@homeflare/alchemy 0.49.0 → 0.51.0

package/dist/kubernetes/helm-chart-bounded.d.ts

@@ -0,0 +1,44 @@
+/**
+ * `boundedHelmChartProvider`: upstream's `Kubernetes.HelmChart` provider with a wall-clock deadline
+ * on `reconcile` and `read`. Wrapped, never re-implemented (alchemy-provider-standard: use what
+ * Alchemy ships).
+ *
+ * ⛔ WHY (measured 2026-10-09, alchemy 2.0.0-beta.81): `requestJson` in `Kubernetes/internal/client.ts`
+ *   sets no timeout and no signal on any request, and retries transport errors only. A hung apiserver
+ *   therefore blocks a HelmChart reconcile or read forever, holding the 1h platform token across a
+ *   stuck deploy. The deadline turns that into a typed `KubernetesReconcileTimeout`.
+ * ★ A DIRECT `Provider(HelmChart)` layer, not a collection member: the engine checks the direct
+ *   service before any collection (`Provider.ts` `tryFindProviderRegistrationByType`), so merging
+ *   this beside `Kubernetes.providers()` makes the wrapper win with no change to upstream's layer.
+ * ⚠️ The interrupted fiber ABANDONS its socket (upstream takes no signal). The run then fails typed
+ *   and the process exits once main completes, so a dangling socket cannot hold anything.
+ * `diff`, `delete`, `stables` and `aliases` come from upstream by spread, so state identity and
+ * replace semantics are exactly upstream's.
+ */
+import { HelmChart } from 'alchemy/Kubernetes/HelmChart';
+import * as Provider from 'alchemy/Provider';
+import * as Layer from 'effect/Layer';
+/** A render + discovery + ~60 server-side-apply PATCHes fit well inside this. */
+export declare const HELM_RECONCILE_TIMEOUT = "5m0s";
+/** `read` is one connect (identity GET): a minute is generous. */
+export declare const HELM_READ_TIMEOUT = "1m0s";
+declare const KubernetesReconcileTimeout_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "KubernetesReconcileTimeout";
+} & Readonly<A>;
+/** The deadline passed with no answer from the apiserver. Names the row and seconds only. */
+export declare class KubernetesReconcileTimeout extends KubernetesReconcileTimeout_base<{
+    readonly id: string;
+    readonly operation: 'reconcile' | 'read';
+    readonly seconds: number;
+}> {
+    get message(): string;
+}
+/** True for a service built by `boundedHelmChartProvider`: lets a stack test its real layer. */
+export declare const isBoundedHelmChartProvider: (service: unknown) => boolean;
+/**
+ * ⛔ A malformed duration dies at layer build (`Effect.orDie`), never becomes a silent unbounded
+ *   call: a bad override cannot quietly drop the deadline.
+ */
+export declare const boundedHelmChartProvider: (reconcileTimeout?: string, readTimeout?: string) => Layer.Layer<Provider.Provider<HelmChart>, never, import("effect/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("alchemy").Stack | import("alchemy").Stage>;
+export {};
+//# sourceMappingURL=helm-chart-bounded.d.ts.map

package/dist/kubernetes/helm-chart-bounded.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm-chart-bounded.d.ts","sourceRoot":"","sources":["../../src/kubernetes/helm-chart-bounded.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,SAAS,EAAqB,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,SAAS,CAAC;;;;AAExC,6FAA6F;AAC7F,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AA6BD,gGAAgG;AAChG,eAAO,MAAM,0BAA0B,YAAa,OAAO,KAAG,OAGN,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,wBAAwB,sBACjB,MAAM,gBACX,MAAM,iPA2BuB,CAAC"}

package/dist/kubernetes/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Kubernetes helpers for Alchemy that upstream does not ship.
+ *
+ * ⛔ A DELIBERATELY SMALL BARREL (the `talos/index.ts` rule): the resource, its provider, its
+ *   props and the typed errors a stack can `catchTag`. The evaluators and the poll stay internal.
+ */
+export { HELM_READ_TIMEOUT, HELM_RECONCILE_TIMEOUT, KubernetesReconcileTimeout, boundedHelmChartProvider, isBoundedHelmChartProvider, } from './helm-chart-bounded.ts';
+export { KubernetesReady, KubernetesReadyProvider, type ReadyAttributes, type ReadyProps, } from './ready.ts';
+export type { ReadyCheck } from './ready-checks.ts';
+export { KubernetesReadyBadAfter, KubernetesReadyBadCheck, KubernetesReadyBadDuration, KubernetesReadyTimeout, KubernetesRolloutFailed, } from './ready-errors.ts';
+export { KubernetesReadyApiError, KubernetesReadyGetTimeout } from './ready-poll.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/kubernetes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/kubernetes/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/kubernetes/index.js

@@ -0,0 +1,585 @@
+// src/kubernetes/helm-chart-bounded.ts
+import { HelmChart, HelmChartProvider } from "alchemy/Kubernetes/HelmChart";
+import * as Provider2 from "alchemy/Provider";
+import * as Data5 from "effect/Data";
+import * as Duration3 from "effect/Duration";
+import * as Effect6 from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+// src/kubernetes/ready-classify.ts
+import * as Data from "effect/Data";
+var isNotFound = (error) => {
+  const e = error;
+  return e?._tag === "KubernetesNotFound" || e?._tag === "KubernetesApiError" && e.statusCode === 404;
+};
+var UPSTREAM_TRANSPORT = /^Failed Kubernetes /;
+var transientOf = (error) => {
+  const e = error;
+  if (e?._tag === "KubernetesReadyGetTimeout")
+    return { tag: "KubernetesReadyGetTimeout" };
+  if (e?._tag === "TalosClusterIdentityTimeout")
+    return { tag: "TalosClusterIdentityTimeout" };
+  if (e?._tag === "KubernetesApiError") {
+    const status = typeof e.statusCode === "number" ? e.statusCode : 0;
+    return status >= 500 || status === 429 ? { status, tag: "KubernetesApiError" } : undefined;
+  }
+  return error instanceof Error && e?._tag === undefined && UPSTREAM_TRANSPORT.test(error.message) ? { tag: "TransportError" } : undefined;
+};
+
+class KubernetesReadyApiError extends Data.TaggedError("KubernetesReadyApiError") {
+  get message() {
+    return `Kubernetes.Ready: ${this.method} ${this.path} responded ${this.statusCode}`;
+  }
+}
+var scrubbed = (error) => {
+  const e = error;
+  return e?._tag === "KubernetesApiError" ? new KubernetesReadyApiError({
+    method: String(e.method),
+    path: String(e.path),
+    statusCode: Number(e.statusCode)
+  }) : error;
+};
+
+// src/kubernetes/ready.ts
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Duration2 from "effect/Duration";
+import * as Effect5 from "effect/Effect";
+
+// src/talos/literal-connection.ts
+import { hasUnresolvedInputs } from "alchemy/Diff";
+import * as Effect from "effect/Effect";
+
+// src/talos/cluster-adapter-errors.ts
+import * as Data2 from "effect/Data";
+
+class TalosOpenBaoUnknownCluster extends Data2.TaggedError("TalosOpenBaoUnknownCluster") {
+  get message() {
+    return `talos-openbao adapter has no entry pinned to cluster uid ${this.uid} ` + `(configured uids: ${this.known.join(", ") || "none"}). Refused rather than reading ` + "another cluster's kubeconfig. If the cluster was retired, keep its entry with " + "`retired: true` and its uid until its rows are destroyed.";
+  }
+}
+
+class TalosOpenBaoAmbiguousUid extends Data2.TaggedError("TalosOpenBaoAmbiguousUid") {
+  get message() {
+    return `talos-openbao adapter entries ${this.aliases.join(", ")} are all pinned to uid ` + `${this.uid}. Refused instead of picking one: a uid names exactly one entry.`;
+  }
+}
+
+class TalosOpenBaoLegacyAuth extends Data2.TaggedError("TalosOpenBaoLegacyAuth") {
+  get message() {
+    return "talos-openbao connection carries a legacy `cluster` alias in its auth block. Refused " + "before any vault read or request, with no silent migration (old and new auth differ, so " + "upstream would PATCH then DELETE the same object). Remedy: edit the saved state ONCE so " + "each such row's `connection.auth` is `{ kind: 'talos-openbao', uid }` (drop `cluster`), " + "then redeploy.";
+  }
+}
+
+class TalosClusterMoved extends Data2.TaggedError("TalosClusterMoved") {
+  get message() {
+    return `Talos.ClusterIdentity '${this.cluster}' published uid ${this.saved} but the vault key now ` + `answers as ${this.live}. Refused, not updated: an update cannot become a replace for the ` + "workloads downstream, so the new cluster would be force-applied and the old one orphaned. " + "A move is explicit: declare a NEW Talos.ClusterIdentity for the new cluster and leave this " + "one pointing at the old cluster until its workloads are destroyed.";
+  }
+}
+
+class TalosVaultKeyMissing extends Data2.TaggedError("TalosVaultKeyMissing") {
+  get message() {
+    return `${this.mount}/${this.key}: OpenBao has no value at this key. Talos.Kubeconfig writes it ` + "once at bring-up. Connect refused instead of reading a kubeconfig from disk.";
+  }
+}
+
+class TalosKubeconfigUnreadable extends Data2.TaggedError("TalosKubeconfigUnreadable") {
+  get message() {
+    return `${this.mount}/${this.key}: OpenBao kubeconfig does not parse for context ${this.context}. ` + "The document stayed in the vault. Connect wrote nothing to disk and nothing to state.";
+  }
+}
+
+class TalosOpenBaoAuthKind extends Data2.TaggedError("TalosOpenBaoAuthKind") {
+  get message() {
+    return `talos-openbao adapter received auth kind '${this.kind}'. This adapter only connects ` + "`talos-openbao`.";
+  }
+}
+
+class TalosClusterIdentityMissing extends Data2.TaggedError("TalosClusterIdentityMissing") {
+  get message() {
+    return "talos-openbao connection carries no uid, so it cannot say which physical cluster it " + "targets. Refused before any vault read or request: pin the uid " + "printed by `Talos.ClusterIdentity` as a literal in `TalosOpenBaoAdapter` and build " + "workloads from `talosOpenBaoConnection(<that literal>)`.";
+  }
+}
+
+class TalosClusterIdentityMismatch extends Data2.TaggedError("TalosClusterIdentityMismatch") {
+  get message() {
+    return `talos-openbao cluster '${this.cluster}' answered as kube-system uid ${this.got}, but the ` + `saved connection expects ${this.expected}. Refused before any apply or delete: the name ` + "now resolves to a different physical cluster. If the original cluster is gone for good, " + "remove its rows from state deliberately.";
+  }
+}
+
+class TalosClusterIdentityUnreadable extends Data2.TaggedError("TalosClusterIdentityUnreadable") {
+  get message() {
+    return `talos-openbao cluster '${this.cluster}': kube-system has no readable metadata.uid. ` + "Refused rather than assuming the cluster is the expected one.";
+  }
+}
+
+class TalosClusterIdentityTimeout extends Data2.TaggedError("TalosClusterIdentityTimeout") {
+  get message() {
+    return `talos-openbao cluster '${this.cluster}': no answer to the kube-system uid read within ` + `${this.seconds}s (the identity read's own deadline, inside the 10 s connect deadline). ` + "Refused (failed closed) rather than waiting on a silent apiserver.";
+  }
+}
+
+class TalosOpenBaoConnectTimeout extends Data2.TaggedError("TalosOpenBaoConnectTimeout") {
+  get message() {
+    return `talos-openbao cluster '${this.cluster}': vault read and identity check did not finish ` + `within ${this.seconds}s. Refused (failed closed); the bao child was killed.`;
+  }
+}
+
+class TalosUidNotLiteral extends Data2.TaggedError("TalosUidNotLiteral") {
+  get message() {
+    return "talos-openbao connection uid must be a literal string taken from the adapter config, not " + "an Output (for example a Talos.ClusterIdentity attribute). An unresolved uid hides a " + "cluster change from the plan: upstream would plan an UPDATE and reconcile the old cluster's " + "objects on the new one. Pin the uid in `TalosOpenBaoAdapter` and take it from there.";
+  }
+}
+
+// src/talos/literal-connection.ts
+var literalConnectionRefusal = (connection) => {
+  const auth = connection?.auth;
+  return hasUnresolvedInputs(connection) || auth?.kind !== "talos-openbao" || typeof auth?.uid !== "string" || auth.uid === "" ? new TalosUidNotLiteral({}) : undefined;
+};
+var withLiteralConnection = (resource) => new Proxy(resource, {
+  apply: (target, thisArg, args) => {
+    const refusal = (given) => literalConnectionRefusal(given?.connection);
+    const props = args[1];
+    if (Effect.isEffect(props)) {
+      const checked = props.pipe(Effect.flatMap((resolved) => {
+        const refused2 = refusal(resolved);
+        return refused2 === undefined ? Effect.succeed(resolved) : Effect.fail(refused2);
+      }));
+      return Reflect.apply(target, thisArg, [args[0], checked, ...args.slice(2)]);
+    }
+    const refused = refusal(props);
+    return refused === undefined ? Reflect.apply(target, thisArg, args) : Effect.fail(refused);
+  }
+});
+
+// src/kubernetes/ready-errors.ts
+import * as Data3 from "effect/Data";
+var describeState = (state) => {
+  if (state === undefined)
+    return "";
+  if ("notFound" in state)
+    return " (not found)";
+  const counts = Object.entries(state.counts).map(([name, value]) => `${name}=${value}`);
+  return counts.length === 0 ? "" : ` (${counts.join(" ")})`;
+};
+
+class KubernetesReadyTimeout extends Data3.TaggedError("KubernetesReadyTimeout") {
+  get message() {
+    const failing = this.failing.map((key) => `${key}${describeState(this.states?.[key])}`);
+    const last = this.lastTransient === undefined ? "" : `; last transient error ${this.lastTransient.tag}${this.lastTransient.status === undefined ? "" : ` ${this.lastTransient.status}`}`;
+    return `Kubernetes.Ready: not ready within ${this.seconds}s: ${failing.join(", ")}${last}`;
+  }
+}
+
+class KubernetesRolloutFailed extends Data3.TaggedError("KubernetesRolloutFailed") {
+  get message() {
+    return this.reason === "UpdateStrategyNotRollingUpdate" ? `Kubernetes.Ready: ${this.check} does not use the RollingUpdate update strategy` : `Kubernetes.Ready: ${this.check} exceeded its progress deadline (ProgressDeadlineExceeded)`;
+  }
+}
+
+class KubernetesReadyBadDuration extends Data3.TaggedError("KubernetesReadyBadDuration") {
+  get message() {
+    const shown = this.value.length > 40 ? `${this.value.slice(0, 40)}...` : this.value;
+    return `${this.resource ?? "Kubernetes.Ready"}: ${this.field} '${shown}' is not a duration like 10m0s`;
+  }
+}
+
+class KubernetesReadyBadCheck extends Data3.TaggedError("KubernetesReadyBadCheck") {
+  get message() {
+    return `Kubernetes.Ready: checks[${this.index}] ${this.problem}`;
+  }
+}
+
+class KubernetesReadyBadAfter extends Data3.TaggedError("KubernetesReadyBadAfter") {
+  get message() {
+    return `Kubernetes.Ready: after[${this.index}] is not chart.objects (the only shape that waits for the chart's update)`;
+  }
+}
+
+// src/kubernetes/ready-checks.ts
+var checkKey = (check) => {
+  switch (check.kind) {
+    case "DaemonSet":
+      return `DaemonSet/${check.namespace}/${check.name}${check.minReady === undefined ? "" : `:min=${check.minReady}`}`;
+    case "Deployment":
+      return `Deployment/${check.namespace}/${check.name}`;
+    case "CustomResourceDefinition":
+      return `CustomResourceDefinition/${check.name}`;
+  }
+};
+var checksCsv = (checks) => checks.map(checkKey).join(",");
+var validateChecks = (checks) => {
+  if (!Array.isArray(checks) || checks.length === 0) {
+    return new KubernetesReadyBadCheck({ index: 0, problem: "must list at least one check" });
+  }
+  for (const [index, raw] of checks.entries()) {
+    const check = obj(raw);
+    const bad = (problem) => new KubernetesReadyBadCheck({ index, problem });
+    const kind = check["kind"];
+    if (kind !== "DaemonSet" && kind !== "Deployment" && kind !== "CustomResourceDefinition") {
+      return bad("has an unknown kind");
+    }
+    if (typeof check["name"] !== "string" || check["name"] === "") {
+      return bad("needs a non-empty name");
+    }
+    if (kind !== "CustomResourceDefinition") {
+      if (typeof check["namespace"] !== "string" || check["namespace"] === "") {
+        return bad(`needs a non-empty namespace (${kind} is namespaced)`);
+      }
+    }
+    const min = check["minReady"];
+    if (min !== undefined && (kind !== "DaemonSet" || !Number.isInteger(min) || Number(min) < 1)) {
+      return bad("minReady is an integer >= 1 and only applies to a DaemonSet");
+    }
+  }
+  return;
+};
+var obj = (value) => typeof value === "object" && value !== null ? value : {};
+var num = (value) => typeof value === "number" ? value : 0;
+var countsOf = (check, body) => {
+  const status = obj(obj(body)["status"]);
+  const names = check.kind === "DaemonSet" ? [
+    "observedGeneration",
+    "desiredNumberScheduled",
+    "updatedNumberScheduled",
+    "numberAvailable"
+  ] : check.kind === "Deployment" ? ["observedGeneration", "replicas", "updatedReplicas", "availableReplicas"] : [];
+  const counts = Object.fromEntries(names.map((name) => [name, num(status[name])]));
+  return { counts: { generation: num(obj(obj(body)["metadata"])["generation"]), ...counts } };
+};
+var conditions = (status) => Array.isArray(status["conditions"]) ? status["conditions"].map(obj) : [];
+var daemonSet = (body, minReady) => {
+  const status = obj(body["status"]);
+  const strategy = obj(obj(body["spec"])["updateStrategy"])["type"];
+  if (strategy !== undefined && strategy !== "RollingUpdate")
+    return "failed";
+  const generation = num(obj(body["metadata"])["generation"]);
+  if (num(status["observedGeneration"]) < generation)
+    return "pending";
+  const desired = num(status["desiredNumberScheduled"]);
+  const need = minReady ?? desired;
+  if (need < 1)
+    return "pending";
+  const updated = num(status["updatedNumberScheduled"]);
+  const oldAtMost = Math.max(desired - updated, 0);
+  return updated >= need && num(status["numberAvailable"]) - oldAtMost >= need ? "ready" : "pending";
+};
+var deployment = (body) => {
+  const status = obj(body["status"]);
+  const generation = num(obj(body["metadata"])["generation"]);
+  if (num(status["observedGeneration"]) < generation)
+    return "pending";
+  const exceeded = conditions(status).some((c) => c["type"] === "Progressing" && c["reason"] === "ProgressDeadlineExceeded");
+  if (exceeded)
+    return "failed";
+  const desired = obj(body["spec"])["replicas"] === undefined ? 1 : num(obj(body["spec"])["replicas"]);
+  const updated = num(status["updatedReplicas"]);
+  return updated >= desired && num(status["replicas"]) === updated && num(status["availableReplicas"]) >= updated ? "ready" : "pending";
+};
+var established = (body) => conditions(obj(body["status"])).some((c) => c["type"] === "Established" && c["status"] === "True") ? "ready" : "pending";
+var evaluate = (check, body) => {
+  if (typeof body !== "object" || body === null)
+    return "pending";
+  switch (check.kind) {
+    case "DaemonSet":
+      return daemonSet(body, check.minReady);
+    case "Deployment":
+      return deployment(body);
+    case "CustomResourceDefinition":
+      return established(body);
+  }
+};
+
+// src/kubernetes/ready-connect.ts
+import { connectCluster } from "alchemy/Kubernetes/internal/client";
+import * as Effect2 from "effect/Effect";
+var connectOnce = (connection) => connectCluster(connection).pipe(Effect2.mapError(scrubbed));
+var connectForDiff = (connection) => Effect2.gen(function* () {
+  const attempt = yield* Effect2.result(connectCluster(connection));
+  if (attempt._tag === "Success")
+    return attempt.success;
+  return transientOf(attempt.failure) === undefined ? yield* Effect2.fail(scrubbed(attempt.failure)) : undefined;
+});
+var connectTolerant = (connection, pollInterval) => (note) => Effect2.gen(function* () {
+  while (true) {
+    const attempt = yield* Effect2.result(connectCluster(connection));
+    if (attempt._tag === "Success")
+      return attempt.success;
+    const transient = transientOf(attempt.failure);
+    if (transient === undefined)
+      return yield* Effect2.fail(scrubbed(attempt.failure));
+    yield* note(transient);
+    yield* Effect2.sleep(pollInterval);
+  }
+});
+
+// src/kubernetes/ready-declare.ts
+import { isPropExpr } from "alchemy/Output";
+import * as Effect3 from "effect/Effect";
+var declarationRefusal = (props) => {
+  const { after, checks } = props ?? {};
+  const badCheck = validateChecks(checks);
+  if (badCheck !== undefined)
+    return badCheck;
+  if (after === undefined)
+    return;
+  const list = Array.isArray(after) ? after : [after];
+  const index = list.findIndex((item) => !(isPropExpr(item) && item.identifier === "objects"));
+  return index === -1 ? undefined : new KubernetesReadyBadAfter({ index });
+};
+var declaredReady = (resource) => new Proxy(resource, {
+  apply: (target, thisArg, args) => {
+    const props = args[1];
+    if (Effect3.isEffect(props)) {
+      const checked = props.pipe(Effect3.flatMap((resolved) => {
+        const refused2 = declarationRefusal(resolved);
+        return refused2 === undefined ? Effect3.succeed(resolved) : Effect3.fail(refused2);
+      }));
+      return Reflect.apply(target, thisArg, [args[0], checked, ...args.slice(2)]);
+    }
+    const refused = declarationRefusal(props);
+    return refused === undefined ? Reflect.apply(target, thisArg, args) : Effect3.fail(refused);
+  }
+});
+
+// src/kubernetes/ready-poll.ts
+import { readObject } from "alchemy/Kubernetes/internal/client";
+import * as Data4 from "effect/Data";
+import * as Duration from "effect/Duration";
+import * as Effect4 from "effect/Effect";
+import * as Ref from "effect/Ref";
+var GET_TIMEOUT = Duration.seconds(5);
+
+class KubernetesReadyGetTimeout extends Data4.TaggedError("KubernetesReadyGetTimeout") {
+  get message() {
+    return `Kubernetes.Ready: GET for ${this.check} timed out after ${this.seconds}s`;
+  }
+}
+var REFS = {
+  CustomResourceDefinition: {
+    apiVersion: "apiextensions.k8s.io/v1",
+    kind: "CustomResourceDefinition"
+  },
+  DaemonSet: { apiVersion: "apps/v1", kind: "DaemonSet" },
+  Deployment: { apiVersion: "apps/v1", kind: "Deployment" }
+};
+var refOf = (check) => ({
+  ...REFS[check.kind],
+  name: check.name,
+  ..."namespace" in check ? { namespace: check.namespace } : {}
+});
+var BACKOFF_CAP = Duration.seconds(30);
+var getOne = (transport, check) => readObject({ object: refOf(check), transport }).pipe(Effect4.timeoutOrElse({
+  duration: GET_TIMEOUT,
+  orElse: () => Effect4.fail(new KubernetesReadyGetTimeout({
+    check: checkKey(check),
+    seconds: Duration.toSeconds(GET_TIMEOUT)
+  }))
+}));
+var pass = (transport, checks, tolerant) => Effect4.gen(function* () {
+  const pending = [];
+  const failed = [];
+  const states = {};
+  let lastTransient;
+  let timedOut = false;
+  for (const check of checks) {
+    const key = checkKey(check);
+    if (timedOut) {
+      pending.push(key);
+      continue;
+    }
+    const outcome = yield* getOne(transport, check).pipe(Effect4.map((body) => {
+      states[key] = countsOf(check, body);
+      return evaluate(check, body);
+    }), Effect4.catch((error) => {
+      if (isNotFound(error)) {
+        states[key] = { notFound: true };
+        return Effect4.succeed("pending");
+      }
+      const transient = tolerant ? transientOf(error) : undefined;
+      if (transient === undefined)
+        return Effect4.fail(scrubbed(error));
+      lastTransient = transient;
+      timedOut = timedOut || transient.tag === "KubernetesReadyGetTimeout";
+      return Effect4.succeed("pending");
+    }));
+    if (outcome === "pending")
+      pending.push(key);
+    if (outcome === "failed")
+      failed.push(key);
+  }
+  return {
+    failed,
+    pending,
+    states,
+    timedOut,
+    ...lastTransient === undefined ? {} : { lastTransient }
+  };
+});
+var poll = (connect, checks, waitTimeout, pollInterval) => Effect4.gen(function* () {
+  const pendingNow = checks.map(checkKey);
+  const last = yield* Ref.make({
+    pending: pendingNow,
+    states: {}
+  });
+  const transient = yield* Ref.make(undefined);
+  const loop = Effect4.gen(function* () {
+    const transport = yield* connect((t) => Ref.set(transient, t));
+    let pause = pollInterval;
+    while (true) {
+      const result2 = yield* pass(transport, checks, true);
+      yield* Ref.update(last, (prior) => ({
+        pending: result2.pending,
+        states: { ...prior.states, ...result2.states }
+      }));
+      yield* Ref.set(transient, result2.lastTransient);
+      const [firstFailed] = result2.failed;
+      if (firstFailed !== undefined) {
+        return yield* Effect4.fail(new KubernetesRolloutFailed({
+          check: firstFailed,
+          reason: firstFailed.startsWith("DaemonSet/") ? "UpdateStrategyNotRollingUpdate" : "ProgressDeadlineExceeded"
+        }));
+      }
+      if (result2.pending.length === 0)
+        return;
+      pause = result2.timedOut ? Duration.min(Duration.times(pause, 2), Duration.max(BACKOFF_CAP, pollInterval)) : pollInterval;
+      yield* Effect4.sleep(pause);
+    }
+  });
+  return yield* loop.pipe(Effect4.timeoutOrElse({
+    duration: waitTimeout,
+    orElse: () => Effect4.gen(function* () {
+      const { pending, states } = yield* Ref.get(last);
+      const lastTransient = yield* Ref.get(transient);
+      const seen = Object.fromEntries(pending.flatMap((k) => states[k] ? [[k, states[k]]] : []));
+      return yield* Effect4.fail(new KubernetesReadyTimeout({
+        failing: pending,
+        seconds: Duration.toSeconds(waitTimeout),
+        states: seen,
+        ...lastTransient === undefined ? {} : { lastTransient }
+      }));
+    })
+  }));
+});
+
+// src/kubernetes/ready.ts
+var KubernetesReady = declaredReady(withLiteralConnection(Resource("HomeFlare.Kubernetes.Ready")));
+var HOUR_MS = 3600000;
+var MINUTE_MS = 60000;
+var SECOND_MS = 1000;
+var GO_DURATION = /^(?:(\d{1,4})h)?(?:(\d{1,4})m)?(?:(\d{1,6})s)?$/;
+var MAX_DURATION_LENGTH = 20;
+var parseGoDuration = (field, value, resource) => Effect5.gen(function* () {
+  const refuse = () => Effect5.fail(new KubernetesReadyBadDuration({
+    field,
+    value,
+    ...resource === undefined ? {} : { resource }
+  }));
+  const match = value.length > MAX_DURATION_LENGTH ? null : GO_DURATION.exec(value);
+  if (match === null || value === "")
+    return yield* refuse();
+  const [, h, m, s] = match;
+  const ms = Number(h ?? 0) * HOUR_MS + Number(m ?? 0) * MINUTE_MS + Number(s ?? 0) * SECOND_MS;
+  if (ms <= 0)
+    return yield* refuse();
+  return Duration2.millis(ms);
+});
+var attributes = (props, ready) => ({
+  checks: checksCsv(props.checks),
+  connection: props.connection,
+  ready
+});
+var sameConnection = (left, right) => right?.auth?.kind === left.auth.kind && right.auth.uid === left.auth.uid && !Object.hasOwn(right.auth, "cluster");
+var readReady = (props) => Effect5.gen(function* () {
+  const transport = yield* connectOnce(props.connection);
+  const result2 = yield* pass(transport, props.checks, false);
+  return attributes(props, result2.pending.length === 0 && result2.failed.length === 0);
+});
+var readReadyForDiff = (props) => Effect5.gen(function* () {
+  const transport = yield* connectForDiff(props.connection);
+  if (transport === undefined)
+    return;
+  const result2 = yield* pass(transport, props.checks, true);
+  const settled = result2.pending.length === 0 && result2.failed.length === 0;
+  return settled ? attributes(props, true) : undefined;
+});
+var reconcileReady = (props) => Effect5.gen(function* () {
+  const waitTimeout = yield* parseGoDuration("waitTimeout", props.waitTimeout ?? "10m0s");
+  const pollInterval = yield* parseGoDuration("pollInterval", props.pollInterval ?? "10s");
+  const connect = connectTolerant(props.connection, pollInterval);
+  yield* poll(connect, props.checks, waitTimeout, pollInterval);
+  return attributes(props, true);
+});
+var diffReady = (news, output) => Effect5.gen(function* () {
+  const refused = literalConnectionRefusal(news.connection);
+  if (refused !== undefined)
+    return yield* Effect5.fail(refused);
+  if (output === undefined || !isResolved(news))
+    return;
+  if (!sameConnection(news.connection, output.connection))
+    return { action: "replace" };
+  const live = yield* readReadyForDiff(news);
+  return live !== undefined && live.checks === output.checks ? { action: "noop" } : { action: "update" };
+});
+var readHandler = ({
+  olds,
+  output
+}) => output === undefined ? Effect5.succeed(undefined) : readReady(olds);
+var handlers = {
+  delete: () => Effect5.void,
+  diff: ({ news, output }) => diffReady(news, output),
+  list: () => Effect5.succeed([]),
+  read: readHandler,
+  reconcile: ({ news }) => reconcileReady(news),
+  stables: ["connection"]
+};
+var KubernetesReadyProvider = () => Provider.effect(KubernetesReady, Effect5.succeed(KubernetesReady.Provider.of(handlers)));
+
+// src/kubernetes/helm-chart-bounded.ts
+var HELM_RECONCILE_TIMEOUT = "5m0s";
+var HELM_READ_TIMEOUT = "1m0s";
+
+class KubernetesReconcileTimeout extends Data5.TaggedError("KubernetesReconcileTimeout") {
+  get message() {
+    return `Kubernetes.HelmChart ${this.id}: ${this.operation} did not finish within ${this.seconds}s (the apiserver stopped answering)`;
+  }
+}
+var bound = (effect3, deadline, id, operation) => effect3.pipe(Effect6.mapError((error) => scrubbed(error)), Effect6.timeoutOrElse({
+  duration: deadline,
+  orElse: () => Effect6.fail(new KubernetesReconcileTimeout({ id, operation, seconds: Duration3.toSeconds(deadline) }))
+}));
+var HelmChartKey = Provider2.Provider(HelmChart.Type);
+var BOUNDED = Symbol.for("@homeflare/alchemy/kubernetes/boundedHelmChartProvider");
+var isBoundedHelmChartProvider = (service) => typeof service === "object" && service !== null && service[BOUNDED] === true;
+var boundedHelmChartProvider = (reconcileTimeout = HELM_RECONCILE_TIMEOUT, readTimeout = HELM_READ_TIMEOUT) => Layer.effect(HelmChartKey, Effect6.gen(function* () {
+  const inner = yield* HelmChartKey;
+  const reconcileDeadline = yield* parseGoDuration("reconcileTimeout", reconcileTimeout, "Kubernetes.HelmChart");
+  const innerRead = inner.read?.bind(inner);
+  const readDeadline = yield* parseGoDuration("readTimeout", readTimeout, "Kubernetes.HelmChart");
+  const service = {
+    ...inner,
+    reconcile: (input) => bound(inner.reconcile(input), reconcileDeadline, input.id, "reconcile"),
+    ...innerRead === undefined ? {} : { read: (input) => bound(innerRead(input), readDeadline, input.id, "read") }
+  };
+  return Object.defineProperty(service, BOUNDED, { value: true });
+}).pipe(Effect6.orDie)).pipe(Layer.provide(HelmChartProvider()));
+export {
+  HELM_READ_TIMEOUT,
+  HELM_RECONCILE_TIMEOUT,
+  KubernetesReady,
+  KubernetesReadyApiError,
+  KubernetesReadyBadAfter,
+  KubernetesReadyBadCheck,
+  KubernetesReadyBadDuration,
+  KubernetesReadyGetTimeout,
+  KubernetesReadyProvider,
+  KubernetesReadyTimeout,
+  KubernetesReconcileTimeout,
+  KubernetesRolloutFailed,
+  boundedHelmChartProvider,
+  isBoundedHelmChartProvider
+};
+
+//# debugId=2779EA87BD42448264756E2164756E21
+//# sourceMappingURL=index.js.map