@homeflare/alchemy 0.15.0 → 0.19.0

package/dist/linux/index.js

@@ -0,0 +1,1554 @@
+// src/linux/directory.ts
+import { Resource } from "alchemy";
+import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect6 from "effect/Effect";
+
+// src/launchd/host-effect.ts
+import * as Effect from "effect/Effect";
+var lift = (step) => Effect.tryPromise({
+  catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
+  try: step
+});
+var resolvedString = (news, key) => {
+  if (typeof news !== "object" || news === null)
+    return;
+  const value = news[key];
+  return typeof value === "string" ? value : undefined;
+};
+
+// src/launchd/runner.ts
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+
+class HostRunnerService extends Context.Service()("homeflare/launchd/HostRunner") {
+}
+var hostRunnerLayer = (runner) => Layer.succeed(HostRunnerService, runner);
+var canActAsRoot = (runner) => runner.privileged || runner.effectiveUid() === 0;
+
+// src/ownership/adopt.ts
+import { AdoptPolicy } from "alchemy/AdoptPolicy";
+import { AlchemyContext } from "alchemy/AlchemyContext";
+import { Stack as Stack3 } from "alchemy/Stack";
+import * as Effect5 from "effect/Effect";
+import * as Option4 from "effect/Option";
+
+// src/ownership/resume.ts
+import { Unowned } from "alchemy/AdoptPolicy";
+import { Artifacts } from "alchemy/Artifacts";
+import * as Effect2 from "effect/Effect";
+import * as Option from "effect/Option";
+var PROVEN = "homeflare/ownership/resumes";
+var UNFINISHED = "homeflare/ownership/unfinished";
+var note = (key, instanceId) => Effect2.gen(function* () {
+  const bag = yield* Effect2.serviceOption(Artifacts);
+  if (Option.isSome(bag))
+    yield* bag.value.set(key, instanceId);
+});
+var noted = (key, instanceId) => Effect2.gen(function* () {
+  const bag = yield* Effect2.serviceOption(Artifacts);
+  if (Option.isNone(bag))
+    return false;
+  return (yield* bag.value.get(key)) === instanceId;
+});
+var noteUnfinished = (instanceId) => Effect2.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect2.gen(function* () {
+  yield* noteUnfinished(instanceId);
+  const unproven = () => Effect2.succeed(undefined);
+  const found = yield* recovered.pipe(Effect2.catch(unproven), Effect2.catchDefect(unproven));
+  if (found === undefined || found === null || Unowned.is(found))
+    return;
+  yield* note(PROVEN, instanceId);
+});
+var resumes = (instanceId) => noted(PROVEN, instanceId);
+var unfinished = (instanceId) => noted(UNFINISHED, instanceId);
+var provingResumes = (service) => {
+  const { diff, read } = service;
+  if (diff === undefined || read === undefined)
+    return service;
+  const proving = (input) => Effect2.gen(function* () {
+    if (input.output === undefined) {
+      yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
+    }
+    return yield* diff(input);
+  });
+  return { ...service, diff: proving };
+};
+
+// src/ownership/rows.ts
+import { Stack as Stack2 } from "alchemy/Stack";
+import { State, isActionState } from "alchemy/State/State";
+import * as Effect4 from "effect/Effect";
+import * as Option3 from "effect/Option";
+
+// src/ownership/whole.ts
+import { Stack } from "alchemy/Stack";
+import * as Effect3 from "effect/Effect";
+import * as Option2 from "effect/Option";
+var absent = (value) => value === undefined || value === null;
+var isPlainObject = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var carries = (declared, recorded) => {
+  if (absent(declared))
+    return true;
+  if (absent(recorded))
+    return false;
+  if (Array.isArray(declared)) {
+    if (!Array.isArray(recorded))
+      return false;
+    return declared.every((each, index) => carries(each, recorded[index]));
+  }
+  if (isPlainObject(declared)) {
+    if (!isPlainObject(recorded))
+      return false;
+    return Object.entries(declared).every(([key, each]) => carries(each, recorded[key]));
+  }
+  return true;
+};
+var wholeDeclaration = (fqn, props) => Effect3.map(Effect3.serviceOption(Stack), (stack) => {
+  const declared = Option2.isSome(stack) ? stack.value.resources[fqn] : undefined;
+  return declared !== undefined && carries(declared.Props, props);
+});
+
+// src/ownership/rows.ts
+var storeOf = Effect4.gen(function* () {
+  const stack = yield* Effect4.serviceOption(Stack2);
+  const state = yield* Effect4.serviceOption(State);
+  if (Option3.isNone(stack) || Option3.isNone(state))
+    return;
+  const store = yield* state.value;
+  const where = { stack: stack.value.name, stage: stack.value.stage };
+  return { resources: stack.value.resources, store, where };
+});
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect4.orElseSucceed(() => {
+  return;
+}));
+var generationOf = (row, instanceId) => {
+  let at = row;
+  while (typeof at === "object" && at !== null && !isActionState(at)) {
+    const generation = at;
+    if (generation.instanceId === instanceId)
+      return generation;
+    at = generation.old;
+  }
+  return;
+};
+var recordedGeneration = (fqn, instanceId) => Effect4.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  for (const at of [fqn, ...found.resources[fqn]?.FormerFqns ?? []]) {
+    const generation = generationOf(yield* rowAt(found.store, found.where, at), instanceId);
+    if (generation !== undefined)
+      return generation;
+  }
+  return;
+});
+var recordedInstance = (fqn, instanceId) => Effect4.gen(function* () {
+  const generation = yield* recordedGeneration(fqn, instanceId);
+  if (generation === undefined)
+    return "absent";
+  return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
+});
+var isCreate = (fqn, instanceId) => Effect4.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var forgetRefusedCreate = (fqn, instanceId) => Effect4.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  const row = yield* rowAt(found.store, found.where, fqn);
+  const mine = row;
+  if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
+    return;
+  }
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect4.ignore);
+});
+
+// src/ownership/adopt.ts
+var adoptEnabled = (fqn) => Effect5.gen(function* () {
+  const stack = yield* Effect5.serviceOption(Stack3);
+  const scoped = Option4.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
+  if (scoped !== undefined)
+    return scoped;
+  const policy = yield* Effect5.serviceOption(AdoptPolicy);
+  if (Option4.isSome(policy))
+    return policy.value;
+  const context = yield* Effect5.serviceOption(AlchemyContext);
+  return Option4.isSome(context) ? context.value.adopt : false;
+});
+var adoptable = (owner) => Effect5.gen(function* () {
+  if (yield* isCreate(owner.fqn, owner.instanceId))
+    return true;
+  return yield* unfinished(owner.instanceId);
+});
+var adoptsAtApply = (owner) => Effect5.gen(function* () {
+  if (!(yield* adoptEnabled(owner.fqn)))
+    return false;
+  return yield* adoptable(owner);
+});
+var refuseTakeover = (owner, what) => Effect5.gen(function* () {
+  if (owner.output !== undefined)
+    return;
+  if (yield* resumes(owner.instanceId))
+    return;
+  const may = yield* adoptable(owner);
+  if (may && (yield* adoptEnabled(owner.fqn)))
+    return;
+  yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
+  const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
+  return yield* Effect5.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+});
+var claimFor = (owner) => (what) => refuseTakeover(owner, what);
+
+// src/launchd/secret-tripwire.ts
+var ALTERNATIVE = "props are stored unencrypted in Alchemy state. Have a secret renderer (e.g. openbao-agent) " + "write it to a root-owned file and declare the file path instead (FOO_FILE=/path, --foo-file /path).";
+var SECRET_NAME = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|API_?KEY|ACCESS_KEY|PRIVATE_KEY|SECRET_KEY|CREDENTIALS?)$/i;
+var INLINE_FLAG = /^--?[a-z0-9-]*(?:token|password|passwd|passphrase|secret|api-?key)=./i;
+var BARE_FLAG = /^--?(?:[a-z0-9]+-)*(?:token|password|passwd|passphrase|secret|api-?key)$/i;
+var PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
+var keyLeaves = (value, path) => {
+  if (typeof value === "string")
+    return PRIVATE_KEY.test(value) ? [path] : [];
+  if (Array.isArray(value)) {
+    return value.flatMap((item, index) => keyLeaves(item, `${path}[${String(index)}]`));
+  }
+  if (typeof value === "object" && value !== null) {
+    return Object.entries(value).flatMap(([key, item]) => keyLeaves(item, `${path}.${key}`));
+  }
+  return [];
+};
+var jobSecretProblems = (environment, argv, extraKeys) => {
+  const found = [];
+  for (const [name, value] of Object.entries(environment ?? {})) {
+    if (SECRET_NAME.test(name))
+      found.push(`environment ${name} looks like a secret: ${ALTERNATIVE}`);
+    else if (PRIVATE_KEY.test(value))
+      found.push(`environment ${name} holds a private key: ${ALTERNATIVE}`);
+  }
+  for (const [index, arg] of argv.entries()) {
+    if (INLINE_FLAG.test(arg)) {
+      found.push(`programArguments[${String(index)}] passes a secret inline: ${ALTERNATIVE}`);
+    } else if (BARE_FLAG.test(arg) && index + 1 < argv.length) {
+      found.push(`programArguments[${String(index + 1)}] follows a secret flag: ${ALTERNATIVE}`);
+    } else if (PRIVATE_KEY.test(arg)) {
+      found.push(`programArguments[${String(index)}] holds a private key: ${ALTERNATIVE}`);
+    }
+  }
+  for (const path of keyLeaves(extraKeys ?? {}, "extraKeys")) {
+    found.push(`${path} holds a private key: ${ALTERNATIVE}`);
+  }
+  return found;
+};
+var fileSecretProblems = (content) => PRIVATE_KEY.test(content) ? [`content holds a private key: ${ALTERNATIVE}`] : [];
+
+// src/launchd/host-file-form.ts
+var DEFAULT_MODE = 420;
+var identityProblems = (name, value) => {
+  if (value === undefined)
+    return [];
+  if (typeof value === "number") {
+    return Number.isSafeInteger(value) && value >= 0 ? [] : [`${name} must be a non-negative integer id`];
+  }
+  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
+};
+var pathProblems = (path) => {
+  const found = [];
+  if (!path.startsWith("/"))
+    found.push("path must be absolute");
+  if (path.endsWith("/") || path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..")) {
+    found.push('path must be normalised (no trailing slash, no empty, "." or ".." segments)');
+  }
+  if (path.includes("\x00"))
+    found.push("path contains NUL");
+  return found;
+};
+var fileProblems = (props) => {
+  const found = pathProblems(props.path);
+  const mode = props.mode ?? DEFAULT_MODE;
+  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
+    found.push("mode must be 0–0o7777");
+  found.push(...identityProblems("owner", props.owner));
+  found.push(...identityProblems("group", props.group));
+  found.push(...fileSecretProblems(props.content));
+  return found;
+};
+
+// src/linux/directory-lifecycle.ts
+var DEFAULT_DIR_MODE = 493;
+var refuse = (path, message) => new Error(`Host.Directory ${path}: ${message}`);
+var idProblems = (name, value) => {
+  if (value === undefined)
+    return [];
+  if (typeof value === "number") {
+    return Number.isSafeInteger(value) && value >= 0 ? [] : [`${name} must be a non-negative id`];
+  }
+  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
+};
+var directoryProblems = (props) => {
+  const found = pathProblems(props.path);
+  const mode = props.mode ?? DEFAULT_DIR_MODE;
+  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
+    found.push("mode must be 0–0o7777");
+  found.push(...idProblems("owner", props.owner), ...idProblems("group", props.group));
+  return found;
+};
+var numericId = (value) => typeof value === "number" ? value : /^\d+$/.test(value) ? Number(value) : undefined;
+var desired = async (runner, props) => {
+  const found = directoryProblems(props);
+  if (found.length > 0)
+    throw refuse(props.path, found.join("; "));
+  let uid;
+  let gid;
+  if (props.owner !== undefined) {
+    uid = numericId(props.owner) ?? (await runner.lookupUser(String(props.owner)))?.uid;
+    if (uid === undefined)
+      throw refuse(props.path, `no user ${String(props.owner)} on this host`);
+  }
+  if (props.group !== undefined) {
+    gid = numericId(props.group) ?? await runner.lookupGroup(String(props.group));
+    if (gid === undefined)
+      throw refuse(props.path, `no group ${String(props.group)} on this host`);
+  }
+  return {
+    mode: props.mode ?? DEFAULT_DIR_MODE,
+    ...uid === undefined ? {} : { uid },
+    ...gid === undefined ? {} : { gid }
+  };
+};
+var readDirectory = async (runner, path) => {
+  const stat = await runner.stat(path);
+  if (stat === undefined || stat.kind !== "directory")
+    return;
+  return { gid: stat.gid, mode: stat.mode, path, uid: stat.uid };
+};
+var octal = (mode) => mode.toString(8).padStart(3, "0");
+var must = async (runner, path, argv) => {
+  const result = await runner.exec(argv);
+  if (result.exitCode !== 0) {
+    throw refuse(path, `${argv.join(" ")} -> ${String(result.exitCode)}: ${result.stderr.trim().slice(0, 300)}`);
+  }
+};
+var reconcileDirectory = async (runner, props, output, adopt = false) => {
+  const want = await desired(runner, props);
+  if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {
+    throw refuse(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy through ` + "a root destination or a privileged HostRunner. This provider never calls sudo itself.");
+  }
+  const stat = await runner.stat(props.path);
+  if (stat !== undefined && stat.kind !== "directory") {
+    throw refuse(props.path, `is a ${stat.kind}, not a directory`);
+  }
+  if (output === undefined && stat !== undefined && !adopt) {
+    const drifted = stat.mode !== want.mode || want.uid !== undefined && stat.uid !== want.uid;
+    if (drifted) {
+      throw refuse(props.path, "already exists with another mode or owner and is not this resource. Remove it, or " + "declare it as a new resource and deploy with --adopt.");
+    }
+  }
+  if (stat === undefined) {
+    const parent = props.path.slice(0, props.path.lastIndexOf("/")) || "/";
+    const above = await runner.stat(parent);
+    if (above === undefined || above.kind !== "directory") {
+      throw refuse(props.path, `its parent ${parent} does not exist; declare that directory too`);
+    }
+    await must(runner, props.path, ["mkdir", "-m", octal(want.mode), "--", props.path]);
+  } else if (stat.mode !== want.mode) {
+    await must(runner, props.path, ["chmod", octal(want.mode), "--", props.path]);
+  }
+  const owner = ownerMatches({ gid: stat?.gid ?? -1, mode: 0, path: props.path, uid: stat?.uid ?? -1 }, want) ? undefined : ownerArg(want);
+  if (owner !== undefined)
+    await must(runner, props.path, ["chown", owner, "--", props.path]);
+  const after = await readDirectory(runner, props.path);
+  if (after === undefined || after.mode !== want.mode || !ownerMatches(after, want)) {
+    throw refuse(props.path, "the directory on the host does not match the declaration");
+  }
+  return after;
+};
+var ownerArg = (want) => {
+  if (want.uid === undefined)
+    return want.gid === undefined ? undefined : `:${String(want.gid)}`;
+  return want.gid === undefined ? String(want.uid) : `${String(want.uid)}:${String(want.gid)}`;
+};
+var ownerMatches = (live, want) => (want.uid === undefined || live.uid === want.uid) && (want.gid === undefined || live.gid === want.gid);
+var diffDirectory = async (runner, news, output) => {
+  const want = await desired(runner, news);
+  if (news.path !== output.path)
+    return { action: "replace" };
+  const live = await readDirectory(runner, news.path);
+  const converged = live !== undefined && live.mode === want.mode && ownerMatches(live, want) && output.mode === want.mode && ownerMatches(output, want);
+  if (converged)
+    return { action: "noop" };
+  await runner.checkWrite?.(news.path, want);
+  return { action: "update" };
+};
+var deleteDirectory = async (runner, output) => {
+  const stat = await runner.stat(output.path);
+  if (stat === undefined)
+    return;
+  if (stat.kind !== "directory")
+    throw refuse(output.path, `is now a ${stat.kind}; not removing it`);
+  await must(runner, output.path, ["rmdir", "--", output.path]);
+};
+
+// src/linux/directory.ts
+var HostDirectory = Resource("Host.Directory");
+var HostDirectoryProvider = () => Provider.effect(HostDirectory, Effect6.gen(function* () {
+  const runner = yield* HostRunnerService;
+  return HostDirectory.Provider.of({
+    list: () => Effect6.succeed([]),
+    read: ({ olds, output }) => lift(async () => {
+      const found = await readDirectory(runner, olds.path);
+      if (found === undefined)
+        return;
+      return output === undefined ? Unowned2(found) : found;
+    }),
+    diff: ({ instanceId, news, output }) => {
+      if (output === undefined)
+        return noteUnfinished(instanceId);
+      if (isResolved(news))
+        return lift(() => diffDirectory(runner, news, output));
+      const path = resolvedString(news, "path");
+      return Effect6.succeed(path !== undefined && path !== output.path ? { action: "replace" } : undefined);
+    },
+    reconcile: ({ fqn, instanceId, news, output }) => Effect6.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) => lift(() => reconcileDirectory(runner, news, output, adopt))),
+    delete: ({ output }) => lift(() => deleteDirectory(runner, output))
+  });
+}));
+// src/linux/providers.ts
+import * as Layer2 from "effect/Layer";
+
+// src/linux/remote-file.ts
+import { Resource as Resource2 } from "alchemy";
+import { Unowned as Unowned3 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved2 } from "alchemy/Diff";
+import * as Provider2 from "alchemy/Provider";
+import * as Effect7 from "effect/Effect";
+
+// src/launchd/job-form.ts
+import { createHash } from "node:crypto";
+
+// src/launchd/plist.ts
+class PlistError extends Error {
+  path;
+  constructor(path, detail) {
+    super(`plist ${path === "" ? "(root)" : path}: ${detail}`);
+    this.path = path;
+    this.name = "PlistError";
+  }
+}
+var HEADER = `<?xml version="1.0" encoding="UTF-8"?>
+` + '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" ' + `"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+` + `<plist version="1.0">
+`;
+var MAX_DEPTH = 32;
+var FORBIDDEN = /[\x00-\x08\x0B\x0C\x0E-\x1F\uD800-\uDFFF\uFFFE\uFFFF]/u;
+var escapeText = (text, path) => {
+  const bad = FORBIDDEN.exec(text);
+  if (bad !== null) {
+    const code = bad[0].codePointAt(0) ?? 0;
+    throw new PlistError(path, `U+${code.toString(16).toUpperCase().padStart(4, "0")} cannot appear in XML 1.0`);
+  }
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\r", "&#13;");
+};
+var isPlainObject2 = (value) => {
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var renderValue = (value, path, depth, out) => {
+  const pad = "\t".repeat(depth);
+  if (depth > MAX_DEPTH)
+    throw new PlistError(path, `nested deeper than ${String(MAX_DEPTH)}`);
+  if (typeof value === "string") {
+    out.push(`${pad}<string>${escapeText(value, path)}</string>`);
+    return;
+  }
+  if (typeof value === "boolean") {
+    out.push(`${pad}<${value ? "true" : "false"}/>`);
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value)) {
+      throw new PlistError(path, `${String(value)} is not a safe integer (no <real> support)`);
+    }
+    out.push(`${pad}<integer>${String(value === 0 ? 0 : value)}</integer>`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      out.push(`${pad}<array/>`);
+      return;
+    }
+    out.push(`${pad}<array>`);
+    for (const [index, item] of value.entries()) {
+      renderValue(item, `${path}[${String(index)}]`, depth + 1, out);
+    }
+    out.push(`${pad}</array>`);
+    return;
+  }
+  if (typeof value === "object" && value !== null && isPlainObject2(value)) {
+    renderDict(value, path, depth, out);
+    return;
+  }
+  const kind = value === null ? "null" : typeof value;
+  throw new PlistError(path, `${kind} has no plist form — omit the key instead`);
+};
+var renderDict = (dict, path, depth, out) => {
+  const pad = "\t".repeat(depth);
+  const keys = Object.keys(dict).sort();
+  if (keys.length === 0) {
+    out.push(`${pad}<dict/>`);
+    return;
+  }
+  out.push(`${pad}<dict>`);
+  for (const key of keys) {
+    const child = path === "" ? key : `${path}.${key}`;
+    out.push(`${pad}	<key>${escapeText(key, child)}</key>`);
+    renderValue(dict[key], child, depth + 1, out);
+  }
+  out.push(`${pad}</dict>`);
+};
+var renderPlist = (dict) => {
+  if (typeof dict !== "object" || dict === null || Array.isArray(dict) || !isPlainObject2(dict)) {
+    throw new PlistError("", "the top level of a launchd plist must be a dict");
+  }
+  const out = [];
+  renderDict(dict, "", 0, out);
+  return `${HEADER}${out.join(`
+`)}
+</plist>
+`;
+};
+
+// src/launchd/job-form.ts
+var parseDomain = (domain) => {
+  if (domain === "system")
+    return { kind: "system" };
+  const match = /^gui\/(\d+)$/.exec(domain);
+  return match?.[1] === undefined ? undefined : { kind: "gui", uid: Number(match[1]) };
+};
+var serviceTarget = (label, domain) => `${domain}/${label}`;
+var plistPathFor = (label, domain, home) => {
+  if (domain.kind === "system")
+    return `/Library/LaunchDaemons/${label}.plist`;
+  if (home === undefined || !home.startsWith("/")) {
+    throw new Error(`gui/${String(domain.uid)}: no home directory for that uid on this host`);
+  }
+  return `${home}/Library/LaunchAgents/${label}.plist`;
+};
+var OWNED_KEYS = [
+  "EnvironmentVariables",
+  "GroupName",
+  "KeepAlive",
+  "Label",
+  "Program",
+  "ProgramArguments",
+  "RunAtLoad",
+  "StandardErrorPath",
+  "StandardOutPath",
+  "StartCalendarInterval",
+  "StartInterval",
+  "ThrottleInterval",
+  "UserName",
+  "WorkingDirectory"
+];
+var calendarDict = (entry) => {
+  const dict = {};
+  if (entry.minute !== undefined)
+    dict["Minute"] = entry.minute;
+  if (entry.hour !== undefined)
+    dict["Hour"] = entry.hour;
+  if (entry.day !== undefined)
+    dict["Day"] = entry.day;
+  if (entry.weekday !== undefined)
+    dict["Weekday"] = entry.weekday;
+  if (entry.month !== undefined)
+    dict["Month"] = entry.month;
+  return dict;
+};
+var keepAliveValue = (keepAlive) => {
+  if (typeof keepAlive === "boolean")
+    return keepAlive;
+  const dict = {};
+  if (keepAlive.successfulExit !== undefined)
+    dict["SuccessfulExit"] = keepAlive.successfulExit;
+  if (keepAlive.crashed !== undefined)
+    dict["Crashed"] = keepAlive.crashed;
+  return dict;
+};
+var jobPlistDict = (props) => {
+  const dict = { ...props.extraKeys };
+  dict["Label"] = props.label;
+  dict["ProgramArguments"] = [...props.programArguments];
+  const env = props.environment ?? {};
+  if (Object.keys(env).length > 0)
+    dict["EnvironmentVariables"] = { ...env };
+  if (props.runAtLoad !== undefined)
+    dict["RunAtLoad"] = props.runAtLoad;
+  if (props.keepAlive !== undefined)
+    dict["KeepAlive"] = keepAliveValue(props.keepAlive);
+  if (props.startInterval !== undefined)
+    dict["StartInterval"] = props.startInterval;
+  const calendar = props.startCalendarInterval;
+  if (calendar !== undefined) {
+    dict["StartCalendarInterval"] = Array.isArray(calendar) ? calendar.map(calendarDict) : calendarDict(calendar);
+  }
+  if (props.throttleInterval !== undefined)
+    dict["ThrottleInterval"] = props.throttleInterval;
+  if (props.standardOutPath !== undefined)
+    dict["StandardOutPath"] = props.standardOutPath;
+  if (props.standardErrorPath !== undefined)
+    dict["StandardErrorPath"] = props.standardErrorPath;
+  if (props.workingDirectory !== undefined)
+    dict["WorkingDirectory"] = props.workingDirectory;
+  if (props.userName !== undefined)
+    dict["UserName"] = props.userName;
+  if (props.groupName !== undefined)
+    dict["GroupName"] = props.groupName;
+  return dict;
+};
+var sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
+var renderJob = (props) => {
+  const text = renderPlist(jobPlistDict(props));
+  const bytes = new TextEncoder().encode(text);
+  return { bytes, sha256: sha256Hex(bytes), text };
+};
+
+// src/linux/region.ts
+var DEFAULT_COMMENT = "#";
+var tokens = (spec) => {
+  const comment = spec.comment ?? DEFAULT_COMMENT;
+  return {
+    begin: `${comment} BEGIN ${spec.name}`,
+    end: `${comment} END ${spec.name}`
+  };
+};
+var regionProblems = (spec) => {
+  const found = [];
+  const comment = spec.comment ?? DEFAULT_COMMENT;
+  if (!/^\S{1,4}$/.test(comment) || comment.includes("\x00")) {
+    found.push("region comment must be 1–4 non-space characters");
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._:@/-]{0,79}$/.test(spec.name)) {
+    found.push("region name must be 1–80 printable characters and start alphanumeric");
+  }
+  return found;
+};
+var refuse2 = (message) => new Error(`managed region: ${message}`);
+var duplicate = (what, at, line) => refuse2(`${what} for ${JSON.stringify(line)} (lines ${at.map((index) => index + 1).join(", ")}). ` + "Remove the duplicate; this resource will not choose between them.");
+var locate = (lines, spec) => {
+  const { begin, end } = tokens(spec);
+  const begins = lines.flatMap((line, index) => line === begin ? [index] : []);
+  const ends = lines.flatMap((line, index) => line === end ? [index] : []);
+  if (begins.length > 1)
+    throw duplicate("two BEGIN markers", begins, begin);
+  if (ends.length > 1)
+    throw duplicate("two END markers", ends, end);
+  const [from] = begins;
+  const [to] = ends;
+  if (from === undefined && to === undefined)
+    return;
+  if (from === undefined || to === undefined) {
+    throw refuse2(`${JSON.stringify(spec.name)} has a ${from === undefined ? "END" : "BEGIN"} marker and no ` + "match. Repair the file by hand — a half-marked block means an edit inside it.");
+  }
+  if (to < from)
+    throw refuse2(`${JSON.stringify(spec.name)} has its END marker before its BEGIN`);
+  return { from, to };
+};
+var spliceRegion = (file, spec, body) => {
+  const { begin, end } = tokens(spec);
+  const block = [begin, ...body === "" ? [] : body.replace(/\n$/, "").split(`
+`), end];
+  const lines = file.split(`
+`);
+  const found = locate(lines, spec);
+  if (found !== undefined) {
+    return [...lines.slice(0, found.from), ...block, ...lines.slice(found.to + 1)].join(`
+`);
+  }
+  const prefix = file === "" || file.endsWith(`
+`) ? file : `${file}
+`;
+  return `${prefix}${block.join(`
+`)}
+`;
+};
+var readRegion = (file, spec) => {
+  const lines = file.split(`
+`);
+  const found = locate(lines, spec);
+  if (found === undefined)
+    return;
+  const body = lines.slice(found.from + 1, found.to);
+  return body.length === 0 ? "" : `${body.join(`
+`)}
+`;
+};
+var removeRegion = (file, spec) => {
+  const lines = file.split(`
+`);
+  const found = locate(lines, spec);
+  if (found === undefined)
+    return file;
+  return [...lines.slice(0, found.from), ...lines.slice(found.to + 1)].join(`
+`);
+};
+
+// src/linux/remote-file-form.ts
+var DEFAULT_MODE2 = 420;
+var identityProblems2 = (name, value) => {
+  if (value === undefined)
+    return [];
+  if (typeof value === "number") {
+    return Number.isSafeInteger(value) && value >= 0 ? [] : [`${name} must be a non-negative integer id`];
+  }
+  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
+};
+var fileProblems2 = (props) => {
+  const found = pathProblems(props.path);
+  const mode = props.mode ?? DEFAULT_MODE2;
+  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
+    found.push("mode must be 0–0o7777");
+  found.push(...identityProblems2("owner", props.owner));
+  found.push(...identityProblems2("group", props.group));
+  found.push(...fileSecretProblems(props.content));
+  if (props.region !== undefined) {
+    found.push(...regionProblems(props.region));
+    if (props.create !== true && (props.mode !== undefined || props.owner !== undefined)) {
+      found.push("mode and owner apply only to a file this resource creates; drop them, or set create: true");
+    }
+  } else if (props.create === true) {
+    found.push("create is for region mode only; a whole-file declaration always creates the file");
+  }
+  return found;
+};
+
+// src/linux/remote-file-plan.ts
+var decoder = new TextDecoder;
+var encoder = new TextEncoder;
+var refuse3 = (path, message) => new Error(`Remote.File ${path}: ${message}`);
+var numericId2 = (value) => typeof value === "number" ? value : /^\d+$/.test(value) ? Number(value) : undefined;
+var identity = async (runner, props) => {
+  const found = fileProblems2(props);
+  if (found.length > 0)
+    throw refuse3(props.path, found.join("; "));
+  let uid;
+  let gid;
+  if (props.owner !== undefined) {
+    uid = numericId2(props.owner) ?? (await runner.lookupUser(String(props.owner)))?.uid;
+    if (uid === undefined)
+      throw refuse3(props.path, `no user ${String(props.owner)} on this host`);
+  }
+  if (props.group !== undefined) {
+    gid = numericId2(props.group) ?? await runner.lookupGroup(String(props.group));
+    if (gid === undefined)
+      throw refuse3(props.path, `no group ${String(props.group)} on this host`);
+  }
+  return { ...uid === undefined ? {} : { uid }, ...gid === undefined ? {} : { gid } };
+};
+var digestOf = (text) => sha256Hex(encoder.encode(text));
+var ownedDigest = (file, region) => {
+  if (file === undefined)
+    return;
+  if (region === undefined)
+    return digestOf(file);
+  const body = readRegion(file, region);
+  return body === undefined ? undefined : digestOf(body);
+};
+var readFileAttributes = async (runner, path, region) => {
+  const stat = await runner.stat(path);
+  if (stat === undefined)
+    return;
+  const bytes = stat.kind === "file" ? await runner.readFile(path) : undefined;
+  const text = bytes === undefined ? undefined : decoder.decode(bytes);
+  return {
+    contentSha256: ownedDigest(text, region) ?? "",
+    gid: stat.gid,
+    mode: stat.mode,
+    path,
+    ...region === undefined ? {} : { region },
+    sha256: bytes === undefined ? "" : sha256Hex(bytes),
+    size: stat.size,
+    uid: stat.uid
+  };
+};
+var matches = (stat, write) => stat !== undefined && stat.mode === write.mode && (write.uid === undefined || stat.uid === write.uid) && (write.gid === undefined || stat.gid === write.gid);
+var planWrite = async (runner, props, want) => {
+  const stat = await runner.stat(props.path);
+  if (stat !== undefined && stat.kind !== "file") {
+    throw refuse3(props.path, `is a ${stat.kind}; remove it from whatever owns it before declaring it here`);
+  }
+  const current = stat === undefined ? undefined : await runner.readFile(props.path);
+  const before = current === undefined ? undefined : decoder.decode(current);
+  const declaredMode = props.mode ?? DEFAULT_MODE2;
+  if (props.region === undefined) {
+    const write = { mode: declaredMode, ...want };
+    return {
+      before,
+      bytes: encoder.encode(props.content),
+      converged: before === props.content && matches(stat, write),
+      write
+    };
+  }
+  if (before === undefined) {
+    if (props.create !== true) {
+      throw refuse3(props.path, "does not exist, and a managed region does not create the file it lives in. Check the " + "path, declare the file itself, or pass create: true.");
+    }
+    return {
+      before,
+      bytes: encoder.encode(spliceRegion("", props.region, props.content)),
+      converged: false,
+      write: { mode: declaredMode, ...want }
+    };
+  }
+  const next = spliceRegion(before, props.region, props.content);
+  return {
+    before,
+    bytes: encoder.encode(next),
+    converged: next === before,
+    write: { gid: stat?.gid ?? 0, mode: stat?.mode ?? declaredMode, uid: stat?.uid ?? 0 }
+  };
+};
+
+// src/linux/remote-file-lifecycle.ts
+var diffFile = async (runner, news, output) => {
+  const want = await identity(runner, news);
+  if (news.path !== output.path) {
+    await runner.checkWrite?.(news.path, { mode: news.mode ?? DEFAULT_MODE2, ...want });
+    return { action: "replace" };
+  }
+  const planned = await planWrite(runner, news, want);
+  if (planned.converged && output.contentSha256 === digestOf(news.content)) {
+    return { action: "noop" };
+  }
+  await runner.checkWrite?.(news.path, planned.write);
+  return { action: "update" };
+};
+var reconcileFile = async (runner, props, output, adopt = false) => {
+  const want = await identity(runner, props);
+  if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {
+    throw refuse3(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy through ` + "a root destination or a privileged HostRunner. This provider never calls sudo itself.");
+  }
+  const moved = output !== undefined && output.path !== props.path;
+  const prior = moved ? undefined : output;
+  const planned = await planWrite(runner, props, want);
+  const live = ownedDigest(planned.before, props.region);
+  const declared = digestOf(props.content);
+  if (prior === undefined && live !== undefined && live !== declared && !(adopt && output === undefined)) {
+    throw refuse3(props.path, `${props.region === undefined ? "already exists" : "already carries that managed region"}` + " and is not this resource. Remove it, or declare it as a new resource and deploy --adopt.");
+  }
+  if (!planned.converged)
+    await runner.writeFileAtomic(props.path, planned.bytes, planned.write);
+  const after = await readFileAttributes(runner, props.path, props.region);
+  if (after === undefined || after.sha256 !== sha256Hex(planned.bytes) || after.contentSha256 !== declared) {
+    if (planned.before === undefined && props.region === undefined) {
+      await runner.removeFile(props.path).catch(() => {
+        return;
+      });
+    }
+    throw refuse3(props.path, "the write returned but the file on disk does not match the declaration");
+  }
+  if (moved && output !== undefined)
+    await deleteFile(runner, output);
+  return after;
+};
+var deleteFile = async (runner, output) => {
+  const stat = await runner.stat(output.path);
+  if (stat === undefined)
+    return;
+  if (stat.kind !== "file")
+    throw refuse3(output.path, `is now a ${stat.kind}; not touching it`);
+  if (output.region === undefined) {
+    await runner.removeFile(output.path);
+    return;
+  }
+  const bytes = await runner.readFile(output.path);
+  if (bytes === undefined)
+    return;
+  const before = decoder.decode(bytes);
+  const next = removeRegion(before, output.region);
+  if (next === before)
+    return;
+  await runner.writeFileAtomic(output.path, encoder.encode(next), {
+    gid: stat.gid,
+    mode: stat.mode,
+    uid: stat.uid
+  });
+};
+
+// src/linux/remote-file.ts
+var RemoteFile = Resource2("Remote.File");
+var RemoteFileProvider = () => Provider2.effect(RemoteFile, Effect7.gen(function* () {
+  const runner = yield* HostRunnerService;
+  return RemoteFile.Provider.of({
+    list: () => Effect7.succeed([]),
+    read: ({ olds, output }) => lift(async () => {
+      const found = await readFileAttributes(runner, olds.path, olds.region);
+      if (found === undefined)
+        return;
+      if (olds.region !== undefined && found.contentSha256 === "")
+        return;
+      return output === undefined ? Unowned3(found) : found;
+    }),
+    diff: ({ instanceId, news, output }) => {
+      if (output === undefined)
+        return noteUnfinished(instanceId);
+      if (isResolved2(news))
+        return lift(() => diffFile(runner, news, output));
+      const path = resolvedString(news, "path");
+      return Effect7.succeed(path !== undefined && path !== output.path ? { action: "replace" } : undefined);
+    },
+    reconcile: ({ fqn, instanceId, news, output }) => Effect7.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) => lift(() => reconcileFile(runner, news, output, adopt))),
+    delete: ({ output }) => lift(() => deleteFile(runner, output))
+  });
+}));
+
+// src/linux/unit.ts
+import { Resource as Resource3 } from "alchemy";
+import * as Provider3 from "alchemy/Provider";
+import * as Effect9 from "effect/Effect";
+
+// src/linux/unit-handlers.ts
+import { Unowned as Unowned4 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved3 } from "alchemy/Diff";
+import * as Effect8 from "effect/Effect";
+
+// src/linux/unit-form.ts
+var DEFAULT_UNIT_DIRECTORY = "/etc/systemd/system";
+var UNIT_SEARCH_DIRECTORIES = [
+  "/etc/systemd/system",
+  "/run/systemd/system",
+  "/usr/local/lib/systemd/system",
+  "/usr/lib/systemd/system",
+  "/lib/systemd/system"
+];
+var UNIT_WRITE = { gid: 0, mode: 420, uid: 0 };
+var digestOf2 = (text) => sha256Hex(new TextEncoder().encode(text));
+var configDigest = (restartOn) => digestOf2((restartOn ?? []).join(`
+`));
+var renderUnit = (sections) => `${sections.map((section) => [`[${section.name}]`, ...section.lines.map(([key, value]) => `${key}=${value}`)].join(`
+`)).join(`
+
+`)}
+`;
+var unitText = (props) => props.content ?? renderUnit(props.sections ?? []);
+var unitPathFor = (props) => `${props.directory ?? DEFAULT_UNIT_DIRECTORY}/${props.name}`;
+var NAME = /^[A-Za-z0-9][A-Za-z0-9_.@:-]*\.([a-z]+)$/;
+var TYPES = new Set([
+  "automount",
+  "device",
+  "mount",
+  "path",
+  "scope",
+  "service",
+  "slice",
+  "socket",
+  "swap",
+  "target",
+  "timer"
+]);
+var INSTALL_KEYS = new Set(["WantedBy", "RequiredBy", "UpsertedBy", "Also", "Alias"]);
+var unitProblems = (props, expect) => {
+  const found = [];
+  const type = NAME.exec(props.name)?.[1];
+  if (type === undefined || !TYPES.has(type)) {
+    found.push(`name must be <unit>.<type> with a systemd unit type, got ${JSON.stringify(props.name)}`);
+  } else if (expect !== undefined && type !== expect) {
+    found.push(`this resource declares a .${expect} unit; ${props.name} is a .${type}`);
+  }
+  if (props.content === undefined === (props.sections === undefined)) {
+    found.push("declare exactly one of content or sections");
+  }
+  const directory = props.directory ?? DEFAULT_UNIT_DIRECTORY;
+  if (!directory.startsWith("/") || directory.endsWith("/") || directory.includes("/..")) {
+    found.push("directory must be an absolute, normalised path with no trailing slash");
+  }
+  found.push(...textProblems(unitText(props)));
+  if (props.enabled !== false && !UNIT_SEARCH_DIRECTORIES.includes(directory)) {
+    found.push(`an enabled unit must live where systemd looks for it by name (${UNIT_SEARCH_DIRECTORIES.join(", ")}); ` + `${directory} is not one of them. Move it, or declare enabled: false.`);
+  }
+  if (props.enabled !== false && !hasInstall(props)) {
+    found.push("enabled units need an [Install] section with WantedBy/RequiredBy/Also/Alias; without one " + 'systemd calls the unit "static" and `systemctl enable` has nothing to link. Add one, or ' + "declare enabled: false and let something else pull it in.");
+  }
+  if (type === "timer" && !unitText(props).includes("[Timer]")) {
+    found.push("a .timer needs a [Timer] section");
+  }
+  return found;
+};
+var hasInstall = (props) => {
+  const text = unitText(props);
+  if (!text.includes("[Install]"))
+    return false;
+  const after = text.slice(text.indexOf("[Install]"));
+  return [...INSTALL_KEYS].some((key) => new RegExp(`^${key}=`, "m").test(after));
+};
+var textProblems = (text) => {
+  const found = [];
+  if (text.trim() === "")
+    found.push("the unit file is empty");
+  if (text.includes("\x00"))
+    found.push("the unit file contains NUL");
+  if (!/^\s*\[[A-Za-z]+]/.test(text))
+    found.push("a unit file must begin with a [Section]");
+  return found;
+};
+
+// src/linux/systemctl.ts
+var SYSTEMCTL = "systemctl";
+var SHOW_PROPERTIES = [
+  "Id",
+  "LoadState",
+  "ActiveState",
+  "SubState",
+  "UnitFileState",
+  "FragmentPath",
+  "NeedDaemonReload"
+];
+
+class SystemctlError extends Error {
+  constructor(command, exitCode, stderr) {
+    super(`systemctl ${command} -> ${String(exitCode)}: ${stderr.trim().slice(0, 300)}`);
+    this.name = "SystemctlError";
+  }
+}
+var parseShow = (stdout) => {
+  const fields = new Map;
+  for (const line of stdout.split(`
+`)) {
+    const at = line.indexOf("=");
+    if (at <= 0)
+      continue;
+    const key = line.slice(0, at);
+    if (!fields.has(key))
+      fields.set(key, line.slice(at + 1));
+  }
+  return fields;
+};
+var statusOf = (stdout) => {
+  const fields = parseShow(stdout);
+  const loadState = fields.get("LoadState") ?? "not-found";
+  const unitFileState = fields.get("UnitFileState") ?? "";
+  const fragmentPath = fields.get("FragmentPath") ?? "";
+  const subState = fields.get("SubState") ?? "";
+  return {
+    activeState: fields.get("ActiveState") ?? "inactive",
+    known: loadState !== "not-found" || unitFileState !== "",
+    loadState,
+    needDaemonReload: fields.get("NeedDaemonReload") === "yes",
+    ...subState === "" ? {} : { subState },
+    ...unitFileState === "" ? {} : { unitFileState },
+    ...fragmentPath === "" ? {} : { fragmentPath }
+  };
+};
+var showUnit = async (runner, name) => {
+  const result = await runner.exec([
+    SYSTEMCTL,
+    "show",
+    "--no-pager",
+    "-p",
+    SHOW_PROPERTIES.join(","),
+    "--",
+    name
+  ]);
+  if (result.exitCode !== 0)
+    throw new SystemctlError(`show ${name}`, result.exitCode, result.stderr);
+  return statusOf(result.stdout);
+};
+var run = async (runner, args) => {
+  const result = await runner.exec([SYSTEMCTL, ...args]);
+  if (result.exitCode !== 0) {
+    throw new SystemctlError(args.join(" "), result.exitCode, result.stderr);
+  }
+};
+var daemonReload = (runner) => run(runner, ["daemon-reload"]);
+var enableUnit = (runner, name) => run(runner, ["enable", "--", name]);
+var disableUnit = (runner, name) => run(runner, ["disable", "--", name]);
+var startUnit = (runner, name) => run(runner, ["start", "--", name]);
+var stopUnit = (runner, name) => run(runner, ["stop", "--", name]);
+var restartUnit = (runner, name) => run(runner, ["restart", "--", name]);
+
+// src/linux/unit-settle.ts
+var refuse4 = (name, message) => new Error(`Systemd.Unit ${name}: ${message}`);
+var attributesOf = (props, unitSha256, status) => ({
+  active: status.activeState === "active" || status.activeState === "activating",
+  activeState: status.activeState,
+  configSha256: configDigest(props.restartOn),
+  enabled: status.unitFileState === "enabled" || status.unitFileState === "enabled-runtime",
+  loadState: status.loadState,
+  name: props.name,
+  unitPath: unitPathFor(props),
+  unitSha256,
+  ...status.unitFileState === undefined ? {} : { unitFileState: status.unitFileState }
+});
+var settle = async (runner, props, step) => {
+  const wantEnabled = props.enabled !== false;
+  const wantStarted = props.started !== false;
+  const isEnabled = step.status.unitFileState === "enabled" || step.status.unitFileState === "enabled-runtime";
+  const undo = async (detail) => {
+    if (step.before === undefined) {
+      await runner.removeFile(step.path).catch(() => {
+        return;
+      });
+      await daemonReload(runner).catch(() => {
+        return;
+      });
+    }
+    throw refuse4(props.name, `${detail} The unit is NOT running.`);
+  };
+  try {
+    if (wantEnabled && (!isEnabled || step.changed))
+      await enableUnit(runner, props.name);
+    if (!wantEnabled && isEnabled)
+      await disableUnit(runner, props.name);
+    const active = step.status.activeState === "active" || step.status.activeState === "activating";
+    if (!wantStarted) {
+      if (active)
+        await stopUnit(runner, props.name);
+    } else if (!active)
+      await startUnit(runner, props.name);
+    else if (step.changed || step.configChanged)
+      await restartUnit(runner, props.name);
+  } catch (cause) {
+    return undo(cause instanceof Error ? cause.message : String(cause));
+  }
+  const after = await showUnit(runner, props.name);
+  if (wantStarted && after.activeState !== "active" && after.activeState !== "activating") {
+    return undo(`systemctl reported success but the unit is ${after.activeState}.`);
+  }
+  const settled = attributesOf(props, step.desired, after);
+  if (wantEnabled && !settled.enabled) {
+    return undo(`systemctl enable reported success but systemd calls the unit ` + `${JSON.stringify(after.unitFileState ?? "")}, not enabled.`);
+  }
+  return settled;
+};
+
+// src/linux/unit-lifecycle.ts
+var encoder2 = new TextEncoder;
+var decoder2 = new TextDecoder;
+var assertValid = (props, expect) => {
+  const found = unitProblems(props, expect);
+  if (found.length > 0)
+    throw refuse4(props.name, found.join("; "));
+};
+var readUnit = async (runner, props) => {
+  const bytes = await runner.readFile(unitPathFor(props));
+  const status = await showUnit(runner, props.name);
+  if (bytes === undefined && !status.known)
+    return;
+  return attributesOf(props, bytes === undefined ? "" : digestOf2(decoder2.decode(bytes)), status);
+};
+var assertMayWrite = (runner, name) => {
+  if (canActAsRoot(runner))
+    return;
+  throw refuse4(name, "a systemd unit is root-owned and systemctl needs root. Point the runner at a destination " + "whose ssh user is root, or provide a privileged HostRunner. This provider never calls sudo.");
+};
+var assertUsable = (props, status) => {
+  if (status.loadState === "masked" || status.unitFileState === "masked") {
+    throw refuse4(props.name, "is masked. If that is stale, `systemctl unmask` it deliberately, then redeploy. Nothing " + "was written.");
+  }
+};
+var diffUnit = async (runner, news, output, expect) => {
+  assertValid(news, expect);
+  if (news.name !== output.name || unitPathFor(news) !== output.unitPath) {
+    assertMayWrite(runner, news.name);
+    return { action: "replace", deleteFirst: true };
+  }
+  const desired2 = digestOf2(unitText(news));
+  const update = async () => {
+    assertMayWrite(runner, news.name);
+    await runner.checkWrite?.(unitPathFor(news), UNIT_WRITE);
+    return { action: "update" };
+  };
+  if (desired2 !== output.unitSha256)
+    return update();
+  if (configDigest(news.restartOn) !== output.configSha256)
+    return update();
+  const live = await readUnit(runner, news);
+  if (live === undefined || live.unitSha256 !== desired2)
+    return update();
+  if (live.enabled !== (news.enabled !== false))
+    return update();
+  if (live.active !== (news.started !== false))
+    return update();
+  const status = await showUnit(runner, news.name);
+  return status.needDaemonReload ? update() : { action: "noop" };
+};
+var reconcileUnit = async (runner, props, output, adopt = false, expect) => {
+  assertValid(props, expect);
+  assertMayWrite(runner, props.name);
+  const path = unitPathFor(props);
+  const status = await showUnit(runner, props.name);
+  assertUsable(props, status);
+  const text = unitText(props);
+  const desired2 = digestOf2(text);
+  const before = await runner.readFile(path);
+  const liveSha = before === undefined ? undefined : digestOf2(decoder2.decode(before));
+  const moved = output !== undefined && (output.name !== props.name || output.unitPath !== path);
+  const prior = moved ? undefined : output;
+  if (prior === undefined && !(adopt && output === undefined) && liveSha !== undefined && liveSha !== desired2) {
+    throw refuse4(props.name, `${path} is already on this host and is not this resource. Remove it, or declare it as a ` + "new resource and deploy with --adopt.");
+  }
+  if (moved && output !== undefined)
+    await deleteUnit(runner, output);
+  const wrote = liveSha !== desired2;
+  const stale = prior !== undefined && prior.unitSha256 !== desired2;
+  const configChanged = prior !== undefined && prior.configSha256 !== configDigest(props.restartOn);
+  if (wrote)
+    await runner.writeFileAtomic(path, encoder2.encode(text), UNIT_WRITE);
+  if (wrote || status.needDaemonReload)
+    await daemonReload(runner);
+  const changed = wrote || stale || status.needDaemonReload;
+  return settle(runner, props, { before, changed, configChanged, desired: desired2, path, status });
+};
+var deleteUnit = async (runner, output) => {
+  assertMayWrite(runner, output.name);
+  const status = await showUnit(runner, output.name);
+  if (status.activeState === "active" || status.activeState === "activating") {
+    await stopUnit(runner, output.name);
+  }
+  if (status.unitFileState === "enabled" || status.unitFileState === "enabled-runtime") {
+    await disableUnit(runner, output.name);
+  }
+  const stat = await runner.stat(output.unitPath);
+  if (stat !== undefined) {
+    if (stat.kind !== "file")
+      throw refuse4(output.name, `${output.unitPath} is a ${stat.kind}`);
+    await runner.removeFile(output.unitPath);
+  }
+  await daemonReload(runner);
+};
+
+// src/linux/unit-handlers.ts
+var readHandler = (runner, olds, output) => lift(async () => {
+  const found = await readUnit(runner, olds);
+  if (found === undefined)
+    return;
+  return output === undefined ? Unowned4(found) : found;
+});
+var diffHandler = (runner, instanceId, news, output, expect) => {
+  if (output === undefined)
+    return noteUnfinished(instanceId);
+  if (isResolved3(news))
+    return lift(() => diffUnit(runner, news, output, expect));
+  const name = resolvedString(news, "name");
+  return Effect8.succeed(name !== undefined && name !== output.name ? { action: "replace", deleteFirst: true } : undefined);
+};
+var reconcileHandler = (runner, args, expect) => Effect8.flatMap(adoptsAtApply(args), (adopt) => lift(() => reconcileUnit(runner, args.news, args.output, adopt, expect)));
+var deleteHandler = (runner, output) => lift(() => deleteUnit(runner, output));
+
+// src/linux/unit.ts
+var SystemdUnit = Resource3("Systemd.Unit");
+var SystemdTimer = Resource3("Systemd.Timer");
+var SystemdUnitProvider = () => Provider3.effect(SystemdUnit, Effect9.gen(function* () {
+  const runner = yield* HostRunnerService;
+  return SystemdUnit.Provider.of({
+    list: () => Effect9.succeed([]),
+    read: ({ olds, output }) => readHandler(runner, olds, output),
+    diff: ({ instanceId, news, output }) => diffHandler(runner, instanceId, news, output),
+    reconcile: (args) => reconcileHandler(runner, args),
+    delete: ({ output }) => deleteHandler(runner, output)
+  });
+}));
+var SystemdTimerProvider = () => Provider3.effect(SystemdTimer, Effect9.gen(function* () {
+  const runner = yield* HostRunnerService;
+  return SystemdTimer.Provider.of({
+    list: () => Effect9.succeed([]),
+    read: ({ olds, output }) => readHandler(runner, olds, output),
+    diff: ({ instanceId, news, output }) => diffHandler(runner, instanceId, news, output, "timer"),
+    reconcile: (args) => reconcileHandler(runner, args, "timer"),
+    delete: ({ output }) => deleteHandler(runner, output)
+  });
+}));
+
+// src/linux/providers.ts
+var linuxProviders = (runner) => Layer2.mergeAll(HostDirectoryProvider(), RemoteFileProvider(), SystemdTimerProvider(), SystemdUnitProvider()).pipe(Layer2.provide(hostRunnerLayer(runner)));
+// src/linux/ssh-runner.ts
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+
+// src/launchd/host-lookup.ts
+var NUMERIC = /^\d+$/;
+var userQuery = (platform, nameOrId) => platform === "darwin" ? [
+  "/usr/bin/dscacheutil",
+  "-q",
+  "user",
+  "-a",
+  NUMERIC.test(nameOrId) ? "uid" : "name",
+  nameOrId
+] : ["getent", "passwd", nameOrId];
+var groupQuery = (platform, nameOrId) => platform === "darwin" ? [
+  "/usr/bin/dscacheutil",
+  "-q",
+  "group",
+  "-a",
+  NUMERIC.test(nameOrId) ? "gid" : "name",
+  nameOrId
+] : ["getent", "group", nameOrId];
+var firstRecord = (stdout) => {
+  const fields = new Map;
+  for (const line of stdout.split(`
+`)) {
+    if (line.trim() === "") {
+      if (fields.size > 0)
+        break;
+      continue;
+    }
+    const at = line.indexOf(": ");
+    if (at <= 0)
+      continue;
+    const key = line.slice(0, at);
+    if (key === "password")
+      continue;
+    fields.set(key, line.slice(at + 2).trim());
+  }
+  return fields;
+};
+var toId = (text) => text !== undefined && NUMERIC.test(text) ? Number(text) : undefined;
+var parseUser = (platform, stdout) => {
+  if (platform === "darwin") {
+    const record = firstRecord(stdout);
+    const uid2 = toId(record.get("uid"));
+    const gid2 = toId(record.get("gid"));
+    const home2 = record.get("dir");
+    return uid2 === undefined || gid2 === undefined || home2 === undefined ? undefined : { gid: gid2, home: home2, uid: uid2 };
+  }
+  const fields = (stdout.split(`
+`)[0] ?? "").split(":");
+  const uid = toId(fields[2]);
+  const gid = toId(fields[3]);
+  const home = fields[5];
+  return uid === undefined || gid === undefined || home === undefined || home === "" ? undefined : { gid, home, uid };
+};
+var parseGroup = (platform, stdout) => {
+  if (platform === "darwin")
+    return toId(firstRecord(stdout).get("gid"));
+  return toId((stdout.split(`
+`)[0] ?? "").split(":")[2]);
+};
+
+// src/linux/ssh-command.ts
+var ABSENT = 66;
+var shellQuote = (arg) => {
+  if (arg.includes("\x00"))
+    throw new Error("ssh: an argument contains NUL");
+  return `'${arg.replaceAll("'", `'\\''`)}'`;
+};
+var quoteArgv = (argv) => argv.map(shellQuote).join(" ");
+var marker = (nonce) => `__HF_RC_${nonce}=`;
+var frameScript = (script, nonce) => `(
+${script}
+)
+__hf=$?
+printf '\\n${marker(nonce)}%s\\n' "$__hf" >&2
+exit "$__hf"`;
+var parseFramed = (stderr, nonce) => {
+  const at = stderr.lastIndexOf(`
+${marker(nonce)}`);
+  if (at < 0)
+    return;
+  const digits = /^(\d+)\s*$/.exec(stderr.slice(at + marker(nonce).length + 1));
+  if (digits?.[1] === undefined)
+    return;
+  return { exitCode: Number(digits[1]), stderr: stderr.slice(0, at) };
+};
+var sshArgv = (host, script, options) => {
+  if (host === "" || host.startsWith("-")) {
+    throw new Error(`ssh: ${JSON.stringify(host)} is not a usable destination`);
+  }
+  return [
+    "ssh",
+    "-T",
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    `ConnectTimeout=${String(options.connectTimeoutSec)}`,
+    ...options.sshArgs ?? [],
+    host,
+    `/bin/sh -c ${shellQuote(script)}`
+  ];
+};
+
+// src/linux/ssh-scripts.ts
+var IF_PRESENT = (path) => `if [ -e ${path} ] || [ -L ${path} ]; then`;
+var statScript = (path) => {
+  const quoted = shellQuote(path);
+  return `${IF_PRESENT(quoted)} stat -c '%f %a %u %g %s' -- ${quoted}; else exit ${String(ABSENT)}; fi`;
+};
+var readScript = (path) => {
+  const quoted = shellQuote(path);
+  return `${IF_PRESENT(quoted)} base64 -- ${quoted}; else exit ${String(ABSENT)}; fi`;
+};
+var removeScript = (path) => `rm -f -- ${shellQuote(path)}`;
+var execScript = (argv) => quoteArgv(argv);
+var writeScript = (path, temp, options) => {
+  const target = shellQuote(path);
+  const staged = shellQuote(temp);
+  const bail = `{ rm -f -- ${staged}; exit`;
+  const owner = options.uid === undefined ? options.gid === undefined ? undefined : `:${String(options.gid)}` : options.gid === undefined ? String(options.uid) : `${String(options.uid)}:${String(options.gid)}`;
+  const chown = owner === undefined ? [] : [`chown ${owner} -- ${staged} || ${bail} 72; }`];
+  return [
+    "set -C",
+    "umask 077",
+    `cat > ${staged} || ${bail} 71; }`,
+    ...chown,
+    `chmod ${options.mode.toString(8).padStart(3, "0")} -- ${staged} || ${bail} 73; }`,
+    `mv -f -- ${staged} ${target} || ${bail} 74; }`
+  ].join(`
+`);
+};
+var TYPE_BITS = 61440;
+var KINDS = new Map([
+  [32768, "file"],
+  [16384, "directory"],
+  [40960, "symlink"]
+]);
+var parseStat = (stdout) => {
+  const fields = stdout.trim().split(/\s+/);
+  if (fields.length !== 5)
+    return;
+  const [rawMode, perms, uid, gid, size] = fields;
+  const raw = Number.parseInt(rawMode, 16);
+  const mode = Number.parseInt(perms, 8);
+  const numbers = [raw, mode, Number(uid), Number(gid), Number(size)];
+  if (numbers.some((value) => !Number.isSafeInteger(value) || value < 0))
+    return;
+  return {
+    gid: Number(gid),
+    kind: KINDS.get(raw & TYPE_BITS) ?? "other",
+    mode,
+    size: Number(size),
+    uid: Number(uid)
+  };
+};
+
+// src/linux/ssh-runner.ts
+var spawnSsh = (argv, timeoutMs, stdin) => new Promise((resolve, reject) => {
+  const [program, ...args] = argv;
+  const child = spawn(program, args, {
+    shell: false,
+    stdio: [stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+    timeout: timeoutMs
+  });
+  const out = [];
+  const err = [];
+  child.stdout?.on("data", (chunk) => out.push(chunk));
+  child.stderr?.on("data", (chunk) => err.push(chunk));
+  child.on("error", (cause) => {
+    reject(new Error(`ssh: ${cause.message}`));
+  });
+  if (stdin !== undefined && child.stdin !== null) {
+    child.stdin.on("error", () => {
+      return;
+    });
+    child.stdin.end(stdin);
+  }
+  child.on("close", (exitCode, signal) => {
+    resolve({
+      exitCode: exitCode ?? -1,
+      signal,
+      stderr: Buffer.concat(err).toString("utf8"),
+      stdout: Buffer.concat(out).toString("utf8")
+    });
+  });
+});
+var runRemote = async (options, nonce, script, stdin) => {
+  const argv = sshArgv(options.host, frameScript(script, nonce), {
+    connectTimeoutSec: options.connectTimeoutSec,
+    ...options.sshArgs === undefined ? {} : { sshArgs: options.sshArgs }
+  });
+  const raw = await spawnSsh(argv, options.execTimeoutMs, stdin);
+  const framed = parseFramed(raw.stderr, nonce);
+  if (framed === undefined) {
+    throw new Error(`ssh ${options.host}: the remote command did not report a status (ssh exit ` + `${String(raw.exitCode)}${raw.signal === null ? "" : `, killed by ${raw.signal}`}): ` + `${raw.stderr.trim().slice(0, 300)}`);
+  }
+  return { exitCode: framed.exitCode, stderr: framed.stderr, stdout: raw.stdout };
+};
+var decodeBase64 = (text) => new Uint8Array(Buffer.from(text.replaceAll(`
+`, ""), "base64"));
+var failed = (host, what, result) => new Error(`ssh ${host}: ${what} -> ${String(result.exitCode)}: ${result.stderr.trim().slice(0, 300)}`);
+var sshRunner = async (options) => {
+  const settings = {
+    connectTimeoutSec: options.connectTimeoutSec ?? 10,
+    execTimeoutMs: options.execTimeoutMs ?? 120000,
+    host: options.host,
+    ...options.sshArgs === undefined ? {} : { sshArgs: options.sshArgs }
+  };
+  const nonce = randomBytes(8).toString("hex");
+  const run2 = (script, stdin) => runRemote(settings, nonce, script, stdin);
+  const probe = await run2("uname -s; id -u");
+  if (probe.exitCode !== 0)
+    throw failed(options.host, "uname -s; id -u", probe);
+  const [system, uid] = probe.stdout.trim().split(`
+`);
+  if (system !== "Linux" || uid === undefined || !/^\d+$/.test(uid)) {
+    throw new Error(`ssh ${options.host}: expected a Linux host, got ${JSON.stringify(probe.stdout.trim())}. ` + "sshRunner() sends GNU/BusyBox argv (stat -c, base64, mv -f); for a Mac use localRunner().");
+  }
+  const euid = Number(uid);
+  return {
+    effectiveUid: () => euid,
+    exec: (argv) => run2(execScript(argv)),
+    lookupGroup: async (nameOrId) => {
+      const result = await run2(execScript(groupQuery("linux", nameOrId)));
+      return result.exitCode === 0 ? parseGroup("linux", result.stdout) : undefined;
+    },
+    lookupUser: async (nameOrId) => {
+      const result = await run2(execScript(userQuery("linux", nameOrId)));
+      return result.exitCode === 0 ? parseUser("linux", result.stdout) : undefined;
+    },
+    privileged: false,
+    readFile: async (path) => {
+      const result = await run2(readScript(path));
+      if (result.exitCode === ABSENT)
+        return;
+      if (result.exitCode !== 0)
+        throw failed(options.host, `read ${path}`, result);
+      return decodeBase64(result.stdout);
+    },
+    removeFile: async (path) => {
+      const result = await run2(removeScript(path));
+      if (result.exitCode !== 0)
+        throw failed(options.host, `remove ${path}`, result);
+    },
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    stat: async (path) => {
+      const result = await run2(statScript(path));
+      if (result.exitCode === ABSENT)
+        return;
+      if (result.exitCode !== 0)
+        throw failed(options.host, `stat ${path}`, result);
+      const parsed = parseStat(result.stdout);
+      if (parsed === undefined) {
+        throw new Error(`ssh ${options.host}: stat ${path} printed an unexpected shape`);
+      }
+      return parsed;
+    },
+    writeFileAtomic: async (path, bytes, write) => {
+      const at = path.lastIndexOf("/");
+      const temp = `${path.slice(0, at)}/.${path.slice(at + 1)}.${randomBytes(6).toString("hex")}.tmp`;
+      const result = await run2(writeScript(path, temp, write), bytes);
+      if (result.exitCode !== 0)
+        throw failed(options.host, `write ${path}`, result);
+    }
+  };
+};
+export {
+  DEFAULT_UNIT_DIRECTORY,
+  HostDirectory,
+  HostDirectoryProvider,
+  HostRunnerService,
+  RemoteFile,
+  RemoteFileProvider,
+  SystemdTimer,
+  SystemdTimerProvider,
+  SystemdUnit,
+  SystemdUnitProvider,
+  canActAsRoot,
+  hostRunnerLayer,
+  linuxProviders,
+  renderUnit,
+  sshRunner
+};
+
+//# debugId=36C2172DF713B75564756E2164756E21
+//# sourceMappingURL=index.js.map