@homeflare/alchemy 0.5.0 → 0.7.0

package/dist/caddy/index.js

@@ -0,0 +1,912 @@
+// src/caddy/admin.ts
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+
+class CaddyUnreachableError extends Error {
+  name = "CaddyUnreachableError";
+}
+
+class CaddyAdminService extends Context.Service()("homeflare/caddy/CaddyAdmin") {
+}
+var caddyAdminLayer = (admin) => Layer.succeed(CaddyAdminService, admin);
+// src/launchd/job-form.ts
+import { createHash } from "node:crypto";
+
+// src/launchd/plist.ts
+class PlistError extends Error {
+  path;
+  constructor(path, detail) {
+    super(`plist ${path === "" ? "(root)" : path}: ${detail}`);
+    this.path = path;
+    this.name = "PlistError";
+  }
+}
+var HEADER = `<?xml version="1.0" encoding="UTF-8"?>
+` + '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" ' + `"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+` + `<plist version="1.0">
+`;
+var MAX_DEPTH = 32;
+var FORBIDDEN = /[\x00-\x08\x0B\x0C\x0E-\x1F\uD800-\uDFFF\uFFFE\uFFFF]/u;
+var escapeText = (text, path) => {
+  const bad = FORBIDDEN.exec(text);
+  if (bad !== null) {
+    const code = bad[0].codePointAt(0) ?? 0;
+    throw new PlistError(path, `U+${code.toString(16).toUpperCase().padStart(4, "0")} cannot appear in XML 1.0`);
+  }
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\r", "&#13;");
+};
+var isPlainObject = (value) => {
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var renderValue = (value, path, depth, out) => {
+  const pad = "\t".repeat(depth);
+  if (depth > MAX_DEPTH)
+    throw new PlistError(path, `nested deeper than ${String(MAX_DEPTH)}`);
+  if (typeof value === "string") {
+    out.push(`${pad}<string>${escapeText(value, path)}</string>`);
+    return;
+  }
+  if (typeof value === "boolean") {
+    out.push(`${pad}<${value ? "true" : "false"}/>`);
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value)) {
+      throw new PlistError(path, `${String(value)} is not a safe integer (no <real> support)`);
+    }
+    out.push(`${pad}<integer>${String(value === 0 ? 0 : value)}</integer>`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      out.push(`${pad}<array/>`);
+      return;
+    }
+    out.push(`${pad}<array>`);
+    for (const [index, item] of value.entries()) {
+      renderValue(item, `${path}[${String(index)}]`, depth + 1, out);
+    }
+    out.push(`${pad}</array>`);
+    return;
+  }
+  if (typeof value === "object" && value !== null && isPlainObject(value)) {
+    renderDict(value, path, depth, out);
+    return;
+  }
+  const kind = value === null ? "null" : typeof value;
+  throw new PlistError(path, `${kind} has no plist form — omit the key instead`);
+};
+var renderDict = (dict, path, depth, out) => {
+  const pad = "\t".repeat(depth);
+  const keys = Object.keys(dict).sort();
+  if (keys.length === 0) {
+    out.push(`${pad}<dict/>`);
+    return;
+  }
+  out.push(`${pad}<dict>`);
+  for (const key of keys) {
+    const child = path === "" ? key : `${path}.${key}`;
+    out.push(`${pad}	<key>${escapeText(key, child)}</key>`);
+    renderValue(dict[key], child, depth + 1, out);
+  }
+  out.push(`${pad}</dict>`);
+};
+var renderPlist = (dict) => {
+  if (typeof dict !== "object" || dict === null || Array.isArray(dict) || !isPlainObject(dict)) {
+    throw new PlistError("", "the top level of a launchd plist must be a dict");
+  }
+  const out = [];
+  renderDict(dict, "", 0, out);
+  return `${HEADER}${out.join(`
+`)}
+</plist>
+`;
+};
+
+// src/launchd/job-form.ts
+var parseDomain = (domain) => {
+  if (domain === "system")
+    return { kind: "system" };
+  const match = /^gui\/(\d+)$/.exec(domain);
+  return match?.[1] === undefined ? undefined : { kind: "gui", uid: Number(match[1]) };
+};
+var serviceTarget = (label, domain) => `${domain}/${label}`;
+var plistPathFor = (label, domain, home) => {
+  if (domain.kind === "system")
+    return `/Library/LaunchDaemons/${label}.plist`;
+  if (home === undefined || !home.startsWith("/")) {
+    throw new Error(`gui/${String(domain.uid)}: no home directory for that uid on this host`);
+  }
+  return `${home}/Library/LaunchAgents/${label}.plist`;
+};
+var OWNED_KEYS = [
+  "EnvironmentVariables",
+  "GroupName",
+  "KeepAlive",
+  "Label",
+  "Program",
+  "ProgramArguments",
+  "RunAtLoad",
+  "StandardErrorPath",
+  "StandardOutPath",
+  "StartCalendarInterval",
+  "StartInterval",
+  "ThrottleInterval",
+  "UserName",
+  "WorkingDirectory"
+];
+var calendarDict = (entry) => {
+  const dict = {};
+  if (entry.minute !== undefined)
+    dict["Minute"] = entry.minute;
+  if (entry.hour !== undefined)
+    dict["Hour"] = entry.hour;
+  if (entry.day !== undefined)
+    dict["Day"] = entry.day;
+  if (entry.weekday !== undefined)
+    dict["Weekday"] = entry.weekday;
+  if (entry.month !== undefined)
+    dict["Month"] = entry.month;
+  return dict;
+};
+var keepAliveValue = (keepAlive) => {
+  if (typeof keepAlive === "boolean")
+    return keepAlive;
+  const dict = {};
+  if (keepAlive.successfulExit !== undefined)
+    dict["SuccessfulExit"] = keepAlive.successfulExit;
+  if (keepAlive.crashed !== undefined)
+    dict["Crashed"] = keepAlive.crashed;
+  return dict;
+};
+var jobPlistDict = (props) => {
+  const dict = { ...props.extraKeys };
+  dict["Label"] = props.label;
+  dict["ProgramArguments"] = [...props.programArguments];
+  const env = props.environment ?? {};
+  if (Object.keys(env).length > 0)
+    dict["EnvironmentVariables"] = { ...env };
+  if (props.runAtLoad !== undefined)
+    dict["RunAtLoad"] = props.runAtLoad;
+  if (props.keepAlive !== undefined)
+    dict["KeepAlive"] = keepAliveValue(props.keepAlive);
+  if (props.startInterval !== undefined)
+    dict["StartInterval"] = props.startInterval;
+  const calendar = props.startCalendarInterval;
+  if (calendar !== undefined) {
+    dict["StartCalendarInterval"] = Array.isArray(calendar) ? calendar.map(calendarDict) : calendarDict(calendar);
+  }
+  if (props.throttleInterval !== undefined)
+    dict["ThrottleInterval"] = props.throttleInterval;
+  if (props.standardOutPath !== undefined)
+    dict["StandardOutPath"] = props.standardOutPath;
+  if (props.standardErrorPath !== undefined)
+    dict["StandardErrorPath"] = props.standardErrorPath;
+  if (props.workingDirectory !== undefined)
+    dict["WorkingDirectory"] = props.workingDirectory;
+  if (props.userName !== undefined)
+    dict["UserName"] = props.userName;
+  if (props.groupName !== undefined)
+    dict["GroupName"] = props.groupName;
+  return dict;
+};
+var sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
+var renderJob = (props) => {
+  const text = renderPlist(jobPlistDict(props));
+  const bytes = new TextEncoder().encode(text);
+  return { bytes, sha256: sha256Hex(bytes), text };
+};
+
+// src/caddy/digest.ts
+var sorted = (value) => {
+  if (Array.isArray(value))
+    return value.map(sorted);
+  if (typeof value === "object" && value !== null) {
+    const object = value;
+    const out = {};
+    for (const key of Object.keys(object).sort())
+      out[key] = sorted(object[key] ?? null);
+    return out;
+  }
+  return value;
+};
+var parseConfig = (text) => JSON.parse(text);
+var canonicalConfig = (config) => JSON.stringify(sorted(config ?? null));
+var configDigest = (config) => sha256Hex(canonicalConfig(config));
+
+// src/caddy/admin-calls.ts
+class CaddyAdminError extends Error {
+  status;
+  method;
+  path;
+  constructor(status, method, path, reason) {
+    super(`Caddy ${method} ${path} → ${String(status)}: ${reason}`);
+    this.status = status;
+    this.method = method;
+    this.path = path;
+    this.name = "CaddyAdminError";
+  }
+}
+var CADDYFILE = "text/caddyfile";
+var ERROR_OPEN = '{"error":';
+var describe = (warning) => `${warning.file ?? "Caddyfile"}:${String(warning.line ?? 0)}: ${warning.message ?? "(no message)"}`;
+var errorIn = (body) => {
+  const at = body.lastIndexOf(ERROR_OPEN);
+  if (at === -1)
+    return;
+  try {
+    const parsed = JSON.parse(body.slice(at));
+    return typeof parsed.error === "string" ? parsed.error : undefined;
+  } catch {
+    return;
+  }
+};
+var warningsIn = (text) => {
+  if (text.trim() === "")
+    return [];
+  try {
+    const parsed = JSON.parse(text);
+    return Array.isArray(parsed) ? parsed.map(describe) : [];
+  } catch {
+    return [];
+  }
+};
+var fail = (response, method, path) => {
+  const reason = errorIn(response.body) ?? (response.body.trim().slice(0, 500) || "(empty body)");
+  const shown = response.status === 200 ? `${reason} (error in a 200 body)` : reason;
+  throw new CaddyAdminError(response.status, method, path, shown);
+};
+var adaptCaddyfile = async (admin, caddyfile) => {
+  const response = await admin.request({
+    body: caddyfile,
+    headers: { "Content-Type": CADDYFILE },
+    method: "POST",
+    path: "/adapt"
+  });
+  if (response.status !== 200)
+    fail(response, "POST", "/adapt");
+  const parsed = JSON.parse(response.body);
+  return { config: parsed.result ?? null, warnings: (parsed.warnings ?? []).map(describe) };
+};
+var readRunningConfig = async (admin) => {
+  const response = await admin.request({ method: "GET", path: "/config/" });
+  if (response.status !== 200)
+    fail(response, "GET", "/config/");
+  return parseConfig(response.body);
+};
+var loadCaddyfile = async (admin, caddyfile, sourceFile) => {
+  const response = await admin.request({
+    body: caddyfile,
+    headers: {
+      "Content-Type": CADDYFILE,
+      ...sourceFile === undefined ? {} : { "Caddy-Config-Source-Adapter": "caddyfile", "Caddy-Config-Source-File": sourceFile }
+    },
+    method: "POST",
+    path: "/load"
+  });
+  const refused = errorIn(response.body);
+  if (response.status !== 200 || refused !== undefined)
+    fail(response, "POST", "/load");
+  return warningsIn(response.body);
+};
+// src/caddy/config.ts
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect2 from "effect/Effect";
+
+// src/launchd/host-effect.ts
+import * as Effect from "effect/Effect";
+var lift = (step) => Effect.tryPromise({
+  catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
+  try: step
+});
+var resolvedString = (news, key) => {
+  if (typeof news !== "object" || news === null)
+    return;
+  const value = news[key];
+  return typeof value === "string" ? value : undefined;
+};
+
+// src/caddy/admin-guard.ts
+var DEFAULT_ADMIN_PORT = 2019;
+var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|\[?::1\]?)$/;
+var parseListen = (listen) => {
+  if (listen.includes("{"))
+    return "a placeholder, which cannot be checked before it runs";
+  const unix = /^unix(?:gram|packet)?\/(.+?)(?:\|[0-7]{3,4})?$/.exec(listen);
+  if (unix !== null)
+    return { kind: "unix", path: unix[1] ?? "" };
+  if (/^[a-z0-9]+\//.test(listen) && !/^tcp[46]?\//.test(listen)) {
+    return `network ${JSON.stringify(listen.split("/")[0])}, not tcp or unix`;
+  }
+  const address = listen.replace(/^tcp[46]?\//, "");
+  const colon = address.lastIndexOf(":");
+  const port = Number(address.slice(colon + 1));
+  if (colon === -1 || !Number.isInteger(port) || port <= 0)
+    return "no single port";
+  return { host: address.slice(0, colon), kind: "tcp", port };
+};
+var unbracket = (host) => host.replace(/^\[(.*)\]$/, "$1");
+var reaches = (hostHeader, listenHost) => {
+  const dialled = unbracket(hostHeader.slice(0, hostHeader.lastIndexOf(":")));
+  const listening = unbracket(listenHost);
+  return dialled === "localhost" || dialled === (listening === "localhost" ? "127.0.0.1" : listening);
+};
+var sameListener = (listen, transport) => listen.kind === "tcp" ? transport.kind === "tcp" && listen.port === transport.port && reaches(transport.hostHeader, listen.host) : transport.kind === "unix" && listen.path === transport.path;
+var defaultOrigins = (port) => ["localhost", "[::1]", "127.0.0.1"].map((host) => `${host}:${String(port)}`);
+var originHost = (origin) => {
+  if (!origin.includes("://"))
+    return origin;
+  try {
+    const url = new URL(origin);
+    return url.protocol === "http:" ? url.host : undefined;
+  } catch {
+    return;
+  }
+};
+var listenProblem = (admin, transport) => {
+  if (admin.listen === undefined) {
+    const atDefault = transport.kind === "tcp" && transport.port === DEFAULT_ADMIN_PORT && reaches(transport.hostHeader, "localhost");
+    return atDefault ? undefined : "no `admin` address: Caddy would fall back to its default listener (localhost:2019, or " + "$CADDY_ADMIN), away from where this provider reaches it — declare `admin <address>`";
+  }
+  const listen = parseListen(admin.listen);
+  const shown = JSON.stringify(admin.listen);
+  if (typeof listen === "string") {
+    return `admin listen ${shown} is ${listen}; declare a literal loopback address`;
+  }
+  if (listen.kind === "tcp" && !LOOPBACK_HOST.test(listen.host)) {
+    return `admin listen ${shown} is not loopback — it would put the admin API on the network`;
+  }
+  return sameListener(listen, transport) ? undefined : `admin listen ${shown} moves the admin API away from where this provider reaches it`;
+};
+var adminProblems = (adapted, transport) => {
+  const admin = typeof adapted === "object" && adapted !== null ? adapted.admin ?? {} : {};
+  const found = [];
+  if (admin.disabled === true) {
+    return ["`admin off` would disable the admin API this resource manages Caddy through"];
+  }
+  if (admin.remote !== undefined)
+    found.push("`admin.remote` opens a network-facing admin API");
+  if (admin.config?.load !== undefined) {
+    found.push("`admin.config.load` makes Caddy pull its config from elsewhere, replacing this one");
+  }
+  const moved = listenProblem(admin, transport);
+  if (moved !== undefined)
+    found.push(moved);
+  if (transport.kind === "tcp") {
+    const allowed = admin.origins?.map(originHost) ?? defaultOrigins(transport.port);
+    if (!allowed.includes(transport.hostHeader)) {
+      const which = admin.origins === undefined ? `Caddy's default origins (no \`origins\` declared) ${JSON.stringify(allowed)}` : `admin origins ${JSON.stringify(admin.origins)}`;
+      found.push(`${which} do not allow Host ${transport.hostHeader}, which this provider sends — ` + "Caddy would refuse it every call after this one");
+    }
+  } else if (admin.enforce_origin === true) {
+    found.push("`enforce_origin` over a unix socket: this transport (like the Caddy CLI) sends no Origin " + "there, so Caddy would answer 403 to every call");
+  }
+  return found;
+};
+
+// src/launchd/secret-tripwire.ts
+var ALTERNATIVE = "props are stored unencrypted in Alchemy state. Have a secret renderer (e.g. openbao-agent) " + "write it to a root-owned file and declare the file path instead (FOO_FILE=/path, --foo-file /path).";
+var SECRET_NAME = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|API_?KEY|ACCESS_KEY|PRIVATE_KEY|SECRET_KEY|CREDENTIALS?)$/i;
+var INLINE_FLAG = /^--?[a-z0-9-]*(?:token|password|passwd|passphrase|secret|api-?key)=./i;
+var BARE_FLAG = /^--?(?:[a-z0-9]+-)*(?:token|password|passwd|passphrase|secret|api-?key)$/i;
+var PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
+var keyLeaves = (value, path) => {
+  if (typeof value === "string")
+    return PRIVATE_KEY.test(value) ? [path] : [];
+  if (Array.isArray(value)) {
+    return value.flatMap((item, index) => keyLeaves(item, `${path}[${String(index)}]`));
+  }
+  if (typeof value === "object" && value !== null) {
+    return Object.entries(value).flatMap(([key, item]) => keyLeaves(item, `${path}.${key}`));
+  }
+  return [];
+};
+var jobSecretProblems = (environment, argv, extraKeys) => {
+  const found = [];
+  for (const [name, value] of Object.entries(environment ?? {})) {
+    if (SECRET_NAME.test(name))
+      found.push(`environment ${name} looks like a secret: ${ALTERNATIVE}`);
+    else if (PRIVATE_KEY.test(value))
+      found.push(`environment ${name} holds a private key: ${ALTERNATIVE}`);
+  }
+  for (const [index, arg] of argv.entries()) {
+    if (INLINE_FLAG.test(arg)) {
+      found.push(`programArguments[${String(index)}] passes a secret inline: ${ALTERNATIVE}`);
+    } else if (BARE_FLAG.test(arg) && index + 1 < argv.length) {
+      found.push(`programArguments[${String(index + 1)}] follows a secret flag: ${ALTERNATIVE}`);
+    } else if (PRIVATE_KEY.test(arg)) {
+      found.push(`programArguments[${String(index)}] holds a private key: ${ALTERNATIVE}`);
+    }
+  }
+  for (const path of keyLeaves(extraKeys ?? {}, "extraKeys")) {
+    found.push(`${path} holds a private key: ${ALTERNATIVE}`);
+  }
+  return found;
+};
+var fileSecretProblems = (content) => PRIVATE_KEY.test(content) ? [`content holds a private key: ${ALTERNATIVE}`] : [];
+
+// src/caddy/caddyfile-tripwire.ts
+var ALTERNATIVE2 = "props are stored unencrypted in Alchemy state. Use a runtime placeholder instead: {env.NAME} " + "(Caddy started with --envfile <file a secret renderer writes>) or {file./path/to/secret}.";
+var SECRET_WORD = /^(?:token|api_token|auth_token|access_token|secret|client_secret|shared_secret|secret_key|password|passwd|passphrase|api_key|apikey|private_key|mac_key|hmac_key)$/i;
+var DNS_DIRECTIVE = /^(?:dns|acme_dns)$/;
+var HEADER_DIRECTIVE = /^(?:header|header_up|header_down|request_header)$/;
+var CREDENTIAL_HEADER = /^[+-]?(?:authorization|proxy-authorization|cookie|x-api-key|api-key|x-auth-token|x-vault-token)$/i;
+var SHAPES = [
+  [/^(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{20,})$/, "a GitHub token"],
+  [/^(?:AKIA|ASIA)[0-9A-Z]{16}$/, "an AWS access key id"],
+  [/^xox[abposr]-[A-Za-z0-9-]{10,}$/, "a Slack token"],
+  [/^sk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}$/, "an API secret key"],
+  [/^eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}$/, "a JWT"],
+  [/^\$2[abxy]?\$\d{2}\$[./A-Za-z0-9]{53}$/, "a bcrypt password hash"],
+  [/^\$argon2(?:id|i|d)\$/, "an argon2 password hash"]
+];
+var PLACEHOLDER = /\{[^{}\s]+\}/g;
+var AUTH_SCHEME = /^(?:bearer|basic|token|digest)$/i;
+var ENV_DEFAULT = /\{\$[^{}\s:]*:([^}]*)\}/g;
+var withDefaults = (line) => line.replace(ENV_DEFAULT, "$1");
+var tokensOf = (line) => {
+  const tokens = [];
+  let current = "";
+  let quote;
+  for (let index = 0;index < line.length; index += 1) {
+    const char = line[index] ?? "";
+    if (quote !== undefined) {
+      if (char === "\\" && quote === '"' && index + 1 < line.length) {
+        index += 1;
+        current += line[index] ?? "";
+      } else if (char === quote)
+        quote = undefined;
+      else
+        current += char;
+    } else if (char === '"' || char === "`") {
+      quote = char;
+    } else if (/\s/.test(char)) {
+      if (current !== "")
+        tokens.push(current);
+      current = "";
+    } else if (char === "#" && current === "") {
+      break;
+    } else
+      current += char;
+  }
+  if (current !== "")
+    tokens.push(current);
+  return tokens;
+};
+var placeholderOnly = (tokens) => tokens.flatMap((token) => token.replace(PLACEHOLDER, " ").split(/\s+/)).filter((part) => part !== "" && part !== "{" && part !== "}" && !AUTH_SCHEME.test(part)).length === 0;
+var lineProblems = (tokens, where) => {
+  const [first = "", second] = tokens;
+  const found = [];
+  if (SECRET_WORD.test(first) && tokens.length > 1 && !placeholderOnly(tokens.slice(1))) {
+    found.push(`${where}: \`${first}\` has a literal value`);
+  }
+  if (DNS_DIRECTIVE.test(first) && tokens.length > 2 && !placeholderOnly(tokens.slice(2))) {
+    found.push(`${where}: \`${first} ${second ?? ""}\` has a literal credential`);
+  }
+  if (HEADER_DIRECTIVE.test(first)) {
+    const at = tokens.findIndex((token, index) => index > 0 && CREDENTIAL_HEADER.test(token));
+    if (at !== -1 && tokens.length > at + 1 && !placeholderOnly(tokens.slice(at + 1))) {
+      found.push(`${where}: \`${first} ${tokens[at] ?? ""}\` sets a literal credential`);
+    }
+  }
+  for (const token of tokens) {
+    const shape = SHAPES.find(([pattern]) => pattern.test(token));
+    if (shape !== undefined)
+      found.push(`${where}: holds what looks like ${shape[1]}`);
+  }
+  return found;
+};
+var caddyfileSecretProblems = (caddyfile) => {
+  const found = [];
+  if (PRIVATE_KEY.test(caddyfile))
+    found.push("the Caddyfile holds a PEM private key");
+  for (const [index, line] of caddyfile.split(`
+`).entries()) {
+    found.push(...lineProblems(tokensOf(withDefaults(line)), `line ${String(index + 1)}`));
+  }
+  return found.map((problem) => `${problem}: ${ALTERNATIVE2}`);
+};
+
+// src/caddy/config-form.ts
+var absoluteNormalised = (path) => path.startsWith("/") && !path.endsWith("/") && !path.includes("\x00") && !path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..");
+var configProblems = (props) => {
+  const found = [];
+  if (props.caddyfile.trim() === "") {
+    found.push("caddyfile is empty — loading it would stop every site Caddy serves");
+  }
+  if (props.sourceFile !== undefined && !absoluteNormalised(props.sourceFile)) {
+    found.push("sourceFile must be an absolute, normalised path");
+  }
+  found.push(...caddyfileSecretProblems(props.caddyfile));
+  return found;
+};
+
+// src/caddy/config-lifecycle.ts
+var refuse = (admin, message) => new Error(`Caddy.Config at ${admin.endpoint}: ${message}`);
+var short = (digest) => digest.slice(0, 12);
+var servesNothing = (config) => {
+  const apps = typeof config === "object" && config !== null ? config.apps : undefined;
+  return typeof apps !== "object" || apps === null || Object.keys(apps).length === 0;
+};
+var desiredConfig = async (admin, props) => {
+  const found = configProblems(props);
+  if (found.length > 0)
+    throw refuse(admin, found.join("; "));
+  const adapted = await adaptCaddyfile(admin, props.caddyfile);
+  if (servesNothing(adapted.config)) {
+    throw refuse(admin, "the Caddyfile adapts to no apps — loading it would stop every site");
+  }
+  const guard = adminProblems(adapted.config, admin.listener);
+  if (guard.length > 0)
+    throw refuse(admin, guard.join("; "));
+  return { digest: configDigest(adapted.config), warnings: adapted.warnings };
+};
+var readLive = async (admin, sourceFile) => ({
+  configSha256: configDigest(await readRunningConfig(admin)),
+  endpoint: admin.endpoint,
+  ...sourceFile === undefined ? {} : { sourceFile }
+});
+var diffConfig = async (admin, news, output) => {
+  const want = await desiredConfig(admin, news);
+  const live = await readLive(admin);
+  const converged = want.digest === live.configSha256 && live.configSha256 === output.configSha256 && news.sourceFile === output.sourceFile && admin.endpoint === output.endpoint;
+  return converged ? { action: "noop" } : { action: "update" };
+};
+var reconcileConfig = async (admin, props) => {
+  const want = await desiredConfig(admin, props);
+  const before = configDigest(await readRunningConfig(admin));
+  let warnings = want.warnings;
+  const loaded = before !== want.digest;
+  if (loaded) {
+    try {
+      warnings = await loadCaddyfile(admin, props.caddyfile, props.sourceFile);
+    } catch (cause) {
+      if (!(cause instanceof CaddyAdminError))
+        throw cause;
+      const after = await readLive(admin).catch(() => {
+        return;
+      });
+      const state = after === undefined ? "and the running config could not be read back" : after.configSha256 === before ? "Caddy kept the previous config (still serving)" : `and the running config is now ${short(after.configSha256)}, not the previous ${short(before)}`;
+      throw refuse(admin, `Caddy refused the Caddyfile — ${cause.message}; ${state}`);
+    }
+  }
+  const attributes = await readLive(admin, props.sourceFile);
+  if (attributes.configSha256 !== want.digest) {
+    throw refuse(admin, `after the load Caddy runs config ${short(attributes.configSha256)}, not the ` + `${short(want.digest)} this Caddyfile adapts to — another writer changed it, or it was not applied`);
+  }
+  return { attributes, loaded, warnings };
+};
+
+// src/caddy/config.ts
+var CaddyConfig = Resource("Caddy.Config", {
+  defaultRemovalPolicy: "retain"
+});
+var unreachable = (error) => error instanceof CaddyUnreachableError;
+var planWithoutCaddy = (admin, fallback) => (error) => Effect2.as(Effect2.logWarning(`Caddy.Config: no Caddy at ${admin.endpoint} (${error.message}); planning without it — ` + "the Caddyfile is validated when the deploy reaches Caddy"), fallback);
+var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect2.gen(function* () {
+  const admin = yield* CaddyAdminService;
+  return CaddyConfig.Provider.of({
+    list: () => Effect2.succeed([]),
+    read: ({ olds }) => lift(() => readLive(admin, resolvedString(olds, "sourceFile"))).pipe(Effect2.catchIf(unreachable, planWithoutCaddy(admin, undefined))),
+    diff: ({ news, output }) => {
+      if (output === undefined)
+        return Effect2.succeed(undefined);
+      const update = planWithoutCaddy(admin, { action: "update" });
+      if (isResolved(news)) {
+        return lift(() => diffConfig(admin, news, output)).pipe(Effect2.catchIf(unreachable, update));
+      }
+      const caddyfile = resolvedString(news, "caddyfile");
+      if (caddyfile === undefined)
+        return Effect2.succeed(undefined);
+      return lift(async () => {
+        await diffConfig(admin, { caddyfile }, output);
+        return { action: "update" };
+      }).pipe(Effect2.catchIf(unreachable, update));
+    },
+    reconcile: ({ news }) => Effect2.gen(function* () {
+      const applied = yield* lift(() => reconcileConfig(admin, news));
+      for (const warning of applied.warnings) {
+        yield* Effect2.logWarning(`Caddy.Config at ${admin.endpoint}: ${warning}`);
+      }
+      return applied.attributes;
+    }),
+    delete: () => Effect2.void
+  });
+}));
+// src/caddy/local-admin.ts
+import { request as httpRequest } from "node:http";
+var DEFAULT_ADMIN_ADDRESS = "http://127.0.0.1:2019";
+var UNIX = "unix://";
+var HOST_PORT = /^(?:[A-Za-z0-9.-]+|\[[0-9A-Fa-f:.]+\]):\d{1,5}$/;
+var refuse2 = (address, why) => new Error(`Caddy admin address ${JSON.stringify(address)}: ${why}`);
+var isLoopback = (hostname) => hostname === "localhost" || hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+var parseAdminAddress = (address, hostHeader) => {
+  if (hostHeader !== undefined && !HOST_PORT.test(hostHeader)) {
+    throw refuse2(address, `hostHeader ${JSON.stringify(hostHeader)} must be host:port`);
+  }
+  if (address.startsWith(UNIX)) {
+    const socketPath = address.slice(UNIX.length);
+    if (!socketPath.startsWith("/"))
+      throw refuse2(address, "the socket path must be absolute");
+    return { listener: { kind: "unix", path: socketPath }, target: { kind: "unix", socketPath } };
+  }
+  let url;
+  try {
+    url = new URL(address);
+  } catch {
+    throw refuse2(address, "not a URL (http://127.0.0.1:2019 or unix:///path)");
+  }
+  if (url.protocol !== "http:")
+    throw refuse2(address, "only http:// (loopback) or unix://");
+  if (!isLoopback(url.hostname)) {
+    throw refuse2(address, "not loopback — the admin API is unauthenticated; forward it to here");
+  }
+  if (url.pathname !== "/" || url.search !== "" || url.username !== "") {
+    throw refuse2(address, "no path, query or credentials — the API lives at the root");
+  }
+  const port = url.port === "" ? 80 : Number(url.port);
+  const host = hostHeader ?? `${url.hostname}:${String(port)}`;
+  return {
+    listener: {
+      hostHeader: host,
+      kind: "tcp",
+      port: Number(host.slice(host.lastIndexOf(":") + 1))
+    },
+    target: { host: url.hostname.replace(/^\[(.*)\]$/, "$1"), kind: "tcp", port }
+  };
+};
+var code = (cause) => typeof cause === "object" && cause !== null && ("code" in cause) ? String(cause.code) : undefined;
+var neverConnected = (cause) => code(cause) === "ECONNREFUSED" || code(cause) === "ENOENT";
+var exchange = (target, method, path, headers, body, timeoutMs) => new Promise((resolve, reject) => {
+  const bytes = body === undefined ? undefined : Buffer.from(body, "utf8");
+  const request = httpRequest({
+    ...target.kind === "tcp" ? { host: target.host, port: target.port } : { socketPath: target.socketPath },
+    headers: bytes === undefined ? headers : { ...headers, "Content-Length": bytes.length },
+    method,
+    path,
+    timeout: timeoutMs
+  }, (response) => {
+    const chunks = [];
+    response.on("data", (chunk) => chunks.push(chunk));
+    response.on("error", reject);
+    response.on("end", () => resolve({
+      body: Buffer.concat(chunks).toString("utf8"),
+      status: response.statusCode ?? 0
+    }));
+  });
+  request.on("timeout", () => request.destroy(new Error(`no answer in ${String(timeoutMs)} ms`)));
+  request.on("error", reject);
+  request.end(bytes);
+});
+var localCaddyAdmin = (options = {}) => {
+  const address = options.address ?? DEFAULT_ADMIN_ADDRESS;
+  const { listener, target } = parseAdminAddress(address, options.hostHeader);
+  const timeoutMs = options.timeoutMs ?? 60000;
+  const retries = options.retries ?? 2;
+  const delay = options.retryDelayMs ?? 500;
+  const fixed = listener.kind === "tcp" ? { Host: listener.hostHeader, Origin: `http://${listener.hostHeader}` } : { Host: "127.0.0.1" };
+  return {
+    endpoint: address,
+    listener,
+    request: async ({ body, headers, method, path }) => {
+      for (let attempt = 0;; attempt += 1) {
+        try {
+          return await exchange(target, method, path, { ...headers, ...fixed }, body, timeoutMs);
+        } catch (cause) {
+          if (!neverConnected(cause) || attempt >= retries) {
+            const reason = cause instanceof Error ? cause.message : String(cause);
+            const message = `Caddy admin ${method} ${path} at ${address}: ${reason}`;
+            throw neverConnected(cause) ? new CaddyUnreachableError(message) : new Error(message);
+          }
+          await new Promise((resolve) => setTimeout(resolve, delay));
+        }
+      }
+    }
+  };
+};
+// src/caddy/providers.ts
+import * as Layer2 from "effect/Layer";
+var caddyProviders = (admin = localCaddyAdmin()) => CaddyConfigProvider().pipe(Layer2.provide(caddyAdminLayer(admin)));
+// src/caddy/with-file.ts
+import * as Effect4 from "effect/Effect";
+import * as RemovalPolicy from "alchemy/RemovalPolicy";
+
+// src/launchd/host-file.ts
+import { Resource as Resource2 } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved2 } from "alchemy/Diff";
+import * as Provider2 from "alchemy/Provider";
+import * as Effect3 from "effect/Effect";
+
+// src/launchd/host-file-form.ts
+var DEFAULT_MODE = 420;
+var identityProblems = (name, value) => {
+  if (value === undefined)
+    return [];
+  if (typeof value === "number") {
+    return Number.isSafeInteger(value) && value >= 0 ? [] : [`${name} must be a non-negative integer id`];
+  }
+  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
+};
+var fileProblems = (props) => {
+  const found = [];
+  const { path } = props;
+  if (!path.startsWith("/"))
+    found.push("path must be absolute");
+  if (path.endsWith("/") || path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..")) {
+    found.push('path must be normalised (no trailing slash, no empty, "." or ".." segments)');
+  }
+  if (path.includes("\x00"))
+    found.push("path contains NUL");
+  const mode = props.mode ?? DEFAULT_MODE;
+  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
+    found.push("mode must be 0–0o7777");
+  found.push(...identityProblems("owner", props.owner));
+  found.push(...identityProblems("group", props.group));
+  found.push(...fileSecretProblems(props.content));
+  return found;
+};
+
+// src/launchd/runner.ts
+import * as Context2 from "effect/Context";
+import * as Layer3 from "effect/Layer";
+
+class HostRunnerService extends Context2.Service()("homeflare/launchd/HostRunner") {
+}
+var hostRunnerLayer = (runner) => Layer3.succeed(HostRunnerService, runner);
+var canActAsRoot = (runner) => runner.privileged || runner.effectiveUid() === 0;
+
+// src/launchd/host-file-lifecycle.ts
+var refuse3 = (path, message) => new Error(`Host.File ${path}: ${message}`);
+var numericId = (value) => typeof value === "number" ? value : /^\d+$/.test(value) ? Number(value) : undefined;
+var desiredFile = async (runner, props) => {
+  const found = fileProblems(props);
+  if (found.length > 0)
+    throw refuse3(props.path, found.join("; "));
+  const bytes = new TextEncoder().encode(props.content);
+  let uid;
+  let gid;
+  if (props.owner !== undefined) {
+    uid = numericId(props.owner) ?? (await runner.lookupUser(String(props.owner)))?.uid;
+    if (uid === undefined)
+      throw refuse3(props.path, `no user ${String(props.owner)} on this host`);
+  }
+  if (props.group !== undefined) {
+    gid = numericId(props.group) ?? await runner.lookupGroup(String(props.group));
+    if (gid === undefined)
+      throw refuse3(props.path, `no group ${String(props.group)} on this host`);
+  }
+  return {
+    bytes,
+    mode: props.mode ?? DEFAULT_MODE,
+    sha256: sha256Hex(bytes),
+    ...uid === undefined ? {} : { uid },
+    ...gid === undefined ? {} : { gid }
+  };
+};
+var readFileAttributes = async (runner, path) => {
+  const stat = await runner.stat(path);
+  if (stat === undefined)
+    return;
+  const bytes = stat.kind === "file" ? await runner.readFile(path) : undefined;
+  return {
+    gid: stat.gid,
+    mode: stat.mode,
+    path,
+    sha256: bytes === undefined ? "" : sha256Hex(bytes),
+    size: stat.size,
+    uid: stat.uid
+  };
+};
+var matches = (live, want) => live.sha256 === want.sha256 && live.mode === want.mode && (want.uid === undefined || live.uid === want.uid) && (want.gid === undefined || live.gid === want.gid);
+var diffFile = async (runner, news, output) => {
+  if (news.path !== output.path)
+    return { action: "replace" };
+  const want = await desiredFile(runner, news);
+  if (want.sha256 !== output.sha256)
+    return { action: "update" };
+  const live = await readFileAttributes(runner, news.path);
+  return live !== undefined && matches(live, want) ? { action: "noop" } : { action: "update" };
+};
+var reconcileFile = async (runner, props, output) => {
+  const want = await desiredFile(runner, props);
+  if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {
+    throw refuse3(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy as root ` + "or through a privileged HostRunner (privileged: true). This provider never calls sudo.");
+  }
+  const stat = await runner.stat(props.path);
+  if (stat !== undefined && stat.kind !== "file") {
+    throw refuse3(props.path, `is a ${stat.kind}; remove it from whatever owns it before declaring it here`);
+  }
+  const before = stat === undefined ? undefined : await readFileAttributes(runner, props.path);
+  const moved = output !== undefined && output.path !== props.path;
+  const prior = moved ? undefined : output;
+  if (prior === undefined && before !== undefined && !matches(before, want)) {
+    throw refuse3(props.path, "already exists and is not this resource. Remove it, or declare it as a new resource and " + "deploy with --adopt.");
+  }
+  if (before === undefined || !matches(before, want)) {
+    await runner.writeFileAtomic(props.path, want.bytes, {
+      mode: want.mode,
+      ...want.uid === undefined ? {} : { uid: want.uid },
+      ...want.gid === undefined ? {} : { gid: want.gid }
+    });
+  }
+  const after = await readFileAttributes(runner, props.path);
+  if (after === undefined || !matches(after, want)) {
+    if (before === undefined)
+      await runner.removeFile(props.path).catch(() => {
+        return;
+      });
+    throw refuse3(props.path, "the write returned but the file on disk does not match the declaration");
+  }
+  if (moved)
+    await deleteFile(runner, output);
+  return after;
+};
+var deleteFile = async (runner, output) => {
+  const stat = await runner.stat(output.path);
+  if (stat === undefined)
+    return;
+  if (stat.kind !== "file")
+    throw refuse3(output.path, `is now a ${stat.kind}; not removing it`);
+  await runner.removeFile(output.path);
+};
+
+// src/launchd/host-file.ts
+var HostFile = Resource2("Host.File");
+var HostFileProvider = () => Provider2.effect(HostFile, Effect3.gen(function* () {
+  const runner = yield* HostRunnerService;
+  return HostFile.Provider.of({
+    list: () => Effect3.succeed([]),
+    read: ({ olds, output }) => lift(async () => {
+      const found = await readFileAttributes(runner, olds.path);
+      if (found === undefined)
+        return;
+      return output === undefined ? Unowned(found) : found;
+    }),
+    diff: ({ news, output }) => {
+      if (output === undefined)
+        return Effect3.succeed(undefined);
+      if (isResolved2(news))
+        return lift(() => diffFile(runner, news, output));
+      const path = resolvedString(news, "path");
+      return Effect3.succeed(path !== undefined && path !== output.path ? { action: "replace" } : undefined);
+    },
+    reconcile: ({ news, output }) => lift(() => reconcileFile(runner, news, output)),
+    delete: ({ output }) => lift(() => deleteFile(runner, output))
+  });
+}));
+
+// src/caddy/with-file.ts
+var caddyWithFile = (id, props) => Effect4.gen(function* () {
+  const found = configProblems({ caddyfile: props.caddyfile, sourceFile: props.path });
+  if (found.length > 0) {
+    return yield* Effect4.fail(new Error(`caddyWithFile ${id}: ${found.join("; ")}`));
+  }
+  const file = yield* HostFile(`${id}-file`, {
+    content: props.caddyfile,
+    mode: props.mode ?? 420,
+    path: props.path,
+    ...props.owner === undefined ? {} : { owner: props.owner },
+    ...props.group === undefined ? {} : { group: props.group }
+  }).pipe(RemovalPolicy.retain());
+  const config = yield* CaddyConfig(id, { caddyfile: props.caddyfile, sourceFile: file.path });
+  return { config, file };
+});
+export {
+  CaddyAdminError,
+  CaddyAdminService,
+  CaddyConfig,
+  CaddyConfigProvider,
+  CaddyUnreachableError,
+  DEFAULT_ADMIN_ADDRESS,
+  caddyAdminLayer,
+  caddyProviders,
+  caddyWithFile,
+  localCaddyAdmin
+};
+
+//# debugId=205F5FF536DDDFA164756E2164756E21
+//# sourceMappingURL=index.js.map