@homeflare/alchemy 0.37.7 → 0.38.0

package/dist/linux/sudo-exec.d.ts

@@ -23,6 +23,22 @@
  *   is a valid type in `unit-form.ts`'s `TYPES` set) would also have elevated. Grepped: no code
  *   in this package ever calls `enable`/`start`/`restart` on a unit it has not itself just
  *   written a file for, so narrowing the exemption to `stop`/`disable` costs nothing legitimate.
+ * 🔴 MEASURED, CT100 deploy 2026-09-26 00:11Z: a THIRD gap, this one refusing a call that should
+ *   have been allowed. `Podman.Container caddy`'s generated `caddy.service` has
+ *   `FragmentPath=/run/systemd/generator/caddy.service` — Quadlet's generator output, never a
+ *   path this runner would ever declare as a prefix (nothing writes there directly) — so `restart`
+ *   was refused outright, even though the `.container` FILE THAT GENERATED IT lives at
+ *   `/etc/containers/systemd/caddy.container`, squarely under this runner's own
+ *   `/etc/containers/systemd` prefix, and this SAME runner had just written it. `SourcePath` is
+ *   the generator's own record of that file (systemctl.ts's header, MEASURED on CT100). So a
+ *   generated unit is now also reachable when its `FragmentPath` is the generator's OWN output
+ *   directory (`GENERATOR_DIRECTORIES` below) AND its `SourcePath` is under a declared prefix —
+ *   the thing this runner actually owns is the `.container` file, and the generated unit is
+ *   systemd's own derivative of it, not a foreign unit. Everything the check refused before still
+ *   refuses: a vendor unit's `FragmentPath` (`/usr/lib/systemd/system/...`) is not under a
+ *   generator directory at all; a generated unit with no `SourcePath`, or one outside every
+ *   prefix (a `.container` file elsewhere in Quadlet's OWN search path —
+ *   `podman-systemd.unit(5)` — that this runner was never told to own), still refuses.
  */
 import type { ExecResult, HostRunner } from '../launchd/runner.ts';
 import type { Elevate } from './sudo-write.ts';

package/dist/linux/sudo-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sudo-exec.d.ts","sourceRoot":"","sources":["../../src/linux/sudo-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAuC/C,iGAAiG;AACjG,eAAO,MAAM,YAAY,SACjB,UAAU,WACP,OAAO,YACN,SAAS,MAAM,EAAE,QACrB,SAAS,MAAM,EAAE,KACtB,OAAO,CAAC,UAAU,CA2CpB,CAAC"}
+{"version":3,"file":"sudo-exec.d.ts","sourceRoot":"","sources":["../../src/linux/sudo-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAInE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AA4D/C,iGAAiG;AACjG,eAAO,MAAM,YAAY,SACjB,UAAU,WACP,OAAO,YACN,SAAS,MAAM,EAAE,QACrB,SAAS,MAAM,EAAE,KACtB,OAAO,CAAC,UAAU,CAuDpB,CAAC"}

package/dist/linux/unit-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unit-form.d.ts","sourceRoot":"","sources":["../../src/linux/unit-form.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,WAAW,GAAG;IACxB,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;CACpE,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAClC,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gDAAgD;IAChD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,YAClC,qBAAqB,EACrB,qBAAqB,EACrB,+BAA+B,EAC/B,yBAAyB,EACzB,qBAAqB,CACb,CAAC;AAEX,mGAAmG;AACnG,eAAO,MAAM,UAAU;aAAK,GAAG,EAAE,CAAC;aAAE,IAAI,EAAE,GAAK;aAAE,GAAG,EAAE,CAAC;CAAW,CAAC;AAEnE,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,MAAmD,CAAC;AAE5F,4FAA4F;AAC5F,eAAO,MAAM,YAAY,cAAe,SAAS,MAAM,EAAE,GAAG,SAAS,KAAG,MAChC,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,eAAO,MAAM,aAAa,gBACX,MAAM,YACT,MAAM,GAAG,SAAS,WACnB,OAAO,KACf,OAKF,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,UAAU,aAAc,SAAS,WAAW,EAAE,KAAG,MAKzC,CAAC;AAEtB,eAAO,MAAM,QAAQ,UAAW,gBAAgB,KAAG,MACA,CAAC;AAEpD,eAAO,MAAM,WAAW,UAAW,gBAAgB,KAAG,MACQ,CAAC;AAE/D,mGAAmG;AACnG,eAAO,MAAM,IAAI,QAA6C,CAAC;AAkB/D;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,UAAW,gBAAgB,WAAW,MAAM,KAAG,MAAM,EAmC7E,CAAC"}
+{"version":3,"file":"unit-form.d.ts","sourceRoot":"","sources":["../../src/linux/unit-form.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,WAAW,GAAG;IACxB,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;CACpE,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAClC,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gDAAgD;IAChD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,YAClC,qBAAqB,EACrB,qBAAqB,EACrB,+BAA+B,EAC/B,yBAAyB,EACzB,qBAAqB,CACb,CAAC;AAEX,mGAAmG;AACnG,eAAO,MAAM,UAAU;aAAK,GAAG,EAAE,CAAC;aAAE,IAAI,EAAE,GAAK;aAAE,GAAG,EAAE,CAAC;CAAW,CAAC;AAEnE,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,MAAmD,CAAC;AAE5F,4FAA4F;AAC5F,eAAO,MAAM,YAAY,cAAe,SAAS,MAAM,EAAE,GAAG,SAAS,KAAG,MAChC,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,eAAO,MAAM,aAAa,gBACX,MAAM,YACT,MAAM,GAAG,SAAS,WACnB,OAAO,KACf,OAKF,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,UAAU,aAAc,SAAS,WAAW,EAAE,KAAG,MAKzC,CAAC;AAEtB,eAAO,MAAM,QAAQ,UAAW,gBAAgB,KAAG,MACA,CAAC;AAEpD,eAAO,MAAM,WAAW,UAAW,gBAAgB,KAAG,MACQ,CAAC;AAE/D,mGAAmG;AACnG,eAAO,MAAM,IAAI,QAA6C,CAAC;AAgB/D;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,UAAW,gBAAgB,WAAW,MAAM,KAAG,MAAM,EAmC7E,CAAC"}

package/dist/linux/unit-text.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The parts of `unit-form.ts`'s validation that inspect the unit file's TEXT rather than its
+ * props struct — split out so unit-form.ts stays under the file cap, and because these are one
+ * coherent concern: is this INI shape something systemd would actually load. Takes plain strings,
+ * never `SystemdUnitProps`, so it never needs to import back from unit-form.ts.
+ *
+ * ⛔ `[Install]` KEYS ARE `unit-form.ts`'s OWN LIST, NOT SYSTEMD'S FULL VOCABULARY — WantedBy,
+ *   RequiredBy, UpsertedBy, Also, Alias, per `systemd.unit(5)` §[Install]. `container-form.ts`'s
+ *   own header notes it deliberately does NOT reuse this set: a `.container` file's `[Install]`
+ *   supports only Alias/WantedBy/RequiredBy (`podman-systemd.unit(5)`), narrower than this.
+ */
+export declare const INSTALL_KEYS: Set<string>;
+/** Whether `text` has an `[Install]` section carrying at least one key systemd actually links on. */
+export declare const hasInstallSection: (text: string) => boolean;
+/**
+ * The first line that is neither blank nor a comment — the line whose shape actually decides
+ * whether the file "begins with a [Section]", per `textProblems` below.
+ * ★ systemd.syntax(7): "Empty lines and lines starting with '#' or ';' are ignored", with no
+ *   carve-out for the position before the first section — a comment header is ordinary content
+ *   there, same as anywhere else in the file.
+ */
+export declare const firstSubstantiveLine: (text: string) => string | undefined;
+/**
+ * 🔴 MEASURED FALSE, CT100 deploy 2026-09-26 00:11Z: the openbao-agent.service asset's first eight
+ *   lines are `#`-comments recording where the file was recovered from (verbatim from the live
+ *   host — homeflare-ct100's `src/openbao-agent/files/openbao-agent.service`), and the file is
+ *   byte-identical to what systemd already loads there. The old check tested the WHOLE text
+ *   against `/^\s*\[[A-Za-z]+]/` — `\s*` skips blank lines and indentation, never a `#`/`;`
+ *   comment — so a leading comment line failed it outright. This checks only the first
+ *   SUBSTANTIVE line, so any number of leading blank lines and comments are fine and a genuine
+ *   `key=value` before any section — the one real error this exists to catch — still fails, since
+ *   that line is neither blank nor a comment either.
+ */
+export declare const textProblems: (text: string) => string[];
+//# sourceMappingURL=unit-text.d.ts.map

package/dist/linux/unit-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unit-text.d.ts","sourceRoot":"","sources":["../../src/linux/unit-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,YAAY,aAAqE,CAAC;AAE/F,qGAAqG;AACrG,eAAO,MAAM,iBAAiB,SAAU,MAAM,KAAG,OAIhD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,SAAU,MAAM,KAAG,MAAM,GAAG,SAG6B,CAAC;AAE3F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,MAAM,EAajD,CAAC"}

package/docs/linux-sudo.md

@@ -76,15 +76,26 @@ Each is `/usr/bin/sudo -n -- <argv>`, every program by absolute path.
 `enable`/`disable`/`start`/`stop`/`restart` elevate only when the unit is not
 **masked** (`LoadState`, read alongside `FragmentPath` in the same call —
 masking is someone's decision, never overridden here) and its **own
-`FragmentPath`** is either under a declared prefix, or empty AND the verb is
+`FragmentPath`** is either under a declared prefix, empty AND the verb is
 `stop`/`disable` — the only two `unit-lifecycle.ts` `deleteUnit` ever sends
 against a unit whose file it may just have removed, so a second, idempotent
-delete pass still works. `enable`/`start`/`restart` with an empty
-`FragmentPath` are refused, closing a kernel-generated pseudo-unit
-(`init.scope`, a `session-N.scope`) as a target. A vendor unit like
-`pveproxy.service`, whose `FragmentPath` is `/usr/lib/systemd/system/…`, is
-refused before sudo ever runs: this runner cannot touch what it did not
-declare. `--user`, `--global`, `-H`, `-M` and `--root` are refused outright,
+delete pass still works — **or a systemd GENERATOR's own output** (measured,
+CT100 deploy 2026-09-26: `/run/systemd/generator`, and `.late`) **whose
+`SourcePath` is under a declared prefix.** That is exactly `Podman.Container`:
+Quadlet's generator writes `caddy.service`'s `FragmentPath` under
+`/run/systemd/generator`, never a path this runner would declare, but stamps
+`SourcePath` with the `.container` file that produced it — the thing this
+runner actually wrote, under `/etc/containers/systemd`. `SourcePath` is read
+in the same `systemctl show` as `FragmentPath`/`LoadState`, so no extra host
+round trip. A generated unit with no `SourcePath`, or one outside every
+prefix (a `.container` file elsewhere in Quadlet's OWN search path this
+runner was never told to own), still refuses. `enable`/`start`/`restart`
+with an empty `FragmentPath` are refused, closing a kernel-generated
+pseudo-unit (`init.scope`, a `session-N.scope`) as a target. A vendor unit
+like `pveproxy.service`, whose `FragmentPath` is `/usr/lib/systemd/system/…`
+— not a generator directory — is refused before sudo ever runs: this runner
+cannot touch what it did not declare, directly or through a generator.
+`--user`, `--global`, `-H`, `-M` and `--root` are refused outright,
 anywhere in the argv. `directory-lifecycle.ts`'s own `chown` argv is bare
 (`0`, `:0`, `0:0`); `canonicalize()` rewrites it to the `+`-forced form above
 before the allowlist ever sees it, so the unprivileged caller never has to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.37.7",
+  "version": "0.38.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/caddy/admin-transport-scope.test.ts

@@ -0,0 +1,127 @@
+/**
+ * The leak this fix closes: `caddyProviders()` used to merge Caddy's admin `HttpClient.HttpClient`
+ * (and `Credentials`) straight into ITS OWN Layer output (providers.ts's `provideMerge`). Once Caddy
+ * sits in a stack's `Layer.mergeAll(…the stack's providers…)` (the exact shape homeflare-mini's
+ * `alchemy.run.ts` uses), its leaked client can shadow the stack's own ambient one for every sibling
+ * fetch-based provider merged alongside it — homeflare-mini's Forgejo and LiteLLM rows, per the PR
+ * evidence. Split from providers.test.ts at the 250-line cap.
+ *
+ * ⛔ A HAND-BUILT `Effect.provide(Layer.mergeAll(ambient, caddyProviders(admin), someProvider))` CANNOT
+ *   REPRODUCE THIS — measured 2026-09-26 (red-team review), correcting an earlier version of this file
+ *   that claimed it did. `Layer.mergeAll` does not thread one member's output into another member's
+ *   requirement, so making a sibling provider that requires `HttpClient.HttpClient` typecheck inside
+ *   the same `mergeAll` as `ambient` needs `someProvider.pipe(Layer.provideMerge(ambient))` — but that
+ *   `provideMerge` also re-outputs `ambient` as the LAST layer effect's own build, which then wins any
+ *   later flat-context lookup regardless of whether Caddy leaked, defeating the setup whether the bug
+ *   is present or not (0 fail either way — confirmed by re-swapping in the pre-fix admin.ts/config.ts/
+ *   providers.ts and re-running: still 2 pass, 0 fail, with or without `--rerun-each 3`).
+ * ★ THE REAL SHAPE INSTEAD: `verify/fake-engine.ts`'s `engineOver` runs the ACTUAL `Alchemy.Stack` +
+ *   `Plan.make` + `apply` over an in-memory state store — the same merge Stack.ts itself performs
+ *   (providers' combined context over the platform's ambient `FetchHttpClient`), not a hand-assembled
+ *   stand-in for it. `Layer.mergeAll(caddyProviders(admin), ProbeProvider()).pipe(Layer.provideMerge
+ *   (ambient))` mirrors a real stack's `providers` option with `ambient` standing in for the platform
+ *   layer Stack.ts itself provides underneath — CAPTURED FAILURE on pre-fix admin.ts/config.ts/
+ *   providers.ts (bun test, this file):
+ *     (fail) ENGINE: Alchemy.Stack + Plan + apply, ambient under the merged providers
+ *       error: expect(received).toEqual(expected)
+ *         Expected: Set {"ambient"}
+ *         Received: Set {"{\"error\":\"host not allowed: 127.0.0.1:<port>\"}\n"}
+ *   (the sibling's `client.get('http://sibling.invalid/probe')` dialled Caddy's OWN admin transport —
+ *   a real loopback connect to the fake Caddy server, which answered its Host check (admin-guard.ts's
+ *   own concern, at the wire) rather than ever reaching `sibling.invalid`); passes post-fix.
+ */
+import { afterEach, describe, expect, test } from 'bun:test';
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
+import * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';
+import { engineOver } from '../verify/fake-engine.ts';
+import { CaddyConfig } from './config.ts';
+import { type FakeCaddy, fakeDefaultCaddy } from './fake-caddy.ts';
+import { caddyProviders } from './providers.ts';
+
+const SITE = 'app.example.com reverse_proxy 127.0.0.1:8080';
+const ids = { fqn: 'stack/caddy', id: 'caddy', instanceId: 'i-1' };
+
+/** Stands in for a real fetch-based sibling (Forgejo, LiteLLM): a `Provider` whose handlers do
+ * exactly what a distilled SDK's generated operation does — `yield* HttpClient.HttpClient`. */
+interface Probe extends Resource<'Test.Probe', { name: string }, { via: string }> {}
+const Probe = Resource<Probe>('Test.Probe');
+
+const ProbeProvider = (vias: string[]) => {
+  const hit = Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    const response = yield* client.get('http://sibling.invalid/probe');
+    const via = yield* response.text;
+    vias.push(via);
+    return { via };
+  });
+  return Provider.succeed(Probe, {
+    read: () => Effect.as(hit, undefined),
+    reconcile: () => hit,
+    delete: () => Effect.void,
+  });
+};
+
+/** Answers instantly and records that IT (not some other client) was the one asked. */
+const labeledClient = (label: string, seen: string[]): Layer.Layer<HttpClient.HttpClient> =>
+  Layer.succeed(
+    HttpClient.HttpClient,
+    HttpClient.make((request) => {
+      seen.push(label);
+      return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(label)));
+    }),
+  );
+
+let fake: FakeCaddy | undefined;
+afterEach(() => {
+  fake?.stop();
+  fake = undefined;
+});
+
+describe('caddyProviders() admin-transport scoping', () => {
+  test('a sibling provider merged alongside it gets the AMBIENT client, never the admin one', async () => {
+    // ★ The real engine (Alchemy.Stack + Plan + apply, see the file header's ★): `ambient` stands in
+    //   for the platform's own `FetchHttpClient`, `Layer.provideMerge`d under the stack's merged
+    //   providers exactly as Stack.ts does. This never starts the fake Caddy's own traffic — it only
+    //   proves WHICH client the sibling resolves, so the admin transport can point anywhere;
+    //   `fakeDefaultCaddy()` gives it a real one.
+    const { admin, caddy } = fakeDefaultCaddy();
+    fake = caddy;
+    const vias: string[] = [];
+    const ambient = labeledClient('ambient', vias);
+    const engine = engineOver(
+      Layer.mergeAll(caddyProviders(admin), ProbeProvider(vias)).pipe(Layer.provideMerge(ambient)),
+    );
+    await engine.deploy(Probe('p', { name: 'sibling' }));
+    expect(vias.length).toBeGreaterThan(0);
+    // ★ Every hit the sibling made must read the ambient client's own label, never an error body from
+    //   Caddy's admin transport (admin-guard.ts's Host check, reached only by a wrong client).
+    expect(new Set(vias)).toEqual(new Set(['ambient']));
+  });
+
+  test("Caddy's own admin calls still go through ITS transport, never the stack's ambient client", async () => {
+    const { admin, caddy } = fakeDefaultCaddy();
+    fake = caddy;
+    const seen: string[] = [];
+    const stack = Layer.mergeAll(labeledClient('ambient', seen), caddyProviders(admin));
+    await Effect.runPromise(
+      Effect.gen(function* () {
+        const provider = yield* CaddyConfig.Provider;
+        return yield* provider.reconcile({
+          ...ids,
+          bindings: [] as never,
+          news: { caddyfile: SITE },
+          olds: { caddyfile: SITE },
+          output: { configSha256: 'earlier', endpoint: caddy.address },
+          session: undefined as never,
+        });
+      }).pipe(Effect.provide(stack)),
+    );
+    expect(caddy.seen.some((call) => call.path === '/load')).toBe(true);
+    // ★ The ambient stub is never asked anything: every admin call reached `admin`'s own transport.
+    expect(seen).toEqual([]);
+  });
+});

package/src/caddy/admin.ts

@@ -10,12 +10,25 @@
  *   caddyconfig/load.go and admin.go, and in the API docs (caddyserver.com/docs/api).
  * ★ `CaddyAdminService` CARRIES ONLY MESSAGE/GUARD METADATA (endpoint, listener) — never a
  *   credential, and never the transport itself. The transport is `@distilled.cloud/caddy`'s own
- *   `Credentials` and `HttpClient.HttpClient` services, provided alongside it by `caddyAdminLayer`,
- *   so admin-calls.ts calls the SDK's operations directly rather than through a house-specific
- *   `.request()` seam. A consumer plugs in another route to the API (an SSH-forwarded socket today;
- *   a remote runner later) by providing a different `CaddyTransport` to `caddyAdminLayer`.
+ *   `Credentials` and `HttpClient.HttpClient` services — admin-calls.ts calls the SDK's operations
+ *   directly rather than through a house-specific `.request()` seam. A consumer plugs in another
+ *   route to the API (an SSH-forwarded socket today; a remote runner later) by providing a different
+ *   `CaddyTransport` to `caddyAdminLayer`.
  * ⛔ THE ADMIN API HAS NO AUTHENTICATION. Anyone who reaches it can replace every site. It stays on
  *   loopback or a unix socket; localCaddyAdmin() refuses anything else (local-admin.ts).
+ * ⛔ `caddyAdminLayer`'s OWN OUTPUT NEVER CARRIES `Credentials`/`HttpClient.HttpClient` DIRECTLY —
+ *   MEASURED 2026-09-26: it used to (`Layer.mergeAll(CaddyAdminService-layer, transport.layer)`,
+ *   what `caddyProviders()` then `provideMerge`d into a stack), and a stack that applies its own
+ *   ambient client OUTSIDE the providers' merge — `Layer.mergeAll(providers…).pipe(Layer.provide
+ *   (ambient))`, the shape `argocd`/`discord`/`opnsense`/`unifi`'s own `providers.ts` document —
+ *   never got it back: `Layer.provide(A, B)`'s result outputs only `A`'s own services, so once `A`
+ *   (the merged providers) already carries `HttpClient.HttpClient` from Caddy, no outer `B` overrides
+ *   it. Every OTHER fetch-based provider merged alongside `caddyProviders()` (homeflare-mini's
+ *   Forgejo, LiteLLM) then dialled Caddy's admin API instead of its own target — reproduced in
+ *   admin-transport-scope.test.ts. `caddyAdminLayer` now stores `transport.layer` itself as a plain
+ *   VALUE, under `CaddyAdminTransport` — a house-only tag nothing outside caddy/ ever reads — and
+ *   config.ts is the one place that `Effect.provide`s it, scoped to exactly the effects that call
+ *   `@distilled.cloud/caddy`'s operations.
  */
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
 import * as Context from 'effect/Context';
@@ -43,7 +56,16 @@ export interface CaddyTarget {
 
 /** What `localCaddyAdmin()` (or a consumer's own transport) hands `caddyAdminLayer`. */
 export interface CaddyTransport extends CaddyTarget {
-  /** Provides the SDK's own `Credentials` and `HttpClient.HttpClient` — see local-admin.ts. */
+  /**
+   * Provides the SDK's own `Credentials` and `HttpClient.HttpClient` — see local-admin.ts.
+   * ⚠️ BUILT AND TORN DOWN ON EVERY `read`/`diff`/`reconcile` CALL — config.ts's `Effect.provide
+   *   (transportLayer)` runs fresh each time, scoped to that one call (the scoping fix this file's
+   *   own ⛔ documents). `localCaddyAdmin()`'s layer is three plain `Layer.succeed` values, so this
+   *   costs nothing; a transport that opens something stateful (an SSH forward, a connection pool)
+   *   would open and close it per call instead of once per stack. No such transport exists in the
+   *   tray today (2026-09-26) — keep `layer` cheap and stateless, or build once and hand config.ts a
+   *   pre-built `Context` instead, if that changes.
+   */
   readonly layer: Layer.Layer<Credentials | HttpClient.HttpClient>;
 }
 
@@ -52,19 +74,33 @@ export class CaddyAdminService extends Context.Service<CaddyAdminService, CaddyT
   'homeflare/caddy/CaddyAdmin',
 ) {}
 
+/**
+ * `transport.layer` ITSELF, carried as a plain value rather than merged into the ambient context —
+ * the scoping fix (see the file header's ⛔). Only config.ts reads this tag, and only to
+ * `Effect.provide` it locally around the handful of effects that actually call
+ * `@distilled.cloud/caddy`'s operations; nothing else in this directory, and nothing outside it,
+ * has a reason to.
+ */
+export class CaddyAdminTransport extends Context.Service<
+  CaddyAdminTransport,
+  Layer.Layer<Credentials | HttpClient.HttpClient>
+>()('homeflare/caddy/CaddyAdminTransport') {}
+
 /**
  * Provide a transport to the provider: `CaddyConfigProvider().pipe(Layer.provideMerge(caddyAdminLayer(localCaddyAdmin())))`
  * — never plain `Layer.provide` here (see providers.ts's own ⚠️): `CaddyConfigProvider()`'s handlers
- * keep needing these services every time the engine calls them, not just once while it is built. Merges
- * the target metadata with the SDK's `Credentials`/`HttpClient` layers `transport.layer` carries.
+ * keep needing `CaddyAdminService`/`CaddyAdminTransport` every time the engine calls them, not just
+ * once while it is built. Neither tag is a generic platform service, so merging them into a stack's
+ * ambient context (unlike the raw `Credentials`/`HttpClient.HttpClient` this used to carry — the
+ * file header's ⛔) is safe: nothing outside this directory looks either up.
  */
 export const caddyAdminLayer = (
   transport: CaddyTransport,
-): Layer.Layer<CaddyAdminService | Credentials | HttpClient.HttpClient> =>
+): Layer.Layer<CaddyAdminService | CaddyAdminTransport> =>
   Layer.mergeAll(
     Layer.succeed(CaddyAdminService, {
       endpoint: transport.endpoint,
       listener: transport.listener,
     }),
-    transport.layer,
+    Layer.succeed(CaddyAdminTransport, transport.layer),
   );

package/src/caddy/config-adopt-provider.test.ts

@@ -9,7 +9,6 @@ import { AdoptPolicy, Unowned } from 'alchemy/AdoptPolicy';
 import { AlchemyContext } from 'alchemy/AlchemyContext';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import type * as Caddy from '@distilled.cloud/caddy';
 import { type CaddyAdminService, type CaddyTransport, caddyAdminLayer } from './admin.ts';
 import { CaddyConfig, CaddyConfigProvider } from './config.ts';
 import { configDigest } from './digest.ts';
@@ -40,9 +39,10 @@ type Deploy = { readonly adopt?: boolean; readonly contextAdopt?: boolean };
 const withProvider = <A>(
   admin: CaddyTransport,
   deploy: Deploy,
+  // ★ `CaddyAdminService` ONLY — see providers.test.ts's own `withProvider` for why.
   use: (
     p: Effect.Success<typeof CaddyConfig.Provider>,
-  ) => Effect.Effect<A, unknown, CaddyAdminService | Caddy.CaddyOpContext>,
+  ) => Effect.Effect<A, unknown, CaddyAdminService>,
 ) => {
   // ⚠️ `Layer.provideMerge`, not `Layer.provide` — providers.ts's own doc on `caddyAdminLayer` says
   //   why: `CaddyConfigProvider()`'s handlers still need these services every time they run, not

package/src/caddy/config-format-warning.test.ts

@@ -13,7 +13,7 @@ import { AdoptPolicy } from 'alchemy/AdoptPolicy';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
 import * as Logger from 'effect/Logger';
-import { caddyAdminLayer } from './admin.ts';
+import { type CaddyTransport, caddyAdminLayer } from './admin.ts';
 import { CaddyConfig, CaddyConfigProvider } from './config.ts';
 import { diffConfig } from './config-reconcile.ts';
 import { type FakeCaddy, fakeDefaultCaddy } from './fake-caddy.ts';
@@ -34,6 +34,12 @@ const setup = () => {
   return made;
 };
 
+/** `diffConfig` still needs the raw `Credentials`/`HttpClient` directly — `caddyAdminLayer` alone
+ * (admin.ts's own scoping fix) only carries `CaddyAdminService`/`CaddyAdminTransport`; merge
+ * `admin.layer` in too, the same fix `fake-caddy.ts`'s `runCaddy` makes for this exact shape. */
+const withTransport = (admin: CaddyTransport) =>
+  Layer.mergeAll(caddyAdminLayer(admin), admin.layer);
+
 /** Runs `effect` and returns its result plus every `Effect.logWarning` line it emitted. */
 const withWarnings = async <A>(effect: Effect.Effect<A, unknown, never>) => {
   const warnings: string[] = [];
@@ -49,7 +55,7 @@ describe('the formatting warning is surfaced distinctly', () => {
     const { admin } = setup();
     const output = { configSha256: 'stub', endpoint: admin.endpoint };
     const { value, warnings } = await withWarnings(
-      diffConfig({ caddyfile: UNFORMATTED }, output).pipe(Effect.provide(caddyAdminLayer(admin))),
+      diffConfig({ caddyfile: UNFORMATTED }, output).pipe(Effect.provide(withTransport(admin))),
     );
     expect(value).toEqual({ action: 'update' });
     expect(warnings).toHaveLength(1);
@@ -61,7 +67,7 @@ describe('the formatting warning is surfaced distinctly', () => {
     const { admin } = setup();
     const output = { configSha256: 'stub', endpoint: admin.endpoint };
     const { warnings } = await withWarnings(
-      diffConfig({ caddyfile: SITE }, output).pipe(Effect.provide(caddyAdminLayer(admin))),
+      diffConfig({ caddyfile: SITE }, output).pipe(Effect.provide(withTransport(admin))),
     );
     expect(warnings).toEqual([]);
   });

package/src/caddy/config.ts

@@ -21,7 +21,13 @@
  *   engine skips that probe, reconcile refuses the same takeover (config-lifecycle.ts).
  * ⛔ `caddyfile` IS NEVER A SECRET — see config-form.ts; refused before anything is sent.
  * ⚠️ WHICH CADDY is the transport's (providers.ts): `CaddyAdminService` plus the `Credentials`/
- *   `HttpClient` layers `caddyAdminLayer` merges — one per stack, not a prop.
+ *   `HttpClient` layer `CaddyAdminTransport` carries — one per stack, not a prop.
+ * ⚠️ `transportLayer` IS `Effect.provide`D LOCALLY IN EACH HANDLER BELOW, NEVER MERGED AHEAD OF
+ *   TIME. `caddyAdminLayer` (admin.ts) stores it under `CaddyAdminTransport` rather than merging its
+ *   `Credentials`/`HttpClient.HttpClient` into the ambient context precisely so this file is the ONE
+ *   place that discharges them — scoped to the handful of effects that actually call
+ *   `@distilled.cloud/caddy`'s operations, never leaking into a sibling fetch-based provider merged
+ *   into the same stack (admin.ts's own ⛔; MEASURED 2026-09-26, admin-transport-scope.test.ts).
  */
 import { Resource } from 'alchemy';
 import { Unowned } from 'alchemy/AdoptPolicy';
@@ -30,7 +36,7 @@ import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import { resolvedString } from '../launchd/host-effect.ts';
 import { adoptEnabled } from '../ownership/adopt.ts';
-import { CaddyAdminService } from './admin.ts';
+import { CaddyAdminService, CaddyAdminTransport } from './admin.ts';
 import { isUnreachable } from './caddy-http-client.ts';
 import type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';
 import { probeLive, readLive } from './config-lifecycle.ts';
@@ -72,6 +78,7 @@ export const CaddyConfigProvider = () =>
     CaddyConfig,
     Effect.gen(function* () {
       const admin = yield* CaddyAdminService;
+      const transportLayer = yield* CaddyAdminTransport;
       /** The probe, branded for the engine: plain when ours, `Unowned` otherwise. */
       const probe = (caddyfile: string | undefined, sourceFile: string | undefined) =>
         Effect.flatMap(probeLive(caddyfile, sourceFile), (found) => {
@@ -104,6 +111,9 @@ export const CaddyConfigProvider = () =>
               ? yield* probe(resolvedString(olds, 'caddyfile'), resolvedString(olds, 'sourceFile'))
               : yield* readLive(resolvedString(olds, 'sourceFile'));
           }).pipe(
+            // ★ Scoped to Caddy's own transport — see the file header's ⚠️ — before the catch below,
+            //   so `isUnreachable` still narrows the SAME raw error this always raised.
+            Effect.provide(transportLayer),
             // ★ Nothing to adopt from a Caddy that is down: plan a create, which is the same load.
             Effect.catchIf(isUnreachable, planWithoutCaddy(admin, undefined)),
           ),
@@ -112,7 +122,10 @@ export const CaddyConfigProvider = () =>
           if (output === undefined) return Effect.succeed(undefined);
           const update = planWithoutCaddy(admin, { action: 'update' as const });
           if (isResolved(news)) {
-            return diffConfig(news, output).pipe(Effect.catchIf(isUnreachable, update));
+            return diffConfig(news, output).pipe(
+              Effect.provide(transportLayer),
+              Effect.catchIf(isUnreachable, update),
+            );
           }
           /**
            * ⚠️ `sourceFile` is an Output while its HostFile changes in the same deploy
@@ -123,6 +136,7 @@ export const CaddyConfigProvider = () =>
           const caddyfile = resolvedString(news, 'caddyfile');
           if (caddyfile === undefined) return Effect.succeed(undefined);
           return Effect.as(diffConfig({ caddyfile }, output), { action: 'update' as const }).pipe(
+            Effect.provide(transportLayer),
             Effect.catchIf(isUnreachable, update),
           );
         },
@@ -136,7 +150,9 @@ export const CaddyConfigProvider = () =>
             const sameCaddy = output !== undefined && output.endpoint === admin.endpoint;
             const takeOver = sameCaddy || (yield* adoptEnabled(fqn));
             const stored = output === undefined ? {} : { stored: output.configSha256 };
-            const applied = yield* reconcileConfig(news, { takeOver, ...stored });
+            const applied = yield* reconcileConfig(news, { takeOver, ...stored }).pipe(
+              Effect.provide(transportLayer),
+            );
             // ★ THE FORMATTING WARNING GETS ITS OWN LINE, NAMING THE FIX — separate from the rest,
             //   which keep logging exactly as before (format-warnings.ts).
             const { formatting, rest } = splitFormattingWarning(applied.warnings);

package/src/caddy/fake-caddy.ts

@@ -18,6 +18,7 @@
  *   fake really listens on an ephemeral one: a Caddy on its default :2019 behind a forward.
  */
 import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
 import type * as Caddy from '@distilled.cloud/caddy';
 import { type CaddyAdminService, type CaddyTransport, caddyAdminLayer } from './admin.ts';
 import { localCaddyAdmin } from './local-admin.ts';
@@ -190,8 +191,16 @@ export const fakeDefaultCaddy = (
  * Runs an Effect that needs `CaddyAdminService` and `@distilled.cloud/caddy`'s own `Credentials`/
  * `HttpClient` against one transport — the one line every test in this directory used to spend on
  * `Effect.provide(caddyAdminLayer(admin))` before this helper existed.
+ * ⚠️ TWO LAYERS, NOT ONE: `caddyAdminLayer(admin)` only carries `CaddyAdminService` and the
+ *   `CaddyAdminTransport`-wrapped VALUE of `admin.layer` (admin.ts's own scoping fix) — the
+ *   lifecycle functions this helper drives (`probeLive`, `reconcileConfig`, …) still need the raw
+ *   `Credentials`/`HttpClient.HttpClient` directly in context, so `admin.layer` is provided again,
+ *   built this time, alongside it.
  */
 export const runCaddy = <A, E>(
   effect: Effect.Effect<A, E, CaddyAdminService | Caddy.CaddyOpContext>,
   admin: CaddyTransport,
-): Promise<A> => Effect.runPromise(effect.pipe(Effect.provide(caddyAdminLayer(admin))));
+): Promise<A> =>
+  Effect.runPromise(
+    effect.pipe(Effect.provide(Layer.mergeAll(caddyAdminLayer(admin), admin.layer))),
+  );

package/src/caddy/providers.test.ts

@@ -7,7 +7,6 @@ import * as Output from 'alchemy/Output';
 import { Stack } from 'alchemy/Stack';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import type * as Caddy from '@distilled.cloud/caddy';
 import { type CaddyAdminService, caddyAdminLayer } from './admin.ts';
 import { CaddyConfig, CaddyConfigProvider } from './config.ts';
 import { type FakeCaddy, fakeCaddy } from './fake-caddy.ts';
@@ -31,9 +30,11 @@ const handler = <F>(name: string, fn: F | undefined): F => {
 };
 
 const withProvider = <A>(
+  // ★ `CaddyAdminService` ONLY — `read`/`diff`/`reconcile` no longer need the admin transport from
+  //   OUTSIDE post-fix: config.ts's handlers `Effect.provide` it locally now (admin.ts's own ⛔).
   use: (
     p: Effect.Success<typeof CaddyConfig.Provider>,
-  ) => Effect.Effect<A, unknown, CaddyAdminService | Caddy.CaddyOpContext>,
+  ) => Effect.Effect<A, unknown, CaddyAdminService>,
   address?: string,
 ) => {
   // ★ A Caddy on its default :2019 behind a forward, as in config-lifecycle.test.ts.

package/src/caddy/providers.ts

@@ -12,17 +12,24 @@
  *   and `HttpClient.HttpClient`.
  *
  * ⚠️ `Layer.provideMerge`, NEVER PLAIN `Layer.provide`, for `caddyAdminLayer`. `CaddyConfigProvider()`'s
- *   `read`/`diff`/`reconcile` handlers each still need `CaddyAdminService` and
- *   `@distilled.cloud/caddy`'s `Credentials`/`HttpClient` — Alchemy's own `Provider.effect` types
- *   those as part of the LAYER's overall requirement (`ProviderService`'s per-handler `Req` type
- *   parameters, `alchemy/Provider.ts`), for exactly this reason. Plain `Layer.provide` SEALS a
- *   layer — it satisfies `CaddyConfigProvider()`'s requirement only for BUILDING the `Provider`
- *   value (the `admin` in its outer `Effect.gen`), then hides those services from anything that
- *   runs LATER, when the returned `read`/`diff`/`reconcile` FUNCTIONS actually execute. MEASURED
- *   2026-09-23: with plain `Layer.provide`, `caddyProviders()`'s own `reconcile` handler dies with
- *   "Service not found: homeflare/caddy/CaddyAdmin" the moment the ENGINE calls it. `provideMerge`
- *   feeds `caddyAdminLayer`'s output into `CaddyConfigProvider()`'s requirement AND keeps that same
- *   output live in the result, so every later handler call still runs with it in context.
+ *   `read`/`diff`/`reconcile` handlers each still need `CaddyAdminService` and `CaddyAdminTransport`
+ *   — Alchemy's own `Provider.effect` types those as part of the LAYER's overall requirement
+ *   (`ProviderService`'s per-handler `Req` type parameters, `alchemy/Provider.ts`), for exactly this
+ *   reason. Plain `Layer.provide` SEALS a layer — it satisfies `CaddyConfigProvider()`'s requirement
+ *   only for BUILDING the `Provider` value (the `admin`/`transportLayer` in its outer `Effect.gen`),
+ *   then hides those services from anything that runs LATER, when the returned `read`/`diff`/
+ *   `reconcile` FUNCTIONS actually execute. MEASURED 2026-09-23: with plain `Layer.provide`,
+ *   `caddyProviders()`'s own `reconcile` handler dies with "Service not found: homeflare/caddy/
+ *   CaddyAdmin" the moment the ENGINE calls it. `provideMerge` feeds `caddyAdminLayer`'s output into
+ *   `CaddyConfigProvider()`'s requirement AND keeps that same output live in the result, so every
+ *   later handler call still runs with it in context.
+ * ⛔ THIS `caddyProviders()` LAYER NEVER CARRIES `Credentials`/`HttpClient.HttpClient` ITSELF (fixed
+ *   2026-09-26 — admin.ts's own ⛔ has the mechanism and the measured leak). `caddyAdminLayer`'s
+ *   output is `CaddyAdminService | CaddyAdminTransport`, both house-only tags safe to `provideMerge`
+ *   into any host stack; the SDK's own `Credentials`/`HttpClient.HttpClient` stay inside
+ *   `CaddyAdminTransport`'s stored value, `Effect.provide`d locally by config.ts around exactly the
+ *   effects that need them. A stack merging `caddyProviders()` with any other fetch-based provider
+ *   (`forgejoProviders()`, `litellmProviders()`, …) is safe from this file's own composition alone.
  */
 import * as Layer from 'effect/Layer';
 import { type CaddyTransport, caddyAdminLayer } from './admin.ts';

package/src/linux/container-form.ts

@@ -18,7 +18,7 @@
  *   or renders that file's contents.
  * ⛔ `[Install]` SUPPORTS ONLY `Alias=`/`WantedBy=`/`RequiredBy=` FOR A `.container` FILE (same doc,
  *   "Currently, only the Alias, WantedBy and RequiredBy keys are supported") — NOT `Also=`, which
- *   plain `systemd.unit(5)` allows and unit-form.ts's `INSTALL_KEYS` therefore lists. See
+ *   plain `systemd.unit(5)` allows and unit-text.ts's `INSTALL_KEYS` therefore lists. See
  *   container-generator.ts's header for why there is no `enabled` prop at all.
  */
 import { type UnitSection, configDigest, digestOf, renderUnit } from './unit-form.ts';

package/src/linux/container-generator.test.ts

@@ -192,4 +192,37 @@ describe('verifyGenerated, directly', () => {
       }),
     ).toThrow(/earlier in Quadlet/);
   });
+
+  /**
+   * ⛔ REGRESSION — found on adversarial review. Before the FragmentPath check was added, a real,
+   *   already-loaded PLAIN unit (e.g. an admin's own `/etc/systemd/system/…` sharing this
+   *   container's service name) reported `LoadState=loaded` (it is a genuinely valid unit) and no
+   *   `SourcePath` (hand-written units never carry one) — both existing checks passed it silently,
+   *   so `verifyGenerated` was not the backstop its own doc comments claimed: a shadow that slipped
+   *   past `assertUnshadowed` (container-preflight.ts) would misapply silently, not throw loudly.
+   */
+  test('a loaded plain unit with no SourcePath is still caught, via FragmentPath', () => {
+    expect(() =>
+      verifyGenerated(NAME, PATH, SERVICE, {
+        activeState: 'active',
+        fragmentPath: '/etc/systemd/system/hf-example.service',
+        known: true,
+        loadState: 'loaded',
+        needDaemonReload: false,
+      }),
+    ).toThrow(/not from Quadlet.s generator/);
+  });
+
+  test('a real generated FragmentPath is not mistaken for a shadow', () => {
+    expect(() =>
+      verifyGenerated(NAME, PATH, SERVICE, {
+        activeState: 'active',
+        fragmentPath: `/run/systemd/generator/${SERVICE}`,
+        known: true,
+        loadState: 'loaded',
+        needDaemonReload: false,
+        sourcePath: PATH,
+      }),
+    ).not.toThrow();
+  });
 });