@homeflare/alchemy 0.5.0 → 0.7.0

package/src/launchd/job-lifecycle.test.ts

@@ -0,0 +1,220 @@
+/**
+ * LaunchdJob's lifecycle against the fake host: no real launchctl, no real writes.
+ *
+ * ★ The assertions are on the SEQUENCE of host calls, because the ordering is the design — write
+ *   before bootout before bootstrap, and nothing at all when the host is already converged.
+ */
+import { describe, expect, test } from 'bun:test';
+import { fakeRunner } from './fake-runner.ts';
+import type { LaunchdJobProps } from './job-form.ts';
+import { deleteJob, diffJob, readJob, reconcileJob } from './job-lifecycle.ts';
+
+const DAEMON = '/Library/LaunchDaemons/com.example.job.plist';
+const AGENT = '/Users/someone/Library/LaunchAgents/com.example.job.plist';
+
+const job: LaunchdJobProps = {
+  domain: 'system',
+  keepAlive: true,
+  label: 'com.example.job',
+  programArguments: ['/usr/local/bin/job'],
+};
+
+const host = (euid = 0, privileged = false) =>
+  fakeRunner({
+    dirs: { '/Library/LaunchDaemons': 0, '/Users/someone/Library/LaunchAgents': 501 },
+    euid,
+    privileged,
+    users: { someone: { gid: 20, home: '/Users/someone', uid: 501 } },
+  });
+
+/** `bootstrap`, `write`, … — the verbs, in order, skipping the read-only ones. */
+const writes = (calls: string[][]) =>
+  calls
+    .map((call) => (call[0] === 'write' ? 'write' : call[1]))
+    .filter((verb) => verb !== 'print' && verb !== 'print-disabled');
+
+describe('create', () => {
+  test('writes the plist root:wheel 0644, then bootstraps it', async () => {
+    const fake = host();
+    const attrs = await reconcileJob(fake.runner, job, undefined);
+    expect(writes(fake.calls)).toEqual(['write', 'bootstrap']);
+    expect(fake.files.get(DAEMON)).toMatchObject({ gid: 0, mode: 0o644, uid: 0 });
+    expect(attrs).toMatchObject({
+      loaded: true,
+      plistPath: DAEMON,
+      serviceTarget: 'system/com.example.job',
+      state: 'running',
+    });
+    expect(attrs.plistSha256).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  test("an agent is written as its user into that user's LaunchAgents", async () => {
+    const fake = host(501);
+    const attrs = await reconcileJob(fake.runner, { ...job, domain: 'gui/501' }, undefined);
+    expect(attrs.plistPath).toBe(AGENT);
+    expect(fake.files.get(AGENT)).toMatchObject({ mode: 0o644, uid: 501 });
+    expect(fake.loaded.has('gui/501/com.example.job')).toBe(true);
+  });
+});
+
+describe('diff', () => {
+  test('noop when nothing changed, on disk or in launchd', async () => {
+    const fake = host();
+    const output = await reconcileJob(fake.runner, job, undefined);
+    expect(await diffJob(fake.runner, job, output)).toEqual({ action: 'noop' });
+  });
+
+  test('update when a prop changes the rendered plist', async () => {
+    const fake = host();
+    const output = await reconcileJob(fake.runner, job, undefined);
+    expect(await diffJob(fake.runner, { ...job, runAtLoad: true }, output)).toEqual({
+      action: 'update',
+    });
+  });
+
+  test('update when the file was hand-edited, or the job was unloaded behind our back', async () => {
+    const fake = host();
+    const output = await reconcileJob(fake.runner, job, undefined);
+    const entry = fake.files.get(DAEMON);
+    if (entry === undefined) throw new Error('no plist');
+    fake.files.set(DAEMON, { ...entry, bytes: new TextEncoder().encode('hand edit') });
+    expect(await diffJob(fake.runner, job, output)).toEqual({ action: 'update' });
+    await reconcileJob(fake.runner, job, output);
+    fake.loaded.clear();
+    expect(await diffJob(fake.runner, job, output)).toEqual({ action: 'update' });
+  });
+
+  test('replace, deleting first, only when label or domain changes', async () => {
+    const fake = host();
+    const output = await reconcileJob(fake.runner, job, undefined);
+    const replace = { action: 'replace', deleteFirst: true } as const;
+    expect(await diffJob(fake.runner, { ...job, label: 'com.example.renamed' }, output)).toEqual(
+      replace,
+    );
+    expect(await diffJob(fake.runner, { ...job, domain: 'gui/501' }, output)).toEqual(replace);
+  });
+
+  test('a bad declaration fails the plan, not the apply', async () => {
+    const fake = host();
+    const output = await reconcileJob(fake.runner, job, undefined);
+    await expect(diffJob(fake.runner, { ...job, startInterval: 0 }, output)).rejects.toThrow(
+      'startInterval',
+    );
+  });
+});
+
+describe('update', () => {
+  test('write, then bootout, then bootstrap — a restart with a new pid', async () => {
+    const fake = host();
+    const first = await reconcileJob(fake.runner, job, undefined);
+    fake.calls.length = 0;
+    fake.state.lingerPrints = 2;
+    const second = await reconcileJob(fake.runner, { ...job, runAtLoad: true }, first);
+    expect(writes(fake.calls)).toEqual(['write', 'bootout', 'bootstrap']);
+    expect(second.pid).not.toBe(first.pid);
+    expect(second.plistSha256).not.toBe(first.plistSha256);
+  });
+
+  test('a converged job is not restarted', async () => {
+    const fake = host();
+    const output = await reconcileJob(fake.runner, job, undefined);
+    fake.calls.length = 0;
+    const again = await reconcileJob(fake.runner, job, output);
+    expect(writes(fake.calls)).toEqual([]);
+    expect(again.pid).toBe(output.pid);
+  });
+
+  test('a failed bootstrap leaves state behind, so the next diff retries', async () => {
+    const fake = host();
+    const output = await reconcileJob(fake.runner, job, undefined);
+    fake.state.bootstrapFailure = {
+      exitCode: 5,
+      stderr: 'Bootstrap failed: 5: Input/output error',
+      stdout: '',
+    };
+    const changed = { ...job, runAtLoad: true };
+    await expect(reconcileJob(fake.runner, changed, output)).rejects.toThrow('NOT RUNNING');
+    expect(fake.loaded.size).toBe(0);
+    expect(await diffJob(fake.runner, changed, output)).toEqual({ action: 'update' });
+  });
+});
+
+describe('refusals', () => {
+  test('the system domain as a non-root user: refused before anything is written', async () => {
+    const fake = host(501);
+    await expect(reconcileJob(fake.runner, job, undefined)).rejects.toThrow('never calls sudo');
+    expect(writes(fake.calls)).toEqual([]);
+    expect(fake.calls).toEqual([]);
+  });
+
+  test('a runner that declares itself privileged may write the system domain', async () => {
+    const fake = host(501, true);
+    expect((await reconcileJob(fake.runner, job, undefined)).loaded).toBe(true);
+  });
+
+  test("another user's gui domain needs root", async () => {
+    const fake = fakeRunner({
+      euid: 501,
+      users: { other: { gid: 20, home: '/Users/other', uid: 502 } },
+    });
+    await expect(
+      reconcileJob(fake.runner, { ...job, domain: 'gui/502' }, undefined),
+    ).rejects.toThrow('another user');
+  });
+
+  test('a gui uid with no user on the host', async () => {
+    const fake = host();
+    await expect(
+      reconcileJob(fake.runner, { ...job, domain: 'gui/777' }, undefined),
+    ).rejects.toThrow('no home');
+  });
+
+  test('a disabled label is left disabled, with the command to change that', async () => {
+    const fake = host();
+    fake.disabled.add('system/com.example.job');
+    await expect(reconcileJob(fake.runner, job, undefined)).rejects.toThrow(
+      'launchctl enable system/com.example.job',
+    );
+    expect(fake.files.has(DAEMON)).toBe(false);
+  });
+
+  test('a reserved label never reaches the host', async () => {
+    const fake = host();
+    await expect(
+      reconcileJob(fake.runner, { ...job, label: 'org.nixos.job' }, undefined),
+    ).rejects.toThrow('another tool owns');
+    expect(fake.calls).toEqual([]);
+  });
+});
+
+describe('read', () => {
+  test('nothing on disk and nothing loaded is undefined', async () => {
+    expect(await readJob(host().runner, job)).toBeUndefined();
+  });
+
+  test('a plist on disk that is not loaded reads as present, not loaded', async () => {
+    const fake = host();
+    await reconcileJob(fake.runner, job, undefined);
+    fake.loaded.clear();
+    expect(await readJob(fake.runner, job)).toMatchObject({ loaded: false, plistPath: DAEMON });
+  });
+});
+
+describe('delete', () => {
+  test('boots out, removes the plist, and is idempotent', async () => {
+    const fake = host();
+    const output = await reconcileJob(fake.runner, job, undefined);
+    fake.calls.length = 0;
+    await deleteJob(fake.runner, output);
+    expect(writes(fake.calls)).toEqual(['bootout']);
+    expect(fake.files.has(DAEMON)).toBe(false);
+    expect(fake.loaded.size).toBe(0);
+    await deleteJob(fake.runner, output);
+  });
+
+  test('refused for a non-root user in the system domain', async () => {
+    const root = host();
+    const output = await reconcileJob(root.runner, job, undefined);
+    await expect(deleteJob(host(501).runner, output)).rejects.toThrow('needs root');
+  });
+});

package/src/launchd/job-lifecycle.ts

@@ -0,0 +1,194 @@
+/**
+ * LaunchdJob's read / diff / reconcile / delete as plain async functions over a HostRunner — split
+ * from job.ts so the whole lifecycle runs against fake-runner.ts in tests, with no real launchd.
+ * The checks made before any write live in job-preflight.ts.
+ *
+ * ★ THE ORDER IS WRITE, BOOTOUT, BOOTSTRAP — not bootout first. launchd reads the plist only at
+ *   bootstrap, so writing the new file while the old job runs changes nothing yet, and a write that
+ *   fails (disk full, EACCES) leaves the old job running instead of leaving nothing running.
+ * ⚠️ A FAILED BOOTSTRAP LEAVES THE JOB DOWN. On an UPDATE the new plist stays on disk, the state
+ *   keeps the previous digest, and the next deploy retries. On a CREATE the plist this deploy wrote
+ *   is removed again: left behind, the next plan's recovery `read` would find a plist with no
+ *   state and report it `Unowned`, and every later deploy would demand `--adopt` for our own file.
+ *   There is no rollback to an older plist: one that launchd refuses is a declaration to fix, and
+ *   re-bootstrapping the old one could fail for the same host-side reason.
+ */
+import type { Diff } from 'alchemy/Diff';
+import {
+  type LaunchdJobAttributes,
+  type LaunchdJobProps,
+  parseDomain,
+  renderJob,
+  sha256Hex,
+} from './job-form.ts';
+import {
+  type Identity,
+  type Location,
+  assertMayWrite,
+  assertReplaceable,
+  assertUnclaimed,
+  assertValid,
+  locate,
+  preflight,
+  refuse,
+} from './job-preflight.ts';
+import { type ServiceStatus, bootoutIfLoaded, bootstrap, printService } from './launchctl.ts';
+import type { HostRunner } from './runner.ts';
+
+const attributesOf = (
+  props: Identity,
+  location: Location,
+  plistSha256: string,
+  status: ServiceStatus,
+): LaunchdJobAttributes => ({
+  domain: props.domain,
+  label: props.label,
+  loaded: status.loaded,
+  plistPath: location.plistPath,
+  plistSha256,
+  serviceTarget: location.target,
+  ...(status.state === undefined ? {} : { state: status.state }),
+  ...(status.pid === undefined ? {} : { pid: status.pid }),
+  ...(status.lastExitCode === undefined ? {} : { lastExitCode: status.lastExitCode }),
+});
+
+/** What is on the host now: the plist's digest and launchd's view. `undefined` when neither exists. */
+export const readJob = async (
+  runner: HostRunner,
+  props: Identity,
+): Promise<LaunchdJobAttributes | undefined> => {
+  const location = await locate(runner, props);
+  const bytes = await runner.readFile(location.plistPath);
+  const status = await printService(runner, location.target);
+  if (bytes === undefined && !status.loaded) return undefined;
+  return attributesOf(props, location, bytes === undefined ? '' : sha256Hex(bytes), status);
+};
+
+/**
+ * ★ `deleteFirst`: labels are unique per domain, and the old and new job would otherwise run the
+ *   same program side by side — same port, same files — until the old one is deleted. A brief
+ *   outage beats two copies. ⛔ Which is why everything the new job's reconcile would refuse is
+ *   refused HERE, at plan time (job-preflight.ts): after the delete it would be too late.
+ * `full` is the whole declaration when resolved; job.ts passes only the identity otherwise.
+ */
+export const replaceDiff = async (
+  runner: HostRunner,
+  next: Identity,
+  full: LaunchdJobProps | undefined,
+  output: LaunchdJobAttributes,
+): Promise<Diff> => {
+  // ★ Validate before rendering, so a bad declaration shows its whole list, not a render error.
+  if (full !== undefined) assertValid(full);
+  const rendered = full === undefined ? undefined : renderJob(full).sha256;
+  await assertReplaceable(runner, next, full, output, rendered);
+  return { action: 'replace', deleteFirst: true };
+};
+
+export const diffJob = async (
+  runner: HostRunner,
+  news: LaunchdJobProps,
+  output: LaunchdJobAttributes,
+): Promise<Diff> => {
+  if (news.label !== output.label || news.domain !== output.domain) {
+    return replaceDiff(runner, news, news, output);
+  }
+  assertValid(news);
+  const desired = renderJob(news).sha256;
+  // ⛔ BOTH digests: the stored one catches a bootstrap that failed after the write landed, the live
+  //   one catches a hand edit. Either alone would report `noop` over a job that is not what we say.
+  if (desired !== output.plistSha256) return { action: 'update' };
+  const live = await readJob(runner, news);
+  if (live === undefined || !live.loaded || live.plistSha256 !== desired)
+    return { action: 'update' };
+  return { action: 'noop' };
+};
+
+export const reconcileJob = async (
+  runner: HostRunner,
+  props: LaunchdJobProps,
+  output: LaunchdJobAttributes | undefined,
+): Promise<LaunchdJobAttributes> => {
+  assertValid(props);
+  const { location, status } = await preflight(runner, props);
+  const rendered = renderJob(props);
+  /**
+   * ⚠️ AN `output` UNDER ANOTHER LABEL OR DOMAIN means the engine planned an UPDATE across a rename —
+   *   which it does whenever diff could not see the rename (a label that was itself an unresolved
+   *   Output at plan time; job.ts). Bootstrapping the new label alone would orphan the old job,
+   *   still running, with nothing left in state to ever remove it. So do what the replace would
+   *   have done: every check above first, then delete the old job, then create the new one.
+   */
+  const renamed =
+    output !== undefined && (output.label !== props.label || output.domain !== props.domain);
+  const prior = renamed ? undefined : output;
+  // ⛔ No prior state for THIS identity: whatever is there already belongs to someone else.
+  if (prior === undefined) {
+    await assertUnclaimed(runner, props.label, location, status, rendered.sha256);
+  }
+  if (renamed) await deleteJob(runner, output);
+  const before = await runner.readFile(location.plistPath);
+  // ★ Already converged (a retried deploy, or an adopted job that matches): do not restart it.
+  // ⛔ The STORED digest is part of the test: a write that landed before a failed bootout leaves
+  //   the new plist on disk and the OLD job loaded — both look right, and only state knows better.
+  if (
+    status.loaded &&
+    before !== undefined &&
+    sha256Hex(before) === rendered.sha256 &&
+    prior?.plistSha256 === rendered.sha256
+  ) {
+    return attributesOf(props, location, rendered.sha256, status);
+  }
+  /**
+   * ⚠️ launchd refuses a daemon plist that is not root:wheel or is group/world-writable ("bad
+   *   ownership/permissions"), so the system domain always writes 0644 root:wheel. An agent's plist
+   *   belongs to its user. REASONED from launchd's documented behaviour, not measured here (no
+   *   bootstrap was run to write this); the nix-darwin daemons on the reference host are 0644 root.
+   */
+  await runner.writeFileAtomic(
+    location.plistPath,
+    rendered.bytes,
+    location.domain.kind === 'system'
+      ? { gid: 0, mode: 0o644, uid: 0 }
+      : { mode: 0o644, uid: location.domain.uid },
+  );
+  await bootoutIfLoaded(runner, location.target);
+  const failed = async (detail: string): Promise<never> => {
+    // ⚠️ A failed removal must not replace the bootstrap error, nor let the message claim it worked.
+    const removed =
+      before === undefined &&
+      (await runner.removeFile(location.plistPath).then(
+        () => true,
+        () => false,
+      ));
+    throw refuse(
+      props.label,
+      removed
+        ? `bootstrap failed, so the job is NOT RUNNING; the plist this deploy wrote was removed ` +
+            `again, so the next deploy starts clean. ${detail}`
+        : `bootstrap failed, so the job is NOT RUNNING; the new plist is at ${location.plistPath} ` +
+            `and the next deploy retries. ${detail}`,
+    );
+  };
+  try {
+    await bootstrap(runner, props.domain, location.plistPath);
+  } catch (cause) {
+    return failed(cause instanceof Error ? cause.message : String(cause));
+  }
+  const after = await printService(runner, location.target);
+  if (!after.loaded) return failed('bootstrap exited 0 but launchctl print cannot find the job');
+  return attributesOf(props, location, rendered.sha256, after);
+};
+
+/** Boot out, then remove the plist. Idempotent: an absent job and an absent file are success. */
+export const deleteJob = async (
+  runner: HostRunner,
+  output: LaunchdJobAttributes,
+): Promise<void> => {
+  const domain = parseDomain(output.domain);
+  if (domain === undefined) throw refuse(output.label, `unknown domain ${output.domain}`);
+  assertMayWrite(runner, output.label, domain);
+  // ★ A gui domain with no login session reads as "not loaded" (launchctl.ts), so the plist is
+  //   still removed — which is what stops launchd loading it again at that user's next login.
+  await bootoutIfLoaded(runner, output.serviceTarget);
+  await runner.removeFile(output.plistPath);
+};

package/src/launchd/job-preflight.ts

@@ -0,0 +1,152 @@
+/**
+ * Everything LaunchdJob checks before it touches the host — split from job-lifecycle.ts so that a
+ * reconcile and a plan-time REPLACE run the very same checks.
+ *
+ * ★ WHY A REPLACE IS CHECKED AT PLAN TIME. A label or domain change is a delete-first replace, and
+ *   Alchemy runs `delete` on the old job BEFORE `reconcile` on the new one (Apply.ts,
+ *   deleteOldGenerations under `node.deleteFirst`; read in alchemy 2.0.0-beta.79 on 2026-09-21).
+ *   A refusal that fired only in reconcile would therefore arrive after the old job was already
+ *   booted out: nothing running, and a plan that had promised a clean swap.
+ * ★ EVERY CHECK HERE IS READ-ONLY: validation, a user lookup, `launchctl print` and
+ *   `print-disabled` — none of which needs root (measured, see launchctl.ts).
+ */
+import {
+  type LaunchdJobAttributes,
+  type LaunchdJobProps,
+  type ParsedDomain,
+  parseDomain,
+  plistPathFor,
+  serviceTarget,
+  sha256Hex,
+} from './job-form.ts';
+import { identityProblems, jobProblems } from './job-validate.ts';
+import { type ServiceStatus, isDisabled, printService } from './launchctl.ts';
+import { type HostRunner, canActAsRoot } from './runner.ts';
+
+export type Location = {
+  readonly domain: ParsedDomain;
+  readonly plistPath: string;
+  readonly target: string;
+};
+
+export type Identity = Pick<LaunchdJobProps, 'label' | 'domain'>;
+
+export const refuse = (label: string, message: string): Error =>
+  new Error(`Launchd.Job ${label}: ${message}`);
+
+/** Throw every refusal at once, so one plan shows the whole list. */
+export const assertValid = (props: LaunchdJobProps): void => {
+  const found = jobProblems(props);
+  if (found.length > 0) throw refuse(props.label, found.join('; '));
+};
+
+export const locate = async (runner: HostRunner, props: Identity): Promise<Location> => {
+  const domain = parseDomain(props.domain);
+  if (domain === undefined) throw refuse(props.label, `unknown domain ${props.domain}`);
+  const home =
+    domain.kind === 'gui' ? (await runner.lookupUser(String(domain.uid)))?.home : undefined;
+  return {
+    domain,
+    plistPath: plistPathFor(props.label, domain, home),
+    target: serviceTarget(props.label, props.domain),
+  };
+};
+
+/**
+ * ⛔ NO SILENT SUDO. The system domain, and another user's gui domain, need root. Refuse up front
+ *   with the two ways out, rather than let launchctl or rename(2) fail halfway through.
+ */
+export const assertMayWrite = (runner: HostRunner, label: string, domain: ParsedDomain): void => {
+  if (canActAsRoot(runner)) return;
+  if (domain.kind === 'system') {
+    throw refuse(
+      label,
+      'the system domain needs root. Run the deploy as root, or provide a HostRunner that is ' +
+        'deliberately privileged (privileged: true). This provider never calls sudo.',
+    );
+  }
+  if (domain.uid !== runner.effectiveUid()) {
+    throw refuse(
+      label,
+      `gui/${String(domain.uid)} belongs to another user; only root may write it. ` +
+        'Deploy as that user, as root, or through a privileged HostRunner.',
+    );
+  }
+};
+
+/** Where the job goes, whether we may write it there, and launchd's current view of it. */
+export const preflight = async (
+  runner: HostRunner,
+  props: Identity,
+): Promise<{ location: Location; status: ServiceStatus }> => {
+  const location = await locate(runner, props);
+  assertMayWrite(runner, props.label, location.domain);
+  const status = await printService(runner, location.target);
+  if (status.domainMissing === true) {
+    throw refuse(
+      props.label,
+      `${props.domain} does not exist: that user has no login session, and launchd creates a gui ` +
+        'domain only at login. Log the user in (or declare a system-domain job with userName), ' +
+        'then redeploy. Nothing was written.',
+    );
+  }
+  /**
+   * ⛔ A DISABLED LABEL IS SOMEONE'S DECISION, NOT DRIFT. `launchctl disable` persists across boots
+   *   and makes bootstrap fail; enabling it here would silently overrule whoever disabled it.
+   */
+  if (await isDisabled(runner, props.domain, props.label)) {
+    throw refuse(
+      props.label,
+      `${location.target} is disabled (launchctl print-disabled ${props.domain}). ` +
+        `If that is stale, run \`launchctl enable ${location.target}\` deliberately, then redeploy.`,
+    );
+  }
+  return { location, status };
+};
+
+/**
+ * ⛔ A JOB THIS RESOURCE DOES NOT OWN IS NEVER OVERWRITTEN. Alchemy's adoption probe guards a
+ *   create, but NOT the new label of a replace — the engine reads nothing there — so a rename onto
+ *   a label someone already loaded would boot their job out and write ours over its plist.
+ * ★ A plist byte-identical to our render is exempt: it is this declaration's own leftover (a
+ *   deploy that died between write and bootstrap), and rewriting it changes nothing.
+ */
+export const assertUnclaimed = async (
+  runner: HostRunner,
+  label: string,
+  location: Location,
+  status: ServiceStatus,
+  renderedSha256: string | undefined,
+): Promise<void> => {
+  const bytes = await runner.readFile(location.plistPath);
+  const foreignFile = bytes !== undefined && sha256Hex(bytes) !== renderedSha256;
+  if (foreignFile || (bytes === undefined && status.loaded)) {
+    throw refuse(
+      label,
+      `${location.target} is already on this host (${foreignFile ? location.plistPath : 'loaded'})` +
+        ' and is not this resource. Remove it, or declare it as a new resource and deploy with ' +
+        '--adopt.',
+    );
+  }
+};
+
+/**
+ * A rename, checked at plan time: the new identity must be valid, writable, bootstrappable and
+ * free, and the old one deletable — before the plan may promise a delete-first replace.
+ * `full` is the whole declaration when it is already resolved; otherwise only the identity is.
+ */
+export const assertReplaceable = async (
+  runner: HostRunner,
+  next: Identity,
+  full: LaunchdJobProps | undefined,
+  old: LaunchdJobAttributes,
+  renderedSha256: string | undefined,
+): Promise<void> => {
+  const found = full === undefined ? identityProblems(next.label, next.domain) : jobProblems(full);
+  if (found.length > 0) throw refuse(next.label, found.join('; '));
+  const oldDomain = parseDomain(old.domain);
+  if (oldDomain === undefined) throw refuse(old.label, `unknown domain ${old.domain}`);
+  assertMayWrite(runner, old.label, oldDomain);
+  const { location, status } = await preflight(runner, next);
+  await assertUnclaimed(runner, next.label, location, status, renderedSha256);
+};