@homeflare/alchemy 0.20.0 → 0.22.0

package/dist/release/index.js

@@ -0,0 +1,1425 @@
+// src/launchd/secret-tripwire.ts
+var ALTERNATIVE = "props are stored unencrypted in Alchemy state. Have a secret renderer (e.g. openbao-agent) " + "write it to a root-owned file and declare the file path instead (FOO_FILE=/path, --foo-file /path).";
+var SECRET_NAME = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|API_?KEY|ACCESS_KEY|PRIVATE_KEY|SECRET_KEY|CREDENTIALS?)$/i;
+var INLINE_FLAG = /^--?[a-z0-9-]*(?:token|password|passwd|passphrase|secret|api-?key)=./i;
+var BARE_FLAG = /^--?(?:[a-z0-9]+-)*(?:token|password|passwd|passphrase|secret|api-?key)$/i;
+var PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
+var keyLeaves = (value, path) => {
+  if (typeof value === "string")
+    return PRIVATE_KEY.test(value) ? [path] : [];
+  if (Array.isArray(value)) {
+    return value.flatMap((item, index) => keyLeaves(item, `${path}[${String(index)}]`));
+  }
+  if (typeof value === "object" && value !== null) {
+    return Object.entries(value).flatMap(([key, item]) => keyLeaves(item, `${path}.${key}`));
+  }
+  return [];
+};
+var jobSecretProblems = (environment, argv, extraKeys) => {
+  const found = [];
+  for (const [name, value] of Object.entries(environment ?? {})) {
+    if (SECRET_NAME.test(name))
+      found.push(`environment ${name} looks like a secret: ${ALTERNATIVE}`);
+    else if (PRIVATE_KEY.test(value))
+      found.push(`environment ${name} holds a private key: ${ALTERNATIVE}`);
+  }
+  for (const [index, arg] of argv.entries()) {
+    if (INLINE_FLAG.test(arg)) {
+      found.push(`programArguments[${String(index)}] passes a secret inline: ${ALTERNATIVE}`);
+    } else if (BARE_FLAG.test(arg) && index + 1 < argv.length) {
+      found.push(`programArguments[${String(index + 1)}] follows a secret flag: ${ALTERNATIVE}`);
+    } else if (PRIVATE_KEY.test(arg)) {
+      found.push(`programArguments[${String(index)}] holds a private key: ${ALTERNATIVE}`);
+    }
+  }
+  for (const path of keyLeaves(extraKeys ?? {}, "extraKeys")) {
+    found.push(`${path} holds a private key: ${ALTERNATIVE}`);
+  }
+  return found;
+};
+var fileSecretProblems = (content) => PRIVATE_KEY.test(content) ? [`content holds a private key: ${ALTERNATIVE}`] : [];
+
+// src/launchd/host-file-form.ts
+var DEFAULT_MODE = 420;
+var identityProblems = (name, value) => {
+  if (value === undefined)
+    return [];
+  if (typeof value === "number") {
+    return Number.isSafeInteger(value) && value >= 0 ? [] : [`${name} must be a non-negative integer id`];
+  }
+  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
+};
+var pathProblems = (path) => {
+  const found = [];
+  if (!path.startsWith("/"))
+    found.push("path must be absolute");
+  if (path.endsWith("/") || path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..")) {
+    found.push('path must be normalised (no trailing slash, no empty, "." or ".." segments)');
+  }
+  if (path.includes("\x00"))
+    found.push("path contains NUL");
+  return found;
+};
+var fileProblems = (props) => {
+  const found = pathProblems(props.path);
+  const mode = props.mode ?? DEFAULT_MODE;
+  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
+    found.push("mode must be 0–0o7777");
+  found.push(...identityProblems("owner", props.owner));
+  found.push(...identityProblems("group", props.group));
+  found.push(...fileSecretProblems(props.content));
+  return found;
+};
+
+// src/release/binary-form.ts
+var DEFAULT_BINARY_MODE = 493;
+var releaseUrl = (repo, tag, asset) => `https://github.com/${repo}/releases/download/${tag}/${asset}`;
+var releaseBinaryPath = (props) => `${props.directory}/${props.name}`;
+var pinnedDownload = (props) => ({
+  member: props.member,
+  memberSha256: props.sha256,
+  sha256: props.archive.sha256,
+  size: props.archive.size,
+  url: releaseUrl(props.archive.repo, props.archive.tag, props.archive.asset)
+});
+var modeProblems = (mode) => {
+  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
+    return ["mode must be 0–0o7777"];
+  const found = [];
+  if ((mode & 3584) !== 0)
+    found.push("mode must not set setuid, setgid or sticky");
+  if ((mode & 18) !== 0)
+    found.push("mode must not be group- or world-writable");
+  if ((mode & 64) === 0)
+    found.push("mode must let the owner execute it");
+  if ((mode & 256) === 0)
+    found.push("mode must let the owner read it (it is re-hashed)");
+  return found;
+};
+var HEX64 = /^[0-9a-f]{64}$/;
+var MAX_ARCHIVE = 1 << 30;
+var REPO = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?\/[A-Za-z0-9._-]+$/;
+var SEGMENT = /^[A-Za-z0-9._-]+$/;
+var TARBALL = /\.(tar\.gz|tgz)$/;
+var segmentProblem = (what, value) => !SEGMENT.test(value) || value === "." || value === ".." ? `${what} must be one path segment of letters, digits, '.', '_' or '-': ${JSON.stringify(value)}` : undefined;
+var pinProblems = (props) => {
+  const archive = props.archive ?? {};
+  const found = [];
+  const text = (what, value) => {
+    if (typeof value === "string")
+      return value;
+    found.push(`${what} is required, as a plain string`);
+    return;
+  };
+  const repo = text("archive.repo", archive.repo);
+  const repoName = repo?.slice(repo.indexOf("/") + 1);
+  if (repo !== undefined && (!REPO.test(repo) || repoName === "." || repoName === ".."))
+    found.push(`archive.repo must be "owner/name": ${JSON.stringify(repo)}`);
+  for (const [what, value] of [
+    ["archive.tag", archive.tag],
+    ["name", props.name]
+  ]) {
+    const given = text(what, value);
+    const problem = given === undefined ? undefined : segmentProblem(what, given);
+    if (problem !== undefined)
+      found.push(problem);
+  }
+  const asset = text("archive.asset", archive.asset);
+  if (asset !== undefined) {
+    const problem = segmentProblem("archive.asset", asset);
+    if (problem !== undefined)
+      found.push(problem);
+    else if (!TARBALL.test(asset))
+      found.push(`archive.asset must be a .tar.gz or .tgz: "${asset}"`);
+  }
+  const size = archive.size;
+  if (typeof size !== "number" || !Number.isSafeInteger(size) || size <= 0 || size > MAX_ARCHIVE) {
+    found.push(`archive.size must be the asset's byte count, 1 to ${String(MAX_ARCHIVE)}`);
+  }
+  for (const [what, value] of [
+    ["archive.sha256", archive.sha256],
+    ["sha256", props.sha256]
+  ]) {
+    const given = text(what, value);
+    if (given !== undefined && !HEX64.test(given))
+      found.push(`${what} must be 64 lower-case hex digits`);
+  }
+  const member = text("member", props.member);
+  if (member !== undefined && (member === "" || member.startsWith("/") || member.split("/").includes(".."))) {
+    found.push(`member must be a relative name inside the archive: ${JSON.stringify(member)}`);
+  }
+  return found;
+};
+var ARCHIVE_KEYS = ["repo", "tag", "asset", "size", "sha256"];
+var pinsMoved = (olds, news) => olds.member !== news.member || olds.sha256 !== news.sha256 || ARCHIVE_KEYS.some((key) => olds.archive[key] !== news.archive[key]);
+var inPlaceRefusal = (olds, news) => `a new pin (${news.archive.tag} ${news.member} ${news.sha256}) at the path of the installed ` + `one (${olds.archive.tag} ${olds.member} ${olds.sha256}) would overwrite it in place; give each ` + "version its own directory (catalogDirectory), so an upgrade is a new path";
+var binaryProblems = (props) => [
+  ...pinProblems(props),
+  ...pathProblems(props.directory).map((problem) => `directory: ${problem}`),
+  ...modeProblems(props.mode ?? DEFAULT_BINARY_MODE),
+  ...identityProblems("owner", props.owner),
+  ...identityProblems("group", props.group)
+];
+// src/release/binary.ts
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import * as Effect9 from "effect/Effect";
+import * as HttpClient3 from "effect/unstable/http/HttpClient";
+
+// src/launchd/host-effect.ts
+import * as Effect from "effect/Effect";
+var lift = (step) => Effect.tryPromise({
+  catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
+  try: step
+});
+var resolvedString = (news, key) => {
+  if (typeof news !== "object" || news === null)
+    return;
+  const value = news[key];
+  return typeof value === "string" ? value : undefined;
+};
+
+// src/launchd/runner.ts
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+
+class HostRunnerService extends Context.Service()("homeflare/launchd/HostRunner") {
+}
+var hostRunnerLayer = (runner) => Layer.succeed(HostRunnerService, runner);
+var canActAsRoot = (runner) => runner.privileged || runner.effectiveUid() === 0;
+
+// src/ownership/adopt.ts
+import { AdoptPolicy } from "alchemy/AdoptPolicy";
+import { AlchemyContext } from "alchemy/AlchemyContext";
+import { Stack as Stack3 } from "alchemy/Stack";
+import * as Effect5 from "effect/Effect";
+import * as Option4 from "effect/Option";
+
+// src/ownership/resume.ts
+import { Unowned } from "alchemy/AdoptPolicy";
+import { Artifacts } from "alchemy/Artifacts";
+import * as Effect2 from "effect/Effect";
+import * as Option from "effect/Option";
+var PROVEN = "homeflare/ownership/resumes";
+var UNFINISHED = "homeflare/ownership/unfinished";
+var note = (key, instanceId) => Effect2.gen(function* () {
+  const bag = yield* Effect2.serviceOption(Artifacts);
+  if (Option.isSome(bag))
+    yield* bag.value.set(key, instanceId);
+});
+var noted = (key, instanceId) => Effect2.gen(function* () {
+  const bag = yield* Effect2.serviceOption(Artifacts);
+  if (Option.isNone(bag))
+    return false;
+  return (yield* bag.value.get(key)) === instanceId;
+});
+var noteUnfinished = (instanceId) => Effect2.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect2.gen(function* () {
+  yield* noteUnfinished(instanceId);
+  const unproven = () => Effect2.succeed(undefined);
+  const found = yield* recovered.pipe(Effect2.catch(unproven), Effect2.catchDefect(unproven));
+  if (found === undefined || found === null || Unowned.is(found))
+    return;
+  yield* note(PROVEN, instanceId);
+});
+var resumes = (instanceId) => noted(PROVEN, instanceId);
+var unfinished = (instanceId) => noted(UNFINISHED, instanceId);
+var provingResumes = (service) => {
+  const { diff, read } = service;
+  if (diff === undefined || read === undefined)
+    return service;
+  const proving = (input) => Effect2.gen(function* () {
+    if (input.output === undefined) {
+      yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
+    }
+    return yield* diff(input);
+  });
+  return { ...service, diff: proving };
+};
+
+// src/ownership/rows.ts
+import { Stack as Stack2 } from "alchemy/Stack";
+import { State, isActionState } from "alchemy/State/State";
+import * as Effect4 from "effect/Effect";
+import * as Option3 from "effect/Option";
+
+// src/ownership/whole.ts
+import { Stack } from "alchemy/Stack";
+import * as Effect3 from "effect/Effect";
+import * as Option2 from "effect/Option";
+var absent = (value) => value === undefined || value === null;
+var isPlainObject = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var carries = (declared, recorded) => {
+  if (absent(declared))
+    return true;
+  if (absent(recorded))
+    return false;
+  if (Array.isArray(declared)) {
+    if (!Array.isArray(recorded))
+      return false;
+    return declared.every((each, index) => carries(each, recorded[index]));
+  }
+  if (isPlainObject(declared)) {
+    if (!isPlainObject(recorded))
+      return false;
+    return Object.entries(declared).every(([key, each]) => carries(each, recorded[key]));
+  }
+  return true;
+};
+var wholeDeclaration = (fqn, props) => Effect3.map(Effect3.serviceOption(Stack), (stack) => {
+  const declared = Option2.isSome(stack) ? stack.value.resources[fqn] : undefined;
+  return declared !== undefined && carries(declared.Props, props);
+});
+
+// src/ownership/rows.ts
+var storeOf = Effect4.gen(function* () {
+  const stack = yield* Effect4.serviceOption(Stack2);
+  const state = yield* Effect4.serviceOption(State);
+  if (Option3.isNone(stack) || Option3.isNone(state))
+    return;
+  const store = yield* state.value;
+  const where = { stack: stack.value.name, stage: stack.value.stage };
+  return { resources: stack.value.resources, store, where };
+});
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect4.orElseSucceed(() => {
+  return;
+}));
+var generationOf = (row, instanceId) => {
+  let at = row;
+  while (typeof at === "object" && at !== null && !isActionState(at)) {
+    const generation = at;
+    if (generation.instanceId === instanceId)
+      return generation;
+    at = generation.old;
+  }
+  return;
+};
+var recordedGeneration = (fqn, instanceId) => Effect4.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  for (const at of [fqn, ...found.resources[fqn]?.FormerFqns ?? []]) {
+    const generation = generationOf(yield* rowAt(found.store, found.where, at), instanceId);
+    if (generation !== undefined)
+      return generation;
+  }
+  return;
+});
+var recordedInstance = (fqn, instanceId) => Effect4.gen(function* () {
+  const generation = yield* recordedGeneration(fqn, instanceId);
+  if (generation === undefined)
+    return "absent";
+  return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
+});
+var isCreate = (fqn, instanceId) => Effect4.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var forgetRefusedCreate = (fqn, instanceId) => Effect4.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  const row = yield* rowAt(found.store, found.where, fqn);
+  const mine = row;
+  if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
+    return;
+  }
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect4.ignore);
+});
+
+// src/ownership/adopt.ts
+var adoptEnabled = (fqn) => Effect5.gen(function* () {
+  const stack = yield* Effect5.serviceOption(Stack3);
+  const scoped = Option4.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
+  if (scoped !== undefined)
+    return scoped;
+  const policy = yield* Effect5.serviceOption(AdoptPolicy);
+  if (Option4.isSome(policy))
+    return policy.value;
+  const context = yield* Effect5.serviceOption(AlchemyContext);
+  return Option4.isSome(context) ? context.value.adopt : false;
+});
+var adoptable = (owner) => Effect5.gen(function* () {
+  if (yield* isCreate(owner.fqn, owner.instanceId))
+    return true;
+  return yield* unfinished(owner.instanceId);
+});
+var adoptsAtApply = (owner) => Effect5.gen(function* () {
+  if (!(yield* adoptEnabled(owner.fqn)))
+    return false;
+  return yield* adoptable(owner);
+});
+var refuseTakeover = (owner, what) => Effect5.gen(function* () {
+  if (owner.output !== undefined)
+    return;
+  if (yield* resumes(owner.instanceId))
+    return;
+  const may = yield* adoptable(owner);
+  if (may && (yield* adoptEnabled(owner.fqn)))
+    return;
+  yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
+  const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
+  return yield* Effect5.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+});
+var claimFor = (owner) => (what) => refuseTakeover(owner, what);
+
+// src/release/binary-diff.ts
+import { isResolved } from "alchemy/Diff";
+
+// src/launchd/file-identity.ts
+var sameEntry = (a, b) => {
+  if (a === undefined || b === undefined)
+    return false;
+  if (a.dev === undefined || a.ino === undefined || b.dev === undefined || b.ino === undefined) {
+    return;
+  }
+  return a.dev === b.dev && a.ino === b.ino;
+};
+var oneFile = async (runner, a, b) => {
+  if (a === b)
+    return true;
+  const [left, right] = await Promise.all([runner.stat(a), runner.stat(b)]);
+  return sameEntry(left, right);
+};
+var leaveOldPath = async (runner, oldPath, path, remove, refuse) => {
+  const same = await oneFile(runner, oldPath, path);
+  if (same === true)
+    return;
+  await remove();
+  if (same === undefined && await runner.stat(path) === undefined) {
+    throw refuse(path, `removing the old path ${oldPath} removed this file too: they are one file under two ` + "spellings (a symlinked parent, or case on a case-insensitive volume). Deploy again to " + "reinstall it, and keep one spelling.");
+  }
+};
+
+// src/launchd/job-form.ts
+import { createHash } from "node:crypto";
+
+// src/launchd/plist.ts
+class PlistError extends Error {
+  path;
+  constructor(path, detail) {
+    super(`plist ${path === "" ? "(root)" : path}: ${detail}`);
+    this.path = path;
+    this.name = "PlistError";
+  }
+}
+var HEADER = `<?xml version="1.0" encoding="UTF-8"?>
+` + '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" ' + `"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+` + `<plist version="1.0">
+`;
+var MAX_DEPTH = 32;
+var FORBIDDEN = /[\x00-\x08\x0B\x0C\x0E-\x1F\uD800-\uDFFF\uFFFE\uFFFF]/u;
+var escapeText = (text, path) => {
+  const bad = FORBIDDEN.exec(text);
+  if (bad !== null) {
+    const code = bad[0].codePointAt(0) ?? 0;
+    throw new PlistError(path, `U+${code.toString(16).toUpperCase().padStart(4, "0")} cannot appear in XML 1.0`);
+  }
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\r", "&#13;");
+};
+var isPlainObject2 = (value) => {
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var renderValue = (value, path, depth, out) => {
+  const pad = "\t".repeat(depth);
+  if (depth > MAX_DEPTH)
+    throw new PlistError(path, `nested deeper than ${String(MAX_DEPTH)}`);
+  if (typeof value === "string") {
+    out.push(`${pad}<string>${escapeText(value, path)}</string>`);
+    return;
+  }
+  if (typeof value === "boolean") {
+    out.push(`${pad}<${value ? "true" : "false"}/>`);
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value)) {
+      throw new PlistError(path, `${String(value)} is not a safe integer (no <real> support)`);
+    }
+    out.push(`${pad}<integer>${String(value === 0 ? 0 : value)}</integer>`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      out.push(`${pad}<array/>`);
+      return;
+    }
+    out.push(`${pad}<array>`);
+    for (const [index, item] of value.entries()) {
+      renderValue(item, `${path}[${String(index)}]`, depth + 1, out);
+    }
+    out.push(`${pad}</array>`);
+    return;
+  }
+  if (typeof value === "object" && value !== null && isPlainObject2(value)) {
+    renderDict(value, path, depth, out);
+    return;
+  }
+  const kind = value === null ? "null" : typeof value;
+  throw new PlistError(path, `${kind} has no plist form — omit the key instead`);
+};
+var renderDict = (dict, path, depth, out) => {
+  const pad = "\t".repeat(depth);
+  const keys = Object.keys(dict).sort();
+  if (keys.length === 0) {
+    out.push(`${pad}<dict/>`);
+    return;
+  }
+  out.push(`${pad}<dict>`);
+  for (const key of keys) {
+    const child = path === "" ? key : `${path}.${key}`;
+    out.push(`${pad}	<key>${escapeText(key, child)}</key>`);
+    renderValue(dict[key], child, depth + 1, out);
+  }
+  out.push(`${pad}</dict>`);
+};
+var renderPlist = (dict) => {
+  if (typeof dict !== "object" || dict === null || Array.isArray(dict) || !isPlainObject2(dict)) {
+    throw new PlistError("", "the top level of a launchd plist must be a dict");
+  }
+  const out = [];
+  renderDict(dict, "", 0, out);
+  return `${HEADER}${out.join(`
+`)}
+</plist>
+`;
+};
+
+// src/launchd/job-form.ts
+var parseDomain = (domain) => {
+  if (domain === "system")
+    return { kind: "system" };
+  const match = /^gui\/(\d+)$/.exec(domain);
+  return match?.[1] === undefined ? undefined : { kind: "gui", uid: Number(match[1]) };
+};
+var serviceTarget = (label, domain) => `${domain}/${label}`;
+var plistPathFor = (label, domain, home) => {
+  if (domain.kind === "system")
+    return `/Library/LaunchDaemons/${label}.plist`;
+  if (home === undefined || !home.startsWith("/")) {
+    throw new Error(`gui/${String(domain.uid)}: no home directory for that uid on this host`);
+  }
+  return `${home}/Library/LaunchAgents/${label}.plist`;
+};
+var OWNED_KEYS = [
+  "EnvironmentVariables",
+  "GroupName",
+  "KeepAlive",
+  "Label",
+  "Program",
+  "ProgramArguments",
+  "RunAtLoad",
+  "StandardErrorPath",
+  "StandardOutPath",
+  "StartCalendarInterval",
+  "StartInterval",
+  "ThrottleInterval",
+  "UserName",
+  "WorkingDirectory"
+];
+var calendarDict = (entry) => {
+  const dict = {};
+  if (entry.minute !== undefined)
+    dict["Minute"] = entry.minute;
+  if (entry.hour !== undefined)
+    dict["Hour"] = entry.hour;
+  if (entry.day !== undefined)
+    dict["Day"] = entry.day;
+  if (entry.weekday !== undefined)
+    dict["Weekday"] = entry.weekday;
+  if (entry.month !== undefined)
+    dict["Month"] = entry.month;
+  return dict;
+};
+var keepAliveValue = (keepAlive) => {
+  if (typeof keepAlive === "boolean")
+    return keepAlive;
+  const dict = {};
+  if (keepAlive.successfulExit !== undefined)
+    dict["SuccessfulExit"] = keepAlive.successfulExit;
+  if (keepAlive.crashed !== undefined)
+    dict["Crashed"] = keepAlive.crashed;
+  return dict;
+};
+var jobPlistDict = (props) => {
+  const dict = { ...props.extraKeys };
+  dict["Label"] = props.label;
+  dict["ProgramArguments"] = [...props.programArguments];
+  const env = props.environment ?? {};
+  if (Object.keys(env).length > 0)
+    dict["EnvironmentVariables"] = { ...env };
+  if (props.runAtLoad !== undefined)
+    dict["RunAtLoad"] = props.runAtLoad;
+  if (props.keepAlive !== undefined)
+    dict["KeepAlive"] = keepAliveValue(props.keepAlive);
+  if (props.startInterval !== undefined)
+    dict["StartInterval"] = props.startInterval;
+  const calendar = props.startCalendarInterval;
+  if (calendar !== undefined) {
+    dict["StartCalendarInterval"] = Array.isArray(calendar) ? calendar.map(calendarDict) : calendarDict(calendar);
+  }
+  if (props.throttleInterval !== undefined)
+    dict["ThrottleInterval"] = props.throttleInterval;
+  if (props.standardOutPath !== undefined)
+    dict["StandardOutPath"] = props.standardOutPath;
+  if (props.standardErrorPath !== undefined)
+    dict["StandardErrorPath"] = props.standardErrorPath;
+  if (props.workingDirectory !== undefined)
+    dict["WorkingDirectory"] = props.workingDirectory;
+  if (props.userName !== undefined)
+    dict["UserName"] = props.userName;
+  if (props.groupName !== undefined)
+    dict["GroupName"] = props.groupName;
+  return dict;
+};
+var sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
+var renderJob = (props) => {
+  const text = renderPlist(jobPlistDict(props));
+  const bytes = new TextEncoder().encode(text);
+  return { bytes, sha256: sha256Hex(bytes), text };
+};
+
+// src/launchd/file-converge.ts
+var numericId = (value) => typeof value === "number" ? value : /^\d+$/.test(value) ? Number(value) : undefined;
+var resolveIds = async (runner, declared, path, refuse) => {
+  let uid;
+  let gid;
+  if (declared.owner !== undefined) {
+    uid = numericId(declared.owner) ?? (await runner.lookupUser(String(declared.owner)))?.uid;
+    if (uid === undefined)
+      throw refuse(path, `no user ${String(declared.owner)} on this host`);
+  }
+  if (declared.group !== undefined) {
+    gid = numericId(declared.group) ?? await runner.lookupGroup(String(declared.group));
+    if (gid === undefined)
+      throw refuse(path, `no group ${String(declared.group)} on this host`);
+  }
+  return { ...uid === undefined ? {} : { uid }, ...gid === undefined ? {} : { gid } };
+};
+var readFileAttributes = async (runner, path) => {
+  const stat = await runner.stat(path);
+  if (stat === undefined)
+    return;
+  const bytes = stat.kind === "file" ? await runner.readFile(path) : undefined;
+  return {
+    gid: stat.gid,
+    mode: stat.mode,
+    path,
+    sha256: bytes === undefined ? "" : sha256Hex(bytes),
+    size: stat.size,
+    uid: stat.uid
+  };
+};
+var writeOptionsOf = (want) => ({
+  mode: want.mode,
+  ...want.uid === undefined ? {} : { uid: want.uid },
+  ...want.gid === undefined ? {} : { gid: want.gid }
+});
+var fileMatches = (live, want) => live.sha256 === want.sha256 && live.mode === want.mode && (want.uid === undefined || live.uid === want.uid) && (want.gid === undefined || live.gid === want.gid);
+var diffTarget = async (runner, want, output) => {
+  const writes = async (diff) => {
+    await runner.checkWrite?.(want.path, writeOptionsOf(want));
+    return diff;
+  };
+  if (want.path !== output.path) {
+    const same = await oneFile(runner, want.path, output.path);
+    return writes({ action: same === true ? "update" : "replace" });
+  }
+  if (want.sha256 !== output.sha256)
+    return writes({ action: "update" });
+  const live = await readFileAttributes(runner, want.path);
+  return live !== undefined && fileMatches(live, want) ? { action: "noop" } : writes({ action: "update" });
+};
+var convergeFile = async (runner, spec, output, adopt = false) => {
+  const { want, refuse } = spec;
+  const path = want.path;
+  if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {
+    throw refuse(path, `owner ${String(spec.owner)} is not the deploying user; only root may chown. Deploy as root ` + "or through a privileged HostRunner (sudoRunner() with this path under a prefix). This " + "provider never calls sudo itself.");
+  }
+  const stat = await runner.stat(path);
+  if (stat !== undefined && stat.kind !== "file") {
+    throw refuse(path, `is a ${stat.kind}; remove it from whatever owns it before declaring it here`);
+  }
+  const before = stat === undefined ? undefined : await readFileAttributes(runner, path);
+  const moved = output !== undefined && output.path !== path;
+  const prior = moved ? undefined : output;
+  const takeOver = adopt && output === undefined;
+  if (prior === undefined && before !== undefined && !fileMatches(before, want) && !takeOver) {
+    throw refuse(path, "already exists and is not this resource. Remove it, or declare it as a new resource and " + "deploy with --adopt.");
+  }
+  if (before === undefined || !fileMatches(before, want)) {
+    const bytes = await spec.bytesFor(before);
+    if (sha256Hex(bytes) !== want.sha256) {
+      throw refuse(path, `the bytes to write do not hash to ${want.sha256}. Nothing was written.`);
+    }
+    await runner.writeFileAtomic(path, bytes, writeOptionsOf(want));
+  }
+  const rollBack = async () => {
+    if (before === undefined)
+      await runner.removeFile(path).catch(() => {
+        return;
+      });
+  };
+  const after = await readFileAttributes(runner, path).catch(async (cause) => {
+    await rollBack();
+    throw refuse(path, `the write returned but reading it back failed: ${String(cause)}`);
+  });
+  if (after === undefined || !fileMatches(after, want)) {
+    await rollBack();
+    throw refuse(path, "the write returned but the file on disk does not match the declaration");
+  }
+  if (moved)
+    await leaveOldPath(runner, output.path, path, () => removeWholeFile(runner, output, refuse), refuse);
+  return after;
+};
+var removeWholeFile = async (runner, output, refuse) => {
+  const stat = await runner.stat(output.path);
+  if (stat === undefined)
+    return;
+  if (stat.kind !== "file")
+    throw refuse(output.path, `is now a ${stat.kind}; not removing it`);
+  await runner.removeFile(output.path);
+};
+
+// src/release/binary-claim.ts
+var TAKEN = "already exists and is not this resource";
+var otherBytes = (found, pinned) => `${found === "" ? "something that is not a regular file" : `a file hashing to ${found}`} is ` + `there, not the pinned binary (${pinned}). --adopt takes over only the pinned binary: taking ` + "over other bytes would overwrite them in place. Remove it (or move it aside) and deploy again";
+var adoptionProblem = (found, pinned) => found === pinned ? undefined : `${TAKEN}: ${otherBytes(found, pinned)}`;
+var claimProblem = async (runner, want, adopt) => {
+  const stat = await runner.stat(want.path);
+  if (stat?.kind !== "file")
+    return;
+  const found = (await readFileAttributes(runner, want.path))?.sha256 ?? "";
+  if (found !== want.sha256)
+    return adoptionProblem(found, want.sha256);
+  if (adopt)
+    return;
+  return `${TAKEN}: it holds the pinned binary, but this stack holds no state for it and the plan ` + "could not ask first (a prop was still an Output, or a replace landed on it). " + "Identical is not ours: once claimed, a later delete removes it from whoever put it there. " + "Deploy with --adopt to take it over (a create, or an interrupted install of this one), or " + "remove it. If another declaration in this stack owned it under another name, declare the " + "rename with renamedFrom() instead";
+};
+
+// src/release/refused.ts
+import * as Data from "effect/Data";
+
+class BinaryRefused extends Data.TaggedError("BinaryRefused") {
+}
+
+class DownloadFailed extends Data.TaggedError("DownloadFailed") {
+}
+
+class ChecksumMismatch extends Data.TaggedError("ChecksumMismatch") {
+}
+
+class ArchiveRefused extends Data.TaggedError("ArchiveRefused") {
+}
+
+// src/release/tar.ts
+var BLOCK = 512;
+var KINDS = {
+  "1": "a hard link",
+  "2": "a symlink",
+  "3": "a character device",
+  "4": "a block device",
+  "5": "a directory",
+  "6": "a FIFO",
+  "7": "a contiguous file",
+  K: "a GNU long-link header",
+  L: "a GNU long-name header",
+  g: "a PAX global header",
+  x: "a PAX extended header"
+};
+var refuse = (message) => new ArchiveRefused({ message });
+var strict = new TextDecoder("utf-8", { fatal: true });
+var ascii = new TextDecoder("latin1");
+var field = (block, start, length) => {
+  const slice = block.subarray(start, start + length);
+  const end = slice.indexOf(0);
+  return end === -1 ? slice : slice.subarray(0, end);
+};
+var text = (block, start, length) => {
+  try {
+    return strict.decode(field(block, start, length));
+  } catch {
+    throw refuse("an entry name is not UTF-8");
+  }
+};
+var octal = (block, start, length, what) => {
+  const raw = block.subarray(start, start + length);
+  if (((raw[0] ?? 0) & 128) !== 0)
+    throw refuse(`${what} is base-256 encoded`);
+  const digits = ascii.decode(raw).replace(/[\0 ]+$/, "").replace(/^ +/, "");
+  if (!/^[0-7]+$/.test(digits))
+    throw refuse(`${what} is not octal: ${JSON.stringify(digits)}`);
+  return Number.parseInt(digits, 8);
+};
+var checksumHolds = (block) => {
+  let sum = 0;
+  for (let at = 0;at < BLOCK; at += 1)
+    sum += at >= 148 && at < 156 ? 32 : block[at] ?? 0;
+  return sum === octal(block, 148, 8, "a header checksum");
+};
+var nameProblem = (name) => {
+  if (name === "")
+    return "has an empty name";
+  if (name.startsWith("/"))
+    return "is absolute";
+  if (name.split("/").includes(".."))
+    return 'climbs out of the archive with ".."';
+  return;
+};
+var concatBytes = (parts) => {
+  const out = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+  let at = 0;
+  for (const part of parts) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+};
+var tarReader = (wanted) => {
+  const header = new Uint8Array(BLOCK);
+  const members = new Map;
+  const names = [];
+  const seen = new Set;
+  let phase = "header";
+  let filled = 0;
+  let remaining = 0;
+  let padding = 0;
+  let zeros = 0;
+  let name = "";
+  let parts;
+  const endEntry = () => {
+    if (parts !== undefined)
+      members.set(name, concatBytes(parts));
+    parts = undefined;
+    phase = padding > 0 ? "pad" : "header";
+  };
+  const startEntry = () => {
+    if (header.every((byte) => byte === 0)) {
+      zeros += 1;
+      if (zeros === 2)
+        phase = "end";
+      return;
+    }
+    if (zeros > 0)
+      throw refuse("a zero block sits between entries (truncated or spliced)");
+    if (!checksumHolds(header))
+      throw refuse("an entry header fails its checksum");
+    const magic = ascii.decode(header.subarray(257, 265));
+    const posix = magic === "ustar\x0000";
+    if (!posix && magic !== "ustar  \x00")
+      throw refuse("an entry header is neither ustar nor GNU");
+    const prefix = posix ? text(header, 345, 155) : "";
+    name = prefix === "" ? text(header, 0, 100) : `${prefix}/${text(header, 0, 100)}`;
+    const problem = nameProblem(name);
+    if (problem !== undefined)
+      throw refuse(`entry ${JSON.stringify(name)} ${problem}`);
+    const type = String.fromCharCode(header[156] ?? 0);
+    if (type !== "0" && type !== "\x00") {
+      const kind = KINDS[type] ?? `of unknown type ${JSON.stringify(type)}`;
+      throw refuse(`entry "${name}" is ${kind}; only regular files are accepted`);
+    }
+    if (seen.has(name))
+      throw refuse(`entry "${name}" appears twice`);
+    seen.add(name);
+    names.push(name);
+    remaining = octal(header, 124, 12, `entry "${name}"'s size`);
+    padding = (BLOCK - remaining % BLOCK) % BLOCK;
+    parts = wanted.has(name) ? [] : undefined;
+    phase = "data";
+    if (remaining === 0)
+      endEntry();
+  };
+  const push = (chunk) => {
+    let at = 0;
+    while (at < chunk.length) {
+      if (phase === "end") {
+        if (chunk.subarray(at).some((byte) => byte !== 0)) {
+          throw refuse("data follows the end-of-archive marker");
+        }
+        return;
+      }
+      if (phase === "header") {
+        const take = Math.min(BLOCK - filled, chunk.length - at);
+        header.set(chunk.subarray(at, at + take), filled);
+        filled += take;
+        at += take;
+        if (filled === BLOCK) {
+          filled = 0;
+          startEntry();
+        }
+      } else if (phase === "data") {
+        const take = Math.min(remaining, chunk.length - at);
+        parts?.push(chunk.slice(at, at + take));
+        remaining -= take;
+        at += take;
+        if (remaining === 0)
+          endEntry();
+      } else {
+        const take = Math.min(padding, chunk.length - at);
+        padding -= take;
+        at += take;
+        if (padding === 0)
+          phase = "header";
+      }
+    }
+  };
+  const finish = () => {
+    if (phase !== "end")
+      throw refuse("the archive stops before its end-of-archive marker");
+    return { members, names };
+  };
+  return { finish, push };
+};
+
+// src/release/archive.ts
+var SLICE = 1 << 20;
+var extractMembers = async (gzipped, wanted) => {
+  const tar = tarReader(wanted);
+  let offset = 0;
+  const source = new ReadableStream({
+    pull(controller) {
+      if (offset >= gzipped.length) {
+        controller.close();
+        return;
+      }
+      controller.enqueue(gzipped.slice(offset, offset + SLICE));
+      offset += SLICE;
+    }
+  });
+  const unzipped = source.pipeThrough(new DecompressionStream("gzip")).getReader();
+  try {
+    for (;; ) {
+      const { done, value } = await unzipped.read();
+      if (done)
+        break;
+      tar.push(value);
+    }
+  } catch (cause) {
+    await unzipped.cancel().catch(() => {
+      return;
+    });
+    if (cause instanceof ArchiveRefused)
+      throw cause;
+    throw new ArchiveRefused({ message: `not a gzip stream (${String(cause)})` });
+  }
+  return tar.finish();
+};
+var mismatch = (subject, expected, actual) => new ChecksumMismatch({
+  actual,
+  expected,
+  message: `${subject} hashes to ${actual}, not the pinned ${expected}`,
+  subject
+});
+var verifiedMember = async (archive, release) => {
+  const archiveSha = sha256Hex(archive);
+  if (archiveSha !== release.sha256)
+    throw mismatch(release.url, release.sha256, archiveSha);
+  const { members, names } = await extractMembers(archive, new Set([release.member]));
+  const bytes = members.get(release.member);
+  if (bytes === undefined) {
+    throw new ArchiveRefused({
+      message: `${release.url} has no member named exactly "${release.member}" (it has ${names.map((n) => `"${n}"`).join(", ") || "none"})`
+    });
+  }
+  const memberSha = sha256Hex(bytes);
+  if (memberSha !== release.memberSha256) {
+    throw mismatch(`member "${release.member}"`, release.memberSha256, memberSha);
+  }
+  return bytes;
+};
+
+// src/release/binary-lifecycle.ts
+var NOTHING = "Nothing was written.";
+var refuse2 = (path, message) => new BinaryRefused({ message: `Release.Binary ${path}: ${message}` });
+var restated = (path, cause) => {
+  const say = (message) => `Release.Binary ${path}: ${message}. ${NOTHING}`;
+  if (cause instanceof ChecksumMismatch) {
+    const { actual, expected, subject } = cause;
+    return new ChecksumMismatch({ actual, expected, message: say(cause.message), subject });
+  }
+  if (cause instanceof ArchiveRefused)
+    return new ArchiveRefused({ message: say(cause.message) });
+  if (cause instanceof DownloadFailed) {
+    return new DownloadFailed({ message: say(cause.message), retryable: cause.retryable });
+  }
+  return cause;
+};
+var desiredBinary = async (runner, props) => {
+  const path = releaseBinaryPath(props);
+  const problems = binaryProblems(props);
+  if (problems.length > 0)
+    throw refuse2(path, `${problems.join("; ")}. ${NOTHING}`);
+  const ids = await resolveIds(runner, props, path, refuse2);
+  const mode = props.mode ?? DEFAULT_BINARY_MODE;
+  return { download: pinnedDownload(props), want: { mode, path, sha256: props.sha256, ...ids } };
+};
+var withSource = (found, download) => ({ ...found, member: download.member, url: download.url });
+var readBinary = async (runner, props) => {
+  const { download, want } = await desiredBinary(runner, props);
+  const found = await readFileAttributes(runner, want.path);
+  return found === undefined ? undefined : withSource(found, download);
+};
+var refreshBinary = async (runner, output) => {
+  const found = await readFileAttributes(runner, output.path);
+  return found === undefined ? undefined : { ...found, member: output.member, url: output.url };
+};
+var directoryReady = async (runner, props) => {
+  const stat = await runner.stat(props.directory);
+  if (stat?.kind === "directory" && (stat.mode & 18) !== 0) {
+    throw refuse2(releaseBinaryPath(props), `directory ${props.directory} is writable by group or other (mode ` + `${stat.mode.toString(8).padStart(4, "0")}), so whoever may write it may replace the ` + `binary; declare it 0755 or narrower. ${NOTHING}`);
+  }
+  if (stat?.kind === "directory")
+    return;
+  const why = stat === undefined ? "does not exist" : `is a ${stat.kind}, not a directory`;
+  throw refuse2(releaseBinaryPath(props), `directory ${props.directory} ${why}; declare it (HostDirectory) and pass its path. ${NOTHING}`);
+};
+var reconcileBinary = async (runner, fetch, props, options = {}) => {
+  const { adopt = false, declared = [], note: note2 = async () => {
+    return;
+  } } = options;
+  if (declared.length > 0) {
+    throw refuse2(releaseBinaryPath(props), `${declared.join("; ")}. A pin is copied into reviewed code, never computed during the ` + `deploy (declared-pins.ts). ${NOTHING}`);
+  }
+  const { download, want } = await desiredBinary(runner, props);
+  const olds = options.olds;
+  if (olds !== undefined && releaseBinaryPath(olds) === want.path && pinsMoved(olds, props)) {
+    throw refuse2(want.path, `${inPlaceRefusal(olds, props)}. ${NOTHING}`);
+  }
+  await directoryReady(runner, props);
+  if (options.output === undefined) {
+    const problem = await claimProblem(runner, want, adopt);
+    if (problem !== undefined)
+      throw refuse2(want.path, `${problem}. ${NOTHING}`);
+  }
+  const bytesFor = async (before) => {
+    if (before?.sha256 === want.sha256) {
+      const local = await runner.readFile(want.path);
+      if (local !== undefined && sha256Hex(local) === want.sha256)
+        return local;
+    }
+    await note2(`downloading ${download.url} (${String(download.size)} bytes)`);
+    try {
+      const bytes = await verifiedMember(await fetch(download.url, download.size), download);
+      await note2(`verified ${download.member} ${download.memberSha256}`);
+      return bytes;
+    } catch (cause) {
+      throw restated(want.path, cause);
+    }
+  };
+  const spec = { bytesFor, owner: props.owner, refuse: refuse2, want };
+  return withSource(await convergeFile(runner, spec, options.output, adopt), download);
+};
+var deleteBinary = (runner, output) => removeWholeFile(runner, output, refuse2);
+
+// src/release/binary-diff.ts
+var diffBinary = async (runner, news, olds, output) => {
+  const problems = pinProblems(news ?? {});
+  if (problems.length > 0)
+    throw refuse2(output.path, `${problems.join("; ")}. ${NOTHING}`);
+  const takeover = adoptionProblem(output.sha256, olds.sha256);
+  if (takeover !== undefined)
+    throw refuse2(output.path, `${takeover}. ${NOTHING}`);
+  const pins = news;
+  const directory = resolvedString(news, "directory");
+  const path = directory === undefined ? undefined : `${directory}/${pins.name}`;
+  const pinned = pinsMoved(olds, pins);
+  if (pinned && path === output.path) {
+    throw refuse2(output.path, `${inPlaceRefusal(olds, pins)}. ${NOTHING}`);
+  }
+  if (isResolved(news))
+    return diffTarget(runner, (await desiredBinary(runner, news)).want, output);
+  if (path !== undefined)
+    return path === output.path ? undefined : { action: "replace" };
+  if (pins.name !== olds.name || pins.sha256 !== olds.sha256)
+    return { action: "replace" };
+  return pinned ? { action: "update" } : undefined;
+};
+
+// src/release/binary-read.ts
+import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
+import * as Effect6 from "effect/Effect";
+var readWithoutState = (runner, ask) => Effect6.gen(function* () {
+  const recovering = (yield* recordedGeneration(ask.fqn, ask.instanceId)) !== undefined;
+  const read = lift(() => readBinary(runner, ask.olds));
+  const found = recovering ? yield* read.pipe(Effect6.catch((cause) => Effect6.as(Effect6.logWarning(`${ask.fqn}: the interrupted create's row cannot locate its binary (${cause.message}); ` + "nothing is recovered, and the create is re-driven with the declaration as it is now"), undefined))) : yield* read;
+  return found === undefined ? undefined : Unowned2(found);
+});
+
+// src/release/declared-pins.ts
+import { Stack as Stack4 } from "alchemy/Stack";
+import * as Effect7 from "effect/Effect";
+import * as Option5 from "effect/Option";
+var declaredPinProblems = (fqn) => Effect7.gen(function* () {
+  const stack = yield* Effect7.serviceOption(Stack4);
+  if (Option5.isNone(stack))
+    return [];
+  const declared = stack.value.resources[fqn]?.Props;
+  if (typeof declared !== "object" && typeof declared !== "function")
+    return [];
+  if (declared === null)
+    return [];
+  return pinProblems(declared).map((problem) => `as declared in the stack program, ${problem}`);
+});
+
+// src/release/download.ts
+import * as Effect8 from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+var failed = (message, retryable) => new DownloadFailed({ message, retryable });
+var attempt = (url, size) => Effect8.gen(function* () {
+  const client = yield* HttpClient.HttpClient;
+  const response = yield* client.get(url);
+  if (response.status !== 200) {
+    return yield* failed(`${url}: HTTP ${String(response.status)}`, response.status >= 500);
+  }
+  const archive = new Uint8Array(size);
+  let total = 0;
+  yield* Stream.runForEach(response.stream, (chunk) => {
+    if (total + chunk.length > size) {
+      return Effect8.fail(failed(`${url}: runs past the pinned ${String(size)} bytes`, false));
+    }
+    archive.set(chunk, total);
+    total += chunk.length;
+    return Effect8.void;
+  });
+  if (total !== size) {
+    return yield* failed(`${url}: ${String(total)} bytes, the pin says ${String(size)}`, true);
+  }
+  return archive;
+}).pipe(Effect8.catchTag("HttpClientError", (cause) => Effect8.fail(failed(cause.message, true))));
+var downloadPinned = (url, size, policy = {}) => attempt(url, size).pipe(Effect8.timeoutOrElse({
+  duration: policy.timeout ?? "10 minutes",
+  orElse: () => Effect8.fail(failed(`${url}: no complete response in time`, false))
+}), Effect8.retry({
+  schedule: Schedule.spaced(policy.spacing ?? "2 seconds"),
+  times: policy.retries ?? 2,
+  while: (error) => error.retryable
+}));
+var httpFetchArchive = (client, policy = {}) => (url, size) => Effect8.runPromise(downloadPinned(url, size, policy).pipe(Effect8.provideService(HttpClient.HttpClient, client)));
+var sharingInFlight = (fetch) => {
+  const inFlight = new Map;
+  return (url, size) => {
+    const key = `${String(size)} ${url}`;
+    const running = inFlight.get(key);
+    if (running !== undefined)
+      return running;
+    const started = fetch(url, size).finally(() => inFlight.delete(key));
+    inFlight.set(key, started);
+    return started;
+  };
+};
+
+// src/release/binary.ts
+var ReleaseBinary = Resource("Release.Binary");
+var makeReleaseBinaryProvider = (internals = {}) => Provider.effect(ReleaseBinary, Effect9.gen(function* () {
+  const runner = yield* HostRunnerService;
+  const client = yield* HttpClient3.HttpClient;
+  const fetch = sharingInFlight(httpFetchArchive(client, internals.download));
+  const claims = new Map;
+  const claim = (fqn, props) => {
+    const path = releaseBinaryPath(props);
+    const holder = claims.get(path);
+    if (holder !== undefined && holder !== fqn) {
+      throw refuse2(path, `is already installed by ${holder} in this deploy; declare each binary path once, ` + `and let every job that runs it share that one resource. ${NOTHING}`);
+    }
+    claims.set(path, fqn);
+  };
+  return ReleaseBinary.Provider.of({
+    list: () => Effect9.succeed([]),
+    read: ({ fqn, instanceId, olds, output }) => output === undefined ? readWithoutState(runner, { fqn, instanceId, olds }) : lift(() => refreshBinary(runner, output)),
+    diff: ({ instanceId, news, olds, output }) => output === undefined ? noteUnfinished(instanceId) : lift(() => diffBinary(runner, news, olds, output)),
+    reconcile: ({ fqn, instanceId, news, olds, output, session }) => Effect9.gen(function* () {
+      const declared = yield* declaredPinProblems(fqn);
+      const adopt = yield* adoptsAtApply({ fqn, instanceId, output });
+      return yield* lift(async () => {
+        claim(fqn, news);
+        return reconcileBinary(runner, fetch, news, {
+          adopt,
+          declared,
+          note: (message) => Effect9.runPromise(session.note(message)),
+          olds,
+          output
+        });
+      });
+    }),
+    delete: ({ fqn, output, session }) => lift(async () => {
+      const holder = claims.get(output.path);
+      if (holder !== undefined && holder !== fqn) {
+        await Effect9.runPromise(session.note(`${output.path} was installed by ${holder} in this deploy; kept`));
+        return;
+      }
+      await deleteBinary(runner, output);
+      if (holder === fqn)
+        claims.delete(output.path);
+    })
+  });
+}));
+var ReleaseBinaryProvider = () => makeReleaseBinaryProvider();
+// src/release/catalog.ts
+var quoted = (names) => [...names].map((n) => `"${n}"`).join(", ");
+var has = (record, key) => Object.hasOwn(record, key);
+var memberDigest = (archive, member) => {
+  const vendor = has(archive.members, member) ? archive.members[member] : undefined;
+  const computed = archive.computed !== undefined && has(archive.computed, member) ? archive.computed[member]?.sha256 : undefined;
+  if (vendor !== undefined && computed !== undefined)
+    return "both";
+  return vendor ?? computed;
+};
+var catalogProblems = (catalog, request) => {
+  const entry = has(catalog.packages, request.package) ? catalog.packages[request.package] : undefined;
+  if (entry === undefined) {
+    return [
+      `${catalog.vendor} package "${request.package}" is not in the catalog (${quoted(Object.keys(catalog.packages))})`
+    ];
+  }
+  const found = [];
+  if (!has(entry.binaries, request.binary)) {
+    const member = Object.values(entry.binaries).includes(request.binary);
+    const hint = member ? " (that is the archive member; name the installed binary)" : "";
+    found.push(`${request.package} has no binary "${request.binary}"${hint}; it has ${quoted(Object.keys(entry.binaries))}`);
+  }
+  const platforms = has(entry.versions, request.version) ? entry.versions[request.version] : undefined;
+  if (platforms === undefined) {
+    found.push(`${request.package} ${request.version} is not in the catalog (it pins ${quoted(Object.keys(entry.versions))}); ` + "a new version is a reviewed change that pins its digests, never a download of whatever is there");
+    return found;
+  }
+  const archive = has(platforms, request.platform) ? platforms[request.platform] : undefined;
+  if (archive === undefined) {
+    found.push(`${request.package} ${request.version} is not pinned for platform "${request.platform}" (${quoted(Object.keys(platforms))})`);
+  } else if (found.length === 0) {
+    const member = entry.binaries[request.binary] ?? "";
+    const digest = memberDigest(archive, member);
+    if (digest === "both") {
+      found.push(`${request.package} ${request.version}'s member "${member}" is pinned twice — once as a ` + "vendor digest and once as a computed one; a member has exactly one owner");
+    } else if (digest === undefined) {
+      found.push(`${request.package} ${request.version} pins no digest for member "${member}" (checked ` + "the vendor checksum file and any computed record)");
+    }
+  }
+  return found;
+};
+var catalogBinary = (catalog, request) => {
+  const problems = catalogProblems(catalog, request);
+  const own = (record, key) => record !== undefined && has(record, key) ? record[key] : undefined;
+  const entry = own(catalog.packages, request.package);
+  const archive = own(own(entry?.versions, request.version), request.platform);
+  const member = own(entry?.binaries, request.binary);
+  const digest = member === undefined || archive === undefined ? undefined : memberDigest(archive, member);
+  const sha256 = digest === "both" ? undefined : digest;
+  if (problems.length > 0 || archive === undefined || member === undefined || sha256 === undefined) {
+    throw new BinaryRefused({
+      message: `Release.Binary ${request.binary}: ${problems.join("; ")}. Nothing was fetched.`
+    });
+  }
+  const { asset, repo, sha256: archiveSha256, size, tag } = archive;
+  return {
+    archive: { asset, repo, sha256: archiveSha256, size, tag },
+    member,
+    name: request.binary,
+    sha256
+  };
+};
+var catalogDirectory = (root, request) => `${root}/${request.package}-${request.version}`;
+var identifyBinary = (catalogs, sha256) => {
+  for (const catalog of catalogs) {
+    for (const [pkg, entry] of Object.entries(catalog.packages)) {
+      for (const [version, platforms] of Object.entries(entry.versions)) {
+        for (const [platform, archive] of Object.entries(platforms)) {
+          for (const [binary, member] of Object.entries(entry.binaries)) {
+            const digest = memberDigest(archive, member);
+            if (digest !== "both" && digest === sha256) {
+              return { binary, package: pkg, platform, vendor: catalog.vendor, version };
+            }
+          }
+        }
+      }
+    }
+  }
+  return;
+};
+// src/release/openbao.ts
+var RECORDED = "2026-09-23";
+var REPO2 = "openbao/openbao";
+var TAG = "v2.6.2";
+var DOWNLOAD = `https://github.com/${REPO2}/releases/download/${TAG}`;
+var OPENBAO_RELEASES = {
+  packages: {
+    openbao: {
+      binaries: { bao: "bao" },
+      versions: {
+        "2.6.2": {
+          darwin_arm64: {
+            asset: "openbao_2.6.2_darwin_arm64.tar.gz",
+            checksums: {
+              recorded: RECORDED,
+              sha256: "3d4a19fdc54a86fd94ce59ea91316dbf4304180bb27ae818e78e85c7f2164645",
+              signature: {
+                kind: "openpgp",
+                key: {
+                  fingerprint: "66D15FDD87287219C8E15478D200CD702853E6D0",
+                  sha256: "1862a196422947124282e026ea4e09d6f7c5d383b628d90c17906936e6e5a8e0",
+                  url: "https://openbao.org/assets/openbao-gpg-pub-20240618.asc"
+                },
+                sha256: "40f294d642a2b4e9adac766ca6b8b2633e15b3dbfdf63969dedbf46d94df53e8",
+                url: `${DOWNLOAD}/checksums.txt.gpgsig`,
+                verified: RECORDED
+              },
+              url: `${DOWNLOAD}/checksums.txt`
+            },
+            computed: {
+              bao: {
+                recorded: RECORDED,
+                sha256: "d476d17e81a35e6d70dd7e86a8ab2a3664313525118f1f1cfe0130e7a2b95f3a"
+              }
+            },
+            members: {},
+            repo: REPO2,
+            sha256: "4e495376174accc0e014d31e9901f518a974f966850c839f626347eaac05fd52",
+            size: 76833570,
+            tag: TAG
+          }
+        }
+      }
+    }
+  },
+  vendor: "OpenBao"
+};
+// src/release/providers.ts
+import * as Layer2 from "effect/Layer";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+var releaseProviders = (runner) => ReleaseBinaryProvider().pipe(Layer2.provide(Layer2.mergeAll(hostRunnerLayer(runner), FetchHttpClient.layer)));
+// src/release/victoria.ts
+var RECORDED2 = "2026-09-22";
+var DOWNLOAD2 = "https://github.com/VictoriaMetrics";
+var VICTORIA_RELEASES = {
+  packages: {
+    "victoria-logs": {
+      binaries: { "victoria-logs": "victoria-logs-prod" },
+      versions: {
+        "1.52.0": {
+          "darwin-arm64": {
+            asset: "victoria-logs-darwin-arm64-v1.52.0.tar.gz",
+            checksums: {
+              recorded: RECORDED2,
+              sha256: "d4ca686c3cceec78a0f4e733ef9ab3f857549131ea48cd6f89f701cda406ac4b",
+              url: `${DOWNLOAD2}/VictoriaLogs/releases/download/v1.52.0/victoria-logs-darwin-arm64-v1.52.0_checksums.txt`
+            },
+            members: {
+              "victoria-logs-prod": "9e48809e314902782959b3a4e683a3087476759d0293791a0564921c676ca7be"
+            },
+            repo: "VictoriaMetrics/VictoriaLogs",
+            sha256: "3157d4b6181d8a7e3e30918e2cbfcd4cc4cb66263e3ef21ea91e4f20f8980883",
+            size: 10943697,
+            tag: "v1.52.0"
+          }
+        }
+      }
+    },
+    "victoria-metrics": {
+      binaries: { "victoria-metrics": "victoria-metrics-prod" },
+      versions: {
+        "1.151.0": {
+          "darwin-arm64": {
+            asset: "victoria-metrics-darwin-arm64-v1.151.0.tar.gz",
+            checksums: {
+              recorded: RECORDED2,
+              sha256: "735745ee0e7b2d5b8118883f2d0ed124c2a12d70261c16380128f5e362566d1e",
+              url: `${DOWNLOAD2}/VictoriaMetrics/releases/download/v1.151.0/victoria-metrics-darwin-arm64-v1.151.0_checksums.txt`
+            },
+            members: {
+              "victoria-metrics-prod": "3c493a95ac1e9034a3261b230c4d62f3b186a04aafcdbacc99bfc110dc5de6a1"
+            },
+            repo: "VictoriaMetrics/VictoriaMetrics",
+            sha256: "8792437c4c0b63719fed7b44ad18d4b4167bbe6861ab3e84c7bb010c922e7582",
+            size: 12739105,
+            tag: "v1.151.0"
+          }
+        }
+      }
+    },
+    "victoria-traces": {
+      binaries: { "victoria-traces": "victoria-traces-prod" },
+      versions: {
+        "0.10.0": {
+          "darwin-arm64": {
+            asset: "victoria-traces-darwin-arm64-v0.10.0.tar.gz",
+            checksums: {
+              recorded: RECORDED2,
+              sha256: "cd32bfc21900b48ba543124e43827a1d13d735e45d50dbfd742c0ca6640e1aae",
+              url: `${DOWNLOAD2}/VictoriaTraces/releases/download/v0.10.0/victoria-traces-darwin-arm64-v0.10.0_checksums.txt`
+            },
+            members: {
+              "victoria-traces-prod": "4759ec89a466129b9eefc22244a111e1f489739340747805fd93b58fd0f7b2dd"
+            },
+            repo: "VictoriaMetrics/VictoriaTraces",
+            sha256: "cbe83f1d409cbb85fbf1c890c4a9b7fd34c1d74acec4dce2e0ebe46fcb260e38",
+            size: 11126077,
+            tag: "v0.10.0"
+          }
+        }
+      }
+    },
+    vmutils: {
+      binaries: {
+        vmagent: "vmagent-prod",
+        vmalert: "vmalert-prod",
+        "vmalert-tool": "vmalert-tool-prod",
+        vmauth: "vmauth-prod",
+        vmbackup: "vmbackup-prod",
+        vmctl: "vmctl-prod",
+        vmrestore: "vmrestore-prod"
+      },
+      versions: {
+        "1.151.0": {
+          "darwin-arm64": {
+            asset: "vmutils-darwin-arm64-v1.151.0.tar.gz",
+            checksums: {
+              recorded: RECORDED2,
+              sha256: "fda5a64fce9022bee7614c3fda27271c0826f1d7b90f8b162e1f48c77c0df04b",
+              url: `${DOWNLOAD2}/VictoriaMetrics/releases/download/v1.151.0/vmutils-darwin-arm64-v1.151.0_checksums.txt`
+            },
+            members: {
+              "vmagent-prod": "d3b6fa1f71ef48beac619f15f8adfa7610e76605caf37db1ebfbb379b6692329",
+              "vmalert-prod": "62845795167e9ff47890e83ac4ac5934693c105767db88591c95a08f3c4fb354",
+              "vmalert-tool-prod": "cbffb9495e4bb1457c9d45e0a7064b3a3a29b2cfd1ae24bfe8f00ec327c26998",
+              "vmauth-prod": "398df9e0f5b7035d037e39ee9ff66a10ddde5333d832602463aa4d2865fdb508",
+              "vmbackup-prod": "1974a2ee211b49bf581287808e010846f6c47ff135276214c6da628567777b9e",
+              "vmctl-prod": "998b111eee206b98e6d25fdf2fbaa455ecc17c7f9e7c3b2373e127cef762459f",
+              "vmrestore-prod": "fc824df7215b01b57921ed46afde7fea6b6698adf13d9ea8e3fe36e194ef8190"
+            },
+            repo: "VictoriaMetrics/VictoriaMetrics",
+            sha256: "27d68bac90e28929214091ed9d27f2e9fef25a080407e2c8661ea9b52dd6b183",
+            size: 123584800,
+            tag: "v1.151.0"
+          }
+        }
+      }
+    }
+  },
+  vendor: "VictoriaMetrics"
+};
+export {
+  ArchiveRefused,
+  BinaryRefused,
+  ChecksumMismatch,
+  DownloadFailed,
+  HostRunnerService,
+  OPENBAO_RELEASES,
+  ReleaseBinary,
+  ReleaseBinaryProvider,
+  VICTORIA_RELEASES,
+  catalogBinary,
+  catalogDirectory,
+  catalogProblems,
+  hostRunnerLayer,
+  identifyBinary,
+  releaseBinaryPath,
+  releaseProviders,
+  releaseUrl
+};
+
+//# debugId=95AC8419C10B267864756E2164756E21
+//# sourceMappingURL=index.js.map