@homeflare/alchemy 0.43.0 → 0.45.0

package/dist/valkey/acl-form.d.ts

@@ -0,0 +1,62 @@
+import * as Effect from 'effect/Effect';
+import type { ValkeyAclUser } from './acl-attrs.ts';
+import { ValkeyAclChannelPatterns, ValkeyAclMonitorKeyPrefix, ValkeyAclNameGlob, ValkeyAclReservedUser, ValkeyAclSeatKeyPrefix, ValkeyAclUserNameMismatch } from './errors.ts';
+import { type Environment } from '../secrets/write-only.ts';
+/** The `#<sha256>` token `ACL SETUSER` accepts in place of `>plaintext`. */
+export declare const passwordToken: (password: string) => Effect.Effect<string>;
+/**
+ * The exact `ACL SETUSER` argument list the family issues for one user: reset the blank user,
+ * enable it, one password hash, channels reset to the profile's scope, the declared key pattern,
+ * then the profile's rules. `password` is the RESOLVED value (already checked present by the
+ * caller), never stored, never returned; only its sha256 crosses the wire.
+ */
+export declare const buildSetUserArgs: (user: ValkeyAclUser, password: string) => Effect.Effect<ReadonlyArray<string>>;
+/** One `ACL LIST` line, parsed. `rules` holds the `+`/`-` tokens the server echoes (normalised,
+ * see the header); `keyPatterns`/`channelPatterns` keep their `~`/`&`; flags are booleans. */
+export interface ParsedAclUser {
+    readonly name: string;
+    readonly on: boolean;
+    readonly nopass: boolean;
+    /** Any password token (`#<hash>`, `>pw`, `<pw`) present. */
+    readonly hasPassword: boolean;
+    readonly keyPatterns: ReadonlyArray<string>;
+    readonly channelPatterns: ReadonlyArray<string>;
+    readonly rules: ReadonlyArray<string>;
+}
+/** Parse one `ACL LIST` line into `ParsedAclUser`. Throws `ValkeyAclParseError` on a malformed
+ * line. */
+export declare const parseAclLine: (line: string) => ParsedAclUser;
+/** Whether a seat-profile user's key prefix escapes its own keyspace. `keyPrefix` goes on the
+ * wire as `~<keyPrefix>`, so read-back compares the declaration to itself: `*`, `grok:*` or
+ * `claude:grok:*` would converge and grant keys the seat does not own. CT100's template renders
+ * exactly `~${user}:*`. A service user is exempt: owning the whole instance is what that
+ * profile is for (LiteLLM's cache user, `*`). A monitor user is keyless and may not carry a
+ * prefix at all. */
+export declare const seatKeyPrefixEscapes: (user: ValkeyAclUser) => boolean;
+/** Refusals must run before any `ACL SETUSER`. A mismatched record key would split one user into
+ * two records; a reserved name would reset the credential this kit authenticates with; a glob in
+ * a name would widen the patterns the profile fixes; a seat prefix or monitor key prefix
+ * contradicts the profile's fixed shape. */
+export declare const refusalBeforeWrite: (instance: string, users: Readonly<Record<string, ValkeyAclUser>>, self?: string) => ValkeyAclUserNameMismatch | ValkeyAclReservedUser | ValkeyAclSeatKeyPrefix | ValkeyAclMonitorKeyPrefix | ValkeyAclNameGlob | ValkeyAclChannelPatterns | undefined;
+/** How the environment compares to what the family last wrote for one user, by seal.
+ * `unknown` — the variable is unset here, so the plan cannot tell (never drift: a plan-only
+ * environment must not report every user as rotated). `stale` — no seal yet (an adopted user) or
+ * the seal disagrees with the current value. `match` — the seal was made from this value. */
+export type PasswordState = 'unknown' | 'stale' | 'match';
+export declare const passwordState: (sealed: string, value: string | undefined) => PasswordState;
+/** The password value of one user in `env`, or undefined when the reference is missing. */
+export declare const resolvedPassword: (user: ValkeyAclUser, env: Environment) => string | undefined;
+/** The plan reconcile walks: `create` (absent live), `update` (present but not exactly as
+ * declared — see `matchesDeclared`), `remove` (previously managed users removed from the
+ * declaration, plus all undeclared users under `exclusive: true`) and `undeclared` (all live
+ * names outside the current declaration, reported with their deletion/preservation decision). */
+export interface AclUserPlan {
+    readonly create: ReadonlyArray<ValkeyAclUser>;
+    readonly update: ReadonlyArray<ValkeyAclUser>;
+    readonly remove: ReadonlyArray<string>;
+    readonly undeclared: ReadonlyArray<string>;
+}
+export declare const planAclUsers: (declared: Readonly<Record<string, ValkeyAclUser>>, live: Readonly<Record<string, ParsedAclUser>>, exclusive?: boolean, managed?: ReadonlyArray<string>) => AclUserPlan;
+/** The exact `ACL DELUSER` argument list. */
+export declare const buildDelUserArgs: (users: ReadonlyArray<string>) => ReadonlyArray<string>;
+//# sourceMappingURL=acl-form.d.ts.map

package/dist/valkey/acl-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-form.d.ts","sourceRoot":"","sources":["../../src/valkey/acl-form.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EAEjB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,WAAW,EAAyC,MAAM,0BAA0B,CAAC;AAMnG,4EAA4E;AAC5E,eAAO,MAAM,aAAa,aAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CACjB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,SACrB,aAAa,YACT,MAAM,KACf,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAYlC,CAAC;AAEL;8FAC8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACvC;AAKD;WACW;AACX,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,aAsB3C,CAAC;AAEF;;;;;oBAKoB;AACpB,eAAO,MAAM,oBAAoB,SAAU,aAAa,KAAG,OAC2B,CAAC;AAEvF;;;4CAG4C;AAC5C,eAAO,MAAM,kBAAkB,aACnB,MAAM,SACT,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,SACvC,MAAM,KAEX,yBAAyB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,yBAAyB,GACzB,iBAAiB,GACjB,wBAAwB,GACxB,SAmCH,CAAC;AAEF;;;6FAG6F;AAC7F,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1D,eAAO,MAAM,aAAa,WAAY,MAAM,SAAS,MAAM,GAAG,SAAS,KAAG,aAIzE,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,SAAU,aAAa,OAAO,WAAW,KAAG,MAAM,GAAG,SAKjF,CAAC;AAEF;;;iGAGiG;AACjG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,eAAO,MAAM,YAAY,aACb,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,QAC3C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,iCAEpC,aAAa,CAAC,MAAM,CAAC,KAC7B,WAsBF,CAAC;AAEF,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB,UAAW,aAAa,CAAC,MAAM,CAAC,KAAG,aAAa,CAAC,MAAM,CAInF,CAAC"}

package/dist/valkey/acl-managed.d.ts

@@ -0,0 +1,4 @@
+/** Observed users are not ownership: remember the declaration independently of ACL LIST. */
+import type { ValkeyAclFileAttributes, ValkeyAclFileProps } from './acl-attrs.ts';
+export declare const managedUserNames: (stored: ValkeyAclFileAttributes | undefined, previous?: ValkeyAclFileProps) => ReadonlyArray<string>;
+//# sourceMappingURL=acl-managed.d.ts.map

package/dist/valkey/acl-managed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-managed.d.ts","sourceRoot":"","sources":["../../src/valkey/acl-managed.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAElF,eAAO,MAAM,gBAAgB,WACnB,uBAAuB,GAAG,SAAS,aAChC,kBAAkB,KAC5B,aAAa,CAAC,MAAM,CAMW,CAAC"}

package/dist/valkey/acl-ops.d.ts

@@ -0,0 +1,37 @@
+/**
+ * `Valkey.AclFile` READ operations, engine-independent: reading the live ACL into attributes,
+ * and the aclfile probe the write path gates on. Extracted from `acl.ts` (the Resource and its
+ * handlers) to keep files under the cap; `acl.test.ts` drives these against `fake-valkey.ts`.
+ *
+ * ⛔ PASSWORD BY REFERENCE. Each `user.password` is a `{ fromEnv }` reference; state stores a
+ *   scrypt seal so the next plan can tell whether the value changed without holding the value.
+ *   See `secrets/write-only.ts` and `acl-attrs.ts`.
+ * ★ NO OWNERSHIP MARK (H1). `read` answers `Unowned` for a match (the same rule as
+ *   `Postgres.Database`), so an adopted instance's ACL needs `adopt(true)`.
+ * ★ THE SEALS THREAD THROUGH `output` THE WAY `LiteLLM.MCPServer`'s `credentialSeal` DOES
+ *   (`mcp-server.ts`): `read` never re-seals — it keeps the seal the store already holds. The
+ *   write path (`acl-reconcile.ts`) mints a fresh one only for a user it actually wrote.
+ */
+import * as Effect from 'effect/Effect';
+import type { ValkeyAclFileAttributes, ValkeyAclUserAttributes } from './acl-attrs.ts';
+import { type ParsedAclUser } from './acl-form.ts';
+import { ValkeyAclParseError } from './errors.ts';
+import { type ValkeyExecutor, type ValkeyTransportError } from './transport.ts';
+/** Parse the live `ACL LIST` into its user lines, keyed by username. `self` is the username the
+ * stack's own connection authenticates as (the instance's admin user) — never this family's to
+ * manage: removing it would lock the kit out of the instance, and a `service` user cannot carry
+ * ACL commands anyway, so it is skipped exactly like `default`. A line that does not parse fails
+ * the whole read: a user this family cannot see is a user it cannot converge. */
+export declare const readParsedUsers: (executor: ValkeyExecutor, self?: string) => Effect.Effect<Readonly<Record<string, ParsedAclUser>>, ValkeyAclParseError | ValkeyTransportError>;
+/** One user's live attributes from its parsed line. Passwords are never read (Valkey returns only
+ * hashes, and this family stores seals, not values), so the seal starts empty and `read` threads
+ * the stored one through `output`. */
+export declare const toUserAttributes: (line: ParsedAclUser) => ValkeyAclUserAttributes;
+/** Read the live ACL users into attributes, against any executor. `self` (the connection's own
+ * username) is skipped along with `default` — see `readParsedUsers`. */
+export declare const readWithExecutor: (executor: ValkeyExecutor, instance: string, self?: string) => Effect.Effect<ValkeyAclFileAttributes, ValkeyAclParseError | ValkeyTransportError>;
+/** Probe `CONFIG GET aclfile`: empty means the kit owns ACL state (runtime SETUSER/DELUSER only —
+ * never `ACL SAVE`, which errors without a configured aclfile); non-empty means a rendered file
+ * is the source of truth and the write path refuses (see `ValkeyAclFileRendered`). */
+export declare const readAclFileConfig: (executor: ValkeyExecutor) => Effect.Effect<string, ValkeyTransportError>;
+//# sourceMappingURL=acl-ops.d.ts.map

package/dist/valkey/acl-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-ops.d.ts","sourceRoot":"","sources":["../../src/valkey/acl-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,KAAK,aAAa,EAAgB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EAEnB,KAAK,oBAAoB,EAE1B,MAAM,gBAAgB,CAAC;AAExB;;;;iFAIiF;AACjF,eAAO,MAAM,eAAe,aAChB,cAAc,SACjB,MAAM,KACZ,MAAM,CAAC,MAAM,CACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,EACvC,mBAAmB,GAAG,oBAAoB,CAuBxC,CAAC;AAEL;;sCAEsC;AACtC,eAAO,MAAM,gBAAgB,SAAU,aAAa,KAAG,uBAUrD,CAAC;AAgBH;wEACwE;AACxE,eAAO,MAAM,gBAAgB,aACjB,cAAc,YACd,MAAM,SACT,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,mBAAmB,GAAG,oBAAoB,CACK,CAAC;AAE1F;;sFAEsF;AACtF,eAAO,MAAM,iBAAiB,aAClB,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAiBzC,CAAC"}

package/dist/valkey/acl-profiles.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The fixed ACL profiles this family can express, as the exact rule tokens the wire carries.
+ *
+ * ⛔ THE COMMAND ALLOW-LIST IS A FIXED PROFILE, NOT A PROP (see `acl-attrs.ts`). Every rule set
+ *   here mirrors `homeflare-ct100/src/valkey-acl.ts` (ct100#117) token for token, measured on the
+ *   9.1.1 scratch; a free-form rules prop would let a declaration widen itself and request
+ *   `FLUSHALL` or `ACL SETUSER`, defeating the isolation the resource exists to enforce.
+ *
+ * ★ THE `monitor` PROFILE EXISTS BECAUSE CT100 CARRIES A KEY-LESS `monitor` USER FOR
+ *   `redis_exporter` (ct100#117). Before it existed, `seat` and `service` were the only profiles,
+ *   so `monitor` was undeclared on every CT100-style instance and reconcile DELETED it —
+ *   exporter's connection closed (measured 2026-09-30). `MONITOR_COMMANDS` is exactly what
+ *   `redis_exporter` v1.92.1 issues, measured: `client|setname`, `info`, `command|info`,
+ *   `commandlog|len` (Valkey 8.1+), `config|get`, `latency|latest`, `latency|histogram`,
+ *   `slowlog|get`, `slowlog|len`, plus `ping`. No keys (`resetkeys`), no channels
+ *   (`resetchannels`), no `client|list` (this exporter version never sends it, so it is not
+ *   granted).
+ */
+import type { ValkeyAclProfile, ValkeyAclUser } from './acl-attrs.ts';
+/** The seat command allow-list — fixed, mirrored from `homeflare-ct100/src/valkey-acl.ts`. */
+export declare const SEAT_COMMANDS: string;
+/** What `redis_exporter` v1.92.1 needs and nothing else (ct100#117's `monitor` note). */
+export declare const MONITOR_COMMANDS: string;
+/** The fixed rule sets, as the exact tokens sent after `reset`. */
+export declare const SEAT_RULES: ReadonlyArray<string>;
+export declare const SERVICE_RULES: ReadonlyArray<string>;
+export declare const MONITOR_RULES: ReadonlyArray<string>;
+/** The rule set one profile carries. */
+export declare const profileRules: (profile: ValkeyAclProfile) => ReadonlyArray<string>;
+/**
+ * The effective key prefix of one declared user.
+ *
+ * - `monitor` is key-less (ct100#117's `resetkeys`): it has no prefix, and a declaration that
+ *   gives it one is refused (`ValkeyAclMonitorKeyPrefix`).
+ * - `seat` is pinned to `<name>:*` — the CT100 template's `~${user}:*`; anything else is refused
+ *   (`ValkeyAclSeatKeyPrefix`). The optional prop defaults to the pin.
+ * - `service` owns the instance's declared prefix, `*` by default (LiteLLM's cache user on CT100
+ *   declares `hf-litellm:*`).
+ */
+export declare const effectiveKeyPrefix: (user: ValkeyAclUser) => string;
+/** The key patterns the declaration expects for one user, in the server's own echo form. */
+export declare const declaredKeyPatterns: (user: ValkeyAclUser) => ReadonlyArray<string>;
+/**
+ * The channel patterns the declaration expects for one user, in the server's own echo form.
+ *
+ * ★ CHANNELS COME FROM THE DECLARATION, NEVER `allchannels` (round-3 finding 2). `seat` gets
+ *   `&<name>:*`, `service` gets `&<keyPrefix>` (ct100#117's litellm line: `&${namespace}:*`),
+ *   `monitor` gets none. The old unconditional `allchannels` on `service` widened LiteLLM from
+ *   `&hf-litellm:*` to every channel; the "mirrors the CT100 template" comment next to it was
+ *   never true. A server normalises `&*` back to `allchannels` internally and echoes `&*`.
+ */
+export declare const declaredChannels: (user: ValkeyAclUser) => ReadonlyArray<string>;
+//# sourceMappingURL=acl-profiles.d.ts.map

package/dist/valkey/acl-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-profiles.d.ts","sourceRoot":"","sources":["../../src/valkey/acl-profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEtE,8FAA8F;AAC9F,eAAO,MAAM,aAAa,QAGN,CAAC;AAMrB,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,QAEmC,CAAC;AAEjE,mEAAmE;AACnE,eAAO,MAAM,UAAU,EAAE,aAAa,CAAC,MAAM,CAAqD,CAAC;AACnG,eAAO,MAAM,aAAa,EAAE,aAAa,CAAC,MAAM,CAAgD,CAAC;AACjG,eAAO,MAAM,aAAa,EAAE,aAAa,CAAC,MAAM,CAA+B,CAAC;AAEhF,wCAAwC;AACxC,eAAO,MAAM,YAAY,YAAa,gBAAgB,KAAG,aAAa,CAAC,MAAM,CACY,CAAC;AAE1F;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,SAAU,aAAa,KAAG,MAK1B,CAAC;AAEhC,4FAA4F;AAC5F,eAAO,MAAM,mBAAmB,SAAU,aAAa,KAAG,aAAa,CAAC,MAAM,CAG7E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,SAAU,aAAa,KAAG,aAAa,CAAC,MAAM,CAI1E,CAAC"}

package/dist/valkey/acl-reconcile.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `Valkey.AclFile` reconcile core, against any executor. Extracted from the old single-file
+ * `acl.ts` and reworked for the round-3 findings:
+ *
+ * ★ GATE FIRST (F3). `CONFIG GET aclfile` non-empty → `ValkeyAclFileRendered`, BEFORE any write.
+ *   The rendered file is the source of truth (CT100: openbao-agent renders it and a runtime
+ *   write reverts — the measured WRONGPASS seat). `delete` runs the same gate (`acl.ts`).
+ * ★ RUNTIME-ONLY WRITES, NO `ACL SAVE` (F3). In kit-owned mode (empty aclfile) `ACL SAVE`
+ *   measurably errors on 8.1.10 — "This instance is not configured to use an ACL file" — so the
+ *   kit-owned family never calls it. ACL state is runtime state, not data: it does not survive
+ *   a restart even with appendonly (measured), so this family re-asserts on every reconcile.
+ * ★ NEVER-MANAGED USERS ARE PRESERVED BY DEFAULT (F1). `planAclUsers` only DELUSERs those
+ *   under `exclusive: true`; removing a previously declared user always revokes it.
+ */
+import * as Effect from 'effect/Effect';
+import { type Environment } from '../secrets/write-only.ts';
+import type { ValkeyAclFileAttributes, ValkeyAclFileProps } from './acl-attrs.ts';
+import { type ValkeyError } from './errors.ts';
+import { type ValkeyExecutor, type ValkeyTransportError } from './transport.ts';
+/** The reconcile core: gate on the rendered aclfile, refuse bad declarations, resolve every
+ * password ONCE, plan against the live ACL, write, then re-read and verify (S10: never trust
+ * the write). `stored` is the state this stack already holds (`output`); it is what adoption
+ * lacks, and its absence is what makes the first plan a write. `self` is the connection's own
+ * username — never managed, like `default`. */
+export declare const reconcileWithExecutor: (executor: ValkeyExecutor, props: ValkeyAclFileProps, stored: ValkeyAclFileAttributes | undefined, env?: Environment, self?: string, previous?: ValkeyAclFileProps) => Effect.Effect<ValkeyAclFileAttributes, ValkeyError | ValkeyTransportError>;
+//# sourceMappingURL=acl-reconcile.d.ts.map

package/dist/valkey/acl-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-reconcile.d.ts","sourceRoot":"","sources":["../../src/valkey/acl-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,WAAW,EAAkC,MAAM,0BAA0B,CAAC;AAC5F,OAAO,KAAK,EACV,uBAAuB,EACvB,kBAAkB,EAGnB,MAAM,gBAAgB,CAAC;AAWxB,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,cAAc,EAAqB,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEnG;;;;+CAI+C;AAC/C,eAAO,MAAM,qBAAqB,aACtB,cAAc,SACjB,kBAAkB,UACjB,uBAAuB,GAAG,SAAS,QACtC,WAAW,SACT,MAAM,aACF,kBAAkB,KAC5B,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,oBAAoB,CA+HxE,CAAC"}

package/dist/valkey/acl.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `Valkey.AclFile` — the per-instance ACL users, each limited to a key prefix and a fixed command
+ * profile, with passwords by reference (never in state). The operations live in `acl-ops.ts`
+ * (extracted to keep both files under the cap); this file is the Resource and its handlers.
+ *
+ * ⛔ ONE ACL FILE PER INSTANCE, SEAT USERS ONLY. A shared file would let a seat user exist on the
+ *   LiteLLM cache (:6380) and `litellm` on the seat store (:6381) — every seat could poison the
+ *   response cache. The consuming stack declares one `Valkey.AclFile` per instance, holding only
+ *   that instance's users.
+ * ★ NO OWNERSHIP MARK (H1). `read` answers `Unowned` for a match (the same rule as
+ *   `Postgres.Database`), so an adopted instance's ACL needs `adopt(true)`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type { ValkeyAclFileAttributes, ValkeyAclFileProps } from './acl-attrs.ts';
+import { type ValkeyConnection, withValkey } from './connection.ts';
+export interface ValkeyAclFile extends Resource<'Valkey.AclFile', ValkeyAclFileProps, ValkeyAclFileAttributes> {
+}
+export declare const ValkeyAclFile: import("alchemy").ResourceClass<ValkeyAclFile>;
+export declare const isValkeyAclFile: (value: unknown) => value is ValkeyAclFile;
+export declare const makeValkeyAclFileHandlers: (connect?: typeof withValkey) => Provider.ProviderService<ValkeyAclFile, ValkeyConnection, never, never, ValkeyConnection, ValkeyConnection>;
+export declare const valkeyAclFileHandlers: Provider.ProviderService<ValkeyAclFile, ValkeyConnection, never, never, ValkeyConnection, ValkeyConnection, never, never, never>;
+export declare const ValkeyAclFileProvider: () => import("effect/Layer").Layer<Provider.Provider<ValkeyAclFile>, never, ValkeyConnection>;
+//# sourceMappingURL=acl.d.ts.map

package/dist/valkey/acl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/valkey/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EACV,uBAAuB,EACvB,kBAAkB,EAEnB,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EAAE,KAAK,gBAAgB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAKpE,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,CACxB;CAAG;AAEJ,eAAO,MAAM,aAAa,gDAExB,CAAC;AAEH,eAAO,MAAM,eAAe,UAAW,OAAO,KAAG,KAAK,IAAI,aAGD,CAAC;AAE1D,eAAO,MAAM,yBAAyB,aAC3B,OAAO,UAAU,KACzB,QAAQ,CAAC,eAAe,CACzB,aAAa,EACb,gBAAgB,EAChB,KAAK,EACL,KAAK,EACL,gBAAgB,EAChB,gBAAgB,CA2Gd,CAAC;AAEL,eAAO,MAAM,qBAAqB,kIAA8B,CAAC;AAEjE,eAAO,MAAM,qBAAqB,+FAA+D,CAAC"}

package/dist/valkey/connection-service.d.ts

@@ -0,0 +1,22 @@
+/** Named connections keep each resource on its own server when provider layers are combined. */
+import * as Context from 'effect/Context';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import type { ValkeyConnectionConfig } from './connection.ts';
+declare const ValkeyConnectionMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyConnectionMissing";
+} & Readonly<A>;
+export declare class ValkeyConnectionMissing extends ValkeyConnectionMissing_base<{
+    readonly instance: string;
+}> {
+    get message(): string;
+}
+declare const ValkeyConnection_base: Context.ServiceClass<ValkeyConnection, "Valkey.Connection", Effect.Effect<ValkeyConnectionConfig, never, never>>;
+/** The unnamed service is only for direct transport calls; resources always select a name. */
+export declare class ValkeyConnection extends ValkeyConnection_base {
+}
+/** Use `Layer.provideMerge` on providers: their handlers resolve this service later. */
+export declare const valkeyConnection: (config: ValkeyConnectionConfig) => Layer.Layer<ValkeyConnection>;
+export declare const resolveValkeyConnection: (instance?: string) => Effect.Effect<ValkeyConnectionConfig, ValkeyConnectionMissing, ValkeyConnection>;
+export {};
+//# sourceMappingURL=connection-service.d.ts.map

package/dist/valkey/connection-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-service.d.ts","sourceRoot":"","sources":["../../src/valkey/connection-service.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;;;;AAE9D,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;AAED,8FAA8F;AAC9F,qBAAa,gBAAiB,SAAQ,qBAGd;CAAG;AAW3B,wFAAwF;AACxF,eAAO,MAAM,gBAAgB,WAAY,sBAAsB,KAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,CACnB,CAAC;AAE5E,eAAO,MAAM,uBAAuB,cACvB,MAAM,KAChB,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,uBAAuB,EAAE,gBAAgB,CAQ9E,CAAC"}

package/dist/valkey/connection.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Where a Valkey instance's socket comes from, and how each lifecycle operation gets an executor.
+ *
+ * ⛔ NO ESTATE VALUE LIVES HERE. The kit is PUBLIC; CT100's host, the two ports (6380/6381) and the
+ *   ACL user a seat authenticates as are the CONSUMING stack's values, passed to
+ *   `valkeyConnection(...)` in a house stack — never a default, never a fallback. The mini's own
+ *   Valkey, or any later host, is a different `valkeyConnection` call, not a constant.
+ * ★ A LAZY `Context.Service` WHOSE VALUE IS AN `Effect` (S24) — the same shape `PostgresConnection`
+ *   uses. `host` and `port` carry no secret; the ACL user's PASSWORD is not a prop here (S25): the
+ *   `Valkey.AclFile` resource seals passwords by reference, and the connection itself authenticates
+ *   with `AUTH` only when a stack supplies a password through `valkeyConnection`'s `password`
+ *   reference — resolved at call time, never stored.
+ * ★ ONE SOCKET PER OPERATION, OPENED AND CLOSED IN A SCOPE. `withValkey` opens a `node:net` socket
+ *   for the operation, runs it, and closes the socket when it finishes — one connection per
+ *   `reconcile`, never held across a whole plan.
+ */
+import * as Effect from 'effect/Effect';
+import { type ValkeyConnection, type ValkeyConnectionMissing } from './connection-service.ts';
+export { ValkeyConnection, ValkeyConnectionMissing, valkeyConnection, } from './connection-service.ts';
+import { type Environment, type FromEnv } from '../secrets/write-only.ts';
+import { ValkeyAuthPasswordMissing } from './errors.ts';
+import { type ValkeyExecutor, type ValkeyTransportError } from './transport.ts';
+/** What a stack passes to reach one instance. `host`/`port` are the TCP endpoint; the ACL
+ * `username` and optional `password` (a `FromEnv` reference, never a value) are the credentials a
+ * stack authenticates with. Omitting both sends no `AUTH` — a bare `default` connection, which is
+ * correct only for a scratch instance a test owns.
+ *
+ * ⛔ A USERNAME REQUIRES A PASSWORD. The discriminated union makes `username` without `password`
+ *   unrepresentable: on an instance whose `default` user is off (CT100's ACL files ship `user
+ *   default off`), a username-only connection cannot authenticate at all, and silently skipping
+ *   `AUTH` would surface much later as a confusing `NOAUTH` from the first command. The bare
+ *   branch carries `username?: undefined` — a type marker, not a prop — so `config.username`
+ *   reads on the whole union without narrowing first.
+ *
+ * `timeoutMs` bounds connect, each read, and the socket idle timer (default 10s). A blackholed
+ * host must stall a plan no longer than that deadline. */
+export type ValkeyConnectionConfig = {
+    /** Resource routing key: required by valkeyProviders; omit only for direct transport calls. */
+    readonly instance?: string;
+    readonly host: string;
+    readonly port: number;
+    /** Per-connect/per-read deadline in ms. */
+    readonly timeoutMs?: number;
+} & ({
+    readonly username?: undefined;
+} | {
+    readonly username?: string;
+    readonly password: FromEnv;
+});
+/** `AUTH` when the config carries a password, resolved at call time; a missing or empty variable
+ * is the typed `ValkeyAuthPasswordMissing` (S21: a fact this family checked, not a sniffed server
+ * reply). A password without a username authenticates as `default`. */
+export declare const auth: (executor: ValkeyExecutor, config: ValkeyConnectionConfig, env: Environment) => Effect.Effect<void, ValkeyTransportError | ValkeyAuthPasswordMissing>;
+/**
+ * Run one operation against a freshly opened, freshly closed socket. Every `read` and `reconcile`
+ * in this family calls this once for the whole operation, never once per command.
+ */
+export declare const withValkey: <A, E>(build: (executor: ValkeyExecutor, config: ValkeyConnectionConfig) => Effect.Effect<A, E | ValkeyTransportError>, instance?: string) => Effect.Effect<A, E | ValkeyTransportError | ValkeyAuthPasswordMissing | ValkeyConnectionMissing, ValkeyConnection>;
+//# sourceMappingURL=connection.d.ts.map

package/dist/valkey/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/valkey/connection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAE7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,OAAO,EAAc,MAAM,0BAA0B,CAAC;AACtF,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAEL,KAAK,cAAc,EAGnB,KAAK,oBAAoB,EAE1B,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;;;;;0DAa0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG;IACnC,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,CACA;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,GACjC;IACE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CACJ,CAAC;AAiDF;;uEAEuE;AACvE,eAAO,MAAM,IAAI,aACL,cAAc,UAChB,sBAAsB,OACzB,WAAW,KACf,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,GAAG,yBAAyB,CAiBtE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,SACtB,CACL,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,sBAAsB,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,oBAAoB,CAAC,aACpC,MAAM,KAChB,MAAM,CAAC,MAAM,CACd,CAAC,EACD,CAAC,GAAG,oBAAoB,GAAG,yBAAyB,GAAG,uBAAuB,EAC9E,gBAAgB,CAyBd,CAAC"}

package/dist/valkey/errors.d.ts

@@ -0,0 +1,165 @@
+declare const ValkeyInstanceDrift_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyInstanceDrift";
+} & Readonly<A>;
+/** The live instance does not match an asserted property. Like `Postgres.DatabaseDrift`, this
+ * family asserts properties at create and refuses drift rather than silently issuing a
+ * reconfiguration that could drop state. */
+export declare class ValkeyInstanceDrift extends ValkeyInstanceDrift_base<{
+    readonly instance: string;
+    readonly prop: string;
+    readonly declared: unknown;
+    readonly live: unknown;
+}> {
+    get message(): string;
+}
+declare const ValkeyInstanceUnreachable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyInstanceUnreachable";
+} & Readonly<A>;
+/** `Valkey.Instance` found the instance unreachable or refused authentication when reading it.
+ * `host` is optional because it is the connection layer's value (`connection.ts`), never a prop
+ * this resource holds — a reconcile that only knows its own declaration names the port. */
+export declare class ValkeyInstanceUnreachable extends ValkeyInstanceUnreachable_base<{
+    readonly instance: string;
+    readonly host?: string;
+    readonly port: number;
+}> {
+    get message(): string;
+}
+declare const ValkeyAclParseError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyAclParseError";
+} & Readonly<A>;
+/** An ACL LIST line could not be parsed. Neither the message nor error data retain the
+ * raw line: error serialization must not expose its password hash. */
+export declare class ValkeyAclParseError extends ValkeyAclParseError_base<{}> {
+    get message(): string;
+}
+declare const ValkeyAclPasswordMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyAclPasswordMissing";
+} & Readonly<A>;
+/** A declared ACL user is missing a referenced password; a user with no password can authenticate
+ * as nobody, which would bypass isolation. */
+export declare class ValkeyAclPasswordMissing extends ValkeyAclPasswordMissing_base<{
+    readonly instance: string;
+    readonly user: string;
+    readonly variable: string;
+}> {
+    get message(): string;
+}
+declare const ValkeyAuthPasswordMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyAuthPasswordMissing";
+} & Readonly<A>;
+/** The stack's own connection password is a `{ fromEnv }` reference that resolved to nothing at
+ * call time. Distinct from `ValkeyInstanceUnreachable` (nothing answered on the wire) and from
+ * `ValkeyAclPasswordMissing` (a DECLARED ACL user's password): this one is the credential the
+ * stack itself authenticates with to reach an instance. */
+export declare class ValkeyAuthPasswordMissing extends ValkeyAuthPasswordMissing_base<{
+    readonly username: string | undefined;
+    readonly variable: string;
+}> {
+    get message(): string;
+}
+declare const ValkeyAclReadbackFailed_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyAclReadbackFailed";
+} & Readonly<A>;
+/** The live ACL after a reconcile does not match the declaration on read-back — the write was lost
+ * or a concurrent mutator changed it before we could verify. */
+export declare class ValkeyAclReadbackFailed extends ValkeyAclReadbackFailed_base<{
+    readonly instance: string;
+    readonly user: string;
+}> {
+    get message(): string;
+}
+declare const ValkeyAclSeatKeyPrefix_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyAclSeatKeyPrefix";
+} & Readonly<A>;
+/** A `seat`-profile user's key prefix escapes its own keyspace. The seat profile exists to pin
+ * each seat to keys beginning with its own name (`~<name>:…`); `keyPrefix` goes on the wire as
+ * `~<keyPrefix>`, so `*` is every key and `grok:*` is another seat's. Refused before any write —
+ * a `service` user is the profile that owns a whole instance. */
+export declare class ValkeyAclSeatKeyPrefix extends ValkeyAclSeatKeyPrefix_base<{
+    readonly instance: string;
+    readonly user: string;
+    readonly keyPrefix: string;
+}> {
+    get message(): string;
+}
+declare const ValkeyAclReservedUser_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyAclReservedUser";
+} & Readonly<A>;
+/** A declaration names `default` or the connection username. `ACL SETUSER` `reset` would replace
+ * the credential this kit authenticates with (`~* +@all`) with a profile that cannot run `ACL`,
+ * and the next `ACL LIST` answers `NOPERM`. Refused before any write. */
+export declare class ValkeyAclReservedUser extends ValkeyAclReservedUser_base<{
+    readonly instance: string;
+    readonly user: string;
+}> {
+    get message(): string;
+}
+declare const ValkeyAclUserNameMismatch_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyAclUserNameMismatch";
+} & Readonly<A>;
+/** A live or stored ACL user is keyed under one name but its line carries another — the parsed
+ * `user` name disagrees with the record key this family stores it under. The record key is this
+ * family's identity, so the mismatch means the ACL was changed by something else. */
+export declare class ValkeyAclUserNameMismatch extends ValkeyAclUserNameMismatch_base<{
+    readonly instance: string;
+    readonly recordKey: string;
+    readonly user: string;
+}> {
+    get message(): string;
+}
+export type ValkeyError = ValkeyInstanceDrift | ValkeyInstanceUnreachable | ValkeyAclParseError | ValkeyAclPasswordMissing | ValkeyAclReadbackFailed | ValkeyAclUserNameMismatch | ValkeyAclReservedUser | ValkeyAclSeatKeyPrefix | ValkeyAclMonitorKeyPrefix | ValkeyAclNameGlob | ValkeyAclChannelPatterns | ValkeyAclFileRendered | ValkeyAuthPasswordMissing;
+declare const ValkeyAclMonitorKeyPrefix_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyAclMonitorKeyPrefix";
+} & Readonly<A>;
+/** A `monitor`-profile user was declared with a key prefix. The monitor profile exists for the
+ * key-less `redis_exporter` identity (ct100#117): its rules carry `resetkeys`, and a `~` pattern
+ * next to them would contradict the key-less shape the profile is fixed to. Refused before any
+ * write. */
+export declare class ValkeyAclMonitorKeyPrefix extends ValkeyAclMonitorKeyPrefix_base<{
+    readonly instance: string;
+    readonly user: string;
+    readonly keyPrefix: string;
+}> {
+    get message(): string;
+}
+declare const ValkeyAclNameGlob_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyAclNameGlob";
+} & Readonly<A>;
+/** A username carries glob characters (`*`, `?`, `[`, `]`). Names are interpolated into key and
+ * channel patterns (`~<name>:*`, `&<name>:*`), so a glob in the name would widen the patterns
+ * the profile is fixed to — `seat*` would reach `seat2:*`. Refused before any write. */
+export declare class ValkeyAclNameGlob extends ValkeyAclNameGlob_base<{
+    readonly instance: string;
+    readonly user: string;
+    readonly chars: string;
+}> {
+    get message(): string;
+}
+declare const ValkeyAclFileRendered_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyAclFileRendered";
+} & Readonly<A>;
+/** The instance renders its ACL from a file (`--aclfile`, answered by `CONFIG GET aclfile`), so
+ * the FILE is the source of truth and this family cannot manage it: the kit speaks RESP only, it
+ * can neither write the file nor outlast the renderer that owns it (CT100: openbao-agent renders
+ * `/etc/valkey/*-acl.conf` and mounts it read-only — a runtime `ACL SETUSER` there is reverted by
+ * the next render/restart, measured 2026-09-30 as a WRONGPASS seat). Declare those users in the
+ * rendering template instead, or use kit-owned runtime ACL management without a configured ACL file. */
+export declare class ValkeyAclFileRendered extends ValkeyAclFileRendered_base<{
+    readonly instance: string;
+    readonly path: string;
+}> {
+    get message(): string;
+}
+declare const ValkeyAclChannelPatterns_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ValkeyAclChannelPatterns";
+} & Readonly<A>;
+/** A fixed profile cannot widen its channel boundary by declaration. */
+export declare class ValkeyAclChannelPatterns extends ValkeyAclChannelPatterns_base<{
+    readonly instance: string;
+    readonly user: string;
+}> {
+    get message(): string;
+}
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/valkey/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/valkey/errors.ts"],"names":[],"mappings":";;;AAUA;;4CAE4C;AAC5C,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;2FAE2F;AAC3F,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;sEACsE;AACtE,qBAAa,mBAAoB,SAAQ,yBAAwC,EAEhF,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;8CAC8C;AAC9C,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;2DAG2D;AAC3D,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;gEACgE;AAChE,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;iEAGiE;AACjE,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;qFAEqF;AACrF,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;AAED,MAAM,MAAM,WAAW,GACnB,mBAAmB,GACnB,yBAAyB,GACzB,mBAAmB,GACnB,wBAAwB,GACxB,uBAAuB,GACvB,yBAAyB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,yBAAyB,GACzB,iBAAiB,GACjB,wBAAwB,GACxB,qBAAqB,GACrB,yBAAyB,CAAC;;;;AAE9B;;;YAGY;AACZ,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;wFAEwF;AACxF,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;;;wGAKwG;AACxG,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAS7B;CACF;;;;AAED,wEAAwE;AACxE,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF"}

package/dist/valkey/fake-acl.d.ts

@@ -0,0 +1,29 @@
+/** One user's ACL state — the fake's parsed mirror of what a real server keeps per user. */
+export interface FakeAclUser {
+    on: boolean;
+    nopass: boolean;
+    /** The stored `#<sha256>` tokens, empty when the user has no passwords. */
+    passwords: ReadonlyArray<string>;
+    /** Key patterns with their `~`, e.g. `['~claude:*']`. */
+    keys: ReadonlyArray<string>;
+    /** Channel patterns with their `&`; `['&*']` is what `allchannels` echoes as. */
+    channels: ReadonlyArray<string>;
+    /** The `+`/`-` rule tokens, with the `-@all` baseline the echo keeps. */
+    rules: ReadonlyArray<string>;
+}
+export declare const sha256: (value: string) => string;
+/** A user straight out of `reset`: off, no password, no patterns, the `-@all` baseline. */
+export declare const freshUser: () => FakeAclUser;
+/** Apply one `ACL SETUSER` rule token, in order — the fake's model of the server's own
+ * incremental semantics (`reset` resets, `+@all` cancels the `-@all` baseline, and so on). */
+export declare const applyToken: (user: FakeAclUser, token: string) => void;
+/** The `ACL LIST` echo for one user — the MEASURED shape: flags, password hash, key patterns,
+ * the bare `resetchannels` marker before the channel patterns, then the rule tokens. */
+export declare const renderUser: (name: string, user: FakeAclUser) => string;
+/** Tokenize a seeded `ACL LIST` line the way the fake would have stored the SETUSER that made
+ * it, so a seed and a write land in the same shape. */
+export declare const seedUser: (line: string) => FakeAclUser;
+/** Does `channel` match one of the session user's `&` patterns? Glob, the way the server's
+ * `&pat:*` works for PUBLISH. */
+export declare const channelAllowed: (user: FakeAclUser, channel: string) => boolean;
+//# sourceMappingURL=fake-acl.d.ts.map

package/dist/valkey/fake-acl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-acl.d.ts","sourceRoot":"","sources":["../../src/valkey/fake-acl.ts"],"names":[],"mappings":"AAGA,4FAA4F;AAC5F,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjC,yDAAyD;IACzD,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChC,yEAAyE;IACzE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED,eAAO,MAAM,MAAM,UAAW,MAAM,KAAG,MAA0D,CAAC;AAElG,2FAA2F;AAC3F,eAAO,MAAM,SAAS,QAAO,WAO3B,CAAC;AAEH;8FAC8F;AAC9F,eAAO,MAAM,UAAU,SAAU,WAAW,SAAS,MAAM,KAAG,IA0D7D,CAAC;AAEF;wFACwF;AACxF,eAAO,MAAM,UAAU,SAAU,MAAM,QAAQ,WAAW,KAAG,MAa/C,CAAC;AAEf;uDACuD;AACvD,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,WAMvC,CAAC;AAEF;iCACiC;AACjC,eAAO,MAAM,cAAc,SAAU,WAAW,WAAW,MAAM,KAAG,OAOhE,CAAC"}

package/dist/valkey/fake-valkey.d.ts

@@ -0,0 +1,35 @@
+import type { ValkeyExecutor } from './transport.ts';
+export interface RecordedCommand {
+    readonly args: ReadonlyArray<string>;
+}
+export interface FakeValkey extends ValkeyExecutor {
+    readonly commands: ReadonlyArray<RecordedCommand>;
+    /** Mutable on purpose: a test seeds a value a "competing" write would have produced before
+     * the fake ever sees it. The `aclfile` entry is what `CONFIG GET aclfile` answers. */
+    readonly config: Map<string, string>;
+    /** The live ACL as `ACL LIST` echoes it, keyed by username — the fake's own report, not the
+     * command list (S28). */
+    readonly acl: Map<string, string>;
+    /** Which usernames the fake accepts an `AUTH` for, and at which plaintext (test fixtures). */
+    readonly passwords: Map<string, string>;
+}
+export interface FakeValkeyOptions {
+    readonly config?: Readonly<Record<string, string>>;
+    /** Seed users as `ACL LIST` lines, parsed with the same tokenizer as SETUSER. */
+    readonly acl?: Readonly<Record<string, string>>;
+    readonly passwords?: Readonly<Record<string, string>>;
+    /** Fail the NEXT write (`ACL SETUSER`/`ACL DELUSER`) once, the way a concurrent mutator would. */
+    readonly raceNextWrite?: boolean;
+    /** Re-add this user after EVERY successful ACL write — a concurrent mutator that survives the
+     * reconcile's writes, so the read-back (never the write reply) is what catches it. */
+    readonly reAddAfterWrite?: {
+        readonly name: string;
+        readonly line: string;
+    };
+    /** The version `INFO` reports as `valkey_version` (with a `redis_version` fallback line). */
+    readonly version?: string;
+    /** `INFO` `tcp_port`. Defaults to 0, the reply a server that omitted the line would give. */
+    readonly port?: number;
+}
+export declare const makeFakeValkey: (options?: FakeValkeyOptions) => FakeValkey;
+//# sourceMappingURL=fake-valkey.d.ts.map

package/dist/valkey/fake-valkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-valkey.d.ts","sourceRoot":"","sources":["../../src/valkey/fake-valkey.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,cAAc,EAAkC,MAAM,gBAAgB,CAAC;AAErF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD;0FACsF;IACtF,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;6BACyB;IACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,iFAAiF;IACjF,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,kGAAkG;IAClG,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;0FACsF;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5E,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,cAAc,aAAa,iBAAiB,KAAQ,UAgKhE,CAAC"}

package/dist/valkey/handler-test-fixture.d.ts

@@ -0,0 +1,20 @@
+/** Test-only connection injection: no listener, module mock or live endpoint. */
+import * as Effect from 'effect/Effect';
+import { type ValkeyConnection, type ValkeyConnectionConfig, type withValkey } from './connection.ts';
+import type { Environment } from '../secrets/write-only.ts';
+import type { ValkeyExecutor } from './transport.ts';
+export declare const config: ValkeyConnectionConfig;
+export declare const env: Environment;
+export declare const connection: (executor: ValkeyExecutor, credentials?: Environment) => typeof withValkey;
+export declare const run: <A, E>(effect: Effect.Effect<A, E, ValkeyConnection>) => Promise<A>;
+export declare const context: {
+    id: string;
+    fqn: string;
+    instanceId: string;
+    session: never;
+    bindings: never[];
+    oldBindings: never[];
+    newBindings: never[];
+};
+export declare const required: <T>(value: T | undefined) => T;
+//# sourceMappingURL=handler-test-fixture.d.ts.map

package/dist/valkey/handler-test-fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-test-fixture.d.ts","sourceRoot":"","sources":["../../src/valkey/handler-test-fixture.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAE3B,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGrD,eAAO,MAAM,MAAM,EAAE,sBAMpB,CAAC;AACF,eAAO,MAAM,GAAG,EAAE,WAAoD,CAAC;AACvE,eAAO,MAAM,UAAU,aACV,cAAc,gBAAe,WAAW,KAAS,OAAO,UAK/D,CAAC;AACP,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,KAAG,OAAO,CAAC,CAAC,CACT,CAAC;AAC3E,eAAO,MAAM,OAAO;IAClB,EAAE;IACF,GAAG;IACH,UAAU;IACV,OAAO,EAAe,KAAK;IAC3B,QAAQ;IACR,WAAW;IACX,WAAW;CACZ,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,CAAC,SAAS,CAAC,GAAG,SAAS,KAAG,CAGlD,CAAC"}