@homeflare/alchemy 0.7.0 → 0.10.0

package/dist/caddy/index.js

@@ -292,9 +292,10 @@ var loadCaddyfile = async (admin, caddyfile, sourceFile) => {
 };
 // src/caddy/config.ts
 import { Resource } from "alchemy";
+import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
-import * as Effect2 from "effect/Effect";
+import * as Effect6 from "effect/Effect";
 
 // src/launchd/host-effect.ts
 import * as Effect from "effect/Effect";
@@ -309,6 +310,183 @@ var resolvedString = (news, key) => {
   return typeof value === "string" ? value : undefined;
 };
 
+// src/ownership/adopt.ts
+import { AdoptPolicy } from "alchemy/AdoptPolicy";
+import { AlchemyContext } from "alchemy/AlchemyContext";
+import { Stack as Stack3 } from "alchemy/Stack";
+import * as Effect5 from "effect/Effect";
+import * as Option4 from "effect/Option";
+
+// src/ownership/resume.ts
+import { Unowned } from "alchemy/AdoptPolicy";
+import { Artifacts } from "alchemy/Artifacts";
+import * as Effect2 from "effect/Effect";
+import * as Option from "effect/Option";
+var PROVEN = "homeflare/ownership/resumes";
+var UNFINISHED = "homeflare/ownership/unfinished";
+var note = (key, instanceId) => Effect2.gen(function* () {
+  const bag = yield* Effect2.serviceOption(Artifacts);
+  if (Option.isSome(bag))
+    yield* bag.value.set(key, instanceId);
+});
+var noted = (key, instanceId) => Effect2.gen(function* () {
+  const bag = yield* Effect2.serviceOption(Artifacts);
+  if (Option.isNone(bag))
+    return false;
+  return (yield* bag.value.get(key)) === instanceId;
+});
+var noteUnfinished = (instanceId) => Effect2.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect2.gen(function* () {
+  yield* noteUnfinished(instanceId);
+  const unproven = () => Effect2.succeed(undefined);
+  const found = yield* recovered.pipe(Effect2.catch(unproven), Effect2.catchDefect(unproven));
+  if (found === undefined || found === null || Unowned.is(found))
+    return;
+  yield* note(PROVEN, instanceId);
+});
+var resumes = (instanceId) => noted(PROVEN, instanceId);
+var unfinished = (instanceId) => noted(UNFINISHED, instanceId);
+var provingResumes = (service) => {
+  const { diff, read } = service;
+  if (diff === undefined || read === undefined)
+    return service;
+  const proving = (input) => Effect2.gen(function* () {
+    if (input.output === undefined) {
+      yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
+    }
+    return yield* diff(input);
+  });
+  return { ...service, diff: proving };
+};
+
+// src/ownership/rows.ts
+import { Stack as Stack2 } from "alchemy/Stack";
+import { State, isActionState } from "alchemy/State/State";
+import * as Effect4 from "effect/Effect";
+import * as Option3 from "effect/Option";
+
+// src/ownership/whole.ts
+import { Stack } from "alchemy/Stack";
+import * as Effect3 from "effect/Effect";
+import * as Option2 from "effect/Option";
+var absent = (value) => value === undefined || value === null;
+var isPlainObject2 = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var carries = (declared, recorded) => {
+  if (absent(declared))
+    return true;
+  if (absent(recorded))
+    return false;
+  if (Array.isArray(declared)) {
+    if (!Array.isArray(recorded))
+      return false;
+    return declared.every((each, index) => carries(each, recorded[index]));
+  }
+  if (isPlainObject2(declared)) {
+    if (!isPlainObject2(recorded))
+      return false;
+    return Object.entries(declared).every(([key, each]) => carries(each, recorded[key]));
+  }
+  return true;
+};
+var wholeDeclaration = (fqn, props) => Effect3.map(Effect3.serviceOption(Stack), (stack) => {
+  const declared = Option2.isSome(stack) ? stack.value.resources[fqn] : undefined;
+  return declared !== undefined && carries(declared.Props, props);
+});
+
+// src/ownership/rows.ts
+var storeOf = Effect4.gen(function* () {
+  const stack = yield* Effect4.serviceOption(Stack2);
+  const state = yield* Effect4.serviceOption(State);
+  if (Option3.isNone(stack) || Option3.isNone(state))
+    return;
+  const store = yield* state.value;
+  const where = { stack: stack.value.name, stage: stack.value.stage };
+  return { resources: stack.value.resources, store, where };
+});
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect4.orElseSucceed(() => {
+  return;
+}));
+var generationOf = (row, instanceId) => {
+  let at = row;
+  while (typeof at === "object" && at !== null && !isActionState(at)) {
+    const generation = at;
+    if (generation.instanceId === instanceId)
+      return generation;
+    at = generation.old;
+  }
+  return;
+};
+var recordedGeneration = (fqn, instanceId) => Effect4.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  for (const at of [fqn, ...found.resources[fqn]?.FormerFqns ?? []]) {
+    const generation = generationOf(yield* rowAt(found.store, found.where, at), instanceId);
+    if (generation !== undefined)
+      return generation;
+  }
+  return;
+});
+var recordedInstance = (fqn, instanceId) => Effect4.gen(function* () {
+  const generation = yield* recordedGeneration(fqn, instanceId);
+  if (generation === undefined)
+    return "absent";
+  return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
+});
+var isCreate = (fqn, instanceId) => Effect4.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var forgetRefusedCreate = (fqn, instanceId) => Effect4.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  const row = yield* rowAt(found.store, found.where, fqn);
+  const mine = row;
+  if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
+    return;
+  }
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect4.ignore);
+});
+
+// src/ownership/adopt.ts
+var adoptEnabled = (fqn) => Effect5.gen(function* () {
+  const stack = yield* Effect5.serviceOption(Stack3);
+  const scoped = Option4.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
+  if (scoped !== undefined)
+    return scoped;
+  const policy = yield* Effect5.serviceOption(AdoptPolicy);
+  if (Option4.isSome(policy))
+    return policy.value;
+  const context = yield* Effect5.serviceOption(AlchemyContext);
+  return Option4.isSome(context) ? context.value.adopt : false;
+});
+var adoptable = (owner) => Effect5.gen(function* () {
+  if (yield* isCreate(owner.fqn, owner.instanceId))
+    return true;
+  return yield* unfinished(owner.instanceId);
+});
+var adoptsAtApply = (owner) => Effect5.gen(function* () {
+  if (!(yield* adoptEnabled(owner.fqn)))
+    return false;
+  return yield* adoptable(owner);
+});
+var refuseTakeover = (owner, what) => Effect5.gen(function* () {
+  if (owner.output !== undefined)
+    return;
+  if (yield* resumes(owner.instanceId))
+    return;
+  const may = yield* adoptable(owner);
+  if (may && (yield* adoptEnabled(owner.fqn)))
+    return;
+  yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
+  const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
+  return yield* Effect5.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+});
+var claimFor = (owner) => (what) => refuseTakeover(owner, what);
+
 // src/caddy/admin-guard.ts
 var DEFAULT_ADMIN_PORT = 2019;
 var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|\[?::1\]?)$/;
@@ -544,20 +722,48 @@ var desiredConfig = async (admin, props) => {
     throw refuse(admin, guard.join("; "));
   return { digest: configDigest(adapted.config), warnings: adapted.warnings };
 };
-var readLive = async (admin, sourceFile) => ({
-  configSha256: configDigest(await readRunningConfig(admin)),
+var attributesOf = (admin, running, sourceFile) => ({
+  configSha256: configDigest(running),
   endpoint: admin.endpoint,
   ...sourceFile === undefined ? {} : { sourceFile }
 });
+var readLive = async (admin, sourceFile) => attributesOf(admin, await readRunningConfig(admin), sourceFile);
+var claimable = (running, declaredDigest) => servesNothing(running) || configDigest(running) === declaredDigest;
+var probeLive = async (admin, caddyfile, sourceFile) => {
+  const running = await readRunningConfig(admin);
+  if (servesNothing(running))
+    return;
+  const attributes = attributesOf(admin, running, sourceFile);
+  if (caddyfile === undefined) {
+    return { attributes, ours: false, unchecked: "the stored Caddyfile is not plain text" };
+  }
+  try {
+    const want = await desiredConfig(admin, { caddyfile });
+    return { attributes, ours: claimable(running, want.digest) };
+  } catch (cause) {
+    if (cause instanceof CaddyUnreachableError)
+      throw cause;
+    return {
+      attributes,
+      ours: false,
+      unchecked: cause instanceof Error ? cause.message : String(cause)
+    };
+  }
+};
 var diffConfig = async (admin, news, output) => {
   const want = await desiredConfig(admin, news);
   const live = await readLive(admin);
   const converged = want.digest === live.configSha256 && live.configSha256 === output.configSha256 && news.sourceFile === output.sourceFile && admin.endpoint === output.endpoint;
   return converged ? { action: "noop" } : { action: "update" };
 };
-var reconcileConfig = async (admin, props) => {
+var reconcileConfig = async (admin, props, authority) => {
   const want = await desiredConfig(admin, props);
-  const before = configDigest(await readRunningConfig(admin));
+  const running = await readRunningConfig(admin);
+  const before = configDigest(running);
+  const known = before === authority.stored || claimable(running, want.digest);
+  if (!authority.takeOver && !known) {
+    throw refuse(admin, `Caddy runs config ${short(before)}, which this stack did not load, and the Caddyfile adapts ` + `to ${short(want.digest)} — loading it would replace every site that config serves. ` + "Deploy with --adopt (or wrap the resource in adopt(true)) to take this Caddy over, or " + "point caddyProviders() at the Caddy you meant.");
+  }
   let warnings = want.warnings;
   const loaded = before !== want.digest;
   if (loaded) {
@@ -585,35 +791,46 @@ var CaddyConfig = Resource("Caddy.Config", {
   defaultRemovalPolicy: "retain"
 });
 var unreachable = (error) => error instanceof CaddyUnreachableError;
-var planWithoutCaddy = (admin, fallback) => (error) => Effect2.as(Effect2.logWarning(`Caddy.Config: no Caddy at ${admin.endpoint} (${error.message}); planning without it — ` + "the Caddyfile is validated when the deploy reaches Caddy"), fallback);
-var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect2.gen(function* () {
+var planWithoutCaddy = (admin, fallback) => (error) => Effect6.as(Effect6.logWarning(`Caddy.Config: no Caddy at ${admin.endpoint} (${error.message}); planning without it — ` + "the Caddyfile is validated when the deploy reaches Caddy"), fallback);
+var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect6.gen(function* () {
   const admin = yield* CaddyAdminService;
+  const probe = (caddyfile, sourceFile) => Effect6.flatMap(lift(() => probeLive(admin, caddyfile, sourceFile)), (found) => {
+    if (found === undefined)
+      return Effect6.succeed(undefined);
+    if (found.ours)
+      return Effect6.succeed(found.attributes);
+    const unowned = Unowned2(found.attributes);
+    return found.unchecked === undefined ? Effect6.succeed(unowned) : Effect6.as(Effect6.logWarning(`Caddy.Config at ${admin.endpoint}: the running config could not be compared ` + `with the declared Caddyfile (${found.unchecked}), so it is not treated as ours`), unowned);
+  });
   return CaddyConfig.Provider.of({
-    list: () => Effect2.succeed([]),
-    read: ({ olds }) => lift(() => readLive(admin, resolvedString(olds, "sourceFile"))).pipe(Effect2.catchIf(unreachable, planWithoutCaddy(admin, undefined))),
+    list: () => Effect6.succeed([]),
+    read: ({ olds, output }) => (output === undefined ? probe(resolvedString(olds, "caddyfile"), resolvedString(olds, "sourceFile")) : lift(() => readLive(admin, resolvedString(olds, "sourceFile")))).pipe(Effect6.catchIf(unreachable, planWithoutCaddy(admin, undefined))),
     diff: ({ news, output }) => {
       if (output === undefined)
-        return Effect2.succeed(undefined);
+        return Effect6.succeed(undefined);
       const update = planWithoutCaddy(admin, { action: "update" });
       if (isResolved(news)) {
-        return lift(() => diffConfig(admin, news, output)).pipe(Effect2.catchIf(unreachable, update));
+        return lift(() => diffConfig(admin, news, output)).pipe(Effect6.catchIf(unreachable, update));
       }
       const caddyfile = resolvedString(news, "caddyfile");
       if (caddyfile === undefined)
-        return Effect2.succeed(undefined);
+        return Effect6.succeed(undefined);
       return lift(async () => {
         await diffConfig(admin, { caddyfile }, output);
         return { action: "update" };
-      }).pipe(Effect2.catchIf(unreachable, update));
+      }).pipe(Effect6.catchIf(unreachable, update));
     },
-    reconcile: ({ news }) => Effect2.gen(function* () {
-      const applied = yield* lift(() => reconcileConfig(admin, news));
+    reconcile: ({ fqn, news, output }) => Effect6.gen(function* () {
+      const sameCaddy = output !== undefined && output.endpoint === admin.endpoint;
+      const takeOver = sameCaddy || (yield* adoptEnabled(fqn));
+      const stored = output === undefined ? {} : { stored: output.configSha256 };
+      const applied = yield* lift(() => reconcileConfig(admin, news, { takeOver, ...stored }));
       for (const warning of applied.warnings) {
-        yield* Effect2.logWarning(`Caddy.Config at ${admin.endpoint}: ${warning}`);
+        yield* Effect6.logWarning(`Caddy.Config at ${admin.endpoint}: ${warning}`);
       }
       return applied.attributes;
     }),
-    delete: () => Effect2.void
+    delete: () => Effect6.void
   });
 }));
 // src/caddy/local-admin.ts
@@ -711,15 +928,15 @@ var localCaddyAdmin = (options = {}) => {
 import * as Layer2 from "effect/Layer";
 var caddyProviders = (admin = localCaddyAdmin()) => CaddyConfigProvider().pipe(Layer2.provide(caddyAdminLayer(admin)));
 // src/caddy/with-file.ts
-import * as Effect4 from "effect/Effect";
+import * as Effect8 from "effect/Effect";
 import * as RemovalPolicy from "alchemy/RemovalPolicy";
 
 // src/launchd/host-file.ts
 import { Resource as Resource2 } from "alchemy";
-import { Unowned } from "alchemy/AdoptPolicy";
+import { Unowned as Unowned3 } from "alchemy/AdoptPolicy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect3 from "effect/Effect";
+import * as Effect7 from "effect/Effect";
 
 // src/launchd/host-file-form.ts
 var DEFAULT_MODE = 420;
@@ -731,9 +948,8 @@ var identityProblems = (name, value) => {
   }
   return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
 };
-var fileProblems = (props) => {
+var pathProblems = (path) => {
   const found = [];
-  const { path } = props;
   if (!path.startsWith("/"))
     found.push("path must be absolute");
   if (path.endsWith("/") || path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..")) {
@@ -741,6 +957,10 @@ var fileProblems = (props) => {
   }
   if (path.includes("\x00"))
     found.push("path contains NUL");
+  return found;
+};
+var fileProblems = (props) => {
+  const found = pathProblems(props.path);
   const mode = props.mode ?? DEFAULT_MODE;
   if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
     found.push("mode must be 0–0o7777");
@@ -801,20 +1021,29 @@ var readFileAttributes = async (runner, path) => {
     uid: stat.uid
   };
 };
+var writeOptionsOf = (want) => ({
+  mode: want.mode,
+  ...want.uid === undefined ? {} : { uid: want.uid },
+  ...want.gid === undefined ? {} : { gid: want.gid }
+});
 var matches = (live, want) => live.sha256 === want.sha256 && live.mode === want.mode && (want.uid === undefined || live.uid === want.uid) && (want.gid === undefined || live.gid === want.gid);
 var diffFile = async (runner, news, output) => {
-  if (news.path !== output.path)
-    return { action: "replace" };
   const want = await desiredFile(runner, news);
+  const writes = async (diff) => {
+    await runner.checkWrite?.(news.path, writeOptionsOf(want));
+    return diff;
+  };
+  if (news.path !== output.path)
+    return writes({ action: "replace" });
   if (want.sha256 !== output.sha256)
-    return { action: "update" };
+    return writes({ action: "update" });
   const live = await readFileAttributes(runner, news.path);
-  return live !== undefined && matches(live, want) ? { action: "noop" } : { action: "update" };
+  return live !== undefined && matches(live, want) ? { action: "noop" } : writes({ action: "update" });
 };
-var reconcileFile = async (runner, props, output) => {
+var reconcileFile = async (runner, props, output, adopt = false) => {
   const want = await desiredFile(runner, props);
   if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {
-    throw refuse3(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy as root ` + "or through a privileged HostRunner (privileged: true). This provider never calls sudo.");
+    throw refuse3(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy as root ` + "or through a privileged HostRunner (sudoRunner() with this path under a prefix). This " + "provider never calls sudo itself.");
   }
   const stat = await runner.stat(props.path);
   if (stat !== undefined && stat.kind !== "file") {
@@ -823,15 +1052,12 @@ var reconcileFile = async (runner, props, output) => {
   const before = stat === undefined ? undefined : await readFileAttributes(runner, props.path);
   const moved = output !== undefined && output.path !== props.path;
   const prior = moved ? undefined : output;
-  if (prior === undefined && before !== undefined && !matches(before, want)) {
+  const takeOver = adopt && output === undefined;
+  if (prior === undefined && before !== undefined && !matches(before, want) && !takeOver) {
     throw refuse3(props.path, "already exists and is not this resource. Remove it, or declare it as a new resource and " + "deploy with --adopt.");
   }
   if (before === undefined || !matches(before, want)) {
-    await runner.writeFileAtomic(props.path, want.bytes, {
-      mode: want.mode,
-      ...want.uid === undefined ? {} : { uid: want.uid },
-      ...want.gid === undefined ? {} : { gid: want.gid }
-    });
+    await runner.writeFileAtomic(props.path, want.bytes, writeOptionsOf(want));
   }
   const after = await readFileAttributes(runner, props.path);
   if (after === undefined || !matches(after, want)) {
@@ -856,34 +1082,34 @@ var deleteFile = async (runner, output) => {
 
 // src/launchd/host-file.ts
 var HostFile = Resource2("Host.File");
-var HostFileProvider = () => Provider2.effect(HostFile, Effect3.gen(function* () {
+var HostFileProvider = () => Provider2.effect(HostFile, Effect7.gen(function* () {
   const runner = yield* HostRunnerService;
   return HostFile.Provider.of({
-    list: () => Effect3.succeed([]),
+    list: () => Effect7.succeed([]),
     read: ({ olds, output }) => lift(async () => {
       const found = await readFileAttributes(runner, olds.path);
       if (found === undefined)
         return;
-      return output === undefined ? Unowned(found) : found;
+      return output === undefined ? Unowned3(found) : found;
     }),
-    diff: ({ news, output }) => {
+    diff: ({ instanceId, news, output }) => {
       if (output === undefined)
-        return Effect3.succeed(undefined);
+        return noteUnfinished(instanceId);
       if (isResolved2(news))
         return lift(() => diffFile(runner, news, output));
       const path = resolvedString(news, "path");
-      return Effect3.succeed(path !== undefined && path !== output.path ? { action: "replace" } : undefined);
+      return Effect7.succeed(path !== undefined && path !== output.path ? { action: "replace" } : undefined);
     },
-    reconcile: ({ news, output }) => lift(() => reconcileFile(runner, news, output)),
+    reconcile: ({ fqn, instanceId, news, output }) => Effect7.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) => lift(() => reconcileFile(runner, news, output, adopt))),
     delete: ({ output }) => lift(() => deleteFile(runner, output))
   });
 }));
 
 // src/caddy/with-file.ts
-var caddyWithFile = (id, props) => Effect4.gen(function* () {
+var caddyWithFile = (id, props) => Effect8.gen(function* () {
   const found = configProblems({ caddyfile: props.caddyfile, sourceFile: props.path });
   if (found.length > 0) {
-    return yield* Effect4.fail(new Error(`caddyWithFile ${id}: ${found.join("; ")}`));
+    return yield* Effect8.fail(new Error(`caddyWithFile ${id}: ${found.join("; ")}`));
   }
   const file = yield* HostFile(`${id}-file`, {
     content: props.caddyfile,
@@ -908,5 +1134,5 @@ export {
   localCaddyAdmin
 };
 
-//# debugId=205F5FF536DDDFA164756E2164756E21
+//# debugId=13AB2C6EDF123C4E64756E2164756E21
 //# sourceMappingURL=index.js.map