@homeflare/alchemy 0.28.0 → 0.29.0

package/README.md

@@ -6,6 +6,8 @@ Custom [Alchemy](https://alchemy.run) providers for gaps the vendor SDK leaves.
 bun add @homeflare/alchemy alchemy@2.0.0-beta.79 effect@4.0.0-rc.115 \
         @effect/platform-node@4.0.0-rc.115 mime@4.1.0 \
         @distilled.cloud/cloudflare@1.0.0-rc.12 @distilled.cloud/forgejo@1.0.0-rc.12 \
+        @distilled.cloud/discord@1.0.0-rc.12 @distilled.cloud/google-workspace@1.0.0-rc.12 \
+        @distilled.cloud/grafana@1.0.0-rc.12 \
         @effect/sql-pg@4.0.0-rc.115
 ```
 

package/dist/caddy/admin-address.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Parses a `localCaddyAdmin()` address into a dial target and the listener Caddy checks requests
+ * against — pure, so admin-guard.ts and local-admin.ts's tests exercise it with no transport at all.
+ *
+ * ★ LOOPBACK OR A UNIX SOCKET, NOTHING ELSE. The admin API is unauthenticated plaintext; an address
+ *   off this machine means it is reachable from the network, which decision 23 forbids. Reaching
+ *   another host's Caddy means forwarding its socket or port to here (SSH), never exposing :2019.
+ * ★ HOST, AS CADDY's OWN CLI SENDS IT (cmd/commandfuncs.go AdminAPIRequest): `host:port`, over TCP.
+ *   MEASURED against a Mac host's Caddy 2.11.4: any other Host gets 403 `host not allowed`, a
+ *   forwarded port included — hence `hostHeader`.
+ */
+import type { CaddyAdminListener } from './admin.ts';
+export type Target = {
+    readonly kind: 'tcp';
+    readonly host: string;
+    readonly port: number;
+} | {
+    readonly kind: 'unix';
+    readonly socketPath: string;
+};
+export declare const DEFAULT_ADMIN_ADDRESS = "http://127.0.0.1:2019";
+/** The dial target and listener for an address, or a refusal naming what is wrong with it. */
+export declare const parseAdminAddress: (address: string, hostHeader?: string) => {
+    target: Target;
+    listener: CaddyAdminListener;
+};
+//# sourceMappingURL=admin-address.d.ts.map

package/dist/caddy/admin-address.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-address.d.ts","sourceRoot":"","sources":["../../src/caddy/admin-address.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,MAAM,GACd;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAW7D,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,YACnB,MAAM,eACF,MAAM,KAClB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAsChD,CAAC"}

package/dist/caddy/admin-calls.d.ts

@@ -1,48 +1,45 @@
 /**
- * The three admin API calls the provider makes, each classified into a value or a readable Error
- * that carries Caddy's own message.
+ * The three admin API calls the provider makes, through `@distilled.cloud/caddy`'s typed `admin`
+ * operations — `catchTag`-able errors, never a status check in this file.
  *
  * Read in caddyserver/caddy v2.11.4 (and the API docs, caddyserver.com/docs/api):
- *   · `POST /adapt` — adapts without running (load.go handleAdapt): 200 `{warnings?, result}`,
- *     or 400 `{"error": …}`. Side-effect free, so it is what plan-time validation uses.
- *   · `POST /load` — Content-Type `text/caddyfile` picks the adapter (load.go adaptByContentType);
- *     "if the new config fails for any reason, the old config is rolled back into place without
- *     downtime" (docs; caddy.go changeConfig restores the previous raw config). An identical
- *     config is a no-op without `Cache-Control: must-revalidate`.
- *   · `GET /config/` — the running config as JSON, `null` when empty (admin.go handleConfig).
+ *   · `POST /adapt` (`adaptConfig`) — adapts without running (load.go handleAdapt). Side-effect
+ *     free, so it is what plan-time validation uses.
+ *   · `POST /load` (`loadConfig`) — Content-Type `text/caddyfile` picks the adapter (load.go
+ *     adaptByContentType); "if the new config fails for any reason, the old config is rolled back
+ *     into place without downtime" (docs; caddy.go changeConfig restores the previous raw config).
+ *     An identical config is a no-op without `Cache-Control: must-revalidate`.
+ *   · `GET /config/` (`getConfig`) — the running config as JSON, `null` when empty (admin.go
+ *     handleConfig).
  * ⛔ A FAILED LOAD CAN ANSWER 200. load.go writes the adapter's WARNINGS to the body before it
  *   runs the config; if the run then fails, the error JSON is appended to a response whose status
- *   is already 200 (Go's first Write sends 200; the later WriteHeader(400) is ignored). The
- *   Caddyfile adapter warns on every unformatted input (adapter.go FormattingDifference), so this
- *   is the COMMON failure shape, not an edge. Hence: look for the error in the body whatever the
- *   status — and the lifecycle reads the config back after every load anyway.
- *   MEASURED 2026-09-21 on a throwaway Caddy 2.11.4 (loopback ports, isolated XDG dirs): an
- *   unformatted Caddyfile whose port was taken answered `200` with body
- *   `[{"file":"Caddyfile","line":8,"message":"Caddyfile input is not formatted; …"}]{"error":"loading
- *   config: … bind: address already in use"}`, and Caddy kept serving the previous config.
+ *   is already 200. The Caddyfile adapter warns on every unformatted input (adapter.go
+ *   FormattingDifference), so this is the COMMON failure shape, not an edge. The SDK's own
+ *   `CaddyProtocol` (`packages/distilled-caddy/src/protocol.ts`) scans `loadConfig`'s body for the
+ *   embedded error on every status and fails with the typed `LoadRefused` — `catchTag`'d below,
+ *   never a status check here. The lifecycle also reads the config back after every load anyway
+ *   (config-lifecycle.ts).
  */
-import type { CaddyAdmin } from './admin.ts';
-export declare class CaddyAdminError extends Error {
-    readonly status: number;
-    readonly method: string;
-    readonly path: string;
-    constructor(status: number, method: string, path: string, reason: string);
-}
+import * as Effect from 'effect/Effect';
+import * as Caddy from '@distilled.cloud/caddy';
 export type Adapted = {
     readonly config: unknown;
     readonly warnings: readonly string[];
 };
 /** Adapt a Caddyfile to JSON on the running Caddy, without loading it. */
-export declare const adaptCaddyfile: (admin: CaddyAdmin, caddyfile: string) => Promise<Adapted>;
+export declare const adaptCaddyfile: (caddyfile: string) => Effect.Effect<Adapted, Caddy.CaddyOpError, Caddy.CaddyOpContext>;
 /** The running config, parsed; `null` when Caddy runs with none. */
-export declare const readRunningConfig: (admin: CaddyAdmin) => Promise<unknown>;
+export declare const readRunningConfig: () => Effect.Effect<unknown, Caddy.CaddyOpError, Caddy.CaddyOpContext>;
 /**
- * Apply a Caddyfile with `POST /load`; resolves with the adapter's warnings.
+ * Apply a Caddyfile with `POST /load`; resolves with the adapter's warnings. A refused load
+ * (`LoadRefused` — the ⛔ above) propagates as that typed error, unretried by anything in this
+ * file — config-lifecycle.ts's `reconcileConfig` is where a refusal turns into a message naming
+ * what is still running.
  *
  * ★ `sourceFile` RIDES AS `Caddy-Config-Source-File` (+ `-Adapter: caddyfile`), the headers
  *   `caddy reload` sends (cmd/commandfuncs.go). A load WITHOUT them makes Caddy forget the file it
  *   was started with (caddy.go ClearLastConfigIfDifferent), and SIGUSR1 then no longer reloads
  *   from that file. With them, and the same path, it keeps it.
  */
-export declare const loadCaddyfile: (admin: CaddyAdmin, caddyfile: string, sourceFile?: string) => Promise<readonly string[]>;
+export declare const loadCaddyfile: (caddyfile: string, sourceFile?: string) => Effect.Effect<readonly string[], Caddy.CaddyOpError, Caddy.CaddyOpContext>;
 //# sourceMappingURL=admin-calls.d.ts.map

package/dist/caddy/admin-calls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-calls.d.ts","sourceRoot":"","sources":["../../src/caddy/admin-calls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAsB,MAAM,YAAY,CAAC;AAGjE,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EAIf;CACF;AAwCD,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEzF,0EAA0E;AAC1E,eAAO,MAAM,cAAc,UAAiB,UAAU,aAAa,MAAM,KAAG,OAAO,CAAC,OAAO,CAY1F,CAAC;AAEF,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,UAAiB,UAAU,KAAG,OAAO,CAAC,OAAO,CAI1E,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,UACjB,UAAU,aACN,MAAM,eACJ,MAAM,KAClB,OAAO,CAAC,SAAS,MAAM,EAAE,CAe3B,CAAC"}
+{"version":3,"file":"admin-calls.d.ts","sourceRoot":"","sources":["../../src/caddy/admin-calls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,wBAAwB,CAAC;AAShD,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEzF,0EAA0E;AAC1E,eAAO,MAAM,cAAc,cACd,MAAM,KAChB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,CAO/D,CAAC;AAEJ,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,QAAO,MAAM,CAAC,MAAM,CAChD,OAAO,EACP,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,cAAc,CAC6E,CAAC;AAEpG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,cACb,MAAM,eACJ,MAAM,KAClB,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,CAQzE,CAAC"}

package/dist/caddy/admin.d.ts

@@ -1,32 +1,26 @@
 /**
- * The one seam between the Caddy provider and a running Caddy: every call to Caddy's admin API goes
- * through a CaddyAdmin, and nothing in this directory reaches Caddy any other way.
+ * The one seam between the Caddy provider and a running Caddy: every operation goes through
+ * `@distilled.cloud/caddy`'s typed `Services.admin.*` calls (admin-calls.ts), over the
+ * `CaddyAdminService` metadata and the `Credentials` + `HttpClient` layers `localCaddyAdmin()`
+ * builds (local-admin.ts) — nothing in this directory reaches Caddy any other way.
  *
  * ★ CADDY's OWN MANAGEMENT API, NOT A FILE AND A SIGNAL. Decision 23 (vault consolidation plan,
  *   2026-09-21): `POST /load` applies a Caddyfile with a graceful reload and rolls back a config
  *   Caddy refuses; `GET /config/` reports what is running. Read in caddyserver/caddy v2.11.4,
  *   caddyconfig/load.go and admin.go, and in the API docs (caddyserver.com/docs/api).
- * ★ A SEAM, THE SAME SHAPE AS launchd's HostRunner, so the lifecycle runs against a fake admin
- *   server in tests and a consumer can plug in another route to the API (an SSH-forwarded socket
- *   today; a remote runner later) without touching the provider. PROMISES, NOT EFFECTS, for the
- *   same reason as HostRunner: a consumer writing their own implements plain async functions.
+ * ★ `CaddyAdminService` CARRIES ONLY MESSAGE/GUARD METADATA (endpoint, listener) — never a
+ *   credential, and never the transport itself. The transport is `@distilled.cloud/caddy`'s own
+ *   `Credentials` and `HttpClient.HttpClient` services, provided alongside it by `caddyAdminLayer`,
+ *   so admin-calls.ts calls the SDK's operations directly rather than through a house-specific
+ *   `.request()` seam. A consumer plugs in another route to the API (an SSH-forwarded socket today;
+ *   a remote runner later) by providing a different `CaddyTransport` to `caddyAdminLayer`.
  * ⛔ THE ADMIN API HAS NO AUTHENTICATION. Anyone who reaches it can replace every site. It stays on
  *   loopback or a unix socket; localCaddyAdmin() refuses anything else (local-admin.ts).
  */
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
 import * as Context from 'effect/Context';
 import * as Layer from 'effect/Layer';
-/** One admin API exchange. ⛔ `body` may hold the running config — never log it whole. */
-export type CaddyAdminResponse = {
-    readonly status: number;
-    readonly body: string;
-};
-export type CaddyAdminRequest = {
-    readonly method: 'GET' | 'POST';
-    /** Absolute API path: `/load`, `/adapt`, `/config/`. */
-    readonly path: string;
-    readonly headers?: Readonly<Record<string, string>>;
-    readonly body?: string;
-};
+import type { Credentials } from '@distilled.cloud/caddy';
 /**
  * Where the admin listener is, in the terms Caddy's own `admin` option uses — so a Caddyfile that
  * would move the listener away from where the provider talks to it can be refused (admin-guard.ts).
@@ -39,35 +33,31 @@ export type CaddyAdminListener = {
     readonly kind: 'unix';
     readonly path: string;
 };
-export interface CaddyAdmin {
-    /** Where requests go, for error messages and the resource's attributes. Never a credential. */
+/** Message/guard metadata for the Caddy this stack talks to — never a credential. */
+export interface CaddyTarget {
+    /** Where requests go, for error messages and the resource's attributes. */
     readonly endpoint: string;
     /**
      * The listener as Caddy sees it. `hostHeader` is the Host every request carries: Caddy checks it
      * against `admin.origins` (admin.go checkHost) on any loopback TCP listener.
      */
     readonly listener: CaddyAdminListener;
-    /**
-     * Send one request. Resolves with ANY status — classifying it is the caller's job
-     * (admin-calls.ts). Rejects only when there was no HTTP exchange at all: with a
-     * CaddyUnreachableError when nothing accepted the connection, any other Error otherwise.
-     */
-    request(request: CaddyAdminRequest): Promise<CaddyAdminResponse>;
 }
-/**
- * Nothing accepted the connection — Caddy is not running, or not listening yet. A transport rejects
- * with THIS only when the request provably never reached Caddy (refused, no socket file), because
- * the provider treats it differently from every other failure: a stopped Caddy must not fail the
- * PLAN that would bring it back (its launchd job in the same stack) — see config.ts.
- */
-export declare class CaddyUnreachableError extends Error {
-    readonly name = "CaddyUnreachableError";
+/** What `localCaddyAdmin()` (or a consumer's own transport) hands `caddyAdminLayer`. */
+export interface CaddyTransport extends CaddyTarget {
+    /** Provides the SDK's own `Credentials` and `HttpClient.HttpClient` — see local-admin.ts. */
+    readonly layer: Layer.Layer<Credentials | HttpClient.HttpClient>;
 }
-declare const CaddyAdminService_base: Context.ServiceClass<CaddyAdminService, "homeflare/caddy/CaddyAdmin", CaddyAdmin>;
-/** The Effect service the Caddy provider reads its admin transport from. */
+declare const CaddyAdminService_base: Context.ServiceClass<CaddyAdminService, "homeflare/caddy/CaddyAdmin", CaddyTarget>;
+/** The Effect service the Caddy provider reads its admin target's metadata from. */
 export declare class CaddyAdminService extends CaddyAdminService_base {
 }
-/** Provide a transport to the provider: `Layer.provide(caddyAdminLayer(localCaddyAdmin()))`. */
-export declare const caddyAdminLayer: (admin: CaddyAdmin) => Layer.Layer<CaddyAdminService>;
+/**
+ * Provide a transport to the provider: `CaddyConfigProvider().pipe(Layer.provideMerge(caddyAdminLayer(localCaddyAdmin())))`
+ * — never plain `Layer.provide` here (see providers.ts's own ⚠️): `CaddyConfigProvider()`'s handlers
+ * keep needing these services every time the engine calls them, not just once while it is built. Merges
+ * the target metadata with the SDK's `Credentials`/`HttpClient` layers `transport.layer` carries.
+ */
+export declare const caddyAdminLayer: (transport: CaddyTransport) => Layer.Layer<CaddyAdminService | Credentials | HttpClient.HttpClient>;
 export {};
 //# sourceMappingURL=admin.d.ts.map

package/dist/caddy/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/caddy/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,yFAAyF;AACzF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAChC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClE;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,2BAA2B;CAClD;;AAED,4EAA4E;AAC5E,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ,gGAAgG;AAChG,eAAO,MAAM,eAAe,UAAW,UAAU,KAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/caddy/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;CAClE;;AAED,oFAAoF;AACpF,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,eAAe,cACf,cAAc,KACxB,KAAK,CAAC,KAAK,CAAC,iBAAiB,GAAG,WAAW,GAAG,UAAU,CAAC,UAAU,CAOnE,CAAC"}

package/dist/caddy/caddy-http-client.d.ts

@@ -0,0 +1,25 @@
+import * as Layer from 'effect/Layer';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
+import * as HttpClientError from 'effect/unstable/http/HttpClientError';
+import type { Target } from './admin-address.ts';
+export type LocalHttpClientOptions = {
+    /**
+     * Abort an exchange after this long. @default 60_000
+     * ⚠️ A `shutdown_delay` in the Caddyfile makes `/load` block that long (caddyhttp app.go Stop);
+     *   a timeout then fails the deploy while Caddy goes on to apply — the next plan converges.
+     */
+    readonly timeoutMs?: number;
+    /** Retries when the connection is REFUSED — see the module doc. @default 2 */
+    readonly retries?: number;
+    /** @default 500 */
+    readonly retryDelayMs?: number;
+};
+/**
+ * Nothing accepted the connection — see the module doc's ★. A type guard, not just a predicate, so
+ * config-lifecycle.ts's error-wrapping can pass through the raw error unchanged (still typed) and
+ * config.ts's plan-time escape hatch (`Effect.catchIf`) narrows to it directly.
+ */
+export declare const isUnreachable: (error: unknown) => error is HttpClientError.HttpClientError;
+/** The transport `localCaddyAdmin()` provides as `HttpClient.HttpClient` — see local-admin.ts. */
+export declare const makeLocalHttpClient: (target: Target, options?: LocalHttpClientOptions) => Layer.Layer<HttpClient.HttpClient>;
+//# sourceMappingURL=caddy-http-client.d.ts.map

package/dist/caddy/caddy-http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caddy-http-client.d.ts","sourceRoot":"","sources":["../../src/caddy/caddy-http-client.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAC;AAGxE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,MAAM,sBAAsB,GAAG;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB;IACnB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AASF;;;;GAIG;AACH,eAAO,MAAM,aAAa,UAAW,OAAO,KAAG,KAAK,IAAI,eAAe,CAAC,eAGjB,CAAC;AA4JxD,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,WACtB,MAAM,YACL,sBAAsB,KAC9B,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAWnC,CAAC"}

package/dist/caddy/config-errors.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Turning a distilled `@distilled.cloud/caddy` operation failure into a readable refusal — shared
+ * by config-lifecycle.ts and config-reconcile.ts, so both read the same way.
+ */
+import * as Effect from 'effect/Effect';
+import type * as Caddy from '@distilled.cloud/caddy';
+export declare const refuse: (endpoint: string, message: string) => Error;
+export declare const short: (digest: string) => string;
+/** Every `CaddyOpError` member carries `.message` (a `Schema.TaggedError` field) — see errors.ts. */
+export declare const messageOf: (error: Caddy.CaddyOpError) => string;
+/**
+ * A distilled operation's typed failure, read the way this resource's own refusals read:
+ * `LoadRefused` (the 200-embedded-error trap admin-calls.ts's module doc describes) says so
+ * explicitly, so a grep for "kept the previous config" is never mistaken for an ordinary 4xx/5xx.
+ */
+export declare const operationFailure: (endpoint: string, op: string, error: Caddy.CaddyOpError) => Error;
+/**
+ * Humanizes every failure from a distilled operation EXCEPT one nothing accepted the connection
+ * for — that stays the raw, still-typed `HttpClientError` so config.ts's plan-time escape hatch
+ * (`Effect.catchIf(isUnreachable, …)`) can keep narrowing to it after this wrapping, the same way
+ * it could inspect the un-wrapped error before this function ran.
+ */
+export declare const wrapOperation: (endpoint: string, op: string) => <A>(effect: Effect.Effect<A, Caddy.CaddyOpError, Caddy.CaddyOpContext>) => Effect.Effect<A, Error | Caddy.CaddyOpError, Caddy.CaddyOpContext>;
+//# sourceMappingURL=config-errors.d.ts.map

package/dist/caddy/config-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-errors.d.ts","sourceRoot":"","sources":["../../src/caddy/config-errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,KAAK,MAAM,wBAAwB,CAAC;AAGrD,eAAO,MAAM,MAAM,aAAc,MAAM,WAAW,MAAM,KAAG,KACL,CAAC;AAEvD,eAAO,MAAM,KAAK,WAAY,MAAM,KAAG,MAA6B,CAAC;AAErE,qGAAqG;AACrG,eAAO,MAAM,SAAS,UAAW,KAAK,CAAC,YAAY,KAAG,MACmC,CAAC;AAE1F;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,aAAc,MAAM,MAAM,MAAM,SAAS,KAAK,CAAC,YAAY,KAAG,KAOf,CAAC;AAE7E;;;;;GAKG;AACH,eAAO,MAAM,aAAa,aACb,MAAM,MAAM,MAAM,MAC5B,CAAC,UACQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,KACjE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,CAKjE,CAAC"}

package/dist/caddy/config-lifecycle.d.ts

@@ -1,33 +1,38 @@
 /**
- * CaddyConfig's read / diff / reconcile as plain async functions over a CaddyAdmin, so the
- * lifecycle runs against a fake admin server in tests.
+ * CaddyConfig's validate / read / probe as Effects over `@distilled.cloud/caddy`'s typed `admin`
+ * operations (admin-calls.ts), so the lifecycle runs against a fake admin server in tests — and,
+ * since fake-caddy.ts is a real HTTP server, against the real distilled wire protocol too.
+ * config-reconcile.ts covers `diff`/`reconcile`, the other half of the same lifecycle.
  *
  * The comparison is always between DIGESTS OF ADAPTED JSON (digest.ts): what `POST /adapt` makes
- * of the declared Caddyfile, what `GET /config/` reports, and what was stored after the last
- * apply. Three digests, because they answer different questions:
- *   · declared ≠ stored — the declaration changed.
- *   · live ≠ stored — DRIFT: a hand `curl` to the API, or a restart that loaded a different file
- *     (or an `autosave.json` holding someone else's change, under `--resume`).
- *   · declared = live — nothing to load, whatever the state says.
- * With NO state there is no stored digest, and the question is whose config is running: see
- * `claimable` below, which both the adoption probe and the apply ask.
+ * of the declared Caddyfile and what `GET /config/` reports — `claimable` below asks whether a
+ * running config is provably the declared one, which both the adoption probe and the apply need.
  */
-import type { Diff } from 'alchemy/Diff';
-import { type CaddyAdmin } from './admin.ts';
+import * as Effect from 'effect/Effect';
+import type * as Caddy from '@distilled.cloud/caddy';
+import { CaddyAdminService } from './admin.ts';
 import { type CaddyConfigAttributes, type CaddyConfigProps } from './config-form.ts';
 type Desired = {
     readonly digest: string;
     readonly warnings: readonly string[];
 };
+/**
+ * ⛔ A CONFIG WITH NO APPS SERVES NOTHING. A Caddyfile of only comments or only global options
+ *   passes the empty-text check (config-form.ts) yet adapts to `{}` or `{"admin":…}` — MEASURED
+ *   2026-09-21 on a throwaway Caddy 2.11.4 — and loading it stops every server: the same outage,
+ *   from the same templating bug, that the empty check exists to prevent.
+ */
+export declare const servesNothing: (config: unknown) => boolean;
 /**
  * Validate the props, adapt the Caddyfile on the running Caddy, and check its `admin` block.
  * ★ Every refusal happens HERE, before anything is loaded — and diff calls this at plan time, so a
  *   Caddyfile that does not adapt, carries a literal secret, or would strand the admin API fails the
  *   PLAN, before any resource (a HostFile holding the same text included) is applied.
  */
-export declare const desiredConfig: (admin: CaddyAdmin, props: CaddyConfigProps) => Promise<Desired>;
+export declare const desiredConfig: (props: CaddyConfigProps) => Effect.Effect<Desired, Error | Caddy.CaddyOpError, CaddyAdminService | Caddy.CaddyOpContext>;
+export declare const attributesOf: (endpoint: string, running: unknown, sourceFile?: string) => CaddyConfigAttributes;
 /** What is running now, as attributes. `sourceFile` is carried over, never discovered. */
-export declare const readLive: (admin: CaddyAdmin, sourceFile?: string) => Promise<CaddyConfigAttributes>;
+export declare const readLive: (sourceFile?: string) => Effect.Effect<CaddyConfigAttributes, Error | Caddy.CaddyOpError, CaddyAdminService | Caddy.CaddyOpContext>;
 /**
  * ⛔ WITH NO STATE, A RUNNING CONFIG IS THIS STACK'S ONLY IF IT IS THE DECLARED ONE (decision,
  *   2026-09-21: CaddyConfig must not adopt silently — the house rule HostFile and LaunchdJob keep).
@@ -52,40 +57,6 @@ export type Probe = {
  *   adapt then would fail every later plan, the one carrying the fix included. What cannot be
  *   compared is "not proven ours", with the reason; the next diff or apply validates the Caddyfile.
  */
-export declare const probeLive: (admin: CaddyAdmin, caddyfile: string | undefined, sourceFile?: string) => Promise<Probe | undefined>;
-/**
- * ★ NEVER `replace`. Nothing in the props names a different object: a new Caddyfile is a reload of
- *   the same Caddy, and `sourceFile` is a header. (Which Caddy is the transport's business — see
- *   the ⚠️ on `endpoint` in the diff.)
- */
-export declare const diffConfig: (admin: CaddyAdmin, news: CaddyConfigProps, output: CaddyConfigAttributes) => Promise<Diff>;
-export type Applied = {
-    readonly attributes: CaddyConfigAttributes;
-    /** The adapter's warnings (e.g. "Caddyfile input is not formatted") — log them, never refuse. */
-    readonly warnings: readonly string[];
-    /** Whether a `POST /load` was sent (false when Caddy already ran this config). */
-    readonly loaded: boolean;
-};
-/**
- * What this apply may load over — config.ts decides from the state and the adopt setting:
- *   · `takeOver` — any running config: the state was applied to THIS Caddy (an update, drift
- *     correction, or a create the engine adopted), or adoption is on (`--adopt`, or the
- *     resource's own `adopt(true)` — ownership/adopt.ts adoptEnabled).
- *   · otherwise only a claimable one — plus, as `stored`, the digest the state last recorded: a
- *     Caddy reached at a NEW endpoint that runs exactly that is the same config under another name.
- */
-export type Authority = {
-    readonly takeOver: boolean;
-    readonly stored?: string;
-};
-/**
- * Load the Caddyfile unless Caddy already runs it, then read it back and insist it matches.
- * ⛔ WITHOUT `takeOver`, A CONFIG THE STACK CANNOT CLAIM IS NEVER LOADED OVER. The engine's adoption
- *   probe cannot guard every create: it is skipped while `news` holds an Output — ALWAYS on
- *   caddyWithFile's first deploy (`sourceFile` is its HostFile's path) — and a Caddy that was down at
- *   plan time read as nothing. Nor does state vouch for a Caddy the transport NOW reaches at another
- *   endpoint (diff plans that as an update). Refused here, before any `/load`, like HostFile's.
- */
-export declare const reconcileConfig: (admin: CaddyAdmin, props: CaddyConfigProps, authority: Authority) => Promise<Applied>;
+export declare const probeLive: (caddyfile: string | undefined, sourceFile?: string) => Effect.Effect<Probe | undefined, Caddy.CaddyOpError, CaddyAdminService | Caddy.CaddyOpContext>;
 export {};
 //# sourceMappingURL=config-lifecycle.d.ts.map

package/dist/caddy/config-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-lifecycle.d.ts","sourceRoot":"","sources":["../../src/caddy/config-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,KAAK,UAAU,EAAyB,MAAM,YAAY,CAAC;AAQpE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAEtB,MAAM,kBAAkB,CAAC;AAQ1B,KAAK,OAAO,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAcjF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,UACjB,UAAU,SACV,gBAAgB,KACtB,OAAO,CAAC,OAAO,CAUjB,CAAC;AAYF,0FAA0F;AAC1F,eAAO,MAAM,QAAQ,UACZ,UAAU,eACJ,MAAM,KAClB,OAAO,CAAC,qBAAqB,CACiC,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,YAAa,OAAO,kBAAkB,MAAM,KAAG,OACD,CAAC;AAErE,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,UACb,UAAU,aACN,MAAM,GAAG,SAAS,eAChB,MAAM,KAClB,OAAO,CAAC,KAAK,GAAG,SAAS,CAmB3B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,UAAU,UACd,UAAU,QACX,gBAAgB,UACd,qBAAqB,KAC5B,OAAO,CAAC,IAAI,CAYd,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,UACnB,UAAU,SACV,gBAAgB,aACZ,SAAS,KACnB,OAAO,CAAC,OAAO,CA8CjB,CAAC"}
+{"version":3,"file":"config-lifecycle.d.ts","sourceRoot":"","sources":["../../src/caddy/config-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,KAAK,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAK/C,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAEtB,MAAM,kBAAkB,CAAC;AAG1B,KAAK,OAAO,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAAY,OAAO,KAAG,OAI/C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,UACjB,gBAAgB,KACtB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAgB1F,CAAC;AAEL,eAAO,MAAM,YAAY,aACb,MAAM,WACP,OAAO,eACH,MAAM,KAClB,qBAID,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,QAAQ,gBACN,MAAM,KAClB,MAAM,CAAC,MAAM,CACd,qBAAqB,EACrB,KAAK,GAAG,KAAK,CAAC,YAAY,EAC1B,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAMtC,CAAC;AAEL;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,YAAa,OAAO,kBAAkB,MAAM,KAAG,OACD,CAAC;AAErE,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,cACT,MAAM,GAAG,SAAS,eAChB,MAAM,KAClB,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,iBAAiB,GAAG,KAAK,CAAC,cAAc,CA6B5F,CAAC"}

package/dist/caddy/config-reconcile.d.ts

@@ -0,0 +1,45 @@
+/**
+ * CaddyConfig's diff / reconcile — the apply half of the lifecycle config-lifecycle.ts's
+ * `desiredConfig`/`readLive`/`probeLive` compute the inputs for. Split out at the 250-line file
+ * cap; the two files together are one lifecycle, read config-lifecycle.ts's module doc first.
+ */
+import * as Effect from 'effect/Effect';
+import type * as Diff from 'alchemy/Diff';
+import type * as Caddy from '@distilled.cloud/caddy';
+import { CaddyAdminService } from './admin.ts';
+import type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';
+/**
+ * ★ NEVER `replace`. Nothing in the props names a different object: a new Caddyfile is a reload of
+ *   the same Caddy, and `sourceFile` is a header. (Which Caddy is the transport's business — see
+ *   the ⚠️ on `endpoint` in the diff.)
+ */
+export declare const diffConfig: (news: CaddyConfigProps, output: CaddyConfigAttributes) => Effect.Effect<Diff.Diff, Error | Caddy.CaddyOpError, CaddyAdminService | Caddy.CaddyOpContext>;
+export type Applied = {
+    readonly attributes: CaddyConfigAttributes;
+    /** The adapter's warnings (e.g. "Caddyfile input is not formatted") — log them, never refuse. */
+    readonly warnings: readonly string[];
+    /** Whether a `POST /load` was sent (false when Caddy already ran this config). */
+    readonly loaded: boolean;
+};
+/**
+ * What this apply may load over — config.ts decides from the state and the adopt setting:
+ *   · `takeOver` — any running config: the state was applied to THIS Caddy (an update, drift
+ *     correction, or a create the engine adopted), or adoption is on (`--adopt`, or the
+ *     resource's own `adopt(true)` — ownership/adopt.ts adoptEnabled).
+ *   · otherwise only a claimable one — plus, as `stored`, the digest the state last recorded: a
+ *     Caddy reached at a NEW endpoint that runs exactly that is the same config under another name.
+ */
+export type Authority = {
+    readonly takeOver: boolean;
+    readonly stored?: string;
+};
+/**
+ * Load the Caddyfile unless Caddy already runs it, then read it back and insist it matches.
+ * ⛔ WITHOUT `takeOver`, A CONFIG THE STACK CANNOT CLAIM IS NEVER LOADED OVER. The engine's adoption
+ *   probe cannot guard every create: it is skipped while `news` holds an Output — ALWAYS on
+ *   caddyWithFile's first deploy (`sourceFile` is its HostFile's path) — and a Caddy that was down at
+ *   plan time read as nothing. Nor does state vouch for a Caddy the transport NOW reaches at another
+ *   endpoint (diff plans that as an update). Refused here, before any `/load`, like HostFile's.
+ */
+export declare const reconcileConfig: (props: CaddyConfigProps, authority: Authority) => Effect.Effect<Applied, Error | Caddy.CaddyOpError, CaddyAdminService | Caddy.CaddyOpContext>;
+//# sourceMappingURL=config-reconcile.d.ts.map

package/dist/caddy/config-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-reconcile.d.ts","sourceRoot":"","sources":["../../src/caddy/config-reconcile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,IAAI,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,KAAK,KAAK,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAI/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAIhF;;;;GAIG;AACH,eAAO,MAAM,UAAU,SACf,gBAAgB,UACd,qBAAqB,KAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAc5F,CAAC;AAEL,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,UACnB,gBAAgB,aACZ,SAAS,KACnB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAmE1F,CAAC"}

package/dist/caddy/config.d.ts

@@ -1,6 +1,6 @@
 /**
  * `Caddy.Config` — a running Caddy's whole config, declared as Caddyfile text and applied through
- * Caddy's own admin API (decision 23).
+ * Caddy's own admin API (decision 23), via `@distilled.cloud/caddy`'s typed `admin` operations.
  *
  * - create / update — `POST /adapt` (validate), `POST /load` with `text/caddyfile` (a graceful
  *   reload; Caddy keeps the old config if it refuses the new one, and the error names why), then
@@ -20,7 +20,8 @@
  *   the deploy runs with `--adopt`. A Caddy serving nothing reads as absent: a create. Where the
  *   engine skips that probe, reconcile refuses the same takeover (config-lifecycle.ts).
  * ⛔ `caddyfile` IS NEVER A SECRET — see config-form.ts; refused before anything is sent.
- * ⚠️ WHICH CADDY is the transport's (providers.ts), not a prop: one CaddyAdmin per stack.
+ * ⚠️ WHICH CADDY is the transport's (providers.ts): `CaddyAdminService` plus the `Credentials`/
+ *   `HttpClient` layers `caddyAdminLayer` merges — one per stack, not a prop.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
@@ -30,5 +31,5 @@ export type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';
 export interface CaddyConfig extends Resource<'Caddy.Config', CaddyConfigProps, CaddyConfigAttributes> {
 }
 export declare const CaddyConfig: import("alchemy").ResourceClass<CaddyConfig>;
-export declare const CaddyConfigProvider: () => import("effect/Layer").Layer<Provider.Provider<CaddyConfig>, never, CaddyAdminService>;
+export declare const CaddyConfigProvider: () => import("effect/Layer").Layer<Provider.Provider<CaddyConfig>, never, CaddyAdminService | import("@distilled.cloud/caddy").CaddyOpContext>;
 //# sourceMappingURL=config.d.ts.map

package/dist/caddy/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/caddy/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAAE,iBAAiB,EAAyB,MAAM,YAAY,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGhF,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAsBH,eAAO,MAAM,mBAAmB,8FAsF7B,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/caddy/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAIhF,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAoBH,eAAO,MAAM,mBAAmB,gJA+E7B,CAAC"}

package/dist/caddy/fake-caddy.d.ts

@@ -17,7 +17,9 @@
  * ★ `listenPort` is the port Caddy BELIEVES it listens on — its Host check uses it — while the
  *   fake really listens on an ephemeral one: a Caddy on its default :2019 behind a forward.
  */
-import type { CaddyAdmin } from './admin.ts';
+import * as Effect from 'effect/Effect';
+import type * as Caddy from '@distilled.cloud/caddy';
+import { type CaddyAdminService, type CaddyTransport } from './admin.ts';
 export type Seen = {
     readonly method: string;
     readonly path: string;
@@ -48,7 +50,13 @@ export declare const fakeCaddy: (options?: {
  *   move it (admin-guard.ts).
  */
 export declare const fakeDefaultCaddy: (running?: unknown) => {
-    admin: CaddyAdmin;
+    admin: CaddyTransport;
     caddy: FakeCaddy;
 };
+/**
+ * Runs an Effect that needs `CaddyAdminService` and `@distilled.cloud/caddy`'s own `Credentials`/
+ * `HttpClient` against one transport — the one line every test in this directory used to spend on
+ * `Effect.provide(caddyAdminLayer(admin))` before this helper existed.
+ */
+export declare const runCaddy: <A, E>(effect: Effect.Effect<A, E, CaddyAdminService | Caddy.CaddyOpContext>, admin: CaddyTransport) => Promise<A>;
 //# sourceMappingURL=fake-caddy.d.ts.map

package/dist/caddy/fake-caddy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-caddy.d.ts","sourceRoot":"","sources":["../../src/caddy/fake-caddy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtB,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,IAAI,IAAI,IAAI,CAAC;CACd,CAAC;AAqDF,eAAO,MAAM,SAAS,aACX;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KACrF,SAoEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,aAAc,OAAO,KAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAQzF,CAAC"}
+{"version":3,"file":"fake-caddy.d.ts","sourceRoot":"","sources":["../../src/caddy/fake-caddy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,KAAK,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAmB,MAAM,YAAY,CAAC;AAG1F,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtB,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,IAAI,IAAI,IAAI,CAAC;CACd,CAAC;AAqDF,eAAO,MAAM,SAAS,aACX;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KACrF,SAwEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,aACjB,OAAO,KAChB;IAAE,KAAK,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAQ3C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,CAAC,UACnB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAAC,SAC9D,cAAc,KACpB,OAAO,CAAC,CAAC,CAA2E,CAAC"}

package/dist/caddy/index.d.ts

@@ -15,9 +15,9 @@
  *   `@homeflare/cloudflare/access-auth`. Guide: docs/access-auth.md.
  */
 export { accessForwardAuth, verifierProblems, type AccessForwardAuthProps, } from './access-forward-auth.ts';
-export type { CaddyAdmin, CaddyAdminListener, CaddyAdminRequest, CaddyAdminResponse, } from './admin.ts';
-export { CaddyAdminService, CaddyUnreachableError, caddyAdminLayer } from './admin.ts';
-export { CaddyAdminError } from './admin-calls.ts';
+export type { CaddyAdminListener, CaddyTarget, CaddyTransport } from './admin.ts';
+export { CaddyAdminService, caddyAdminLayer } from './admin.ts';
+export { isUnreachable } from './caddy-http-client.ts';
 export type { CaddyConfigAttributes, CaddyConfigProps } from './config.ts';
 export { CaddyConfig, CaddyConfigProvider } from './config.ts';
 export type { LocalCaddyAdminOptions } from './local-admin.ts';

package/dist/caddy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/caddy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,sBAAsB,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/caddy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,sBAAsB,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}