@homeflare/alchemy 0.40.0 → 0.42.0

package/dist/proxmox/index.js

@@ -1025,6 +1025,20 @@ import * as Duration from "effect/Duration";
 import * as Effect3 from "effect/Effect";
 import * as Exit from "effect/Exit";
 
+// src/proxmox/credentials.ts
+var VALID_TIER = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var mintTier = (target, role) => {
+  if (target.scheme !== "pve")
+    return role;
+  const tier = target.roles?.[role];
+  if (tier === undefined)
+    return role;
+  if (!VALID_TIER.test(tier)) {
+    throw new Error(`PveTarget.roles.${role} = ${JSON.stringify(tier)} is not a valid OpenBao tier name -- ` + 'it would be interpolated straight into "<mount>/creds/<tier>" and must be a plain name ' + '(letters, digits, ".", "_", "-", not starting with one of those and not "..").');
+  }
+  return tier;
+};
+
 // src/proxmox/mint.ts
 import * as Effect2 from "effect/Effect";
 import * as Option from "effect/Option";
@@ -1038,14 +1052,15 @@ import * as Data from "effect/Data";
 
 class PveCredentialDenied extends Data.TaggedError("PveCredentialDenied") {
   get message() {
-    return `OpenBao GET /v1/${this.mount}/creds/${this.role} -> 403: ${this.detail}. This identity's ` + "AppRole has no grant for this role -- a refused read, not evidence the object is gone.";
+    return `OpenBao GET /v1/${this.mount}/creds/${this.tier} -> 403: ${this.detail}. This identity's ` + "AppRole has no grant for this role -- a refused read, not evidence the object is gone.";
   }
 }
 
 // src/proxmox/mint.ts
 var baoVariable = (env, name) => env[`BAO_${name}`] ?? env[`VAULT_${name}`] ?? "";
 var mint = (target, role, env = process.env) => Effect2.gen(function* () {
-  const path = `${target.mount}/creds/${role}`;
+  const tier = mintTier(target, role);
+  const path = `${target.mount}/creds/${tier}`;
   const refuse = (status2, detail) => new Error(`OpenBao GET /v1/${path} -> ${status2 === 0 ? "no response" : status2}: ${detail}`);
   const address = baoVariable(env, "AGENT_ADDR") || baoVariable(env, "ADDR") || "https://127.0.0.1:8200";
   const socket = address.startsWith("unix://") ? address.slice("unix://".length) : undefined;
@@ -1078,14 +1093,14 @@ var mint = (target, role, env = process.env) => Effect2.gen(function* () {
     const isOpenBaoBody = Array.isArray(errors);
     const detail = isOpenBaoBody ? errors.map(String).join("; ") : "not an OpenBao error body";
     if (status === 403 && isOpenBaoBody) {
-      return yield* Effect2.fail(new PveCredentialDenied({ detail, mount: target.mount, role }));
+      return yield* Effect2.fail(new PveCredentialDenied({ detail, mount: target.mount, tier }));
     }
     return yield* Effect2.fail(refuse(status, detail || "(no errors given)"));
   }
   const tokenId = parsed?.data?.token_id;
   const secret = parsed?.data?.secret;
   if (typeof tokenId !== "string" || typeof secret !== "string") {
-    return yield* Effect2.fail(new Error(`${target.mount}/creds/${role} returned no token_id/secret. Either this approle lacks ` + `the grant, or the mount is not ${target.mount}. Say which mount and role you needed ` + `than falling back to a stored credential -- every stored PVE token is read-only.`));
+    return yield* Effect2.fail(new Error(`${target.mount}/creds/${tier} returned no token_id/secret. Either this approle lacks ` + `the grant, or the mount is not ${target.mount}. Say which mount and role you needed ` + `than falling back to a stored credential -- every stored PVE token is read-only.`));
   }
   const lease = parsed?.lease_duration;
   const leaseSeconds = typeof lease === "number" ? lease : 0;
@@ -1097,13 +1112,14 @@ var authorization = (credential, target) => target.scheme === "pbs" ? `PBSAPITok
 var REMINT_MARGIN_SECONDS = 60;
 var keyOf = (target, role) => ({
   mount: target.mount,
-  role,
-  scheme: target.scheme
+  scheme: target.scheme,
+  tier: mintTier(target, role)
 });
 var timeToLive = (exit) => Exit.isSuccess(exit) && exit.value.leaseSeconds > REMINT_MARGIN_SECONDS ? Duration.seconds(exit.value.leaseSeconds - REMINT_MARGIN_SECONDS) : Duration.zero;
 var makeLeases = (mintFor) => Cache.makeWith(mintFor, { capacity: 64, requireServicesAt: "lookup", timeToLive });
-var targetForKey = (key) => key.scheme === "pbs" ? { api: "https://pbs.invalid/api2/json", mount: key.mount, scheme: "pbs" } : { members: [], mount: key.mount, scheme: "pve" };
-var leases = Effect3.runSync(makeLeases((key) => mint(targetForKey(key), key.role)));
+var targetForKey = (key) => key.scheme === "pbs" ? { api: "https://pbs.invalid/api2/json", mount: key.mount, scheme: "pbs" } : { members: [], mount: key.mount, roles: { read: key.tier }, scheme: "pve" };
+var mintForKey = (key, env = process.env) => mint(targetForKey(key), key.scheme === "pbs" ? key.tier : "read", env);
+var leases = Effect3.runSync(makeLeases(mintForKey));
 var leased = (target, role) => Cache.get(leases, keyOf(target, role));
 
 // src/proxmox/members.ts
@@ -1233,7 +1249,7 @@ var runPve = (target, role, isWrite, op) => Effect5.gen(function* () {
 import * as Effect6 from "effect/Effect";
 var UNREADABLE = Symbol("pve-unreadable");
 var readOrUnreadable = (effect) => effect.pipe(Effect6.catchTag("PveCredentialDenied", () => Effect6.succeed(UNREADABLE)));
-var unreadableWarning = (type, identity2) => Effect6.logWarning(`${type} ${identity2}: the read was refused (no grant for this credential's role) -- ` + "reporting noop rather than forcing an update with nothing compared. Re-plan on a lane " + "that can read this object before trusting this row.");
+var unreadableWarning = (type, identity2, mount, tier) => Effect6.logWarning(`${type} ${identity2}: the read of ${mount}/creds/${tier} was refused (no grant for this ` + "credential's role) -- reporting noop rather than forcing an update with nothing compared. " + "Re-plan on a lane that can read this object before trusting this row.");
 
 // src/proxmox/acl.ts
 var ProxmoxAcl = Resource("Proxmox.Acl");
@@ -1255,7 +1271,7 @@ var ProxmoxAclProvider = () => Provider.effect(ProxmoxAcl, Effect7.succeed(Proxm
       return;
     const live = yield* readAttributes(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.Acl", identity(news));
+      yield* unreadableWarning("Proxmox.Acl", identity(news), news.target.mount, mintTier(news.target, "provision"));
       return { action: "noop" };
     }
     return live !== undefined && matches(live, news) ? { action: "noop" } : { action: "update" };
@@ -1425,7 +1441,7 @@ var ProxmoxApiTokenProvider = () => Provider2.effect(ProxmoxApiToken, Effect8.su
       return;
     const live = yield* readToken(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.ApiToken", `${news.userid}!${news.tokenid}`);
+      yield* unreadableWarning("Proxmox.ApiToken", `${news.userid}!${news.tokenid}`, news.target.mount, mintTier(news.target, "provision"));
       return { action: "noop" };
     }
     return live !== undefined && matches2(live, news) ? { action: "noop" } : { action: "update" };
@@ -2393,7 +2409,7 @@ var ProxmoxGroupProvider = () => Provider10.effect(ProxmoxGroup, Effect28.succee
       return;
     const live = yield* readGroupOrFail(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.Group", news.groupid);
+      yield* unreadableWarning("Proxmox.Group", news.groupid, news.target.mount, mintTier(news.target, "read"));
       return { action: "noop" };
     }
     if (live === undefined) {
@@ -3866,7 +3882,7 @@ var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Eff
       return;
     const live = yield* readInterfaceOrFail(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.NodeNetwork", `${news.node}/${news.iface}`);
+      yield* unreadableWarning("Proxmox.NodeNetwork", `${news.node}/${news.iface}`, news.target.mount, mintTier(news.target, "read"));
       return { action: "noop" };
     }
     if (live === undefined) {
@@ -5801,7 +5817,7 @@ var ProxmoxRoleProvider = () => Provider26.effect(ProxmoxRole, Effect78.succeed(
       return;
     const live = yield* readRole(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.Role", news.roleid);
+      yield* unreadableWarning("Proxmox.Role", news.roleid, news.target.mount, mintTier(news.target, "read"));
       return { action: "noop" };
     }
     if (live === undefined) {
@@ -5901,7 +5917,7 @@ var ProxmoxUserProvider = () => Provider27.effect(ProxmoxUser, Effect80.succeed(
       return;
     const live = yield* readUserOrFail(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.User", news.userid);
+      yield* unreadableWarning("Proxmox.User", news.userid, news.target.mount, mintTier(news.target, "read"));
       return { action: "noop" };
     }
     if (live === undefined) {
@@ -6904,33 +6920,9 @@ import * as Provider35 from "alchemy/Provider";
 import * as storage2 from "@distilled.cloud/proxmox/storage";
 import * as Effect97 from "effect/Effect";
 
-// src/proxmox/storage-form.ts
-var STORAGE_CREATE = "pve:POST /storage";
-var STORAGE_UPDATE = "pve:PUT /storage/{storage}";
-var field6 = (name, value) => value === undefined ? {} : { [name]: value };
-var locatorForm = (locator) => ({ ...locator });
-var underscored = (form2) => Object.fromEntries(Object.entries(form2).map(([key, value]) => [key.replaceAll("-", "_"), value]));
-var mutable2 = (props) => ({
-  ...field6("comment", props.comment),
-  ...field6("content", props.content),
-  ...field6("disable", flag(props.disable)),
-  ...field6("nodes", props.nodes),
-  ...field6("preallocation", props.preallocation),
-  ...field6("prune-backups", props["prune-backups"]),
-  ...field6("shared", flag(props.shared))
-});
-var createForm11 = (props) => ({
-  ...locatorForm(props.locator),
-  ...mutable2(props),
-  storage: props.storage,
-  type: props.type
-});
-var updateForm9 = (props) => ({
-  ...mutable2(props),
-  storage: props.storage
-});
-var toDistilledCreate4 = (props) => underscored(createForm11(props));
-var toDistilledUpdate3 = (props) => underscored(updateForm9(props));
+// src/proxmox/storage-plugin-options.ts
+var SHARED_ACCEPTED_TYPES = new Set(["dir", "lvm", "btrfs", "esxi"]);
+var sharedAccepted = (type) => SHARED_ACCEPTED_TYPES.has(type);
 
 // src/proxmox/storage-wire.ts
 import * as storage from "@distilled.cloud/proxmox/storage";
@@ -6956,7 +6948,44 @@ var attributesOf10 = (live, props) => {
 var readStorageOrFail = (props) => readOrUnreadable(runPve(props.target, "provision", false, storage.getStorage({ storage: props.storage }))).pipe(Effect96.map((live) => live === UNREADABLE ? UNREADABLE : attributesOf10(live, props)));
 var readStorage = (props) => readStorageOrFail(props).pipe(Effect96.catchTag("StorageNotFound", () => Effect96.succeed(undefined)));
 var dropUnreadable7 = (live) => live === UNREADABLE ? undefined : live;
-var matches10 = (attributes2, props) => sameList2(props.content, attributes2.content) && sameList2(props.nodes, attributes2.nodes) && sameList2(props["prune-backups"], attributes2["prune-backups"]) && same7(props.disable, attributes2.disable) && same7(props.shared, attributes2.shared) && same7(props.preallocation, attributes2.preallocation) && same7(props.comment, attributes2.comment);
+var changedProps = (live, props) => ({
+  ...sameList2(props.content, live.content) ? {} : { content: props.content },
+  ...sameList2(props.nodes, live.nodes) ? {} : { nodes: props.nodes },
+  ...sameList2(props["prune-backups"], live["prune-backups"]) ? {} : { "prune-backups": props["prune-backups"] },
+  ...same7(props.disable, live.disable) ? {} : { disable: props.disable },
+  ...sharedAccepted(props.type) && !same7(props.shared, live.shared) ? { shared: props.shared } : {},
+  ...same7(props.preallocation, live.preallocation) ? {} : { preallocation: props.preallocation },
+  ...same7(props.comment, live.comment) ? {} : { comment: props.comment }
+});
+var matches10 = (attributes2, props) => !sharedAccepted(props.type) && !same7(props.shared, attributes2.shared) ? Effect96.die(new Error(`storage/${props.storage}: declared shared: ${String(props.shared)}, but PVE reports ` + `${String(attributes2.shared)} and '${props.type}' storages never accept a 'shared' ` + "write (storage-plugin-options.ts) -- remove the declared shared or set it to match " + "what PVE already reports; this value can never be applied.")) : Effect96.succeed(Object.keys(changedProps(attributes2, props)).length === 0);
+
+// src/proxmox/storage-form.ts
+var STORAGE_CREATE = "pve:POST /storage";
+var STORAGE_UPDATE = "pve:PUT /storage/{storage}";
+var field6 = (name, value) => value === undefined ? {} : { [name]: value };
+var locatorForm = (locator) => ({ ...locator });
+var underscored = (form2) => Object.fromEntries(Object.entries(form2).map(([key, value]) => [key.replaceAll("-", "_"), value]));
+var mutable2 = (type, props) => ({
+  ...field6("comment", props.comment),
+  ...field6("content", props.content),
+  ...field6("disable", flag(props.disable)),
+  ...field6("nodes", props.nodes),
+  ...field6("preallocation", props.preallocation),
+  ...field6("prune-backups", props["prune-backups"]),
+  ...sharedAccepted(type) ? field6("shared", flag(props.shared)) : {}
+});
+var createForm11 = (props) => ({
+  ...locatorForm(props.locator),
+  ...mutable2(props.type, props),
+  storage: props.storage,
+  type: props.type
+});
+var updateForm9 = (props, live) => ({
+  ...mutable2(props.type, live === undefined ? props : changedProps(live, props)),
+  storage: props.storage
+});
+var toDistilledCreate4 = (props) => underscored(createForm11(props));
+var toDistilledUpdate3 = (form2) => underscored(form2);
 
 // src/proxmox/storage.ts
 var ProxmoxStorage = Resource35("Proxmox.Storage", {
@@ -6971,28 +7000,29 @@ var ProxmoxStorageProvider = () => Provider35.effect(ProxmoxStorage, Effect97.su
     if (!isResolved30(news))
       return;
     yield* guardWrite2(STORAGE_CREATE, createForm11(news), output === undefined);
-    yield* guardWrite2(STORAGE_UPDATE, updateForm9(news), false);
+    yield* guardWrite2(STORAGE_UPDATE, updateForm9(news, undefined), false);
     if (output === undefined)
       return;
     const live = yield* readStorageOrFail(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.Storage", news.storage);
+      yield* unreadableWarning("Proxmox.Storage", news.storage, news.target.mount, mintTier(news.target, "provision"));
       return { action: "noop" };
     }
     if (live === undefined) {
       yield* guardWrite2(STORAGE_CREATE, createForm11(news), true);
       return { action: "update" };
     }
-    return matches10(live, news) ? { action: "noop" } : { action: "update" };
+    return (yield* matches10(live, news)) ? { action: "noop" } : { action: "update" };
   }),
   reconcile: Effect97.fn(function* ({ news }) {
     const before = dropUnreadable7(yield* readStorage(news));
     yield* guardWrite2(STORAGE_CREATE, createForm11(news), before === undefined);
-    yield* guardWrite2(STORAGE_UPDATE, updateForm9(news), false);
+    const update2 = updateForm9(news, before);
+    yield* guardWrite2(STORAGE_UPDATE, update2, false);
     if (before === undefined) {
       yield* runPve(news.target, "provision", true, storage2.createStorage(toDistilledCreate4(news)));
-    } else if (!matches10(before, news)) {
-      yield* runPve(news.target, "provision", true, storage2.putStorage(toDistilledUpdate3(news)));
+    } else if (!(yield* matches10(before, news))) {
+      yield* runPve(news.target, "provision", true, storage2.putStorage(toDistilledUpdate3(update2)));
     }
     const after = dropUnreadable7(yield* readStorage(news));
     if (after === undefined) {
@@ -7098,7 +7128,7 @@ var ProxmoxZfsPoolProvider = () => Provider36.effect(ProxmoxZfsPool, Effect100.s
       return;
     const live = yield* readPoolOrFail(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.ZfsPool", `${news.node}/${news.name}`);
+      yield* unreadableWarning("Proxmox.ZfsPool", `${news.node}/${news.name}`, news.target.mount, mintTier(news.target, "read"));
       return { action: "noop" };
     }
     if (live === undefined) {
@@ -7193,5 +7223,5 @@ export {
   violations
 };
 
-//# debugId=CF5040306473FBD564756E2164756E21
+//# debugId=71934628F9E3FB7664756E2164756E21
 //# sourceMappingURL=index.js.map