@homeflare/alchemy 0.20.0 → 0.21.0

package/README.md

@@ -164,6 +164,31 @@ SystemdUnit('thing', { name: 'thing.service', sections: [...], restartOn: [confi
 - ⛔ **The directive set is systemd's:** unit files render verbatim; nothing here invents a schema.
 - Guide, the measured `systemctl` shapes and the limits: [docs/linux-host.md](./docs/linux-host.md).
 
+## Release binaries — `@homeflare/alchemy/release`
+
+`ReleaseBinary` installs one binary out of a pinned release archive into a directory you declare,
+verified twice. The pins are props; each vendor's pinned versions are a data set beside it
+(`VICTORIA_RELEASES` is the first). `releaseProviders(runner)` provides it.
+
+```ts
+const request = {
+  package: 'vmutils',
+  version: '1.151.0',
+  platform: 'darwin-arm64',
+  binary: 'vmalert',
+};
+ReleaseBinary('vmalert', { ...catalogBinary(VICTORIA_RELEASES, request), directory: dir.path });
+```
+
+- ⛔ **It installs; it never starts.** Put `binary.path` in your job's argv; that orders the two.
+- ⛔ **Pinned in code, never fetched:** a version the data set does not pin fails the plan. Exact
+  asset names, the archive verified before unpacking and the binary before writing, only the
+  declared member extracted, one writer (`HostRunner.writeFileAtomic`).
+- Guide: [docs/release-binary.md](./docs/release-binary.md) · data sets and adding a vendor:
+  [docs/release-binary-catalogs.md](./docs/release-binary-catalogs.md) · measured:
+  [docs/release-binary-measured.md](./docs/release-binary-measured.md) · upstream:
+  [docs/release-binary-upstream.md](./docs/release-binary-upstream.md).
+
 ## Caddy — `@homeflare/alchemy/caddy`
 
 `CaddyConfig` declares a running Caddy's config as Caddyfile text, applied through Caddy's own admin

package/dist/caddy/access-forward-auth.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The Caddyfile half of "protect this route with Cloudflare Access": a `forward_auth` block
+ * pointing at a verifier that speaks the contract in `@homeflare/cloudflare/access-auth`.
+ *
+ * ★ A BUILDER, NOT A RESOURCE. Nothing here is created, adopted or destroyed — it is Caddyfile
+ *   TEXT that a caller drops into the `caddyfile` prop of a `CaddyConfig` / `caddyWithFile()`.
+ *   A resource would own a fragment of a config that `CaddyConfig` already owns whole, and two
+ *   owners of one file is the drift this package exists to prevent.
+ *
+ * ⛔ WHY IT IS GENERATED RATHER THAN COPY-PASTED. Every field below is load-bearing, and the
+ *   failure mode of getting one wrong is a route that looks protected and is not:
+ *   · a missing `copy_headers` — the upstream gets no identity and either breaks or, worse,
+ *     falls back to trusting a header the CLIENT set;
+ *   · the verifier on anything but loopback — the JWT check becomes advisory, because the
+ *     verifier itself can be reached and answered around;
+ *   · `uri` pointing at a path the verifier does not route — every request 404s, which is
+ *     non-2xx, which Caddy correctly treats as a denial, so the symptom is "Access is broken".
+ */
+export interface AccessForwardAuthProps {
+    /**
+     * Where the verifier listens, e.g. `127.0.0.1:9101`.
+     * ⛔ LOOPBACK OR A UNIX SOCKET. See `verifierProblems` — a routable verifier is not a check.
+     */
+    readonly verifier: string;
+    /** The path the verifier answers on. @default '/access/verify' */
+    readonly uri?: string;
+    /**
+     * Response headers copied from the verifier onto the upstream request.
+     * @default ['X-Access-Email', 'X-Access-Sub']
+     */
+    readonly copyHeaders?: readonly string[];
+    /** Lines placed inside the route BEFORE `forward_auth` — typically the upstream. */
+    readonly body?: readonly string[];
+    /** Indent applied to every emitted line. @default '\t' */
+    readonly indent?: string;
+}
+export declare const verifierProblems: (verifier: string) => string[];
+/**
+ * Render the `forward_auth` block for one protected route.
+ *
+ * ```ts
+ * const caddyfile = `vnc.example.com {
+ * ${accessForwardAuth({ verifier: '127.0.0.1:9101', body: ['reverse_proxy 127.0.0.1:6080'] })}
+ * }
+ * `;
+ * ```
+ *
+ * ⛔ ONE VERIFIER ENDPOINT PER ACCESS APPLICATION. The AUD is fixed in the verifier's own config,
+ *   never carried in this request — so two applications mean two `uri`s (or two verifiers), not
+ *   one endpoint told which app to check. An AUD the request can influence is the vulnerability.
+ *
+ * ⚠️ `forward_auth` COPIES THE VERIFIER'S RESPONSE BACK TO THE CLIENT on any non-2xx, which is why
+ *   the verifier answers a bare 401 with no body: whatever it returns is what the browser sees.
+ */
+export declare const accessForwardAuth: (props: AccessForwardAuthProps) => string;
+//# sourceMappingURL=access-forward-auth.d.ts.map

package/dist/caddy/access-forward-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-forward-auth.d.ts","sourceRoot":"","sources":["../../src/caddy/access-forward-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA6BD,eAAO,MAAM,gBAAgB,aAAc,MAAM,KAAG,MAAM,EAWzD,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,UAAW,sBAAsB,KAAG,MAqBjE,CAAC"}

package/dist/caddy/index.d.ts

@@ -9,6 +9,12 @@
  * ⛔ NOTHING IS ADOPTED SILENTLY: a running config that is not the declared one needs `--adopt`.
  * Guide, order of file and load, adoption, `--resume` and secrets: docs/caddy.md.
  */
+/**
+ * ★ `accessForwardAuth` is Caddyfile TEXT, not a resource: it renders the `forward_auth` block
+ *   that puts a Cloudflare Access check in front of a route, paired with the verifier in
+ *   `@homeflare/cloudflare/access-auth`. Guide: docs/access-auth.md.
+ */
+export { accessForwardAuth, verifierProblems, type AccessForwardAuthProps, } from './access-forward-auth.ts';
 export type { CaddyAdmin, CaddyAdminListener, CaddyAdminRequest, CaddyAdminResponse, } from './admin.ts';
 export { CaddyAdminService, CaddyUnreachableError, caddyAdminLayer } from './admin.ts';
 export { CaddyAdminError } from './admin-calls.ts';

package/dist/caddy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/caddy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/caddy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,sBAAsB,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/caddy/index.js

@@ -1,3 +1,44 @@
+// src/caddy/access-forward-auth.ts
+var DEFAULT_COPY_HEADERS = ["X-Access-Email", "X-Access-Sub"];
+var LOOPBACK = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+var hostOf = (verifier) => {
+  const address = verifier.replace(/^https?:\/\//, "");
+  if (address.startsWith("unix/"))
+    return "unix";
+  if (address.startsWith("["))
+    return address.slice(0, address.indexOf("]") + 1);
+  const colon = address.indexOf(":");
+  return colon === -1 ? address : address.slice(0, colon);
+};
+var verifierProblems = (verifier) => {
+  const found = [];
+  const host = hostOf(verifier.trim());
+  if (verifier.trim() === "")
+    found.push("verifier is empty");
+  else if (host !== "unix" && !LOOPBACK.has(host)) {
+    found.push(`verifier must be loopback or a unix socket, got ${verifier} — a routable verifier can be bypassed`);
+  }
+  return found;
+};
+var accessForwardAuth = (props) => {
+  const problems = verifierProblems(props.verifier);
+  if (problems.length > 0)
+    throw new Error(`accessForwardAuth: ${problems.join("; ")}`);
+  const indent = props.indent ?? "\t";
+  const uri = props.uri ?? "/access/verify";
+  const headers = props.copyHeaders ?? DEFAULT_COPY_HEADERS;
+  const lines = [
+    ...props.body ?? [],
+    `forward_auth ${props.verifier} {`,
+    `${indent}uri ${uri}`,
+    `${indent}copy_headers {`,
+    ...headers.map((header) => `${indent}${indent}${header}`),
+    `${indent}}`,
+    "}"
+  ];
+  return lines.map((line) => `${indent}${line}`).join(`
+`);
+};
 // src/caddy/admin.ts
 import * as Context from "effect/Context";
 import * as Layer from "effect/Layer";
@@ -938,36 +979,29 @@ import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
 import * as Effect7 from "effect/Effect";
 
-// src/launchd/host-file-form.ts
-var DEFAULT_MODE = 420;
-var identityProblems = (name, value) => {
-  if (value === undefined)
-    return [];
-  if (typeof value === "number") {
-    return Number.isSafeInteger(value) && value >= 0 ? [] : [`${name} must be a non-negative integer id`];
+// src/launchd/file-identity.ts
+var sameEntry = (a, b) => {
+  if (a === undefined || b === undefined)
+    return false;
+  if (a.dev === undefined || a.ino === undefined || b.dev === undefined || b.ino === undefined) {
+    return;
   }
-  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
+  return a.dev === b.dev && a.ino === b.ino;
 };
-var pathProblems = (path) => {
-  const found = [];
-  if (!path.startsWith("/"))
-    found.push("path must be absolute");
-  if (path.endsWith("/") || path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..")) {
-    found.push('path must be normalised (no trailing slash, no empty, "." or ".." segments)');
-  }
-  if (path.includes("\x00"))
-    found.push("path contains NUL");
-  return found;
+var oneFile = async (runner, a, b) => {
+  if (a === b)
+    return true;
+  const [left, right] = await Promise.all([runner.stat(a), runner.stat(b)]);
+  return sameEntry(left, right);
 };
-var fileProblems = (props) => {
-  const found = pathProblems(props.path);
-  const mode = props.mode ?? DEFAULT_MODE;
-  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
-    found.push("mode must be 0–0o7777");
-  found.push(...identityProblems("owner", props.owner));
-  found.push(...identityProblems("group", props.group));
-  found.push(...fileSecretProblems(props.content));
-  return found;
+var leaveOldPath = async (runner, oldPath, path, remove, refuse3) => {
+  const same = await oneFile(runner, oldPath, path);
+  if (same === true)
+    return;
+  await remove();
+  if (same === undefined && await runner.stat(path) === undefined) {
+    throw refuse3(path, `removing the old path ${oldPath} removed this file too: they are one file under two ` + "spellings (a symlinked parent, or case on a case-insensitive volume). Deploy again to " + "reinstall it, and keep one spelling.");
+  }
 };
 
 // src/launchd/runner.ts
@@ -979,33 +1013,22 @@ class HostRunnerService extends Context2.Service()("homeflare/launchd/HostRunner
 var hostRunnerLayer = (runner) => Layer3.succeed(HostRunnerService, runner);
 var canActAsRoot = (runner) => runner.privileged || runner.effectiveUid() === 0;
 
-// src/launchd/host-file-lifecycle.ts
-var refuse3 = (path, message) => new Error(`Host.File ${path}: ${message}`);
+// src/launchd/file-converge.ts
 var numericId = (value) => typeof value === "number" ? value : /^\d+$/.test(value) ? Number(value) : undefined;
-var desiredFile = async (runner, props) => {
-  const found = fileProblems(props);
-  if (found.length > 0)
-    throw refuse3(props.path, found.join("; "));
-  const bytes = new TextEncoder().encode(props.content);
+var resolveIds = async (runner, declared, path, refuse3) => {
   let uid;
   let gid;
-  if (props.owner !== undefined) {
-    uid = numericId(props.owner) ?? (await runner.lookupUser(String(props.owner)))?.uid;
+  if (declared.owner !== undefined) {
+    uid = numericId(declared.owner) ?? (await runner.lookupUser(String(declared.owner)))?.uid;
     if (uid === undefined)
-      throw refuse3(props.path, `no user ${String(props.owner)} on this host`);
+      throw refuse3(path, `no user ${String(declared.owner)} on this host`);
   }
-  if (props.group !== undefined) {
-    gid = numericId(props.group) ?? await runner.lookupGroup(String(props.group));
+  if (declared.group !== undefined) {
+    gid = numericId(declared.group) ?? await runner.lookupGroup(String(declared.group));
     if (gid === undefined)
-      throw refuse3(props.path, `no group ${String(props.group)} on this host`);
+      throw refuse3(path, `no group ${String(declared.group)} on this host`);
   }
-  return {
-    bytes,
-    mode: props.mode ?? DEFAULT_MODE,
-    sha256: sha256Hex(bytes),
-    ...uid === undefined ? {} : { uid },
-    ...gid === undefined ? {} : { gid }
-  };
+  return { ...uid === undefined ? {} : { uid }, ...gid === undefined ? {} : { gid } };
 };
 var readFileAttributes = async (runner, path) => {
   const stat = await runner.stat(path);
@@ -1026,52 +1049,64 @@ var writeOptionsOf = (want) => ({
   ...want.uid === undefined ? {} : { uid: want.uid },
   ...want.gid === undefined ? {} : { gid: want.gid }
 });
-var matches = (live, want) => live.sha256 === want.sha256 && live.mode === want.mode && (want.uid === undefined || live.uid === want.uid) && (want.gid === undefined || live.gid === want.gid);
-var diffFile = async (runner, news, output) => {
-  const want = await desiredFile(runner, news);
+var fileMatches = (live, want) => live.sha256 === want.sha256 && live.mode === want.mode && (want.uid === undefined || live.uid === want.uid) && (want.gid === undefined || live.gid === want.gid);
+var diffTarget = async (runner, want, output) => {
   const writes = async (diff) => {
-    await runner.checkWrite?.(news.path, writeOptionsOf(want));
+    await runner.checkWrite?.(want.path, writeOptionsOf(want));
     return diff;
   };
-  if (news.path !== output.path)
-    return writes({ action: "replace" });
+  if (want.path !== output.path) {
+    const same = await oneFile(runner, want.path, output.path);
+    return writes({ action: same === true ? "update" : "replace" });
+  }
   if (want.sha256 !== output.sha256)
     return writes({ action: "update" });
-  const live = await readFileAttributes(runner, news.path);
-  return live !== undefined && matches(live, want) ? { action: "noop" } : writes({ action: "update" });
+  const live = await readFileAttributes(runner, want.path);
+  return live !== undefined && fileMatches(live, want) ? { action: "noop" } : writes({ action: "update" });
 };
-var reconcileFile = async (runner, props, output, adopt = false) => {
-  const want = await desiredFile(runner, props);
+var convergeFile = async (runner, spec, output, adopt = false) => {
+  const { want, refuse: refuse3 } = spec;
+  const path = want.path;
   if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {
-    throw refuse3(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy as root ` + "or through a privileged HostRunner (sudoRunner() with this path under a prefix). This " + "provider never calls sudo itself.");
+    throw refuse3(path, `owner ${String(spec.owner)} is not the deploying user; only root may chown. Deploy as root ` + "or through a privileged HostRunner (sudoRunner() with this path under a prefix). This " + "provider never calls sudo itself.");
   }
-  const stat = await runner.stat(props.path);
+  const stat = await runner.stat(path);
   if (stat !== undefined && stat.kind !== "file") {
-    throw refuse3(props.path, `is a ${stat.kind}; remove it from whatever owns it before declaring it here`);
+    throw refuse3(path, `is a ${stat.kind}; remove it from whatever owns it before declaring it here`);
   }
-  const before = stat === undefined ? undefined : await readFileAttributes(runner, props.path);
-  const moved = output !== undefined && output.path !== props.path;
+  const before = stat === undefined ? undefined : await readFileAttributes(runner, path);
+  const moved = output !== undefined && output.path !== path;
   const prior = moved ? undefined : output;
   const takeOver = adopt && output === undefined;
-  if (prior === undefined && before !== undefined && !matches(before, want) && !takeOver) {
-    throw refuse3(props.path, "already exists and is not this resource. Remove it, or declare it as a new resource and " + "deploy with --adopt.");
+  if (prior === undefined && before !== undefined && !fileMatches(before, want) && !takeOver) {
+    throw refuse3(path, "already exists and is not this resource. Remove it, or declare it as a new resource and " + "deploy with --adopt.");
   }
-  if (before === undefined || !matches(before, want)) {
-    await runner.writeFileAtomic(props.path, want.bytes, writeOptionsOf(want));
+  if (before === undefined || !fileMatches(before, want)) {
+    const bytes = await spec.bytesFor(before);
+    if (sha256Hex(bytes) !== want.sha256) {
+      throw refuse3(path, `the bytes to write do not hash to ${want.sha256}. Nothing was written.`);
+    }
+    await runner.writeFileAtomic(path, bytes, writeOptionsOf(want));
   }
-  const after = await readFileAttributes(runner, props.path);
-  if (after === undefined || !matches(after, want)) {
+  const rollBack = async () => {
     if (before === undefined)
-      await runner.removeFile(props.path).catch(() => {
+      await runner.removeFile(path).catch(() => {
         return;
       });
-    throw refuse3(props.path, "the write returned but the file on disk does not match the declaration");
+  };
+  const after = await readFileAttributes(runner, path).catch(async (cause) => {
+    await rollBack();
+    throw refuse3(path, `the write returned but reading it back failed: ${String(cause)}`);
+  });
+  if (after === undefined || !fileMatches(after, want)) {
+    await rollBack();
+    throw refuse3(path, "the write returned but the file on disk does not match the declaration");
   }
   if (moved)
-    await deleteFile(runner, output);
+    await leaveOldPath(runner, output.path, path, () => removeWholeFile(runner, output, refuse3), refuse3);
   return after;
 };
-var deleteFile = async (runner, output) => {
+var removeWholeFile = async (runner, output, refuse3) => {
   const stat = await runner.stat(output.path);
   if (stat === undefined)
     return;
@@ -1080,6 +1115,61 @@ var deleteFile = async (runner, output) => {
   await runner.removeFile(output.path);
 };
 
+// src/launchd/host-file-form.ts
+var DEFAULT_MODE = 420;
+var identityProblems = (name, value) => {
+  if (value === undefined)
+    return [];
+  if (typeof value === "number") {
+    return Number.isSafeInteger(value) && value >= 0 ? [] : [`${name} must be a non-negative integer id`];
+  }
+  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
+};
+var pathProblems = (path) => {
+  const found = [];
+  if (!path.startsWith("/"))
+    found.push("path must be absolute");
+  if (path.endsWith("/") || path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..")) {
+    found.push('path must be normalised (no trailing slash, no empty, "." or ".." segments)');
+  }
+  if (path.includes("\x00"))
+    found.push("path contains NUL");
+  return found;
+};
+var fileProblems = (props) => {
+  const found = pathProblems(props.path);
+  const mode = props.mode ?? DEFAULT_MODE;
+  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
+    found.push("mode must be 0–0o7777");
+  found.push(...identityProblems("owner", props.owner));
+  found.push(...identityProblems("group", props.group));
+  found.push(...fileSecretProblems(props.content));
+  return found;
+};
+
+// src/launchd/host-file-lifecycle.ts
+var refuse3 = (path, message) => new Error(`Host.File ${path}: ${message}`);
+var desiredFile = async (runner, props) => {
+  const found = fileProblems(props);
+  if (found.length > 0)
+    throw refuse3(props.path, found.join("; "));
+  const bytes = new TextEncoder().encode(props.content);
+  return {
+    bytes,
+    mode: props.mode ?? DEFAULT_MODE,
+    path: props.path,
+    sha256: sha256Hex(bytes),
+    ...await resolveIds(runner, props, props.path, refuse3)
+  };
+};
+var diffFile = async (runner, news, output) => diffTarget(runner, await desiredFile(runner, news), output);
+var reconcileFile = async (runner, props, output, adopt = false) => {
+  const want = await desiredFile(runner, props);
+  const spec = { bytesFor: async () => want.bytes, owner: props.owner, refuse: refuse3, want };
+  return convergeFile(runner, spec, output, adopt);
+};
+var deleteFile = (runner, output) => removeWholeFile(runner, output, refuse3);
+
 // src/launchd/host-file.ts
 var HostFile = Resource2("Host.File");
 var HostFileProvider = () => Provider2.effect(HostFile, Effect7.gen(function* () {
@@ -1098,7 +1188,9 @@ var HostFileProvider = () => Provider2.effect(HostFile, Effect7.gen(function* ()
       if (isResolved2(news))
         return lift(() => diffFile(runner, news, output));
       const path = resolvedString(news, "path");
-      return Effect7.succeed(path !== undefined && path !== output.path ? { action: "replace" } : undefined);
+      if (path === undefined || path === output.path)
+        return Effect7.succeed(undefined);
+      return lift(async () => await oneFile(runner, path, output.path) === true ? undefined : { action: "replace" });
     },
     reconcile: ({ fqn, instanceId, news, output }) => Effect7.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) => lift(() => reconcileFile(runner, news, output, adopt))),
     delete: ({ output }) => lift(() => deleteFile(runner, output))
@@ -1128,11 +1220,13 @@ export {
   CaddyConfigProvider,
   CaddyUnreachableError,
   DEFAULT_ADMIN_ADDRESS,
+  accessForwardAuth,
   caddyAdminLayer,
   caddyProviders,
   caddyWithFile,
-  localCaddyAdmin
+  localCaddyAdmin,
+  verifierProblems
 };
 
-//# debugId=13AB2C6EDF123C4E64756E2164756E21
+//# debugId=A91D75C3B7D7145864756E2164756E21
 //# sourceMappingURL=index.js.map