@homeflare/alchemy 0.19.1 → 0.21.0

package/dist/launchd/local-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/local-runner.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAwB,UAAU,EAAgB,MAAM,aAAa,CAAC;AAElF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,MAAM,GAAG,SAGrC,CAAC;AAqEhB,eAAO,MAAM,WAAW,aAAa,kBAAkB,KAAQ,UAgD9D,CAAC"}
+{"version":3,"file":"local-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/local-runner.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAwB,UAAU,EAAgB,MAAM,aAAa,CAAC;AAElF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,MAAM,GAAG,SAGrC,CAAC;AAqEhB,eAAO,MAAM,WAAW,aAAa,kBAAkB,KAAQ,UAkD9D,CAAC"}

package/dist/launchd/runner.d.ts

@@ -31,9 +31,22 @@ export type FileStat = {
     readonly uid: number;
     readonly gid: number;
     readonly size: number;
+    /**
+     * The entry's identity, device and inode, when the runner can say. ★ Two spellings of ONE file
+     *   (`/tmp/x` and `/private/tmp/x`; `Bin` and `bin` on case-insensitive APFS) differ as strings
+     *   and match here, and a move must not delete its old path when that path IS the new file
+     *   (file-identity.ts). Optional: a runner that leaves them out gets a check after the fact.
+     */
+    readonly dev?: number;
+    readonly ino?: number;
 };
 export type WriteOptions = {
-    /** Permission bits for the final file, applied BEFORE it becomes visible at `path`. */
+    /**
+     * Permission bits for the final file. localRunner applies them BEFORE the file is visible at
+     * `path`. ⚠️ sudoRunner's `install -S` does NOT: MEASURED 2026-09-22 on macOS 27.2 (an lstat
+     *   poller racing /usr/bin/install), the new inode appears at `path` as 0600 and is chmodded
+     *   0.2–0.4 ms later. Never torn, never wider than declared, but briefly not executable.
+     */
     readonly mode: number;
     /** Numeric owner; omitted means whoever the runner writes as. */
     readonly uid?: number;
@@ -68,7 +81,9 @@ export interface HostRunner {
     stat(path: string): Promise<FileStat | undefined>;
     /**
      * Write `bytes` so that `path` holds either the old file or the new one, never a torn mix:
-     * a temporary file in the same directory, mode and owner set on it, then rename(2) over `path`.
+     * a temporary file in the same directory, mode and owner set on it, then rename(2) over `path`
+     * (sudoRunner: the mode just after the rename, measured — see WriteOptions.mode; the owner too,
+     * ⚠️ REASONED NOT MEASURED, since measuring it needs root).
      * ⚠️ The parent directory must exist; creating it would invent an owner and mode nobody declared.
      */
     writeFileAtomic(path: string, bytes: Uint8Array, options: WriteOptions): Promise<void>;

package/dist/launchd/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/launchd/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,sGAAsG;AACtG,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1D,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,YAAY,IAAI,MAAM,CAAC;IACvB,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACxD,uDAAuD;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAClD;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF;;;;;OAKG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,+DAA+D;IAC/D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,2EAA2E;IAC3E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC5D,kFAAkF;IAClF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3D,gFAAgF;IAChF,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;;AAED,uEAAuE;AACvE,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,eAAe,WAAY,UAAU,KAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;AAE3C,oFAAoF;AACpF,eAAO,MAAM,YAAY,WAAY,UAAU,KAAG,OACA,CAAC"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/launchd/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,sGAAsG;AACtG,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1D,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,YAAY,IAAI,MAAM,CAAC;IACvB,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACxD,uDAAuD;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAClD;;;;;;OAMG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF;;;;;OAKG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,+DAA+D;IAC/D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,2EAA2E;IAC3E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC5D,kFAAkF;IAClF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3D,gFAAgF;IAChF,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;;AAED,uEAAuE;AACvE,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,eAAe,WAAY,UAAU,KAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;AAE3C,oFAAoF;AACpF,eAAO,MAAM,YAAY,WAAY,UAAU,KAAG,OACA,CAAC"}

package/dist/launchd/sudo-runner.d.ts

@@ -21,6 +21,17 @@
  * ★ `install -S`: install(1) on macOS 27.2 (read 2026-09-21) always writes a temp file in the
  *   target directory and renames it, so the file is never torn, and -S adds the fsync that
  *   localRunner's `handle.sync()` does.
+ * ⚠️ BUT IT CHMODS AFTER THE RENAME. MEASURED 2026-09-22 (an lstat poller racing
+ *   `/usr/bin/install -S -m 0755`, 300 MB, six runs, target absent and present): the new inode
+ *   is visible at the path as 0600, then 0755 0.2–0.4 ms later. Only ever narrower than declared.
+ *   ⚠️ REASONED NOT MEASURED: a launchd start inside that window gets EACCES and retries after its
+ *   throttle, and an install killed inside it leaves a root-owned 0600 file the operator cannot
+ *   read back. Closing it needs a second privileged step (install to a temp name, then rename),
+ *   which is a change to this allowlist and wants its own red team.
+ * ⚠️ AND IT COPIES XATTRS, com.apple.quarantine included (MEASURED 2026-09-22: a quarantined
+ *   source installed as a quarantined target). The staged file is written by this process, and
+ *   node:fs writes here carried only com.apple.provenance (measured the same day) — so nothing
+ *   is quarantined today, but a quarantined staging file would be installed quarantined.
  * ⚠️ REASONED, NOT MEASURED: sudo's failure text (sudo-said.ts has the strings and their sources).
  * ⛔ EVERY CHECK BEFORE SUDO ALSO RUNS AT PLAN TIME (`checkWrite`, 2026-09-21): the mode, the
  *   directories from the prefix down, the read-back. Reads only, as the operator — never sudo.

package/dist/launchd/sudo-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sudo-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,KAAK,kBAAkB,EAAe,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAc,UAAU,EAAgB,MAAM,aAAa,CAAC;AACxE,OAAO,EAIL,gBAAgB,EAMjB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG;IACnD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,uFAAuF;IACvF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,QAAQ,GAAG;IACrB,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,CAAC;AAEF,eAAO,MAAM,cAAc,eAAgB,SAAS,MAAM,EAAE,QAAQ,QAAQ,KAAG,UAgI9E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,YAAa,iBAAiB,KAAG,UAYvD,CAAC"}
+{"version":3,"file":"sudo-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,KAAK,kBAAkB,EAAe,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAc,UAAU,EAAgB,MAAM,aAAa,CAAC;AACxE,OAAO,EAIL,gBAAgB,EAMjB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG;IACnD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,uFAAuF;IACvF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,QAAQ,GAAG;IACrB,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,CAAC;AAEF,eAAO,MAAM,cAAc,eAAgB,SAAS,MAAM,EAAE,QAAQ,QAAQ,KAAG,UAgI9E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,YAAa,iBAAiB,KAAG,UAYvD,CAAC"}

package/dist/linux/index.js

@@ -624,6 +624,7 @@ var tokens = (spec) => {
     end: `${comment} END ${spec.name}`
   };
 };
+var sameRegion = (a, b) => a === undefined || b === undefined ? a === undefined && b === undefined : a.name === b.name && (a.comment ?? DEFAULT_COMMENT) === (b.comment ?? DEFAULT_COMMENT);
 var regionProblems = (spec) => {
   const found = [];
   const comment = spec.comment ?? DEFAULT_COMMENT;
@@ -748,6 +749,16 @@ var identity = async (runner, props) => {
   return { ...uid === undefined ? {} : { uid }, ...gid === undefined ? {} : { gid } };
 };
 var digestOf = (text) => sha256Hex(encoder.encode(text));
+var relocation = (props, output) => {
+  if (props.path !== output.path)
+    return "path";
+  if (sameRegion(props.region, output.region))
+    return "none";
+  if (props.region === undefined || output.region === undefined) {
+    throw refuse3(props.path, `changes between owning the whole file and owning the managed region ` + `${JSON.stringify((props.region ?? output.region)?.name ?? "")} at the same path. Those ` + "are two different claims on one file: destroy this resource and declare a new one.");
+  }
+  return "region";
+};
 var ownedDigest = (file, region) => {
   if (file === undefined)
     return;
@@ -814,7 +825,7 @@ var planWrite = async (runner, props, want) => {
 // src/linux/remote-file-lifecycle.ts
 var diffFile = async (runner, news, output) => {
   const want = await identity(runner, news);
-  if (news.path !== output.path) {
+  if (relocation(news, output) === "path") {
     await runner.checkWrite?.(news.path, { mode: news.mode ?? DEFAULT_MODE2, ...want });
     return { action: "replace" };
   }
@@ -830,8 +841,8 @@ var reconcileFile = async (runner, props, output, adopt = false) => {
   if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {
     throw refuse3(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy through ` + "a root destination or a privileged HostRunner. This provider never calls sudo itself.");
   }
-  const moved = output !== undefined && output.path !== props.path;
-  const prior = moved ? undefined : output;
+  const move = output === undefined ? "none" : relocation(props, output);
+  const prior = move === "none" ? output : undefined;
   const planned = await planWrite(runner, props, want);
   const live = ownedDigest(planned.before, props.region);
   const declared = digestOf(props.content);
@@ -849,9 +860,16 @@ var reconcileFile = async (runner, props, output, adopt = false) => {
     }
     throw refuse3(props.path, "the write returned but the file on disk does not match the declaration");
   }
-  if (moved && output !== undefined)
-    await deleteFile(runner, output);
-  return after;
+  if (move === "none" || output === undefined)
+    return after;
+  await deleteFile(runner, output);
+  if (move === "path")
+    return after;
+  const settled = await readFileAttributes(runner, props.path, props.region);
+  if (settled === undefined || settled.contentSha256 !== declared) {
+    throw refuse3(props.path, "removing the previous managed block did not leave ours intact");
+  }
+  return settled;
 };
 var deleteFile = async (runner, output) => {
   const stat = await runner.stat(output.path);
@@ -1148,11 +1166,14 @@ var assertUnclaimed = async (runner, props) => {
     throw refuse4(props.name, `${path} is already on this host and is not this resource. Remove it, or declare it as a ` + "new resource and deploy with --adopt.");
   }
 };
+var assertRenameTarget = async (runner, old, name) => {
+  assertMayWrite(runner, old.name);
+  assertMayWrite(runner, name);
+  assertUsable({ name }, await showUnit(runner, name));
+};
 var assertReplaceable = async (runner, next, old, expect) => {
   assertValid(next, expect);
-  assertMayWrite(runner, old.name);
-  assertMayWrite(runner, next.name);
-  assertUsable(next, await showUnit(runner, next.name));
+  await assertRenameTarget(runner, old, next.name);
   await assertUnclaimed(runner, next);
   await runner.checkWrite?.(unitPathFor(next), UNIT_WRITE);
 };
@@ -1253,7 +1274,12 @@ var diffHandler = (runner, instanceId, news, output, expect) => {
   if (isResolved3(news))
     return lift(() => diffUnit(runner, news, output, expect));
   const name = resolvedString(news, "name");
-  return Effect8.succeed(name !== undefined && name !== output.name ? { action: "replace", deleteFirst: true } : undefined);
+  if (name === undefined || name === output.name)
+    return Effect8.succeed(undefined);
+  return lift(async () => {
+    await assertRenameTarget(runner, output, name);
+    return { action: "replace", deleteFirst: true };
+  });
 };
 var reconcileHandler = (runner, args, expect) => Effect8.flatMap(adoptsAtApply(args), (adopt) => lift(() => reconcileUnit(runner, args.news, args.output, adopt, expect)));
 var deleteHandler = (runner, output) => lift(() => deleteUnit(runner, output));
@@ -1571,5 +1597,5 @@ export {
   sshRunner
 };
 
-//# debugId=6BC8BE5DBFF285E364756E2164756E21
+//# debugId=999A0F25FFF74BEF64756E2164756E21
 //# sourceMappingURL=index.js.map