@homeflare/alchemy 0.27.4 → 0.29.0

package/dist/caddy/index.js

@@ -43,304 +43,134 @@ var accessForwardAuth = (props) => {
 import * as Context from "effect/Context";
 import * as Layer from "effect/Layer";
 
-class CaddyUnreachableError extends Error {
-  name = "CaddyUnreachableError";
-}
-
 class CaddyAdminService extends Context.Service()("homeflare/caddy/CaddyAdmin") {
 }
-var caddyAdminLayer = (admin) => Layer.succeed(CaddyAdminService, admin);
-// src/launchd/job-form.ts
-import { createHash } from "node:crypto";
-
-// src/launchd/plist.ts
-class PlistError extends Error {
-  path;
-  constructor(path, detail) {
-    super(`plist ${path === "" ? "(root)" : path}: ${detail}`);
-    this.path = path;
-    this.name = "PlistError";
-  }
-}
-var HEADER = `<?xml version="1.0" encoding="UTF-8"?>
-` + '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" ' + `"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-` + `<plist version="1.0">
-`;
-var MAX_DEPTH = 32;
-var FORBIDDEN = /[\x00-\x08\x0B\x0C\x0E-\x1F\uD800-\uDFFF\uFFFE\uFFFF]/u;
-var escapeText = (text, path) => {
-  const bad = FORBIDDEN.exec(text);
-  if (bad !== null) {
-    const code = bad[0].codePointAt(0) ?? 0;
-    throw new PlistError(path, `U+${code.toString(16).toUpperCase().padStart(4, "0")} cannot appear in XML 1.0`);
-  }
-  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\r", "&#13;");
-};
-var isPlainObject = (value) => {
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === null;
-};
-var renderValue = (value, path, depth, out) => {
-  const pad = "\t".repeat(depth);
-  if (depth > MAX_DEPTH)
-    throw new PlistError(path, `nested deeper than ${String(MAX_DEPTH)}`);
-  if (typeof value === "string") {
-    out.push(`${pad}<string>${escapeText(value, path)}</string>`);
-    return;
-  }
-  if (typeof value === "boolean") {
-    out.push(`${pad}<${value ? "true" : "false"}/>`);
-    return;
-  }
-  if (typeof value === "number") {
-    if (!Number.isSafeInteger(value)) {
-      throw new PlistError(path, `${String(value)} is not a safe integer (no <real> support)`);
-    }
-    out.push(`${pad}<integer>${String(value === 0 ? 0 : value)}</integer>`);
-    return;
-  }
-  if (Array.isArray(value)) {
-    if (value.length === 0) {
-      out.push(`${pad}<array/>`);
-      return;
-    }
-    out.push(`${pad}<array>`);
-    for (const [index, item] of value.entries()) {
-      renderValue(item, `${path}[${String(index)}]`, depth + 1, out);
-    }
-    out.push(`${pad}</array>`);
-    return;
-  }
-  if (typeof value === "object" && value !== null && isPlainObject(value)) {
-    renderDict(value, path, depth, out);
-    return;
-  }
-  const kind = value === null ? "null" : typeof value;
-  throw new PlistError(path, `${kind} has no plist form — omit the key instead`);
-};
-var renderDict = (dict, path, depth, out) => {
-  const pad = "\t".repeat(depth);
-  const keys = Object.keys(dict).sort();
-  if (keys.length === 0) {
-    out.push(`${pad}<dict/>`);
-    return;
-  }
-  out.push(`${pad}<dict>`);
-  for (const key of keys) {
-    const child = path === "" ? key : `${path}.${key}`;
-    out.push(`${pad}	<key>${escapeText(key, child)}</key>`);
-    renderValue(dict[key], child, depth + 1, out);
-  }
-  out.push(`${pad}</dict>`);
-};
-var renderPlist = (dict) => {
-  if (typeof dict !== "object" || dict === null || Array.isArray(dict) || !isPlainObject(dict)) {
-    throw new PlistError("", "the top level of a launchd plist must be a dict");
-  }
-  const out = [];
-  renderDict(dict, "", 0, out);
-  return `${HEADER}${out.join(`
-`)}
-</plist>
-`;
-};
-
-// src/launchd/job-form.ts
-var parseDomain = (domain) => {
-  if (domain === "system")
-    return { kind: "system" };
-  const match = /^gui\/(\d+)$/.exec(domain);
-  return match?.[1] === undefined ? undefined : { kind: "gui", uid: Number(match[1]) };
-};
-var serviceTarget = (label, domain) => `${domain}/${label}`;
-var plistPathFor = (label, domain, home) => {
-  if (domain.kind === "system")
-    return `/Library/LaunchDaemons/${label}.plist`;
-  if (home === undefined || !home.startsWith("/")) {
-    throw new Error(`gui/${String(domain.uid)}: no home directory for that uid on this host`);
-  }
-  return `${home}/Library/LaunchAgents/${label}.plist`;
-};
-var OWNED_KEYS = [
-  "EnvironmentVariables",
-  "GroupName",
-  "KeepAlive",
-  "Label",
-  "Program",
-  "ProgramArguments",
-  "RunAtLoad",
-  "StandardErrorPath",
-  "StandardOutPath",
-  "StartCalendarInterval",
-  "StartInterval",
-  "ThrottleInterval",
-  "UserName",
-  "WorkingDirectory"
-];
-var calendarDict = (entry) => {
-  const dict = {};
-  if (entry.minute !== undefined)
-    dict["Minute"] = entry.minute;
-  if (entry.hour !== undefined)
-    dict["Hour"] = entry.hour;
-  if (entry.day !== undefined)
-    dict["Day"] = entry.day;
-  if (entry.weekday !== undefined)
-    dict["Weekday"] = entry.weekday;
-  if (entry.month !== undefined)
-    dict["Month"] = entry.month;
-  return dict;
-};
-var keepAliveValue = (keepAlive) => {
-  if (typeof keepAlive === "boolean")
-    return keepAlive;
-  const dict = {};
-  if (keepAlive.successfulExit !== undefined)
-    dict["SuccessfulExit"] = keepAlive.successfulExit;
-  if (keepAlive.crashed !== undefined)
-    dict["Crashed"] = keepAlive.crashed;
-  return dict;
-};
-var jobPlistDict = (props) => {
-  const dict = { ...props.extraKeys };
-  dict["Label"] = props.label;
-  dict["ProgramArguments"] = [...props.programArguments];
-  const env = props.environment ?? {};
-  if (Object.keys(env).length > 0)
-    dict["EnvironmentVariables"] = { ...env };
-  if (props.runAtLoad !== undefined)
-    dict["RunAtLoad"] = props.runAtLoad;
-  if (props.keepAlive !== undefined)
-    dict["KeepAlive"] = keepAliveValue(props.keepAlive);
-  if (props.startInterval !== undefined)
-    dict["StartInterval"] = props.startInterval;
-  const calendar = props.startCalendarInterval;
-  if (calendar !== undefined) {
-    dict["StartCalendarInterval"] = Array.isArray(calendar) ? calendar.map(calendarDict) : calendarDict(calendar);
-  }
-  if (props.throttleInterval !== undefined)
-    dict["ThrottleInterval"] = props.throttleInterval;
-  if (props.standardOutPath !== undefined)
-    dict["StandardOutPath"] = props.standardOutPath;
-  if (props.standardErrorPath !== undefined)
-    dict["StandardErrorPath"] = props.standardErrorPath;
-  if (props.workingDirectory !== undefined)
-    dict["WorkingDirectory"] = props.workingDirectory;
-  if (props.userName !== undefined)
-    dict["UserName"] = props.userName;
-  if (props.groupName !== undefined)
-    dict["GroupName"] = props.groupName;
-  return dict;
-};
-var sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
-var renderJob = (props) => {
-  const text = renderPlist(jobPlistDict(props));
-  const bytes = new TextEncoder().encode(text);
-  return { bytes, sha256: sha256Hex(bytes), text };
-};
-
-// src/caddy/digest.ts
-var sorted = (value) => {
-  if (Array.isArray(value))
-    return value.map(sorted);
-  if (typeof value === "object" && value !== null) {
-    const object = value;
-    const out = {};
-    for (const key of Object.keys(object).sort())
-      out[key] = sorted(object[key] ?? null);
-    return out;
-  }
-  return value;
-};
-var parseConfig = (text) => JSON.parse(text);
-var canonicalConfig = (config) => JSON.stringify(sorted(config ?? null));
-var configDigest = (config) => sha256Hex(canonicalConfig(config));
-
-// src/caddy/admin-calls.ts
-class CaddyAdminError extends Error {
-  status;
-  method;
-  path;
-  constructor(status, method, path, reason) {
-    super(`Caddy ${method} ${path} → ${String(status)}: ${reason}`);
-    this.status = status;
-    this.method = method;
-    this.path = path;
-    this.name = "CaddyAdminError";
-  }
-}
-var CADDYFILE = "text/caddyfile";
-var ERROR_OPEN = '{"error":';
-var describe = (warning) => `${warning.file ?? "Caddyfile"}:${String(warning.line ?? 0)}: ${warning.message ?? "(no message)"}`;
-var errorIn = (body) => {
-  const at = body.lastIndexOf(ERROR_OPEN);
-  if (at === -1)
-    return;
-  try {
-    const parsed = JSON.parse(body.slice(at));
-    return typeof parsed.error === "string" ? parsed.error : undefined;
-  } catch {
-    return;
-  }
-};
-var warningsIn = (text) => {
-  if (text.trim() === "")
-    return [];
-  try {
-    const parsed = JSON.parse(text);
-    return Array.isArray(parsed) ? parsed.map(describe) : [];
-  } catch {
-    return [];
+var caddyAdminLayer = (transport) => Layer.mergeAll(Layer.succeed(CaddyAdminService, {
+  endpoint: transport.endpoint,
+  listener: transport.listener
+}), transport.layer);
+// src/caddy/caddy-http-client.ts
+import * as http from "node:http";
+import { Readable } from "node:stream";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer2 from "effect/Layer";
+import * as Result from "effect/Result";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+var NEVER_CONNECTED = new Set(["ECONNREFUSED", "ENOENT"]);
+var codeOf = (cause) => typeof cause === "object" && cause !== null && ("code" in cause) ? String(cause.code) : undefined;
+var isUnreachable = (error) => error instanceof HttpClientError.HttpClientError && error.reason._tag === "TransportError" && NEVER_CONNECTED.has(codeOf(error.reason.cause) ?? "");
+var transportFailure = (request2, cause) => new HttpClientError.HttpClientError({
+  reason: new HttpClientError.TransportError({ request: request2, cause })
+});
+var flattenHeaders = (headers) => {
+  const flat = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (value !== undefined)
+      flat[key] = Array.isArray(value) ? value.join(", ") : value;
   }
+  return flat;
 };
-var fail = (response, method, path) => {
-  const reason = errorIn(response.body) ?? (response.body.trim().slice(0, 500) || "(empty body)");
-  const shown = response.status === 200 ? `${reason} (error in a 200 body)` : reason;
-  throw new CaddyAdminError(response.status, method, path, shown);
-};
-var adaptCaddyfile = async (admin, caddyfile) => {
-  const response = await admin.request({
-    body: caddyfile,
-    headers: { "Content-Type": CADDYFILE },
-    method: "POST",
-    path: "/adapt"
+var waitForResponse = (nodeRequest, request2) => Effect.callback((resume) => {
+  const onError2 = (cause) => {
+    resume(Effect.fail(transportFailure(request2, cause)));
+  };
+  nodeRequest.on("error", onError2);
+  const onResponse = (response) => {
+    nodeRequest.off("error", onError2);
+    resume(Effect.succeed(response));
+  };
+  nodeRequest.on("response", onResponse);
+  return Effect.sync(() => {
+    nodeRequest.off("error", onError2);
+    nodeRequest.off("response", onResponse);
   });
-  if (response.status !== 200)
-    fail(response, "POST", "/adapt");
-  const parsed = JSON.parse(response.body);
-  return { config: parsed.result ?? null, warnings: (parsed.warnings ?? []).map(describe) };
-};
-var readRunningConfig = async (admin) => {
-  const response = await admin.request({ method: "GET", path: "/config/" });
-  if (response.status !== 200)
-    fail(response, "GET", "/config/");
-  return parseConfig(response.body);
-};
-var loadCaddyfile = async (admin, caddyfile, sourceFile) => {
-  const response = await admin.request({
-    body: caddyfile,
-    headers: {
-      "Content-Type": CADDYFILE,
-      ...sourceFile === undefined ? {} : { "Caddy-Config-Source-Adapter": "caddyfile", "Caddy-Config-Source-File": sourceFile }
-    },
-    method: "POST",
-    path: "/load"
+});
+var waitForFinish = (nodeRequest, request2) => Effect.callback((resume) => {
+  const onError2 = (cause) => {
+    resume(Effect.fail(transportFailure(request2, cause)));
+  };
+  nodeRequest.once("error", onError2);
+  const onFinish = () => {
+    nodeRequest.off("error", onError2);
+    resume(Effect.void);
+  };
+  nodeRequest.once("finish", onFinish);
+  return Effect.sync(() => {
+    nodeRequest.off("error", onError2);
+    nodeRequest.off("finish", onFinish);
   });
-  const refused = errorIn(response.body);
-  if (response.status !== 200 || refused !== undefined)
-    fail(response, "POST", "/load");
-  return warningsIn(response.body);
+});
+var sendBody = (nodeRequest, request2) => Effect.suspend(() => {
+  const body = request2.body;
+  if (body._tag === "Empty") {
+    nodeRequest.end();
+    return waitForFinish(nodeRequest, request2);
+  }
+  if (body._tag === "Uint8Array") {
+    nodeRequest.setHeader("content-length", body.contentLength);
+    nodeRequest.end(body.body);
+    return waitForFinish(nodeRequest, request2);
+  }
+  return Effect.fail(new HttpClientError.HttpClientError({
+    reason: new HttpClientError.EncodeError({
+      request: request2,
+      description: `Caddy admin transport: unsupported request body "${body._tag}" — every Caddy operation sends Empty or a Uint8Array body`
+    })
+  }));
+});
+var toWebResponse = (source) => new Response(Readable.toWeb(source), {
+  headers: flattenHeaders(source.headers),
+  status: source.statusCode ?? 0
+});
+var exchangeOnce = (target, request2, url, signal, timeoutMs) => Effect.suspend(() => {
+  const nodeRequest = http.request({
+    headers: request2.headers,
+    method: request2.method,
+    path: `${url.pathname}${url.search}`,
+    signal,
+    timeout: timeoutMs,
+    ...target.kind === "unix" ? { socketPath: target.socketPath } : { host: target.host, port: target.port }
+  });
+  nodeRequest.on("timeout", () => {
+    nodeRequest.destroy(new Error(`no answer in ${String(timeoutMs)} ms`));
+  });
+  return Effect.raceFirst(waitForResponse(nodeRequest, request2), sendBody(nodeRequest, request2).pipe(Effect.andThen(Effect.never))).pipe(Effect.onError(() => Effect.sync(() => nodeRequest.destroy())), Effect.map((source) => HttpClientResponse.fromWeb(request2, toWebResponse(source))));
+});
+var withUnreachableRetry = (attempt, retries, retryDelayMs) => Effect.gen(function* () {
+  let attemptsLeft = retries;
+  for (;; ) {
+    const outcome = yield* Effect.result(attempt);
+    if (Result.isSuccess(outcome))
+      return outcome.success;
+    if (attemptsLeft <= 0 || !isUnreachable(outcome.failure)) {
+      return yield* Effect.fail(outcome.failure);
+    }
+    attemptsLeft -= 1;
+    yield* Effect.sleep(Duration.millis(retryDelayMs));
+  }
+});
+var makeLocalHttpClient = (target, options = {}) => {
+  const timeoutMs = options.timeoutMs ?? 60000;
+  const retries = options.retries ?? 2;
+  const retryDelayMs = options.retryDelayMs ?? 500;
+  return Layer2.succeed(HttpClient.HttpClient, HttpClient.make((request2, url, signal) => {
+    const attempt = exchangeOnce(target, request2, url, signal, timeoutMs);
+    return retries <= 0 ? attempt : withUnreachableRetry(attempt, retries, retryDelayMs);
+  }));
 };
 // src/caddy/config.ts
 import { Resource } from "alchemy";
 import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
-import * as Effect6 from "effect/Effect";
+import * as Effect11 from "effect/Effect";
 
 // src/launchd/host-effect.ts
-import * as Effect from "effect/Effect";
-var lift = (step) => Effect.tryPromise({
+import * as Effect2 from "effect/Effect";
+var lift = (step) => Effect2.tryPromise({
   catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
   try: step
 });
@@ -355,32 +185,32 @@ var resolvedString = (news, key) => {
 import { AdoptPolicy } from "alchemy/AdoptPolicy";
 import { AlchemyContext } from "alchemy/AlchemyContext";
 import { Stack as Stack3 } from "alchemy/Stack";
-import * as Effect5 from "effect/Effect";
+import * as Effect6 from "effect/Effect";
 import * as Option4 from "effect/Option";
 
 // src/ownership/resume.ts
 import { Unowned } from "alchemy/AdoptPolicy";
 import { Artifacts } from "alchemy/Artifacts";
-import * as Effect2 from "effect/Effect";
+import * as Effect3 from "effect/Effect";
 import * as Option from "effect/Option";
 var PROVEN = "homeflare/ownership/resumes";
 var UNFINISHED = "homeflare/ownership/unfinished";
-var note = (key, instanceId) => Effect2.gen(function* () {
-  const bag = yield* Effect2.serviceOption(Artifacts);
+var note = (key, instanceId) => Effect3.gen(function* () {
+  const bag = yield* Effect3.serviceOption(Artifacts);
   if (Option.isSome(bag))
     yield* bag.value.set(key, instanceId);
 });
-var noted = (key, instanceId) => Effect2.gen(function* () {
-  const bag = yield* Effect2.serviceOption(Artifacts);
+var noted = (key, instanceId) => Effect3.gen(function* () {
+  const bag = yield* Effect3.serviceOption(Artifacts);
   if (Option.isNone(bag))
     return false;
   return (yield* bag.value.get(key)) === instanceId;
 });
-var noteUnfinished = (instanceId) => Effect2.as(note(UNFINISHED, instanceId), undefined);
-var noteResume = (instanceId, recovered) => Effect2.gen(function* () {
+var noteUnfinished = (instanceId) => Effect3.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect3.gen(function* () {
   yield* noteUnfinished(instanceId);
-  const unproven = () => Effect2.succeed(undefined);
-  const found = yield* recovered.pipe(Effect2.catch(unproven), Effect2.catchDefect(unproven));
+  const unproven = () => Effect3.succeed(undefined);
+  const found = yield* recovered.pipe(Effect3.catch(unproven), Effect3.catchDefect(unproven));
   if (found === undefined || found === null || Unowned.is(found))
     return;
   yield* note(PROVEN, instanceId);
@@ -391,7 +221,7 @@ var provingResumes = (service) => {
   const { diff, read } = service;
   if (diff === undefined || read === undefined)
     return service;
-  const proving = (input) => Effect2.gen(function* () {
+  const proving = (input) => Effect3.gen(function* () {
     if (input.output === undefined) {
       yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
     }
@@ -403,15 +233,15 @@ var provingResumes = (service) => {
 // src/ownership/rows.ts
 import { Stack as Stack2 } from "alchemy/Stack";
 import { State, isActionState } from "alchemy/State/State";
-import * as Effect4 from "effect/Effect";
+import * as Effect5 from "effect/Effect";
 import * as Option3 from "effect/Option";
 
 // src/ownership/whole.ts
 import { Stack } from "alchemy/Stack";
-import * as Effect3 from "effect/Effect";
+import * as Effect4 from "effect/Effect";
 import * as Option2 from "effect/Option";
 var absent = (value) => value === undefined || value === null;
-var isPlainObject2 = (value) => {
+var isPlainObject = (value) => {
   if (typeof value !== "object" || value === null || Array.isArray(value))
     return false;
   const proto = Object.getPrototypeOf(value);
@@ -427,29 +257,29 @@ var carries = (declared, recorded) => {
       return false;
     return declared.every((each, index) => carries(each, recorded[index]));
   }
-  if (isPlainObject2(declared)) {
-    if (!isPlainObject2(recorded))
+  if (isPlainObject(declared)) {
+    if (!isPlainObject(recorded))
       return false;
     return Object.entries(declared).every(([key, each]) => carries(each, recorded[key]));
   }
   return true;
 };
-var wholeDeclaration = (fqn, props) => Effect3.map(Effect3.serviceOption(Stack), (stack) => {
+var wholeDeclaration = (fqn, props) => Effect4.map(Effect4.serviceOption(Stack), (stack) => {
   const declared = Option2.isSome(stack) ? stack.value.resources[fqn] : undefined;
   return declared !== undefined && carries(declared.Props, props);
 });
 
 // src/ownership/rows.ts
-var storeOf = Effect4.gen(function* () {
-  const stack = yield* Effect4.serviceOption(Stack2);
-  const state = yield* Effect4.serviceOption(State);
+var storeOf = Effect5.gen(function* () {
+  const stack = yield* Effect5.serviceOption(Stack2);
+  const state = yield* Effect5.serviceOption(State);
   if (Option3.isNone(stack) || Option3.isNone(state))
     return;
   const store = yield* state.value;
   const where = { stack: stack.value.name, stage: stack.value.stage };
   return { resources: stack.value.resources, store, where };
 });
-var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect4.orElseSucceed(() => {
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect5.orElseSucceed(() => {
   return;
 }));
 var generationOf = (row, instanceId) => {
@@ -462,7 +292,7 @@ var generationOf = (row, instanceId) => {
   }
   return;
 };
-var recordedGeneration = (fqn, instanceId) => Effect4.gen(function* () {
+var recordedGeneration = (fqn, instanceId) => Effect5.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return;
@@ -473,14 +303,14 @@ var recordedGeneration = (fqn, instanceId) => Effect4.gen(function* () {
   }
   return;
 });
-var recordedInstance = (fqn, instanceId) => Effect4.gen(function* () {
+var recordedInstance = (fqn, instanceId) => Effect5.gen(function* () {
   const generation = yield* recordedGeneration(fqn, instanceId);
   if (generation === undefined)
     return "absent";
   return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
 });
-var isCreate = (fqn, instanceId) => Effect4.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
-var forgetRefusedCreate = (fqn, instanceId) => Effect4.gen(function* () {
+var isCreate = (fqn, instanceId) => Effect5.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var forgetRefusedCreate = (fqn, instanceId) => Effect5.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return;
@@ -489,32 +319,32 @@ var forgetRefusedCreate = (fqn, instanceId) => Effect4.gen(function* () {
   if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
     return;
   }
-  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect4.ignore);
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect5.ignore);
 });
 
 // src/ownership/adopt.ts
-var adoptEnabled = (fqn) => Effect5.gen(function* () {
-  const stack = yield* Effect5.serviceOption(Stack3);
+var adoptEnabled = (fqn) => Effect6.gen(function* () {
+  const stack = yield* Effect6.serviceOption(Stack3);
   const scoped = Option4.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
   if (scoped !== undefined)
     return scoped;
-  const policy = yield* Effect5.serviceOption(AdoptPolicy);
+  const policy = yield* Effect6.serviceOption(AdoptPolicy);
   if (Option4.isSome(policy))
     return policy.value;
-  const context = yield* Effect5.serviceOption(AlchemyContext);
+  const context = yield* Effect6.serviceOption(AlchemyContext);
   return Option4.isSome(context) ? context.value.adopt : false;
 });
-var adoptable = (owner) => Effect5.gen(function* () {
+var adoptable = (owner) => Effect6.gen(function* () {
   if (yield* isCreate(owner.fqn, owner.instanceId))
     return true;
   return yield* unfinished(owner.instanceId);
 });
-var adoptsAtApply = (owner) => Effect5.gen(function* () {
+var adoptsAtApply = (owner) => Effect6.gen(function* () {
   if (!(yield* adoptEnabled(owner.fqn)))
     return false;
   return yield* adoptable(owner);
 });
-var refuseTakeover = (owner, what) => Effect5.gen(function* () {
+var refuseTakeover = (owner, what) => Effect6.gen(function* () {
   if (owner.output !== undefined)
     return;
   if (yield* resumes(owner.instanceId))
@@ -524,10 +354,30 @@ var refuseTakeover = (owner, what) => Effect5.gen(function* () {
     return;
   yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
   const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
-  return yield* Effect5.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+  return yield* Effect6.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
 });
 var claimFor = (owner) => (what) => refuseTakeover(owner, what);
 
+// src/caddy/config-lifecycle.ts
+import * as Effect9 from "effect/Effect";
+import * as Result2 from "effect/Result";
+
+// src/caddy/admin-calls.ts
+import * as Effect7 from "effect/Effect";
+import * as Caddy from "@distilled.cloud/caddy";
+var CADDYFILE = "text/caddyfile";
+var describe = (warning) => `${warning.file ?? "Caddyfile"}:${String(warning.line ?? 0)}: ${warning.message ?? "(no message)"}`;
+var adaptCaddyfile = (caddyfile) => Effect7.map(Caddy.Services.admin.adaptConfig({ config: caddyfile, contentType: CADDYFILE }), (response) => ({
+  config: response.result ?? null,
+  warnings: (response.warnings ?? []).map(describe)
+}));
+var readRunningConfig = () => Effect7.map(Caddy.Services.admin.getConfig({ path: "" }), (response) => response.value ?? null);
+var loadCaddyfile = (caddyfile, sourceFile) => Effect7.map(Caddy.Services.admin.loadConfig({
+  config: caddyfile,
+  contentType: CADDYFILE,
+  ...sourceFile === undefined ? {} : { sourceAdapter: "caddyfile", sourceFile }
+}), (response) => (response.warnings ?? []).map(describe));
+
 // src/caddy/admin-guard.ts
 var DEFAULT_ADMIN_PORT = 2019;
 var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|\[?::1\]?)$/;
@@ -606,6 +456,14 @@ var adminProblems = (adapted, transport) => {
   return found;
 };
 
+// src/caddy/config-errors.ts
+import * as Effect8 from "effect/Effect";
+var refuse = (endpoint, message) => new Error(`Caddy.Config at ${endpoint}: ${message}`);
+var short = (digest) => digest.slice(0, 12);
+var messageOf = (error) => ("message" in error) && typeof error.message === "string" ? error.message : String(error);
+var operationFailure = (endpoint, op, error) => error._tag === "LoadRefused" ? refuse(endpoint, `Caddy refused the Caddyfile (${error._tag}, a 200 whose body carried the error, not a ` + `failure status) — ${error.message}`) : refuse(endpoint, `${op} failed (${error._tag}) — ${messageOf(error)}`);
+var wrapOperation = (endpoint, op) => (effect) => effect.pipe(Effect8.mapError((error) => isUnreachable(error) ? error : operationFailure(endpoint, op, error)));
+
 // src/launchd/secret-tripwire.ts
 var ALTERNATIVE = "props are stored unencrypted in Alchemy state. Have a secret renderer (e.g. openbao-agent) " + "write it to a root-owned file and declare the file path instead (FOO_FILE=/path, --foo-file /path).";
 var SECRET_NAME = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|API_?KEY|ACCESS_KEY|PRIVATE_KEY|SECRET_KEY|CREDENTIALS?)$/i;
@@ -743,139 +601,356 @@ var configProblems = (props) => {
   return found;
 };
 
+// src/launchd/job-form.ts
+import { createHash } from "node:crypto";
+
+// src/launchd/plist.ts
+class PlistError extends Error {
+  path;
+  constructor(path, detail) {
+    super(`plist ${path === "" ? "(root)" : path}: ${detail}`);
+    this.path = path;
+    this.name = "PlistError";
+  }
+}
+var HEADER = `<?xml version="1.0" encoding="UTF-8"?>
+` + '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" ' + `"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+` + `<plist version="1.0">
+`;
+var MAX_DEPTH = 32;
+var FORBIDDEN = /[\x00-\x08\x0B\x0C\x0E-\x1F\uD800-\uDFFF\uFFFE\uFFFF]/u;
+var escapeText = (text, path) => {
+  const bad = FORBIDDEN.exec(text);
+  if (bad !== null) {
+    const code = bad[0].codePointAt(0) ?? 0;
+    throw new PlistError(path, `U+${code.toString(16).toUpperCase().padStart(4, "0")} cannot appear in XML 1.0`);
+  }
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\r", "&#13;");
+};
+var isPlainObject2 = (value) => {
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var renderValue = (value, path, depth, out) => {
+  const pad = "\t".repeat(depth);
+  if (depth > MAX_DEPTH)
+    throw new PlistError(path, `nested deeper than ${String(MAX_DEPTH)}`);
+  if (typeof value === "string") {
+    out.push(`${pad}<string>${escapeText(value, path)}</string>`);
+    return;
+  }
+  if (typeof value === "boolean") {
+    out.push(`${pad}<${value ? "true" : "false"}/>`);
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value)) {
+      throw new PlistError(path, `${String(value)} is not a safe integer (no <real> support)`);
+    }
+    out.push(`${pad}<integer>${String(value === 0 ? 0 : value)}</integer>`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      out.push(`${pad}<array/>`);
+      return;
+    }
+    out.push(`${pad}<array>`);
+    for (const [index, item] of value.entries()) {
+      renderValue(item, `${path}[${String(index)}]`, depth + 1, out);
+    }
+    out.push(`${pad}</array>`);
+    return;
+  }
+  if (typeof value === "object" && value !== null && isPlainObject2(value)) {
+    renderDict(value, path, depth, out);
+    return;
+  }
+  const kind = value === null ? "null" : typeof value;
+  throw new PlistError(path, `${kind} has no plist form — omit the key instead`);
+};
+var renderDict = (dict, path, depth, out) => {
+  const pad = "\t".repeat(depth);
+  const keys = Object.keys(dict).sort();
+  if (keys.length === 0) {
+    out.push(`${pad}<dict/>`);
+    return;
+  }
+  out.push(`${pad}<dict>`);
+  for (const key of keys) {
+    const child = path === "" ? key : `${path}.${key}`;
+    out.push(`${pad}	<key>${escapeText(key, child)}</key>`);
+    renderValue(dict[key], child, depth + 1, out);
+  }
+  out.push(`${pad}</dict>`);
+};
+var renderPlist = (dict) => {
+  if (typeof dict !== "object" || dict === null || Array.isArray(dict) || !isPlainObject2(dict)) {
+    throw new PlistError("", "the top level of a launchd plist must be a dict");
+  }
+  const out = [];
+  renderDict(dict, "", 0, out);
+  return `${HEADER}${out.join(`
+`)}
+</plist>
+`;
+};
+
+// src/launchd/job-form.ts
+var parseDomain = (domain) => {
+  if (domain === "system")
+    return { kind: "system" };
+  const match = /^gui\/(\d+)$/.exec(domain);
+  return match?.[1] === undefined ? undefined : { kind: "gui", uid: Number(match[1]) };
+};
+var serviceTarget = (label, domain) => `${domain}/${label}`;
+var plistPathFor = (label, domain, home) => {
+  if (domain.kind === "system")
+    return `/Library/LaunchDaemons/${label}.plist`;
+  if (home === undefined || !home.startsWith("/")) {
+    throw new Error(`gui/${String(domain.uid)}: no home directory for that uid on this host`);
+  }
+  return `${home}/Library/LaunchAgents/${label}.plist`;
+};
+var OWNED_KEYS = [
+  "EnvironmentVariables",
+  "GroupName",
+  "KeepAlive",
+  "Label",
+  "Program",
+  "ProgramArguments",
+  "RunAtLoad",
+  "StandardErrorPath",
+  "StandardOutPath",
+  "StartCalendarInterval",
+  "StartInterval",
+  "ThrottleInterval",
+  "UserName",
+  "WorkingDirectory"
+];
+var calendarDict = (entry) => {
+  const dict = {};
+  if (entry.minute !== undefined)
+    dict["Minute"] = entry.minute;
+  if (entry.hour !== undefined)
+    dict["Hour"] = entry.hour;
+  if (entry.day !== undefined)
+    dict["Day"] = entry.day;
+  if (entry.weekday !== undefined)
+    dict["Weekday"] = entry.weekday;
+  if (entry.month !== undefined)
+    dict["Month"] = entry.month;
+  return dict;
+};
+var keepAliveValue = (keepAlive) => {
+  if (typeof keepAlive === "boolean")
+    return keepAlive;
+  const dict = {};
+  if (keepAlive.successfulExit !== undefined)
+    dict["SuccessfulExit"] = keepAlive.successfulExit;
+  if (keepAlive.crashed !== undefined)
+    dict["Crashed"] = keepAlive.crashed;
+  return dict;
+};
+var jobPlistDict = (props) => {
+  const dict = { ...props.extraKeys };
+  dict["Label"] = props.label;
+  dict["ProgramArguments"] = [...props.programArguments];
+  const env = props.environment ?? {};
+  if (Object.keys(env).length > 0)
+    dict["EnvironmentVariables"] = { ...env };
+  if (props.runAtLoad !== undefined)
+    dict["RunAtLoad"] = props.runAtLoad;
+  if (props.keepAlive !== undefined)
+    dict["KeepAlive"] = keepAliveValue(props.keepAlive);
+  if (props.startInterval !== undefined)
+    dict["StartInterval"] = props.startInterval;
+  const calendar = props.startCalendarInterval;
+  if (calendar !== undefined) {
+    dict["StartCalendarInterval"] = Array.isArray(calendar) ? calendar.map(calendarDict) : calendarDict(calendar);
+  }
+  if (props.throttleInterval !== undefined)
+    dict["ThrottleInterval"] = props.throttleInterval;
+  if (props.standardOutPath !== undefined)
+    dict["StandardOutPath"] = props.standardOutPath;
+  if (props.standardErrorPath !== undefined)
+    dict["StandardErrorPath"] = props.standardErrorPath;
+  if (props.workingDirectory !== undefined)
+    dict["WorkingDirectory"] = props.workingDirectory;
+  if (props.userName !== undefined)
+    dict["UserName"] = props.userName;
+  if (props.groupName !== undefined)
+    dict["GroupName"] = props.groupName;
+  return dict;
+};
+var sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
+var renderJob = (props) => {
+  const text = renderPlist(jobPlistDict(props));
+  const bytes = new TextEncoder().encode(text);
+  return { bytes, sha256: sha256Hex(bytes), text };
+};
+
+// src/caddy/digest.ts
+var sorted = (value) => {
+  if (Array.isArray(value))
+    return value.map(sorted);
+  if (typeof value === "object" && value !== null) {
+    const object = value;
+    const out = {};
+    for (const key of Object.keys(object).sort())
+      out[key] = sorted(object[key] ?? null);
+    return out;
+  }
+  return value;
+};
+var canonicalConfig = (config) => JSON.stringify(sorted(config ?? null));
+var configDigest = (config) => sha256Hex(canonicalConfig(config));
+
 // src/caddy/config-lifecycle.ts
-var refuse = (admin, message) => new Error(`Caddy.Config at ${admin.endpoint}: ${message}`);
-var short = (digest) => digest.slice(0, 12);
 var servesNothing = (config) => {
   const apps = typeof config === "object" && config !== null ? config.apps : undefined;
   return typeof apps !== "object" || apps === null || Object.keys(apps).length === 0;
 };
-var desiredConfig = async (admin, props) => {
+var desiredConfig = (props) => Effect9.gen(function* () {
+  const { endpoint, listener } = yield* CaddyAdminService;
   const found = configProblems(props);
   if (found.length > 0)
-    throw refuse(admin, found.join("; "));
-  const adapted = await adaptCaddyfile(admin, props.caddyfile);
+    return yield* Effect9.fail(refuse(endpoint, found.join("; ")));
+  const adapted = yield* adaptCaddyfile(props.caddyfile).pipe(wrapOperation(endpoint, "POST /adapt"));
   if (servesNothing(adapted.config)) {
-    throw refuse(admin, "the Caddyfile adapts to no apps — loading it would stop every site");
+    return yield* Effect9.fail(refuse(endpoint, "the Caddyfile adapts to no apps — loading it would stop every site"));
   }
-  const guard = adminProblems(adapted.config, admin.listener);
+  const guard = adminProblems(adapted.config, listener);
   if (guard.length > 0)
-    throw refuse(admin, guard.join("; "));
+    return yield* Effect9.fail(refuse(endpoint, guard.join("; ")));
   return { digest: configDigest(adapted.config), warnings: adapted.warnings };
-};
-var attributesOf = (admin, running, sourceFile) => ({
+});
+var attributesOf = (endpoint, running, sourceFile) => ({
   configSha256: configDigest(running),
-  endpoint: admin.endpoint,
+  endpoint,
   ...sourceFile === undefined ? {} : { sourceFile }
 });
-var readLive = async (admin, sourceFile) => attributesOf(admin, await readRunningConfig(admin), sourceFile);
+var readLive = (sourceFile) => Effect9.gen(function* () {
+  const { endpoint } = yield* CaddyAdminService;
+  const running = yield* readRunningConfig().pipe(wrapOperation(endpoint, "GET /config/"));
+  return attributesOf(endpoint, running, sourceFile);
+});
 var claimable = (running, declaredDigest) => servesNothing(running) || configDigest(running) === declaredDigest;
-var probeLive = async (admin, caddyfile, sourceFile) => {
-  const running = await readRunningConfig(admin);
+var probeLive = (caddyfile, sourceFile) => Effect9.gen(function* () {
+  const { endpoint } = yield* CaddyAdminService;
+  const running = yield* readRunningConfig();
   if (servesNothing(running))
     return;
-  const attributes = attributesOf(admin, running, sourceFile);
+  const attributes = attributesOf(endpoint, running, sourceFile);
   if (caddyfile === undefined) {
     return { attributes, ours: false, unchecked: "the stored Caddyfile is not plain text" };
   }
-  try {
-    const want = await desiredConfig(admin, { caddyfile });
-    return { attributes, ours: claimable(running, want.digest) };
-  } catch (cause) {
-    if (cause instanceof CaddyUnreachableError)
-      throw cause;
-    return {
-      attributes,
-      ours: false,
-      unchecked: cause instanceof Error ? cause.message : String(cause)
-    };
+  const desired = yield* Effect9.result(desiredConfig({ caddyfile }));
+  if (Result2.isSuccess(desired)) {
+    return { attributes, ours: claimable(running, desired.success.digest) };
   }
-};
-var diffConfig = async (admin, news, output) => {
-  const want = await desiredConfig(admin, news);
-  const live = await readLive(admin);
-  const converged = want.digest === live.configSha256 && live.configSha256 === output.configSha256 && news.sourceFile === output.sourceFile && admin.endpoint === output.endpoint;
+  if (isUnreachable(desired.failure))
+    return yield* Effect9.fail(desired.failure);
+  const cause = desired.failure;
+  return {
+    attributes,
+    ours: false,
+    unchecked: cause instanceof Error ? cause.message : String(cause)
+  };
+});
+
+// src/caddy/config-reconcile.ts
+import * as Effect10 from "effect/Effect";
+import * as Result3 from "effect/Result";
+var diffConfig = (news, output) => Effect10.gen(function* () {
+  const { endpoint } = yield* CaddyAdminService;
+  const want = yield* desiredConfig(news);
+  const live = yield* readLive();
+  const converged = want.digest === live.configSha256 && live.configSha256 === output.configSha256 && news.sourceFile === output.sourceFile && endpoint === output.endpoint;
   return converged ? { action: "noop" } : { action: "update" };
-};
-var reconcileConfig = async (admin, props, authority) => {
-  const want = await desiredConfig(admin, props);
-  const running = await readRunningConfig(admin);
+});
+var reconcileConfig = (props, authority) => Effect10.gen(function* () {
+  const { endpoint } = yield* CaddyAdminService;
+  const want = yield* desiredConfig(props);
+  const running = yield* readRunningConfig().pipe(wrapOperation(endpoint, "GET /config/"));
   const before = configDigest(running);
   const known = before === authority.stored || claimable(running, want.digest);
   if (!authority.takeOver && !known) {
-    throw refuse(admin, `Caddy runs config ${short(before)}, which this stack did not load, and the Caddyfile adapts ` + `to ${short(want.digest)} — loading it would replace every site that config serves. ` + "Deploy with --adopt (or wrap the resource in adopt(true)) to take this Caddy over, or " + "point caddyProviders() at the Caddy you meant.");
+    return yield* Effect10.fail(refuse(endpoint, `Caddy runs config ${short(before)}, which this stack did not load, and the Caddyfile ` + `adapts to ${short(want.digest)} — loading it would replace every site that config ` + "serves. Deploy with --adopt (or wrap the resource in adopt(true)) to take this Caddy " + "over, or point caddyProviders() at the Caddy you meant."));
   }
   let warnings = want.warnings;
   const loaded = before !== want.digest;
   if (loaded) {
-    try {
-      warnings = await loadCaddyfile(admin, props.caddyfile, props.sourceFile);
-    } catch (cause) {
-      if (!(cause instanceof CaddyAdminError))
-        throw cause;
-      const after = await readLive(admin).catch(() => {
-        return;
-      });
+    const outcome = yield* Effect10.result(loadCaddyfile(props.caddyfile, props.sourceFile));
+    if (Result3.isFailure(outcome)) {
+      const error = outcome.failure;
+      if (isUnreachable(error))
+        return yield* Effect10.fail(error);
+      const afterRead = yield* Effect10.result(readLive());
+      const after = Result3.isSuccess(afterRead) ? afterRead.success : undefined;
       const state = after === undefined ? "and the running config could not be read back" : after.configSha256 === before ? "Caddy kept the previous config (still serving)" : `and the running config is now ${short(after.configSha256)}, not the previous ${short(before)}`;
-      throw refuse(admin, `Caddy refused the Caddyfile — ${cause.message}; ${state}`);
+      const reason = error._tag === "LoadRefused" ? `${error.message} (LoadRefused: a 200 whose body carried the error, not a failure status)` : messageOf(error);
+      return yield* Effect10.fail(refuse(endpoint, `Caddy refused the Caddyfile — ${reason}; ${state}`));
     }
+    warnings = outcome.success;
   }
-  const attributes = await readLive(admin, props.sourceFile);
+  const attributes = yield* readLive(props.sourceFile);
   if (attributes.configSha256 !== want.digest) {
-    throw refuse(admin, `after the load Caddy runs config ${short(attributes.configSha256)}, not the ` + `${short(want.digest)} this Caddyfile adapts to — another writer changed it, or it was not applied`);
+    return yield* Effect10.fail(refuse(endpoint, `after the load Caddy runs config ${short(attributes.configSha256)}, not the ` + `${short(want.digest)} this Caddyfile adapts to — another writer changed it, or it was ` + "not applied"));
   }
   return { attributes, loaded, warnings };
-};
+});
 
 // src/caddy/config.ts
 var CaddyConfig = Resource("Caddy.Config", {
   defaultRemovalPolicy: "retain"
 });
-var unreachable = (error) => error instanceof CaddyUnreachableError;
-var planWithoutCaddy = (admin, fallback) => (error) => Effect6.as(Effect6.logWarning(`Caddy.Config: no Caddy at ${admin.endpoint} (${error.message}); planning without it — ` + "the Caddyfile is validated when the deploy reaches Caddy"), fallback);
-var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect6.gen(function* () {
+var planWithoutCaddy = (admin, fallback) => (error) => Effect11.as(Effect11.logWarning(`Caddy.Config: no Caddy at ${admin.endpoint} ` + `(${error instanceof Error ? error.message : String(error)}); planning without it — ` + "the Caddyfile is validated when the deploy reaches Caddy"), fallback);
+var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect11.gen(function* () {
   const admin = yield* CaddyAdminService;
-  const probe = (caddyfile, sourceFile) => Effect6.flatMap(lift(() => probeLive(admin, caddyfile, sourceFile)), (found) => {
+  const probe = (caddyfile, sourceFile) => Effect11.flatMap(probeLive(caddyfile, sourceFile), (found) => {
     if (found === undefined)
-      return Effect6.succeed(undefined);
+      return Effect11.succeed(undefined);
     if (found.ours)
-      return Effect6.succeed(found.attributes);
+      return Effect11.succeed(found.attributes);
     const unowned = Unowned2(found.attributes);
-    return found.unchecked === undefined ? Effect6.succeed(unowned) : Effect6.as(Effect6.logWarning(`Caddy.Config at ${admin.endpoint}: the running config could not be compared ` + `with the declared Caddyfile (${found.unchecked}), so it is not treated as ours`), unowned);
+    return found.unchecked === undefined ? Effect11.succeed(unowned) : Effect11.as(Effect11.logWarning(`Caddy.Config at ${admin.endpoint}: the running config could not be compared ` + `with the declared Caddyfile (${found.unchecked}), so it is not treated as ours`), unowned);
   });
   return CaddyConfig.Provider.of({
-    list: () => Effect6.succeed([]),
-    read: ({ olds, output }) => (output === undefined ? probe(resolvedString(olds, "caddyfile"), resolvedString(olds, "sourceFile")) : lift(() => readLive(admin, resolvedString(olds, "sourceFile")))).pipe(Effect6.catchIf(unreachable, planWithoutCaddy(admin, undefined))),
+    list: () => Effect11.succeed([]),
+    read: ({ olds, output }) => Effect11.gen(function* () {
+      return output === undefined ? yield* probe(resolvedString(olds, "caddyfile"), resolvedString(olds, "sourceFile")) : yield* readLive(resolvedString(olds, "sourceFile"));
+    }).pipe(Effect11.catchIf(isUnreachable, planWithoutCaddy(admin, undefined))),
     diff: ({ news, output }) => {
       if (output === undefined)
-        return Effect6.succeed(undefined);
+        return Effect11.succeed(undefined);
       const update = planWithoutCaddy(admin, { action: "update" });
       if (isResolved(news)) {
-        return lift(() => diffConfig(admin, news, output)).pipe(Effect6.catchIf(unreachable, update));
+        return diffConfig(news, output).pipe(Effect11.catchIf(isUnreachable, update));
       }
       const caddyfile = resolvedString(news, "caddyfile");
       if (caddyfile === undefined)
-        return Effect6.succeed(undefined);
-      return lift(async () => {
-        await diffConfig(admin, { caddyfile }, output);
-        return { action: "update" };
-      }).pipe(Effect6.catchIf(unreachable, update));
+        return Effect11.succeed(undefined);
+      return Effect11.as(diffConfig({ caddyfile }, output), { action: "update" }).pipe(Effect11.catchIf(isUnreachable, update));
     },
-    reconcile: ({ fqn, news, output }) => Effect6.gen(function* () {
+    reconcile: ({ fqn, news, output }) => Effect11.gen(function* () {
       const sameCaddy = output !== undefined && output.endpoint === admin.endpoint;
       const takeOver = sameCaddy || (yield* adoptEnabled(fqn));
       const stored = output === undefined ? {} : { stored: output.configSha256 };
-      const applied = yield* lift(() => reconcileConfig(admin, news, { takeOver, ...stored }));
+      const applied = yield* reconcileConfig(news, { takeOver, ...stored });
       for (const warning of applied.warnings) {
-        yield* Effect6.logWarning(`Caddy.Config at ${admin.endpoint}: ${warning}`);
+        yield* Effect11.logWarning(`Caddy.Config at ${admin.endpoint}: ${warning}`);
       }
       return applied.attributes;
     }),
-    delete: () => Effect6.void
+    delete: () => Effect11.void
   });
 }));
 // src/caddy/local-admin.ts
-import { request as httpRequest } from "node:http";
+import * as Layer3 from "effect/Layer";
+import * as Caddy2 from "@distilled.cloud/caddy";
+
+// src/caddy/admin-address.ts
 var DEFAULT_ADMIN_ADDRESS = "http://127.0.0.1:2019";
 var UNIX = "unix://";
 var HOST_PORT = /^(?:[A-Za-z0-9.-]+|\[[0-9A-Fa-f:.]+\]):\d{1,5}$/;
@@ -916,60 +991,29 @@ var parseAdminAddress = (address, hostHeader) => {
     target: { host: url.hostname.replace(/^\[(.*)\]$/, "$1"), kind: "tcp", port }
   };
 };
-var code = (cause) => typeof cause === "object" && cause !== null && ("code" in cause) ? String(cause.code) : undefined;
-var neverConnected = (cause) => code(cause) === "ECONNREFUSED" || code(cause) === "ENOENT";
-var exchange = (target, method, path, headers, body, timeoutMs) => new Promise((resolve, reject) => {
-  const bytes = body === undefined ? undefined : Buffer.from(body, "utf8");
-  const request = httpRequest({
-    ...target.kind === "tcp" ? { host: target.host, port: target.port } : { socketPath: target.socketPath },
-    headers: bytes === undefined ? headers : { ...headers, "Content-Length": bytes.length },
-    method,
-    path,
-    timeout: timeoutMs
-  }, (response) => {
-    const chunks = [];
-    response.on("data", (chunk) => chunks.push(chunk));
-    response.on("error", reject);
-    response.on("end", () => resolve({
-      body: Buffer.concat(chunks).toString("utf8"),
-      status: response.statusCode ?? 0
-    }));
-  });
-  request.on("timeout", () => request.destroy(new Error(`no answer in ${String(timeoutMs)} ms`)));
-  request.on("error", reject);
-  request.end(bytes);
-});
+
+// src/caddy/local-admin.ts
 var localCaddyAdmin = (options = {}) => {
   const address = options.address ?? DEFAULT_ADMIN_ADDRESS;
   const { listener, target } = parseAdminAddress(address, options.hostHeader);
-  const timeoutMs = options.timeoutMs ?? 60000;
-  const retries = options.retries ?? 2;
-  const delay = options.retryDelayMs ?? 500;
-  const fixed = listener.kind === "tcp" ? { Host: listener.hostHeader, Origin: `http://${listener.hostHeader}` } : { Host: "127.0.0.1" };
+  const credentials = target.kind === "unix" ? Caddy2.fromApiBaseUrl({
+    apiBaseUrl: "http://localhost",
+    hostHeader: options.hostHeader ?? "127.0.0.1"
+  }) : Caddy2.fromApiBaseUrl({
+    apiBaseUrl: address,
+    ...options.hostHeader === undefined ? {} : { hostHeader: options.hostHeader }
+  });
   return {
     endpoint: address,
-    listener,
-    request: async ({ body, headers, method, path }) => {
-      for (let attempt = 0;; attempt += 1) {
-        try {
-          return await exchange(target, method, path, { ...headers, ...fixed }, body, timeoutMs);
-        } catch (cause) {
-          if (!neverConnected(cause) || attempt >= retries) {
-            const reason = cause instanceof Error ? cause.message : String(cause);
-            const message = `Caddy admin ${method} ${path} at ${address}: ${reason}`;
-            throw neverConnected(cause) ? new CaddyUnreachableError(message) : new Error(message);
-          }
-          await new Promise((resolve) => setTimeout(resolve, delay));
-        }
-      }
-    }
+    layer: Layer3.mergeAll(credentials, makeLocalHttpClient(target, options), Layer3.succeed(Caddy2.Retry.Retry, { while: () => false })),
+    listener
   };
 };
 // src/caddy/providers.ts
-import * as Layer2 from "effect/Layer";
-var caddyProviders = (admin = localCaddyAdmin()) => CaddyConfigProvider().pipe(Layer2.provide(caddyAdminLayer(admin)));
+import * as Layer4 from "effect/Layer";
+var caddyProviders = (transport = localCaddyAdmin()) => CaddyConfigProvider().pipe(Layer4.provideMerge(caddyAdminLayer(transport)));
 // src/caddy/with-file.ts
-import * as Effect8 from "effect/Effect";
+import * as Effect13 from "effect/Effect";
 import * as RemovalPolicy from "alchemy/RemovalPolicy";
 
 // src/launchd/host-file.ts
@@ -977,7 +1021,7 @@ import { Resource as Resource2 } from "alchemy";
 import { Unowned as Unowned3 } from "alchemy/AdoptPolicy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect7 from "effect/Effect";
+import * as Effect12 from "effect/Effect";
 
 // src/launchd/file-identity.ts
 var sameEntry = (a, b) => {
@@ -1006,11 +1050,11 @@ var leaveOldPath = async (runner, oldPath, path, remove, refuse3) => {
 
 // src/launchd/runner.ts
 import * as Context2 from "effect/Context";
-import * as Layer3 from "effect/Layer";
+import * as Layer5 from "effect/Layer";
 
 class HostRunnerService extends Context2.Service()("homeflare/launchd/HostRunner") {
 }
-var hostRunnerLayer = (runner) => Layer3.succeed(HostRunnerService, runner);
+var hostRunnerLayer = (runner) => Layer5.succeed(HostRunnerService, runner);
 var canActAsRoot = (runner) => runner.privileged || runner.effectiveUid() === 0;
 
 // src/launchd/file-converge.ts
@@ -1172,10 +1216,10 @@ var deleteFile = (runner, output) => removeWholeFile(runner, output, refuse3);
 
 // src/launchd/host-file.ts
 var HostFile = Resource2("Host.File");
-var HostFileProvider = () => Provider2.effect(HostFile, Effect7.gen(function* () {
+var HostFileProvider = () => Provider2.effect(HostFile, Effect12.gen(function* () {
   const runner = yield* HostRunnerService;
   return HostFile.Provider.of({
-    list: () => Effect7.succeed([]),
+    list: () => Effect12.succeed([]),
     read: ({ olds, output }) => lift(async () => {
       const found = await readFileAttributes(runner, olds.path);
       if (found === undefined)
@@ -1189,19 +1233,19 @@ var HostFileProvider = () => Provider2.effect(HostFile, Effect7.gen(function* ()
         return lift(() => diffFile(runner, news, output));
       const path = resolvedString(news, "path");
       if (path === undefined || path === output.path)
-        return Effect7.succeed(undefined);
+        return Effect12.succeed(undefined);
       return lift(async () => await oneFile(runner, path, output.path) === true ? undefined : { action: "replace" });
     },
-    reconcile: ({ fqn, instanceId, news, output }) => Effect7.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) => lift(() => reconcileFile(runner, news, output, adopt))),
+    reconcile: ({ fqn, instanceId, news, output }) => Effect12.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) => lift(() => reconcileFile(runner, news, output, adopt))),
     delete: ({ output }) => lift(() => deleteFile(runner, output))
   });
 }));
 
 // src/caddy/with-file.ts
-var caddyWithFile = (id, props) => Effect8.gen(function* () {
+var caddyWithFile = (id, props) => Effect13.gen(function* () {
   const found = configProblems({ caddyfile: props.caddyfile, sourceFile: props.path });
   if (found.length > 0) {
-    return yield* Effect8.fail(new Error(`caddyWithFile ${id}: ${found.join("; ")}`));
+    return yield* Effect13.fail(new Error(`caddyWithFile ${id}: ${found.join("; ")}`));
   }
   const file = yield* HostFile(`${id}-file`, {
     content: props.caddyfile,
@@ -1214,19 +1258,18 @@ var caddyWithFile = (id, props) => Effect8.gen(function* () {
   return { config, file };
 });
 export {
-  CaddyAdminError,
   CaddyAdminService,
   CaddyConfig,
   CaddyConfigProvider,
-  CaddyUnreachableError,
   DEFAULT_ADMIN_ADDRESS,
   accessForwardAuth,
   caddyAdminLayer,
   caddyProviders,
   caddyWithFile,
+  isUnreachable,
   localCaddyAdmin,
   verifierProblems
 };
 
-//# debugId=A91D75C3B7D7145864756E2164756E21
+//# debugId=643BF5F5D21610F364756E2164756E21
 //# sourceMappingURL=index.js.map