@homeflare/alchemy 0.5.0 → 0.6.0

package/dist/launchd/index.js

@@ -0,0 +1,969 @@
+// src/launchd/host-file.ts
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect2 from "effect/Effect";
+
+// src/launchd/host-effect.ts
+import * as Effect from "effect/Effect";
+var lift = (step) => Effect.tryPromise({
+  catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
+  try: step
+});
+var resolvedString = (news, key) => {
+  if (typeof news !== "object" || news === null)
+    return;
+  const value = news[key];
+  return typeof value === "string" ? value : undefined;
+};
+
+// src/launchd/secret-tripwire.ts
+var ALTERNATIVE = "props are stored unencrypted in Alchemy state. Have a secret renderer (e.g. openbao-agent) " + "write it to a root-owned file and declare the file path instead (FOO_FILE=/path, --foo-file /path).";
+var SECRET_NAME = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|API_?KEY|ACCESS_KEY|PRIVATE_KEY|SECRET_KEY|CREDENTIALS?)$/i;
+var INLINE_FLAG = /^--?[a-z0-9-]*(?:token|password|passwd|passphrase|secret|api-?key)=./i;
+var BARE_FLAG = /^--?(?:[a-z0-9]+-)*(?:token|password|passwd|passphrase|secret|api-?key)$/i;
+var PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
+var keyLeaves = (value, path) => {
+  if (typeof value === "string")
+    return PRIVATE_KEY.test(value) ? [path] : [];
+  if (Array.isArray(value)) {
+    return value.flatMap((item, index) => keyLeaves(item, `${path}[${String(index)}]`));
+  }
+  if (typeof value === "object" && value !== null) {
+    return Object.entries(value).flatMap(([key, item]) => keyLeaves(item, `${path}.${key}`));
+  }
+  return [];
+};
+var jobSecretProblems = (environment, argv, extraKeys) => {
+  const found = [];
+  for (const [name, value] of Object.entries(environment ?? {})) {
+    if (SECRET_NAME.test(name))
+      found.push(`environment ${name} looks like a secret: ${ALTERNATIVE}`);
+    else if (PRIVATE_KEY.test(value))
+      found.push(`environment ${name} holds a private key: ${ALTERNATIVE}`);
+  }
+  for (const [index, arg] of argv.entries()) {
+    if (INLINE_FLAG.test(arg)) {
+      found.push(`programArguments[${String(index)}] passes a secret inline: ${ALTERNATIVE}`);
+    } else if (BARE_FLAG.test(arg) && index + 1 < argv.length) {
+      found.push(`programArguments[${String(index + 1)}] follows a secret flag: ${ALTERNATIVE}`);
+    } else if (PRIVATE_KEY.test(arg)) {
+      found.push(`programArguments[${String(index)}] holds a private key: ${ALTERNATIVE}`);
+    }
+  }
+  for (const path of keyLeaves(extraKeys ?? {}, "extraKeys")) {
+    found.push(`${path} holds a private key: ${ALTERNATIVE}`);
+  }
+  return found;
+};
+var fileSecretProblems = (content) => PRIVATE_KEY.test(content) ? [`content holds a private key: ${ALTERNATIVE}`] : [];
+
+// src/launchd/host-file-form.ts
+var DEFAULT_MODE = 420;
+var identityProblems = (name, value) => {
+  if (value === undefined)
+    return [];
+  if (typeof value === "number") {
+    return Number.isSafeInteger(value) && value >= 0 ? [] : [`${name} must be a non-negative integer id`];
+  }
+  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
+};
+var fileProblems = (props) => {
+  const found = [];
+  const { path } = props;
+  if (!path.startsWith("/"))
+    found.push("path must be absolute");
+  if (path.endsWith("/") || path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..")) {
+    found.push('path must be normalised (no trailing slash, no empty, "." or ".." segments)');
+  }
+  if (path.includes("\x00"))
+    found.push("path contains NUL");
+  const mode = props.mode ?? DEFAULT_MODE;
+  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
+    found.push("mode must be 0–0o7777");
+  found.push(...identityProblems("owner", props.owner));
+  found.push(...identityProblems("group", props.group));
+  found.push(...fileSecretProblems(props.content));
+  return found;
+};
+
+// src/launchd/job-form.ts
+import { createHash } from "node:crypto";
+
+// src/launchd/plist.ts
+class PlistError extends Error {
+  path;
+  constructor(path, detail) {
+    super(`plist ${path === "" ? "(root)" : path}: ${detail}`);
+    this.path = path;
+    this.name = "PlistError";
+  }
+}
+var HEADER = `<?xml version="1.0" encoding="UTF-8"?>
+` + '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" ' + `"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+` + `<plist version="1.0">
+`;
+var MAX_DEPTH = 32;
+var FORBIDDEN = /[\x00-\x08\x0B\x0C\x0E-\x1F\uD800-\uDFFF\uFFFE\uFFFF]/u;
+var escapeText = (text, path) => {
+  const bad = FORBIDDEN.exec(text);
+  if (bad !== null) {
+    const code = bad[0].codePointAt(0) ?? 0;
+    throw new PlistError(path, `U+${code.toString(16).toUpperCase().padStart(4, "0")} cannot appear in XML 1.0`);
+  }
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\r", "&#13;");
+};
+var isPlainObject = (value) => {
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var renderValue = (value, path, depth, out) => {
+  const pad = "\t".repeat(depth);
+  if (depth > MAX_DEPTH)
+    throw new PlistError(path, `nested deeper than ${String(MAX_DEPTH)}`);
+  if (typeof value === "string") {
+    out.push(`${pad}<string>${escapeText(value, path)}</string>`);
+    return;
+  }
+  if (typeof value === "boolean") {
+    out.push(`${pad}<${value ? "true" : "false"}/>`);
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value)) {
+      throw new PlistError(path, `${String(value)} is not a safe integer (no <real> support)`);
+    }
+    out.push(`${pad}<integer>${String(value === 0 ? 0 : value)}</integer>`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      out.push(`${pad}<array/>`);
+      return;
+    }
+    out.push(`${pad}<array>`);
+    for (const [index, item] of value.entries()) {
+      renderValue(item, `${path}[${String(index)}]`, depth + 1, out);
+    }
+    out.push(`${pad}</array>`);
+    return;
+  }
+  if (typeof value === "object" && value !== null && isPlainObject(value)) {
+    renderDict(value, path, depth, out);
+    return;
+  }
+  const kind = value === null ? "null" : typeof value;
+  throw new PlistError(path, `${kind} has no plist form — omit the key instead`);
+};
+var renderDict = (dict, path, depth, out) => {
+  const pad = "\t".repeat(depth);
+  const keys = Object.keys(dict).sort();
+  if (keys.length === 0) {
+    out.push(`${pad}<dict/>`);
+    return;
+  }
+  out.push(`${pad}<dict>`);
+  for (const key of keys) {
+    const child = path === "" ? key : `${path}.${key}`;
+    out.push(`${pad}	<key>${escapeText(key, child)}</key>`);
+    renderValue(dict[key], child, depth + 1, out);
+  }
+  out.push(`${pad}</dict>`);
+};
+var renderPlist = (dict) => {
+  if (typeof dict !== "object" || dict === null || Array.isArray(dict) || !isPlainObject(dict)) {
+    throw new PlistError("", "the top level of a launchd plist must be a dict");
+  }
+  const out = [];
+  renderDict(dict, "", 0, out);
+  return `${HEADER}${out.join(`
+`)}
+</plist>
+`;
+};
+
+// src/launchd/job-form.ts
+var parseDomain = (domain) => {
+  if (domain === "system")
+    return { kind: "system" };
+  const match = /^gui\/(\d+)$/.exec(domain);
+  return match?.[1] === undefined ? undefined : { kind: "gui", uid: Number(match[1]) };
+};
+var serviceTarget = (label, domain) => `${domain}/${label}`;
+var plistPathFor = (label, domain, home) => {
+  if (domain.kind === "system")
+    return `/Library/LaunchDaemons/${label}.plist`;
+  if (home === undefined || !home.startsWith("/")) {
+    throw new Error(`gui/${String(domain.uid)}: no home directory for that uid on this host`);
+  }
+  return `${home}/Library/LaunchAgents/${label}.plist`;
+};
+var OWNED_KEYS = [
+  "EnvironmentVariables",
+  "GroupName",
+  "KeepAlive",
+  "Label",
+  "Program",
+  "ProgramArguments",
+  "RunAtLoad",
+  "StandardErrorPath",
+  "StandardOutPath",
+  "StartCalendarInterval",
+  "StartInterval",
+  "ThrottleInterval",
+  "UserName",
+  "WorkingDirectory"
+];
+var calendarDict = (entry) => {
+  const dict = {};
+  if (entry.minute !== undefined)
+    dict["Minute"] = entry.minute;
+  if (entry.hour !== undefined)
+    dict["Hour"] = entry.hour;
+  if (entry.day !== undefined)
+    dict["Day"] = entry.day;
+  if (entry.weekday !== undefined)
+    dict["Weekday"] = entry.weekday;
+  if (entry.month !== undefined)
+    dict["Month"] = entry.month;
+  return dict;
+};
+var keepAliveValue = (keepAlive) => {
+  if (typeof keepAlive === "boolean")
+    return keepAlive;
+  const dict = {};
+  if (keepAlive.successfulExit !== undefined)
+    dict["SuccessfulExit"] = keepAlive.successfulExit;
+  if (keepAlive.crashed !== undefined)
+    dict["Crashed"] = keepAlive.crashed;
+  return dict;
+};
+var jobPlistDict = (props) => {
+  const dict = { ...props.extraKeys };
+  dict["Label"] = props.label;
+  dict["ProgramArguments"] = [...props.programArguments];
+  const env = props.environment ?? {};
+  if (Object.keys(env).length > 0)
+    dict["EnvironmentVariables"] = { ...env };
+  if (props.runAtLoad !== undefined)
+    dict["RunAtLoad"] = props.runAtLoad;
+  if (props.keepAlive !== undefined)
+    dict["KeepAlive"] = keepAliveValue(props.keepAlive);
+  if (props.startInterval !== undefined)
+    dict["StartInterval"] = props.startInterval;
+  const calendar = props.startCalendarInterval;
+  if (calendar !== undefined) {
+    dict["StartCalendarInterval"] = Array.isArray(calendar) ? calendar.map(calendarDict) : calendarDict(calendar);
+  }
+  if (props.throttleInterval !== undefined)
+    dict["ThrottleInterval"] = props.throttleInterval;
+  if (props.standardOutPath !== undefined)
+    dict["StandardOutPath"] = props.standardOutPath;
+  if (props.standardErrorPath !== undefined)
+    dict["StandardErrorPath"] = props.standardErrorPath;
+  if (props.workingDirectory !== undefined)
+    dict["WorkingDirectory"] = props.workingDirectory;
+  if (props.userName !== undefined)
+    dict["UserName"] = props.userName;
+  if (props.groupName !== undefined)
+    dict["GroupName"] = props.groupName;
+  return dict;
+};
+var sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
+var renderJob = (props) => {
+  const text = renderPlist(jobPlistDict(props));
+  const bytes = new TextEncoder().encode(text);
+  return { bytes, sha256: sha256Hex(bytes), text };
+};
+
+// src/launchd/runner.ts
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+
+class HostRunnerService extends Context.Service()("homeflare/launchd/HostRunner") {
+}
+var hostRunnerLayer = (runner) => Layer.succeed(HostRunnerService, runner);
+var canActAsRoot = (runner) => runner.privileged || runner.effectiveUid() === 0;
+
+// src/launchd/host-file-lifecycle.ts
+var refuse = (path, message) => new Error(`Host.File ${path}: ${message}`);
+var numericId = (value) => typeof value === "number" ? value : /^\d+$/.test(value) ? Number(value) : undefined;
+var desiredFile = async (runner, props) => {
+  const found = fileProblems(props);
+  if (found.length > 0)
+    throw refuse(props.path, found.join("; "));
+  const bytes = new TextEncoder().encode(props.content);
+  let uid;
+  let gid;
+  if (props.owner !== undefined) {
+    uid = numericId(props.owner) ?? (await runner.lookupUser(String(props.owner)))?.uid;
+    if (uid === undefined)
+      throw refuse(props.path, `no user ${String(props.owner)} on this host`);
+  }
+  if (props.group !== undefined) {
+    gid = numericId(props.group) ?? await runner.lookupGroup(String(props.group));
+    if (gid === undefined)
+      throw refuse(props.path, `no group ${String(props.group)} on this host`);
+  }
+  return {
+    bytes,
+    mode: props.mode ?? DEFAULT_MODE,
+    sha256: sha256Hex(bytes),
+    ...uid === undefined ? {} : { uid },
+    ...gid === undefined ? {} : { gid }
+  };
+};
+var readFileAttributes = async (runner, path) => {
+  const stat = await runner.stat(path);
+  if (stat === undefined)
+    return;
+  const bytes = stat.kind === "file" ? await runner.readFile(path) : undefined;
+  return {
+    gid: stat.gid,
+    mode: stat.mode,
+    path,
+    sha256: bytes === undefined ? "" : sha256Hex(bytes),
+    size: stat.size,
+    uid: stat.uid
+  };
+};
+var matches = (live, want) => live.sha256 === want.sha256 && live.mode === want.mode && (want.uid === undefined || live.uid === want.uid) && (want.gid === undefined || live.gid === want.gid);
+var diffFile = async (runner, news, output) => {
+  if (news.path !== output.path)
+    return { action: "replace" };
+  const want = await desiredFile(runner, news);
+  if (want.sha256 !== output.sha256)
+    return { action: "update" };
+  const live = await readFileAttributes(runner, news.path);
+  return live !== undefined && matches(live, want) ? { action: "noop" } : { action: "update" };
+};
+var reconcileFile = async (runner, props, output) => {
+  const want = await desiredFile(runner, props);
+  if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {
+    throw refuse(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy as root ` + "or through a privileged HostRunner (privileged: true). This provider never calls sudo.");
+  }
+  const stat = await runner.stat(props.path);
+  if (stat !== undefined && stat.kind !== "file") {
+    throw refuse(props.path, `is a ${stat.kind}; remove it from whatever owns it before declaring it here`);
+  }
+  const before = stat === undefined ? undefined : await readFileAttributes(runner, props.path);
+  const moved = output !== undefined && output.path !== props.path;
+  const prior = moved ? undefined : output;
+  if (prior === undefined && before !== undefined && !matches(before, want)) {
+    throw refuse(props.path, "already exists and is not this resource. Remove it, or declare it as a new resource and " + "deploy with --adopt.");
+  }
+  if (before === undefined || !matches(before, want)) {
+    await runner.writeFileAtomic(props.path, want.bytes, {
+      mode: want.mode,
+      ...want.uid === undefined ? {} : { uid: want.uid },
+      ...want.gid === undefined ? {} : { gid: want.gid }
+    });
+  }
+  const after = await readFileAttributes(runner, props.path);
+  if (after === undefined || !matches(after, want)) {
+    if (before === undefined)
+      await runner.removeFile(props.path).catch(() => {
+        return;
+      });
+    throw refuse(props.path, "the write returned but the file on disk does not match the declaration");
+  }
+  if (moved)
+    await deleteFile(runner, output);
+  return after;
+};
+var deleteFile = async (runner, output) => {
+  const stat = await runner.stat(output.path);
+  if (stat === undefined)
+    return;
+  if (stat.kind !== "file")
+    throw refuse(output.path, `is now a ${stat.kind}; not removing it`);
+  await runner.removeFile(output.path);
+};
+
+// src/launchd/host-file.ts
+var HostFile = Resource("Host.File");
+var HostFileProvider = () => Provider.effect(HostFile, Effect2.gen(function* () {
+  const runner = yield* HostRunnerService;
+  return HostFile.Provider.of({
+    list: () => Effect2.succeed([]),
+    read: ({ olds, output }) => lift(async () => {
+      const found = await readFileAttributes(runner, olds.path);
+      if (found === undefined)
+        return;
+      return output === undefined ? Unowned(found) : found;
+    }),
+    diff: ({ news, output }) => {
+      if (output === undefined)
+        return Effect2.succeed(undefined);
+      if (isResolved(news))
+        return lift(() => diffFile(runner, news, output));
+      const path = resolvedString(news, "path");
+      return Effect2.succeed(path !== undefined && path !== output.path ? { action: "replace" } : undefined);
+    },
+    reconcile: ({ news, output }) => lift(() => reconcileFile(runner, news, output)),
+    delete: ({ output }) => lift(() => deleteFile(runner, output))
+  });
+}));
+// src/launchd/job.ts
+import { Resource as Resource2 } from "alchemy";
+import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved2 } from "alchemy/Diff";
+import * as Provider2 from "alchemy/Provider";
+import * as Effect3 from "effect/Effect";
+
+// src/launchd/job-validate.ts
+var LABEL = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
+var RESERVED_LABEL_PREFIXES = [
+  "org.nixos.",
+  "com.apple.",
+  "homebrew.mxcl."
+];
+var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var RANGES = [
+  ["minute", 0, 59],
+  ["hour", 0, 23],
+  ["day", 1, 31],
+  ["weekday", 0, 7],
+  ["month", 1, 12]
+];
+var isInt = (value, min, max = Number.MAX_SAFE_INTEGER) => Number.isSafeInteger(value) && value >= min && value <= max;
+var calendarProblems = (entries) => {
+  if (entries.length === 0)
+    return ["startCalendarInterval is an empty list; omit it instead"];
+  const found = [];
+  for (const [index, entry] of entries.entries()) {
+    for (const [field, min, max] of RANGES) {
+      const value = entry[field];
+      if (value !== undefined && !isInt(value, min, max)) {
+        found.push(`startCalendarInterval[${String(index)}].${field} must be ${String(min)}–${String(max)}`);
+      }
+    }
+  }
+  return found;
+};
+var absolute = (name, value) => value === undefined || value.startsWith("/") ? [] : [`${name} must be an absolute path`];
+var identityProblems2 = (label, domainText) => {
+  const found = [];
+  if (!LABEL.test(label)) {
+    found.push("label must be 1–200 of [A-Za-z0-9._-], starting with a letter or digit");
+  }
+  const reserved = RESERVED_LABEL_PREFIXES.find((prefix) => label.startsWith(prefix));
+  if (reserved !== undefined) {
+    found.push(`label ${label} is under ${reserved}, which another tool owns; declare a new label`);
+  }
+  if (parseDomain(domainText) === undefined)
+    found.push(`domain must be 'system' or 'gui/<uid>', not ${domainText}`);
+  return found;
+};
+var jobProblems = (props) => {
+  const found = identityProblems2(props.label, props.domain);
+  const domain = parseDomain(props.domain);
+  const [program] = props.programArguments;
+  if (program === undefined)
+    found.push("programArguments must name a program");
+  else if (!program.startsWith("/"))
+    found.push("programArguments[0] must be an absolute path");
+  for (const name of Object.keys(props.environment ?? {})) {
+    if (!ENV_NAME.test(name))
+      found.push(`environment name ${JSON.stringify(name)} is not a valid variable name`);
+  }
+  found.push(...jobSecretProblems(props.environment, props.programArguments, props.extraKeys));
+  if (props.startInterval !== undefined && !isInt(props.startInterval, 1)) {
+    found.push("startInterval must be a positive whole number of seconds");
+  }
+  if (props.throttleInterval !== undefined && !isInt(props.throttleInterval, 0)) {
+    found.push("throttleInterval must be a non-negative whole number of seconds");
+  }
+  const calendar = props.startCalendarInterval;
+  if (calendar !== undefined) {
+    found.push(...calendarProblems(Array.isArray(calendar) ? calendar : [calendar]));
+  }
+  const keepAlive = props.keepAlive;
+  if (typeof keepAlive === "object" && keepAlive.successfulExit === undefined && keepAlive.crashed === undefined) {
+    found.push("keepAlive {} names no condition; use true, false, or a condition");
+  }
+  found.push(...absolute("standardOutPath", props.standardOutPath));
+  found.push(...absolute("standardErrorPath", props.standardErrorPath));
+  found.push(...absolute("workingDirectory", props.workingDirectory));
+  if (domain?.kind === "gui" && (props.userName !== undefined || props.groupName !== undefined)) {
+    found.push("userName/groupName apply only to the system domain; launchd ignores them for agents");
+  }
+  for (const key of Object.keys(props.extraKeys ?? {})) {
+    if (OWNED_KEYS.includes(key))
+      found.push(`extraKeys.${key} is owned by a typed prop; use that instead`);
+  }
+  return found;
+};
+
+// src/launchd/launchctl.ts
+var LAUNCHCTL = "/bin/launchctl";
+var NOT_FOUND = 113;
+var NO_DOMAIN = 112;
+var NO_DOMAIN_TEXT = "Could not find domain";
+
+class LaunchctlError extends Error {
+  constructor(command, exitCode, stderr) {
+    super(`launchctl ${command} -> ${String(exitCode)}: ${stderr.trim().slice(0, 300)}`);
+    this.name = "LaunchctlError";
+  }
+}
+var printFields = (stdout) => {
+  const fields = new Map;
+  const closers = [];
+  for (const line of stdout.split(`
+`)) {
+    if (closers.length === 0) {
+      if (fields.size === 0 && line.endsWith(" = {"))
+        closers.push("}");
+      continue;
+    }
+    if (line === closers[closers.length - 1]) {
+      closers.pop();
+      continue;
+    }
+    const opened = /^(\t+)\S.* = \{$/.exec(line);
+    if (opened?.[1] !== undefined && opened[1].length === closers.length) {
+      closers.push(`${opened[1]}}`);
+      continue;
+    }
+    const field = closers.length === 1 ? /^\t([a-z][a-z ]*[a-z]) = (.*)$/.exec(line) : null;
+    if (field?.[1] !== undefined && field[2] !== undefined && !fields.has(field[1])) {
+      fields.set(field[1], field[2]);
+    }
+  }
+  return fields;
+};
+var leadingInt = (text) => {
+  const match = text === undefined ? null : /^(-?\d+)/.exec(text);
+  return match?.[1] === undefined ? undefined : Number(match[1]);
+};
+var parsePrint = (stdout) => {
+  const fields = printFields(stdout);
+  const state = fields.get("state");
+  const pid = leadingInt(fields.get("pid"));
+  const lastExitCode = leadingInt(fields.get("last exit code"));
+  return {
+    loaded: true,
+    ...state === undefined ? {} : { state },
+    ...pid === undefined ? {} : { pid },
+    ...lastExitCode === undefined ? {} : { lastExitCode }
+  };
+};
+var parseDisabled = (stdout) => {
+  const disabled = new Set;
+  for (const match of stdout.matchAll(/^\s*"([^"]+)" => (\w+)\s*$/gm)) {
+    if (match[1] !== undefined && (match[2] === "disabled" || match[2] === "true")) {
+      disabled.add(match[1]);
+    }
+  }
+  return disabled;
+};
+var printService = async (runner, target) => {
+  const result = await runner.exec([LAUNCHCTL, "print", target]);
+  if (result.exitCode === NOT_FOUND)
+    return { loaded: false };
+  if (result.exitCode === NO_DOMAIN && result.stderr.includes(NO_DOMAIN_TEXT)) {
+    return { domainMissing: true, loaded: false };
+  }
+  if (result.exitCode !== 0)
+    throw new LaunchctlError(`print ${target}`, result.exitCode, result.stderr);
+  return parsePrint(result.stdout);
+};
+var isDisabled = async (runner, domain, label) => {
+  const result = await runner.exec([LAUNCHCTL, "print-disabled", domain]);
+  if (result.exitCode !== 0) {
+    throw new LaunchctlError(`print-disabled ${domain}`, result.exitCode, result.stderr);
+  }
+  return parseDisabled(result.stdout).has(label);
+};
+var bootstrap = async (runner, domain, plistPath) => {
+  const result = await runner.exec([LAUNCHCTL, "bootstrap", domain, plistPath]);
+  if (result.exitCode !== 0) {
+    throw new LaunchctlError(`bootstrap ${domain} ${plistPath}`, result.exitCode, result.stderr);
+  }
+};
+var waitUnloaded = async (runner, target, attempts = 120, intervalMs = 250) => {
+  for (let attempt = 0;attempt < attempts; attempt += 1) {
+    if (!(await printService(runner, target)).loaded)
+      return;
+    await runner.sleep(intervalMs);
+  }
+  throw new Error(`${target} is still loaded ${String(attempts * intervalMs / 1000)}s after bootout`);
+};
+var bootoutIfLoaded = async (runner, target) => {
+  if (!(await printService(runner, target)).loaded)
+    return;
+  const result = await runner.exec([LAUNCHCTL, "bootout", target]);
+  try {
+    await waitUnloaded(runner, target);
+  } catch (cause) {
+    if (result.exitCode === 0)
+      throw cause;
+    throw new LaunchctlError(`bootout ${target}`, result.exitCode, `${result.stderr.trim()} (and still loaded after waiting)`);
+  }
+};
+
+// src/launchd/job-preflight.ts
+var refuse2 = (label, message) => new Error(`Launchd.Job ${label}: ${message}`);
+var assertValid = (props) => {
+  const found = jobProblems(props);
+  if (found.length > 0)
+    throw refuse2(props.label, found.join("; "));
+};
+var locate = async (runner, props) => {
+  const domain = parseDomain(props.domain);
+  if (domain === undefined)
+    throw refuse2(props.label, `unknown domain ${props.domain}`);
+  const home = domain.kind === "gui" ? (await runner.lookupUser(String(domain.uid)))?.home : undefined;
+  return {
+    domain,
+    plistPath: plistPathFor(props.label, domain, home),
+    target: serviceTarget(props.label, props.domain)
+  };
+};
+var assertMayWrite = (runner, label, domain) => {
+  if (canActAsRoot(runner))
+    return;
+  if (domain.kind === "system") {
+    throw refuse2(label, "the system domain needs root. Run the deploy as root, or provide a HostRunner that is " + "deliberately privileged (privileged: true). This provider never calls sudo.");
+  }
+  if (domain.uid !== runner.effectiveUid()) {
+    throw refuse2(label, `gui/${String(domain.uid)} belongs to another user; only root may write it. ` + "Deploy as that user, as root, or through a privileged HostRunner.");
+  }
+};
+var preflight = async (runner, props) => {
+  const location = await locate(runner, props);
+  assertMayWrite(runner, props.label, location.domain);
+  const status = await printService(runner, location.target);
+  if (status.domainMissing === true) {
+    throw refuse2(props.label, `${props.domain} does not exist: that user has no login session, and launchd creates a gui ` + "domain only at login. Log the user in (or declare a system-domain job with userName), " + "then redeploy. Nothing was written.");
+  }
+  if (await isDisabled(runner, props.domain, props.label)) {
+    throw refuse2(props.label, `${location.target} is disabled (launchctl print-disabled ${props.domain}). ` + `If that is stale, run \`launchctl enable ${location.target}\` deliberately, then redeploy.`);
+  }
+  return { location, status };
+};
+var assertUnclaimed = async (runner, label, location, status, renderedSha256) => {
+  const bytes = await runner.readFile(location.plistPath);
+  const foreignFile = bytes !== undefined && sha256Hex(bytes) !== renderedSha256;
+  if (foreignFile || bytes === undefined && status.loaded) {
+    throw refuse2(label, `${location.target} is already on this host (${foreignFile ? location.plistPath : "loaded"})` + " and is not this resource. Remove it, or declare it as a new resource and deploy with " + "--adopt.");
+  }
+};
+var assertReplaceable = async (runner, next, full, old, renderedSha256) => {
+  const found = full === undefined ? identityProblems2(next.label, next.domain) : jobProblems(full);
+  if (found.length > 0)
+    throw refuse2(next.label, found.join("; "));
+  const oldDomain = parseDomain(old.domain);
+  if (oldDomain === undefined)
+    throw refuse2(old.label, `unknown domain ${old.domain}`);
+  assertMayWrite(runner, old.label, oldDomain);
+  const { location, status } = await preflight(runner, next);
+  await assertUnclaimed(runner, next.label, location, status, renderedSha256);
+};
+
+// src/launchd/job-lifecycle.ts
+var attributesOf = (props, location, plistSha256, status) => ({
+  domain: props.domain,
+  label: props.label,
+  loaded: status.loaded,
+  plistPath: location.plistPath,
+  plistSha256,
+  serviceTarget: location.target,
+  ...status.state === undefined ? {} : { state: status.state },
+  ...status.pid === undefined ? {} : { pid: status.pid },
+  ...status.lastExitCode === undefined ? {} : { lastExitCode: status.lastExitCode }
+});
+var readJob = async (runner, props) => {
+  const location = await locate(runner, props);
+  const bytes = await runner.readFile(location.plistPath);
+  const status = await printService(runner, location.target);
+  if (bytes === undefined && !status.loaded)
+    return;
+  return attributesOf(props, location, bytes === undefined ? "" : sha256Hex(bytes), status);
+};
+var replaceDiff = async (runner, next, full, output) => {
+  if (full !== undefined)
+    assertValid(full);
+  const rendered = full === undefined ? undefined : renderJob(full).sha256;
+  await assertReplaceable(runner, next, full, output, rendered);
+  return { action: "replace", deleteFirst: true };
+};
+var diffJob = async (runner, news, output) => {
+  if (news.label !== output.label || news.domain !== output.domain) {
+    return replaceDiff(runner, news, news, output);
+  }
+  assertValid(news);
+  const desired = renderJob(news).sha256;
+  if (desired !== output.plistSha256)
+    return { action: "update" };
+  const live = await readJob(runner, news);
+  if (live === undefined || !live.loaded || live.plistSha256 !== desired)
+    return { action: "update" };
+  return { action: "noop" };
+};
+var reconcileJob = async (runner, props, output) => {
+  assertValid(props);
+  const { location, status } = await preflight(runner, props);
+  const rendered = renderJob(props);
+  const renamed = output !== undefined && (output.label !== props.label || output.domain !== props.domain);
+  const prior = renamed ? undefined : output;
+  if (prior === undefined) {
+    await assertUnclaimed(runner, props.label, location, status, rendered.sha256);
+  }
+  if (renamed)
+    await deleteJob(runner, output);
+  const before = await runner.readFile(location.plistPath);
+  if (status.loaded && before !== undefined && sha256Hex(before) === rendered.sha256 && prior?.plistSha256 === rendered.sha256) {
+    return attributesOf(props, location, rendered.sha256, status);
+  }
+  await runner.writeFileAtomic(location.plistPath, rendered.bytes, location.domain.kind === "system" ? { gid: 0, mode: 420, uid: 0 } : { mode: 420, uid: location.domain.uid });
+  await bootoutIfLoaded(runner, location.target);
+  const failed = async (detail) => {
+    const removed = before === undefined && await runner.removeFile(location.plistPath).then(() => true, () => false);
+    throw refuse2(props.label, removed ? `bootstrap failed, so the job is NOT RUNNING; the plist this deploy wrote was removed ` + `again, so the next deploy starts clean. ${detail}` : `bootstrap failed, so the job is NOT RUNNING; the new plist is at ${location.plistPath} ` + `and the next deploy retries. ${detail}`);
+  };
+  try {
+    await bootstrap(runner, props.domain, location.plistPath);
+  } catch (cause) {
+    return failed(cause instanceof Error ? cause.message : String(cause));
+  }
+  const after = await printService(runner, location.target);
+  if (!after.loaded)
+    return failed("bootstrap exited 0 but launchctl print cannot find the job");
+  return attributesOf(props, location, rendered.sha256, after);
+};
+var deleteJob = async (runner, output) => {
+  const domain = parseDomain(output.domain);
+  if (domain === undefined)
+    throw refuse2(output.label, `unknown domain ${output.domain}`);
+  assertMayWrite(runner, output.label, domain);
+  await bootoutIfLoaded(runner, output.serviceTarget);
+  await runner.removeFile(output.plistPath);
+};
+
+// src/launchd/job.ts
+var LaunchdJob = Resource2("Launchd.Job");
+var LaunchdJobProvider = () => Provider2.effect(LaunchdJob, Effect3.gen(function* () {
+  const runner = yield* HostRunnerService;
+  return LaunchdJob.Provider.of({
+    list: () => Effect3.succeed([]),
+    read: ({ olds, output }) => lift(async () => {
+      const found = await readJob(runner, olds);
+      if (found === undefined)
+        return;
+      return output === undefined ? Unowned2(found) : found;
+    }),
+    diff: ({ news, output }) => {
+      if (output === undefined)
+        return Effect3.succeed(undefined);
+      if (isResolved2(news))
+        return lift(() => diffJob(runner, news, output));
+      const label = resolvedString(news, "label");
+      const domain = resolvedString(news, "domain");
+      return label !== undefined && domain !== undefined && (label !== output.label || domain !== output.domain) ? lift(() => replaceDiff(runner, { domain, label }, undefined, output)) : Effect3.succeed(undefined);
+    },
+    reconcile: ({ news, output }) => lift(() => reconcileJob(runner, news, output)),
+    delete: ({ output }) => lift(() => deleteJob(runner, output))
+  });
+}));
+// src/launchd/local-runner.ts
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { lstat, open, readFile, rename, unlink } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+
+// src/launchd/host-lookup.ts
+var NUMERIC = /^\d+$/;
+var userQuery = (platform, nameOrId) => platform === "darwin" ? [
+  "/usr/bin/dscacheutil",
+  "-q",
+  "user",
+  "-a",
+  NUMERIC.test(nameOrId) ? "uid" : "name",
+  nameOrId
+] : ["getent", "passwd", nameOrId];
+var groupQuery = (platform, nameOrId) => platform === "darwin" ? [
+  "/usr/bin/dscacheutil",
+  "-q",
+  "group",
+  "-a",
+  NUMERIC.test(nameOrId) ? "gid" : "name",
+  nameOrId
+] : ["getent", "group", nameOrId];
+var firstRecord = (stdout) => {
+  const fields = new Map;
+  for (const line of stdout.split(`
+`)) {
+    if (line.trim() === "") {
+      if (fields.size > 0)
+        break;
+      continue;
+    }
+    const at = line.indexOf(": ");
+    if (at <= 0)
+      continue;
+    const key = line.slice(0, at);
+    if (key === "password")
+      continue;
+    fields.set(key, line.slice(at + 2).trim());
+  }
+  return fields;
+};
+var toId = (text) => text !== undefined && NUMERIC.test(text) ? Number(text) : undefined;
+var parseUser = (platform, stdout) => {
+  if (platform === "darwin") {
+    const record = firstRecord(stdout);
+    const uid2 = toId(record.get("uid"));
+    const gid2 = toId(record.get("gid"));
+    const home2 = record.get("dir");
+    return uid2 === undefined || gid2 === undefined || home2 === undefined ? undefined : { gid: gid2, home: home2, uid: uid2 };
+  }
+  const fields = (stdout.split(`
+`)[0] ?? "").split(":");
+  const uid = toId(fields[2]);
+  const gid = toId(fields[3]);
+  const home = fields[5];
+  return uid === undefined || gid === undefined || home === undefined || home === "" ? undefined : { gid, home, uid };
+};
+var parseGroup = (platform, stdout) => {
+  if (platform === "darwin")
+    return toId(firstRecord(stdout).get("gid"));
+  return toId((stdout.split(`
+`)[0] ?? "").split(":")[2]);
+};
+
+// src/launchd/local-runner.ts
+var code = (cause) => typeof cause === "object" && cause !== null && ("code" in cause) ? String(cause.code) : undefined;
+var absent = (cause) => code(cause) === "ENOENT" || code(cause) === "ENOTDIR";
+var run = (argv, timeoutMs) => new Promise((resolve, reject) => {
+  const [program, ...args] = argv;
+  if (program === undefined) {
+    reject(new Error("exec: empty argv"));
+    return;
+  }
+  const child = spawn(program, args, {
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: timeoutMs
+  });
+  const out = [];
+  const err = [];
+  child.stdout.on("data", (chunk) => out.push(chunk));
+  child.stderr.on("data", (chunk) => err.push(chunk));
+  child.on("error", (cause) => {
+    reject(new Error(`exec ${program}: ${cause.message}`));
+  });
+  child.on("close", (exitCode, signal) => {
+    const stderr = Buffer.concat(err).toString("utf8");
+    resolve({
+      exitCode: exitCode ?? -1,
+      stderr: signal === null ? stderr : `${stderr}
+(killed by ${signal})`.trim(),
+      stdout: Buffer.concat(out).toString("utf8")
+    });
+  });
+});
+var kindOf = (stats) => {
+  if (stats.isSymbolicLink())
+    return "symlink";
+  if (stats.isFile())
+    return "file";
+  if (stats.isDirectory())
+    return "directory";
+  return "other";
+};
+var writeAtomic = async (path, bytes, options) => {
+  const temp = join(dirname(path), `.${basename(path)}.${randomBytes(6).toString("hex")}.tmp`);
+  const handle = await open(temp, "wx", 384);
+  try {
+    try {
+      await handle.writeFile(bytes);
+      if (options.uid !== undefined || options.gid !== undefined) {
+        await handle.chown(options.uid ?? -1, options.gid ?? -1);
+      }
+      await handle.chmod(options.mode);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await rename(temp, path);
+  } catch (cause) {
+    await unlink(temp).catch(() => {
+      return;
+    });
+    throw cause;
+  }
+};
+var localRunner = (options = {}) => {
+  const timeoutMs = options.execTimeoutMs ?? 120000;
+  const platform = process.platform;
+  return {
+    effectiveUid: () => process.geteuid?.() ?? -1,
+    exec: (argv) => run(argv, timeoutMs),
+    lookupGroup: async (nameOrId) => {
+      const result = await run(groupQuery(platform, nameOrId), timeoutMs);
+      return result.exitCode === 0 ? parseGroup(platform, result.stdout) : undefined;
+    },
+    lookupUser: async (nameOrId) => {
+      const result = await run(userQuery(platform, nameOrId), timeoutMs);
+      return result.exitCode === 0 ? parseUser(platform, result.stdout) : undefined;
+    },
+    privileged: false,
+    readFile: async (path) => {
+      try {
+        return new Uint8Array(await readFile(path));
+      } catch (cause) {
+        if (absent(cause))
+          return;
+        throw cause;
+      }
+    },
+    removeFile: async (path) => {
+      try {
+        await unlink(path);
+      } catch (cause) {
+        if (!absent(cause))
+          throw cause;
+      }
+    },
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    stat: async (path) => {
+      try {
+        const stats = await lstat(path);
+        return {
+          gid: stats.gid,
+          kind: kindOf(stats),
+          mode: stats.mode & 4095,
+          size: stats.size,
+          uid: stats.uid
+        };
+      } catch (cause) {
+        if (absent(cause))
+          return;
+        throw cause;
+      }
+    },
+    writeFileAtomic: writeAtomic
+  };
+};
+// src/launchd/providers.ts
+import * as Layer2 from "effect/Layer";
+var launchdProviders = (runner = localRunner()) => Layer2.mergeAll(LaunchdJobProvider(), HostFileProvider()).pipe(Layer2.provide(hostRunnerLayer(runner)));
+export {
+  HostFile,
+  HostFileProvider,
+  HostRunnerService,
+  LaunchdJob,
+  LaunchdJobProvider,
+  PlistError,
+  canActAsRoot,
+  hostRunnerLayer,
+  launchdProviders,
+  localRunner,
+  renderPlist
+};
+
+//# debugId=86750D103F13F7F764756E2164756E21
+//# sourceMappingURL=index.js.map