@dovocode/workstation 0.1.0

package/dist/index.js

@@ -0,0 +1,1318 @@
+// src/api/jsonc.ts
+var JsoncDocument = class _JsoncDocument {
+  /** Store the rendered document text; callers construct documents through the builder commands. */
+  constructor(content) {
+    this.content = content;
+  }
+  /** @internal Build from typed commands; arbitrary unvalidated JSONC is not accepted. */
+  static from(lines) {
+    const flattened = flatten(lines);
+    if (flattened.filter((line) => line.kind === "value").length !== 1 || flattened.some((line) => line.kind === "property")) {
+      throw new Error("A JSONC document must contain exactly one value and no top-level properties");
+    }
+    return new _JsoncDocument(renderLines(flattened, 0, false).join("\n") + "\n");
+  }
+};
+var jsonc = {
+  /** Join a document's comments and single root value, separating commands by newlines.
+   * @example jsonc.concat(jsonc.comment("Editor settings"), jsonc.object([jsonc.property("theme", "dark")]))
+   */
+  concat(...lines) {
+    return JsoncDocument.from(lines);
+  },
+  /** Add a // comment. Each line of multiline text receives its own comment prefix. */
+  comment(text) {
+    return { kind: "comment", text };
+  },
+  /** Insert an intentional empty line. */
+  blank() {
+    return { kind: "blank" };
+  },
+  /** Add an object property. Values may be ordinary JSON data or a nested JSONC document. */
+  property(name, value) {
+    return { kind: "property", name, content: renderValue(value) };
+  },
+  /** Add a JSON value, for example an array element or a primitive document root. */
+  value(value) {
+    return { kind: "value", content: renderValue(value) };
+  },
+  /** Build an object from properties, comments, blank lines, and optional groups. */
+  object(lines) {
+    return container(lines, "property", "{", "}");
+  },
+  /** Build an array from values, comments, blank lines, and optional groups. */
+  array(lines) {
+    return container(lines, "value", "[", "]");
+  }
+};
+function container(lines, kind, open, close) {
+  const commands = flatten(lines);
+  if (commands.some((line) => line.kind !== kind && line.kind !== "comment" && line.kind !== "blank")) {
+    throw new Error(`JSONC ${open === "{" ? "objects require properties" : "arrays require values"}`);
+  }
+  const body = renderLines(commands, 1, true);
+  const content = body.length ? [open, ...body, close].join("\n") : open + close;
+  return JsoncDocument.from([{ kind: "value", content }]);
+}
+function flatten(lines) {
+  return lines.flatMap((line) => {
+    if (!line) return [];
+    if (line instanceof JsoncDocument) return [{ kind: "value", content: line.content.trimEnd() }];
+    if (isGroup(line)) return flatten(line);
+    return [line];
+  });
+}
+function isGroup(line) {
+  return Array.isArray(line);
+}
+function renderLines(lines, depth, commas) {
+  const indent = "  ".repeat(depth);
+  const lastValue = lines.findLastIndex((line) => line.kind === "value" || line.kind === "property");
+  return lines.flatMap((line, index) => {
+    if (line.kind === "blank") return [""];
+    if (line.kind === "comment") return line.text.split(/\r\n|\r|\n/).map((text) => `${indent}// ${text}`);
+    const content = line.kind === "property" ? `${JSON.stringify(line.name)}: ${line.content}` : line.content;
+    const rendered = content.split("\n").map((text) => indent + text);
+    if (commas && index !== lastValue) {
+      if (/^\s*\/\//.test(rendered.at(-1) ?? "")) rendered.push(indent + ",");
+      else rendered[rendered.length - 1] += ",";
+    }
+    return rendered;
+  });
+}
+function renderValue(value) {
+  if (value instanceof JsoncDocument) return value.content.trimEnd();
+  const content = JSON.stringify(value, (_key, item) => {
+    if (typeof item === "number" && !Number.isFinite(item)) throw new Error("JSONC numbers must be finite");
+    if (item === void 0 || typeof item === "function" || typeof item === "symbol") throw new Error("Invalid JSONC value");
+    return item;
+  }, 2);
+  if (content === void 0) throw new Error("Invalid JSONC value");
+  return content;
+}
+
+// src/api/tasks.ts
+function task(command, args = [], options = {}) {
+  return { command, args, ...options };
+}
+
+// src/config/tasks.ts
+import { isAbsolute, resolve } from "path";
+function resolveTasks(definition, context) {
+  const tasks = /* @__PURE__ */ Object.create(null);
+  const aliases = /* @__PURE__ */ Object.create(null);
+  for (const [name, value] of Object.entries(definition.tasks ?? {})) {
+    validateName(name);
+    if (!value || typeof value !== "object" || typeof value.command !== "string" || !value.command.trim() || value.args !== void 0 && (!Array.isArray(value.args) || !value.args.every((arg) => typeof arg === "string")) || value.cwd !== void 0 && typeof value.cwd !== "string" || value.description !== void 0 && typeof value.description !== "string" || value.environment !== void 0 && (typeof value.environment !== "object" || value.environment === null || Array.isArray(value.environment) || !Object.values(value.environment).every((item) => typeof item === "string"))) {
+      throw new Error(`Invalid task: ${name}`);
+    }
+    const cwd = value.cwd?.replace(/^~(?=\/|$)/, context.home) ?? context.configDir;
+    tasks[name] = { ...value, cwd: isAbsolute(cwd) ? cwd : resolve(context.configDir, cwd) };
+  }
+  for (const [name, target] of Object.entries(definition.aliases ?? {})) {
+    validateName(name);
+    if (Object.hasOwn(tasks, name)) throw new Error(`Task and alias share a name: ${name}`);
+    if (typeof target !== "string") throw new Error(`Invalid alias target: ${name}`);
+    aliases[name] = target;
+  }
+  for (const name of Object.keys(aliases)) resolveTaskName(name, tasks, aliases);
+  return { tasks, aliases };
+}
+function resolveTaskName(name, tasks, aliases) {
+  const visited = /* @__PURE__ */ new Set();
+  let current = name;
+  while (Object.hasOwn(aliases, current)) {
+    if (visited.has(current)) throw new Error(`Task alias cycle: ${[...visited, current].join(" -> ")}`);
+    visited.add(current);
+    const target = aliases[current];
+    if (target === void 0) throw new Error(`Invalid alias: ${current}`);
+    current = target;
+  }
+  if (!Object.hasOwn(tasks, current)) throw new Error(`Unknown task: ${current}`);
+  return current;
+}
+function validateName(name) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9:_-]*$/.test(name) || name === "help" || name === "init") throw new Error(`Invalid or reserved task name: ${name}`);
+}
+
+// src/resources/tasks.ts
+async function runTask(config, name, args, runner) {
+  const tasks = config.tasks ?? {};
+  const resolved = resolveTaskName(name, tasks, config.aliases ?? {});
+  const task2 = tasks[resolved];
+  if (!task2) throw new Error(`Unknown task: ${resolved}`);
+  return await runner.run(task2.command, [...task2.args ?? [], ...args], {
+    ...task2.cwd ? { cwd: task2.cwd } : {},
+    ...task2.environment ? { environment: task2.environment } : {}
+  });
+}
+
+// src/api/config.ts
+function packageList(manager, packages, upgrade) {
+  if (Array.isArray(packages)) {
+    return packages.map((name) => ({
+      kind: "package",
+      manager,
+      name,
+      ...upgrade ? { upgrade } : {}
+    }));
+  }
+  return Object.entries(packages).map(([name, version]) => ({
+    kind: "package",
+    manager,
+    name,
+    version
+  }));
+}
+var tools = {
+  /**
+   * Install mise tools. A list requests `latest`; a map accepts version selectors.
+   * @example tools.mise({ node: "lts", go: "1.27" })
+   */
+  mise: (packages) => packageList("mise", packages),
+  /** Install Homebrew formulae (command-line packages). */
+  brew: (packages) => packageList("brew", packages),
+  /**
+   * Install macOS applications. Greedy casks refresh their lock pin each run.
+   * @example tools.brewCask(["ghostty"], { greedy: true, force: true })
+   */
+  brewCask: (packages, upgrade) => packageList("brew-cask", packages, upgrade),
+  /** Install Debian/Ubuntu packages through APT. Mutations request sudo. */
+  apt: (packages) => packageList("apt", packages),
+  /** Use the configured platform manager; defaults to Homebrew on macOS and APT on Linux. */
+  system: (packages) => packageList("system", packages)
+};
+function symlink(source, target) {
+  return { kind: "symlink", source, target };
+}
+function launchAgent(label, options) {
+  return { kind: "launch-agent", label, ...options };
+}
+function generatedFile(format, target, value, options = {}) {
+  return {
+    kind: "generated-file",
+    format,
+    target,
+    value,
+    ifExists: options.ifExists ?? "overwrite",
+    ...options.mode !== void 0 ? { mode: options.mode } : {}
+  };
+}
+var files = {
+  /**
+   * Generate TOML. Values must be representable in TOML (for example, no null).
+   * @example files.toml("~/.config/app/config.toml", { server: { port: 3000 } })
+   */
+  toml: (target, value, options) => generatedFile("toml", target, value, options),
+  /** Generate YAML with the standard overwrite/restore policy. */
+  yaml: (target, value, options) => generatedFile("yaml", target, value, options),
+  /**
+   * Generate formatted JSON.
+   * @example files.json("~/.config/app/config.json", { enabled: true })
+   */
+  json: (target, value, options) => generatedFile("json", target, value, options),
+  /** Generate JSONC from plain data or jsonc.concat/object commands with comments. */
+  jsonc: (target, value, options) => value instanceof JsoncDocument ? { ...generatedFile("jsonc", target, null, options), renderedContent: value.content } : generatedFile("jsonc", target, value, options)
+};
+function systemdService(name, options) {
+  return { kind: "systemd-service", name, scope: options.scope ?? "user", ...options };
+}
+function customTool(name, options) {
+  return { kind: "custom-tool", name, ...options };
+}
+function when(condition, resources) {
+  return condition ? resources : [];
+}
+function defineConfig(config) {
+  return config;
+}
+function configure(factory) {
+  return factory;
+}
+function darwin(config) {
+  return conditional((context) => context.platform === "darwin", config);
+}
+function linux(config) {
+  return conditional((context) => context.platform === "linux", config);
+}
+function machine(names, config) {
+  const accepted = typeof names === "string" ? [names] : names;
+  return conditional((context) => accepted.includes(context.machine), config);
+}
+function conditional(predicate, config) {
+  return (context) => predicate(context) ? resolveInput(config, context) : void 0;
+}
+function resolveInput(config, context) {
+  return typeof config === "function" ? config(context) : config;
+}
+
+// src/api/shell.ts
+var shell = {
+  /**
+   * Reference a shell variable at runtime.
+   * @example shell.export("VISUAL", shell.variable("EDITOR"))
+   */
+  variable(name) {
+    return { kind: "variable", name: validateVariable(name) };
+  },
+  /**
+   * Expand a path under the shell's HOME at runtime.
+   * @example shell.home(".local/bin")
+   */
+  home(path = "") {
+    if (path.includes("\0") || path.includes("\n")) throw new Error("Invalid home-relative path");
+    return { kind: "home", path: path.replace(/^\//, "") };
+  },
+  /** Join literals and expressions into one shell value. */
+  concat(...values) {
+    return { kind: "concat", values };
+  },
+  /** Use a command's stdout as a value via command substitution. */
+  capture(command) {
+    return { kind: "capture", command };
+  },
+  /** Describe a command and its arguments. Use `capture` for its output or `eval` for initialization code. */
+  command(command, args = [], options = {}) {
+    if (!command || command.includes("\0") || command.includes("\n")) {
+      throw new Error("Invalid shell command");
+    }
+    return { command, args, ...options };
+  },
+  /** Set and export an environment variable. */
+  export(name, value) {
+    return { kind: "export", name: validateVariable(name), value };
+  },
+  /** Set a shell variable without exporting it. */
+  assign(name, value) {
+    return { kind: "assign", name: validateVariable(name), value };
+  },
+  /** Remove one or more shell variables. */
+  unset(...names) {
+    if (names.length === 0) throw new Error("unset requires at least one variable");
+    return { kind: "unset", names: names.map(validateVariable) };
+  },
+  /**
+   * Prepend paths while retaining the current PATH.
+   * @example shell.prependPath(shell.home(".local/bin"))
+   */
+  prependPath(...values) {
+    return { kind: "prepend-path", values };
+  },
+  /** Define an alias; its command text is interpreted when the alias runs. */
+  alias(name, command) {
+    if (!/^[A-Za-z0-9_.-]+$/.test(name)) throw new Error(`Invalid shell alias: ${name}`);
+    return { kind: "alias", name, command };
+  },
+  /**
+   * Evaluate shell code printed by a command.
+   * @example shell.eval(shell.command("mise", ["activate", "zsh"]))
+   */
+  eval(command) {
+    return { kind: "eval", command };
+  },
+  /** Source another shell file. With `ifExists: true`, source only when readable. */
+  source(path, options = {}) {
+    return { kind: "source", path, ifExists: options.ifExists ?? false };
+  },
+  /** Generate a shell-time conditional containing one or more statements. */
+  when(condition, statements) {
+    if (statements.length === 0) throw new Error("Shell condition requires at least one statement");
+    return { kind: "if", condition, statements };
+  },
+  /** Insert literal shell code without validation or quoting. Prefer typed helpers for ordinary statements. */
+  raw(code) {
+    return { kind: "raw", code };
+  },
+  /** Construct conditions evaluated when the shell starts. */
+  condition: {
+    /** Test whether a command is available on PATH. */
+    commandExists(command) {
+      if (!command || command.includes("\0") || command.includes("\n")) {
+        throw new Error("Invalid shell command");
+      }
+      return { kind: "command-exists", command };
+    },
+    /** Test whether a path is executable. */
+    executable(path) {
+      return { kind: "executable", path };
+    },
+    /** Test whether a path is a regular file. */
+    file(path) {
+      return { kind: "file", path };
+    },
+    /** Test whether a path is a directory. */
+    directory(path) {
+      return { kind: "directory", path };
+    },
+    /** Test whether a value is empty. */
+    empty(value) {
+      return { kind: "empty", value };
+    },
+    /** Test whether a value is non-empty. */
+    nonEmpty(value) {
+      return { kind: "non-empty", value };
+    },
+    /** Combine conditions with shell AND. */
+    and(...conditions) {
+      if (conditions.length === 0) throw new Error("and requires at least one condition");
+      return { kind: "and", conditions };
+    },
+    /** Combine conditions with shell OR. */
+    or(...conditions) {
+      if (conditions.length === 0) throw new Error("or requires at least one condition");
+      return { kind: "or", conditions };
+    },
+    /** Negate a condition. */
+    not(condition) {
+      return { kind: "not", condition };
+    }
+  }
+};
+var zsh = {
+  /** Generate ~/.zshenv, read by every Zsh invocation. Keep this minimal. */
+  zshenv: (statements, options) => shellFile("zsh", "~/.zshenv", statements, options),
+  /** Generate ~/.zprofile for login-shell environment initialization. */
+  zprofile: (statements, options) => shellFile("zsh", "~/.zprofile", statements, options),
+  /** Generate ~/.zshrc for interactive aliases, prompts, and completion. */
+  zshrc: (statements, options) => shellFile("zsh", "~/.zshrc", statements, options),
+  /** Enable Zsh-only options using uppercase names. Cannot be rendered to Bash. */
+  setopt(...options) {
+    if (options.length === 0) throw new Error("setopt requires at least one option");
+    for (const option of options) {
+      if (!/^[A-Z_]+$/.test(option)) throw new Error(`Invalid Zsh option: ${option}`);
+    }
+    return { kind: "zsh-setopt", options };
+  }
+};
+var bash = {
+  /** Generate ~/.bashrc for interactive non-login shells. */
+  bashrc: (statements, options) => shellFile("bash", "~/.bashrc", statements, options),
+  /** Generate ~/.bash_profile for Bash login shells; source ~/.bashrc explicitly if desired. */
+  bashProfile: (statements, options) => shellFile("bash", "~/.bash_profile", statements, options),
+  /** Generate ~/.profile using Bash syntax; use only where Bash will read it. */
+  profile: (statements, options) => shellFile("bash", "~/.profile", statements, options)
+};
+function renderShell(statements, target) {
+  return `${statements.map((statement) => renderStatement(statement, target, 0)).join("\n")}
+`;
+}
+function shellFile(format, target, statements, options = {}) {
+  return {
+    kind: "generated-file",
+    target,
+    format,
+    value: renderShell(statements, format),
+    ifExists: options.ifExists ?? "overwrite",
+    mode: options.mode ?? 420
+  };
+}
+function renderStatement(statement, target, depth) {
+  const indent = "  ".repeat(depth);
+  switch (statement.kind) {
+    case "export":
+      return `${indent}export ${statement.name}=${renderValue2(statement.value)}`;
+    case "assign":
+      return `${indent}${statement.name}=${renderValue2(statement.value)}`;
+    case "unset":
+      return `${indent}unset ${statement.names.join(" ")}`;
+    case "prepend-path":
+      return `${indent}export PATH=${[...statement.values.map(renderValue2), '"$PATH"'].join(":")}`;
+    case "alias":
+      return `${indent}alias ${statement.name}=${quote(statement.command)}`;
+    case "eval":
+      return `${indent}eval "${escapeDouble(`$(${renderCommand(statement.command)})`)}"`;
+    case "source": {
+      const source = `source ${renderValue2(statement.path)}`;
+      return statement.ifExists ? `${indent}if [[ -r ${renderValue2(statement.path)} ]]; then ${source}; fi` : `${indent}${source}`;
+    }
+    case "if":
+      return [
+        `${indent}if ${renderCondition(statement.condition)}; then`,
+        ...statement.statements.map((child) => renderStatement(child, target, depth + 1)),
+        `${indent}fi`
+      ].join("\n");
+    case "zsh-setopt":
+      if (target !== "zsh") throw new Error("setopt is only valid in Zsh configuration");
+      return `${indent}setopt ${statement.options.join(" ")}`;
+    case "raw":
+      return statement.code.split("\n").map((line) => `${indent}${line}`).join("\n");
+  }
+}
+function renderCondition(condition) {
+  switch (condition.kind) {
+    case "command-exists":
+      return `command -v ${quote(condition.command)} >/dev/null 2>&1`;
+    case "executable":
+      return `[[ -x ${renderValue2(condition.path)} ]]`;
+    case "file":
+      return `[[ -f ${renderValue2(condition.path)} ]]`;
+    case "directory":
+      return `[[ -d ${renderValue2(condition.path)} ]]`;
+    case "empty":
+      return `[[ -z ${renderValue2(condition.value)} ]]`;
+    case "non-empty":
+      return `[[ -n ${renderValue2(condition.value)} ]]`;
+    case "and":
+      return condition.conditions.map(renderCondition).join(" && ");
+    case "or":
+      return condition.conditions.map(renderCondition).join(" || ");
+    case "not":
+      return `! ${renderCondition(condition.condition)}`;
+  }
+}
+function renderCommand(command) {
+  const stderr = command.stderr === "ignore" ? " 2>/dev/null" : "";
+  return [quote(command.command), ...(command.args ?? []).map(renderValue2)].join(" ") + stderr;
+}
+function renderValue2(value) {
+  if (typeof value === "string") return quote(value);
+  switch (value.kind) {
+    case "variable":
+      return `"\${${value.name}}"`;
+    case "home":
+      return `"\${HOME}${value.path ? `/${escapeDouble(value.path)}` : ""}"`;
+    case "concat":
+      return `"${value.values.map(renderInsideDoubleQuotes).join("")}"`;
+    case "capture":
+      return `"$(${renderCommand(value.command)})"`;
+  }
+}
+function renderInsideDoubleQuotes(value) {
+  if (typeof value === "string") return escapeDouble(value);
+  const rendered = renderValue2(value);
+  return rendered.startsWith('"') && rendered.endsWith('"') ? rendered.slice(1, -1) : rendered;
+}
+function quote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function escapeDouble(value) {
+  return value.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
+}
+function validateVariable(name) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new Error(`Invalid shell variable: ${name}`);
+  return name;
+}
+
+// src/config/load.ts
+import { hostname as readHostname, homedir, platform as readPlatform } from "os";
+import { dirname, isAbsolute as isAbsolute2, resolve as resolve3 } from "path";
+import { access } from "fs/promises";
+
+// src/config/identity.ts
+import { createHash } from "crypto";
+function resourceId(resource) {
+  switch (resource.kind) {
+    case "package":
+      return `package:${resource.manager}:${resource.name}`;
+    case "symlink":
+      return `file:${resource.target}`;
+    case "launch-agent":
+      return `launch-agent:${resource.label}`;
+    case "generated-file":
+      return `file:${resource.target}`;
+    case "systemd-service":
+      return `systemd-service:${resource.scope}:${resource.name}`;
+    case "custom-tool":
+      return `file:${resource.target}`;
+  }
+}
+function fingerprint(resource) {
+  return createHash("sha256").update(stableJson(resource)).digest("hex");
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (typeof value === "object" && value !== null) {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => `${JSON.stringify(key)}:${stableJson(child)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+// src/config/source-hash.ts
+import { createHash as createHash2 } from "crypto";
+import { lstat, readFile, readdir, readlink } from "fs/promises";
+import { resolve as resolve2 } from "path";
+async function hashSource(path) {
+  const hash = createHash2("sha256");
+  await addPathToHash(hash, path, ".");
+  return hash.digest("hex");
+}
+async function addPathToHash(hash, path, relativePath) {
+  const stats = await lstat(path);
+  if (stats.isSymbolicLink()) {
+    hash.update(`link\0${relativePath}\0${await readlink(path)}\0`);
+    return;
+  }
+  if (stats.isFile()) {
+    hash.update(`file\0${relativePath}\0`);
+    hash.update(await readFile(path));
+    return;
+  }
+  if (!stats.isDirectory()) throw new Error(`Unsupported custom tool source entry: ${path}`);
+  hash.update(`directory\0${relativePath}\0`);
+  const entries = (await readdir(path, { withFileTypes: true })).sort(
+    (left, right) => left.name.localeCompare(right.name)
+  );
+  for (const entry of entries) {
+    await addPathToHash(hash, resolve2(path, entry.name), `${relativePath}/${entry.name}`);
+  }
+}
+
+// src/config/validation.ts
+function validateResource(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error("Every configured resource must be an object, array, or falsey value");
+  }
+  const candidate = value;
+  switch (candidate.kind) {
+    case "package":
+      if (!["mise", "brew", "brew-cask", "apt", "system"].includes(String(candidate.manager)) || typeof candidate.name !== "string" || candidate.name.length === 0 || candidate.version !== void 0 && typeof candidate.version !== "string" || !isBrewCaskUpgradeOptions(candidate.upgrade)) {
+        throw new Error("Invalid package resource");
+      }
+      return;
+    case "symlink":
+      if (typeof candidate.source !== "string" || typeof candidate.target !== "string") {
+        throw new Error("Invalid symlink resource");
+      }
+      return;
+    case "launch-agent":
+      if (typeof candidate.label !== "string" || !/^[A-Za-z0-9.-]+$/.test(candidate.label) || typeof candidate.program !== "string" || candidate.args !== void 0 && (!Array.isArray(candidate.args) || !candidate.args.every((argument) => typeof argument === "string"))) {
+        throw new Error("Invalid LaunchAgent resource");
+      }
+      return;
+    case "generated-file":
+      if (typeof candidate.target !== "string" || !["toml", "yaml", "json", "jsonc", "zsh", "bash"].includes(String(candidate.format)) || !["update", "overwrite", "ignore"].includes(String(candidate.ifExists)) || !isConfigValue(candidate.value) || candidate.renderedContent !== void 0 && (candidate.format !== "jsonc" || typeof candidate.renderedContent !== "string") || ["zsh", "bash"].includes(String(candidate.format)) && typeof candidate.value !== "string" || candidate.mode !== void 0 && (typeof candidate.mode !== "number" || !Number.isInteger(candidate.mode) || candidate.mode < 0 || candidate.mode > 511)) {
+        throw new Error("Invalid generated file resource");
+      }
+      return;
+    case "custom-tool":
+      if (typeof candidate.name !== "string" || !/^[A-Za-z0-9_.-]+$/.test(candidate.name) || typeof candidate.source !== "string" || typeof candidate.target !== "string" || !isCommandSpec(candidate.build)) {
+        throw new Error("Invalid custom tool resource");
+      }
+      return;
+    case "systemd-service":
+      if (typeof candidate.name !== "string" || !/^[A-Za-z0-9_.@-]+(?:\.service)?$/.test(candidate.name) || typeof candidate.program !== "string" || !["user", "system"].includes(String(candidate.scope)) || candidate.restart !== void 0 && !["no", "on-failure", "always"].includes(String(candidate.restart)) || candidate.args !== void 0 && (!Array.isArray(candidate.args) || !candidate.args.every((argument) => typeof argument === "string")) || candidate.environment !== void 0 && !isStringRecord(candidate.environment)) {
+        throw new Error("Invalid systemd service resource");
+      }
+      return;
+    default:
+      throw new Error(`Unknown resource kind: ${String(candidate.kind)}`);
+  }
+}
+function isConfigValue(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) {
+    return true;
+  }
+  if (Array.isArray(value)) return value.every(isConfigValue);
+  return typeof value === "object" && value !== null && Object.values(value).every(isConfigValue);
+}
+function isStringRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((item) => typeof item === "string");
+}
+function isCommandSpec(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const candidate = value;
+  return typeof candidate.command === "string" && candidate.command.length > 0 && (candidate.args === void 0 || Array.isArray(candidate.args) && candidate.args.every((item) => typeof item === "string")) && (candidate.cwd === void 0 || typeof candidate.cwd === "string") && (candidate.environment === void 0 || isStringRecord(candidate.environment));
+}
+function isBrewCaskUpgradeOptions(value) {
+  if (value === void 0) return true;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const options = value;
+  return Object.keys(options).every((key) => key === "greedy" || key === "force") && (options.greedy === void 0 || typeof options.greedy === "boolean") && (options.force === void 0 || typeof options.force === "boolean");
+}
+
+// src/config/load.ts
+import { createJiti } from "jiti/static";
+var DEFAULT_CONFIG_FILE = "workstation.config.ts";
+async function findConfig(explicit) {
+  if (explicit) return resolve3(explicit);
+  const path = resolve3(DEFAULT_CONFIG_FILE);
+  try {
+    await access(path);
+    return path;
+  } catch {
+    throw new Error(`No configuration found (${DEFAULT_CONFIG_FILE})`);
+  }
+}
+async function loadConfig(configPath, machineOverride) {
+  const nativePlatform = readPlatform();
+  if (nativePlatform !== "darwin" && nativePlatform !== "linux") {
+    throw new Error(`Unsupported platform: ${nativePlatform}`);
+  }
+  const context = {
+    machine: machineOverride ?? readHostname().split(".")[0] ?? readHostname(),
+    hostname: readHostname(),
+    platform: nativePlatform,
+    home: homedir(),
+    configDir: dirname(configPath)
+  };
+  const jiti = createJiti(configPath);
+  const imported = await jiti.import(configPath, { default: true });
+  const definitions = collectDefinitions(imported, context);
+  if (definitions.length === 0) {
+    throw new Error(`${configPath} did not produce any configuration`);
+  }
+  const definition = mergeDefinitions(definitions);
+  const inputs = definitions.flatMap((fragment) => [
+    fragment.resources,
+    fragment.machines?.[context.machine]
+  ]);
+  const resolved = await Promise.all(
+    flatten2(inputs).map((resource) => resolveResource(resource, definition, context))
+  );
+  const resources = [...new Map(resolved.map((resource) => [resourceId(resource), resource])).values()];
+  return {
+    context,
+    ...resolveTasks(definition, context),
+    resources,
+    stateFile: expandPath(
+      definition.stateFile ?? "~/.local/state/workstation/state.json",
+      context,
+      false
+    )
+  };
+}
+async function resolveResource(resource, definition, context) {
+  if (resource.kind === "package") {
+    const manager = resolveManager(resource.manager, definition, context);
+    if (resource.upgrade !== void 0 && manager !== "brew-cask") {
+      throw new Error(`Upgrade options are only supported for Homebrew casks (${resource.name})`);
+    }
+    if (manager === "mise") {
+      return { ...resource, manager, version: resource.version ?? "latest" };
+    }
+    if (resource.version !== void 0) {
+      throw new Error(`${manager} package ${resource.name} cannot declare a version`);
+    }
+    return { ...resource, manager };
+  }
+  if (resource.kind === "symlink") {
+    return {
+      ...resource,
+      source: expandPath(resource.source, context, true),
+      target: expandPath(resource.target, context, false)
+    };
+  }
+  if (resource.kind === "generated-file") {
+    return { ...resource, target: expandPath(resource.target, context, false) };
+  }
+  if (resource.kind === "systemd-service") {
+    if (context.platform !== "linux") {
+      throw new Error(`systemd service ${resource.name} is only supported on Linux`);
+    }
+    return {
+      ...resource,
+      name: resource.name.endsWith(".service") ? resource.name : `${resource.name}.service`,
+      program: expandPath(resource.program, context, true)
+    };
+  }
+  if (resource.kind === "custom-tool") {
+    const source = expandPath(resource.source, context, true);
+    const target = expandPath(resource.target, context, false);
+    return {
+      ...resource,
+      source,
+      target,
+      sourceHash: await hashSource(source),
+      build: {
+        ...resource.build,
+        ...resource.build.cwd && !resource.build.cwd.includes("{") ? { cwd: expandPath(resource.build.cwd, context, true) } : {}
+      }
+    };
+  }
+  if (context.platform !== "darwin") {
+    throw new Error(`LaunchAgent ${resource.label} is only supported on macOS`);
+  }
+  return {
+    ...resource,
+    program: expandPath(resource.program, context, true),
+    ...resource.stdoutPath ? { stdoutPath: expandPath(resource.stdoutPath, context, false) } : {},
+    ...resource.stderrPath ? { stderrPath: expandPath(resource.stderrPath, context, false) } : {}
+  };
+}
+function resolveManager(manager, definition, context) {
+  if (manager !== "system") return manager;
+  return definition.managers?.[context.platform] ?? (context.platform === "darwin" ? "brew" : "apt");
+}
+function expandPath(path, context, relativeToConfig) {
+  const expanded = path === "~" ? context.home : path.replace(/^~\//, `${context.home}/`);
+  if (isAbsolute2(expanded)) return resolve3(expanded);
+  return resolve3(relativeToConfig ? context.configDir : context.home, expanded);
+}
+function flatten2(input) {
+  if (!input) return [];
+  if (Array.isArray(input)) return input.flatMap((item) => flatten2(item));
+  validateResource(input);
+  return [input];
+}
+function validateDefinition(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error("Configuration must resolve to an object");
+  }
+}
+function collectDefinitions(value, context) {
+  if (value === null || value === void 0 || value === false) return [];
+  if (typeof value === "function") {
+    return collectDefinitions(value(context), context);
+  }
+  if (Array.isArray(value)) {
+    return value.flatMap((fragment) => collectDefinitions(fragment, context));
+  }
+  validateDefinition(value);
+  return [value];
+}
+function mergeDefinitions(definitions) {
+  return definitions.reduce(
+    (merged, fragment) => ({
+      managers: { ...merged.managers, ...fragment.managers },
+      tasks: { ...merged.tasks, ...fragment.tasks },
+      aliases: { ...merged.aliases, ...fragment.aliases },
+      ...fragment.stateFile !== void 0 ? { stateFile: fragment.stateFile } : merged.stateFile !== void 0 ? { stateFile: merged.stateFile } : {}
+    }),
+    {}
+  );
+}
+
+// src/persistence/manifest.ts
+import { mkdir, readFile as readFile2, rename, writeFile } from "fs/promises";
+import { dirname as dirname2, resolve as resolve4 } from "path";
+import { parse, stringify } from "smol-toml";
+var MANIFEST_VERSION = 1;
+function manifestPath(config) {
+  return resolve4(dirname2(config.stateFile), "config.toml");
+}
+async function writeManifest(path, config) {
+  const document = {
+    version: MANIFEST_VERSION,
+    state_file: config.stateFile,
+    context: {
+      machine: config.context.machine,
+      hostname: config.context.hostname,
+      platform: config.context.platform,
+      home: config.context.home,
+      config_dir: config.context.configDir
+    },
+    resources: config.resources.map(toTomlResource)
+  };
+  await mkdir(dirname2(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.${process.pid}.tmp`;
+  await writeFile(temporary, stringify(document), { mode: 384 });
+  await rename(temporary, path);
+}
+async function readManifest(path) {
+  const document = parse(await readFile2(path, "utf8"));
+  if (document.version !== MANIFEST_VERSION) {
+    throw new Error(`Unsupported workstation manifest version in ${path}`);
+  }
+  const stateFile = requireString(document.state_file, "state_file");
+  const context = parseContext(requireTable(document.context, "context"));
+  if (!Array.isArray(document.resources)) throw new Error("Manifest resources must be an array");
+  const resources = document.resources.map(
+    (resource, index) => parseResource(requireTable(resource, `resources[${index}]`))
+  );
+  return { context, resources, stateFile };
+}
+function toTomlResource(resource) {
+  switch (resource.kind) {
+    case "package":
+      return {
+        kind: resource.kind,
+        manager: resource.manager,
+        name: resource.name,
+        ...resource.version ? { version: resource.version } : {},
+        ...resource.lockedVersion ? { locked_version: resource.lockedVersion } : {},
+        ...resource.upgrade ? {
+          upgrade: {
+            ...resource.upgrade.greedy !== void 0 ? { greedy: resource.upgrade.greedy } : {},
+            ...resource.upgrade.force !== void 0 ? { force: resource.upgrade.force } : {}
+          }
+        } : {}
+      };
+    case "symlink":
+      return { kind: resource.kind, source: resource.source, target: resource.target };
+    case "launch-agent":
+      return {
+        kind: resource.kind,
+        label: resource.label,
+        program: resource.program,
+        ...resource.args ? { args: [...resource.args] } : {},
+        ...resource.environment ? { environment: { ...resource.environment } } : {},
+        ...resource.runAtLoad !== void 0 ? { run_at_load: resource.runAtLoad } : {},
+        ...resource.keepAlive !== void 0 ? { keep_alive: resource.keepAlive } : {},
+        ...resource.stdoutPath ? { stdout_path: resource.stdoutPath } : {},
+        ...resource.stderrPath ? { stderr_path: resource.stderrPath } : {}
+      };
+    case "generated-file":
+      return {
+        kind: resource.kind,
+        target: resource.target,
+        format: resource.format,
+        if_exists: resource.ifExists,
+        value_json: JSON.stringify(resource.value),
+        ...resource.renderedContent !== void 0 ? { rendered_content: resource.renderedContent } : {},
+        ...resource.mode !== void 0 ? { mode: resource.mode } : {}
+      };
+    case "systemd-service":
+      return {
+        kind: resource.kind,
+        name: resource.name,
+        scope: resource.scope,
+        program: resource.program,
+        ...resource.description ? { description: resource.description } : {},
+        ...resource.args ? { args: [...resource.args] } : {},
+        ...resource.environment ? { environment: { ...resource.environment } } : {},
+        ...resource.restart ? { restart: resource.restart } : {},
+        ...resource.wantedBy ? { wanted_by: resource.wantedBy } : {}
+      };
+    case "custom-tool":
+      return {
+        kind: resource.kind,
+        name: resource.name,
+        source: resource.source,
+        source_hash: resource.sourceHash ?? "",
+        target: resource.target,
+        build: {
+          command: resource.build.command,
+          ...resource.build.args ? { args: [...resource.build.args] } : {},
+          ...resource.build.cwd ? { cwd: resource.build.cwd } : {},
+          ...resource.build.environment ? { environment: { ...resource.build.environment } } : {}
+        }
+      };
+  }
+}
+function parseContext(value) {
+  const platform = requireString(value.platform, "context.platform");
+  if (platform !== "darwin" && platform !== "linux") {
+    throw new Error(`Invalid manifest platform: ${platform}`);
+  }
+  return {
+    machine: requireString(value.machine, "context.machine"),
+    hostname: requireString(value.hostname, "context.hostname"),
+    platform,
+    home: requireString(value.home, "context.home"),
+    configDir: requireString(value.config_dir, "context.config_dir")
+  };
+}
+function parseResource(value) {
+  const kind = requireString(value.kind, "resource.kind");
+  if (kind === "package") return parsePackage(value);
+  if (kind === "symlink") return parseSymlink(value);
+  if (kind === "launch-agent") return parseLaunchAgent(value);
+  if (kind === "generated-file") return parseGeneratedFile(value);
+  if (kind === "systemd-service") return parseSystemdService(value);
+  if (kind === "custom-tool") return parseCustomTool(value);
+  throw new Error(`Unknown manifest resource kind: ${kind}`);
+}
+function parseGeneratedFile(value) {
+  const format = requireString(value.format, "generated-file.format");
+  if (value.rendered_content !== void 0 && format !== "jsonc") {
+    throw new Error("Pre-rendered content requires JSONC format");
+  }
+  const ifExists = requireString(value.if_exists, "generated-file.if_exists");
+  if (format !== "toml" && format !== "yaml" && format !== "json" && format !== "jsonc" && format !== "zsh" && format !== "bash") {
+    throw new Error(`Invalid generated file format: ${format}`);
+  }
+  if (ifExists !== "update" && ifExists !== "overwrite" && ifExists !== "ignore") {
+    throw new Error(`Invalid generated file policy: ${ifExists}`);
+  }
+  const configValue = JSON.parse(requireString(value.value_json, "generated-file.value_json"));
+  if (!isConfigValue2(configValue)) throw new Error("Invalid generated file value");
+  const mode = value.mode;
+  if (mode !== void 0 && (typeof mode !== "number" || !Number.isInteger(mode) || mode < 0 || mode > 511)) {
+    throw new Error("generated-file.mode must be between 0 and 0777");
+  }
+  return {
+    kind: "generated-file",
+    target: requireString(value.target, "generated-file.target"),
+    format,
+    ifExists,
+    value: configValue,
+    ...value.rendered_content !== void 0 ? { renderedContent: requireString(value.rendered_content, "generated-file.rendered_content") } : {},
+    ...mode !== void 0 ? { mode } : {}
+  };
+}
+function parseCustomTool(value) {
+  const build = requireTable(value.build, "custom-tool.build");
+  return {
+    kind: "custom-tool",
+    name: requireString(value.name, "custom-tool.name"),
+    source: requireString(value.source, "custom-tool.source"),
+    sourceHash: requireString(value.source_hash, "custom-tool.source_hash"),
+    target: requireString(value.target, "custom-tool.target"),
+    build: {
+      command: requireString(build.command, "custom-tool.build.command"),
+      ...build.args !== void 0 ? { args: requireStringArray(build.args, "custom-tool.build.args") } : {},
+      ...build.cwd !== void 0 ? { cwd: requireString(build.cwd, "custom-tool.build.cwd") } : {},
+      ...build.environment !== void 0 ? { environment: requireStringTable(build.environment, "custom-tool.build.environment") } : {}
+    }
+  };
+}
+function parseSystemdService(value) {
+  const scope = requireString(value.scope, "systemd-service.scope");
+  if (scope !== "user" && scope !== "system") throw new Error(`Invalid systemd scope: ${scope}`);
+  const restart = value.restart === void 0 ? void 0 : requireString(value.restart, "systemd-service.restart");
+  if (restart !== void 0 && restart !== "no" && restart !== "on-failure" && restart !== "always") {
+    throw new Error(`Invalid systemd restart policy: ${restart}`);
+  }
+  return {
+    kind: "systemd-service",
+    name: requireString(value.name, "systemd-service.name"),
+    scope,
+    program: requireString(value.program, "systemd-service.program"),
+    ...value.description !== void 0 ? { description: requireString(value.description, "systemd-service.description") } : {},
+    ...value.args !== void 0 ? { args: requireStringArray(value.args, "systemd-service.args") } : {},
+    ...value.environment !== void 0 ? { environment: requireStringTable(value.environment, "systemd-service.environment") } : {},
+    ...restart ? { restart } : {},
+    ...value.wanted_by !== void 0 ? { wantedBy: requireString(value.wanted_by, "systemd-service.wanted_by") } : {}
+  };
+}
+function parsePackage(value) {
+  const manager = requireString(value.manager, "package.manager");
+  if (!isPackageManager(manager)) {
+    throw new Error(`Invalid manifest package manager: ${manager}`);
+  }
+  const upgrade = value.upgrade === void 0 ? void 0 : requireTable(value.upgrade, "package.upgrade");
+  if (value.version !== void 0 && manager !== "mise") {
+    throw new Error(`Manifest ${manager} package cannot declare a version`);
+  }
+  if (upgrade !== void 0 && manager !== "brew-cask") {
+    throw new Error(`Manifest upgrade options require a Homebrew cask`);
+  }
+  return {
+    kind: "package",
+    manager,
+    name: requireString(value.name, "package.name"),
+    ...value.version !== void 0 ? { version: requireString(value.version, "package.version") } : {},
+    ...value.locked_version !== void 0 ? { lockedVersion: requireString(value.locked_version, "package.locked_version") } : {},
+    ...upgrade ? {
+      upgrade: {
+        ...upgrade.greedy !== void 0 ? { greedy: requireBoolean(upgrade.greedy, "package.upgrade.greedy") } : {},
+        ...upgrade.force !== void 0 ? { force: requireBoolean(upgrade.force, "package.upgrade.force") } : {}
+      }
+    } : {}
+  };
+}
+function parseSymlink(value) {
+  return {
+    kind: "symlink",
+    source: requireString(value.source, "symlink.source"),
+    target: requireString(value.target, "symlink.target")
+  };
+}
+function parseLaunchAgent(value) {
+  const args = value.args === void 0 ? void 0 : requireStringArray(value.args, "launch-agent.args");
+  const environment = value.environment === void 0 ? void 0 : requireStringTable(value.environment, "launch-agent.environment");
+  return {
+    kind: "launch-agent",
+    label: requireString(value.label, "launch-agent.label"),
+    program: requireString(value.program, "launch-agent.program"),
+    ...args ? { args } : {},
+    ...environment ? { environment } : {},
+    ...value.run_at_load !== void 0 ? { runAtLoad: requireBoolean(value.run_at_load, "launch-agent.run_at_load") } : {},
+    ...value.keep_alive !== void 0 ? { keepAlive: requireBoolean(value.keep_alive, "launch-agent.keep_alive") } : {},
+    ...value.stdout_path !== void 0 ? { stdoutPath: requireString(value.stdout_path, "launch-agent.stdout_path") } : {},
+    ...value.stderr_path !== void 0 ? { stderrPath: requireString(value.stderr_path, "launch-agent.stderr_path") } : {}
+  };
+}
+function requireTable(value, field) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${field} must be a table`);
+  }
+  return value;
+}
+function requireString(value, field) {
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${field} must be a string`);
+  return value;
+}
+function requireBoolean(value, field) {
+  if (typeof value !== "boolean") throw new Error(`${field} must be a boolean`);
+  return value;
+}
+function requireStringArray(value, field) {
+  if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) {
+    throw new Error(`${field} must be an array of strings`);
+  }
+  return value;
+}
+function requireStringTable(value, field) {
+  const table = requireTable(value, field);
+  const result = {};
+  for (const [key, item] of Object.entries(table)) {
+    if (typeof item !== "string") throw new Error(`${field} must contain strings`);
+    result[key] = item;
+  }
+  return result;
+}
+function isPackageManager(value) {
+  return value === "mise" || value === "brew" || value === "brew-cask" || value === "apt";
+}
+function isConfigValue2(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) {
+    return true;
+  }
+  if (Array.isArray(value)) return value.every(isConfigValue2);
+  return typeof value === "object" && value !== null && Object.values(value).every(isConfigValue2);
+}
+
+// src/persistence/lock.ts
+import { readFile as readFile3, rename as rename3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, resolve as resolve5 } from "path";
+import { parse as parse2, stringify as stringify2 } from "smol-toml";
+
+// src/resources/shared.ts
+import { chmod, rename as rename2, writeFile as writeFile2 } from "fs/promises";
+async function requireSuccess(runner, command, args, options) {
+  const result = await runner.run(command, args, options);
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `${command} ${args.join(" ")} failed (${result.exitCode})${result.stderr ? `: ${result.stderr.trim()}` : ""}`
+    );
+  }
+  return result;
+}
+
+// src/resources/brew-info.ts
+async function readAvailableBrewVersion(resource, runner) {
+  const item = brewItem(await readBrewInfo(resource, runner), resource);
+  const baseVersion = resource.manager === "brew-cask" ? item.version : typeof item.versions === "object" && item.versions !== null && "stable" in item.versions ? item.versions.stable : void 0;
+  const version = resource.manager === "brew" && typeof baseVersion === "string" && typeof item.revision === "number" && item.revision > 0 ? `${baseVersion}_${item.revision}` : baseVersion;
+  if (typeof version !== "string" || version.length === 0) {
+    throw new Error(`Homebrew did not report an available version for ${resource.name}`);
+  }
+  return version;
+}
+async function readBrewInfo(resource, runner) {
+  const flag = resource.manager === "brew-cask" ? "--cask" : "--formula";
+  const result = await requireSuccess(runner, "brew", ["info", "--json=v2", flag, resource.name]);
+  try {
+    const value = JSON.parse(result.stdout);
+    if (!isRecord(value)) throw new Error("Expected a JSON object");
+    return value;
+  } catch (error) {
+    throw new Error(`Homebrew returned invalid JSON for ${resource.name}`, { cause: error });
+  }
+}
+function brewItem(document, resource) {
+  const collection = document[resource.manager === "brew-cask" ? "casks" : "formulae"];
+  const value = Array.isArray(collection) ? collection[0] : void 0;
+  if (!isRecord(value)) {
+    throw new Error(`Homebrew did not report information for ${resource.name}`);
+  }
+  return value;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/resources/package-version.ts
+async function resolvePackageVersion(resource, runner) {
+  if (resource.kind !== "package") return void 0;
+  switch (resource.manager) {
+    case "mise": {
+      const spec = `${resource.name}@${resource.version ?? "latest"}`;
+      const result = await requireSuccess(runner, "mise", ["latest", spec]);
+      const version = result.stdout.trim().split(/\s+/).at(-1);
+      if (!version) throw new Error(`mise latest ${spec} did not report a version`);
+      return version;
+    }
+    case "apt": {
+      const result = await requireSuccess(runner, "apt-cache", ["policy", resource.name]);
+      const candidate = /^\s*Candidate:\s*(\S+)\s*$/m.exec(result.stdout)?.[1];
+      if (!candidate || candidate === "(none)") {
+        throw new Error(`apt has no installation candidate for ${resource.name}`);
+      }
+      return candidate;
+    }
+    case "brew":
+    case "brew-cask": {
+      const version = await readAvailableBrewVersion(resource, runner);
+      return version === "latest" ? void 0 : version;
+    }
+    case "system":
+      throw new Error("System package manager must be resolved before locking");
+  }
+}
+
+// src/persistence/lock.ts
+var LOCK_VERSION = 1;
+function lockPath(configPath) {
+  return resolve5(dirname3(configPath), "workstation.lock");
+}
+async function lockConfig(configPath, config, runner) {
+  const path = lockPath(configPath);
+  const previousText = await readOptional(path);
+  const previous = previousText === void 0 ? emptyLock() : parseLock(previousText, path);
+  const target = previous.targets.find(({ machine: machine2 }) => machine2 === config.context.machine);
+  const existing = new Map(target?.resources.map((entry) => [entry.id, entry]));
+  const resources = [];
+  const entries = [];
+  for (const resource of config.resources) {
+    const id = resourceId(resource);
+    const declarationFingerprint = fingerprint(resource);
+    const prior = existing.get(id);
+    const refreshesOnRun = resource.kind === "package" && resource.manager === "brew-cask" && resource.upgrade?.greedy === true;
+    const canReuse = !refreshesOnRun && prior?.fingerprint === declarationFingerprint && (resource.kind !== "package" || prior.lockedVersion !== void 0);
+    const lockedVersion = canReuse ? prior.lockedVersion : await resolvePackageVersion(resource, runner);
+    resources.push(withLockedVersion(resource, lockedVersion));
+    entries.push({
+      id,
+      fingerprint: declarationFingerprint,
+      ...lockedVersion ? { lockedVersion } : {}
+    });
+  }
+  const nextTarget = {
+    machine: config.context.machine,
+    platform: config.context.platform,
+    resources: entries.sort((left, right) => left.id.localeCompare(right.id))
+  };
+  const next = {
+    version: LOCK_VERSION,
+    targets: [
+      ...previous.targets.filter(({ machine: machine2 }) => machine2 !== config.context.machine),
+      nextTarget
+    ].sort((left, right) => left.machine.localeCompare(right.machine))
+  };
+  const nextText = stringifyLock(next);
+  const changed = previousText !== nextText;
+  if (changed) await atomicWrite(path, nextText);
+  return { config: { ...config, resources }, path, changed };
+}
+function withLockedVersion(resource, lockedVersion) {
+  if (resource.kind !== "package" || lockedVersion === void 0) return resource;
+  return { ...resource, lockedVersion };
+}
+function emptyLock() {
+  return { version: LOCK_VERSION, targets: [] };
+}
+function stringifyLock(lock) {
+  return stringify2({
+    version: lock.version,
+    targets: lock.targets.map((target) => ({
+      machine: target.machine,
+      platform: target.platform,
+      resources: target.resources.map((entry) => ({
+        id: entry.id,
+        fingerprint: entry.fingerprint,
+        ...entry.lockedVersion ? { locked_version: entry.lockedVersion } : {}
+      }))
+    }))
+  });
+}
+function parseLock(text, path) {
+  const document = parse2(text);
+  if (document.version !== LOCK_VERSION) {
+    throw new Error(`Unsupported workstation lock version in ${path}`);
+  }
+  if (!Array.isArray(document.targets)) throw new Error(`Lock targets must be an array in ${path}`);
+  const machines = /* @__PURE__ */ new Set();
+  const targets = document.targets.map((value, targetIndex) => {
+    const target = requireTable2(value, `targets[${targetIndex}]`);
+    const machine2 = requireString2(target.machine, `targets[${targetIndex}].machine`);
+    if (machines.has(machine2)) throw new Error(`Duplicate machine ${machine2} in ${path}`);
+    machines.add(machine2);
+    const platform = requireString2(target.platform, `targets[${targetIndex}].platform`);
+    if (platform !== "darwin" && platform !== "linux") {
+      throw new Error(`Invalid platform for ${machine2} in ${path}`);
+    }
+    if (!Array.isArray(target.resources)) {
+      throw new Error(`Lock resources for ${machine2} must be an array in ${path}`);
+    }
+    const ids = /* @__PURE__ */ new Set();
+    const resources = target.resources.map((value2, resourceIndex) => {
+      const entry = requireTable2(value2, `targets[${targetIndex}].resources[${resourceIndex}]`);
+      const id = requireString2(entry.id, "lock resource id");
+      if (ids.has(id)) throw new Error(`Duplicate resource ${id} for ${machine2} in ${path}`);
+      ids.add(id);
+      return {
+        id,
+        fingerprint: requireString2(entry.fingerprint, `lock fingerprint for ${id}`),
+        ...entry.locked_version === void 0 ? {} : { lockedVersion: requireString2(entry.locked_version, `locked version for ${id}`) }
+      };
+    });
+    return { machine: machine2, platform, resources };
+  });
+  return { version: LOCK_VERSION, targets };
+}
+function requireTable2(value, field) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${field} must be a table`);
+  }
+  return value;
+}
+function requireString2(value, field) {
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${field} must be a string`);
+  return value;
+}
+async function readOptional(path) {
+  try {
+    return await readFile3(path, "utf8");
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
+      return void 0;
+    }
+    throw error;
+  }
+}
+async function atomicWrite(path, contents) {
+  const temporary = `${path}.${process.pid}.tmp`;
+  await writeFile3(temporary, contents, { mode: 420 });
+  await rename3(temporary, path);
+}
+
+// src/resources/runner.ts
+import { spawn } from "child_process";
+var ProcessRunner = class {
+  /** Execute a command directly and return captured output and its exit code; spawn failures reject. */
+  async run(command, args, options) {
+    return await new Promise((resolve6, reject) => {
+      const child = spawn(command, [...args], {
+        cwd: options?.cwd,
+        env: { ...process.env, ...options?.environment },
+        stdio: ["inherit", "pipe", "pipe"]
+      });
+      let stdout = "";
+      let stderr = "";
+      child.stdout.setEncoding("utf8");
+      child.stderr.setEncoding("utf8");
+      child.stdout.on("data", (chunk) => stdout += chunk);
+      child.stderr.on("data", (chunk) => stderr += chunk);
+      child.once("error", reject);
+      child.once(
+        "close",
+        (exitCode) => resolve6({ exitCode: exitCode ?? 1, stdout, stderr })
+      );
+    });
+  }
+};
+export {
+  JsoncDocument,
+  ProcessRunner,
+  bash,
+  configure,
+  customTool,
+  darwin,
+  defineConfig,
+  files,
+  findConfig,
+  fingerprint,
+  jsonc,
+  launchAgent,
+  linux,
+  loadConfig,
+  lockConfig,
+  lockPath,
+  machine,
+  manifestPath,
+  readManifest,
+  renderShell,
+  resourceId,
+  runTask,
+  shell,
+  symlink,
+  systemdService,
+  task,
+  tools,
+  when,
+  writeManifest,
+  zsh
+};
+//# sourceMappingURL=index.js.map