@homeflare/alchemy 0.36.0 → 0.37.0

package/README.md

@@ -7,6 +7,7 @@ bun add @homeflare/alchemy alchemy@2.0.0-beta.79 effect@4.0.0-rc.115 \
         @effect/platform-node@4.0.0-rc.115 mime@4.1.0 \
         @distilled.cloud/cloudflare@1.0.0-rc.12 @distilled.cloud/forgejo@1.0.0-rc.12 \
         @distilled.cloud/discord@1.0.0-rc.12 @distilled.cloud/google-workspace@1.0.0-rc.12 \
+        @distilled.cloud/argocd@1.0.0-rc.12 \
         @effect/sql-pg@4.0.0-rc.115
 ```
 
@@ -288,6 +289,19 @@ export const help =
   });
 ```
 
+## Argo CD — `@homeflare/alchemy/argocd`
+
+`Argocd.Repository`, `Argocd.RepoCreds` and `Argocd.Cluster` declare Argo CD's own REST-managed
+objects (backed by labeled `Secret`s, not CRDs), generated from `@distilled.cloud/argocd`. Built
+2026-09-24, **ahead of need** — no Talos-on-PVE cluster or Argo CD instance exists yet; every test
+runs against a fake. `Application`/`AppProject` are genuinely Kubernetes CRDs and are deliberately
+NOT here — declare them with upstream Alchemy's own `Kubernetes.Manifest` instead:
+[docs/argocd.md](./docs/argocd.md) and [docs/argocd-kubernetes.md](./docs/argocd-kubernetes.md).
+
+```ts
+import { ArgocdRepository, providers } from '@homeflare/alchemy/argocd';
+```
+
 ## UniFi Network — `@homeflare/alchemy/unifi`
 
 `Unifi.Network` and `Unifi.FirewallZone`, generated from Ubiquiti's own UniFi Network

package/dist/argocd/cluster.d.ts

@@ -0,0 +1,102 @@
+/**
+ * `Argocd.Cluster` — a target Kubernetes cluster registered with an Argo CD instance
+ * (`/api/v1/clusters`) so Applications can deploy onto it. REST-managed, not a CRD; see
+ * `docs/argocd.md`. This is how the house will register the Talos-on-PVE cluster itself with
+ * Argo CD once both exist — Argo CD's own control-plane cluster (where Argo CD is installed) is
+ * registered implicitly as `https://kubernetes.default.svc` and never needs this resource.
+ *
+ * ⚠️ ONLY BEARER-TOKEN AND STATIC TLS CLIENT-CERT AUTH ARE SUPPORTED. `V1alpha1ClusterConfig` also
+ *   carries `awsAuthConfig` (EKS IAM) and `execProviderConfig` (an exec plugin) — measured in
+ *   `services/argocd.ts`, distilled homeflare/base — neither of which applies to a Talos cluster;
+ *   left unbuilt rather than modeled and untested.
+ *
+ * ⚠️ NO LIVE ARGO CD INSTANCE EXISTS ON THE ESTATE (2026-09-24) — see `docs/argocd.md`.
+ *
+ * ⛔ `defaultRemovalPolicy: 'retain'` — deregistering a cluster Applications still target breaks
+ *   their sync. `delete` below is fully implemented; opt in with `.pipe(RemovalPolicy.destroy())`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as argocd from '@distilled.cloud/argocd/argocd';
+import * as Effect from 'effect/Effect';
+import { type FromEnv } from '../secrets/write-only.ts';
+import { type ArgocdRequirements, type ArgocdSpec } from './resource.ts';
+export interface ClusterCredentialRefs {
+    readonly password?: FromEnv;
+    readonly bearerToken?: FromEnv;
+    readonly tlsClientKeyData?: FromEnv;
+}
+export interface ClusterProps {
+    /** The cluster's API server URL — identity key; changing it is a replace. */
+    server: string;
+    name?: string;
+    /** Restricts this cluster to one Argo CD project; omit for every project. */
+    project?: string;
+    namespaces?: readonly string[];
+    clusterResources?: boolean;
+    labels?: Readonly<Record<string, string>>;
+    annotations?: Readonly<Record<string, string>>;
+    proxyUrl?: string;
+    username?: string;
+    tlsCaData?: string;
+    /** The client certificate itself — public, unlike its key. */
+    tlsCertData?: string;
+    tlsInsecure?: boolean;
+    tlsServerName?: string;
+    /** Write-only — never a value here, only env var names. See the module header. */
+    credentials?: ClusterCredentialRefs;
+}
+export interface ClusterAttributes {
+    server: string;
+    name: string | undefined;
+    project: string | undefined;
+    namespaces: readonly string[] | undefined;
+    clusterResources: boolean | undefined;
+    labels: Readonly<Record<string, string>> | undefined;
+    annotations: Readonly<Record<string, string>> | undefined;
+    proxyUrl: string | undefined;
+    username: string | undefined;
+    tlsCaData: string | undefined;
+    tlsCertData: string | undefined;
+    tlsInsecure: boolean | undefined;
+    tlsServerName: string | undefined;
+}
+export interface ArgocdCluster extends Resource<'Argocd.Cluster', ClusterProps, ClusterAttributes, never, ArgocdRequirements> {
+}
+export declare const ArgocdCluster: import("alchemy").ResourceClass<ArgocdCluster>;
+declare const ArgocdClusterSecretEnvUnsetError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ArgocdClusterSecretEnvUnsetError";
+} & Readonly<A>;
+/** Domain refusal, not a distilled error — a declared credential's env var is unset at call time. */
+export declare class ArgocdClusterSecretEnvUnsetError extends ArgocdClusterSecretEnvUnsetError_base<{
+    readonly message: string;
+}> {
+}
+type ClusterError = argocd.GetClusterServiceError | argocd.CreateClusterServiceError | argocd.DeleteClusterServiceError | ArgocdClusterSecretEnvUnsetError;
+/** ★ EXPORTED for direct testing against `fake-argocd.ts` — see `cluster.test.ts`. */
+export declare const spec: ArgocdSpec<ClusterProps, argocd.V1alpha1Cluster, ClusterAttributes, ClusterError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: ClusterProps;
+    }) => Effect.Effect<ClusterAttributes | undefined, ClusterError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: ({ news, output }: {
+        news: import("alchemy").Input<ClusterProps>;
+        output: ClusterAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'replace';
+    } | {
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, ClusterError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: ({ news }: {
+        news: ClusterProps;
+    }) => Effect.Effect<ClusterAttributes, ClusterError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds }: {
+        olds: ClusterProps;
+    }) => Effect.Effect<void, ClusterError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const ArgocdClusterProvider: () => import("effect/Layer").Layer<Provider.Provider<ArgocdCluster>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export {};
+//# sourceMappingURL=cluster.d.ts.map

package/dist/argocd/cluster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster.d.ts","sourceRoot":"","sources":["../../src/argocd/cluster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,gCAAgC,CAAC;AAEzD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,OAAO,EAAc,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,UAAU,EAA2B,MAAM,eAAe,CAAC;AAElG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,WAAW,CAAC,EAAE,qBAAqB,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC1C,gBAAgB,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACrD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAC1D,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,kBAAkB,CACnB;CAAG;AAEJ,eAAO,MAAM,aAAa,gDAExB,CAAC;;;;AAEH,qGAAqG;AACrG,qBAAa,gCAAiC,SAAQ,sCAEpD;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AA0EL,KAAK,YAAY,GACb,MAAM,CAAC,sBAAsB,GAC7B,MAAM,CAAC,yBAAyB,GAChC,MAAM,CAAC,yBAAyB,GAChC,gCAAgC,CAAC;AAErC,sFAAsF;AACtF,eAAO,MAAM,IAAI,EAAE,UAAU,CAC3B,YAAY,EACZ,MAAM,CAAC,eAAe,EACtB,iBAAiB,EACjB,YAAY,CA8Cb,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;CAAuB,CAAC;AAE7C,eAAO,MAAM,qBAAqB,mIACmD,CAAC"}

package/dist/argocd/credentials.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Argo CD credentials — a bearer-token REFERENCE, resolved lazily, never a prop.
+ *
+ * ⛔ NO TOKEN IS EVER A PROP OR AN ATTRIBUTE. Alchemy persists Attributes unencrypted
+ *   (State/StateEncoding.ts@v2.0.0-beta.79#encodeState), so nothing a stack file holds may be a
+ *   credential. `@distilled.cloud/argocd/Credentials` already ships exactly the shape this asks
+ *   for: `Credentials` is a lazy `Context.Service<Credentials, Effect.Effect<Config>>`, resolved
+ *   on the calling fiber inside each operation (`ArgocdProtocol`'s `credentials:` field), never at
+ *   layer build. This file re-exports it rather than re-implementing it — the same choice
+ *   `../discord/credentials.ts` and `../forgejo` (via `@distilled.cloud/forgejo/Credentials`) made.
+ *
+ * ★ `CredentialsFromEnv` reads `ARGOCD_TOKEN` (required) and `ARGOCD_SERVER` (optional instance
+ *   origin, default `https://localhost:8080`) — the distilled package's own names, unchanged here
+ *   so a consumer never has to guess which var this family reads.
+ *
+ * ⚠️ NO `credentials(...)` FACTORY EXISTS ON THIS SDK, unlike Discord/Grafana's — measured against
+ *   `packages/argocd/src/credentials.ts` (distilled homeflare/base): only `fromToken({ token,
+ *   apiBaseUrl? })` and `CredentialsFromEnv`. `fake-argocd.ts` builds its test layer from
+ *   `fromToken` directly.
+ *
+ * ⚠️ NO OpenBao MINT YET, same as every other family in this kit today (`Alchemy.Stack({ secrets
+ *   })` is unreleased, PR 1728, `main`-only). A deploy process exports `ARGOCD_TOKEN` itself —
+ *   this package never reads it from a file.
+ *
+ * ⚠️ NO LIVE ARGO CD INSTANCE EXISTS ON THE ESTATE YET (2026-09-24) — this family is built ahead
+ *   of the Talos-on-PVE cluster it targets, per Tim's "get the providers ready even if we don't
+ *   use it yet but we know we will." Nothing here has been exercised against a real server; every
+ *   test in this family runs against `fake-argocd.ts`.
+ */
+import type { Config } from '@distilled.cloud/argocd/Credentials';
+import { Credentials, CredentialsFromEnv, fromToken } from '@distilled.cloud/argocd/Credentials';
+/** Re-exported so a consumer never has to reach into `@distilled.cloud/argocd` by hand. */
+export { Credentials, CredentialsFromEnv, fromToken };
+export type { Config as ArgocdCredentialsConfig };
+/** `ArgocdCredentials.fromEnv()` — the layer every `argocdProviders()` stack uses by default. */
+export declare const fromEnv: () => import("effect/Layer").Layer<Credentials, never, never>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/argocd/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/argocd/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qCAAqC,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAEjG,2FAA2F;AAC3F,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC;AACtD,YAAY,EAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;AAElD,iGAAiG;AACjG,eAAO,MAAM,OAAO,+DAA2B,CAAC"}

package/dist/argocd/fake-argocd.d.ts

@@ -0,0 +1,42 @@
+/**
+ * A minimal in-memory Argo CD REST API for this family's tests — an in-memory `fetch` handed to
+ * Effect's real `FetchHttpClient` through its `Fetch` reference, mirroring `../discord/fake-discord.ts`
+ * (itself mirroring `../forgejo/fake-forgejo.ts` and `cloudflare/fake-mesh.ts`). Tests exercise
+ * distilled's REAL path assembly, JSON encode/decode and status→typed-error matching — nothing
+ * about any of that is re-implemented here, only the wire responses a scenario needs.
+ *
+ * ⛔ TEST-ONLY, AND NO NETWORK. No provider imports this file. The base URL is RFC 2606
+ *   `argocd.example.com`, and the token is a placeholder. NO LIVE ARGO CD INSTANCE EXISTS ON THE
+ *   ESTATE (2026-09-24) — this is the only server any test in this family talks to.
+ */
+import { type Credentials } from '@distilled.cloud/argocd/Credentials';
+import * as Layer from 'effect/Layer';
+export declare const FAKE_BASE = "https://argocd.example.com";
+export declare const FAKE_TOKEN = "placeholder-argocd-token";
+export type Seen = {
+    readonly method: string;
+    readonly path: string;
+    readonly body: unknown;
+};
+/** Argo CD's grpc-gateway `{ code?, message, error? }` failure envelope. */
+export declare const fakeFailure: (status: number, message: string, code?: number) => Response;
+/**
+ * `route` decides every response; this wrapper only records what was sent and adapts to
+ * `globalThis.fetch`'s signature. A test that expects no request at all asserts `seen` is empty.
+ */
+export declare const fakeArgocd: (route: (method: string, url: URL, body: unknown, callNumber: number) => Response) => {
+    fetch: typeof fetch;
+    seen: Seen[];
+};
+/**
+ * distilled Credentials + the real FetchHttpClient over the fake — `ArgocdOpContext`, what every
+ * resource file's exported `spec.fetchLive`/`spec.upsert`/`spec.destroy` needs.
+ *
+ * ⚠️ NOT PAIRED WITH `handlers` (each resource file's `argocdHandlers(spec)` export). `handlers`
+ *   bakes in `CredentialsFromEnv`, which resolves through Effect's `Config` snapshot of
+ *   `process.env` — untestable against a fake server without mutating the real environment. So a
+ *   test calls `spec.fetchLive`/`spec.upsert`/`spec.destroy` directly, with this explicit layer,
+ *   exercising exactly the same production code without that env seam.
+ */
+export declare const fakeArgocdLayer: (fetchFn: typeof globalThis.fetch, creds?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/unstable/http/HttpClient").HttpClient, never, never>;
+//# sourceMappingURL=fake-argocd.d.ts.map

package/dist/argocd/fake-argocd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-argocd.d.ts","sourceRoot":"","sources":["../../src/argocd/fake-argocd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,KAAK,WAAW,EAAa,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,eAAO,MAAM,SAAS,+BAA+B,CAAC;AACtD,eAAO,MAAM,UAAU,6BAA6B,CAAC;AAErD,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9F,4EAA4E;AAC5E,eAAO,MAAM,WAAW,WAAY,MAAM,WAAW,MAAM,SAAS,MAAM,aACZ,CAAC;AAE/D;;;GAGG;AACH,eAAO,MAAM,UAAU,UACd,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,KAAK,QAAQ;;;CAejF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,YACjB,OAAO,UAAU,CAAC,KAAK,UACzB,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,kGAC+D,CAAC"}

package/dist/argocd/git-credentials.d.ts

@@ -0,0 +1,29 @@
+import * as Effect from 'effect/Effect';
+import { type FromEnv } from '../secrets/write-only.ts';
+export interface GitCredentialRefs {
+    readonly password?: FromEnv;
+    readonly sshPrivateKey?: FromEnv;
+    readonly bearerToken?: FromEnv;
+    readonly tlsClientCertKey?: FromEnv;
+}
+export interface ResolvedGitCredentials {
+    readonly password?: string;
+    readonly sshPrivateKey?: string;
+    readonly bearerToken?: string;
+    readonly tlsClientCertKey?: string;
+}
+declare const ArgocdSecretEnvUnsetError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ArgocdSecretEnvUnsetError";
+} & Readonly<A>;
+/** Domain refusal, not a distilled error — a declared credential's env var is unset at call time. */
+export declare class ArgocdSecretEnvUnsetError extends ArgocdSecretEnvUnsetError_base<{
+    readonly message: string;
+}> {
+}
+/**
+ * Resolves every declared ref from the deploying process's own environment, or fails with the
+ * names of whichever are missing — never a value, in the failure or anywhere else.
+ */
+export declare const resolveGitCredentials: (refs: GitCredentialRefs) => Effect.Effect<ResolvedGitCredentials, ArgocdSecretEnvUnsetError>;
+export {};
+//# sourceMappingURL=git-credentials.d.ts.map

package/dist/argocd/git-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credentials.d.ts","sourceRoot":"","sources":["../../src/argocd/git-credentials.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,OAAO,EAAc,MAAM,0BAA0B,CAAC;AAEpE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;;;;AAED,qGAAqG;AACrG,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AAYL;;;GAGG;AACH,eAAO,MAAM,qBAAqB,SAC1B,iBAAiB,KACtB,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,yBAAyB,CAYjE,CAAC"}

package/dist/argocd/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Argo CD providers for Alchemy.
+ *
+ * ⛔ THIS BARREL IS THE PUBLIC API, AND IT IS DELIBERATELY SMALLER THAN THE DIRECTORY. `resource.ts`
+ *   and `git-credentials.ts` are internals the three resource files share — a consumer builds
+ *   against the resources and `providers()`, not the engine underneath.
+ *
+ * ★ `Application` AND `AppProject` ARE NOT HERE — they are Kubernetes CRDs, not Argo CD REST-only
+ *   objects, and the upstream-correct owner is Alchemy's own `Kubernetes.Manifest`
+ *   (`alchemy/Kubernetes`, v2.0.0-beta.79). See `docs/argocd.md#applications-and-appprojects` for
+ *   the measured reasoning and worked examples — no code for those two lives in this kit.
+ */
+export { ArgocdCluster, ArgocdClusterProvider, type ClusterAttributes, type ClusterCredentialRefs, type ClusterProps, } from './cluster.ts';
+export { type ArgocdCredentialsConfig, Credentials, CredentialsFromEnv, fromEnv, fromToken, } from './credentials.ts';
+export { type ArgocdSecretEnvUnsetError, type GitCredentialRefs } from './git-credentials.ts';
+export { providers } from './providers.ts';
+export { ArgocdRepoCreds, ArgocdRepoCredsProvider, type RepoCredsAttributes, type RepoCredsProps, } from './repo-creds.ts';
+export { ArgocdRepository, ArgocdRepositoryProvider, type RepositoryAttributes, type RepositoryProps, } from './repository.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/argocd/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/argocd/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,uBAAuB,EAC5B,WAAW,EACX,kBAAkB,EAClB,OAAO,EACP,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC"}

package/dist/argocd/index.js

@@ -0,0 +1,306 @@
+// src/argocd/cluster.ts
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import * as argocd from "@distilled.cloud/argocd/argocd";
+import * as Data from "effect/Data";
+import * as Effect2 from "effect/Effect";
+
+// src/secrets/write-only.ts
+import { Buffer } from "node:buffer";
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+var resolveAll = (refs, env = process.env) => {
+  const values = {};
+  const missing = [];
+  for (const [key, ref] of Object.entries(refs)) {
+    const value = env[ref.fromEnv];
+    if (value === undefined || value === "")
+      missing.push(ref.fromEnv);
+    else
+      values[key] = value;
+  }
+  return { missing: [...new Set(missing)].sort(), values };
+};
+var COST = { N: 16384, maxmem: 64 * 1024 * 1024, p: 1, r: 8 };
+var PREFIX = "scrypt";
+var canonical = (values) => JSON.stringify(Object.keys(values).sort().map((key) => [key, values[key]]));
+var digest = (salt, values) => scryptSync(canonical(values), salt, 32, COST);
+var seal = (values, salt) => {
+  if (Object.keys(values).length === 0)
+    return "";
+  const bytes = salt === undefined ? randomBytes(16) : Buffer.from(salt, "utf8");
+  return `${PREFIX}:${bytes.toString("base64url")}:${digest(bytes, values).toString("base64url")}`;
+};
+var sealMatches = (sealed, values) => {
+  if (sealed === "")
+    return Object.keys(values).length === 0;
+  const [prefix, salt, stored, extra] = sealed.split(":");
+  if (prefix !== PREFIX || salt === undefined || stored === undefined || extra !== undefined) {
+    return false;
+  }
+  const expected = Buffer.from(stored, "base64url");
+  const actual = digest(Buffer.from(salt, "base64url"), values);
+  return expected.length === actual.length && timingSafeEqual(expected, actual);
+};
+
+// src/argocd/resource.ts
+import { isResolved } from "alchemy/Diff";
+import { CredentialsFromEnv } from "@distilled.cloud/argocd/Credentials";
+import * as Effect from "effect/Effect";
+var present = (obj) => Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined));
+var argocdOperations = (spec) => {
+  const read = (props) => spec.fetchLive(props).pipe(Effect.map((live) => live === undefined ? undefined : spec.attributes(live, props)));
+  return {
+    read,
+    diff: (news, output) => Effect.gen(function* () {
+      if (output === undefined || !isResolved(news))
+        return;
+      if (spec.identityOfProps(news) !== spec.identityOfAttributes(output)) {
+        return { action: "replace" };
+      }
+      const live = yield* read(news);
+      if (live === undefined)
+        return { action: "update" };
+      return spec.matches(live, news) ? { action: "noop" } : { action: "update" };
+    }),
+    reconcile: (news) => Effect.gen(function* () {
+      const before = yield* read(news);
+      if (before === undefined || !spec.matches(before, news)) {
+        yield* spec.upsert(news);
+      }
+      const after = yield* read(news);
+      if (after === undefined) {
+        return yield* Effect.die(new Error("the write returned no error but the object is still absent — read back rather " + "than trust the status code."));
+      }
+      return after;
+    }),
+    destroy: (olds) => Effect.gen(function* () {
+      const live = yield* spec.fetchLive(olds);
+      if (live === undefined)
+        return;
+      yield* spec.destroy(olds, live);
+    })
+  };
+};
+var argocdHandlers = (spec) => {
+  const ops = argocdOperations(spec);
+  const withCredentials = (effect) => Effect.provide(effect, CredentialsFromEnv);
+  return {
+    list: () => Effect.succeed([]),
+    read: ({ olds }) => withCredentials(ops.read(olds)),
+    diff: ({ news, output }) => withCredentials(ops.diff(news, output)),
+    reconcile: ({ news }) => withCredentials(ops.reconcile(news)),
+    delete: ({ olds }) => withCredentials(ops.destroy(olds))
+  };
+};
+
+// src/argocd/cluster.ts
+var ArgocdCluster = Resource("Argocd.Cluster", {
+  defaultRemovalPolicy: "retain"
+});
+
+class ArgocdClusterSecretEnvUnsetError extends Data.TaggedError("ArgocdClusterSecretEnvUnsetError") {
+}
+var resolveClusterCredentials = (refs) => {
+  const declared = {};
+  if (refs.password !== undefined)
+    declared.password = refs.password;
+  if (refs.bearerToken !== undefined)
+    declared.bearerToken = refs.bearerToken;
+  if (refs.tlsClientKeyData !== undefined)
+    declared.tlsClientKeyData = refs.tlsClientKeyData;
+  const { values, missing } = resolveAll(declared);
+  if (missing.length > 0) {
+    return Effect2.fail(new ArgocdClusterSecretEnvUnsetError({
+      message: `credential write requires ${missing.join(", ")}, unset or empty in the ` + "deploying environment. Export it and deploy again."
+    }));
+  }
+  return Effect2.succeed(values);
+};
+var attributesOf = (live) => ({
+  annotations: live.annotations,
+  clusterResources: live.clusterResources,
+  labels: live.labels,
+  name: live.name,
+  namespaces: live.namespaces,
+  project: live.project,
+  proxyUrl: live.config?.proxyUrl,
+  server: live.server ?? "",
+  tlsCaData: live.config?.tlsClientConfig?.caData,
+  tlsCertData: live.config?.tlsClientConfig?.certData,
+  tlsInsecure: live.config?.tlsClientConfig?.insecure,
+  tlsServerName: live.config?.tlsClientConfig?.serverName,
+  username: live.config?.username
+});
+var sameRecord = (a, b) => JSON.stringify(Object.entries(a ?? {}).sort()) === JSON.stringify(Object.entries(b ?? {}).sort());
+var sameList = (a, b) => JSON.stringify([...a ?? []].sort()) === JSON.stringify([...b ?? []].sort());
+var plainMatches = (attrs, props) => (props.name ?? undefined) === (attrs.name ?? undefined) && (props.project ?? undefined) === (attrs.project ?? undefined) && sameList(props.namespaces, attrs.namespaces) && Boolean(props.clusterResources) === Boolean(attrs.clusterResources) && sameRecord(props.labels, attrs.labels) && sameRecord(props.annotations, attrs.annotations) && (props.proxyUrl ?? undefined) === (attrs.proxyUrl ?? undefined) && (props.username ?? undefined) === (attrs.username ?? undefined) && (props.tlsCaData ?? undefined) === (attrs.tlsCaData ?? undefined) && (props.tlsCertData ?? undefined) === (attrs.tlsCertData ?? undefined) && Boolean(props.tlsInsecure) === Boolean(attrs.tlsInsecure) && (props.tlsServerName ?? undefined) === (attrs.tlsServerName ?? undefined);
+var spec = {
+  attributes: (live) => attributesOf(live),
+  destroy: (props) => argocd.deleteClusterService({ id_value: props.server }).pipe(Effect2.catchTag("NotFound", () => Effect2.void)),
+  identityOfAttributes: (attrs) => attrs.server,
+  identityOfProps: (props) => props.server,
+  fetchLive: (props) => argocd.getClusterService({ id_value: props.server }).pipe(Effect2.catchTag("NotFound", () => Effect2.succeed(undefined))),
+  matches: plainMatches,
+  upsert: (props) => resolveClusterCredentials(props.credentials ?? {}).pipe(Effect2.flatMap((creds) => argocd.createClusterService(present({
+    upsert: true,
+    annotations: props.annotations,
+    clusterResources: props.clusterResources,
+    config: present({
+      bearerToken: creds.bearerToken,
+      password: creds.password,
+      proxyUrl: props.proxyUrl,
+      tlsClientConfig: present({
+        caData: props.tlsCaData,
+        certData: props.tlsCertData,
+        insecure: props.tlsInsecure,
+        keyData: creds.tlsClientKeyData,
+        serverName: props.tlsServerName
+      }),
+      username: props.username
+    }),
+    labels: props.labels,
+    name: props.name,
+    namespaces: props.namespaces === undefined ? undefined : [...props.namespaces],
+    project: props.project,
+    server: props.server
+  }))))
+};
+var handlers = argocdHandlers(spec);
+var ArgocdClusterProvider = () => Provider.effect(ArgocdCluster, Effect2.succeed(ArgocdCluster.Provider.of(handlers)));
+// src/argocd/credentials.ts
+import { Credentials, CredentialsFromEnv as CredentialsFromEnv2, fromToken } from "@distilled.cloud/argocd/Credentials";
+var fromEnv = () => CredentialsFromEnv2;
+// src/argocd/providers.ts
+import * as Layer from "effect/Layer";
+
+// src/argocd/repo-creds.ts
+import { Resource as Resource2 } from "alchemy";
+import * as Provider2 from "alchemy/Provider";
+import * as argocd2 from "@distilled.cloud/argocd/argocd";
+import * as Effect4 from "effect/Effect";
+
+// src/argocd/git-credentials.ts
+import * as Data2 from "effect/Data";
+import * as Effect3 from "effect/Effect";
+class ArgocdSecretEnvUnsetError extends Data2.TaggedError("ArgocdSecretEnvUnsetError") {
+}
+var declaredRefs = (refs) => {
+  const out = {};
+  if (refs.password !== undefined)
+    out.password = refs.password;
+  if (refs.sshPrivateKey !== undefined)
+    out.sshPrivateKey = refs.sshPrivateKey;
+  if (refs.bearerToken !== undefined)
+    out.bearerToken = refs.bearerToken;
+  if (refs.tlsClientCertKey !== undefined)
+    out.tlsClientCertKey = refs.tlsClientCertKey;
+  return out;
+};
+var resolveGitCredentials = (refs) => {
+  const { values, missing } = resolveAll(declaredRefs(refs));
+  if (missing.length > 0) {
+    return Effect3.fail(new ArgocdSecretEnvUnsetError({
+      message: `credential write requires ${missing.join(", ")}, unset or empty in the ` + "deploying environment. Export it and deploy again."
+    }));
+  }
+  return Effect3.succeed(values);
+};
+
+// src/argocd/repo-creds.ts
+var ArgocdRepoCreds = Resource2("Argocd.RepoCreds");
+var attributesOf2 = (live) => ({
+  tlsClientCertData: live.tlsClientCertData,
+  type: live.type,
+  url: live.url ?? "",
+  username: live.username
+});
+var plainMatches2 = (attrs, props) => (props.type ?? "git") === (attrs.type ?? "git") && (props.username ?? undefined) === (attrs.username ?? undefined) && (props.tlsClientCertData ?? undefined) === (attrs.tlsClientCertData ?? undefined);
+var spec2 = {
+  attributes: (live) => attributesOf2(live),
+  destroy: (props) => argocd2.deleteRepoCredsServiceRepositoryCredentials({ url: props.url }).pipe(Effect4.catchTag("NotFound", () => Effect4.void)),
+  identityOfAttributes: (attrs) => attrs.url,
+  identityOfProps: (props) => props.url,
+  fetchLive: (props) => argocd2.listRepoCredsServiceRepositoryCredentials({ url: props.url }).pipe(Effect4.map((page) => (page.items ?? []).find((row) => row.url === props.url)), Effect4.catchTag("NotFound", () => Effect4.succeed(undefined))),
+  matches: plainMatches2,
+  upsert: (props) => resolveGitCredentials(props.credentials ?? {}).pipe(Effect4.flatMap((creds) => argocd2.createRepoCredsServiceRepositoryCredentials(present({
+    upsert: true,
+    tlsClientCertData: props.tlsClientCertData,
+    type: props.type,
+    url: props.url,
+    username: props.username,
+    ...creds
+  }))))
+};
+var handlers2 = argocdHandlers(spec2);
+var ArgocdRepoCredsProvider = () => Provider2.effect(ArgocdRepoCreds, Effect4.succeed(ArgocdRepoCreds.Provider.of(handlers2)));
+
+// src/argocd/repository.ts
+import { Resource as Resource3 } from "alchemy";
+import * as Provider3 from "alchemy/Provider";
+import * as argocd3 from "@distilled.cloud/argocd/argocd";
+import * as Effect5 from "effect/Effect";
+var ArgocdRepository = Resource3("Argocd.Repository", {
+  defaultRemovalPolicy: "retain"
+});
+var attributesOf3 = (live) => ({
+  enableLfs: live.enableLfs,
+  enableOCI: live.enableOCI,
+  forceHttpBasicAuth: live.forceHttpBasicAuth,
+  insecure: live.insecure,
+  insecureIgnoreHostKey: live.insecureIgnoreHostKey,
+  name: live.name,
+  noProxy: live.noProxy,
+  project: live.project,
+  proxy: live.proxy,
+  repo: live.repo ?? "",
+  tlsClientCertData: live.tlsClientCertData,
+  type: live.type,
+  username: live.username
+});
+var plainMatches3 = (attrs, props) => (props.type ?? "git") === (attrs.type ?? "git") && (props.name ?? undefined) === (attrs.name ?? undefined) && (props.project ?? undefined) === (attrs.project ?? undefined) && (props.username ?? undefined) === (attrs.username ?? undefined) && Boolean(props.insecure) === Boolean(attrs.insecure) && Boolean(props.insecureIgnoreHostKey) === Boolean(attrs.insecureIgnoreHostKey) && Boolean(props.enableLfs) === Boolean(attrs.enableLfs) && Boolean(props.enableOCI) === Boolean(attrs.enableOCI) && Boolean(props.forceHttpBasicAuth) === Boolean(attrs.forceHttpBasicAuth) && (props.proxy ?? undefined) === (attrs.proxy ?? undefined) && (props.noProxy ?? undefined) === (attrs.noProxy ?? undefined) && (props.tlsClientCertData ?? undefined) === (attrs.tlsClientCertData ?? undefined);
+var spec3 = {
+  attributes: (live) => attributesOf3(live),
+  destroy: (props) => argocd3.deleteRepositoryServiceRepository({ repo: props.repo }).pipe(Effect5.catchTag("NotFound", () => Effect5.void)),
+  identityOfAttributes: (attrs) => attrs.repo,
+  identityOfProps: (props) => props.repo,
+  fetchLive: (props) => argocd3.getRepositoryService({ repo: props.repo }).pipe(Effect5.catchTag("NotFound", () => Effect5.succeed(undefined))),
+  matches: plainMatches3,
+  upsert: (props) => resolveGitCredentials(props.credentials ?? {}).pipe(Effect5.flatMap((creds) => argocd3.createRepositoryServiceRepository(present({
+    upsert: true,
+    enableLfs: props.enableLfs,
+    enableOCI: props.enableOCI,
+    forceHttpBasicAuth: props.forceHttpBasicAuth,
+    insecure: props.insecure,
+    insecureIgnoreHostKey: props.insecureIgnoreHostKey,
+    name: props.name,
+    noProxy: props.noProxy,
+    project: props.project,
+    proxy: props.proxy,
+    repo: props.repo,
+    tlsClientCertData: props.tlsClientCertData,
+    type: props.type,
+    username: props.username,
+    ...creds
+  }))))
+};
+var handlers3 = argocdHandlers(spec3);
+var ArgocdRepositoryProvider = () => Provider3.effect(ArgocdRepository, Effect5.succeed(ArgocdRepository.Provider.of(handlers3)));
+
+// src/argocd/providers.ts
+var providers = () => Layer.mergeAll(ArgocdRepositoryProvider(), ArgocdRepoCredsProvider(), ArgocdClusterProvider());
+export {
+  ArgocdCluster,
+  ArgocdClusterProvider,
+  ArgocdRepoCreds,
+  ArgocdRepoCredsProvider,
+  ArgocdRepository,
+  ArgocdRepositoryProvider,
+  Credentials,
+  CredentialsFromEnv2 as CredentialsFromEnv,
+  fromEnv,
+  fromToken,
+  providers
+};
+
+//# debugId=0D501C98E7FA3B6C64756E2164756E21
+//# sourceMappingURL=index.js.map