@homeflare/alchemy 0.51.0 → 0.52.0

package/dist/linux/container-env-quote.d.ts

@@ -0,0 +1,39 @@
+/** Same shape as container-form.ts's `UnitLine` — structural, so this module imports nothing back. */
+export type EnvironmentLine = readonly [key: string, value: string];
+declare const QuadletEnvironmentValueError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "QuadletEnvironmentValueError";
+} & Readonly<A>;
+/**
+ * ⛔ CARRIES THE KEY AND THE RULE, NEVER THE VALUE — an error is logged, retried and pasted into a
+ * PR, and a newline-containing value may be arbitrarily large or semi-secret; the key name (which
+ * `secretLikeEnvironment` already names in its own messages) is enough to locate the prop.
+ */
+export declare class QuadletEnvironmentValueError extends QuadletEnvironmentValueError_base<{
+    readonly key: string;
+}> {
+    get message(): string;
+}
+/**
+ * `Environment="KEY=value"` — the whole assignment double-quoted, with `\`, `"`, `%` and `$`
+ * escaped (in that order, over the joined `KEY=value`), so the wrapping quotes this function adds
+ * can never be confused with quotes the value contained, every `%` reaches systemd's specifier
+ * expansion as the documented `%%` literal instead of an unknown `%x` that invalidates the unit,
+ * and every `$` reaches it as `$$` — the documented literal-dollar escape (systemd.service(5)
+ * §Command lines) — instead of a `${FOO}` systemd would erase and replace with a variable of ITS
+ * choosing, or a `$$` it would fold and halve.
+ */
+export declare const quoteEnvironmentValue: (key: string, value: string) => string;
+/**
+ * The sorted, quoted `Environment=` lines of a `[Container]` section — spliced by container-form.ts
+ * between `EnvironmentFile=` and `Volume=`, exactly where the unquoted renderer emitted them, so
+ * the render ORDER does not change (only the bytes of the Environment lines themselves do).
+ */
+export declare const environmentLines: (environment: Readonly<Record<string, string>>) => readonly EnvironmentLine[];
+/**
+ * The newline refusal as problem STRINGS (containerProblems' currency), so one plan still shows the
+ * whole list instead of aborting on the first newline — the typed error above stays the contract
+ * for anyone rendering directly.
+ */
+export declare const environmentValueProblems: (environment: Readonly<Record<string, string>>) => string[];
+export {};
+//# sourceMappingURL=container-env-quote.d.ts.map

package/dist/linux/container-env-quote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-env-quote.d.ts","sourceRoot":"","sources":["../../src/linux/container-env-quote.ts"],"names":[],"mappings":"AA6CA,sGAAsG;AACtG,MAAM,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;;;;AAQpE;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,kCAAiD;IACjG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,QAAS,MAAM,SAAS,MAAM,KAAG,MAYlE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,gBACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAC5C,SAAS,eAAe,EAMoE,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,gBACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAC5C,MAAM,EAaR,CAAC"}

package/dist/linux/container-form.d.ts

@@ -16,14 +16,25 @@
  *   `containerProblems` below. A container that needs a secret takes `EnvironmentFile=` pointing at
  *   a host path an out-of-band secret renderer (openbao-agent) maintains; this family never reads
  *   or renders that file's contents.
+ * ⛔ `Environment=` VALUES ARE ALWAYS QUOTED, VIA container-env-quote.ts — measured 2026-10-11:
+ *   unquoted, a spaced value splits at its first space, a quoted fragment re-parses into a bogus
+ *   variable, and an unknown C escape drops the line's assignments silently (ice2/grafana-oidc.md;
+ *   the live podman 5.4.2 generator reproduced all three). Quoting costs the PARSE nothing — the
+ *   generator reads a quoted line as exactly one assignment — and it also stops systemd expanding
+ *   `%` specifiers in values. It is NOT free at deploy: every Environment line's BYTES change, so
+ *   the first deploy after this bump rewrites the file and RESTARTS every container declaring
+ *   `environment` (all 13 on ct100; only grafana's values change meaning) — plan it as one window.
+ *   Newlines are refused, never encoded (same module).
  * ⛔ `[Install]` SUPPORTS ONLY `Alias=`/`WantedBy=`/`RequiredBy=` FOR A `.container` FILE (same doc,
  *   "Currently, only the Alias, WantedBy and RequiredBy keys are supported") — NOT `Also=`, which
  *   plain `systemd.unit(5)` allows and unit-text.ts's `INSTALL_KEYS` therefore lists. See
  *   container-generator.ts's header for why there is no `enabled` prop at all.
  */
 import { configDigest, digestOf } from './unit-form.ts';
+import { QUADLET_DEFAULT_DIRECTORY, QUADLET_SEARCH_DIRECTORIES } from './container-paths.ts';
 /** ★ Reused, not redefined: same digest and `restartOn`-join contract as Systemd.Unit. */
 export { configDigest, digestOf };
+export { QUADLET_DEFAULT_DIRECTORY, QUADLET_SEARCH_DIRECTORIES };
 export type UnitLine = readonly [key: string, value: string];
 /**
  * The `[Container]` keys this family supports — a deliberate SUBSET of the ~80 keys
@@ -59,7 +70,8 @@ export type ContainerSection = {
 export type ContainerProps = {
     /** The Quadlet file's basename, WITHOUT `.container`. Written as `<name>.container`. */
     name: string;
-    /** @default QUADLET_DEFAULT_DIRECTORY. Must be one of QUADLET_SEARCH_DIRECTORIES (below). */
+    /** @default QUADLET_DEFAULT_DIRECTORY. Must be one of QUADLET_SEARCH_DIRECTORIES
+     *  (container-paths.ts, where the search path now lives). */
     directory?: string;
     /** `[Unit]` — `Description=`/`Documentation=` typed, everything else verbatim (see file header). */
     unit?: {
@@ -104,19 +116,8 @@ export type ContainerAttributes = {
     active: boolean;
 };
 /**
- * Podman's OWN rootful search path, most specific first — `podman-systemd.unit(5)`, "Podman Unit
- * Search Path", Podman 5.4, read 2026-09-24: "Quadlet files for the root user can be placed in the
- * following directories ordered in precedence" (`/run` over `/etc` over `/usr/share`).
- * ★ CT100's `caddy.container` lives in the middle one — measured live, `cat` over `ssh ct100`,
- *   2026-09-24: `/etc/containers/systemd/caddy.container`.
- * ⛔ A directory outside this list is invisible to Quadlet: the generator only reads these three, so
- *   a file elsewhere is a `.container` file with no `.service` ever generated from it — silently,
- *   unlike `Systemd.Unit`'s directory check, which at least writes a unit systemd could load if only
- *   it were enabled. See `containerProblems`.
+ * ★ A conservative subset of what Quadlet itself accepts as a unit name: no template `@`, no `/`.
  */
-export declare const QUADLET_SEARCH_DIRECTORIES: readonly ['/run/containers/systemd', '/etc/containers/systemd', '/usr/share/containers/systemd'];
-export declare const QUADLET_DEFAULT_DIRECTORY = "/etc/containers/systemd";
-/** ★ A conservative subset of what Quadlet itself accepts as a unit name: no template `@`, no `/`. */
 export declare const NAME: RegExp;
 export declare const containerPathFor: (props: Pick<ContainerProps, 'name' | 'directory'>) => string;
 /** The unit Quadlet generates FROM the `.container` file — systemctl only ever sees this name. */

package/dist/linux/container-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-form.d.ts","sourceRoot":"","sources":["../../src/linux/container-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAoB,YAAY,EAAE,QAAQ,EAAc,MAAM,gBAAgB,CAAC;AAGtF,0FAA0F;AAC1F,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAElC,MAAM,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,qGAAqG;IACrG,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,yFAAyF;IACzF,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,qGAAqG;IACrG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,oGAAoG;IACpG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,yGAAyG;IACzG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC3C,gGAAgG;IAChG,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAA;KAAE,CAAC;IACrF,4DAA4D;IAC5D,SAAS,EAAE,gBAAgB,CAAC;IAC5B,8EAA8E;IAC9E,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAA;KAAE,CAAC;IACjF,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC/B,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC3B,CAAC;IACF;yGACqG;IACrG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yGAAyG;IACzG,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;6FACyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,YACrC,yBAAyB,EACzB,yBAAyB,EACzB,+BAA+B,CACvB,CAAC;AAEX,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,sGAAsG;AACtG,eAAO,MAAM,IAAI,QAAiC,CAAC;AAEnD,eAAO,MAAM,gBAAgB,UAAW,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,WAAW,CAAC,KAAG,MACV,CAAC;AAE5E,kGAAkG;AAClG,eAAO,MAAM,cAAc,UAAW,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,KAAG,MAC5C,CAAC;AA8C1B,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,UAAW,cAAc,KAAG,MAQ3D,CAAC;AAEF,eAAO,MAAM,eAAe,SAAU,MAAM,WAAW,MAAM,KAAG,KACb,CAAC;AAEpD,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,UAAW,cAAc,KAAG,MAAM,EAkD/D,CAAC"}
+{"version":3,"file":"container-form.d.ts","sourceRoot":"","sources":["../../src/linux/container-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAoB,YAAY,EAAE,QAAQ,EAAc,MAAM,gBAAgB,CAAC;AAGtF,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAE7F,0FAA0F;AAC1F,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAGlC,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,CAAC;AAEjE,MAAM,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,qGAAqG;IACrG,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,yFAAyF;IACzF,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,qGAAqG;IACrG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,oGAAoG;IACpG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,yGAAyG;IACzG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC3C,gGAAgG;IAChG,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb;iEAC6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAA;KAAE,CAAC;IACrF,4DAA4D;IAC5D,SAAS,EAAE,gBAAgB,CAAC;IAC5B,8EAA8E;IAC9E,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAA;KAAE,CAAC;IACjF,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC/B,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC3B,CAAC;IACF;yGACqG;IACrG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yGAAyG;IACzG,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;6FACyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,IAAI,QAAiC,CAAC;AAEnD,eAAO,MAAM,gBAAgB,UAAW,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,WAAW,CAAC,KAAG,MACV,CAAC;AAE5E,kGAAkG;AAClG,eAAO,MAAM,cAAc,UAAW,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,KAAG,MAC5C,CAAC;AAyC1B,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,UAAW,cAAc,KAAG,MAQ3D,CAAC;AAEF,eAAO,MAAM,eAAe,SAAU,MAAM,WAAW,MAAM,KAAG,KACb,CAAC;AAEpD,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,UAAW,cAAc,KAAG,MAAM,EA6D/D,CAAC"}

package/dist/linux/container-paths.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Where Quadlet looks for `.container` files — split out of container-form.ts under the file-length
+ * cap, with the measured context that justifies every entry kept intact.
+ *
+ * Podman's OWN rootful search path, most specific first — `podman-systemd.unit(5)`, "Podman Unit
+ * Search Path", Podman 5.4, read 2026-09-24: "Quadlet files for the root user can be placed in the
+ * following directories ordered in precedence" (`/run` over `/etc` over `/usr/share`).
+ * ★ CT100's `caddy.container` lives in the middle one — measured live, `cat` over `ssh ct100`,
+ *   2026-09-24: `/etc/containers/systemd/caddy.container`.
+ * ⛔ A directory outside this list is invisible to Quadlet: the generator only reads these three, so
+ *   a file elsewhere is a `.container` file with no `.service` ever generated from it — silently,
+ *   unlike `Systemd.Unit`'s directory check, which at least writes a unit systemd could load if only
+ *   it were enabled. See `containerProblems`.
+ */
+export declare const QUADLET_SEARCH_DIRECTORIES: readonly ['/run/containers/systemd', '/etc/containers/systemd', '/usr/share/containers/systemd'];
+export declare const QUADLET_DEFAULT_DIRECTORY = "/etc/containers/systemd";
+//# sourceMappingURL=container-paths.d.ts.map

package/dist/linux/container-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-paths.d.ts","sourceRoot":"","sources":["../../src/linux/container-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,YACrC,yBAAyB,EACzB,yBAAyB,EACzB,+BAA+B,CACvB,CAAC;AAEX,eAAO,MAAM,yBAAyB,4BAA4B,CAAC"}

package/dist/linux/index.js

@@ -909,13 +909,46 @@ var secretLikeLines = (lines) => {
 };
 var podmanArgsProblems = (args) => args.filter((arg) => ENV_FLAG.test(arg)).map((arg) => `podmanArgs entry ${JSON.stringify(arg)} sets a container environment variable outside ` + "the typed props, which this family never checks for a secret. Use container.environment " + "(checked) or container.environmentFile (for anything secret) instead.");
 
-// src/linux/container-form.ts
+// src/linux/container-env-quote.ts
+import * as Data from "effect/Data";
+var environmentValueProblem = (key) => `environment key ${JSON.stringify(key)} contains a newline; a .container file is line-based, ` + "so quadlet would end the assignment mid-value and parse whatever follows as a new directive. " + "Nothing was written.";
+
+class QuadletEnvironmentValueError extends Data.TaggedError("QuadletEnvironmentValueError") {
+  get message() {
+    return environmentValueProblem(this.key);
+  }
+}
+var quoteEnvironmentValue = (key, value) => {
+  if (key.includes(`
+`) || value.includes(`
+`))
+    throw new QuadletEnvironmentValueError({ key });
+  return `"${`${key}=${value}`.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("%", "%%").replaceAll("$", () => "$$")}"`;
+};
+var environmentLines = (environment) => Object.entries(environment).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, value]) => ["Environment", quoteEnvironmentValue(key, value)]);
+var environmentValueProblems = (environment) => {
+  const found = [];
+  for (const [key, value] of Object.entries(environment).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+    try {
+      quoteEnvironmentValue(key, value);
+    } catch (error) {
+      if (!(error instanceof QuadletEnvironmentValueError))
+        throw error;
+      found.push(environmentValueProblem(key));
+    }
+  }
+  return found;
+};
+
+// src/linux/container-paths.ts
 var QUADLET_SEARCH_DIRECTORIES = [
   "/run/containers/systemd",
   "/etc/containers/systemd",
   "/usr/share/containers/systemd"
 ];
 var QUADLET_DEFAULT_DIRECTORY = "/etc/containers/systemd";
+
+// src/linux/container-form.ts
 var NAME2 = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
 var containerPathFor = (props) => `${props.directory ?? QUADLET_DEFAULT_DIRECTORY}/${props.name}.container`;
 var serviceNameFor = (props) => `${props.name}.service`;
@@ -932,10 +965,7 @@ var containerLines = (c) => [
   ...c.exec === undefined ? [] : [["Exec", c.exec]],
   ...c.autoUpdate === undefined ? [] : [["AutoUpdate", c.autoUpdate]],
   ...(c.environmentFile ?? []).map((file) => ["EnvironmentFile", file]),
-  ...Object.keys(c.environment ?? {}).sort().map((key) => [
-    "Environment",
-    `${key}=${c.environment[key]}`
-  ]),
+  ...environmentLines(c.environment ?? {}),
   ...(c.volume ?? []).map((volume) => ["Volume", volume]),
   ...(c.publishPort ?? []).map((port) => ["PublishPort", port]),
   ...(c.podmanArgs ?? []).map((arg) => ["PodmanArgs", arg])
@@ -978,13 +1008,16 @@ var containerProblems = (props) => {
   }
   found.push(...secretLikeEnvironment(props.container.environment ?? {}).map((problem) => `container.${problem}`));
   found.push(...podmanArgsProblems(props.container.podmanArgs ?? []).map((problem) => `container.${problem}`));
+  const envProblems = environmentValueProblems(props.container.environment ?? {});
+  found.push(...envProblems);
+  const { environment: _env, ...withoutEnvironment } = props.container;
   found.push(...secretLikeLines([
     ...unitLines(props),
-    ...containerLines(props.container).filter(([key]) => key !== "Environment"),
+    ...containerLines(withoutEnvironment),
     ...serviceLines(props),
     ...installLines(props)
   ]));
-  if (renderContainerFile(props).includes("\x00"))
+  if (envProblems.length === 0 && renderContainerFile(props).includes("\x00"))
     found.push("the rendered .container file contains NUL");
   return found;
 };
@@ -3225,5 +3258,5 @@ export {
   sshSudoRunner
 };
 
-//# debugId=FD1877F9498BF32D64756E2164756E21
+//# debugId=32C72A25441D70A164756E2164756E21
 //# sourceMappingURL=index.js.map