSha !== undefined && liveSha !== desired2) {
     throw refuse4(props.name, `${path} is already on this host and is not this resource. Remove it, or declare it as a ` + "new resource and deploy with --adopt.");
@@ -1232,7 +1274,12 @@ var diffHandler = (runner, instanceId, news, output, expect) => {
   if (isResolved3(news))
     return lift(() => diffUnit(runner, news, output, expect));
   const name = resolvedString(news, "name");
-  return Effect8.succeed(name !== undefined && name !== output.name ? { action: "replace", deleteFirst: true } : undefined);
+  if (name === undefined || name === output.name)
+    return Effect8.succeed(undefined);
+  return lift(async () => {
+    await assertRenameTarget(runner, output, name);
+    return { action: "replace", deleteFirst: true };
+  });
 };
 var reconcileHandler = (runner, args, expect) => Effect8.flatMap(adoptsAtApply(args), (adopt) => lift(() => reconcileUnit(runner, args.news, args.output, adopt, expect)));
 var deleteHandler = (runner, output) => lift(() => deleteUnit(runner, output));
@@ -1550,5 +1597,5 @@ export {
   sshRunner
 };
 
-//# debugId=36C2172DF713B75564756E2164756E21
+//# debugId=999A0F25FFF74BEF64756E2164756E21
 //# sourceMappingURL=index.js.map