@homeflare/alchemy 0.46.1 → 0.47.1

package/src/litellm/policy.test.ts

@@ -9,7 +9,7 @@ import { expect, test } from 'bun:test';
 import { credentials } from '@distilled.cloud/litellm/Credentials';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { FAKE_BASE } from './fake-litellm.ts';
 import { FAKE_KEY } from './fake-registry-base.ts';
 import {

package/src/litellm/team-members.test.ts

@@ -9,7 +9,7 @@ import { expect, test } from 'bun:test';
 import { credentials } from '@distilled.cloud/litellm/Credentials';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { FAKE_BASE } from './fake-litellm.ts';
 import { FAKE_KEY } from './fake-registry-base.ts';
 import { type FakeTeamLitellm, startFakeTeamLitellm, teamRow } from './fake-team-litellm.ts';

package/src/litellm/team-read.test.ts

@@ -9,7 +9,7 @@ import { expect, test } from 'bun:test';
 import { credentials } from '@distilled.cloud/litellm/Credentials';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { FAKE_BASE } from './fake-litellm.ts';
 import { FAKE_KEY } from './fake-registry-base.ts';
 import { type FakeTeamLitellm, startFakeTeamLitellm, teamRow } from './fake-team-litellm.ts';

package/src/litellm/tool-policy.test.ts

@@ -9,7 +9,7 @@ import { expect, test } from 'bun:test';
 import { credentials } from '@distilled.cloud/litellm/Credentials';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { FAKE_BASE } from './fake-litellm.ts';
 import { FAKE_KEY } from './fake-registry-base.ts';
 import { type FakeToolLitellm, startFakeToolLitellm, toolRow } from './fake-tool-litellm.ts';

package/src/litellm/toolset.test.ts

@@ -9,7 +9,7 @@ import { expect, test } from 'bun:test';
 import { credentials } from '@distilled.cloud/litellm/Credentials';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { FAKE_BASE } from './fake-litellm.ts';
 import { FAKE_KEY } from './fake-registry-base.ts';
 import {

package/src/netbox/fake-netbox.ts

@@ -11,7 +11,7 @@
  */
 import { type Credentials, credentials } from '@distilled.cloud/netbox/Credentials';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 
 export const FAKE_BASE = 'https://netbox.example.com';
 export const FAKE_TOKEN = 'placeholder-netbox-token';

package/src/netbox/resource.ts

@@ -36,7 +36,7 @@ import type { Input } from 'alchemy/Input';
 import { CredentialsFromEnv } from '@distilled.cloud/netbox/Credentials';
 import type { NetboxOpContext } from '@distilled.cloud/netbox/Protocol';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { guardBody } from './constraint-guard.ts';
 import type { EndpointKey, NetboxBody } from './constraints.ts';
 

package/src/openbao/adopt-core.test.ts

@@ -15,7 +15,10 @@ import { writesOf } from './fake-stack.ts';
 import { BaoMount } from './mount.ts';
 
 const NOT_OWNED = /Cannot adopt resource 'Z'.*not owned by this stack.*--adopt/s;
-const TAKEOVER = /: already exists, and this stack holds no state for it.*Nothing was written/s;
+// ★ beta.81 probes a create with an Output prop at apply itself, so ITS refusal fires first; the
+//   kit's refuseTakeover is the backstop. Either way each test asserts nothing was written.
+const TAKEOVER =
+  /Cannot adopt resource 'Z'.*--adopt|: already exists, and this stack holds no state for it.*Nothing was written/s;
 
 /** `Z`, with its knob an Output until apply: an upstream AppRole's `tokenTtl`, created with it. */
 const pending = (row: CoreRow) =>

package/src/openbao/adopt-families.test.ts

@@ -19,7 +19,10 @@ import { FAMILIES, type Family, upstream, withEstate } from './fake-families.ts'
 import { writesOf } from './fake-stack.ts';
 
 const NOT_OWNED = /Cannot adopt resource 'Z'.*not owned by this stack.*--adopt/s;
-const TAKEOVER = /: already exists, and this stack holds no state for it.*Nothing was written/s;
+// ★ beta.81 probes a create with an Output prop at apply itself, so ITS refusal fires first; the
+//   kit's refuseTakeover is the backstop. Either way each test asserts nothing was written.
+const TAKEOVER =
+  /Cannot adopt resource 'Z'.*--adopt|: already exists, and this stack holds no state for it.*Nothing was written/s;
 const STILL_REFUSED = /Cannot adopt resource 'Z'.*--adopt/s;
 
 /** `Z` names `a`, with its knob an Output until apply: the upstream AppRole is created with it. */

package/src/openbao/adopt-holes.test.ts

@@ -26,7 +26,7 @@ import { BaoMount } from './mount.ts';
 import { BaoPkiRole } from './pki-role.ts';
 
 const REFUSED =
-  /Cannot resume creating resource 'Z'|: already exists, and this stack holds no state/s;
+  /Cannot resume creating resource 'Z'|Cannot adopt resource 'Z'|: already exists, and this stack holds no state/s;
 const RESUME_REFUSED = /already exists, and this stack holds no state.*Deploy with --adopt/s;
 
 /** Writes other than the upstream's. */

package/src/openbao/adopt-recovery.test.ts

@@ -69,3 +69,27 @@ for (const row of FAMILIES.filter((each) => each.family !== 'Bao.MfaTotpMethod')
     });
   });
 }
+
+/**
+ * 🔴 A DESTROY AFTER A CRASHED CREATE MUST STILL DELETE (red team, kit PR 359, 2026-10-06). The
+ * engine's deletion-recovery read (Apply.ts, a row with no attributes) shares alchemy beta.81's
+ * `provider.read` span with the create-time deferred-adoption read. Answering `Unowned` to both
+ * made the engine skip `provider.delete` and erase the row: a live object nothing tracked.
+ */
+/** Bao.JwtAuthConfig's delete writes nothing and Bao.MfaLoginEnforcement's refuses: no object goes. */
+const DELETES_NOTHING = ['Bao.JwtAuthConfig', 'Bao.MfaLoginEnforcement'];
+for (const row of FAMILIES.filter((each) => !DELETES_NOTHING.includes(each.family))) {
+  describe(`${row.family}: a destroy after an interrupted create`, () => {
+    it('deletes the object the crashed create wrote', async () => {
+      await withCrashes((crashNext) => async (stack, estate) => {
+        crashNext();
+        const destroy = RemovalPolicy.destroy;
+        await assert.rejects(stack.deploy(row.declare('X', 'a', '15m', destroy)), /injected/);
+        assert.ok(row.has(estate, 'a'));
+        const declared = row.declare('X', 'a', '15m', destroy);
+        assert.deepEqual(await stack.destroy(declared), { X: 'delete' });
+        assert.ok(!row.has(estate, 'a'), 'the destroy left the object it was asked to delete');
+      });
+    });
+  });
+}

package/src/openbao/approle-login.ts

@@ -18,8 +18,8 @@
  *   consolidation plan; not re-measured here). Give each host its own secret_id.
  */
 import * as Effect from 'effect/Effect';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { BaoEnvironment } from './bao-address.ts';
 import { BaoEnv, baoCall } from './bao-http.ts';
 import type { BaoError } from './bao-status.ts';

package/src/openbao/auth-method-reconcile.ts

@@ -5,7 +5,7 @@
  * to a non-auth path, and `token/` cannot move at all).
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { Claim } from '../ownership/adopt.ts';
 import {
   type BaoAuthMethodAttributes,

package/src/openbao/auth-method.ts

@@ -18,7 +18,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { claimFor } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/auth-role-sdk.test.ts

@@ -5,7 +5,7 @@ import * as RemovalPolicy from 'alchemy/RemovalPolicy';
 import * as Test from 'alchemy/Test/Bun';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
 import { BaoEnv } from './bao-http.ts';
 import { type Reply, fakeBao } from './fake-bao.ts';

package/src/openbao/auth-role.ts

@@ -13,7 +13,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/bao-http.test.ts

@@ -6,9 +6,9 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
 import * as Effect from 'effect/Effect';
-import * as Headers from 'effect/unstable/http/Headers';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
-import * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';
+import * as Headers from 'effect/http/Headers';
+import * as HttpClient from 'effect/http/HttpClient';
+import * as HttpClientResponse from 'effect/http/HttpClientResponse';
 import { BaoEnv, baoDelete, baoRead, baoWrite } from './bao-http.ts';
 import { BaoError } from './bao-status.ts';
 import { fakeBao, run, runFailure, withFake } from './fake-bao.ts';

package/src/openbao/bao-http.ts

@@ -17,10 +17,10 @@ import * as Effect from 'effect/Effect';
 import * as Option from 'effect/Option';
 import * as Schedule from 'effect/Schedule';
 import * as Semaphore from 'effect/Semaphore';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
-import * as Headers from 'effect/unstable/http/Headers';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
-import * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
+import * as Headers from 'effect/http/Headers';
+import * as HttpClient from 'effect/http/HttpClient';
+import * as HttpClientRequest from 'effect/http/HttpClientRequest';
 import { type BaoEnvironment, headersFor, resolveAddress } from './bao-address.ts';
 import { BaoError, type BaoIntent, settle } from './bao-status.ts';
 

package/src/openbao/bao-identity.ts

@@ -32,8 +32,8 @@
  *   point: a standby forwards to the same vault.
  */
 import * as Effect from 'effect/Effect';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { type BaoEnvironment, resolveAddress } from './bao-address.ts';
 import { BaoEnv, baoCall } from './bao-http.ts';
 import { canonicalNamespace, envNamespace, namespaceLabel } from './bao-namespace.ts';

package/src/openbao/cloudflare-permission-groups.ts

@@ -32,7 +32,7 @@
  */
 import * as Context from 'effect/Context';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { baoRead } from './bao-http.ts';
 import type { BaoError } from './bao-status.ts';
 import { groupKey } from './cloudflare-group-scope.ts';

package/src/openbao/cloudflare-role-wire.ts

@@ -3,7 +3,7 @@
  * of `<mount>/roles/<name>`. Split out so each can be tested against fake-bao.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
 import type { BaoError } from './bao-status.ts';
 import { type LiveCloudflareRole, liveRoleOf, rolePath } from './cloudflare-role-form.ts';

package/src/openbao/cloudflare-role.ts

@@ -20,7 +20,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/distilled-retry.test.ts

@@ -1,9 +1,9 @@
 import { expect, test } from 'bun:test';
 import { policiesReadAclPolicy } from '@distilled.cloud/openbao/policies';
 import * as Effect from 'effect/Effect';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
-import { HttpClientError, TransportError } from 'effect/unstable/http/HttpClientError';
-import * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';
+import * as HttpClient from 'effect/http/HttpClient';
+import { HttpClientError, TransportError } from 'effect/http/HttpClientError';
+import * as HttpClientResponse from 'effect/http/HttpClientResponse';
 import { readAuthRole, writeAuthRole } from './auth-role-wire.ts';
 import { BaoEnv } from './bao-http.ts';
 import { BaoError } from './bao-status.ts';

package/src/openbao/distilled.test.ts

@@ -5,9 +5,9 @@ import { join } from 'node:path';
 import { policiesReadAclPolicy, policiesWriteAclPolicy } from '@distilled.cloud/openbao/policies';
 import * as Effect from 'effect/Effect';
 import * as Semaphore from 'effect/Semaphore';
-import * as Headers from 'effect/unstable/http/Headers';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
-import * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';
+import * as Headers from 'effect/http/Headers';
+import * as HttpClient from 'effect/http/HttpClient';
+import * as HttpClientResponse from 'effect/http/HttpClientResponse';
 import { BaoEnv, BaoGate, MAX_IN_FLIGHT, baoRead } from './bao-http.ts';
 import { runBao } from './distilled.ts';
 import { fakeBao, run, runFailure, withFake } from './fake-bao.ts';

package/src/openbao/distilled.ts

@@ -14,8 +14,8 @@ import type * as Duration from 'effect/Duration';
 import * as Effect from 'effect/Effect';
 import * as Redacted from 'effect/Redacted';
 import * as Semaphore from 'effect/Semaphore';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
-import { isHttpClientError } from 'effect/unstable/http/HttpClientError';
+import type * as HttpClient from 'effect/http/HttpClient';
+import { isHttpClientError } from 'effect/http/HttpClientError';
 import { readBaoVariable, resolveAddress } from './bao-address.ts';
 import {
   BAO_TIMEOUT,

package/src/openbao/fake-bao.ts

@@ -7,8 +7,8 @@
  *   BAO_TOKEN in the shell running the tests can never be read or contacted.
  */
 import * as Effect from 'effect/Effect';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { BaoEnvironment } from './bao-address.ts';
 import { BaoEnv } from './bao-http.ts';
 

package/src/openbao/fake-core.ts

@@ -9,7 +9,7 @@
  */
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import type * as Output from 'alchemy/Output';
 import { BaoAuthMethod, BaoAuthMethodProvider } from './auth-method.ts';
 import { BaoAuthRoleProvider } from './auth-role.ts';

package/src/openbao/fake-engines.ts

@@ -10,7 +10,7 @@ import * as Effect from 'effect/Effect';
 import * as FileSystem from 'effect/FileSystem';
 import * as Layer from 'effect/Layer';
 import * as Path from 'effect/Path';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import type { Reply, Seen } from './fake-bao.ts';
 import { parseDuration } from './mount-form.ts';
 import { trimTrailing } from './mount-path.ts';

package/src/openbao/fake-families.ts

@@ -11,7 +11,7 @@ import * as RemovalPolicy from 'alchemy/RemovalPolicy';
 import type * as Output from 'alchemy/Output';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
 import type { Reply, Seen } from './fake-bao.ts';
 import { type Estate, fakeEstate } from './fake-engines-roles.ts';

package/src/openbao/fake-stack.ts

@@ -36,6 +36,11 @@ export type DeployOptions = { readonly adopt?: boolean };
 export interface FakeStack {
   /** Plan, then apply, `body`. Resolves to the plan; rejects with the apply's failure. */
   readonly deploy: (body: StackBody, options?: DeployOptions) => Promise<Planned>;
+  /**
+   * `alchemy destroy` of `body`: the body is still evaluated (its declarations stay in the Stack
+   * service), and the plan is Alchemy's own `Plan.destroy`. Resolves to the plan's actions.
+   */
+  readonly destroy: (body: StackBody) => Promise<Planned>;
 }
 
 type Node = { readonly action: string };
@@ -82,11 +87,14 @@ export const fakeStack = <ROut, E, RIn>(
    *   diff uses to tell reconcile it resumes an interrupted create (ownership/resume.ts).
    * ★ `--adopt` reaches registration, plan and apply alike, as the Alchemist session provides it.
    */
-  const deploy = (body: StackBody, options: DeployOptions = {}) =>
+  const destroying = Alchemy.Plan.destroy as unknown as (
+    compiled: unknown,
+  ) => Effect.Effect<PlanView, unknown, never>;
+  const run = (body: StackBody, options: DeployOptions, planner: typeof plan) =>
     Effect.gen(function* () {
       const compiled = yield* stack(name, { providers, state }, body);
       return yield* Effect.gen(function* () {
-        const planned = yield* plan(compiled);
+        const planned = yield* planner(compiled);
         yield* apply(planned);
         return actionsOf(planned);
       }).pipe(provideFreshArtifactStore, Effect.provide(Layer.succeedContext(compiled.services)));
@@ -99,7 +107,9 @@ export const fakeStack = <ROut, E, RIn>(
     );
 
   return {
-    deploy: (body, options) => Effect.runPromise(deploy(body, options) as Effect.Effect<Planned>),
+    deploy: (body, options) =>
+      Effect.runPromise(run(body, options ?? {}, plan) as Effect.Effect<Planned>),
+    destroy: (body) => Effect.runPromise(run(body, {}, destroying) as Effect.Effect<Planned>),
   };
 };
 

package/src/openbao/jwt-config.ts

@@ -20,7 +20,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { claimFor } from '../ownership/adopt.ts';
 import { provingResumes } from '../ownership/resume.ts';
 import {

package/src/openbao/jwt-role.ts

@@ -22,7 +22,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { claimFor } from '../ownership/adopt.ts';
 import { provingResumes } from '../ownership/resume.ts';
 import { baoDelete } from './bao-http.ts';

package/src/openbao/kubernetes-role.ts

@@ -16,7 +16,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { claimFor } from '../ownership/adopt.ts';
 import { provingResumes } from '../ownership/resume.ts';
 import { baoDelete } from './bao-http.ts';

package/src/openbao/mfa-enforcement.ts

@@ -30,7 +30,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { type Claim, claimFor } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/mfa-totp.ts

@@ -19,7 +19,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { type Claim, claimFor } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/mfa-wire.ts

@@ -25,7 +25,7 @@
  *   (identity/mfa.go:172-183), which HTTP answers 204. So this never writes by id.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { BaoEnv, baoCall, baoDelete, baoRead } from './bao-http.ts';
 import { envNamespace, namespacePath } from './bao-namespace.ts';
 import type { BaoError } from './bao-status.ts';

package/src/openbao/mount-move.ts

@@ -13,7 +13,7 @@
  *   neither, is a refusal — "neither" in particular is exactly the empty-mount failure above.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { BaoError } from './bao-status.ts';
 import { mountPath } from './mount-form.ts';
 import { type RemountError, type RemountOptions, remountAndWait } from './remount-wire.ts';

package/src/openbao/mount-reconcile.ts

@@ -3,7 +3,7 @@
  * refusals) run against a fake server, not only in a reviewer's head.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import {

package/src/openbao/mount.ts

@@ -21,7 +21,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { claimFor } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/pki-role.ts

@@ -42,7 +42,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/plugin-reconcile.ts

@@ -3,7 +3,7 @@
  * be run against a fake server rather than only reasoned about.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import {

package/src/openbao/plugin-wire.ts

@@ -12,7 +12,7 @@
  *   token without it reads as 403, which is an error here, never "absent".
  */
 import type * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
 import type { BaoError } from './bao-status.ts';
 import {

package/src/openbao/plugin.ts

@@ -23,7 +23,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { claimFor } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/policy.ts

@@ -4,7 +4,7 @@ import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import * as FileSystem from 'effect/FileSystem';
 import * as Path from 'effect/Path';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/proxmox-role.ts

@@ -39,7 +39,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/remount-wire.ts

@@ -18,7 +18,7 @@
  * ⛔ POLICIES ARE NOT REWRITTEN. Every ACL path naming the old mount keeps naming it.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { baoCall, baoRead } from './bao-http.ts';
 import type { BaoError } from './bao-status.ts';
 

package/src/openbao/rename-occupied.test.ts

@@ -10,7 +10,7 @@ import * as Output from 'alchemy/Output';
 import * as RemovalPolicy from 'alchemy/RemovalPolicy';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { groupKey } from './cloudflare-group-scope.ts';
 import { CloudflarePermissionGroups } from './cloudflare-permission-groups.ts';
 import { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';

package/src/openbao/role-reconcile.ts

@@ -14,7 +14,7 @@
  *   so the refusal is seen at the next deploy instead of hiding behind a clean plan.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { Claim, Owner } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { baoRead, baoWrite } from './bao-http.ts';

package/src/openbao/role-rename.test.ts

@@ -9,7 +9,7 @@ import * as Output from 'alchemy/Output';
 import * as RemovalPolicy from 'alchemy/RemovalPolicy';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { groupKey } from './cloudflare-group-scope.ts';
 import { CloudflarePermissionGroups } from './cloudflare-permission-groups.ts';
 import { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';

package/src/openbao/ssh-role.ts

@@ -35,7 +35,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/opnsense/fake-opnsense.ts

@@ -11,7 +11,7 @@
  */
 import { type Credentials, credentials } from '@distilled.cloud/opnsense/Credentials';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 
 export const FAKE_BASE = 'https://opnsense.example.com';
 export const FAKE_KEY = 'placeholder-opnsense-key';