@homeflare/alchemy 0.5.0 → 0.7.0

package/dist/cloudflare/mesh-node-harness.d.ts

@@ -0,0 +1,46 @@
+import * as Effect from 'effect/Effect';
+import * as Exit from 'effect/Exit';
+import { type FakeMesh } from './fake-mesh.ts';
+import { MeshNode } from './mesh-node.ts';
+import type { MeshNodeAttributes, MeshNodeProps } from './mesh-node-form.ts';
+export declare const ids: {
+    fqn: string;
+    id: string;
+    instanceId: string;
+};
+export declare const extra: {
+    bindings: never;
+    session: never;
+};
+export type P = Effect.Success<typeof MeshNode.Provider>;
+export declare const handler: <F>(name: string, fn: F | undefined) => F;
+/** Build the provider over the fake (as `accountId`'s environment) and hand it to `use`. */
+export declare const run: <A, E>(fake: FakeMesh, use: (p: P) => Effect.Effect<A, E>, accountId?: string) => Promise<A>;
+export declare const reconcile: (p: P, news: MeshNodeProps, output?: MeshNodeAttributes) => Effect.Effect<MeshNodeAttributes, any, never>;
+export declare const read: (p: P, olds: MeshNodeProps, output?: MeshNodeAttributes) => Effect.Effect<MeshNodeAttributes | undefined, any, never>;
+export declare const diff: (p: P, news: MeshNodeProps, olds: MeshNodeProps, output: MeshNodeAttributes) => Effect.Effect<void | import("alchemy").Diff, any, never>;
+/** A stored attribute set for a node that may or may not exist in the fake. */
+export declare const stored: (accountId: string, over?: Partial<MeshNodeAttributes>) => MeshNodeAttributes;
+export declare const tokenReads: (fake: FakeMesh) => number;
+/** The writes the fake saw, in order: `['POST', 'DELETE', …]`. */
+export declare const writes: (fake: FakeMesh) => string[];
+/**
+ * ★ THE REAL ENGINE, NOT A MODEL OF IT: Alchemy's own `Plan.make` + `apply` over an in-memory
+ *   state store, which is what its Test harness's scratch stacks run (Test/Core.ts
+ *   `scratchStack`), minus the profile, config and telemetry layers a fake Cloudflare does not
+ *   need. Removal policy lives in the engine, so only this can show what it does to a replace.
+ * ⚠️ `FetchHttpClient.Fetch` IS READ PER REQUEST, from the fiber running the engine, so it is
+ *   provided around the whole deploy. Provided only under the provider layer, the requests went
+ *   to the real `fetch` (measured 2026-09-21: ENOTFOUND api.example.com, the RFC 2606 host, so
+ *   no API answered — but a real DNS lookup went out).
+ */
+export declare const engine: (fake: FakeMesh) => {
+    deploy: <A, E, R>(declare: Effect.Effect<A, E, R>) => Promise<Exit.Exit<unknown, unknown>>;
+    /** The stored row's status (`created`, `replacing`, …), or `undefined` when there is none. */
+    status: (fqn: string) => "created" | "creating" | "deleting" | "replaced" | "replacing" | "updated" | "updating" | undefined;
+    /** ★ What `alchemy state rm` does ("Delete state records without deleting cloud resources"). */
+    forget: (fqn: string) => void;
+};
+/** The failure sentence of a deploy, or `''` when it succeeded. */
+export declare const failureOf: (exit: Exit.Exit<unknown, unknown>) => string;
+//# sourceMappingURL=mesh-node-harness.d.ts.map

package/dist/cloudflare/mesh-node-harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh-node-harness.d.ts","sourceRoot":"","sources":["../../src/cloudflare/mesh-node-harness.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAGpC,OAAO,EAAE,KAAK,QAAQ,EAAqB,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAoB,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,eAAO,MAAM,GAAG;IAAK,GAAG;IAAgB,EAAE;IAAU,UAAU;CAAS,CAAC;AACxE,eAAO,MAAM,KAAK;IAAK,QAAQ,EAAQ,KAAK;IAAE,OAAO,EAAe,KAAK;CAAE,CAAC;AAE5E,MAAM,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAEzD,eAAO,MAAM,OAAO,GAAI,CAAC,QAAQ,MAAM,MAAM,CAAC,GAAG,SAAS,KAAG,CAG5D,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,QAAQ,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,MAAM,eAS7F,CAAC;AAEJ,eAAO,MAAM,SAAS,MAAO,CAAC,QAAQ,aAAa,WAAW,kBAAkB,kDACd,CAAC;AAEnE,eAAO,MAAM,IAAI,MAAO,CAAC,QAAQ,aAAa,WAAW,kBAAkB,8DACxB,CAAC;AAEpD,eAAO,MAAM,IAAI,MAAO,CAAC,QAAQ,aAAa,QAAQ,aAAa,UAAU,kBAAkB,6DAW3F,CAAC;AAEL,+EAA+E;AAC/E,eAAO,MAAM,MAAM,cACN,MAAM,SACX,OAAO,CAAC,kBAAkB,CAAC,KAChC,kBAOD,CAAC;AAEH,eAAO,MAAM,UAAU,SAAU,QAAQ,WACkB,CAAC;AAE5D,kEAAkE;AAClE,eAAO,MAAM,MAAM,SAAU,QAAQ,aAC6B,CAAC;AAInE;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,SAAU,QAAQ;aAInB,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IActD,8FAA8F;kBAChF,MAAM;IACpB,gGAAgG;kBAClF,MAAM;CAIvB,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,SAAS,SAAU,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,WACG,CAAC"}

package/dist/cloudflare/mesh-node-lifecycle.d.ts

@@ -0,0 +1,22 @@
+import * as Effect from 'effect/Effect';
+import { MeshNodeError } from './mesh-node-api.ts';
+import { type MeshNodeAttributes, type MeshNodeProps } from './mesh-node-form.ts';
+/**
+ * Owned: refresh by the stored id. Cold: find the live node by exact name and hand it back
+ * `Unowned`, so Alchemy refuses to take it over until the stack says `adopt(true)` — the same
+ * gate `Cloudflare.Tunnel.WarpConnector` uses, because a `warp_connector` carries no ownership
+ * marker to prove it was ours.
+ *
+ * ⚠️ ADOPTION RECORDS THE DECLARED `ha`, BECAUSE NOTHING ELSE CAN. No documented read returns a
+ *   node's HA flag. Adopting an existing node with the wrong `ha` records the wrong value, and no
+ *   later plan can notice. Check the node's HA badge in the dashboard before adopting.
+ */
+export declare const readMeshNode: (accountId: string, olds: MeshNodeProps | undefined, output: MeshNodeAttributes | undefined) => Effect.Effect<MeshNodeAttributes | undefined, MeshNodeError | import("@distilled.cloud/cloudflare/zero-trust").ListTunnelWarpConnectorsError, import("@distilled.cloud/cloudflare/Protocol").CloudflareOpContext>;
+export declare const reconcileMeshNode: (accountId: string, news: MeshNodeProps, output: MeshNodeAttributes | undefined) => Effect.Effect<MeshNodeAttributes, import("@distilled.cloud/cloudflare/zero-trust").Forbidden | MeshNodeError | import("@distilled.cloud/cloudflare/zero-trust").TunnelNotFound | import("@distilled.cloud/cloudflare/Protocol").CloudflareOpError, import("@distilled.cloud/cloudflare/Protocol").CloudflareOpContext>;
+/**
+ * ⚠️ Cloudflare may refuse to delete a node while replicas are connected (Alchemy's WarpConnector
+ *   notes "Deleting requires all connector sessions to be down"; unmeasured here). Stop the
+ *   client on every replica first. A node already gone is a successful delete.
+ */
+export declare const deleteMeshNode: (output: MeshNodeAttributes) => Effect.Effect<void, import("@distilled.cloud/cloudflare/zero-trust").Forbidden | import("@distilled.cloud/cloudflare/Protocol").CloudflareOpError, import("@distilled.cloud/cloudflare/Protocol").CloudflareOpContext>;
+//# sourceMappingURL=mesh-node-lifecycle.d.ts.map

package/dist/cloudflare/mesh-node-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh-node-lifecycle.d.ts","sourceRoot":"","sources":["../../src/cloudflare/mesh-node-lifecycle.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,aAAa,EAOd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,aAAa,EAAoB,MAAM,qBAAqB,CAAC;AAUpG;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,cACZ,MAAM,QACX,aAAa,GAAG,SAAS,UACvB,kBAAkB,GAAG,SAAS,sNAapC,CAAC;AAoGL,eAAO,MAAM,iBAAiB,cACjB,MAAM,QACX,aAAa,UACX,kBAAkB,GAAG,SAAS,2TAwBpC,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,cAAc,WAAY,kBAAkB,2NAChB,CAAC"}

package/dist/cloudflare/mesh-node-token.d.ts

@@ -0,0 +1,23 @@
+import * as zeroTrust from '@distilled.cloud/cloudflare/zero-trust';
+import * as Effect from 'effect/Effect';
+import * as Redacted from 'effect/Redacted';
+import { MeshNodeError } from './mesh-node-api.ts';
+/** Which node: by id (the `MeshNode` attribute) or by its exact name. */
+export type MeshNodeRef = {
+    readonly accountId: string;
+} & ({
+    readonly id: string;
+    readonly name?: undefined;
+} | {
+    readonly name: string;
+    readonly id?: undefined;
+});
+/**
+ * ⛔ An EMPTY token fails closed: `warp-cli connector new ""` would not enrol, and a script that
+ *   wrote an empty file would report success over a host that never joined.
+ * ⛔ The failures made here name the node and account and quote no response body, because the
+ *   success body IS the token. Other SDK errors pass through; they come only from non-2xx
+ *   responses, which carry an error envelope, not a token.
+ */
+export declare const fetchMeshNodeToken: (ref: MeshNodeRef) => Effect.Effect<Redacted.Redacted<string>, import("@distilled.cloud/cloudflare/Errors").BadGateway | import("@distilled.cloud/cloudflare/Errors").CloudflareError | import("@distilled.cloud/cloudflare/Errors").CloudflareHttpError | import("@distilled.cloud/cloudflare/Errors").CloudflareParseError | import("@distilled.cloud/cloudflare/Errors").CloudflareRateLimited | import("@distilled.cloud/cloudflare/Errors").ConfigError | zeroTrust.Forbidden | import("@distilled.cloud/cloudflare/Errors").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/cloudflare/Errors").InternalServerError | import("@distilled.cloud/cloudflare/Errors").InvalidRoute | MeshNodeError | import("@distilled.cloud/cloudflare/Credentials").OAuthRefreshError | import("@distilled.cloud/cloudflare/Errors").ServiceUnavailable | import("@distilled.cloud/cloudflare/Errors").TooManyRequests | import("@distilled.cloud/cloudflare/Errors").Unauthorized | import("@distilled.cloud/cloudflare/Errors").UnknownCloudflareError, zeroTrust.CloudflareOpContext>;
+//# sourceMappingURL=mesh-node-token.d.ts.map

package/dist/cloudflare/mesh-node-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh-node-token.d.ts","sourceRoot":"","sources":["../../src/cloudflare/mesh-node-token.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAkB,MAAM,oBAAoB,CAAC;AAEnE,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,CACvD;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,CAAA;CAAE,CACrD,CAAC;AAoDF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAAS,WAAW,wjCA4B/C,CAAC"}

package/dist/cloudflare/mesh-node.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `Cloudflare.MeshNode` — a Cloudflare Mesh node (a `warp_connector` object), declared without
+ * its token ever touching Alchemy state. Usage and the enrolment step: docs/mesh-node.md.
+ *
+ * 🔴 WHY THIS EXISTS ALONGSIDE `Cloudflare.Tunnel.WarpConnector`. A Mesh node that fronts a
+ *   private service needs a node record in the graph, so the Gateway rules and DNS records that
+ *   name it deploy together. Alchemy beta.79's WarpConnector would put the node token — the
+ *   credential that lets any Linux host join the account's Mesh as that node — into plaintext
+ *   state on every read, and it cannot create an HA node. See mesh-node-form.ts.
+ *
+ * ★ REMOVAL POLICY: `retain` BY DEFAULT — see the ★ on `MeshNode` below, and what it does to an
+ *   `ha` replace in mesh-node-lifecycle.ts.
+ */
+import { Credentials } from '@distilled.cloud/cloudflare/Credentials';
+import * as Cloudflare from 'alchemy/Cloudflare';
+import * as Provider from 'alchemy/Provider';
+import { Resource, type ResourceClass } from 'alchemy/Resource';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type MeshNodeAttributes, type MeshNodeProps } from './mesh-node-form.ts';
+import type { Providers } from './providers.ts';
+export interface MeshNode extends Resource<'Cloudflare.MeshNode', MeshNodeProps, MeshNodeAttributes, never, Providers> {
+}
+/**
+ * ★ `defaultRemovalPolicy: 'retain'`, LIKE EVERY KIT RESOURCE WHOSE DELETION BREAKS ITS CONSUMERS
+ *   (the `Bao.*` families, `R2BucketLock`, the Proxmox storage families; the reasoning is written
+ *   once in proxmox/resource.ts). Deleting a node cuts every enrolled replica off the Mesh, and
+ *   nothing brings it back: a new node has a new id, a new token and a new Mesh IP per replica, so
+ *   each host must be re-enrolled by hand and every Gateway rule or allow-list that pins the old
+ *   Mesh IP breaks. So dropping the declaration, or `alchemy destroy`, leaves the node live.
+ * ⚠️ IT ALSO SKIPS THE OLD NODE'S DELETE IN A REPLACE (Apply.ts, `deleteOldGenerations` and the
+ *   GC's `retainOldGeneration`, beta.79). A same-name `ha` change therefore REFUSES, deleting
+ *   nothing, until that deploy opts in with `.pipe(RemovalPolicy.destroy())`; a create-first
+ *   replace leaves the old node live and unmanaged. Both measured in mesh-node-policy.test.ts.
+ * ⛔ `delete` STAYS FULLY IMPLEMENTED. Retain is Terraform's `prevent_destroy`, not a stub: it runs
+ *   the moment a declaration opts in with `.pipe(RemovalPolicy.destroy())`.
+ */
+export declare const MeshNode: ResourceClass<MeshNode>;
+/** What every call below needs: the account, credentials and HTTP — Alchemy's own trio. */
+export type MeshNodeServices = Cloudflare.CloudflareEnvironment | Credentials | HttpClient.HttpClient;
+/**
+ * ★ `Provider.effect`, CAPTURING THE THREE SERVICES AT BUILD. `Provider.succeed` (what Alchemy's
+ *   own providers use) leaves each handler to find CloudflareEnvironment and Credentials in the
+ *   engine's context at call time — which works for `Cloudflare.providers()` only because it
+ *   `provideMerge`s them into the stack. Capturing them here keeps this provider correct whether
+ *   or not the stack also merges `Cloudflare.providers()`.
+ */
+export declare const MeshNodeProvider: () => import("effect/Layer").Layer<Provider.Provider<MeshNode>, never, Cloudflare.CloudflareEnvironment | Credentials | HttpClient.HttpClient>;
+//# sourceMappingURL=mesh-node.d.ts.map

package/dist/cloudflare/mesh-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh-node.d.ts","sourceRoot":"","sources":["../../src/cloudflare/mesh-node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACtE,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAGnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAE3C,CAAC;AAEH,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GACxB,UAAU,CAAC,qBAAqB,GAChC,WAAW,GACX,UAAU,CAAC,UAAU,CAAC;AAQ1B;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,gJA4C1B,CAAC"}

package/dist/cloudflare/providers.d.ts

@@ -1,19 +1,8 @@
-/**
- * The HomeFlare Cloudflare provider collection, in the shape `LiteLLM.providers()` has.
- *
- * ★ ONE LAYER, BUILT ONCE, so the single `Config.Redacted('CLOUDFLARE_API_TOKEN')` read is shared
- *   by every resource in the stack rather than repeated per resource.
- *
- * ⚠️ THIS IS NOT `alchemy/Cloudflare`'s COLLECTION AND DOES NOT REPLACE IT. A stack that declares
- *   both a `Cloudflare.R2.Bucket` and this lock merges the two:
- *   `Layer.mergeAll(Cloudflare.providers(), HomeflareCloudflare.providers())` — the shape
- *   a consuming stack names for one talking to more than one account.
- */
 import * as Provider from 'alchemy/Provider';
 import * as Layer from 'effect/Layer';
 declare const Providers_base: Provider.ProviderCollection<Providers, "HomeflareCloudflare">;
 export declare class Providers extends Providers_base {
 }
-export declare const providers: () => Layer.Layer<import("./client.ts").CloudflareApi | Providers, never, never>;
+export declare const providers: () => Layer.Layer<import("./client.ts").CloudflareApi | Providers, never, import("alchemy").AuthProviders | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/unstable/http/HttpClient").HttpClient | import("effect/Path").Path>;
 export {};
 //# sourceMappingURL=providers.d.ts.map

package/dist/cloudflare/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/cloudflare/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AAItC,qBAAa,SAAU,SAAQ,cAA+D;CAAG;AAEjG,eAAO,MAAM,SAAS,kFAInB,CAAC"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/cloudflare/providers.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AAKtC,qBAAa,SAAU,SAAQ,cAA+D;CAAG;AAEjG,eAAO,MAAM,SAAS,sVAWnB,CAAC"}

package/dist/index.d.ts

@@ -9,6 +9,8 @@
  *     import { BaoMount } from '@homeflare/alchemy/openbao';
  *     import { TalosCluster } from '@homeflare/alchemy/talos';
  *     import { ProxmoxAcl } from '@homeflare/alchemy/proxmox';
+ *     import { LaunchdJob } from '@homeflare/alchemy/launchd';
+ *     import { CaddyConfig } from '@homeflare/alchemy/caddy';
  *
  * ★ WHY THESE EXIST AT ALL. When Alchemy has no resource for something, the alternative
  *   is a runbook step a human runs once — and a plan can never show a missing runbook

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC"}

package/dist/launchd/fake-runner.d.ts

@@ -0,0 +1,36 @@
+import type { ExecResult, FileStat, HostRunner, HostUser } from './runner.ts';
+type Entry = {
+    bytes: Uint8Array;
+    mode: number;
+    uid: number;
+    gid: number;
+    kind: FileStat['kind'];
+};
+export type FakeOptions = {
+    euid?: number;
+    privileged?: boolean;
+    /** Directories that exist, and their owner uid. */
+    dirs?: Record<string, number>;
+    users?: Record<string, HostUser>;
+    groups?: Record<string, number>;
+};
+export declare const fakeRunner: (options?: FakeOptions) => {
+    calls: string[][];
+    disabled: Set<string>;
+    dirs: Map<string, number>;
+    files: Map<string, Entry>;
+    loaded: Map<string, number | undefined>;
+    runner: HostRunner;
+    state: {
+        lingerPrints: number;
+        nextPid: number;
+        bootstrapFailure: ExecResult | undefined;
+        /** Returned by bootout in place of success. The job still goes, unless `bootoutKeepsJob`. */
+        bootoutFailure: ExecResult | undefined;
+        bootoutKeepsJob: boolean;
+        /** gui uids with no login session: every launchctl call into `gui/<uid>` exits 112. */
+        loggedOut: Set<number>;
+    };
+};
+export {};
+//# sourceMappingURL=fake-runner.d.ts.map

package/dist/launchd/fake-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/fake-runner.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAgB,MAAM,aAAa,CAAC;AAE5F,KAAK,KAAK,GAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC;AAEnG,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AA0BF,eAAO,MAAM,UAAU,aAAa,WAAW;;;;;;;;;;0BAaZ,UAAU,GAAG,SAAS;QACrD,6FAA6F;wBAChE,UAAU,GAAG,SAAS;;QAEnD,uFAAuF;;;CA4G1F,CAAC"}

package/dist/launchd/host-effect.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The one place a HostRunner's promises become Effects — plus the one probe of an unresolved
+ * `news` both providers' diffs share.
+ *
+ * ★ The lifecycle files are plain async functions over a HostRunner (see runner.ts for why the
+ *   runner is promise-based), so each provider handler is a single `lift(() => step(runner, …))`.
+ * ⚠️ A thrown Error stays that Error — its message is the refusal a deploy prints. Anything else
+ *   thrown is wrapped, so the failure channel is always an Error with a readable message.
+ */
+import * as Effect from 'effect/Effect';
+export declare const lift: <A>(step: () => Promise<A>) => Effect.Effect<A, Error>;
+/**
+ * A string prop of a diff's `news`, when that one prop is already resolved; `undefined` while it
+ * is still an Output (a function-typed proxy), an Effect or a Config.
+ * ★ For the identity props a diff must see even when the rest of `news` is unresolved — a plain
+ *   string is resolved by definition, so `typeof` is the whole test.
+ */
+export declare const resolvedString: (news: unknown, key: string) => string | undefined;
+//# sourceMappingURL=host-effect.d.ts.map

package/dist/launchd/host-effect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-effect.d.ts","sourceRoot":"","sources":["../../src/launchd/host-effect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,IAAI,GAAI,CAAC,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAInE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC"}

package/dist/launchd/host-file-form.d.ts

@@ -0,0 +1,24 @@
+export interface HostFileProps {
+    /** Absolute path. The parent directory must already exist. */
+    path: string;
+    /** UTF-8 text. ⛔ Never a secret — see the file header. */
+    content: string;
+    /** Permission bits. @default 0o644 */
+    mode?: number;
+    /** User name or numeric uid. Omitted: whoever the runner writes as (a rewrite keeps no owner). */
+    owner?: string | number;
+    /** Group name or numeric gid. Omitted: the directory's default group. */
+    group?: string | number;
+}
+export interface HostFileAttributes {
+    path: string;
+    /** SHA-256 of the bytes on disk. */
+    sha256: string;
+    mode: number;
+    uid: number;
+    gid: number;
+    size: number;
+}
+export declare const DEFAULT_MODE = 420;
+export declare const fileProblems: (props: HostFileProps) => string[];
+//# sourceMappingURL=host-file-form.d.ts.map

package/dist/launchd/host-file-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-file-form.d.ts","sourceRoot":"","sources":["../../src/launchd/host-file-form.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kGAAkG;IAClG,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,YAAY,MAAQ,CAAC;AAclC,eAAO,MAAM,YAAY,UAAW,aAAa,KAAG,MAAM,EAsBzD,CAAC"}

package/dist/launchd/host-file-lifecycle.d.ts

@@ -0,0 +1,29 @@
+/**
+ * HostFile's read / diff / reconcile / delete as plain async functions over a HostRunner, so the
+ * lifecycle runs against fake-runner.ts in tests.
+ *
+ * ⛔ SYMLINKS AND DIRECTORIES ARE REFUSED, NOT REPLACED. rename(2) over a symlink replaces the LINK,
+ *   so a path that is a symlink (nix-darwin's /etc entries point into /nix/store) would be quietly
+ *   taken from the tool that owns it — which puts it back, or refuses its next activation. Remove
+ *   the path from its owner first, then declare it here.
+ */
+import type { Diff } from 'alchemy/Diff';
+import { type HostFileAttributes, type HostFileProps } from './host-file-form.ts';
+import { type HostRunner } from './runner.ts';
+type Desired = {
+    readonly bytes: Uint8Array;
+    readonly sha256: string;
+    readonly mode: number;
+    readonly uid?: number;
+    readonly gid?: number;
+};
+/** Validate, then resolve owner/group names to ids through the runner. */
+export declare const desiredFile: (runner: HostRunner, props: HostFileProps) => Promise<Desired>;
+/** The file as it is now, or `undefined` when nothing is at the path. Non-files read with no digest. */
+export declare const readFileAttributes: (runner: HostRunner, path: string) => Promise<HostFileAttributes | undefined>;
+export declare const diffFile: (runner: HostRunner, news: HostFileProps, output: HostFileAttributes) => Promise<Diff>;
+export declare const reconcileFile: (runner: HostRunner, props: HostFileProps, output?: HostFileAttributes) => Promise<HostFileAttributes>;
+/** Remove the file. Idempotent. ⛔ Refuses a path that has since become a symlink or directory. */
+export declare const deleteFile: (runner: HostRunner, output: HostFileAttributes) => Promise<void>;
+export {};
+//# sourceMappingURL=host-file-lifecycle.d.ts.map

package/dist/launchd/host-file-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-file-lifecycle.d.ts","sourceRoot":"","sources":["../../src/launchd/host-file-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAEnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,aAAa,CAAC;AAE5D,KAAK,OAAO,GAAG;IACb,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAOF,0EAA0E;AAC1E,eAAO,MAAM,WAAW,WAAkB,UAAU,SAAS,aAAa,KAAG,OAAO,CAAC,OAAO,CAqB3F,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,kBAAkB,WACrB,UAAU,QACZ,MAAM,KACX,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAYxC,CAAC;AAQF,eAAO,MAAM,QAAQ,WACX,UAAU,QACZ,aAAa,UACX,kBAAkB,KACzB,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,eAAO,MAAM,aAAa,WAChB,UAAU,SACX,aAAa,WACX,kBAAkB,KAC1B,OAAO,CAAC,kBAAkB,CA0D5B,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,UAAU,WAAkB,UAAU,UAAU,kBAAkB,KAAG,OAAO,CAAC,IAAI,CAK7F,CAAC"}

package/dist/launchd/host-file.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `Host.File` — one text file on the host, declared: content, mode, owner, group.
+ *
+ * - create / update — atomic write (temp file in the same directory, mode and owner set, rename),
+ *   skipped when the file already matches; then read back and compared.
+ * - read — lstat plus the SHA-256 of the bytes.
+ * - diff — declared SHA-256 against the stored and on-disk digest, plus mode and owner.
+ * - replace — only when `path` changes; create-before-delete.
+ * - delete — removes the file.
+ *
+ * ⛔ NEVER A SECRET — see host-file-form.ts. Secret files stay rendered by openbao-agent.
+ * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`: a file already at the path reads as `Unowned`.
+ * ★ IT LIVES IN THE launchd SUBPATH because the two travel together: a Mac host stack declares a
+ *   daemon's config file and the daemon that reads it, through the same HostRunner.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type { HostFileAttributes, HostFileProps } from './host-file-form.ts';
+import { HostRunnerService } from './runner.ts';
+export type { HostFileAttributes, HostFileProps } from './host-file-form.ts';
+export interface HostFile extends Resource<'Host.File', HostFileProps, HostFileAttributes> {
+}
+export declare const HostFile: import("alchemy").ResourceClass<HostFile>;
+export declare const HostFileProvider: () => import("effect/Layer").Layer<Provider.Provider<HostFile>, never, HostRunnerService>;
+//# sourceMappingURL=host-file.d.ts.map

package/dist/launchd/host-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-file.d.ts","sourceRoot":"","sources":["../../src/launchd/host-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,MAAM,WAAW,QAAS,SAAQ,QAAQ,CAAC,WAAW,EAAE,aAAa,EAAE,kBAAkB,CAAC;CAAG;AAE7F,eAAO,MAAM,QAAQ,2CAAkC,CAAC;AAExD,eAAO,MAAM,gBAAgB,2FAgC1B,CAAC"}

package/dist/launchd/host-lookup.d.ts

@@ -0,0 +1,27 @@
+/**
+ * User and group lookups, as argv plus a parser — split out so the parsing is tested against the
+ * real output shapes without running anything.
+ *
+ * ★ macOS FIRST, getent ELSEWHERE. macOS has no `getent`; its directory service answers through
+ *   `dscacheutil`. Shape MEASURED 2026-09-21 on macOS 27.2 (read-only query):
+ *
+ *     name: someone
+ *     password: ********
+ *     uid: 501
+ *     gid: 20
+ *     dir: /Users/someone
+ *     shell: /bin/zsh
+ *
+ *   An unknown uid printed NOTHING and exited 0 — so "no record" is an empty parse, never an
+ *   exit code. `getent` exits 2 for an unknown key; that also parses as no record.
+ * ⛔ NEVER PARSE OR KEEP THE `password:` LINE. It is a placeholder on macOS, but a parser that
+ *   copies every field would carry a hash from any host where it is not.
+ */
+import type { HostUser } from './runner.ts';
+/** argv for looking up a user, by name or numeric id. */
+export declare const userQuery: (platform: string, nameOrId: string) => readonly string[];
+/** argv for looking up a group, by name or numeric id. */
+export declare const groupQuery: (platform: string, nameOrId: string) => readonly string[];
+export declare const parseUser: (platform: string, stdout: string) => HostUser | undefined;
+export declare const parseGroup: (platform: string, stdout: string) => number | undefined;
+//# sourceMappingURL=host-lookup.d.ts.map

package/dist/launchd/host-lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-lookup.d.ts","sourceRoot":"","sources":["../../src/launchd/host-lookup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,yDAAyD;AACzD,eAAO,MAAM,SAAS,aAAc,MAAM,YAAY,MAAM,KAAG,SAAS,MAAM,EAU1C,CAAC;AAErC,0DAA0D;AAC1D,eAAO,MAAM,UAAU,aAAc,MAAM,YAAY,MAAM,KAAG,SAAS,MAAM,EAU5C,CAAC;AAsBpC,eAAO,MAAM,SAAS,aAAc,MAAM,UAAU,MAAM,KAAG,QAAQ,GAAG,SAkBvE,CAAC;AAEF,eAAO,MAAM,UAAU,aAAc,MAAM,UAAU,MAAM,KAAG,MAAM,GAAG,SAItE,CAAC"}

package/dist/launchd/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * launchd providers for Alchemy — declare a Mac host's jobs and their config files.
+ *
+ * ⛔ THIS BARREL IS THE PUBLIC API, AND IT IS DELIBERATELY SMALLER THAN THE DIRECTORY. The
+ *   lifecycle files, the launchctl parsers and the fake runner are internals; an `export *` would
+ *   publish them as API and make the next refactor a breaking change.
+ * ⛔ macOS HOSTS ONLY for LaunchdJob. HostFile and the runner work on any POSIX host, but the
+ *   subpath exists for the Mac: see docs/launchd.md for the cutover from nix-darwin.
+ */
+export type { HostFileAttributes, HostFileProps } from './host-file.ts';
+export { HostFile, HostFileProvider } from './host-file.ts';
+export type { CalendarInterval, KeepAlive, LaunchdDomain, LaunchdJobAttributes, LaunchdJobProps, } from './job.ts';
+export { LaunchdJob, LaunchdJobProvider } from './job.ts';
+export type { LocalRunnerOptions } from './local-runner.ts';
+export { localRunner } from './local-runner.ts';
+export type { PlistDict, PlistValue } from './plist.ts';
+export { PlistError, renderPlist } from './plist.ts';
+export { launchdProviders } from './providers.ts';
+export type { ExecResult, FileStat, HostRunner, HostUser, WriteOptions } from './runner.ts';
+export { HostRunnerService, canActAsRoot, hostRunnerLayer } from './runner.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/launchd/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/launchd/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,eAAe,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}