@homeflare/alchemy 0.45.0 → 0.46.0

package/src/proxmox/qemu-resize.ts

@@ -0,0 +1,86 @@
+/** PVE 9.2.11 QEMU resize, already generated as nodes.putNodeQemuResize in the distilled SDK. */
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import * as Effect from 'effect/Effect';
+import { type VmProps, storedConfig } from './qemu-props.ts';
+import { readVm } from './qemu-read.ts';
+import { QemuDiskResizeRefused, checkLiveDiskSizes, diskBytes } from './qemu-size.ts';
+import { qemuTask } from './qemu-task.ts';
+import { formViolations } from './constraint-guard.ts';
+
+const RESIZE_POLLS = 60;
+
+/**
+ * ⛔ Recovery can reach here while a timed-out import still holds `lock`. Read the raw
+ * config: storedConfig intentionally drops it. Lock waits and task polls share one budget.
+ * Never skip/unset a lock; PVE also checks it if another worker races this observation.
+ */
+const unlockedConfig = (props: VmProps, disk: string) =>
+  Effect.gen(function* () {
+    for (let attempt = 0; ; attempt++) {
+      const live = yield* readVm(props);
+      if (live === undefined)
+        return yield* Effect.fail(
+          new QemuDiskResizeRefused({ disk, message: 'VM disappeared before resize' }),
+        );
+      if (live.lock === undefined)
+        return {
+          config: storedConfig(live as unknown as Record<string, unknown>),
+          polls: RESIZE_POLLS - attempt,
+        };
+      if (attempt === RESIZE_POLLS - 1)
+        return yield* Effect.fail(
+          new QemuDiskResizeRefused({
+            disk,
+            message: `${disk}: VM ${props.vmid} remains locked (${live.lock}) after ${RESIZE_POLLS} observations; refusing resize`,
+          }),
+        );
+      yield* Effect.sleep('1 second');
+    }
+  });
+
+/**
+ * ⛔ Observe the unlocked, allocated disk before each resize, including recovery after import.
+ * Absolute targets make retries safe; `+60G` would grow again after interrupted state writes.
+ * This resource never starts a guest. Its caller can power on only after reconcile returns.
+ * SDK failures retain their generated tags; provider refusals are QemuDiskResizeRefused.
+ */
+export const resizeDisks = (props: VmProps) =>
+  Effect.gen(function* () {
+    const targets = Object.entries(props.diskSizesGiB ?? {}).filter(
+      (entry): entry is [string, number] => entry[1] !== undefined,
+    );
+    const first = targets[0];
+    if (first === undefined) return;
+    const live = yield* readVm(props);
+    if (live === undefined)
+      return yield* Effect.fail(
+        new QemuDiskResizeRefused({
+          disk: first[0],
+          message: 'VM disappeared before resize',
+        }),
+      );
+    const observed = storedConfig(live as unknown as Record<string, unknown>);
+    yield* checkLiveDiskSizes(props, observed);
+    for (const [disk, size] of targets) {
+      // ⚠️ A backup lock must not delay/refuse a no-op. Only growth needs an unlocked VM.
+      if ((diskBytes(observed[disk]) ?? 0) >= size * 1024 ** 3) continue;
+      const { config, polls } = yield* unlockedConfig(props, disk);
+      yield* checkLiveDiskSizes(props, config);
+      if ((diskBytes(config[disk]) ?? 0) >= size * 1024 ** 3) continue;
+      const form = { disk, size: `${size}G` };
+      const refused = formViolations('pve:PUT /nodes/{node}/qemu/{vmid}/resize', form, true);
+      if (refused.length > 0) {
+        return yield* Effect.fail(new QemuDiskResizeRefused({ disk, message: refused.join('\n') }));
+      }
+      yield* qemuTask(
+        props,
+        nodes.putNodeQemuResize({
+          node: props.node,
+          vmid: String(props.vmid),
+          ...form,
+        }),
+        `resize VM ${props.vmid} ${disk} to ${size} GiB`,
+        polls,
+      );
+    }
+  });

package/src/proxmox/qemu-size.test.ts

@@ -0,0 +1,64 @@
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { FAKE_TARGET } from './fake-pve.ts';
+import { form } from './qemu-form.ts';
+import { judge } from './qemu-judge.ts';
+import type { VmProps } from './qemu-props.ts';
+import { diskBytes, validateDiskSizes } from './qemu-size.ts';
+
+const props = {
+  target: FAKE_TARGET,
+  node: 'n2',
+  vmid: 10000,
+  scsi0: 'cephtb4:0,import-from=local:import/talos.raw',
+};
+
+test('size units compare capacity, while targets never become config form keys', () => {
+  expect(diskBytes('ceph:disk,size=65536M')).toBe(64 * 1024 ** 3);
+  expect(diskBytes('ceph:disk,size=4.15G')).toBe(4.15 * 1024 ** 3);
+  expect(diskBytes('ceph:disk,size=4096K')).toBe(4 * 1024 ** 2);
+  expect(diskBytes('ceph:disk,size=1T')).toBe(1024 ** 4);
+  for (const size of ['NaNG', '0G', '-1G', '64GB', 'unknown']) {
+    expect(diskBytes(`ceph:disk,size=${size}`)).toBeUndefined();
+  }
+  const news = { ...props, diskSizesGiB: { scsi0: 64 } };
+  expect(form(news)).toEqual({ scsi0: props.scsi0 });
+  expect(judge(news, { scsi0: 'cephtb4:vm-10000-disk-0,size=4.15G' })).toEqual({
+    put: {},
+    refuse: [],
+    drift: ['diskSizesGiB.scsi0'],
+  });
+});
+
+test('invalid targets, unsupported slots, undeclared slots and seed disks fail with a typed tag', async () => {
+  const bad = [
+    { diskSizesGiB: null },
+    { diskSizesGiB: [] },
+    { diskSizesGiB: '64G' },
+    ...[0, -1, 1.5, NaN, Infinity, Number.MAX_SAFE_INTEGER, '64'].map((scsi0) => ({
+      diskSizesGiB: { scsi0 },
+    })),
+    { diskSizesGiB: { scsi31: 64 }, scsi31: 'cephtb4:1' },
+    { diskSizesGiB: { scsi1: 64 } },
+    { diskSizesGiB: { ide2: 64 }, ide2: 'cephtb4:cloudinit' },
+    { diskSizesGiB: { ide2: 64 }, ide2: 'local:iso/image.iso,media=cdrom' },
+  ];
+  for (const extra of bad) {
+    const result = await Effect.runPromise(
+      validateDiskSizes({ ...props, ...extra } as unknown as VmProps).pipe(
+        Effect.catchTag('QemuDiskResizeRefused', (error) => Effect.succeed(error._tag)),
+      ),
+    );
+    expect(result).toBe('QemuDiskResizeRefused');
+  }
+});
+
+test('an import source whose filename starts with cloudinit is still a regular disk', async () => {
+  await Effect.runPromise(
+    validateDiskSizes({
+      ...props,
+      scsi0: 'cephtb4:0,import-from=local:cloudinit-disk.raw',
+      diskSizesGiB: { scsi0: 64 },
+    }),
+  );
+});

package/src/proxmox/qemu-size.ts

@@ -0,0 +1,95 @@
+/** Grow-only targets are separate from config: PUT config's `size=` does not grow a disk. */
+import * as Data from 'effect/Data';
+import * as Effect from 'effect/Effect';
+import { type VmProps, declaredValue, indexedKey } from './qemu-props.ts';
+import { parseDisk } from './qemu-volume.ts';
+
+export class QemuDiskResizeRefused extends Data.TaggedError('QemuDiskResizeRefused')<{
+  readonly disk: string;
+  readonly message: string;
+}> {}
+
+/** PVE config reports binary sizes, including fractional G and integer M/K for imported images. */
+export const diskBytes = (config: string | undefined): number | undefined => {
+  const size = config === undefined ? undefined : parseDisk(config).size;
+  const match = size === undefined ? null : /^(\d+(?:\.\d+)?)([KMGT])?$/.exec(size);
+  if (match === null) return undefined;
+  const scale = { K: 1024, M: 1024 ** 2, G: 1024 ** 3, T: 1024 ** 4 };
+  const bytes = Number(match[1]) * (scale[match[2] as keyof typeof scale] ?? 1);
+  return Number.isFinite(bytes) && bytes > 0 ? bytes : undefined;
+};
+
+/** Validate the whole declaration before any write, including a later attempted target decrease. */
+export const validateDiskSizes = (props: VmProps, olds?: VmProps) =>
+  Effect.gen(function* () {
+    const sizes = props.diskSizesGiB;
+    if (sizes === undefined) return;
+    if (sizes === null || typeof sizes !== 'object' || Array.isArray(sizes)) {
+      return yield* Effect.fail(
+        new QemuDiskResizeRefused({
+          disk: 'diskSizesGiB',
+          message: 'diskSizesGiB must be a map of disk slots to GiB targets',
+        }),
+      );
+    }
+    for (const [disk, size] of Object.entries(sizes)) {
+      if (size === undefined) continue;
+      const family = indexedKey(disk)?.[0];
+      const value = declaredValue(props, disk);
+      const previous = olds?.diskSizesGiB?.[disk as keyof typeof sizes];
+      let reason: string | undefined;
+      if ((family !== 'scsi' && family !== 'ide') || typeof value !== 'string') {
+        reason = 'declare a supported scsi/ide disk slot before assigning a resize target';
+      } else if (
+        !Number.isSafeInteger(size) ||
+        size <= 0 ||
+        !Number.isSafeInteger(size * 1024 ** 3)
+      ) {
+        reason = 'the target must be a positive, safely representable integer GiB size';
+      } else if (
+        value.split(',')[0]?.endsWith(':cloudinit') === true ||
+        parseDisk(value).options.get('media') === 'cdrom'
+      ) {
+        reason = 'cloud-init and CD-ROM drives cannot be resized';
+      } else if (previous !== undefined && size < previous) {
+        reason = `refusing shrink from declared ${previous} GiB to ${size} GiB`;
+      }
+      if (reason !== undefined) {
+        return yield* Effect.fail(
+          new QemuDiskResizeRefused({ disk, message: `${disk}: ${reason}` }),
+        );
+      }
+    }
+  });
+
+/** Capacity drift drives reconcile; recovery ownership ignores it because resize follows create. */
+export const diskSizeDrift = (props: VmProps, config: Record<string, string>): string[] =>
+  Object.entries(props.diskSizesGiB ?? {})
+    .filter(
+      ([disk, size]) => size !== undefined && (diskBytes(config[disk]) ?? 0) < size * 1024 ** 3,
+    )
+    .map(([disk]) => `diskSizesGiB.${disk}`);
+
+/** Missing slots may be imported by the upcoming config write; unreadable existing sizes fail closed. */
+export const checkLiveDiskSizes = (
+  props: VmProps,
+  config: Record<string, string>,
+  allowMissing = false,
+) =>
+  Effect.gen(function* () {
+    for (const [disk, size] of Object.entries(props.diskSizesGiB ?? {})) {
+      if (size === undefined) continue;
+      if (allowMissing && config[disk] === undefined) continue;
+      if (
+        diskBytes(config[disk]) === undefined ||
+        parseDisk(config[disk] ?? '').options.get('media') === 'cdrom'
+      ) {
+        return yield* Effect.fail(
+          new QemuDiskResizeRefused({
+            disk,
+            message: `${disk}: the live disk has no readable positive size or is a CD-ROM`,
+          }),
+        );
+      }
+    }
+  });

package/src/proxmox/qemu-spec.ts

@@ -0,0 +1,44 @@
+/** QEMU config forms and vendor guards, separated from lifecycle to keep both reviewable. */
+import { createForm, updateForm } from './qemu-form.ts';
+import {
+  type VmAttributes,
+  type VmProps,
+  declaredKeys,
+  declaredValue,
+  isManagedKey,
+  storedConfig,
+  wireValue,
+} from './qemu-props.ts';
+import type { PveSpec } from './resource-spec.ts';
+import { specGuards } from './resource-guard.ts';
+
+export const attributesOf = (live: Record<string, unknown>, props: VmProps): VmAttributes => ({
+  config: storedConfig(live),
+  node: props.node,
+  vmid: props.vmid,
+});
+
+/**
+ * ⚠️ KEPT ONLY TO SATISFY `PveSpec`'S REQUIRED FIELD — `qemu-judge.ts`'s `judge` is what diff and
+ *   reconcile actually decide by, since a plain string compare is exactly the bug C1 found (it
+ *   never matches the "new disk" or MAC-less spellings a declaration may use).
+ */
+const matches = (attributes: VmAttributes, props: VmProps) =>
+  declaredKeys(props)
+    .filter(isManagedKey)
+    .every((key) => attributes.config[key] === wireValue(declaredValue(props, key)));
+
+export const spec = {
+  attributes: attributesOf,
+  collection: (props: VmProps) => `nodes/${props.node}/qemu`,
+  createForm,
+  endpoint: {
+    create: 'pve:POST /nodes/{node}/qemu',
+    update: 'pve:PUT /nodes/{node}/qemu/{vmid}/config',
+  },
+  matches,
+  path: (props: VmProps) => `nodes/${props.node}/qemu/${String(props.vmid)}/config`,
+  updateForm,
+} satisfies PveSpec<VmProps, VmAttributes>;
+
+export const { guardCreate, guardUpdate } = specGuards(spec);

package/src/proxmox/qemu-volume.ts

@@ -39,10 +39,10 @@
  *   whose volname is the literal `"0"` and whose options include an `import-from` key is `fresh`,
  *   with `import-from` itself dropped and every other declared option carried through for
  *   `judgeDisk` to enforce (see its `want.kind === 'fresh'` branch) -- independent of option order.
- * ⛔ NO RESIZE IS MADE HERE. lxc-volume.ts drives a second endpoint (`PUT .../resize`) this resource
- *   does not call — Talos's disks are declared once at their create size. A size difference between
- *   two already-adopted volume declarations is REFUSED with the `qm resize` to run by hand, never
- *   guessed at or silently written.
+ * ⛔ NO RESIZE IS MADE BY A CONFIG PUT. Before 2026-10-05 this resource did not call the resize
+ *   endpoint at all. `diskSizesGiB` now drives it separately (qemu-resize.ts), after import;
+ *   `size=` inside an adopted volume string still describes its observed size, never a resize.
+ *   A mismatch there is refused so a config PUT cannot record capacity the disk does not have.
  * ⚠️ OPTIONS BEYOND `size` ARE COMPARED AS A WHOLE, NOT KEY BY KEY, FOR AN ADOPTED `volume` -- BUT AS
  *   A SUBSET FOR A `fresh` IMPORT. Unlike lxc-volume.ts, this file does not model pve-qemu-server's
  *   per-option defaults (`ssd`, `discard`, `iothread`, …) — that table is unverified here. For an
@@ -169,7 +169,7 @@ export const judgeDisk = (key: string, declared: string, live: string): DiskVerd
     return {
       refuse:
         `${key}: declared size ${want.size} differs from the live ${have.size}. This resource does ` +
-        'not resize a disk -- grow it by hand (`qm resize`) and declare the size it then reports.',
+        'not resize a disk through config -- omit size= and declare a diskSizesGiB target instead.',
     };
   }
   if (sameMap(want.options, have.options)) return {};

package/src/verify/fake-engine.ts

@@ -129,7 +129,7 @@ type PlanView = { readonly resources: Readonly<Record<string, { readonly action:
 export type DriftRow = { readonly action: string };
 
 export interface FakeEngine {
-  /** Plan and apply `body`, as `alchemy deploy --adopt` would; resolves to the planned actions. */
+  /** Plan and apply `body` with the configured adoption policy; resolves to planned actions. */
   readonly deploy: (body: Body) => Promise<Record<string, string>>;
   /** Verify `body` against what the earlier deploys recorded. */
   readonly verify: (body: Body, options?: VerifyOptions) => Promise<AdoptReport>;
@@ -155,7 +155,10 @@ export interface FakeEngine {
  * hands in its real provider over a fake transport (proxmox/ceph-pool-adopt.test.ts).
  * ⚠️ THE CASTS ARE AT THE ENGINE'S TYPED BOUNDARY — openbao/fake-stack.ts has the reasoning.
  */
-export const engineOver = <ROut, E, RIn>(layer: Layer.Layer<ROut, E, RIn>): FakeEngine => {
+export const engineOver = <ROut, E, RIn>(
+  layer: Layer.Layer<ROut, E, RIn>,
+  options: { readonly adopt?: boolean } = {},
+): FakeEngine => {
   const rows: NonNullable<Parameters<typeof Alchemy.inMemoryState>[0]> = {};
   const state = Alchemy.inMemoryState(rows);
   const stack = Alchemy.Stack as unknown as (
@@ -176,7 +179,7 @@ export const engineOver = <ROut, E, RIn>(layer: Layer.Layer<ROut, E, RIn>): Fake
         const compiled = yield* stack('VerifyStack', { providers: layer, state }, body);
         return yield* next(compiled).pipe(Effect.provide(Layer.succeedContext(compiled.services)));
       }).pipe(
-        Effect.provideService(AdoptPolicy, true),
+        Effect.provideService(AdoptPolicy, options.adopt ?? true),
         Effect.provideService(Alchemy.Stage, 'test'),
         Effect.provide(state),
         Effect.scoped,