@homeflare/alchemy 0.6.0 → 0.8.0

package/dist/cloudflare/mesh-node-harness.d.ts

@@ -0,0 +1,46 @@
+import * as Effect from 'effect/Effect';
+import * as Exit from 'effect/Exit';
+import { type FakeMesh } from './fake-mesh.ts';
+import { MeshNode } from './mesh-node.ts';
+import type { MeshNodeAttributes, MeshNodeProps } from './mesh-node-form.ts';
+export declare const ids: {
+    fqn: string;
+    id: string;
+    instanceId: string;
+};
+export declare const extra: {
+    bindings: never;
+    session: never;
+};
+export type P = Effect.Success<typeof MeshNode.Provider>;
+export declare const handler: <F>(name: string, fn: F | undefined) => F;
+/** Build the provider over the fake (as `accountId`'s environment) and hand it to `use`. */
+export declare const run: <A, E>(fake: FakeMesh, use: (p: P) => Effect.Effect<A, E>, accountId?: string) => Promise<A>;
+export declare const reconcile: (p: P, news: MeshNodeProps, output?: MeshNodeAttributes) => Effect.Effect<MeshNodeAttributes, any, never>;
+export declare const read: (p: P, olds: MeshNodeProps, output?: MeshNodeAttributes) => Effect.Effect<MeshNodeAttributes | undefined, any, never>;
+export declare const diff: (p: P, news: MeshNodeProps, olds: MeshNodeProps, output: MeshNodeAttributes) => Effect.Effect<void | import("alchemy").Diff, any, never>;
+/** A stored attribute set for a node that may or may not exist in the fake. */
+export declare const stored: (accountId: string, over?: Partial<MeshNodeAttributes>) => MeshNodeAttributes;
+export declare const tokenReads: (fake: FakeMesh) => number;
+/** The writes the fake saw, in order: `['POST', 'DELETE', …]`. */
+export declare const writes: (fake: FakeMesh) => string[];
+/**
+ * ★ THE REAL ENGINE, NOT A MODEL OF IT: Alchemy's own `Plan.make` + `apply` over an in-memory
+ *   state store, which is what its Test harness's scratch stacks run (Test/Core.ts
+ *   `scratchStack`), minus the profile, config and telemetry layers a fake Cloudflare does not
+ *   need. Removal policy lives in the engine, so only this can show what it does to a replace.
+ * ⚠️ `FetchHttpClient.Fetch` IS READ PER REQUEST, from the fiber running the engine, so it is
+ *   provided around the whole deploy. Provided only under the provider layer, the requests went
+ *   to the real `fetch` (measured 2026-09-21: ENOTFOUND api.example.com, the RFC 2606 host, so
+ *   no API answered — but a real DNS lookup went out).
+ */
+export declare const engine: (fake: FakeMesh) => {
+    deploy: <A, E, R>(declare: Effect.Effect<A, E, R>) => Promise<Exit.Exit<unknown, unknown>>;
+    /** The stored row's status (`created`, `replacing`, …), or `undefined` when there is none. */
+    status: (fqn: string) => "created" | "creating" | "deleting" | "replaced" | "replacing" | "updated" | "updating" | undefined;
+    /** ★ What `alchemy state rm` does ("Delete state records without deleting cloud resources"). */
+    forget: (fqn: string) => void;
+};
+/** The failure sentence of a deploy, or `''` when it succeeded. */
+export declare const failureOf: (exit: Exit.Exit<unknown, unknown>) => string;
+//# sourceMappingURL=mesh-node-harness.d.ts.map

package/dist/cloudflare/mesh-node-harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh-node-harness.d.ts","sourceRoot":"","sources":["../../src/cloudflare/mesh-node-harness.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAGpC,OAAO,EAAE,KAAK,QAAQ,EAAqB,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAoB,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,eAAO,MAAM,GAAG;IAAK,GAAG;IAAgB,EAAE;IAAU,UAAU;CAAS,CAAC;AACxE,eAAO,MAAM,KAAK;IAAK,QAAQ,EAAQ,KAAK;IAAE,OAAO,EAAe,KAAK;CAAE,CAAC;AAE5E,MAAM,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAEzD,eAAO,MAAM,OAAO,GAAI,CAAC,QAAQ,MAAM,MAAM,CAAC,GAAG,SAAS,KAAG,CAG5D,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,QAAQ,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,MAAM,eAS7F,CAAC;AAEJ,eAAO,MAAM,SAAS,MAAO,CAAC,QAAQ,aAAa,WAAW,kBAAkB,kDACd,CAAC;AAEnE,eAAO,MAAM,IAAI,MAAO,CAAC,QAAQ,aAAa,WAAW,kBAAkB,8DACxB,CAAC;AAEpD,eAAO,MAAM,IAAI,MAAO,CAAC,QAAQ,aAAa,QAAQ,aAAa,UAAU,kBAAkB,6DAW3F,CAAC;AAEL,+EAA+E;AAC/E,eAAO,MAAM,MAAM,cACN,MAAM,SACX,OAAO,CAAC,kBAAkB,CAAC,KAChC,kBAOD,CAAC;AAEH,eAAO,MAAM,UAAU,SAAU,QAAQ,WACkB,CAAC;AAE5D,kEAAkE;AAClE,eAAO,MAAM,MAAM,SAAU,QAAQ,aAC6B,CAAC;AAInE;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,SAAU,QAAQ;aAInB,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IActD,8FAA8F;kBAChF,MAAM;IACpB,gGAAgG;kBAClF,MAAM;CAIvB,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,SAAS,SAAU,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,WACG,CAAC"}

package/dist/cloudflare/mesh-node-lifecycle.d.ts

@@ -0,0 +1,22 @@
+import * as Effect from 'effect/Effect';
+import { MeshNodeError } from './mesh-node-api.ts';
+import { type MeshNodeAttributes, type MeshNodeProps } from './mesh-node-form.ts';
+/**
+ * Owned: refresh by the stored id. Cold: find the live node by exact name and hand it back
+ * `Unowned`, so Alchemy refuses to take it over until the stack says `adopt(true)` — the same
+ * gate `Cloudflare.Tunnel.WarpConnector` uses, because a `warp_connector` carries no ownership
+ * marker to prove it was ours.
+ *
+ * ⚠️ ADOPTION RECORDS THE DECLARED `ha`, BECAUSE NOTHING ELSE CAN. No documented read returns a
+ *   node's HA flag. Adopting an existing node with the wrong `ha` records the wrong value, and no
+ *   later plan can notice. Check the node's HA badge in the dashboard before adopting.
+ */
+export declare const readMeshNode: (accountId: string, olds: MeshNodeProps | undefined, output: MeshNodeAttributes | undefined) => Effect.Effect<MeshNodeAttributes | undefined, MeshNodeError | import("@distilled.cloud/cloudflare/zero-trust").ListTunnelWarpConnectorsError, import("@distilled.cloud/cloudflare/Protocol").CloudflareOpContext>;
+export declare const reconcileMeshNode: (accountId: string, news: MeshNodeProps, output: MeshNodeAttributes | undefined) => Effect.Effect<MeshNodeAttributes, import("@distilled.cloud/cloudflare/zero-trust").Forbidden | MeshNodeError | import("@distilled.cloud/cloudflare/zero-trust").TunnelNotFound | import("@distilled.cloud/cloudflare/Protocol").CloudflareOpError, import("@distilled.cloud/cloudflare/Protocol").CloudflareOpContext>;
+/**
+ * ⚠️ Cloudflare may refuse to delete a node while replicas are connected (Alchemy's WarpConnector
+ *   notes "Deleting requires all connector sessions to be down"; unmeasured here). Stop the
+ *   client on every replica first. A node already gone is a successful delete.
+ */
+export declare const deleteMeshNode: (output: MeshNodeAttributes) => Effect.Effect<void, import("@distilled.cloud/cloudflare/zero-trust").Forbidden | import("@distilled.cloud/cloudflare/Protocol").CloudflareOpError, import("@distilled.cloud/cloudflare/Protocol").CloudflareOpContext>;
+//# sourceMappingURL=mesh-node-lifecycle.d.ts.map

package/dist/cloudflare/mesh-node-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh-node-lifecycle.d.ts","sourceRoot":"","sources":["../../src/cloudflare/mesh-node-lifecycle.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,aAAa,EAOd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,aAAa,EAAoB,MAAM,qBAAqB,CAAC;AAUpG;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,cACZ,MAAM,QACX,aAAa,GAAG,SAAS,UACvB,kBAAkB,GAAG,SAAS,sNAapC,CAAC;AAoGL,eAAO,MAAM,iBAAiB,cACjB,MAAM,QACX,aAAa,UACX,kBAAkB,GAAG,SAAS,2TAwBpC,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,cAAc,WAAY,kBAAkB,2NAChB,CAAC"}

package/dist/cloudflare/mesh-node-token.d.ts

@@ -0,0 +1,23 @@
+import * as zeroTrust from '@distilled.cloud/cloudflare/zero-trust';
+import * as Effect from 'effect/Effect';
+import * as Redacted from 'effect/Redacted';
+import { MeshNodeError } from './mesh-node-api.ts';
+/** Which node: by id (the `MeshNode` attribute) or by its exact name. */
+export type MeshNodeRef = {
+    readonly accountId: string;
+} & ({
+    readonly id: string;
+    readonly name?: undefined;
+} | {
+    readonly name: string;
+    readonly id?: undefined;
+});
+/**
+ * ⛔ An EMPTY token fails closed: `warp-cli connector new ""` would not enrol, and a script that
+ *   wrote an empty file would report success over a host that never joined.
+ * ⛔ The failures made here name the node and account and quote no response body, because the
+ *   success body IS the token. Other SDK errors pass through; they come only from non-2xx
+ *   responses, which carry an error envelope, not a token.
+ */
+export declare const fetchMeshNodeToken: (ref: MeshNodeRef) => Effect.Effect<Redacted.Redacted<string>, import("@distilled.cloud/cloudflare/Errors").BadGateway | import("@distilled.cloud/cloudflare/Errors").CloudflareError | import("@distilled.cloud/cloudflare/Errors").CloudflareHttpError | import("@distilled.cloud/cloudflare/Errors").CloudflareParseError | import("@distilled.cloud/cloudflare/Errors").CloudflareRateLimited | import("@distilled.cloud/cloudflare/Errors").ConfigError | zeroTrust.Forbidden | import("@distilled.cloud/cloudflare/Errors").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/cloudflare/Errors").InternalServerError | import("@distilled.cloud/cloudflare/Errors").InvalidRoute | MeshNodeError | import("@distilled.cloud/cloudflare/Credentials").OAuthRefreshError | import("@distilled.cloud/cloudflare/Errors").ServiceUnavailable | import("@distilled.cloud/cloudflare/Errors").TooManyRequests | import("@distilled.cloud/cloudflare/Errors").Unauthorized | import("@distilled.cloud/cloudflare/Errors").UnknownCloudflareError, zeroTrust.CloudflareOpContext>;
+//# sourceMappingURL=mesh-node-token.d.ts.map

package/dist/cloudflare/mesh-node-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh-node-token.d.ts","sourceRoot":"","sources":["../../src/cloudflare/mesh-node-token.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAkB,MAAM,oBAAoB,CAAC;AAEnE,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,CACvD;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,CAAA;CAAE,CACrD,CAAC;AAoDF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAAS,WAAW,wjCA4B/C,CAAC"}

package/dist/cloudflare/mesh-node.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `Cloudflare.MeshNode` — a Cloudflare Mesh node (a `warp_connector` object), declared without
+ * its token ever touching Alchemy state. Usage and the enrolment step: docs/mesh-node.md.
+ *
+ * 🔴 WHY THIS EXISTS ALONGSIDE `Cloudflare.Tunnel.WarpConnector`. A Mesh node that fronts a
+ *   private service needs a node record in the graph, so the Gateway rules and DNS records that
+ *   name it deploy together. Alchemy beta.79's WarpConnector would put the node token — the
+ *   credential that lets any Linux host join the account's Mesh as that node — into plaintext
+ *   state on every read, and it cannot create an HA node. See mesh-node-form.ts.
+ *
+ * ★ REMOVAL POLICY: `retain` BY DEFAULT — see the ★ on `MeshNode` below, and what it does to an
+ *   `ha` replace in mesh-node-lifecycle.ts.
+ */
+import { Credentials } from '@distilled.cloud/cloudflare/Credentials';
+import * as Cloudflare from 'alchemy/Cloudflare';
+import * as Provider from 'alchemy/Provider';
+import { Resource, type ResourceClass } from 'alchemy/Resource';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type MeshNodeAttributes, type MeshNodeProps } from './mesh-node-form.ts';
+import type { Providers } from './providers.ts';
+export interface MeshNode extends Resource<'Cloudflare.MeshNode', MeshNodeProps, MeshNodeAttributes, never, Providers> {
+}
+/**
+ * ★ `defaultRemovalPolicy: 'retain'`, LIKE EVERY KIT RESOURCE WHOSE DELETION BREAKS ITS CONSUMERS
+ *   (the `Bao.*` families, `R2BucketLock`, the Proxmox storage families; the reasoning is written
+ *   once in proxmox/resource.ts). Deleting a node cuts every enrolled replica off the Mesh, and
+ *   nothing brings it back: a new node has a new id, a new token and a new Mesh IP per replica, so
+ *   each host must be re-enrolled by hand and every Gateway rule or allow-list that pins the old
+ *   Mesh IP breaks. So dropping the declaration, or `alchemy destroy`, leaves the node live.
+ * ⚠️ IT ALSO SKIPS THE OLD NODE'S DELETE IN A REPLACE (Apply.ts, `deleteOldGenerations` and the
+ *   GC's `retainOldGeneration`, beta.79). A same-name `ha` change therefore REFUSES, deleting
+ *   nothing, until that deploy opts in with `.pipe(RemovalPolicy.destroy())`; a create-first
+ *   replace leaves the old node live and unmanaged. Both measured in mesh-node-policy.test.ts.
+ * ⛔ `delete` STAYS FULLY IMPLEMENTED. Retain is Terraform's `prevent_destroy`, not a stub: it runs
+ *   the moment a declaration opts in with `.pipe(RemovalPolicy.destroy())`.
+ */
+export declare const MeshNode: ResourceClass<MeshNode>;
+/** What every call below needs: the account, credentials and HTTP — Alchemy's own trio. */
+export type MeshNodeServices = Cloudflare.CloudflareEnvironment | Credentials | HttpClient.HttpClient;
+/**
+ * ★ `Provider.effect`, CAPTURING THE THREE SERVICES AT BUILD. `Provider.succeed` (what Alchemy's
+ *   own providers use) leaves each handler to find CloudflareEnvironment and Credentials in the
+ *   engine's context at call time — which works for `Cloudflare.providers()` only because it
+ *   `provideMerge`s them into the stack. Capturing them here keeps this provider correct whether
+ *   or not the stack also merges `Cloudflare.providers()`.
+ */
+export declare const MeshNodeProvider: () => import("effect/Layer").Layer<Provider.Provider<MeshNode>, never, Cloudflare.CloudflareEnvironment | Credentials | HttpClient.HttpClient>;
+//# sourceMappingURL=mesh-node.d.ts.map

package/dist/cloudflare/mesh-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh-node.d.ts","sourceRoot":"","sources":["../../src/cloudflare/mesh-node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACtE,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAGnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAE3C,CAAC;AAEH,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GACxB,UAAU,CAAC,qBAAqB,GAChC,WAAW,GACX,UAAU,CAAC,UAAU,CAAC;AAQ1B;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,gJA4C1B,CAAC"}

package/dist/cloudflare/providers.d.ts

@@ -1,19 +1,8 @@
-/**
- * The HomeFlare Cloudflare provider collection, in the shape `LiteLLM.providers()` has.
- *
- * ★ ONE LAYER, BUILT ONCE, so the single `Config.Redacted('CLOUDFLARE_API_TOKEN')` read is shared
- *   by every resource in the stack rather than repeated per resource.
- *
- * ⚠️ THIS IS NOT `alchemy/Cloudflare`'s COLLECTION AND DOES NOT REPLACE IT. A stack that declares
- *   both a `Cloudflare.R2.Bucket` and this lock merges the two:
- *   `Layer.mergeAll(Cloudflare.providers(), HomeflareCloudflare.providers())` — the shape
- *   a consuming stack names for one talking to more than one account.
- */
 import * as Provider from 'alchemy/Provider';
 import * as Layer from 'effect/Layer';
 declare const Providers_base: Provider.ProviderCollection<Providers, "HomeflareCloudflare">;
 export declare class Providers extends Providers_base {
 }
-export declare const providers: () => Layer.Layer<import("./client.ts").CloudflareApi | Providers, never, never>;
+export declare const providers: () => Layer.Layer<import("./client.ts").CloudflareApi | Providers, never, import("alchemy").AuthProviders | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/unstable/http/HttpClient").HttpClient | import("effect/Path").Path>;
 export {};
 //# sourceMappingURL=providers.d.ts.map

package/dist/cloudflare/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/cloudflare/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AAItC,qBAAa,SAAU,SAAQ,cAA+D;CAAG;AAEjG,eAAO,MAAM,SAAS,kFAInB,CAAC"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/cloudflare/providers.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AAKtC,qBAAa,SAAU,SAAQ,cAA+D;CAAG;AAEjG,eAAO,MAAM,SAAS,sVAWnB,CAAC"}

package/dist/index.d.ts

@@ -10,6 +10,7 @@
  *     import { TalosCluster } from '@homeflare/alchemy/talos';
  *     import { ProxmoxAcl } from '@homeflare/alchemy/proxmox';
  *     import { LaunchdJob } from '@homeflare/alchemy/launchd';
+ *     import { CaddyConfig } from '@homeflare/alchemy/caddy';
  *
  * ★ WHY THESE EXIST AT ALL. When Alchemy has no resource for something, the alternative
  *   is a runbook step a human runs once — and a plan can never show a missing runbook

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC"}

package/dist/launchd/fake-sudo.d.ts

@@ -0,0 +1,50 @@
+import type { ExecResult, HostRunner } from './runner.ts';
+export declare const OPERATOR = 501;
+export declare const PREFIXES: string[];
+/** What `sudo -n` prints (exit 1) when it will not run the command. Reasoned; see sudo-runner.ts. */
+export declare const SUDO_SAYS: {
+    readonly denied: "Sorry, user someone is not allowed to execute '/bin/launchctl bootout system/x' as root on example.\n";
+    readonly 'not-in-sudoers': 'someone is not in the sudoers file.\n';
+    readonly 'not-on-host': 'someone is not allowed to run sudo on example.\n';
+    readonly password: 'sudo: a password is required\n';
+};
+/** `groups` is the operator's `id -G`; `'unknown'` models that lookup failing. */
+export declare const fakeSudoHost: (groups?: readonly number[] | 'unknown', prefixes?: readonly string[]) => {
+    fake: {
+        calls: string[][];
+        disabled: Set<string>;
+        dirs: Map<string, number>;
+        files: Map<string, {
+            bytes: Uint8Array;
+            mode: number;
+            uid: number;
+            gid: number;
+            kind: import("./runner.ts").FileStat['kind'];
+        }>;
+        loaded: Map<string, number | undefined>;
+        runner: HostRunner;
+        state: {
+            lingerPrints: number;
+            nextPid: number;
+            bootstrapFailure: ExecResult | undefined;
+            bootoutFailure: ExecResult | undefined;
+            bootoutKeepsJob: boolean;
+            loggedOut: Set<number>;
+        };
+    };
+    logs: string[];
+    privileged: () => string[][];
+    runner: HostRunner;
+    staged: Map<string, Uint8Array<ArrayBufferLike>>;
+    state: {
+        /** What sudo itself answers: runs the command, or refuses it with one of SUDO_SAYS. */
+        sudo: 'ok' | keyof typeof SUDO_SAYS;
+        /** Returned by `install` in place of success; nothing is written. */
+        installFailure: ExecResult | undefined;
+        stagedCount: number;
+        /** The staged bytes as `install` saw them, by destination. */
+        installedFrom: Map<string, string>;
+    };
+    sudoCalls: string[][];
+};
+//# sourceMappingURL=fake-sudo.d.ts.map

package/dist/launchd/fake-sudo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-sudo.d.ts","sourceRoot":"","sources":["../../src/launchd/fake-sudo.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI1D,eAAO,MAAM,QAAQ,MAAM,CAAC;AAC5B,eAAO,MAAM,QAAQ,UAA6C,CAAC;AAInE,qGAAqG;AACrG,eAAO,MAAM,SAAS;aACpB,MAAM,EACJ,uGAAuG;aACzG,gBAAgB,EAAE,uCAAuC;aACzD,aAAa,EAAE,kDAAkD;aACjE,QAAQ,EAAE,gCAAgC;CAClC,CAAC;AAoBX,kFAAkF;AAClF,eAAO,MAAM,YAAY,YACf,SAAS,MAAM,EAAE,GAAG,SAAS,aAC3B,SAAS,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsBzB,uFAAuF;cACzE,IAAI,GAAG,MAAM,OAAO,SAAS;QAC3C,qEAAqE;wBACxC,UAAU,GAAG,SAAS;;QAEnD,8DAA8D;;;;CAqDjE,CAAC"}

package/dist/launchd/host-effect.d.ts

@@ -1,12 +1,3 @@
-/**
- * The one place a HostRunner's promises become Effects — plus the one probe of an unresolved
- * `news` both providers' diffs share.
- *
- * ★ The lifecycle files are plain async functions over a HostRunner (see runner.ts for why the
- *   runner is promise-based), so each provider handler is a single `lift(() => step(runner, …))`.
- * ⚠️ A thrown Error stays that Error — its message is the refusal a deploy prints. Anything else
- *   thrown is wrapped, so the failure channel is always an Error with a readable message.
- */
 import * as Effect from 'effect/Effect';
 export declare const lift: <A>(step: () => Promise<A>) => Effect.Effect<A, Error>;
 /**
@@ -16,4 +7,22 @@ export declare const lift: <A>(step: () => Promise<A>) => Effect.Effect<A, Error
  *   string is resolved by definition, so `typeof` is the whole test.
  */
 export declare const resolvedString: (news: unknown, key: string) => string | undefined;
+/**
+ * Whether the resource at `fqn` may be adopted, resolved exactly as the planner resolves it (alchemy
+ * beta.79 Plan.ts: `resource.Adopt ?? shouldAdopt`): a resource-scoped `adopt(…)`, else the
+ * `AdoptPolicy` service, else `AlchemyContext.adopt`, else off.
+ * ★ FOR A CREATE THE ENGINE NEVER PROBED. Alchemy skips the adoption probe while `news` holds an
+ *   Output, so an ownership check that must still honour `--adopt` can only run at apply. All three
+ *   reach the apply: Alchemist runs plan AND apply under the session context, which provides the
+ *   services from the CLI flag and the Stack the resources registered on (Alchemist/Session.ts,
+ *   routes/stack.ts; Apply.ts reads the same Stack).
+ * ⛔ THE RESOURCE-SCOPED SETTING WINS, BOTH WAYS. The engine captures `adopt(…)` on the resource at
+ *   registration (Resource.ts `Adopt`, into `Stack.resources[fqn]`) and never hands it to a
+ *   provider. Reading only the deploy-wide flag let `--adopt` take over a resource declared
+ *   `.pipe(adopt(false))` — which the planner refuses — and refused one declared `adopt(true)`.
+ * ⚠️ `resources` carries an `@internal` comment in Alchemy's source, but it is in the published types
+ *   and the planner reads `Adopt` from it. caddy/adopt-scope.test.ts registers through the real
+ *   `Resource`, so an upgrade that stops recording it there fails the suite.
+ */
+export declare const adoptEnabled: (fqn: string) => Effect.Effect<boolean>;
 //# sourceMappingURL=host-effect.d.ts.map

package/dist/launchd/host-effect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-effect.d.ts","sourceRoot":"","sources":["../../src/launchd/host-effect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,IAAI,GAAI,CAAC,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAInE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC"}
+{"version":3,"file":"host-effect.d.ts","sourceRoot":"","sources":["../../src/launchd/host-effect.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,eAAO,MAAM,IAAI,GAAI,CAAC,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAInE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,QAAS,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAS5D,CAAC"}

package/dist/launchd/host-file-form.d.ts

@@ -20,5 +20,10 @@ export interface HostFileAttributes {
     size: number;
 }
 export declare const DEFAULT_MODE = 420;
+/**
+ * An absolute, normalised path, or the reasons it is not. ★ Shared with sudo-allowlist.ts, so a
+ *   path the sudo runner may touch as root obeys exactly the rule a declared file does.
+ */
+export declare const pathProblems: (path: string) => string[];
 export declare const fileProblems: (props: HostFileProps) => string[];
 //# sourceMappingURL=host-file-form.d.ts.map

package/dist/launchd/host-file-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-file-form.d.ts","sourceRoot":"","sources":["../../src/launchd/host-file-form.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kGAAkG;IAClG,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,YAAY,MAAQ,CAAC;AAclC,eAAO,MAAM,YAAY,UAAW,aAAa,KAAG,MAAM,EAsBzD,CAAC"}
+{"version":3,"file":"host-file-form.d.ts","sourceRoot":"","sources":["../../src/launchd/host-file-form.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kGAAkG;IAClG,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,YAAY,MAAQ,CAAC;AAclC;;;GAGG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,MAAM,EAgBjD,CAAC;AAEF,eAAO,MAAM,YAAY,UAAW,aAAa,KAAG,MAAM,EAQzD,CAAC"}

package/dist/launchd/host-file-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-file-lifecycle.d.ts","sourceRoot":"","sources":["../../src/launchd/host-file-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAEnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,aAAa,CAAC;AAE5D,KAAK,OAAO,GAAG;IACb,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAOF,0EAA0E;AAC1E,eAAO,MAAM,WAAW,WAAkB,UAAU,SAAS,aAAa,KAAG,OAAO,CAAC,OAAO,CAqB3F,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,kBAAkB,WACrB,UAAU,QACZ,MAAM,KACX,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAYxC,CAAC;AAQF,eAAO,MAAM,QAAQ,WACX,UAAU,QACZ,aAAa,UACX,kBAAkB,KACzB,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,eAAO,MAAM,aAAa,WAChB,UAAU,SACX,aAAa,WACX,kBAAkB,KAC1B,OAAO,CAAC,kBAAkB,CA0D5B,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,UAAU,WAAkB,UAAU,UAAU,kBAAkB,KAAG,OAAO,CAAC,IAAI,CAK7F,CAAC"}
+{"version":3,"file":"host-file-lifecycle.d.ts","sourceRoot":"","sources":["../../src/launchd/host-file-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAEnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,aAAa,CAAC;AAE5D,KAAK,OAAO,GAAG;IACb,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAOF,0EAA0E;AAC1E,eAAO,MAAM,WAAW,WAAkB,UAAU,SAAS,aAAa,KAAG,OAAO,CAAC,OAAO,CAqB3F,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,kBAAkB,WACrB,UAAU,QACZ,MAAM,KACX,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAYxC,CAAC;AAQF,eAAO,MAAM,QAAQ,WACX,UAAU,QACZ,aAAa,UACX,kBAAkB,KACzB,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,eAAO,MAAM,aAAa,WAChB,UAAU,SACX,aAAa,WACX,kBAAkB,KAC1B,OAAO,CAAC,kBAAkB,CA2D5B,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,UAAU,WAAkB,UAAU,UAAU,kBAAkB,KAAG,OAAO,CAAC,IAAI,CAK7F,CAAC"}

package/dist/launchd/index.d.ts

@@ -18,4 +18,6 @@ export { PlistError, renderPlist } from './plist.ts';
 export { launchdProviders } from './providers.ts';
 export type { ExecResult, FileStat, HostRunner, HostUser, WriteOptions } from './runner.ts';
 export { HostRunnerService, canActAsRoot, hostRunnerLayer } from './runner.ts';
+export type { SudoRunnerOptions } from './sudo-runner.ts';
+export { SudoRefusedError, sudoRunner } from './sudo-runner.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/launchd/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/launchd/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,eAAe,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/launchd/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,eAAe,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}