@homeflare/alchemy 0.37.5 → 0.37.6

package/src/openbao/policy-wire.ts

@@ -2,15 +2,20 @@
  * The three OpenBao calls Bao.Policy makes — read, write and delete of `sys/policies/acl/<name>`.
  * Split from policy.ts so the trailing-newline round trip can be tested against a fake server.
  */
+import {
+  policiesDeleteAclPolicy,
+  policiesReadAclPolicy,
+  policiesWriteAclPolicy,
+} from '@distilled.cloud/openbao/policies';
 import * as Effect from 'effect/Effect';
-import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
 import { BaoError } from './bao-status.ts';
+import { runBao, runBaoRead, runBaoWrite } from './distilled.ts';
 
 /** The endpoint the CLI's policy commands used — openbao v2.6.2 api/sys_policy.go:60, :100, :122. */
 export const policyPath = (name: string) => `sys/policies/acl/${name}`;
 
 /**
- * The live policy text, or '' when the policy is genuinely absent. Anything else FAILS.
+ * The live policy text, or undefined only when the SDK reports PolicyNotFound. Other errors FAIL.
  *
  * 🔴 THE ABSENCE WORDING WAS THE POLICY COMMAND'S OWN, AND ASSUMING OTHERWISE MADE A NEW POLICY
  *   UNCREATABLE. `No value found at` was measured for `bao read`; `bao policy read` never printed
@@ -33,21 +38,36 @@ export const policyPath = (name: string) => `sys/policies/acl/${name}`;
  *   ("no policy found in response", api/sys_policy.go:81-85).
  */
 export const readPolicy = (name: string) =>
-  Effect.flatMap(baoRead(policyPath(name)), (data) => {
-    if (data === undefined) return Effect.succeed('');
-    const text = data['policy'];
-    return typeof text === 'string'
-      ? Effect.succeed(text)
-      : Effect.fail(new BaoError(200, 'GET', policyPath(name), ['no data.policy in the response']));
-  });
+  runBaoRead(policiesReadAclPolicy({ name })).pipe(
+    Effect.flatMap((data) => {
+      const text = data['policy'];
+      return typeof text === 'string'
+        ? Effect.succeed(text)
+        : Effect.fail(
+            new BaoError(200, 'GET', policyPath(name), ['no data.policy in the response']),
+          );
+    }),
+    Effect.catchTag('PolicyNotFound', () => Effect.succeed(undefined)),
+  );
+
+/** Even a live empty policy occupies its name; rename guards must not overwrite it. */
+export const policyExists = (name: string) =>
+  Effect.map(readPolicy(name), (policy) => policy !== undefined);
 
 /**
  * ★ THE HCL TRAVELS IN THE REQUEST BODY (`{"policy": …}`, api/sys_policy.go:96-101). The CLI path
  *   needed a scoped temp file because passing HCL on argv would have put every grant in the process
  *   list; a JSON body never reaches argv, so the temp file is gone with it.
+ * ★ A FULL-REPLACE WRITE: the whole policy text is sent every time, so it is safe to retry a
+ *   transport failure through `runBaoWrite` — a replayed attempt converges on the same policy
+ *   rather than compounding a partial one.
  */
 export const writePolicy = (name: string, hcl: string) =>
-  baoWrite('PUT', policyPath(name), { policy: hcl });
+  runBaoWrite(policiesWriteAclPolicy({ name, policy: hcl })).pipe(Effect.asVoid);
 
 /** Deleting a policy that is already gone answers success (handlePoliciesDelete returns nothing). */
-export const deletePolicy = (name: string) => baoDelete(policyPath(name));
+export const deletePolicy = (name: string) =>
+  runBao(policiesDeleteAclPolicy({ name })).pipe(
+    Effect.catchTag('NotFound', () => Effect.void),
+    Effect.asVoid,
+  );

package/src/openbao/policy.ts

@@ -10,9 +10,9 @@ import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';
 import { sha256 } from './digest.ts';
 import { isEmptyAssembly } from './policy-assembly.ts';
-import { deletePolicy, policyPath, readPolicy, writePolicy } from './policy-wire.ts';
-import { policyKey } from './rename.ts';
-import { guardRename, judgeRename, nameIdentity } from './rename-identity.ts';
+import { judgePolicyRename, policyIdentity } from './policy-identity.ts';
+import { deletePolicy, readPolicy, writePolicy } from './policy-wire.ts';
+import { guardRename } from './rename-identity.ts';
 
 /**
  * An OpenBao ACL policy, assembled from the HCL fragments that declare it.
@@ -103,9 +103,6 @@ export const BaoPolicy = Resource<BaoPolicy>('Bao.Policy', {
   defaultRemovalPolicy: 'retain',
 });
 
-/** A policy is its name, keyed as OpenBao keys it (`policyKey`). */
-const IDENTITY = nameIdentity<BaoPolicyAttributes>('Bao.Policy', policyPath, policyKey);
-
 /** `path "..."` grant count — the same number the apply script prints. */
 const grantsOf = (hcl: string) => (hcl.match(/^path /gm) ?? []).length;
 
@@ -140,12 +137,12 @@ export const BaoPolicyProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        // ★ '' means genuinely absent (a 404); a refusal fails. policy-wire.ts has the history.
+        // ★ Only undefined means absent (a typed 404); even a live empty policy occupies its name.
         // ⛔ With no attributes in state, a live policy is `Unowned` unless it is the one our own
         //   interrupted create wrote: these fragments, byte for byte (ownership/probe.ts).
         read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
           const live = yield* readPolicy(olds.name);
-          const found = live.length === 0 ? undefined : attributesOf(olds.name, live, 0);
+          const found = live === undefined ? undefined : attributesOf(olds.name, live, 0);
           const ours = Effect.map(
             assemble(olds.fragments),
             (a) => sha256(a.joined) === found?.digest,
@@ -170,7 +167,7 @@ export const BaoPolicyProvider = () =>
            *   delete, so a role outside this graph that names the old policy must move in the same
            *   PR (REPLACE.md).
            */
-          const move = yield* judgeRename(IDENTITY, olds, news, output);
+          const move = yield* judgePolicyRename(olds, news, output);
           // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
@@ -180,7 +177,7 @@ export const BaoPolicyProvider = () =>
           if (!isResolved(news)) return undefined;
           const { joined } = yield* assemble(news.fragments);
           const live = yield* readPolicy(news.name);
-          return live.length > 0 && sha256(live) === sha256(joined)
+          return live !== undefined && sha256(live) === sha256(joined)
             ? ({ action: 'noop' } as const)
             : ({ action: 'update' } as const);
         }),
@@ -188,7 +185,7 @@ export const BaoPolicyProvider = () =>
         reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           const name = news.name;
           // ⛔ An `update` across a rename the diff could not see — refused before any write.
-          yield* guardRename(IDENTITY, news, output);
+          yield* guardRename(policyIdentity, news, output);
           const { joined, parts } = yield* assemble(news.fragments);
           /**
            * ⛔ AN EMPTY ASSEMBLY IS A REFUSAL, NOT AN EMPTY POLICY. `bao policy write` with
@@ -218,9 +215,9 @@ export const BaoPolicyProvider = () =>
            *   sibling PVE provider does exactly this in pveOperations.reconcile.
            */
           const current = yield* readPolicy(name);
-          if (current.length > 0)
+          if (current !== undefined)
             yield* refuseTakeover({ fqn, instanceId, output }, `Bao.Policy ${name}`);
-          if (current.length > 0 && sha256(current) === sha256(joined)) {
+          if (current !== undefined && sha256(current) === sha256(joined)) {
             return attributesOf(name, joined, parts);
           }
           // ⚠️ In the request body, never on argv — see `writePolicy` for why the temp file went.

package/src/openbao/rename.ts

@@ -127,12 +127,28 @@ export const judgeMove = (
   declared: string | undefined,
   pathOf: (identity: string) => string,
   key: (identity: string) => string = exact,
+) =>
+  judgeMoveWith(
+    family,
+    tried,
+    declared,
+    (identity) => Effect.map(baoRead(pathOf(identity)), (value) => value !== undefined),
+    key,
+  );
+
+/** SDK families supply their own typed read so a rename cannot fall back to raw HTTP. */
+export const judgeMoveWith = <E, R>(
+  family: string,
+  tried: string | undefined,
+  declared: string | undefined,
+  occupied: (identity: string) => Effect.Effect<boolean, E, R>,
+  key: (identity: string) => string = exact,
 ) =>
   Effect.gen(function* () {
     if (tried === undefined || declared === undefined || key(tried) === key(declared)) {
       return undefined;
     }
-    if ((yield* baoRead(pathOf(declared))) === undefined) return { from: tried, to: declared };
+    if (!(yield* occupied(declared))) return { from: tried, to: declared };
     return yield* Effect.die(
       new Error(
         `${family}: ${tried} → ${declared} would land on an object that already exists at ` +

package/src/proxmox/node-network-read-failure.test.ts

@@ -139,6 +139,30 @@ describe('only the measured "interface does not exist" 400 means absent', () =>
     });
   });
 
+  /**
+   * ⛔ THE RETAG REGRESSION'S OWN TEST — RED-TEAM FINDING, 2026-09-25: `@distilled.cloud/proxmox`
+   *   retagged this exact 400 from the generic `ParameterVerificationFailed` to a specific
+   *   `NetworkInterfaceNotFound` (`nodes.ts`), and `readInterfaceOrFail`'s `catchTag` still named
+   *   the OLD tag — so on an already-adopted row (this is `diff`'s and `verify --all`'s `read`'s
+   *   `output !== undefined` branch, the non-folding one) the absence signal went UNCAUGHT and
+   *   threw straight through `engine.verify`, instead of resolving a `diff`/`missing` report.
+   *   Proven by temporarily reverting the `catchTag` to `'ParameterVerificationFailed'`: only this
+   *   test fails, with an unhandled `NetworkInterfaceNotFound`.
+   */
+  test('an already-adopted interface whose live GET now answers genuinely absent resolves via diff as missing, never throws', async () => {
+    const fake = clusterOverInterface('n2', 'vmbr0', live);
+    await withoutBao(async () => {
+      const engine = engineOver(ProxmoxNodeNetworkProvider().pipe(Layer.provideMerge(fake.layer)));
+      expect(await engine.deploy(declare())).toEqual({ 'n2-vmbr0': 'adopted' });
+      fake.setAnswer('genuinely-absent');
+      const report = await engine.verify(declare(), { all: true });
+      // ⛔ `update` IS THE RIGHT ANSWER HERE, NOT A THROW: this resource's `diff` treats a
+      //   vanished interface as something `reconcile` recreates (node-network.ts's `diff`,
+      //   `live === undefined` branch), the same as any other drifted-away row.
+      expect(report.rows[0]).toMatchObject({ diff: 'update' });
+    });
+  });
+
   /**
    * ★ WHY `read` FOLDS AT ALL, SPELLED OUT ON A BRAND NEW DECLARATION. Plan.ts's cold-start
    *   adoption probe (no prior Alchemy state for this declaration) calls `provider.read` with no

package/src/proxmox/node-network-wire.ts

@@ -156,14 +156,17 @@ const attributesOf = (
  *   `{"errors":{"iface":"interface does not exist"},"data":null,"message":"Parameter verification
  *   failed.\n"}` at HTTP 400 — a THIRD shape, different from every other migrated family's
  *   measured 500. `@distilled.cloud/proxmox` types this as a genuine typed error,
- *   `ParameterVerificationFailed` (`errors.ts`), carrying the per-field `errors` object rather
- *   than collapsing it to an opaque `BadRequest` — PVE's OWN 400 is never one shape (it is
- *   whatever the endpoint's parameter verification rejected), so `errors.ts`'s own header spells
- *   out why this ONE typed error is global rather than per-operation.
- * ⛔ ONLY THIS EXACT SIGNAL MEANS ABSENT, EVEN WITH THE FOLD BELOW. A different 400 reason, a
- *   permission gap, a network blip, or ANY OTHER `ParameterVerificationFailed` reason is never
- *   read as "this interface is not there" — `diff` calls this directly and propagates every one
- *   of them loudly.
+ *   `NetworkInterfaceNotFound` (`nodes.ts`, generated from `patches/nodes/network-errors.json`),
+ *   attached ONLY to `getNodeNetwork`'s error union and matched by the SDK's own
+ *   `errorEnvelope`/`matchTypedError` against the EXACT sole-field body `errors.iface ===
+ *   "interface does not exist"` — the precision the code here used to check by hand
+ *   (`error.errors['iface'] === '…'`) is now the SDK's own matcher contract, not this file's.
+ *   Any 400 that fails that exact match (a different field, a different message, more than one
+ *   field) decodes as the generic `ParameterVerificationFailed` instead, never this tag.
+ * ⛔ ONLY THIS EXACT SIGNAL MEANS ABSENT, EVEN WITH THE FOLD BELOW. A different 400 reason
+ *   (`ParameterVerificationFailed`), a permission gap, a network blip, or any other failure is
+ *   never read as "this interface is not there" — `diff` calls this directly and propagates
+ *   every one of them loudly.
  */
 export const readInterfaceOrFail = (props: NodeNetworkProps) =>
   readOrUnreadable(
@@ -172,13 +175,7 @@ export const readInterfaceOrFail = (props: NodeNetworkProps) =>
       'read',
       false,
       nodes.getNodeNetwork({ iface: props.iface, node: props.node }),
-    ).pipe(
-      Effect.catchTag('ParameterVerificationFailed', (error) =>
-        error.errors['iface'] === 'interface does not exist'
-          ? Effect.succeed(undefined)
-          : Effect.fail(error),
-      ),
-    ),
+    ).pipe(Effect.catchTag('NetworkInterfaceNotFound', () => Effect.succeed(undefined))),
   ).pipe(
     Effect.map((live) => {
       if (live === UNREADABLE) return UNREADABLE;
@@ -198,8 +195,9 @@ export const readInterfaceOrFail = (props: NodeNetworkProps) =>
  *   interrupted-create recovery, and Apply.ts's delete recovery, all call `read` with
  *   `output: undefined` and NO catch of their own (`Plan.ts` v2.0.0-beta.79 ~line 1308) — and
  *   Plan.ts fails the WHOLE PLAN, every other resource included, if that call throws. A malformed
- *   `iface` in ONE brand-new declaration (a DIFFERENT `ParameterVerificationFailed` than the
- *   absence one) would abort `bun run plan` for the entire stack under the precise-only design,
+ *   `iface` in ONE brand-new declaration (a `ParameterVerificationFailed`, DIFFERENT from the
+ *   `NetworkInterfaceNotFound` absence tag) would abort `bun run plan` for the entire stack under
+ *   the precise-only design,
  *   where every other migrated family instead defers that same malformed declaration to a scoped,
  *   loud refusal at apply. This restores that same fold for those three call sites.
  */