@homeflare/alchemy 0.2.0 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo and Talos.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/openbao/bao-http.ts

@@ -14,6 +14,7 @@
 import * as Context from 'effect/Context';
 import * as Effect from 'effect/Effect';
 import * as Option from 'effect/Option';
+import * as Schedule from 'effect/Schedule';
 import * as Semaphore from 'effect/Semaphore';
 import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
 import * as Headers from 'effect/unstable/http/Headers';
@@ -66,6 +67,19 @@ export const BaoGate = Context.Reference<Semaphore.Semaphore>('homeflare/openbao
  */
 const TIMEOUT = '60 seconds';
 
+/**
+ * Mesh in front of a remote OpenBao drops connections under Alchemy's unbounded
+ * fan-out. Status 0 is transport, not an OpenBao 4xx — retry twice. Measured
+ * 2026-09-16 against api.v.homeflare.dev: a 585-role plan died mid-diff with
+ * `no response: (no errors given)` while the vault stayed unsealed.
+ */
+const retryTransport = <A, R>(effect: Effect.Effect<A, BaoError, R>) =>
+  Effect.retry(effect, {
+    schedule: Schedule.spaced('750 millis'),
+    times: 2,
+    while: (error: BaoError) => error.status === 0,
+  });
+
 /**
  * ⛔ EFFECT RECORDS EVERY REQUEST HEADER ON THE CLIENT SPAN and redacts only the names in
  *   `Headers.CurrentRedactedNames` — by default authorization, cookie, set-cookie and x-api-key
@@ -142,10 +156,12 @@ export const baoCall = (
     // ★ THE PERMIT WRAPS THE TIMEOUT, NOT THE REVERSE: a call queued behind the gate is not yet
     //   talking to OpenBao, so its wait must not count against the 60 seconds.
     const gate = yield* BaoGate;
-    const { status, text } = yield* exchange.pipe(
-      overSocket(address.socket, method, path),
-      redactingToken,
-      Semaphore.withPermits(gate, 1),
+    const { status, text } = yield* retryTransport(
+      exchange.pipe(
+        overSocket(address.socket, method, path),
+        redactingToken,
+        Semaphore.withPermits(gate, 1),
+      ),
     );
     const outcome = settle(intent, method, path, status, text);
     return 'error' in outcome ? yield* Effect.fail(outcome.error) : outcome.body;

package/src/openbao/index.ts

@@ -8,9 +8,18 @@
  * ★ Anything unlisted is still reachable by path if you genuinely need it — that is a
  *   deliberate, visible act rather than an accident of barrelling.
  */
-export { BaoAuthRoleProvider } from './auth-role.ts';
-export { BaoCloudflareRoleProvider } from './cloudflare-role.ts';
-export { BaoMountProvider } from './mount.ts';
+export { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
+export { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';
+export {
+  CloudflarePermissionGroups,
+  permissionGroupsFromEngine,
+  permissionGroupsFromLiveRoles,
+} from './cloudflare-permission-groups.ts';
+export type { CloudflareZone, ExpandedRole } from './cloudflare-roles-expand.ts';
+export { expandAccount, expandAll, mountName } from './cloudflare-roles-expand.ts';
+export type { RolesConfig, SurfaceSpec } from './cloudflare-roles-config.ts';
+export { parseRolesConfig } from './cloudflare-roles-config.ts';
+export { BaoMount, BaoMountProvider } from './mount.ts';
 export { BaoPkiRoleProvider } from './pki-role.ts';
 export { BaoPolicy, BaoPolicyProvider } from './policy.ts';
 export { BaoProxmoxRole, BaoProxmoxRoleProvider } from './proxmox-role.ts';

package/src/proxmox/client.test.ts

@@ -55,7 +55,13 @@ const remapFetch = (
         url.port = String(port);
         return underlying(url, init);
       }
-      return underlying(input, init);
+      // ⛔ NEVER fall through to the real resolver. `.test` is reserved (RFC 2606) but
+      //   GitHub's Linux runners sometimes hang on it until node:test's 5s timeout —
+      //   measured 2026-09-16: release verify failed on "skips an unresolvable first
+      //   member" while `ci` on the same SHA passed. The file header says no live hosts.
+      return Promise.reject(
+        Object.assign(new Error(`getaddrinfo ENOTFOUND ${url.hostname}`), { code: 'ENOTFOUND' }),
+      );
     },
     { preconnect: globalThis.fetch.preconnect },
   );