@homeflare/alchemy 0.43.0 → 0.45.0

package/dist/valkey/index.js

@@ -0,0 +1,964 @@
+// src/valkey/acl.ts
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect9 from "effect/Effect";
+
+// src/valkey/acl-form.ts
+import { sha256 } from "alchemy/Util/sha256";
+import * as Effect from "effect/Effect";
+
+// src/valkey/acl-profiles.ts
+var SEAT_COMMANDS = "+@read +@write +@string +@hash +@list +@set +@sortedset +@stream +@pubsub +@connection " + "+@transaction -@dangerous -@admin -keys -flushall -flushdb -monitor -acl -config " + "-shutdown -debug";
+var DENY = "-scan -randomkey -dbsize -pubsub";
+var MONITOR_COMMANDS = "-@all +ping +client|setname +info +command|info +commandlog|len +config|get " + "+latency|latest +latency|histogram +slowlog|get +slowlog|len";
+var SEAT_RULES = [...SEAT_COMMANDS.split(" "), ...DENY.split(" ")];
+var SERVICE_RULES = ["+@all", "-@dangerous", ...DENY.split(" ")];
+var MONITOR_RULES = MONITOR_COMMANDS.split(" ");
+var profileRules = (profile) => profile === "seat" ? SEAT_RULES : profile === "service" ? SERVICE_RULES : MONITOR_RULES;
+var effectiveKeyPrefix = (user) => user.profile === "monitor" ? "" : user.profile === "seat" ? user.keyPrefix ?? `${user.name}:*` : user.keyPrefix ?? "*";
+var declaredKeyPatterns = (user) => {
+  const prefix = effectiveKeyPrefix(user);
+  return prefix === "" ? [] : [`~${prefix}`];
+};
+var declaredChannels = (user) => {
+  if (user.profile === "monitor")
+    return [];
+  const prefix = effectiveKeyPrefix(user);
+  return (user.channelPatterns ?? [prefix]).map((pattern) => `&${pattern}`);
+};
+
+// src/valkey/errors.ts
+import * as Data from "effect/Data";
+
+class ValkeyInstanceDrift extends Data.TaggedError("ValkeyInstanceDrift") {
+  get message() {
+    return `Valkey.Instance "${this.instance}": ${this.prop} is declared as ` + `${JSON.stringify(this.declared)} but the live instance has ${JSON.stringify(this.live)}. ` + "Update the declaration to match the live value, or change it by hand and re-plan.";
+  }
+}
+
+class ValkeyInstanceUnreachable extends Data.TaggedError("ValkeyInstanceUnreachable") {
+  get message() {
+    return `Valkey.Instance "${this.instance}" at ${this.host === undefined ? "" : `${this.host}:`}` + `${String(this.port)}: could not verify the instance. Check that the Quadlet container is ` + "running and the ACL/password is correct.";
+  }
+}
+
+class ValkeyAclParseError extends Data.TaggedError("ValkeyAclParseError") {
+  get message() {
+    return "Valkey.AclFile: cannot parse an ACL LIST line. The line is withheld from this message " + "because it can carry a password hash.";
+  }
+}
+
+class ValkeyAclPasswordMissing extends Data.TaggedError("ValkeyAclPasswordMissing") {
+  get message() {
+    return `Valkey.AclFile "${this.instance}": ACL user "${this.user}" references environment ` + `variable ${this.variable}, which is missing or empty at call time.`;
+  }
+}
+
+class ValkeyAuthPasswordMissing extends Data.TaggedError("ValkeyAuthPasswordMissing") {
+  get message() {
+    const who = this.username === undefined ? "" : ` as "${this.username}"`;
+    return `Valkey connection${who}: password environment variable ${this.variable} is missing or ` + "empty at call time. Render the secret into the deploying process environment and re-plan.";
+  }
+}
+
+class ValkeyAclReadbackFailed extends Data.TaggedError("ValkeyAclReadbackFailed") {
+  get message() {
+    return `Valkey.AclFile "${this.instance}": ACL reconciliation for "${this.user}" reported success, ` + "but readback contradicts the declared rules or removal. Re-plan.";
+  }
+}
+
+class ValkeyAclSeatKeyPrefix extends Data.TaggedError("ValkeyAclSeatKeyPrefix") {
+  get message() {
+    return `Valkey.AclFile "${this.instance}": ACL user "${this.user}" declares key prefix ` + `"${this.keyPrefix}". A seat user is limited to "${this.user}:*"; a user that owns ` + 'every key on the instance declares profile "service".';
+  }
+}
+
+class ValkeyAclReservedUser extends Data.TaggedError("ValkeyAclReservedUser") {
+  get message() {
+    return `Valkey.AclFile "${this.instance}": refusing to manage ACL user "${this.user}". ` + "That name is `default` or the connection username. ACL SETUSER reset would replace the " + "credential this kit authenticates with, and the next ACL LIST would answer NOPERM.";
+  }
+}
+
+class ValkeyAclUserNameMismatch extends Data.TaggedError("ValkeyAclUserNameMismatch") {
+  get message() {
+    return `Valkey.AclFile "${this.instance}": ACL user "${this.user}" was found keyed under ` + `"${this.recordKey}". This family keys every user by its own name; re-plan or fix the ` + "ACL by hand on the instance.";
+  }
+}
+
+class ValkeyAclMonitorKeyPrefix extends Data.TaggedError("ValkeyAclMonitorKeyPrefix") {
+  get message() {
+    return `Valkey.AclFile "${this.instance}": ACL user "${this.user}" declares profile "monitor" ` + `with key prefix "${this.keyPrefix}". The monitor profile is key-less (resetkeys); omit ` + "the keyPrefix.";
+  }
+}
+
+class ValkeyAclNameGlob extends Data.TaggedError("ValkeyAclNameGlob") {
+  get message() {
+    return `Valkey.AclFile "${this.instance}": ACL user "${this.user}" contains glob characters ` + `(${this.chars}). A name is interpolated into key and channel patterns, so a glob would ` + "widen the isolation the profile fixes. Use a glob-free name.";
+  }
+}
+
+class ValkeyAclFileRendered extends Data.TaggedError("ValkeyAclFileRendered") {
+  get message() {
+    return `Valkey.AclFile "${this.instance}": the instance loads its ACL from "${this.path}" ` + "(CONFIG GET aclfile), so the file — not this family — is the source of truth. The kit " + "speaks RESP only and can neither write that file nor survive the renderer that owns it; " + "a runtime ACL SETUSER there is reverted on the next render or restart. Declare the users " + "in the rendering template. Adoption also reconciles and is refused. ACL reads require " + "ACL LIST permission, which CT100 rendered users do not have.";
+  }
+}
+
+class ValkeyAclChannelPatterns extends Data.TaggedError("ValkeyAclChannelPatterns") {
+  get message() {
+    return `Valkey.AclFile "${this.instance}": invalid channel patterns for "${this.user}". ` + "Seats require <name>:*; monitors require no channels.";
+  }
+}
+
+// src/secrets/write-only.ts
+import { Buffer as Buffer2 } from "node:buffer";
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+var resolveAll = (refs, env = process.env) => {
+  const values = {};
+  const missing = [];
+  for (const [key, ref] of Object.entries(refs)) {
+    const value = env[ref.fromEnv];
+    if (value === undefined || value === "")
+      missing.push(ref.fromEnv);
+    else
+      values[key] = value;
+  }
+  return { missing: [...new Set(missing)].sort(), values };
+};
+var COST = { N: 16384, maxmem: 64 * 1024 * 1024, p: 1, r: 8 };
+var PREFIX = "scrypt";
+var canonical = (values) => JSON.stringify(Object.keys(values).sort().map((key) => [key, values[key]]));
+var digest = (salt, values) => scryptSync(canonical(values), salt, 32, COST);
+var seal = (values, salt) => {
+  if (Object.keys(values).length === 0)
+    return "";
+  const bytes = salt === undefined ? randomBytes(16) : Buffer2.from(salt, "utf8");
+  return `${PREFIX}:${bytes.toString("base64url")}:${digest(bytes, values).toString("base64url")}`;
+};
+var sealMatches = (sealed, values) => {
+  if (sealed === "")
+    return Object.keys(values).length === 0;
+  const [prefix, salt, stored, extra] = sealed.split(":");
+  if (prefix !== PREFIX || salt === undefined || stored === undefined || extra !== undefined) {
+    return false;
+  }
+  const expected = Buffer2.from(stored, "base64url");
+  const actual = digest(Buffer2.from(salt, "base64url"), values);
+  return expected.length === actual.length && timingSafeEqual(expected, actual);
+};
+
+// src/valkey/acl-compare.ts
+var sameSet = (a, b) => {
+  if (a.length !== b.length)
+    return false;
+  const sa = new Set(a);
+  const sb = new Set(b);
+  if (sa.size !== sb.size)
+    return false;
+  for (const x of sa)
+    if (!sb.has(x))
+      return false;
+  return true;
+};
+var inferProfile = (rules) => {
+  const normalised = rules.filter((rule) => rule !== "-@all");
+  if (sameSet(normalised, SEAT_RULES))
+    return "seat";
+  if (sameSet(normalised, SERVICE_RULES))
+    return "service";
+  if (sameSet(rules, MONITOR_RULES))
+    return "monitor";
+  return "unrecognized";
+};
+var matchesDeclared = (live, user) => live.name === user.name && live.on && !live.nopass && live.hasPassword && sameSet(live.keyPatterns, declaredKeyPatterns(user)) && sameSet(live.channelPatterns, declaredChannels(user)) && inferProfile(live.rules) === user.profile;
+
+// src/valkey/acl-form.ts
+var NAME_GLOB = /[*?[\]\\]/;
+var passwordToken = (password) => Effect.map(sha256(password), (hash) => `#${hash}`);
+var buildSetUserArgs = (user, password) => Effect.map(passwordToken(password), (token) => [
+  "ACL",
+  "SETUSER",
+  user.name,
+  "reset",
+  "on",
+  token,
+  "resetchannels",
+  ...declaredChannels(user),
+  ...declaredKeyPatterns(user),
+  ...profileRules(user.profile)
+]);
+var MARKER_TOKENS = new Set(["resetchannels", "resetkeys", "resetpass", "reseton", "resetoff"]);
+var parseAclLine = (line) => {
+  const parts = line.split(" ");
+  if (parts[0] !== "user" || parts[1] === undefined || parts[1] === "") {
+    throw new ValkeyAclParseError;
+  }
+  const on = parts[2] === "on";
+  const nopass = parts.includes("nopass");
+  const keyPatterns = [];
+  const channelPatterns = [];
+  const rules = [];
+  let hasPassword = false;
+  for (const part of parts.slice(2)) {
+    if (part.startsWith("~"))
+      keyPatterns.push(part);
+    else if (part.startsWith("&"))
+      channelPatterns.push(part);
+    else if (part.startsWith(">") || part.startsWith("<") || part.startsWith("#"))
+      hasPassword = true;
+    else if (part.startsWith("+") || part.startsWith("-"))
+      rules.push(part);
+    else if (MARKER_TOKENS.has(part))
+      continue;
+  }
+  return { name: parts[1], on, nopass, hasPassword, keyPatterns, channelPatterns, rules };
+};
+var seatKeyPrefixEscapes = (user) => user.profile === "seat" && (user.keyPrefix ?? `${user.name}:*`) !== `${user.name}:*`;
+var refusalBeforeWrite = (instance, users, self) => {
+  for (const [key, user] of Object.entries(users)) {
+    if (user.name !== key) {
+      return new ValkeyAclUserNameMismatch({ instance, recordKey: key, user: user.name });
+    }
+    if (user.name === "default" || user.name === self) {
+      return new ValkeyAclReservedUser({ instance, user: user.name });
+    }
+    const glob = NAME_GLOB.exec(user.name);
+    if (glob !== null) {
+      return new ValkeyAclNameGlob({ instance, user: user.name, chars: glob[0] });
+    }
+    if (seatKeyPrefixEscapes(user)) {
+      return new ValkeyAclSeatKeyPrefix({
+        instance,
+        user: user.name,
+        keyPrefix: user.keyPrefix ?? `${user.name}:*`
+      });
+    }
+    if (user.channelPatterns !== undefined && (user.profile === "monitor" && user.channelPatterns.length > 0 || user.profile === "seat" && (user.channelPatterns.length !== 1 || user.channelPatterns[0] !== `${user.name}:*`)))
+      return new ValkeyAclChannelPatterns({ instance, user: user.name });
+    if (user.profile === "monitor" && user.keyPrefix !== undefined) {
+      return new ValkeyAclMonitorKeyPrefix({
+        instance,
+        user: user.name,
+        keyPrefix: user.keyPrefix
+      });
+    }
+  }
+  return;
+};
+var passwordState = (sealed, value) => {
+  if (value === undefined)
+    return "unknown";
+  if (sealed === "")
+    return "stale";
+  return sealMatches(sealed, { password: value }) ? "match" : "stale";
+};
+var planAclUsers = (declared, live, exclusive = false, managed = []) => {
+  const create = [];
+  const update = [];
+  const undeclared = [];
+  for (const [name, user] of Object.entries(declared)) {
+    const liveUser = live[name];
+    if (liveUser === undefined)
+      create.push(user);
+    else if (!matchesDeclared(liveUser, user))
+      update.push(user);
+  }
+  for (const name of Object.keys(live)) {
+    if (declared[name] === undefined)
+      undeclared.push(name);
+  }
+  return {
+    create,
+    update,
+    remove: exclusive ? undeclared : undeclared.filter((name) => managed.includes(name)),
+    undeclared
+  };
+};
+var buildDelUserArgs = (users) => [
+  "ACL",
+  "DELUSER",
+  ...users
+];
+
+// src/valkey/acl-connection.ts
+import * as Effect3 from "effect/Effect";
+
+// src/valkey/connection-service.ts
+import * as Context from "effect/Context";
+import * as Data2 from "effect/Data";
+import * as Effect2 from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+
+class ValkeyConnectionMissing extends Data2.TaggedError("ValkeyConnectionMissing") {
+  get message() {
+    return `Valkey connection for "${this.instance}" is missing; configure that instance in valkeyProviders.`;
+  }
+}
+
+class ValkeyConnection extends Context.Service()("Valkey.Connection") {
+}
+var connectionService = (instance) => instance === undefined ? ValkeyConnection : Context.Service(`Valkey.Connection:${instance}`);
+var valkeyConnection = (config) => Layer.succeed(connectionService(config.instance), Effect2.succeed(config));
+var resolveValkeyConnection = (instance) => Effect2.gen(function* () {
+  const service = yield* Effect2.serviceOption(connectionService(instance));
+  if (Option.isNone(service)) {
+    return yield* Effect2.fail(new ValkeyConnectionMissing({ instance: instance ?? "<unnamed>" }));
+  }
+  return yield* service.value;
+});
+
+// src/valkey/acl-connection.ts
+var aclUnreachable = (instance) => (_error) => Effect3.gen(function* () {
+  const config = yield* resolveValkeyConnection(instance);
+  return yield* Effect3.fail(new ValkeyInstanceUnreachable({ instance, host: config.host, port: config.port }));
+});
+
+// src/valkey/acl-managed.ts
+var managedUserNames = (stored, previous) => stored?.managedUsers ?? (previous === undefined ? Object.keys(stored?.users ?? {}).filter((name) => stored?.users[name]?.passwordSeal !== "") : Object.keys(previous.users));
+
+// src/valkey/acl-ops.ts
+import * as Effect6 from "effect/Effect";
+
+// src/valkey/transport.ts
+import * as Effect5 from "effect/Effect";
+
+// src/valkey/resp.ts
+import * as Effect4 from "effect/Effect";
+
+// src/valkey/transport-error.ts
+import * as Data3 from "effect/Data";
+
+class ValkeyServerError extends Data3.TaggedError("ValkeyServerError") {
+  get message() {
+    return this.detail;
+  }
+}
+
+class ValkeySocketError extends Data3.TaggedError("ValkeySocketError") {
+  get message() {
+    return this.reason;
+  }
+}
+
+// src/valkey/resp.ts
+var MAX_BULK_BYTES = 1048576;
+var MAX_ARRAY_ITEMS = 1e4;
+var CRLF = `\r
+`;
+var boundedCount = (raw, cap) => {
+  if (!/^(?:-1|\d+)$/.test(raw))
+    return;
+  const n = Number(raw);
+  if (!Number.isSafeInteger(n) || n > cap)
+    return;
+  return n;
+};
+var readUntil = (socket, state, inFlight, timeoutMs, done) => Effect4.tryPromise({
+  try: (signal) => new Promise((resolve, reject) => {
+    let settled = false;
+    const wait = {};
+    const finish = (fn) => {
+      if (settled)
+        return;
+      settled = true;
+      if (wait.timer !== undefined)
+        clearTimeout(wait.timer);
+      if (wait.onData !== undefined)
+        socket.off("data", wait.onData);
+      if (wait.onEnd !== undefined)
+        socket.off("end", wait.onEnd);
+      signal.removeEventListener("abort", onAbort);
+      if (inFlight.fail === failRead)
+        inFlight.fail = null;
+      fn();
+    };
+    const failRead = (reason) => {
+      finish(() => reject(new ValkeySocketError({ reason })));
+    };
+    const onAbort = () => failRead("read interrupted");
+    const settle = (parsed) => {
+      state.buf = state.buf.subarray(parsed.drop);
+      finish(() => resolve(parsed.value));
+    };
+    const immediate = done(state.buf);
+    if (immediate !== undefined) {
+      settle(immediate);
+      return;
+    }
+    if (socket.readableEnded || socket.destroyed) {
+      failRead("socket closed mid-reply");
+      return;
+    }
+    wait.onData = (chunk) => {
+      state.buf = Buffer.concat([state.buf, chunk]);
+      if (state.buf.length > MAX_BULK_BYTES + 64) {
+        failRead(`reply exceeded ${String(MAX_BULK_BYTES)} bytes`);
+        return;
+      }
+      const parsed = done(state.buf);
+      if (parsed === undefined)
+        return;
+      settle(parsed);
+    };
+    wait.onEnd = () => failRead("socket closed mid-reply");
+    wait.timer = setTimeout(() => failRead("socket timed out"), timeoutMs);
+    inFlight.fail = failRead;
+    signal.addEventListener("abort", onAbort);
+    socket.on("data", wait.onData);
+    socket.on("end", wait.onEnd);
+  }),
+  catch: (cause) => cause instanceof ValkeySocketError ? cause : new ValkeySocketError({ reason: String(cause) })
+});
+var readReply = (socket, state, command, inFlight, timeoutMs) => {
+  const readLine = () => readUntil(socket, state, inFlight, timeoutMs, (buffer) => {
+    const nl = buffer.indexOf(CRLF);
+    return nl === -1 ? undefined : { value: buffer.subarray(0, nl).toString("utf8"), drop: nl + 2 };
+  });
+  const readBytes = (n) => Effect4.gen(function* () {
+    if (state.taken + n > MAX_BULK_BYTES) {
+      return yield* Effect4.fail(new ValkeySocketError({
+        reason: `reply exceeded ${String(MAX_BULK_BYTES)} bytes`
+      }));
+    }
+    state.taken += n;
+    return yield* readUntil(socket, state, inFlight, timeoutMs, (buffer) => buffer.length < n + 2 ? undefined : { value: buffer.subarray(0, n).toString("utf8"), drop: n + 2 });
+  });
+  return Effect4.gen(function* () {
+    const line = yield* readLine();
+    const prefix = line[0];
+    if (prefix === "+")
+      return { kind: "bulk", value: line.slice(1) };
+    if (prefix === "-") {
+      return yield* Effect4.fail(new ValkeyServerError({ detail: line.slice(1) }));
+    }
+    if (prefix === "$") {
+      const n = boundedCount(line.slice(1), MAX_BULK_BYTES);
+      if (n === undefined) {
+        return yield* Effect4.fail(new ValkeySocketError({
+          reason: `bulk length ${line.slice(1)} exceeds ${String(MAX_BULK_BYTES)}`
+        }));
+      }
+      if (n === -1)
+        return { kind: "bulk", value: null };
+      return { kind: "bulk", value: yield* readBytes(n) };
+    }
+    if (prefix === "*") {
+      const n = boundedCount(line.slice(1), MAX_ARRAY_ITEMS);
+      if (n === undefined) {
+        return yield* Effect4.fail(new ValkeySocketError({
+          reason: `array length ${line.slice(1)} exceeds ${String(MAX_ARRAY_ITEMS)}`
+        }));
+      }
+      if (n === -1)
+        return { kind: "array", values: [] };
+      const values = [];
+      for (let i = 0;i < n; i += 1) {
+        const item = yield* readReply(socket, state, command, inFlight, timeoutMs);
+        if (item.kind !== "bulk") {
+          return yield* Effect4.fail(new ValkeyServerError({
+            detail: `nested array inside the reply to ${command}: this family reads only flat arrays`
+          }));
+        }
+        values.push(item.value);
+      }
+      return { kind: "array", values };
+    }
+    if (prefix === ":")
+      return { kind: "bulk", value: line.slice(1) };
+    return yield* Effect4.fail(new ValkeyServerError({ detail: `unexpected RESP prefix ${prefix}` }));
+  });
+};
+
+// src/valkey/transport.ts
+var DEFAULT_SOCKET_TIMEOUT_MS = 1e4;
+var CRLF2 = `\r
+`;
+var encodeArgs = (args) => `*${args.length}${CRLF2}${args.map((a) => `$${Buffer.byteLength(a)}${CRLF2}${a}`).join(CRLF2)}${CRLF2}`;
+var makeSocketExecutor = (socket, timeoutMs = DEFAULT_SOCKET_TIMEOUT_MS) => {
+  const inFlight = { fail: null };
+  let socketFailure;
+  const onError = (error) => {
+    socketFailure = error.message;
+    inFlight.fail?.(error.message);
+  };
+  socket.on("error", onError);
+  return {
+    send: (args) => {
+      if (socketFailure !== undefined || socket.destroyed) {
+        return Effect5.fail(new ValkeySocketError({ reason: socketFailure ?? "socket closed" }));
+      }
+      const state = { buf: Buffer.alloc(0), taken: 0 };
+      const command = args[0] ?? "command";
+      try {
+        socket.write(encodeArgs(args));
+      } catch (cause) {
+        return Effect5.fail(new ValkeySocketError({
+          reason: cause instanceof Error ? cause.message : String(cause)
+        }));
+      }
+      if (socketFailure !== undefined || socket.destroyed) {
+        return Effect5.fail(new ValkeySocketError({ reason: socketFailure ?? "socket closed" }));
+      }
+      return readReply(socket, state, command, inFlight, timeoutMs);
+    }
+  };
+};
+var arrayPairs = (values) => {
+  const out = new Map;
+  for (let i = 0;i + 1 < values.length; i += 2) {
+    out.set(values[i] ?? "", values[i + 1] ?? null);
+  }
+  return out;
+};
+
+// src/valkey/acl-ops.ts
+var readParsedUsers = (executor, self) => Effect6.gen(function* () {
+  const reply = yield* executor.send(["ACL", "LIST"]);
+  if (reply.kind === "error") {
+    return yield* Effect6.fail(new ValkeyServerError({ detail: reply.message }));
+  }
+  if (reply.kind !== "array") {
+    return yield* Effect6.fail(new ValkeyServerError({ detail: "ACL LIST did not answer an array" }));
+  }
+  const users = {};
+  for (const line of reply.values) {
+    if (line === null)
+      continue;
+    const parsed = yield* Effect6.try({
+      try: () => parseAclLine(line),
+      catch: () => new ValkeyAclParseError
+    });
+    if (parsed.name === "default" || parsed.name === self)
+      continue;
+    users[parsed.name] = parsed;
+  }
+  return users;
+});
+var toUserAttributes = (line) => ({
+  name: line.name,
+  keyPrefix: line.keyPatterns[0]?.slice(1) ?? "",
+  extraKeyPatterns: line.keyPatterns.slice(1).map((pattern) => pattern.slice(1)),
+  channelPatterns: [...line.channelPatterns],
+  profile: inferProfile(line.rules),
+  on: line.on,
+  nopass: line.nopass,
+  hasPassword: line.hasPassword,
+  passwordSeal: ""
+});
+var toAttributes = (instance, parsed) => {
+  const users = {};
+  for (const [name, line] of Object.entries(parsed)) {
+    users[name] = toUserAttributes(line);
+  }
+  return { instance, users };
+};
+var readWithExecutor = (executor, instance, self) => Effect6.map(readParsedUsers(executor, self), (parsed) => toAttributes(instance, parsed));
+var readAclFileConfig = (executor) => Effect6.gen(function* () {
+  const reply = yield* executor.send(["CONFIG", "GET", "aclfile"]);
+  if (reply.kind === "error") {
+    return yield* Effect6.fail(new ValkeyServerError({ detail: reply.message }));
+  }
+  if (reply.kind !== "array") {
+    return yield* Effect6.fail(new ValkeyServerError({ detail: "CONFIG GET aclfile did not answer an array" }));
+  }
+  const path = arrayPairs(reply.values).get("aclfile");
+  if (path === undefined || path === null)
+    return yield* Effect6.fail(new ValkeyServerError({ detail: "CONFIG GET aclfile omitted aclfile" }));
+  return path;
+});
+
+// src/valkey/acl-reconcile.ts
+import * as Effect7 from "effect/Effect";
+var reconcileWithExecutor = (executor, props, stored, env = process.env, self, previous) => Effect7.gen(function* () {
+  const aclfile = yield* readAclFileConfig(executor);
+  if (aclfile !== "") {
+    return yield* Effect7.fail(new ValkeyAclFileRendered({ instance: props.instance, path: aclfile }));
+  }
+  const refused = refusalBeforeWrite(props.instance, props.users, self);
+  if (refused !== undefined)
+    return yield* Effect7.fail(refused);
+  const refs = {};
+  for (const [name, user] of Object.entries(props.users))
+    refs[name] = user.password;
+  const { values } = resolveAll(refs, env);
+  const live = yield* readParsedUsers(executor, self);
+  const { create, update, remove, undeclared } = planAclUsers(props.users, live, props.exclusive, managedUserNames(stored, previous));
+  for (const name of undeclared) {
+    yield* Effect7.logWarning(`Valkey.AclFile "${props.instance}": live ACL user "${name}" is not declared; ${remove.includes(name) ? "it is scheduled for deletion (previously managed or exclusive: true)." : "it was left alone (exclusive: false)."}`);
+  }
+  const rotate = Object.entries(props.users).filter(([name, user]) => {
+    const liveUser = live[name];
+    const sealed = stored?.users[name]?.passwordSeal ?? "";
+    return liveUser !== undefined && matchesDeclared(liveUser, user) && passwordState(sealed, values[name]) === "stale";
+  }).map(([, user]) => user);
+  const writes = [...create, ...update, ...rotate];
+  const writeList = [];
+  for (const user of writes) {
+    const password = values[user.name];
+    if (password === undefined) {
+      return yield* Effect7.fail(new ValkeyAclPasswordMissing({
+        instance: props.instance,
+        user: user.name,
+        variable: user.password.fromEnv
+      }));
+    }
+    writeList.push({ user, password });
+  }
+  for (const { user, password } of writeList) {
+    const reply = yield* executor.send(yield* buildSetUserArgs(user, password));
+    if (reply.kind === "error") {
+      return yield* Effect7.fail(new ValkeyServerError({ detail: reply.message }));
+    }
+  }
+  if (remove.length > 0) {
+    const reply = yield* executor.send(buildDelUserArgs(remove));
+    if (reply.kind === "error") {
+      return yield* Effect7.fail(new ValkeyServerError({ detail: reply.message }));
+    }
+  }
+  const after = yield* readParsedUsers(executor, self);
+  for (const [name, user] of Object.entries(props.users)) {
+    const parsed = after[name];
+    if (parsed === undefined || !matchesDeclared(parsed, user)) {
+      return yield* Effect7.fail(new ValkeyAclReadbackFailed({ instance: props.instance, user: name }));
+    }
+  }
+  if (props.exclusive || remove.length > 0) {
+    for (const name of Object.keys(after)) {
+      if (props.users[name] === undefined && (props.exclusive || remove.includes(name))) {
+        return yield* Effect7.fail(new ValkeyAclReadbackFailed({ instance: props.instance, user: name }));
+      }
+    }
+  }
+  const seals = {};
+  for (const name of Object.keys(props.users)) {
+    seals[name] = stored?.users[name]?.passwordSeal ?? "";
+  }
+  for (const { user, password } of writeList)
+    seals[user.name] = seal({ password });
+  const users = {};
+  for (const [name, parsed] of Object.entries(after)) {
+    users[name] = { ...toUserAttributes(parsed), passwordSeal: seals[name] ?? "" };
+  }
+  return { instance: props.instance, users, managedUsers: Object.keys(props.users).sort() };
+});
+
+// src/valkey/connection.ts
+import * as Effect8 from "effect/Effect";
+import { connect } from "node:net";
+var openSocket = (host, port, timeoutMs) => Effect8.tryPromise({
+  try: (signal) => new Promise((resolve, reject) => {
+    const socket = connect({ host, port });
+    let settled = false;
+    const onConnect = () => {
+      if (settled)
+        return;
+      settled = true;
+      socket.off("error", onError);
+      socket.off("timeout", onTimeout);
+      signal.removeEventListener("abort", onAbort);
+      clearTimeout(timer);
+      socket.setTimeout(0);
+      resolve(socket);
+    };
+    const onError = (error) => {
+      if (settled)
+        return;
+      settled = true;
+      socket.off("connect", onConnect);
+      socket.off("timeout", onTimeout);
+      signal.removeEventListener("abort", onAbort);
+      clearTimeout(timer);
+      socket.destroy();
+      reject(new ValkeySocketError({ reason: error.message }));
+    };
+    const onTimeout = () => onError(new Error("connect timed out"));
+    const onAbort = () => onError(new Error("connect interrupted"));
+    const timer = setTimeout(onTimeout, timeoutMs);
+    timer.unref();
+    socket.setTimeout(timeoutMs);
+    signal.addEventListener("abort", onAbort);
+    socket.once("connect", onConnect);
+    socket.once("error", onError);
+    socket.once("timeout", onTimeout);
+  }),
+  catch: (cause) => cause instanceof ValkeySocketError ? cause : new ValkeySocketError({ reason: String(cause) })
+});
+var auth = (executor, config, env) => {
+  if (!("password" in config))
+    return Effect8.void;
+  const { username, password } = config;
+  return Effect8.gen(function* () {
+    const { values, missing } = resolveAll({ password }, env);
+    const value = values.password;
+    if (missing.length > 0 || value === undefined) {
+      return yield* Effect8.fail(new ValkeyAuthPasswordMissing({ username, variable: password.fromEnv }));
+    }
+    const reply = yield* executor.send(username === undefined ? ["AUTH", value] : ["AUTH", username, value]);
+    if (reply.kind === "error")
+      return yield* Effect8.fail(new ValkeyServerError({ detail: "Valkey AUTH was refused" }));
+  });
+};
+var withValkey = (build, instance) => Effect8.gen(function* () {
+  const config = yield* resolveValkeyConnection(instance);
+  const timeoutMs = config.timeoutMs ?? DEFAULT_SOCKET_TIMEOUT_MS;
+  const socket = yield* openSocket(config.host, config.port, timeoutMs);
+  const executor = makeSocketExecutor(socket, timeoutMs);
+  socket.setTimeout(timeoutMs);
+  const onIdle = () => {
+    socket.destroy(new Error("socket timed out"));
+  };
+  socket.on("timeout", onIdle);
+  return yield* Effect8.ensuring(Effect8.gen(function* () {
+    yield* auth(executor, config, process.env);
+    return yield* build(executor, config);
+  }), Effect8.sync(() => {
+    socket.setTimeout(0);
+    socket.off("timeout", onIdle);
+    socket.destroy();
+  }));
+});
+
+// src/valkey/acl.ts
+var ValkeyAclFile = Resource("Valkey.AclFile", {
+  defaultRemovalPolicy: "retain"
+});
+var isValkeyAclFile = (value) => (typeof value === "object" || typeof value === "function") && value !== null && value.Type === "Valkey.AclFile";
+var makeValkeyAclFileHandlers = (connect2 = withValkey) => ValkeyAclFile.Provider.of({
+  list: () => Effect9.succeed([]),
+  nuke: { skip: true },
+  read: ({ output, olds }) => Effect9.gen(function* () {
+    const props = output ?? olds;
+    const live = yield* connect2((ex, config) => readWithExecutor(ex, props.instance, config.username), props.instance).pipe(Effect9.catchTag("ValkeySocketError", aclUnreachable(props.instance)));
+    if (output === undefined)
+      return Unowned(live);
+    const users = {};
+    for (const [name, user] of Object.entries(live.users)) {
+      users[name] = { ...user, passwordSeal: output.users[name]?.passwordSeal ?? "" };
+    }
+    return { instance: live.instance, users, managedUsers: managedUserNames(output, olds) };
+  }),
+  diff: ({ news, output, olds }) => Effect9.gen(function* () {
+    if (!isResolved(news))
+      return;
+    const refused = refusalBeforeWrite(news.instance, news.users);
+    if (refused !== undefined)
+      return yield* Effect9.fail(refused);
+    if (output === undefined)
+      return;
+    const declared = Object.keys(news.users).sort();
+    if (!sameSet(declared, [...managedUserNames(output, olds)]))
+      return { action: "update" };
+    const liveNames = Object.keys(output.users).sort();
+    if (news.exclusive && declared.length !== liveNames.length)
+      return { action: "update" };
+    for (const [name, user] of Object.entries(news.users)) {
+      const live = output.users[name];
+      if (live === undefined || live.keyPrefix !== effectiveKeyPrefix(user) || live.extraKeyPatterns.length > 0 || !sameSet(live.channelPatterns, [...declaredChannels(user)]) || live.profile !== user.profile || !live.on || live.nopass || !live.hasPassword) {
+        return { action: "update" };
+      }
+      const { values } = resolveAll({ password: user.password });
+      if (passwordState(live.passwordSeal, values.password) === "stale") {
+        return { action: "update" };
+      }
+    }
+    return { action: "noop" };
+  }),
+  reconcile: ({ news, output, olds }) => connect2((ex, config) => reconcileWithExecutor(ex, news, output, process.env, config.username, olds), news.instance).pipe(Effect9.catchTag("ValkeySocketError", aclUnreachable(news.instance))),
+  delete: ({ olds, output }) => connect2((ex, config) => Effect9.gen(function* () {
+    const aclfile = yield* readAclFileConfig(ex);
+    if (aclfile !== "") {
+      return yield* Effect9.fail(new ValkeyAclFileRendered({ instance: olds.instance, path: aclfile }));
+    }
+    const live = yield* readParsedUsers(ex, config.username);
+    const targets = managedUserNames(output, olds).filter((name) => live[name] !== undefined);
+    if (targets.length === 0)
+      return;
+    const reply = yield* ex.send(buildDelUserArgs(targets));
+    if (reply.kind === "error") {
+      return yield* Effect9.fail(new ValkeyServerError({ detail: reply.message }));
+    }
+    return;
+  }), olds.instance).pipe(Effect9.catchTag("ValkeySocketError", aclUnreachable(olds.instance)))
+});
+var valkeyAclFileHandlers = makeValkeyAclFileHandlers();
+var ValkeyAclFileProvider = () => Provider.succeed(ValkeyAclFile, valkeyAclFileHandlers);
+// src/valkey/instance.ts
+import { Resource as Resource2 } from "alchemy";
+import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved2 } from "alchemy/Diff";
+import * as Provider2 from "alchemy/Provider";
+import * as Data4 from "effect/Data";
+import * as Effect10 from "effect/Effect";
+
+// src/valkey/instance-form.ts
+var parseInfo = (value) => {
+  const fallback = "0.0.0";
+  if (value === null)
+    return { version: fallback, port: 0 };
+  const match = /valkey_version:([0-9a-zA-Z._-]+)/.exec(value);
+  const port = /tcp_port:([0-9]+)/.exec(value);
+  return {
+    version: match?.[1] ?? fallback,
+    port: port?.[1] === undefined ? 0 : Number(port[1])
+  };
+};
+var MEMORY_UNITS = {
+  "": 1n,
+  b: 1n,
+  k: 1000n,
+  kb: 1024n,
+  m: 1000000n,
+  mb: 1024n * 1024n,
+  g: 1000000000n,
+  gb: 1024n * 1024n * 1024n
+};
+var memoryBytes = (value) => {
+  if (value.startsWith("-"))
+    return;
+  const match = /^(\d+)([a-z]*)$/i.exec(value);
+  if (match === null)
+    return;
+  const digits = match[1];
+  const unit = (match[2] ?? "").toLowerCase();
+  const mul = MEMORY_UNITS[unit];
+  if (digits === undefined || mul === undefined)
+    return;
+  return BigInt(digits) * mul;
+};
+var sameMemory = (declared, live) => {
+  const left = memoryBytes(declared);
+  const right = memoryBytes(live);
+  return left !== undefined && right !== undefined && left === right;
+};
+var defaultedConfig = (raw) => ({
+  maxmemory: raw.maxmemory ?? "0",
+  maxmemoryPolicy: raw.maxmemoryPolicy ?? "noeviction",
+  appendonly: raw.appendonly ?? "no"
+});
+var buildAttributes = (props, info, config) => ({
+  name: props.name,
+  port: info.port,
+  version: info.version,
+  ...defaultedConfig(config)
+});
+var firstDrift = (props, live) => {
+  const checks = [
+    ["port", props.port, live.port],
+    ["maxmemory", props.maxmemory, live.maxmemory],
+    ["maxmemoryPolicy", props.maxmemoryPolicy, live.maxmemoryPolicy],
+    ["appendonly", props.appendonly, live.appendonly]
+  ];
+  for (const [prop, declared, liveValue] of checks) {
+    if (declared === undefined)
+      continue;
+    if (prop === "maxmemory" && typeof declared === "string" && typeof liveValue === "string" && sameMemory(declared, liveValue)) {
+      continue;
+    }
+    if (declared !== liveValue)
+      return { prop, declared, live: liveValue };
+  }
+  return;
+};
+
+// src/valkey/instance.ts
+var ValkeyInstance = Resource2("Valkey.Instance", {
+  defaultRemovalPolicy: "retain"
+});
+var isValkeyInstance = (value) => (typeof value === "object" || typeof value === "function") && value !== null && value.Type === "Valkey.Instance";
+
+class ValkeyInstanceDeleteRefused extends Data4.TaggedError("ValkeyInstanceDeleteRefused") {
+  get message() {
+    return `Valkey.Instance "${this.instance}": delete is refused. This provider never stops a ` + "running Valkey server. Stop it by hand on the host if you mean to remove it, then remove " + "the declaration.";
+  }
+}
+var readWithExecutor2 = (executor, props) => Effect10.gen(function* () {
+  const infoReply = yield* executor.send(["INFO"]);
+  if (infoReply.kind === "error") {
+    return yield* Effect10.fail(new ValkeyServerError({ detail: infoReply.message }));
+  }
+  const info = parseInfo(infoReply.kind === "bulk" ? infoReply.value : null);
+  const configReply = yield* executor.send([
+    "CONFIG",
+    "GET",
+    "maxmemory",
+    "maxmemory-policy",
+    "appendonly"
+  ]);
+  if (configReply.kind === "error") {
+    return yield* Effect10.fail(new ValkeyServerError({ detail: configReply.message }));
+  }
+  const pairs = configReply.kind === "array" ? arrayPairs(configReply.values) : new Map;
+  return buildAttributes(props, info, {
+    maxmemory: pairs.get("maxmemory") ?? undefined,
+    maxmemoryPolicy: pairs.get("maxmemory-policy") ?? undefined,
+    appendonly: pairs.get("appendonly") ?? undefined
+  });
+});
+var makeValkeyInstanceHandlers = (connect2 = withValkey) => ValkeyInstance.Provider.of({
+  list: () => Effect10.succeed([]),
+  nuke: { skip: true },
+  read: ({ output, olds }) => Effect10.gen(function* () {
+    const props = output ?? olds;
+    return yield* connect2((ex) => Effect10.map(readWithExecutor2(ex, { name: props.name, port: props.port }), Unowned2), props.name);
+  }),
+  diff: ({ news, output }) => Effect10.sync(() => {
+    if (!isResolved2(news))
+      return;
+    if (output === undefined)
+      return;
+    const drift = firstDrift(news, output);
+    return drift !== undefined ? { action: "update" } : { action: "noop" };
+  }),
+  reconcile: ({ news }) => Effect10.gen(function* () {
+    const live = yield* connect2((ex) => readWithExecutor2(ex, { name: news.name, port: news.port }), news.name);
+    const drift = firstDrift(news, live);
+    if (drift !== undefined) {
+      return yield* Effect10.fail(new ValkeyInstanceDrift({
+        instance: news.name,
+        prop: drift.prop,
+        declared: drift.declared,
+        live: drift.live
+      }));
+    }
+    return live;
+  }),
+  delete: ({ olds }) => Effect10.fail(new ValkeyInstanceDeleteRefused({ instance: olds.name }))
+});
+var valkeyInstanceHandlers = makeValkeyInstanceHandlers();
+var ValkeyInstanceProvider = () => Provider2.succeed(ValkeyInstance, valkeyInstanceHandlers);
+// src/valkey/providers.ts
+import * as Layer2 from "effect/Layer";
+var valkeyProviders = (config) => Layer2.mergeAll(ValkeyInstanceProvider(), ValkeyAclFileProvider()).pipe(Layer2.provideMerge(valkeyConnection(config)));
+export {
+  ValkeyAclChannelPatterns,
+  ValkeyAclFile,
+  ValkeyAclFileProvider,
+  ValkeyAclFileRendered,
+  ValkeyAclMonitorKeyPrefix,
+  ValkeyAclNameGlob,
+  ValkeyAclParseError,
+  ValkeyAclPasswordMissing,
+  ValkeyAclReadbackFailed,
+  ValkeyAclReservedUser,
+  ValkeyAclSeatKeyPrefix,
+  ValkeyAclUserNameMismatch,
+  ValkeyAuthPasswordMissing,
+  ValkeyConnection,
+  ValkeyConnectionMissing,
+  ValkeyInstance,
+  ValkeyInstanceDeleteRefused,
+  ValkeyInstanceDrift,
+  ValkeyInstanceProvider,
+  ValkeyInstanceUnreachable,
+  isValkeyAclFile,
+  isValkeyInstance,
+  valkeyConnection,
+  valkeyProviders,
+  withValkey
+};
+
+//# debugId=AD3AB456863A1F6E64756E2164756E21
+//# sourceMappingURL=index.js.map