@homeflare/alchemy 0.20.0 → 0.21.0

package/dist/launchd/index.js

@@ -182,6 +182,31 @@ var refuseTakeover = (owner, what) => Effect4.gen(function* () {
 });
 var claimFor = (owner) => (what) => refuseTakeover(owner, what);
 
+// src/launchd/file-identity.ts
+var sameEntry = (a, b) => {
+  if (a === undefined || b === undefined)
+    return false;
+  if (a.dev === undefined || a.ino === undefined || b.dev === undefined || b.ino === undefined) {
+    return;
+  }
+  return a.dev === b.dev && a.ino === b.ino;
+};
+var oneFile = async (runner, a, b) => {
+  if (a === b)
+    return true;
+  const [left, right] = await Promise.all([runner.stat(a), runner.stat(b)]);
+  return sameEntry(left, right);
+};
+var leaveOldPath = async (runner, oldPath, path, remove, refuse) => {
+  const same = await oneFile(runner, oldPath, path);
+  if (same === true)
+    return;
+  await remove();
+  if (same === undefined && await runner.stat(path) === undefined) {
+    throw refuse(path, `removing the old path ${oldPath} removed this file too: they are one file under two ` + "spellings (a symlinked parent, or case on a case-insensitive volume). Deploy again to " + "reinstall it, and keep one spelling.");
+  }
+};
+
 // src/launchd/host-effect.ts
 import * as Effect5 from "effect/Effect";
 var lift = (step) => Effect5.tryPromise({
@@ -195,79 +220,6 @@ var resolvedString = (news, key) => {
   return typeof value === "string" ? value : undefined;
 };
 
-// src/launchd/secret-tripwire.ts
-var ALTERNATIVE = "props are stored unencrypted in Alchemy state. Have a secret renderer (e.g. openbao-agent) " + "write it to a root-owned file and declare the file path instead (FOO_FILE=/path, --foo-file /path).";
-var SECRET_NAME = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|API_?KEY|ACCESS_KEY|PRIVATE_KEY|SECRET_KEY|CREDENTIALS?)$/i;
-var INLINE_FLAG = /^--?[a-z0-9-]*(?:token|password|passwd|passphrase|secret|api-?key)=./i;
-var BARE_FLAG = /^--?(?:[a-z0-9]+-)*(?:token|password|passwd|passphrase|secret|api-?key)$/i;
-var PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
-var keyLeaves = (value, path) => {
-  if (typeof value === "string")
-    return PRIVATE_KEY.test(value) ? [path] : [];
-  if (Array.isArray(value)) {
-    return value.flatMap((item, index) => keyLeaves(item, `${path}[${String(index)}]`));
-  }
-  if (typeof value === "object" && value !== null) {
-    return Object.entries(value).flatMap(([key, item]) => keyLeaves(item, `${path}.${key}`));
-  }
-  return [];
-};
-var jobSecretProblems = (environment, argv, extraKeys) => {
-  const found = [];
-  for (const [name, value] of Object.entries(environment ?? {})) {
-    if (SECRET_NAME.test(name))
-      found.push(`environment ${name} looks like a secret: ${ALTERNATIVE}`);
-    else if (PRIVATE_KEY.test(value))
-      found.push(`environment ${name} holds a private key: ${ALTERNATIVE}`);
-  }
-  for (const [index, arg] of argv.entries()) {
-    if (INLINE_FLAG.test(arg)) {
-      found.push(`programArguments[${String(index)}] passes a secret inline: ${ALTERNATIVE}`);
-    } else if (BARE_FLAG.test(arg) && index + 1 < argv.length) {
-      found.push(`programArguments[${String(index + 1)}] follows a secret flag: ${ALTERNATIVE}`);
-    } else if (PRIVATE_KEY.test(arg)) {
-      found.push(`programArguments[${String(index)}] holds a private key: ${ALTERNATIVE}`);
-    }
-  }
-  for (const path of keyLeaves(extraKeys ?? {}, "extraKeys")) {
-    found.push(`${path} holds a private key: ${ALTERNATIVE}`);
-  }
-  return found;
-};
-var fileSecretProblems = (content) => PRIVATE_KEY.test(content) ? [`content holds a private key: ${ALTERNATIVE}`] : [];
-
-// src/launchd/host-file-form.ts
-var DEFAULT_MODE = 420;
-var identityProblems = (name, value) => {
-  if (value === undefined)
-    return [];
-  if (typeof value === "number") {
-    return Number.isSafeInteger(value) && value >= 0 ? [] : [`${name} must be a non-negative integer id`];
-  }
-  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
-};
-var pathProblems = (path) => {
-  const found = [];
-  if (!path.startsWith("/"))
-    found.push("path must be absolute");
-  if (path.endsWith("/") || path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..")) {
-    found.push('path must be normalised (no trailing slash, no empty, "." or ".." segments)');
-  }
-  if (path.includes("\x00"))
-    found.push("path contains NUL");
-  return found;
-};
-var fileProblems = (props) => {
-  const found = pathProblems(props.path);
-  const mode = props.mode ?? DEFAULT_MODE;
-  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
-    found.push("mode must be 0–0o7777");
-  found.push(...identityProblems("owner", props.owner));
-  found.push(...identityProblems("group", props.group));
-  found.push(...fileSecretProblems(props.content));
-  return found;
-};
-
 // src/launchd/job-form.ts
 import { createHash } from "node:crypto";
 
@@ -466,33 +418,22 @@ class HostRunnerService extends Context.Service()("homeflare/launchd/HostRunner"
 var hostRunnerLayer = (runner) => Layer.succeed(HostRunnerService, runner);
 var canActAsRoot = (runner) => runner.privileged || runner.effectiveUid() === 0;
 
-// src/launchd/host-file-lifecycle.ts
-var refuse = (path, message) => new Error(`Host.File ${path}: ${message}`);
+// src/launchd/file-converge.ts
 var numericId = (value) => typeof value === "number" ? value : /^\d+$/.test(value) ? Number(value) : undefined;
-var desiredFile = async (runner, props) => {
-  const found = fileProblems(props);
-  if (found.length > 0)
-    throw refuse(props.path, found.join("; "));
-  const bytes = new TextEncoder().encode(props.content);
+var resolveIds = async (runner, declared, path, refuse) => {
   let uid;
   let gid;
-  if (props.owner !== undefined) {
-    uid = numericId(props.owner) ?? (await runner.lookupUser(String(props.owner)))?.uid;
+  if (declared.owner !== undefined) {
+    uid = numericId(declared.owner) ?? (await runner.lookupUser(String(declared.owner)))?.uid;
     if (uid === undefined)
-      throw refuse(props.path, `no user ${String(props.owner)} on this host`);
+      throw refuse(path, `no user ${String(declared.owner)} on this host`);
   }
-  if (props.group !== undefined) {
-    gid = numericId(props.group) ?? await runner.lookupGroup(String(props.group));
+  if (declared.group !== undefined) {
+    gid = numericId(declared.group) ?? await runner.lookupGroup(String(declared.group));
     if (gid === undefined)
-      throw refuse(props.path, `no group ${String(props.group)} on this host`);
+      throw refuse(path, `no group ${String(declared.group)} on this host`);
   }
-  return {
-    bytes,
-    mode: props.mode ?? DEFAULT_MODE,
-    sha256: sha256Hex(bytes),
-    ...uid === undefined ? {} : { uid },
-    ...gid === undefined ? {} : { gid }
-  };
+  return { ...uid === undefined ? {} : { uid }, ...gid === undefined ? {} : { gid } };
 };
 var readFileAttributes = async (runner, path) => {
   const stat = await runner.stat(path);
@@ -513,52 +454,64 @@ var writeOptionsOf = (want) => ({
   ...want.uid === undefined ? {} : { uid: want.uid },
   ...want.gid === undefined ? {} : { gid: want.gid }
 });
-var matches = (live, want) => live.sha256 === want.sha256 && live.mode === want.mode && (want.uid === undefined || live.uid === want.uid) && (want.gid === undefined || live.gid === want.gid);
-var diffFile = async (runner, news, output) => {
-  const want = await desiredFile(runner, news);
+var fileMatches = (live, want) => live.sha256 === want.sha256 && live.mode === want.mode && (want.uid === undefined || live.uid === want.uid) && (want.gid === undefined || live.gid === want.gid);
+var diffTarget = async (runner, want, output) => {
   const writes = async (diff) => {
-    await runner.checkWrite?.(news.path, writeOptionsOf(want));
+    await runner.checkWrite?.(want.path, writeOptionsOf(want));
     return diff;
   };
-  if (news.path !== output.path)
-    return writes({ action: "replace" });
+  if (want.path !== output.path) {
+    const same = await oneFile(runner, want.path, output.path);
+    return writes({ action: same === true ? "update" : "replace" });
+  }
   if (want.sha256 !== output.sha256)
     return writes({ action: "update" });
-  const live = await readFileAttributes(runner, news.path);
-  return live !== undefined && matches(live, want) ? { action: "noop" } : writes({ action: "update" });
+  const live = await readFileAttributes(runner, want.path);
+  return live !== undefined && fileMatches(live, want) ? { action: "noop" } : writes({ action: "update" });
 };
-var reconcileFile = async (runner, props, output, adopt = false) => {
-  const want = await desiredFile(runner, props);
+var convergeFile = async (runner, spec, output, adopt = false) => {
+  const { want, refuse } = spec;
+  const path = want.path;
   if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {
-    throw refuse(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy as root ` + "or through a privileged HostRunner (sudoRunner() with this path under a prefix). This " + "provider never calls sudo itself.");
+    throw refuse(path, `owner ${String(spec.owner)} is not the deploying user; only root may chown. Deploy as root ` + "or through a privileged HostRunner (sudoRunner() with this path under a prefix). This " + "provider never calls sudo itself.");
   }
-  const stat = await runner.stat(props.path);
+  const stat = await runner.stat(path);
   if (stat !== undefined && stat.kind !== "file") {
-    throw refuse(props.path, `is a ${stat.kind}; remove it from whatever owns it before declaring it here`);
+    throw refuse(path, `is a ${stat.kind}; remove it from whatever owns it before declaring it here`);
   }
-  const before = stat === undefined ? undefined : await readFileAttributes(runner, props.path);
-  const moved = output !== undefined && output.path !== props.path;
+  const before = stat === undefined ? undefined : await readFileAttributes(runner, path);
+  const moved = output !== undefined && output.path !== path;
   const prior = moved ? undefined : output;
   const takeOver = adopt && output === undefined;
-  if (prior === undefined && before !== undefined && !matches(before, want) && !takeOver) {
-    throw refuse(props.path, "already exists and is not this resource. Remove it, or declare it as a new resource and " + "deploy with --adopt.");
+  if (prior === undefined && before !== undefined && !fileMatches(before, want) && !takeOver) {
+    throw refuse(path, "already exists and is not this resource. Remove it, or declare it as a new resource and " + "deploy with --adopt.");
   }
-  if (before === undefined || !matches(before, want)) {
-    await runner.writeFileAtomic(props.path, want.bytes, writeOptionsOf(want));
+  if (before === undefined || !fileMatches(before, want)) {
+    const bytes = await spec.bytesFor(before);
+    if (sha256Hex(bytes) !== want.sha256) {
+      throw refuse(path, `the bytes to write do not hash to ${want.sha256}. Nothing was written.`);
+    }
+    await runner.writeFileAtomic(path, bytes, writeOptionsOf(want));
   }
-  const after = await readFileAttributes(runner, props.path);
-  if (after === undefined || !matches(after, want)) {
+  const rollBack = async () => {
     if (before === undefined)
-      await runner.removeFile(props.path).catch(() => {
+      await runner.removeFile(path).catch(() => {
         return;
       });
-    throw refuse(props.path, "the write returned but the file on disk does not match the declaration");
+  };
+  const after = await readFileAttributes(runner, path).catch(async (cause) => {
+    await rollBack();
+    throw refuse(path, `the write returned but reading it back failed: ${String(cause)}`);
+  });
+  if (after === undefined || !fileMatches(after, want)) {
+    await rollBack();
+    throw refuse(path, "the write returned but the file on disk does not match the declaration");
   }
   if (moved)
-    await deleteFile(runner, output);
+    await leaveOldPath(runner, output.path, path, () => removeWholeFile(runner, output, refuse), refuse);
   return after;
 };
-var deleteFile = async (runner, output) => {
+var removeWholeFile = async (runner, output, refuse) => {
   const stat = await runner.stat(output.path);
   if (stat === undefined)
     return;
@@ -567,6 +520,102 @@ var deleteFile = async (runner, output) => {
   await runner.removeFile(output.path);
 };
 
+// src/launchd/secret-tripwire.ts
+var ALTERNATIVE = "props are stored unencrypted in Alchemy state. Have a secret renderer (e.g. openbao-agent) " + "write it to a root-owned file and declare the file path instead (FOO_FILE=/path, --foo-file /path).";
+var SECRET_NAME = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|API_?KEY|ACCESS_KEY|PRIVATE_KEY|SECRET_KEY|CREDENTIALS?)$/i;
+var INLINE_FLAG = /^--?[a-z0-9-]*(?:token|password|passwd|passphrase|secret|api-?key)=./i;
+var BARE_FLAG = /^--?(?:[a-z0-9]+-)*(?:token|password|passwd|passphrase|secret|api-?key)$/i;
+var PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
+var keyLeaves = (value, path) => {
+  if (typeof value === "string")
+    return PRIVATE_KEY.test(value) ? [path] : [];
+  if (Array.isArray(value)) {
+    return value.flatMap((item, index) => keyLeaves(item, `${path}[${String(index)}]`));
+  }
+  if (typeof value === "object" && value !== null) {
+    return Object.entries(value).flatMap(([key, item]) => keyLeaves(item, `${path}.${key}`));
+  }
+  return [];
+};
+var jobSecretProblems = (environment, argv, extraKeys) => {
+  const found = [];
+  for (const [name, value] of Object.entries(environment ?? {})) {
+    if (SECRET_NAME.test(name))
+      found.push(`environment ${name} looks like a secret: ${ALTERNATIVE}`);
+    else if (PRIVATE_KEY.test(value))
+      found.push(`environment ${name} holds a private key: ${ALTERNATIVE}`);
+  }
+  for (const [index, arg] of argv.entries()) {
+    if (INLINE_FLAG.test(arg)) {
+      found.push(`programArguments[${String(index)}] passes a secret inline: ${ALTERNATIVE}`);
+    } else if (BARE_FLAG.test(arg) && index + 1 < argv.length) {
+      found.push(`programArguments[${String(index + 1)}] follows a secret flag: ${ALTERNATIVE}`);
+    } else if (PRIVATE_KEY.test(arg)) {
+      found.push(`programArguments[${String(index)}] holds a private key: ${ALTERNATIVE}`);
+    }
+  }
+  for (const path of keyLeaves(extraKeys ?? {}, "extraKeys")) {
+    found.push(`${path} holds a private key: ${ALTERNATIVE}`);
+  }
+  return found;
+};
+var fileSecretProblems = (content) => PRIVATE_KEY.test(content) ? [`content holds a private key: ${ALTERNATIVE}`] : [];
+
+// src/launchd/host-file-form.ts
+var DEFAULT_MODE = 420;
+var identityProblems = (name, value) => {
+  if (value === undefined)
+    return [];
+  if (typeof value === "number") {
+    return Number.isSafeInteger(value) && value >= 0 ? [] : [`${name} must be a non-negative integer id`];
+  }
+  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
+};
+var pathProblems = (path) => {
+  const found = [];
+  if (!path.startsWith("/"))
+    found.push("path must be absolute");
+  if (path.endsWith("/") || path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..")) {
+    found.push('path must be normalised (no trailing slash, no empty, "." or ".." segments)');
+  }
+  if (path.includes("\x00"))
+    found.push("path contains NUL");
+  return found;
+};
+var fileProblems = (props) => {
+  const found = pathProblems(props.path);
+  const mode = props.mode ?? DEFAULT_MODE;
+  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
+    found.push("mode must be 0–0o7777");
+  found.push(...identityProblems("owner", props.owner));
+  found.push(...identityProblems("group", props.group));
+  found.push(...fileSecretProblems(props.content));
+  return found;
+};
+
+// src/launchd/host-file-lifecycle.ts
+var refuse = (path, message) => new Error(`Host.File ${path}: ${message}`);
+var desiredFile = async (runner, props) => {
+  const found = fileProblems(props);
+  if (found.length > 0)
+    throw refuse(props.path, found.join("; "));
+  const bytes = new TextEncoder().encode(props.content);
+  return {
+    bytes,
+    mode: props.mode ?? DEFAULT_MODE,
+    path: props.path,
+    sha256: sha256Hex(bytes),
+    ...await resolveIds(runner, props, props.path, refuse)
+  };
+};
+var diffFile = async (runner, news, output) => diffTarget(runner, await desiredFile(runner, news), output);
+var reconcileFile = async (runner, props, output, adopt = false) => {
+  const want = await desiredFile(runner, props);
+  const spec = { bytesFor: async () => want.bytes, owner: props.owner, refuse, want };
+  return convergeFile(runner, spec, output, adopt);
+};
+var deleteFile = (runner, output) => removeWholeFile(runner, output, refuse);
+
 // src/launchd/host-file.ts
 var HostFile = Resource("Host.File");
 var HostFileProvider = () => Provider.effect(HostFile, Effect6.gen(function* () {
@@ -585,7 +634,9 @@ var HostFileProvider = () => Provider.effect(HostFile, Effect6.gen(function* ()
       if (isResolved(news))
         return lift(() => diffFile(runner, news, output));
       const path = resolvedString(news, "path");
-      return Effect6.succeed(path !== undefined && path !== output.path ? { action: "replace" } : undefined);
+      if (path === undefined || path === output.path)
+        return Effect6.succeed(undefined);
+      return lift(async () => await oneFile(runner, path, output.path) === true ? undefined : { action: "replace" });
     },
     reconcile: ({ fqn, instanceId, news, output }) => Effect6.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) => lift(() => reconcileFile(runner, news, output, adopt))),
     delete: ({ output }) => lift(() => deleteFile(runner, output))
@@ -1126,7 +1177,9 @@ var localRunner = (options = {}) => {
       try {
         const stats = await lstat(path);
         return {
+          dev: stats.dev,
           gid: stats.gid,
+          ino: stats.ino,
           kind: kindOf(stats),
           mode: stats.mode & 4095,
           size: stats.size,
@@ -1558,5 +1611,5 @@ export {
   sudoRunner
 };
 
-//# debugId=59F08ED5EC139A6064756E2164756E21
+//# debugId=3EE0567FCAB27DCF64756E2164756E21
 //# sourceMappingURL=index.js.map