@homeflare/alchemy 0.29.1 → 0.31.0

package/README.md

@@ -208,6 +208,10 @@ with `HostFile`; `caddyProviders()` provides the transport, `http://127.0.0.1:20
 - ⛔ **Delete never unloads or stops Caddy.** Order of file and load: [docs/caddy.md](./docs/caddy.md).
 - ★ **Managed Caddies run `--resume` with their own `XDG_CONFIG_HOME`**, so a restart runs the last
   config Caddy accepted — and after one, SIGUSR1 has no file to reload. Why, and the rest: same doc.
+- **`formatCaddyfile(text)`** runs the local `caddy fmt -` binary (no admin API does this); plan and
+  deploy both call out Caddy's own "not formatted" warning as its own clear line. Formatting should
+  never change the adapted JSON (reasoned from the grammar, not measured in this package — see the
+  doc). Details: [docs/caddy-fmt.md](./docs/caddy-fmt.md).
 
 ## PostgreSQL — `@homeflare/alchemy/postgres`
 
@@ -245,6 +249,44 @@ endpoint lives in ONE `general_settings` field (a whole-list read-modify-write),
 declared in `config.yaml` is refused rather than silently overridden, and a literal secret in a
 forwarded header is refused at plan: [docs/litellm.md](./docs/litellm.md).
 
+## Discord — `@homeflare/alchemy/discord`
+
+`Discord.ApplicationCommand` (global) and `Discord.GuildApplicationCommand` (guild-scoped)
+declare a slash/user/message command, generated from Discord API v10 via
+`@distilled.cloud/discord`. `reconcile` is one upsert call — Discord's own create endpoint
+overwrites a command with the same name. ⛔ `read` answers `Unowned` on every match (never a
+silent adopt — `adopt(true)` is on by default on both constructors), and declaring
+`Discord.GuildApplicationCommand` against a guild `hf-discord-halibut.service` still
+self-registers into fights the bot, not replaces it: [docs/discord.md](./docs/discord.md).
+
+```ts
+import { applicationCommand, guildApplicationCommand, providers } from '@homeflare/alchemy/discord';
+
+export const help =
+  yield *
+  applicationCommand('help', {
+    applicationId: '123456789012345678',
+    name: 'help',
+    description: 'Show available commands',
+  });
+```
+
+## Google Workspace — `@homeflare/alchemy/google-workspace`
+
+`Group`, `GroupMember`, `DomainAlias` and `OrgUnit` over the Admin SDK Directory API, generated
+from `@distilled.cloud/google-workspace@1.0.0-rc.12`. ⛔ No `User` resource — Google's own `User`
+schema carries a `password` field, and Alchemy persists props unencrypted. Credential setup
+(domain-wide delegation, the least scopes each resource needs, where the key lives in OpenBao):
+[docs/google-workspace.md](./docs/google-workspace.md).
+
+## Grafana — `@homeflare/alchemy/grafana`
+
+`Grafana.Datasource` declares one data source, keyed by `uid`, generated from
+`@distilled.cloud/grafana`'s own typed `addDataSource`/`getDataSourceByUID`/
+`updateDataSourceByUID`/`deleteDataSourceByUID` operations. ⛔ The SDK at `1.0.0-rc.12` has no
+folder, dashboard, alert-rule or contact-point CRUD — only `Datasource` ships, and the gap is
+recorded rather than worked around: [docs/grafana.md](./docs/grafana.md).
+
 ## GitHub — `@homeflare/alchemy/github`
 
 `declareRepoPolicy` declares one repository's merge policy and its default-branch ruleset in a

package/dist/caddy/config-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-reconcile.d.ts","sourceRoot":"","sources":["../../src/caddy/config-reconcile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,IAAI,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,KAAK,KAAK,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAI/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAIhF;;;;GAIG;AACH,eAAO,MAAM,UAAU,SACf,gBAAgB,UACd,qBAAqB,KAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAc5F,CAAC;AAEL,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,UACnB,gBAAgB,aACZ,SAAS,KACnB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAmE1F,CAAC"}
+{"version":3,"file":"config-reconcile.d.ts","sourceRoot":"","sources":["../../src/caddy/config-reconcile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,IAAI,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,KAAK,KAAK,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAI/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAKhF;;;;GAIG;AACH,eAAO,MAAM,UAAU,SACf,gBAAgB,UACd,qBAAqB,KAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAmB5F,CAAC;AAEL,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,UACnB,gBAAgB,aACZ,SAAS,KACnB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAmE1F,CAAC"}

package/dist/caddy/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/caddy/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAIhF,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAoBH,eAAO,MAAM,mBAAmB,gJA+E7B,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/caddy/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAKhF,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAoBH,eAAO,MAAM,mBAAmB,gJAqF7B,CAAC"}

package/dist/caddy/format-warnings.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Pulls Caddy's adapter "Caddyfile input is not formatted" warning(s) out of a warnings list, so
+ * config.ts's reconcile (deploy) and config-reconcile.ts's diffConfig (plan) can show it as one
+ * clear, actionable line instead of burying it among the rest.
+ *
+ * ★ THIS IS THE COMMON CASE, NOT AN EDGE ONE. admin-calls.ts's module doc: the Caddyfile adapter
+ *   warns on EVERY unformatted input (adapter.go FormattingDifference) — every declared Caddyfile
+ *   that was not run through `caddy fmt` (or format.ts's formatCaddyfile()) carries this warning
+ *   on every plan and every deploy, indistinguishable from the rest unless split out.
+ */
+export type SplitWarnings = {
+    /**
+     * Every warning THAT IS the formatting one — usually one, but an `import`ed file can add
+     * another with its own file:line, and this keeps every one of them (never just the first): a
+     * `.find()` here would silently drop the rest, not merely leave them uncounted.
+     */
+    readonly formatting: readonly string[];
+    /** Every other warning, in order, formatting removed. */
+    readonly rest: readonly string[];
+};
+/** Separates the formatting warning(s) (by substring, matching admin-calls.ts's `describe()`). */
+export declare const splitFormattingWarning: (warnings: readonly string[]) => SplitWarnings;
+/**
+ * One clear line naming the fix — never just the adapter's own warning text, and never repeated
+ * per formatting warning: however many `formatting` holds, this is logged once (config.ts,
+ * config-reconcile.ts), since restating the same fix N times is its own noise.
+ */
+export declare const formattingFixLine: (endpoint: string) => string;
+//# sourceMappingURL=format-warnings.d.ts.map

package/dist/caddy/format-warnings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-warnings.d.ts","sourceRoot":"","sources":["../../src/caddy/format-warnings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,sBAAsB,aAAc,SAAS,MAAM,EAAE,KAAG,aAGnE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAAc,MAAM,KAAG,MAEqC,CAAC"}

package/dist/caddy/format.d.ts

@@ -0,0 +1,50 @@
+/**
+ * `formatCaddyfile(text)` — pipes a Caddyfile through the LOCAL `caddy fmt -` binary (stdin in,
+ * formatted text out), the same formatter the `caddy fmt` CLI command runs
+ * (caddyconfig/caddyfile Format in caddyserver/caddy).
+ *
+ * ⛔ THERE IS NO ADMIN API FOR THIS. `caddy fmt` is a CLI-only feature (cmd/commandfuncs.go); no
+ *   `/adapt`, `/load` or other admin endpoint formats a Caddyfile, so this never belongs in
+ *   `@distilled.cloud/caddy` — measured 2026-09-24. It shells out instead, the same pattern
+ *   talos/talosctl.ts uses for a vendor CLI Alchemy does not wrap.
+ * ⛔ NEVER REIMPLEMENTED IN TS. The Caddyfile grammar's formatting rules live in the Go adapter;
+ *   a hand-rolled formatter would drift from it silently. This module only ever runs the real
+ *   binary.
+ * ⛔ A MISSING OR FAILING BINARY FAILS THE EFFECT — IT NEVER RETURNS THE INPUT UNCHANGED.
+ *   `CaddyFmtNotFound` and `CaddyFmtFailed` are typed, catchTag-able failures (S21); there is no
+ *   fallback path that silently skips formatting.
+ * ★ WHY THIS MATTERS: admin-calls.ts's module doc — Caddy's adapter warns "Caddyfile input is not
+ *   formatted" on EVERY unformatted input (adapter.go FormattingDifference), which shares the
+ *   `/load` response body with the refused-but-200 trap. format-warnings.ts surfaces that warning
+ *   distinctly in plan/deploy output; this function is how a caller silences it — by formatting
+ *   the Caddyfile before declaring it, not by ignoring the warning.
+ */
+import * as Effect from 'effect/Effect';
+import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
+import type * as PlatformError from 'effect/PlatformError';
+/** `caddy` resolved on `PATH`, unless the caller points at a specific build. */
+export declare const DEFAULT_CADDY_BINARY = "caddy";
+/** The configured binary is not on `PATH` (or not executable) — install Caddy, or fix the path. */
+export declare class CaddyFmtNotFound extends Error {
+    readonly binaryPath: string;
+    readonly _tag = "CaddyFmtNotFound";
+    constructor(binaryPath: string, cause: PlatformError.PlatformError);
+}
+/** The binary ran but exited non-zero — a syntax error in `text`, most likely. */
+export declare class CaddyFmtFailed extends Error {
+    readonly binaryPath: string;
+    readonly exitCode: number;
+    readonly _tag = "CaddyFmtFailed";
+    constructor(binaryPath: string, exitCode: number, stderr: string);
+}
+export type FormatCaddyfileOptions = {
+    /** The `caddy` binary to run `fmt -` against. @default DEFAULT_CADDY_BINARY, resolved on PATH. */
+    readonly binaryPath?: string;
+};
+/**
+ * Format a Caddyfile the way `caddy fmt` would, by actually running it — never a TS
+ * reimplementation. Requires `ChildProcessSpawner` (S19: no `node:child_process`, no
+ * `async`/`await`); provide `@effect/platform-node`'s or `@effect/platform-bun`'s layer.
+ */
+export declare const formatCaddyfile: (text: string, options?: FormatCaddyfileOptions) => Effect.Effect<string, CaddyFmtNotFound | CaddyFmtFailed | PlatformError.PlatformError, ChildProcessSpawner.ChildProcessSpawner>;
+//# sourceMappingURL=format.d.ts.map

package/dist/caddy/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/caddy/format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AACnF,OAAO,KAAK,KAAK,aAAa,MAAM,sBAAsB,CAAC;AAE3D,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C,mGAAmG;AACnG,qBAAa,gBAAiB,SAAQ,KAAK;IAGvC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAF7B,QAAQ,CAAC,IAAI,sBAAsB;IACnC,YACW,UAAU,EAAE,MAAM,EAC3B,KAAK,EAAE,aAAa,CAAC,aAAa,EAOnC;CACF;AAED,kFAAkF;AAClF,qBAAa,cAAe,SAAQ,KAAK;IAGrC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAH3B,QAAQ,CAAC,IAAI,oBAAoB;IACjC,YACW,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,EAMf;CACF;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,kGAAkG;IAClG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,SACpB,MAAM,YACH,sBAAsB,KAC9B,MAAM,CAAC,MAAM,CACd,MAAM,EAGN,gBAAgB,GAAG,cAAc,GAAG,aAAa,CAAC,aAAa,EAC/D,mBAAmB,CAAC,mBAAmB,CA0CrC,CAAC"}

package/dist/caddy/index.d.ts

@@ -20,6 +20,7 @@ export { CaddyAdminService, caddyAdminLayer } from './admin.ts';
 export { isUnreachable } from './caddy-http-client.ts';
 export type { CaddyConfigAttributes, CaddyConfigProps } from './config.ts';
 export { CaddyConfig, CaddyConfigProvider } from './config.ts';
+export { CaddyFmtFailed, CaddyFmtNotFound, DEFAULT_CADDY_BINARY, formatCaddyfile, type FormatCaddyfileOptions, } from './format.ts';
 export type { LocalCaddyAdminOptions } from './local-admin.ts';
 export { DEFAULT_ADMIN_ADDRESS, localCaddyAdmin } from './local-admin.ts';
 export { caddyProviders } from './providers.ts';

package/dist/caddy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/caddy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,sBAAsB,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/caddy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,sBAAsB,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/caddy/index.js

@@ -862,9 +862,22 @@ var probeLive = (caddyfile, sourceFile) => Effect9.gen(function* () {
 // src/caddy/config-reconcile.ts
 import * as Effect10 from "effect/Effect";
 import * as Result3 from "effect/Result";
+
+// src/caddy/format-warnings.ts
+var NOT_FORMATTED = "Caddyfile input is not formatted";
+var splitFormattingWarning = (warnings) => ({
+  formatting: warnings.filter((warning) => warning.includes(NOT_FORMATTED)),
+  rest: warnings.filter((warning) => !warning.includes(NOT_FORMATTED))
+});
+var formattingFixLine = (endpoint) => `Caddy.Config at ${endpoint}: Caddyfile is not formatted — run \`caddy fmt\` on it, or format ` + "it with this package's formatCaddyfile() before declaring it, to silence this warning.";
+
+// src/caddy/config-reconcile.ts
 var diffConfig = (news, output) => Effect10.gen(function* () {
   const { endpoint } = yield* CaddyAdminService;
   const want = yield* desiredConfig(news);
+  const { formatting } = splitFormattingWarning(want.warnings);
+  if (formatting.length > 0)
+    yield* Effect10.logWarning(formattingFixLine(endpoint));
   const live = yield* readLive();
   const converged = want.digest === live.configSha256 && live.configSha256 === output.configSha256 && news.sourceFile === output.sourceFile && endpoint === output.endpoint;
   return converged ? { action: "noop" } : { action: "update" };
@@ -938,7 +951,11 @@ var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect11.gen(functi
       const takeOver = sameCaddy || (yield* adoptEnabled(fqn));
       const stored = output === undefined ? {} : { stored: output.configSha256 };
       const applied = yield* reconcileConfig(news, { takeOver, ...stored });
-      for (const warning of applied.warnings) {
+      const { formatting, rest } = splitFormattingWarning(applied.warnings);
+      if (formatting.length > 0) {
+        yield* Effect11.logWarning(formattingFixLine(admin.endpoint));
+      }
+      for (const warning of rest) {
         yield* Effect11.logWarning(`Caddy.Config at ${admin.endpoint}: ${warning}`);
       }
       return applied.attributes;
@@ -946,6 +963,53 @@ var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect11.gen(functi
     delete: () => Effect11.void
   });
 }));
+// src/caddy/format.ts
+import * as Effect12 from "effect/Effect";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+var DEFAULT_CADDY_BINARY = "caddy";
+
+class CaddyFmtNotFound extends Error {
+  binaryPath;
+  _tag = "CaddyFmtNotFound";
+  constructor(binaryPath, cause) {
+    super(`formatCaddyfile: "${binaryPath}" was not found (${cause.message}). Install Caddy so it is ` + "on PATH, or pass { binaryPath } naming the exact build the target Caddy runs.");
+    this.binaryPath = binaryPath;
+    this.name = "CaddyFmtNotFound";
+  }
+}
+
+class CaddyFmtFailed extends Error {
+  binaryPath;
+  exitCode;
+  _tag = "CaddyFmtFailed";
+  constructor(binaryPath, exitCode, stderr) {
+    super(`formatCaddyfile: "${binaryPath} fmt -" exited ${String(exitCode)}: ${stderr.slice(0, 300)}`);
+    this.binaryPath = binaryPath;
+    this.exitCode = exitCode;
+    this.name = "CaddyFmtFailed";
+  }
+}
+var formatCaddyfile = (text, options = {}) => Effect12.gen(function* () {
+  const binaryPath = options.binaryPath ?? DEFAULT_CADDY_BINARY;
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const input = new TextEncoder().encode(text);
+  const result4 = yield* ChildProcess.make(binaryPath, ["fmt", "-"], {
+    detached: false,
+    stderr: "pipe",
+    stdin: Stream.make(input),
+    stdout: "pipe"
+  }).pipe(spawner.spawn, Effect12.flatMap((child) => Effect12.all({
+    exitCode: child.exitCode,
+    stderr: child.stderr.pipe(Stream.decodeText, Stream.mkString, Effect12.map((out) => out.trim())),
+    stdout: child.stdout.pipe(Stream.decodeText, Stream.mkString)
+  }, { concurrency: "unbounded" })), Effect12.scoped, Effect12.catchTag("PlatformError", (error) => error.reason._tag === "NotFound" ? Effect12.fail(new CaddyFmtNotFound(binaryPath, error)) : Effect12.fail(error)));
+  if (result4.exitCode !== 0) {
+    return yield* Effect12.fail(new CaddyFmtFailed(binaryPath, result4.exitCode, result4.stderr));
+  }
+  return result4.stdout;
+});
 // src/caddy/local-admin.ts
 import * as Layer3 from "effect/Layer";
 import * as Caddy2 from "@distilled.cloud/caddy";
@@ -1013,7 +1077,7 @@ var localCaddyAdmin = (options = {}) => {
 import * as Layer4 from "effect/Layer";
 var caddyProviders = (transport = localCaddyAdmin()) => CaddyConfigProvider().pipe(Layer4.provideMerge(caddyAdminLayer(transport)));
 // src/caddy/with-file.ts
-import * as Effect13 from "effect/Effect";
+import * as Effect14 from "effect/Effect";
 import * as RemovalPolicy from "alchemy/RemovalPolicy";
 
 // src/launchd/host-file.ts
@@ -1021,7 +1085,7 @@ import { Resource as Resource2 } from "alchemy";
 import { Unowned as Unowned3 } from "alchemy/AdoptPolicy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect12 from "effect/Effect";
+import * as Effect13 from "effect/Effect";
 
 // src/launchd/file-identity.ts
 var sameEntry = (a, b) => {
@@ -1216,10 +1280,10 @@ var deleteFile = (runner, output) => removeWholeFile(runner, output, refuse3);
 
 // src/launchd/host-file.ts
 var HostFile = Resource2("Host.File");
-var HostFileProvider = () => Provider2.effect(HostFile, Effect12.gen(function* () {
+var HostFileProvider = () => Provider2.effect(HostFile, Effect13.gen(function* () {
   const runner = yield* HostRunnerService;
   return HostFile.Provider.of({
-    list: () => Effect12.succeed([]),
+    list: () => Effect13.succeed([]),
     read: ({ olds, output }) => lift(async () => {
       const found = await readFileAttributes(runner, olds.path);
       if (found === undefined)
@@ -1233,19 +1297,19 @@ var HostFileProvider = () => Provider2.effect(HostFile, Effect12.gen(function* (
         return lift(() => diffFile(runner, news, output));
       const path = resolvedString(news, "path");
       if (path === undefined || path === output.path)
-        return Effect12.succeed(undefined);
+        return Effect13.succeed(undefined);
       return lift(async () => await oneFile(runner, path, output.path) === true ? undefined : { action: "replace" });
     },
-    reconcile: ({ fqn, instanceId, news, output }) => Effect12.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) => lift(() => reconcileFile(runner, news, output, adopt))),
+    reconcile: ({ fqn, instanceId, news, output }) => Effect13.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) => lift(() => reconcileFile(runner, news, output, adopt))),
     delete: ({ output }) => lift(() => deleteFile(runner, output))
   });
 }));
 
 // src/caddy/with-file.ts
-var caddyWithFile = (id, props) => Effect13.gen(function* () {
+var caddyWithFile = (id, props) => Effect14.gen(function* () {
   const found = configProblems({ caddyfile: props.caddyfile, sourceFile: props.path });
   if (found.length > 0) {
-    return yield* Effect13.fail(new Error(`caddyWithFile ${id}: ${found.join("; ")}`));
+    return yield* Effect14.fail(new Error(`caddyWithFile ${id}: ${found.join("; ")}`));
   }
   const file = yield* HostFile(`${id}-file`, {
     content: props.caddyfile,
@@ -1261,15 +1325,19 @@ export {
   CaddyAdminService,
   CaddyConfig,
   CaddyConfigProvider,
+  CaddyFmtFailed,
+  CaddyFmtNotFound,
   DEFAULT_ADMIN_ADDRESS,
+  DEFAULT_CADDY_BINARY,
   accessForwardAuth,
   caddyAdminLayer,
   caddyProviders,
   caddyWithFile,
+  formatCaddyfile,
   isUnreachable,
   localCaddyAdmin,
   verifierProblems
 };
 
-//# debugId=643BF5F5D21610F364756E2164756E21
+//# debugId=CC0C3E3E18BF8F0664756E2164756E21
 //# sourceMappingURL=index.js.map