@homeflare/alchemy 0.37.8 → 0.39.0

package/README.md

@@ -351,6 +351,28 @@ checks you name required. ⛔ Auto-merge with nothing required merges **immediat
 `bunx --bun hf-adopt-verify --config alchemy.run.ts --stage live`: Alchemy's planner, no writes,
 each row's own diff, exit 0 only when all are no-ops. [docs/adopt-verify.md](./docs/adopt-verify.md)
 
+## Telemetry — `@homeflare/alchemy/telemetry`
+
+`telemetryLayer` builds an OTLP tracing/logging/metrics `Layer` for a stack's own `providers` —
+off unless you give it real endpoints, no default collector anywhere in it.
+
+```ts
+import { telemetryLayer } from '@homeflare/alchemy/telemetry';
+
+export const providers = Layer.mergeAll(
+  myProviders(),
+  telemetryLayer({
+    endpoints: { traces: 'http://<your-collector>/v1/traces' },
+    serviceName: 'my-stack',
+  }),
+);
+```
+
+Every span — a provider's own, `HttpClient`'s, and alchemy's own plan/apply engine — is redacted
+before export: every header dropped, every query string stripped, a denylisted host or path segment
+blanked. Options, the redaction policy and what a spike measured actually arriving at a collector:
+[docs/telemetry.md](./docs/telemetry.md) · [docs/telemetry-spike.md](./docs/telemetry-spike.md).
+
 ## Credentials
 
 ⛔ **Mint a short-lived, scoped token** — never a long-lived one, never a Global API Key. How each

package/dist/caddy/admin.d.ts

@@ -10,12 +10,25 @@
  *   caddyconfig/load.go and admin.go, and in the API docs (caddyserver.com/docs/api).
  * ★ `CaddyAdminService` CARRIES ONLY MESSAGE/GUARD METADATA (endpoint, listener) — never a
  *   credential, and never the transport itself. The transport is `@distilled.cloud/caddy`'s own
- *   `Credentials` and `HttpClient.HttpClient` services, provided alongside it by `caddyAdminLayer`,
- *   so admin-calls.ts calls the SDK's operations directly rather than through a house-specific
- *   `.request()` seam. A consumer plugs in another route to the API (an SSH-forwarded socket today;
- *   a remote runner later) by providing a different `CaddyTransport` to `caddyAdminLayer`.
+ *   `Credentials` and `HttpClient.HttpClient` services — admin-calls.ts calls the SDK's operations
+ *   directly rather than through a house-specific `.request()` seam. A consumer plugs in another
+ *   route to the API (an SSH-forwarded socket today; a remote runner later) by providing a different
+ *   `CaddyTransport` to `caddyAdminLayer`.
  * ⛔ THE ADMIN API HAS NO AUTHENTICATION. Anyone who reaches it can replace every site. It stays on
  *   loopback or a unix socket; localCaddyAdmin() refuses anything else (local-admin.ts).
+ * ⛔ `caddyAdminLayer`'s OWN OUTPUT NEVER CARRIES `Credentials`/`HttpClient.HttpClient` DIRECTLY —
+ *   MEASURED 2026-09-26: it used to (`Layer.mergeAll(CaddyAdminService-layer, transport.layer)`,
+ *   what `caddyProviders()` then `provideMerge`d into a stack), and a stack that applies its own
+ *   ambient client OUTSIDE the providers' merge — `Layer.mergeAll(providers…).pipe(Layer.provide
+ *   (ambient))`, the shape `argocd`/`discord`/`opnsense`/`unifi`'s own `providers.ts` document —
+ *   never got it back: `Layer.provide(A, B)`'s result outputs only `A`'s own services, so once `A`
+ *   (the merged providers) already carries `HttpClient.HttpClient` from Caddy, no outer `B` overrides
+ *   it. Every OTHER fetch-based provider merged alongside `caddyProviders()` (homeflare-mini's
+ *   Forgejo, LiteLLM) then dialled Caddy's admin API instead of its own target — reproduced in
+ *   admin-transport-scope.test.ts. `caddyAdminLayer` now stores `transport.layer` itself as a plain
+ *   VALUE, under `CaddyAdminTransport` — a house-only tag nothing outside caddy/ ever reads — and
+ *   config.ts is the one place that `Effect.provide`s it, scoped to exactly the effects that call
+ *   `@distilled.cloud/caddy`'s operations.
  */
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
 import * as Context from 'effect/Context';
@@ -45,19 +58,40 @@ export interface CaddyTarget {
 }
 /** What `localCaddyAdmin()` (or a consumer's own transport) hands `caddyAdminLayer`. */
 export interface CaddyTransport extends CaddyTarget {
-    /** Provides the SDK's own `Credentials` and `HttpClient.HttpClient` — see local-admin.ts. */
+    /**
+     * Provides the SDK's own `Credentials` and `HttpClient.HttpClient` — see local-admin.ts.
+     * ⚠️ BUILT AND TORN DOWN ON EVERY `read`/`diff`/`reconcile` CALL — config.ts's `Effect.provide
+     *   (transportLayer)` runs fresh each time, scoped to that one call (the scoping fix this file's
+     *   own ⛔ documents). `localCaddyAdmin()`'s layer is three plain `Layer.succeed` values, so this
+     *   costs nothing; a transport that opens something stateful (an SSH forward, a connection pool)
+     *   would open and close it per call instead of once per stack. No such transport exists in the
+     *   tray today (2026-09-26) — keep `layer` cheap and stateless, or build once and hand config.ts a
+     *   pre-built `Context` instead, if that changes.
+     */
     readonly layer: Layer.Layer<Credentials | HttpClient.HttpClient>;
 }
 declare const CaddyAdminService_base: Context.ServiceClass<CaddyAdminService, "homeflare/caddy/CaddyAdmin", CaddyTarget>;
 /** The Effect service the Caddy provider reads its admin target's metadata from. */
 export declare class CaddyAdminService extends CaddyAdminService_base {
 }
+declare const CaddyAdminTransport_base: Context.ServiceClass<CaddyAdminTransport, "homeflare/caddy/CaddyAdminTransport", Layer.Layer<Credentials | HttpClient.HttpClient, never, never>>;
+/**
+ * `transport.layer` ITSELF, carried as a plain value rather than merged into the ambient context —
+ * the scoping fix (see the file header's ⛔). Only config.ts reads this tag, and only to
+ * `Effect.provide` it locally around the handful of effects that actually call
+ * `@distilled.cloud/caddy`'s operations; nothing else in this directory, and nothing outside it,
+ * has a reason to.
+ */
+export declare class CaddyAdminTransport extends CaddyAdminTransport_base {
+}
 /**
  * Provide a transport to the provider: `CaddyConfigProvider().pipe(Layer.provideMerge(caddyAdminLayer(localCaddyAdmin())))`
  * — never plain `Layer.provide` here (see providers.ts's own ⚠️): `CaddyConfigProvider()`'s handlers
- * keep needing these services every time the engine calls them, not just once while it is built. Merges
- * the target metadata with the SDK's `Credentials`/`HttpClient` layers `transport.layer` carries.
+ * keep needing `CaddyAdminService`/`CaddyAdminTransport` every time the engine calls them, not just
+ * once while it is built. Neither tag is a generic platform service, so merging them into a stack's
+ * ambient context (unlike the raw `Credentials`/`HttpClient.HttpClient` this used to carry — the
+ * file header's ⛔) is safe: nothing outside this directory looks either up.
  */
-export declare const caddyAdminLayer: (transport: CaddyTransport) => Layer.Layer<CaddyAdminService | Credentials | HttpClient.HttpClient>;
+export declare const caddyAdminLayer: (transport: CaddyTransport) => Layer.Layer<CaddyAdminService | CaddyAdminTransport>;
 export {};
 //# sourceMappingURL=admin.d.ts.map

package/dist/caddy/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/caddy/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;CAClE;;AAED,oFAAoF;AACpF,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,eAAe,cACf,cAAc,KACxB,KAAK,CAAC,KAAK,CAAC,iBAAiB,GAAG,WAAW,GAAG,UAAU,CAAC,UAAU,CAOnE,CAAC"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/caddy/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;CAClE;;AAED,oFAAoF;AACpF,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;;AAEJ;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,wBAGC;CAAG;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,cACf,cAAc,KACxB,KAAK,CAAC,KAAK,CAAC,iBAAiB,GAAG,mBAAmB,CAOnD,CAAC"}

package/dist/caddy/config.d.ts

@@ -21,15 +21,21 @@
  *   engine skips that probe, reconcile refuses the same takeover (config-lifecycle.ts).
  * ⛔ `caddyfile` IS NEVER A SECRET — see config-form.ts; refused before anything is sent.
  * ⚠️ WHICH CADDY is the transport's (providers.ts): `CaddyAdminService` plus the `Credentials`/
- *   `HttpClient` layers `caddyAdminLayer` merges — one per stack, not a prop.
+ *   `HttpClient` layer `CaddyAdminTransport` carries — one per stack, not a prop.
+ * ⚠️ `transportLayer` IS `Effect.provide`D LOCALLY IN EACH HANDLER BELOW, NEVER MERGED AHEAD OF
+ *   TIME. `caddyAdminLayer` (admin.ts) stores it under `CaddyAdminTransport` rather than merging its
+ *   `Credentials`/`HttpClient.HttpClient` into the ambient context precisely so this file is the ONE
+ *   place that discharges them — scoped to the handful of effects that actually call
+ *   `@distilled.cloud/caddy`'s operations, never leaking into a sibling fetch-based provider merged
+ *   into the same stack (admin.ts's own ⛔; MEASURED 2026-09-26, admin-transport-scope.test.ts).
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { CaddyAdminService } from './admin.ts';
+import { CaddyAdminService, CaddyAdminTransport } from './admin.ts';
 import type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';
 export type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';
 export interface CaddyConfig extends Resource<'Caddy.Config', CaddyConfigProps, CaddyConfigAttributes> {
 }
 export declare const CaddyConfig: import("alchemy").ResourceClass<CaddyConfig>;
-export declare const CaddyConfigProvider: () => import("effect/Layer").Layer<Provider.Provider<CaddyConfig>, never, CaddyAdminService | import("@distilled.cloud/caddy").CaddyOpContext>;
+export declare const CaddyConfigProvider: () => import("effect/Layer").Layer<Provider.Provider<CaddyConfig>, never, CaddyAdminService | CaddyAdminTransport>;
 //# sourceMappingURL=config.d.ts.map

package/dist/caddy/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/caddy/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAKhF,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAoBH,eAAO,MAAM,mBAAmB,gJAqF7B,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/caddy/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAKhF,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAoBH,eAAO,MAAM,mBAAmB,oHA+F7B,CAAC"}

package/dist/caddy/fake-caddy.d.ts

@@ -57,6 +57,11 @@ export declare const fakeDefaultCaddy: (running?: unknown) => {
  * Runs an Effect that needs `CaddyAdminService` and `@distilled.cloud/caddy`'s own `Credentials`/
  * `HttpClient` against one transport — the one line every test in this directory used to spend on
  * `Effect.provide(caddyAdminLayer(admin))` before this helper existed.
+ * ⚠️ TWO LAYERS, NOT ONE: `caddyAdminLayer(admin)` only carries `CaddyAdminService` and the
+ *   `CaddyAdminTransport`-wrapped VALUE of `admin.layer` (admin.ts's own scoping fix) — the
+ *   lifecycle functions this helper drives (`probeLive`, `reconcileConfig`, …) still need the raw
+ *   `Credentials`/`HttpClient.HttpClient` directly in context, so `admin.layer` is provided again,
+ *   built this time, alongside it.
  */
 export declare const runCaddy: <A, E>(effect: Effect.Effect<A, E, CaddyAdminService | Caddy.CaddyOpContext>, admin: CaddyTransport) => Promise<A>;
 //# sourceMappingURL=fake-caddy.d.ts.map

package/dist/caddy/fake-caddy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-caddy.d.ts","sourceRoot":"","sources":["../../src/caddy/fake-caddy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,KAAK,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAmB,MAAM,YAAY,CAAC;AAG1F,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtB,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,IAAI,IAAI,IAAI,CAAC;CACd,CAAC;AAqDF,eAAO,MAAM,SAAS,aACX;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KACrF,SAwEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,aACjB,OAAO,KAChB;IAAE,KAAK,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAQ3C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,CAAC,UACnB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAAC,SAC9D,cAAc,KACpB,OAAO,CAAC,CAAC,CAA2E,CAAC"}
+{"version":3,"file":"fake-caddy.d.ts","sourceRoot":"","sources":["../../src/caddy/fake-caddy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,KAAK,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAmB,MAAM,YAAY,CAAC;AAG1F,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtB,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,IAAI,IAAI,IAAI,CAAC;CACd,CAAC;AAqDF,eAAO,MAAM,SAAS,aACX;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KACrF,SAwEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,aACjB,OAAO,KAChB;IAAE,KAAK,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAQ3C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,CAAC,UACnB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC,cAAc,CAAC,SAC9D,cAAc,KACpB,OAAO,CAAC,CAAC,CAGT,CAAC"}

package/dist/caddy/index.js

@@ -45,10 +45,13 @@ import * as Layer from "effect/Layer";
 
 class CaddyAdminService extends Context.Service()("homeflare/caddy/CaddyAdmin") {
 }
+
+class CaddyAdminTransport extends Context.Service()("homeflare/caddy/CaddyAdminTransport") {
+}
 var caddyAdminLayer = (transport) => Layer.mergeAll(Layer.succeed(CaddyAdminService, {
   endpoint: transport.endpoint,
   listener: transport.listener
-}), transport.layer);
+}), Layer.succeed(CaddyAdminTransport, transport.layer));
 // src/caddy/caddy-http-client.ts
 import * as http from "node:http";
 import { Readable } from "node:stream";
@@ -921,6 +924,7 @@ var CaddyConfig = Resource("Caddy.Config", {
 var planWithoutCaddy = (admin, fallback) => (error) => Effect11.as(Effect11.logWarning(`Caddy.Config: no Caddy at ${admin.endpoint} ` + `(${error instanceof Error ? error.message : String(error)}); planning without it — ` + "the Caddyfile is validated when the deploy reaches Caddy"), fallback);
 var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect11.gen(function* () {
   const admin = yield* CaddyAdminService;
+  const transportLayer = yield* CaddyAdminTransport;
   const probe = (caddyfile, sourceFile) => Effect11.flatMap(probeLive(caddyfile, sourceFile), (found) => {
     if (found === undefined)
       return Effect11.succeed(undefined);
@@ -933,24 +937,24 @@ var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect11.gen(functi
     list: () => Effect11.succeed([]),
     read: ({ olds, output }) => Effect11.gen(function* () {
       return output === undefined ? yield* probe(resolvedString(olds, "caddyfile"), resolvedString(olds, "sourceFile")) : yield* readLive(resolvedString(olds, "sourceFile"));
-    }).pipe(Effect11.catchIf(isUnreachable, planWithoutCaddy(admin, undefined))),
+    }).pipe(Effect11.provide(transportLayer), Effect11.catchIf(isUnreachable, planWithoutCaddy(admin, undefined))),
     diff: ({ news, output }) => {
       if (output === undefined)
         return Effect11.succeed(undefined);
       const update = planWithoutCaddy(admin, { action: "update" });
       if (isResolved(news)) {
-        return diffConfig(news, output).pipe(Effect11.catchIf(isUnreachable, update));
+        return diffConfig(news, output).pipe(Effect11.provide(transportLayer), Effect11.catchIf(isUnreachable, update));
       }
       const caddyfile = resolvedString(news, "caddyfile");
       if (caddyfile === undefined)
         return Effect11.succeed(undefined);
-      return Effect11.as(diffConfig({ caddyfile }, output), { action: "update" }).pipe(Effect11.catchIf(isUnreachable, update));
+      return Effect11.as(diffConfig({ caddyfile }, output), { action: "update" }).pipe(Effect11.provide(transportLayer), Effect11.catchIf(isUnreachable, update));
     },
     reconcile: ({ fqn, news, output }) => Effect11.gen(function* () {
       const sameCaddy = output !== undefined && output.endpoint === admin.endpoint;
       const takeOver = sameCaddy || (yield* adoptEnabled(fqn));
       const stored = output === undefined ? {} : { stored: output.configSha256 };
-      const applied = yield* reconcileConfig(news, { takeOver, ...stored });
+      const applied = yield* reconcileConfig(news, { takeOver, ...stored }).pipe(Effect11.provide(transportLayer));
       const { formatting, rest } = splitFormattingWarning(applied.warnings);
       if (formatting.length > 0) {
         yield* Effect11.logWarning(formattingFixLine(admin.endpoint));
@@ -1339,5 +1343,5 @@ export {
   verifierProblems
 };
 
-//# debugId=CC0C3E3E18BF8F0664756E2164756E21
+//# debugId=B368F4E9D50791DC64756E2164756E21
 //# sourceMappingURL=index.js.map