@homeflare/alchemy 0.20.0 → 0.22.0

package/dist/proxmox/pbs-notification-target-form.d.ts

@@ -19,7 +19,7 @@
  */
 import type { PveForm } from './client.ts';
 import type { PbsNotificationTargetAttributes, PbsNotificationTargetProps } from './pbs-notification-target.ts';
-import { type Environment } from './write-only.ts';
+import { type Environment } from '../secrets/write-only.ts';
 type Props = PbsNotificationTargetProps;
 /**
  * Why this declaration cannot be written, or nothing. Checked at PLAN, so a webhook without a

package/dist/proxmox/pbs-notification-target-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pbs-notification-target-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-notification-target-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC3B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,KAAK,WAAW,EAAyC,MAAM,iBAAiB,CAAC;AAE1F,KAAK,KAAK,GAAG,0BAA0B,CAAC;AAkCxC;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,UAAW,KAAK,KAAG,MAAM,EAsB7C,CAAC;AAIF,sFAAsF;AACtF,eAAO,MAAM,aAAa,UAAW,KAAK,QAAO,WAAW;;;;;;;;;;;CAgB3D,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AAKvD,4FAA4F;AAC5F,eAAO,MAAM,YAAY,SAAU,+BAA+B,SAAS,KAAK,KAAG,OAagB,CAAC;AAEpG,eAAO,MAAM,WAAW,SAChB,+BAA+B,SAC9B,KAAK,UACJ,MAAM,KACb,UAKF,CAAC;AAEF,eAAO,MAAM,WAAW,SAChB,+BAA+B,SAC9B,KAAK,UACJ,MAAM,UACN,MAAM,KACb,UAMF,CAAC;AAEF,oFAAoF;AACpF,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAmCD;;;;;GAKG;AACH,eAAO,MAAM,UAAU,UACd,KAAK,UACJ,MAAM,SACP,KAAK,QACN,QAAQ,GAAG,QAAQ,KACxB,OAkBF,CAAC"}
+{"version":3,"file":"pbs-notification-target-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-notification-target-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC3B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,KAAK,WAAW,EAAyC,MAAM,0BAA0B,CAAC;AAEnG,KAAK,KAAK,GAAG,0BAA0B,CAAC;AAkCxC;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,UAAW,KAAK,KAAG,MAAM,EAsB7C,CAAC;AAIF,sFAAsF;AACtF,eAAO,MAAM,aAAa,UAAW,KAAK,QAAO,WAAW;;;;;;;;;;;CAgB3D,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AAKvD,4FAA4F;AAC5F,eAAO,MAAM,YAAY,SAAU,+BAA+B,SAAS,KAAK,KAAG,OAagB,CAAC;AAEpG,eAAO,MAAM,WAAW,SAChB,+BAA+B,SAC9B,KAAK,UACJ,MAAM,KACb,UAKF,CAAC;AAEF,eAAO,MAAM,WAAW,SAChB,+BAA+B,SAC9B,KAAK,UACJ,MAAM,UACN,MAAM,KACb,UAMF,CAAC;AAEF,oFAAoF;AACpF,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAmCD;;;;;GAKG;AACH,eAAO,MAAM,UAAU,UACd,KAAK,UACJ,MAAM,SACP,KAAK,QACN,QAAQ,GAAG,QAAQ,KACxB,OAkBF,CAAC"}

package/dist/proxmox/pbs-notification-target.d.ts

@@ -29,7 +29,7 @@
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import type { PveRequirements, WithPbsTarget } from './resource.ts';
-import type { FromEnv } from './write-only.ts';
+import type { FromEnv } from '../secrets/write-only.ts';
 export type PbsNotificationTargetType = 'sendmail' | 'smtp' | 'webhook';
 /**
  * ⚠️ PBS'S OWN KEY NAMES, DASHES INCLUDED, for the reason backup-job.ts gives. A field outside its

package/dist/proxmox/pbs-notification-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pbs-notification-target.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-notification-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAExE;;;;GAIG;AACH,MAAM,WAAW,0BAA2B,SAAQ,aAAa;IAC/D,6EAA6E;IAC7E,IAAI,EAAE,yBAAyB,CAAC;IAChC,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iEAAiE;IACjE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;IACvC,YAAY;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC;IACpD;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC5C;AAED,2EAA2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,yBAAyB,CAAC;IAChC,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAsB,SAAQ,QAAQ,CACrD,wBAAwB,EACxB,0BAA0B,EAC1B,+BAA+B,EAC/B,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,qBAAqB,wDAA4D,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,6BAA6B,2IAIvC,CAAC"}
+{"version":3,"file":"pbs-notification-target.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-notification-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAExE;;;;GAIG;AACH,MAAM,WAAW,0BAA2B,SAAQ,aAAa;IAC/D,6EAA6E;IAC7E,IAAI,EAAE,yBAAyB,CAAC;IAChC,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iEAAiE;IACjE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;IACvC,YAAY;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC;IACpD;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC5C;AAED,2EAA2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,yBAAyB,CAAC;IAChC,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAsB,SAAQ,QAAQ,CACrD,wBAAwB,EACxB,0BAA0B,EAC1B,+BAA+B,EAC/B,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,qBAAqB,wDAA4D,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,6BAA6B,2IAIvC,CAAC"}

package/dist/release/archive.d.ts

@@ -0,0 +1,11 @@
+import type { PinnedDownload } from './binary-form.ts';
+import { type TarContents } from './tar.ts';
+/** Gunzip and read a tar, keeping only `wanted`. Throws ArchiveRefused. */
+export declare const extractMembers: (gzipped: Uint8Array, wanted: ReadonlySet<string>) => Promise<TarContents>;
+/**
+ * The declared member's bytes out of a downloaded archive, both layers checked.
+ * ⚠️ `archive` may be shared with another resource's extraction (download.ts sharingInFlight):
+ *   this only reads it.
+ */
+export declare const verifiedMember: (archive: Uint8Array, release: PinnedDownload) => Promise<Uint8Array>;
+//# sourceMappingURL=archive.d.ts.map

package/dist/release/archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../src/release/archive.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,KAAK,WAAW,EAAa,MAAM,UAAU,CAAC;AAKvD,2EAA2E;AAC3E,eAAO,MAAM,cAAc,YAChB,UAAU,UACX,WAAW,CAAC,MAAM,CAAC,KAC1B,OAAO,CAAC,WAAW,CA8BrB,CAAC;AAUF;;;;GAIG;AACH,eAAO,MAAM,cAAc,YAChB,UAAU,WACV,cAAc,KACtB,OAAO,CAAC,UAAU,CAepB,CAAC"}

package/dist/release/binary-claim.d.ts

@@ -0,0 +1,53 @@
+/**
+ * What a Release.Binary may take over at a path it holds no state for: ONLY the pinned binary, and
+ * only under `--adopt`. Asked the same way at plan (binary-diff.ts) and at apply
+ * (binary-lifecycle.ts), so a plan never says `adopted` or `create` for a file the apply would then
+ * overwrite or silently claim.
+ *
+ * ⛔ OTHER BYTES ARE NEVER ADOPTED, `--adopt` OR NOT. 🔴 MEASURED 2026-09-22 (adopt-parity.test.ts,
+ *   through Alchemy's own Plan and Apply): under `--adopt`, a file with other bytes at the path
+ *   planned as `adopted` — beta.79 forces an `adopted` update after every takeover and prints it for
+ *   drift too — and the apply downloaded the archive and overwrote that file in place. With the
+ *   directory an Output (the probe skipped) the same file planned as `create`, and was overwritten.
+ *   ★ Refused rather than converged, which is what Host.File does with a file it adopts: a binary's
+ *   content is named entirely by its pin, so "adopting" other bytes is replacing them under
+ *   whatever runs them, with no rollback but a re-download — the very overwrite binary-form.ts
+ *   inPlaceRefusal refuses for a re-pin. The pinned bytes with another mode or owner ARE adopted;
+ *   the apply re-writes the bytes already on disk.
+ * ⛔ THE PINNED BYTES WITH NO STATE ARE NOT OURS WITHOUT `--adopt` — AT APPLY AS AT PLAN. The probe
+ *   already says `Unowned` for them (docs/ownership.md: identical is not ours). file-converge.ts
+ *   accepts them at apply as the resume of an interrupted install, and that gap is where the probe
+ *   never runs: every first deploy that passes `directory: dir.path`. 🔴 MEASURED 2026-09-22: a
+ *   declaration renamed (a new logical id, the same path) in a deploy that also changed its
+ *   HostDirectory's mode claimed the identical file at apply without `--adopt`; the orphan delete of
+ *   the old name then removed it, and the deploy reported success with the binary gone. With the
+ *   directory unchanged, the probe refused that same rename.
+ *   ⚠️ THE COST: an install interrupted between its write and its commit while a prop was an
+ *   Output now resumes only with `--adopt` — as the same install with every prop resolved already
+ *   did (its recovery read is `Unowned`), and as ownership.md says a create or replace interrupted
+ *   while a prop was an Output does. A retained old version is not re-claimed by a rollback either.
+ *   ★ `renamedFrom()` IS THE REMEDY FOR A RENAME: `.pipe(renamedFrom('old-id'))` migrates the row
+ *   and keeps the file (adopt-parity.test.ts). 🔴 MEASURED 2026-09-22: the same rename under
+ *   `--adopt` claimed the file, the old name's delete then removed it, and the deploy succeeded
+ *   with the binary gone. binary.ts's delete now leaves a path another declaration installed in
+ *   the same deploy, so that is kept too — as an adoption, not as the old row. ⚠️ That guard sees
+ *   only this deploy's claims, by spelling; nothing here sees another row's claim in state.
+ * ★ HOW DIFF TELLS A TAKEOVER FROM ITS OWN ROW. Every row this resource commits records the digest
+ *   reconcile READ BACK, which it checked equal to the pin — so `output.sha256 === olds.sha256` for
+ *   every row of its own, and an update never changes the digest (a new digest is a new path, a
+ *   `replace`). The engine hands diff anything else only after a read of a path it holds no state
+ *   for: the adoption probe (`olds` = the declaration) or the recovery read of an interrupted
+ *   create (`olds` = its row). A non-file reads with digest '' (file-converge.ts).
+ */
+import { type FileTarget } from '../launchd/file-converge.ts';
+import type { HostRunner } from '../launchd/runner.ts';
+/** Plan side: why diff must refuse `found` — a digest read at a path with no state — or undefined. */
+export declare const adoptionProblem: (found: string, pinned: string) => string | undefined;
+/**
+ * Apply side, for a reconcile with no `output` — a create, a replace's new generation, or the
+ * resume of either: why it must not write, or undefined. `adopt` is adoptsAtApply's answer (never
+ * true for a fresh replace). A symlink or directory is left to convergeFile, which refuses it by
+ * kind.
+ */
+export declare const claimProblem: (runner: HostRunner, want: FileTarget, adopt: boolean) => Promise<string | undefined>;
+//# sourceMappingURL=binary-claim.d.ts.map

package/dist/release/binary-claim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-claim.d.ts","sourceRoot":"","sources":["../../src/release/binary-claim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,KAAK,UAAU,EAAsB,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AASvD,sGAAsG;AACtG,eAAO,MAAM,eAAe,UAAW,MAAM,UAAU,MAAM,KAAG,MAAM,GAAG,SACA,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,YAAY,WACf,UAAU,QACZ,UAAU,SACT,OAAO,KACb,OAAO,CAAC,MAAM,GAAG,SAAS,CAc5B,CAAC"}

package/dist/release/binary-diff.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Release.Binary's plan-time answer: refuse what the plan can already see is wrong, `replace` when
+ * the binary's identity moves, and otherwise compare the live file with the declaration.
+ *
+ * ⛔ THE PINS MUST BE PLAIN VALUES, AND ARE CHECKED EVEN WHILE `directory` IS AN OUTPUT. A pin that
+ *   is an Output would be computed during the deploy — a fetch by another name — so a malformed or
+ *   non-literal pin fails the plan here, before a byte is fetched, whatever else is unresolved.
+ *   ⚠️ A CREATE IS NEVER DIFFED: the engine plans a first deploy without calling diff, and skips
+ *   the adoption probe while any prop is an Output. A pin wired from another resource's Output on
+ *   a FIRST deploy therefore reaches no plan-time check; reconcile refuses it before any host call
+ *   or request, from the props as the stack program declared them (declared-pins.ts). 🔴 Until
+ *   2026-09-22 it was checked there for shape only, and a swapped archive with swapped digests
+ *   installed (apply-pins.test.ts).
+ * ⛔ A NEW PIN IS A NEW PATH (binary-form.ts inPlaceRefusal). When the path is resolved and
+ *   unchanged, a changed pin is refused here; when it is resolved and new, it is a `replace`.
+ * ⚠️ WHILE THE DIRECTORY IS STILL AN OUTPUT the path is unknown, and the answer depends on whether
+ *   the BYTES move, because the path may turn out not to have:
+ *   - other bytes (or another name) → `replace`. If the path did not move after all, the new
+ *     generation's create finds the old file, which does not hold its bytes, and refuses
+ *     (file-converge.ts never overwrites what a generation does not own).
+ *   - the same bytes from another archive (a re-pin, a repack) → `update`, NEVER `replace`. 🔴 A
+ *     replace onto the same path would accept the old file as its own (same bytes, same mode) and
+ *     then Phase 2 would delete the OLD generation — at that same path, taking the new one's file
+ *     with it. An update reaches reconcile with `olds`, whose in-place guard refuses the same path,
+ *     and whose move (file-converge.ts) writes the new path before removing the old.
+ *   ★ Not the engine's default either way: a changed prop is an update by default, which is
+ *   exactly the in-place overwrite this resource refuses.
+ * ★ Create-before-delete: two versions can sit in two directories at once, so nothing forces
+ *   `deleteFirst`; the old file goes only once the new one is written and verified.
+ * ⚠️ HOUSE, NOT UPSTREAM: this reads the live file at plan time and can answer `noop`. Upstream's
+ *   guidance is a diff that rarely does either (docs/release-binary-upstream.md).
+ */
+import { type Diff } from 'alchemy/Diff';
+import type { Input } from 'alchemy/Input';
+import type { HostRunner } from '../launchd/runner.ts';
+import { type ReleaseBinaryAttributes, type ReleaseBinaryProps } from './binary-form.ts';
+export declare const diffBinary: (runner: HostRunner, news: Input<ReleaseBinaryProps>, olds: ReleaseBinaryProps, output: ReleaseBinaryAttributes) => Promise<Diff | undefined>;
+//# sourceMappingURL=binary-diff.d.ts.map

package/dist/release/binary-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-diff.d.ts","sourceRoot":"","sources":["../../src/release/binary-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,KAAK,IAAI,EAAc,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAG3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAIxB,MAAM,kBAAkB,CAAC;AAG1B,eAAO,MAAM,UAAU,WACb,UAAU,QACZ,KAAK,CAAC,kBAAkB,CAAC,QACzB,kBAAkB,UAChB,uBAAuB,KAC9B,OAAO,CAAC,IAAI,GAAG,SAAS,CAoB1B,CAAC"}

package/dist/release/binary-form.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Release.Binary's props, attributes and validation — the pure half of the provider.
+ *
+ * ★ THE PINNED ARCHIVE IS A PROP, NOT A LOOKUP. Repository, tag, exact asset name, size, the
+ *   archive's SHA-256, the member and the member's SHA-256 all arrive as props — usually spread from
+ *   a vendor data set (victoria.ts) by `catalogBinary()`. So the resource knows no vendor at all: a
+ *   second vendor is a second data module, never a change here, and the resource is the shape
+ *   Alchemy could accept (docs/release-binary-upstream.md).
+ * ⛔ NOTHING ESTATE-SPECIFIC IS A CONSTANT HERE. The install directory, owner, group and mode are
+ *   the consuming stack's props. A stack that keeps binaries under `/opt/<estate>/obs/bin` says so
+ *   in its own code.
+ * ⛔ EVERY PIN IS REQUIRED, AND WELL-FORMED OR REFUSED. There is no "latest", no optional digest and
+ *   no fallback to a checksum file fetched at apply — see victoria.ts for why a pin beats a fetch.
+ */
+import type { HostFileAttributes } from '../launchd/host-file-form.ts';
+/** One release archive, pinned: where it is published, and the bytes it must be. */
+export interface ReleaseArchive {
+    /** The GitHub repository that publishes it, `owner/name`: `'VictoriaMetrics/VictoriaMetrics'`. */
+    readonly repo: string;
+    /** The release tag, exactly as published: `'v1.151.0'`. */
+    readonly tag: string;
+    /**
+     * The asset's file name, whole: `'vmutils-darwin-arm64-v1.151.0.tar.gz'`. ⛔ Never a prefix or a
+     * pattern — `-enterprise` and `-cluster` siblings share every prefix with it.
+     */
+    readonly asset: string;
+    /** Bytes, per the release API. A download that runs past this is cut off and refused. */
+    readonly size: number;
+    /** The archive's SHA-256, lower-case hex, as the vendor's checksum file lists it. */
+    readonly sha256: string;
+}
+export interface ReleaseBinaryProps {
+    /** The pinned archive the binary comes out of. `catalogBinary()` fills it from a data set. */
+    archive: ReleaseArchive;
+    /** The archive member to extract, by its exact name: `'vmalert-prod'`. Nothing else is unpacked. */
+    member: string;
+    /** The member's own SHA-256 — what the installed file must hash to. */
+    sha256: string;
+    /**
+     * The installed file name: `'vmalert'`. ★ Separate from `member` on purpose — VictoriaMetrics
+     * names every member `<binary>-prod`, and a job's argv[0] should not carry that.
+     */
+    name: string;
+    /**
+     * The directory the binary is written into. ⛔ It must already exist — declare it with
+     * `HostDirectory` and pass that resource's `path`, which also orders it first. ★ Give each
+     * version its own directory (`catalogDirectory()`): an upgrade is then a new path — a
+     * create-before-delete replace, never an overwrite under a running daemon — and a rollback is a
+     * path. A new pin at the SAME path is refused (binary-diff.ts).
+     */
+    directory: string;
+    /**
+     * Permission bits. ⛔ Owner-readable and -executable, never group- or world-writable, never
+     * setuid, setgid or sticky — a writable binary is whoever-can-write's code, run as whoever runs
+     * the daemon. Its directory must not be group- or world-writable either (binary-lifecycle.ts).
+     * @default 0o755
+     */
+    mode?: number;
+    /** User name or numeric uid. Omitted: whoever the runner writes as. */
+    owner?: string | number;
+    /** Group name or numeric gid. Omitted: the directory's default group. */
+    group?: string | number;
+}
+export interface ReleaseBinaryAttributes extends HostFileAttributes {
+    /** The archive the bytes came from, whole. */
+    url: string;
+    /** The archive member installed, by its exact name: `vmalert-prod`. */
+    member: string;
+}
+/** Everything a download and its two checks need: one archive, one member, both digests. */
+export type PinnedDownload = {
+    readonly url: string;
+    readonly size: number;
+    /** The archive's pinned SHA-256. */
+    readonly sha256: string;
+    /** The archive member to extract, by exact name. */
+    readonly member: string;
+    /** The member's pinned SHA-256. */
+    readonly memberSha256: string;
+};
+export declare const DEFAULT_BINARY_MODE = 493;
+/**
+ * The release-asset URL. ★ GITHUB'S DOWNLOAD PATH, NOT THE API: it needs no token and spends no rate
+ *   limit (it redirects to a signed CDN URL — measured 2026-09-22 with HEAD). Every consumer the
+ *   estate census found publishes on GitHub except Grafana (grafana.com), which is not a
+ *   single-binary consumer anyway (docs/release-binary-catalogs.md). A second source kind arrives
+ *   with its first consumer, not before.
+ */
+export declare const releaseUrl: (repo: string, tag: string, asset: string) => string;
+/** Where a declaration puts its binary: `<directory>/<name>`. */
+export declare const releaseBinaryPath: (props: {
+    readonly directory: string;
+    readonly name: string;
+}) => string;
+/** The download a declaration means. ⚠️ Validate first (binaryProblems): this trusts its input. */
+export declare const pinnedDownload: (props: ReleaseBinaryProps) => PinnedDownload;
+export declare const modeProblems: (mode: number) => string[];
+export declare const MAX_ARCHIVE: number;
+/** Everything wrong with the pins alone — plain strings in any declaration, resolved or not. */
+export declare const pinProblems: (props: {
+    readonly archive?: Partial<ReleaseArchive>;
+    readonly member?: unknown;
+    readonly sha256?: unknown;
+    readonly name?: unknown;
+}) => string[];
+type Pins = Pick<ReleaseBinaryProps, 'archive' | 'member' | 'sha256'>;
+/** Whether two declarations pin different bytes: another archive, member or member digest. */
+export declare const pinsMoved: (olds: Pins, news: Pins) => boolean;
+/**
+ * ⛔ A NEW PIN IS A NEW PATH. The same path with other bytes would overwrite a binary under the
+ *   daemon running it, and leave no rollback but a re-download — so it is refused, at plan when the
+ *   path is resolved (binary-diff.ts) and at apply otherwise (binary-lifecycle.ts).
+ */
+export declare const inPlaceRefusal: (olds: Pins, news: Pins) => string;
+/** Everything wrong with a declaration, before any host or network is asked anything. */
+export declare const binaryProblems: (props: ReleaseBinaryProps) => string[];
+export {};
+//# sourceMappingURL=binary-form.d.ts.map

package/dist/release/binary-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-form.d.ts","sourceRoot":"","sources":["../../src/release/binary-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGvE,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,8FAA8F;IAC9F,OAAO,EAAE,cAAc,CAAC;IACxB,oGAAoG;IACpG,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,mBAAmB,MAAQ,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,SAAU,MAAM,OAAO,MAAM,SAAS,MAAM,KAAG,MACN,CAAC;AAEjE,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,UAAW;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,KAAG,MAA4C,CAAC;AAEjD,mGAAmG;AACnG,eAAO,MAAM,cAAc,UAAW,kBAAkB,KAAG,cAMzD,CAAC;AAEH,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,MAAM,EAUjD,CAAC;AAGF,eAAO,MAAM,WAAW,QAAU,CAAC;AAcnC,gGAAgG;AAChG,eAAO,MAAM,WAAW,UAAW;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB,KAAG,MAAM,EAqDT,CAAC;AAIF,KAAK,IAAI,GAAG,IAAI,CAAC,kBAAkB,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC;AAEtE,8FAA8F;AAC9F,eAAO,MAAM,SAAS,SAAU,IAAI,QAAQ,IAAI,KAAG,OAGkB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,cAAc,SAAU,IAAI,QAAQ,IAAI,KAAG,MAGqB,CAAC;AAE9E,yFAAyF;AACzF,eAAO,MAAM,cAAc,UAAW,kBAAkB,KAAG,MAAM,EAMhE,CAAC"}

package/dist/release/binary-lifecycle.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Release.Binary's read / reconcile / delete as plain async functions over a HostRunner and a
+ * FetchArchive, so the lifecycle runs against fakes of both in tests. (diff: binary-diff.ts.)
+ *
+ * ⛔ ONE WRITER. The verified bytes reach the host through file-converge.ts — the path Host.File's
+ *   bytes take — and so through `HostRunner.writeFileAtomic` alone: a temp file in the same
+ *   directory, mode and owner set, rename. Under sudoRunner that is its staged `install -S`.
+ *   Nothing here opens a file, spawns `tar`, or stages a download on disk.
+ * ★ REFUSE BEFORE TOUCHING ANYTHING. Validation runs before the first host call, the host checks
+ *   run before the first download, and the digest checks run before the one write — so every
+ *   refusal but a failed read-back can say "Nothing was written."
+ * ★ AN INSTALLED BINARY IS RECOGNISED BY ITS DIGEST. A file whose SHA-256 is the pin needs no
+ *   download to confirm, and a mode or owner fix re-writes the bytes already on disk.
+ */
+import { type FileTarget } from '../launchd/file-converge.ts';
+import type { HostRunner } from '../launchd/runner.ts';
+import { type PinnedDownload, type ReleaseBinaryAttributes, type ReleaseBinaryProps } from './binary-form.ts';
+import type { FetchArchive } from './download.ts';
+import { BinaryRefused } from './refused.ts';
+export declare const NOTHING = "Nothing was written.";
+export declare const refuse: (path: string, message: string) => BinaryRefused;
+export type Desired = {
+    readonly want: FileTarget;
+    readonly download: PinnedDownload;
+};
+/** Validate every prop, then resolve owner and group through the runner. */
+export declare const desiredBinary: (runner: HostRunner, props: ReleaseBinaryProps) => Promise<Desired>;
+/**
+ * The file at the declaration's path, or undefined when absent — the adoption probe's answer.
+ * ★ Its `sha256` is the digest of the bytes on disk, so a caller sees at once whether it is the
+ *   pinned binary (equal to `props.sha256`) without anything being executed.
+ */
+export declare const readBinary: (runner: HostRunner, props: ReleaseBinaryProps) => Promise<ReleaseBinaryAttributes | undefined>;
+/** An owned binary as it is now, at the path state recorded — no pins needed to find it. */
+export declare const refreshBinary: (runner: HostRunner, output: ReleaseBinaryAttributes) => Promise<ReleaseBinaryAttributes | undefined>;
+export type ReconcileOptions = {
+    /** The attributes state holds; undefined on a create. */
+    readonly output?: ReleaseBinaryAttributes | undefined;
+    /** The props state holds; undefined on a create and on an adoption. */
+    readonly olds?: ReleaseBinaryProps | undefined;
+    /** adoptsAtApply's answer. What it may take over is convergeFile's ⛔. @default false */
+    readonly adopt?: boolean;
+    /** Progress for the deploy log — the engine's `session.note`. */
+    readonly note?: (message: string) => Promise<void>;
+    /**
+     * What is wrong with the pins as the stack program DECLARED them (declared-pins.ts) — an Output
+     * there resolves to a plausible plain string by the time it reaches `props`. @default []
+     */
+    readonly declared?: readonly string[];
+};
+/** Install the declared binary unless it is already there, and return it as read back. */
+export declare const reconcileBinary: (runner: HostRunner, fetch: FetchArchive, props: ReleaseBinaryProps, options?: ReconcileOptions) => Promise<ReleaseBinaryAttributes>;
+/** Remove the binary. Idempotent. ⛔ Refuses a path that has since become a symlink or directory. */
+export declare const deleteBinary: (runner: HostRunner, output: ReleaseBinaryAttributes) => Promise<void>;
+//# sourceMappingURL=binary-lifecycle.d.ts.map

package/dist/release/binary-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-lifecycle.d.ts","sourceRoot":"","sources":["../../src/release/binary-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,KAAK,UAAU,EAKhB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGvD,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAMxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAkB,aAAa,EAAoC,MAAM,cAAc,CAAC;AAE/F,eAAO,MAAM,OAAO,yBAAyB,CAAC;AAE9C,eAAO,MAAM,MAAM,SAAU,MAAM,WAAW,MAAM,KAAG,aACe,CAAC;AAgBvE,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,CAAC;AAEvF,4EAA4E;AAC5E,eAAO,MAAM,aAAa,WAChB,UAAU,SACX,kBAAkB,KACxB,OAAO,CAAC,OAAO,CAOjB,CAAC;AAOF;;;;GAIG;AACH,eAAO,MAAM,UAAU,WACb,UAAU,SACX,kBAAkB,KACxB,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAI7C,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,aAAa,WAChB,UAAU,UACV,uBAAuB,KAC9B,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAG7C,CAAC;AAgCF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACtD,uEAAuE;IACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC/C,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,eAAe,WAClB,UAAU,SACX,YAAY,SACZ,kBAAkB,YAChB,gBAAgB,KACxB,OAAO,CAAC,uBAAuB,CA2CjC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,YAAY,WAAY,UAAU,UAAU,uBAAuB,KAAG,OAAO,CAAC,IAAI,CACtD,CAAC"}

package/dist/release/binary-read.d.ts

@@ -0,0 +1,11 @@
+import * as Effect from 'effect/Effect';
+import type { HostRunner } from '../launchd/runner.ts';
+type Ask = {
+    readonly fqn: string;
+    readonly instanceId: string;
+    readonly olds: unknown;
+};
+/** The file a declaration (or a row) names, as `Unowned` — or undefined when there is none. */
+export declare const readWithoutState: (runner: HostRunner, ask: Ask) => Effect.Effect<import("./binary-form.ts").ReleaseBinaryAttributes | undefined, Error, never>;
+export {};
+//# sourceMappingURL=binary-read.d.ts.map

package/dist/release/binary-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-read.d.ts","sourceRoot":"","sources":["../../src/release/binary-read.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAKvD,KAAK,GAAG,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzF,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB,WAAY,UAAU,OAAO,GAAG,gGAkBzD,CAAC"}

package/dist/release/binary.d.ts

@@ -0,0 +1,68 @@
+/**
+ * `Release.Binary` — one binary out of a pinned release archive, written onto a host and verified
+ * twice: the archive against its pinned SHA-256, then the binary against its own.
+ *
+ * - reconcile — validate every prop; download the archive by its exact URL; verify it; unpack ONLY
+ *   the declared member; verify that; write it atomically through the HostRunner; read it back. A
+ *   file already holding the pinned bytes is never downloaded again.
+ * - read — lstat plus the SHA-256 of the bytes; never runs the binary.
+ * - diff — the pins, the path, then mode and owner against the live file (binary-diff.ts).
+ * - replace — when the path moves (a new version is a new directory): create-before-delete.
+ * - delete — removes the file, never the directory.
+ *
+ * ★ VENDOR-NEUTRAL. The pinned archive arrives as props, usually from a data set beside this
+ *   (victoria.ts) through `catalogBinary()`; nothing here knows a vendor, a package or a version.
+ * ⛔ IT INSTALLS; IT NEVER STARTS. No launchctl, no systemctl, no restart: the job that runs the
+ *   binary is the stack's own `LaunchdJob`, which puts this resource's `path` in its argv so the
+ *   engine installs first and restarts the job when the path moves.
+ * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`, AT PLAN OR AT APPLY: the probe reads a file already at
+ *   the path as `Unowned` — even one holding exactly the pinned bytes (docs/ownership.md) — and
+ *   where the probe never ran (a prop was an Output) reconcile refuses it the same way. With
+ *   `--adopt`, a file holding the pinned bytes is recognised by its digest and taken over without
+ *   a download. ⛔ A file with OTHER bytes is never adopted, `--adopt` or not: that would be an
+ *   overwrite in place that the plan prints as `adopted` (binary-claim.ts, both halves).
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
+import { HostRunnerService } from '../launchd/runner.ts';
+import { type ReleaseBinaryAttributes, type ReleaseBinaryProps } from './binary-form.ts';
+import { type DownloadPolicy } from './download.ts';
+export type { ReleaseBinaryAttributes, ReleaseBinaryProps } from './binary-form.ts';
+export interface ReleaseBinary extends Resource<'Release.Binary', ReleaseBinaryProps, ReleaseBinaryAttributes> {
+}
+/**
+ * One binary from a pinned release archive, installed onto a host and verified against digests
+ * the stack pins in code — the archive's, then the binary's own.
+ *
+ * ### Installing a binary
+ *
+ * The directory is declared first and passed by its `path`, which orders the two; the job that
+ * runs the binary references the binary's `path`, which orders the job after it.
+ *
+ * **Example:**
+ *
+ * ```ts
+ * const vmalertOf = { package: 'vmutils', version: '1.151.0', platform: 'darwin-arm64', binary: 'vmalert' };
+ * const dir = yield* HostDirectory('vmutils-1.151.0', {
+ *   path: catalogDirectory('/opt/example/bin', vmalertOf),
+ *   mode: 0o755,
+ * });
+ * const vmalert = yield* ReleaseBinary('vmalert', {
+ *   ...catalogBinary(VICTORIA_RELEASES, vmalertOf),
+ *   directory: dir.path,
+ * });
+ * // LaunchdJob(…, { programArguments: [vmalert.path, '--httpListenAddr=127.0.0.1:8880'] })
+ * ```
+ *
+ * @resource
+ */
+export declare const ReleaseBinary: import("alchemy").ResourceClass<ReleaseBinary>;
+/** Test seams — NOT on the barrel. Every caller outside tests uses the defaults. */
+export type ReleaseBinaryInternals = {
+    readonly download?: DownloadPolicy;
+};
+export declare const makeReleaseBinaryProvider: (internals?: ReleaseBinaryInternals) => import("effect/Layer").Layer<Provider.Provider<ReleaseBinary>, never, HostRunnerService | HttpClient.HttpClient>;
+/** The provider, as a stack uses it. It needs a HostRunnerService and an HttpClient. */
+export declare const ReleaseBinaryProvider: () => import("effect/Layer").Layer<Provider.Provider<ReleaseBinary>, never, HostRunnerService | HttpClient.HttpClient>;
+//# sourceMappingURL=binary.d.ts.map

package/dist/release/binary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../src/release/binary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAIzD,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAAE,KAAK,cAAc,EAAqC,MAAM,eAAe,CAAC;AAEvF,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEpF,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,CACxB;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,aAAa,gDAA4C,CAAC;AAEvE,oFAAoF;AACpF,MAAM,MAAM,sBAAsB,GAAG;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAE,CAAC;AAE5E,eAAO,MAAM,yBAAyB,eAAe,sBAAsB,qHAyFxE,CAAC;AAEJ,wFAAwF;AACxF,eAAO,MAAM,qBAAqB,wHAAoC,CAAC"}

package/dist/release/catalog.d.ts

@@ -0,0 +1,113 @@
+/**
+ * A vendor's pinned releases as DATA, and the one way to turn an entry into Release.Binary props —
+ * or into the reasons there is none. Pure: no network, no host.
+ *
+ * ★ THE DATA SITS BESIDE THE RESOURCE, NOT INSIDE IT. A catalog (victoria.ts is the first) is the
+ *   reviewed record of what one vendor published: exact asset names, sizes, both digest layers and
+ *   where each was copied from. The resource takes one pinned archive as props and never reads a
+ *   catalog, so adding a vendor is a data module with its own walk-down, never a resource change.
+ * ★ A VERSION THE CATALOG DOES NOT LIST IS A REFUSAL, NOT A DOWNLOAD ATTEMPT. `catalogBinary()` runs
+ *   in the stack's own program — which `alchemy plan` evaluates — so an unknown version, a
+ *   `-enterprise` spelling or a `v` prefix fails the plan before any resource is asked anything,
+ *   let alone fetches a byte.
+ * ⛔ ADD A VENDOR ONLY AFTER ITS OWN WALK-DOWN (docs/release-binary-catalogs.md): its checksum
+ *   format read byte-exact, and its binary's linkage measured (`otool -L`). Vendor binaries were
+ *   measured self-contained ONLY for the five Victoria ones; that is not a property of "Go".
+ * ★ `computed` IS A SECOND, LESSER OWNER OF A MEMBER'S DIGEST — never the vendor's, always ours,
+ *   for a checksum file that never lists the member at all (OpenBao: archives and SBOMs only,
+ *   never `bao`; docs/release-binary-openbao.md is the walk-down). `checksums.signature` records
+ *   how the checksum file's OWN authorship was checked, if a vendor publishes one to check.
+ */
+import type { ReleaseArchive, ReleaseBinaryProps } from './binary-form.ts';
+/**
+ * A member digest WE computed, because the vendor's checksum file never lists it — read
+ * checksums.ts's header before adding one: most vendors list archives only.
+ */
+export interface ComputedDigest {
+    readonly sha256: string;
+    /** The date it was computed, from the archive whose pinned SHA-256 matched that day. */
+    readonly recorded: string;
+}
+/** How the checksum file itself was checked, beyond its own SHA-256 — openpgp today. */
+export interface ChecksumSignature {
+    readonly kind: 'openpgp';
+    /** The detached signature asset's URL. */
+    readonly url: string;
+    readonly sha256: string;
+    /** The public key it was checked against. */
+    readonly key: {
+        readonly url: string;
+        readonly sha256: string;
+        readonly fingerprint: string;
+    };
+    /** The date `gpgv` was run, recorded once — never re-run at apply or by CI. */
+    readonly verified: string;
+}
+/** One release archive as a catalog records it: the pin, plus where every digest came from. */
+export interface PinnedArchive extends ReleaseArchive {
+    /** Archive member → its SHA-256. Every member the vendor's checksum file lists, not just ours. */
+    readonly members: Readonly<Record<string, string>>;
+    /**
+     * Archive member → a digest WE computed, for a checksum file that never lists it (OpenBao's
+     * lists archives and SBOMs, never `bao`). ⛔ NOT A VENDOR FACT: computed from the bytes of an
+     * archive whose own SHA-256 already matched the pin, never filed beside `members`. A member in
+     * both is refused (catalogProblems) — two owners of one pin is a data-set bug, not a choice.
+     */
+    readonly computed?: Readonly<Record<string, ComputedDigest>>;
+    /** The checksum file the digests were copied from, its own SHA-256, and when. Never fetched. */
+    readonly checksums: {
+        readonly url: string;
+        readonly sha256: string;
+        readonly recorded: string;
+        /** How the checksum file's own authorship was checked, if at all. Optional: not every vendor publishes one. */
+        readonly signature?: ChecksumSignature;
+    };
+}
+/** One package (one archive per version and platform) of a vendor. */
+export interface CatalogPackage {
+    /**
+     * Installed name → archive member, written out, never derived: a member the vendor adds is
+     * installable only once somebody names it here.
+     */
+    readonly binaries: Readonly<Record<string, string>>;
+    /** Version (as the catalog spells it) → platform (the vendor's spelling) → archive. */
+    readonly versions: Readonly<Record<string, Readonly<Record<string, PinnedArchive>>>>;
+}
+/** A vendor's pinned releases. */
+export interface ReleaseCatalog {
+    /** Who publishes these, for refusals: `'VictoriaMetrics'`. */
+    readonly vendor: string;
+    readonly packages: Readonly<Record<string, CatalogPackage>>;
+}
+/** Which binary a stack asks a catalog for. */
+export type CatalogRequest = {
+    readonly package: string;
+    readonly version: string;
+    readonly platform: string;
+    /** The installed name — `vmalert`, not the member `vmalert-prod`. */
+    readonly binary: string;
+};
+/** The pinned half of Release.Binary's props; the stack adds `directory`, `mode` and owner. */
+export type PinnedBinary = Pick<ReleaseBinaryProps, 'archive' | 'member' | 'sha256' | 'name'>;
+/** Everything wrong with a request against a catalog; empty when it resolves. */
+export declare const catalogProblems: (catalog: ReleaseCatalog, request: CatalogRequest) => string[];
+/**
+ * The pinned props for one binary out of a catalog. ⛔ Throws BinaryRefused for anything the
+ * catalog does not pin — in a stack program, that fails the plan before anything is fetched.
+ */
+export declare const catalogBinary: (catalog: ReleaseCatalog, request: CatalogRequest) => PinnedBinary;
+/** `<root>/<package>-<version>`: one directory per version, so an upgrade is a new path. */
+export declare const catalogDirectory: (root: string, request: Pick<CatalogRequest, 'package' | 'version'>) => string;
+/** What a catalog says an installed binary is, found by its SHA-256 alone. */
+export type IdentifiedBinary = CatalogRequest & {
+    readonly vendor: string;
+};
+/**
+ * Name an installed file by its digest — never by running it. ★ IDENTITY BY SHA-256: the running
+ *   Nix victoria-traces reports an empty version (`vm_app_version{version=""}` on /metrics, measured
+ *   2026-09-22 — its build sets no buildinfo), a stamped build prints `-version` to STDERR, not
+ *   stdout (lib/buildinfo, read, not run), and executing a binary to learn what it is runs the very
+ *   bytes whose provenance is the question. A digest needs a read, nothing more.
+ */
+export declare const identifyBinary: (catalogs: readonly ReleaseCatalog[], sha256: string) => IdentifiedBinary | undefined;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/release/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/release/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3E;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9F,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7D,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+GAA+G;QAC/G,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;KACxC,CAAC;CACH;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;CACtF;AAED,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CAC7D;AAED,+CAA+C;AAC/C,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,+FAA+F;AAC/F,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC,CAAC;AAqB9F,iFAAiF;AACjF,eAAO,MAAM,eAAe,YAAa,cAAc,WAAW,cAAc,KAAG,MAAM,EAkDxF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,YAAa,cAAc,WAAW,cAAc,KAAG,YA4BhF,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB,SACrB,MAAM,WACH,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,SAAS,CAAC,KACnD,MAAyD,CAAC;AAE7D,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,aACf,SAAS,cAAc,EAAE,UAC3B,MAAM,KACb,gBAAgB,GAAG,SAgBrB,CAAC"}

package/dist/release/checksums.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A vendor checksum file in `sha256sum` text mode, parsed strictly — the shape every pin in
+ * victoria.ts was copied from.
+ *
+ * ★ WHY PARSE A FILE THE PROVIDER NEVER FETCHES. The pins are the ground truth at apply; this is
+ *   the ground truth when a pin is WRITTEN. victoria.test.ts feeds it the exact bytes of all four
+ *   recorded files (fixtures/victoria/, each matching GitHub's digest of that asset AS READ on the
+ *   recorded date — no test re-reads it) and requires the catalog to equal what it reads, so a pin
+ *   typed by hand, a line missed, or a member added by the vendor is a failing test rather than a
+ *   trusted typo.
+ * ⛔ STRICT, BECAUSE THE FORMAT IS KNOWN. Measured 2026-09-22 on all four files: `sha256sum` text
+ *   mode — `<64 lowercase hex><two spaces><name>` per line, LF endings, a trailing newline, the
+ *   archive on line 1 and one `-prod` member per line after it. Anything else (a `*` binary-mode
+ *   marker, CRLF, upper-case hex, a blank line, a repeated name) is a refusal: a file that no longer
+ *   has this shape is a vendor change to read before any pin moves, not something to guess past.
+ * ⚠️ ONE FORMAT, MEASURED FOR ONE VENDOR. Other vendors list archives only (Prometheus, vector,
+ *   pyroscope, OpenBao — the estate census, 2026-09-22) or publish digests in JSON (grafana.com). A
+ *   catalog for one of them reads ITS format byte-exact first; nothing here is assumed to fit it.
+ */
+/** Name → SHA-256, in file order. Throws, naming the line, on anything but the measured shape. */
+export declare const parseChecksums: (text: string) => ReadonlyMap<string, string>;
+//# sourceMappingURL=checksums.d.ts.map

package/dist/release/checksums.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checksums.d.ts","sourceRoot":"","sources":["../../src/release/checksums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,kGAAkG;AAClG,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAmBvE,CAAC"}

package/dist/release/declared-pins.d.ts

@@ -0,0 +1,4 @@
+import * as Effect from 'effect/Effect';
+/** Everything wrong with the pins of the resource at `fqn` as its stack program declared them. */
+export declare const declaredPinProblems: (fqn: string) => Effect.Effect<string[]>;
+//# sourceMappingURL=declared-pins.d.ts.map

package/dist/release/declared-pins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-pins.d.ts","sourceRoot":"","sources":["../../src/release/declared-pins.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,QAAS,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAUpE,CAAC"}