@homeflare/alchemy 0.60.0 → 0.61.0

package/dist/scope/duplicate-id.d.ts

@@ -24,9 +24,24 @@ export declare class DuplicateResourceIdError extends DuplicateResourceIdError_b
 }> {
 }
 /**
- * The exact `alchemy` version `patches/alchemy@2.0.0-beta.81.patch` was cut against.
+ * The exact `alchemy` version `patches/alchemy@2.0.0-beta.81.patch` was cut against — this
+ * package's own peer pin, and the version `duplicate-id.test.ts` drives a real `Stack` over.
  * `duplicate-id.test.ts` keeps this honest against `package.json`'s own `peerDependencies`.
+ *
+ * ⛔ STAYS, MEANING BETA.81 — do not repoint this at beta.83. A consumer that calls
+ * `checkAlchemyPatch` with an explicit `alchemyVersion` (or reads this constant directly)
+ * must keep getting the same answer it always has; {@link PATCHED_ALCHEMY_VERSIONS} is the
+ * list a caller walks to find ALL supported pins, this one constant is not retargeted to mean
+ * "whichever is newest."
  */
 export declare const PATCHED_ALCHEMY_VERSION: string;
+/**
+ * Every alchemy version `@homeflare/alchemy` ships a cut `patches/alchemy@<version>.patch`
+ * for, oldest first. `checkAlchemyPatch` uses this to pick the shipped patch matching a
+ * consumer's ACTUAL installed version instead of only ever checking against
+ * {@link PATCHED_ALCHEMY_VERSION}. `patch-check.test.ts` and the static patch-coverage test
+ * both assert every entry here has a real `patches/alchemy@<version>.patch` file.
+ */
+export declare const PATCHED_ALCHEMY_VERSIONS: readonly string[];
 export {};
 //# sourceMappingURL=duplicate-id.d.ts.map

package/dist/scope/duplicate-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"duplicate-id.d.ts","sourceRoot":"","sources":["../../src/scope/duplicate-id.ts"],"names":[],"mappings":";;;AA4BA;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;CAAG;AAEL;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAwB,CAAC"}
+{"version":3,"file":"duplicate-id.d.ts","sourceRoot":"","sources":["../../src/scope/duplicate-id.ts"],"names":[],"mappings":";;;AAqCA;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;CAAG;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAwB,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAuC,CAAC"}

package/dist/scope/index.d.ts

@@ -2,8 +2,9 @@
  * `@homeflare/alchemy/scope` — a consuming stack's own check that it carries the
  * duplicate-resource-id patch, and the error shape that patch throws.
  *
- * The fix itself is a patch to `alchemy`'s own `Resource.ts`
- * (`../../patches/alchemy@2.0.0-beta.81.patch`), applied at EACH consuming stack's own root
+ * The fix itself is a patch to `alchemy`'s own `Resource.ts`, one per supported alchemy version
+ * (`../../patches/alchemy@<version>.patch`, listed in `PATCHED_ALCHEMY_VERSIONS`: beta.81 and
+ * beta.83), applied at EACH consuming stack's own root
  * (`alchemy` is a peer dependency here, so `patchedDependencies` in this package's manifest
  * only reaches this package's own install, never a consumer's). docs/duplicate-resource-id.md
  * has the full guide, the exact `bun patch` workflow, and what this does and does not cover.
@@ -18,6 +19,6 @@
  * }
  * ```
  */
-export { DuplicateResourceIdError, PATCHED_ALCHEMY_VERSION } from './duplicate-id.ts';
+export { DuplicateResourceIdError, PATCHED_ALCHEMY_VERSION, PATCHED_ALCHEMY_VERSIONS, } from './duplicate-id.ts';
 export { checkAlchemyPatch, type PatchProblem } from './patch-check.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/scope/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scope/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scope/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/scope/index.js

@@ -4,20 +4,26 @@ import * as Data from "effect/Data";
 class DuplicateResourceIdError extends Data.TaggedError("DuplicateResourceIdError") {
 }
 var PATCHED_ALCHEMY_VERSION = "2.0.0-beta.81";
+var PATCHED_ALCHEMY_VERSIONS = ["2.0.0-beta.81", "2.0.0-beta.83"];
 // src/scope/patch-check.ts
 var patchKey = (version) => `alchemy@${version}`;
 var shippedPatchPath = (version) => new URL(`../../patches/${patchKey(version)}.patch`, import.meta.url).pathname;
-var checkAlchemyPatch = async (projectDir, alchemyVersion = PATCHED_ALCHEMY_VERSION) => {
+var checkAlchemyPatch = async (projectDir, alchemyVersion) => {
   const problems = [];
-  const key = patchKey(alchemyVersion);
   const installedPkg = Bun.file(`${projectDir}/node_modules/alchemy/package.json`);
   if (!await installedPkg.exists()) {
     problems.push("node_modules/alchemy: not installed — nothing to check the patch against");
     return problems;
   }
   const installedVersion = (await installedPkg.json()).version;
-  if (installedVersion !== alchemyVersion) {
-    problems.push(`node_modules/alchemy is ${installedVersion ?? "unknown"}, but the duplicate-resource-id ` + `patch targets ${alchemyVersion} — bump the patch (@homeflare/alchemy's own ` + "patches/) before bumping alchemy, or this install has no protection at all");
+  const targetVersion = alchemyVersion ?? installedVersion ?? PATCHED_ALCHEMY_VERSION;
+  const key = patchKey(targetVersion);
+  if (!PATCHED_ALCHEMY_VERSIONS.includes(targetVersion)) {
+    problems.push(`alchemy ${targetVersion} (installed: ${installedVersion ?? "unknown"}) is a version ` + `@homeflare/alchemy has ` + `no duplicate-resource-id patch for — supported versions are ` + `${PATCHED_ALCHEMY_VERSIONS.join(", ")}; cut a new patches/${key}.patch ` + "(@homeflare/alchemy's own patches/) before bumping alchemy, or this install has no " + "protection at all");
+    return problems;
+  }
+  if (installedVersion !== targetVersion) {
+    problems.push(`node_modules/alchemy is ${installedVersion ?? "unknown"}, but the duplicate-resource-id ` + `check was asked for ${targetVersion} — pass the installed version explicitly, or omit ` + "alchemyVersion to check against whatever is actually installed");
     return problems;
   }
   const pkgFile = Bun.file(`${projectDir}/package.json`);
@@ -36,7 +42,7 @@ var checkAlchemyPatch = async (projectDir, alchemyVersion = PATCHED_ALCHEMY_VERS
     problems.push(`package.json declares "${key}" at ${declaredPath}, but that file is missing`);
     return problems;
   }
-  const ours = Bun.file(shippedPatchPath(alchemyVersion));
+  const ours = Bun.file(shippedPatchPath(targetVersion));
   if (!await ours.exists()) {
     problems.push(`@homeflare/alchemy ships no patches/${key}.patch to compare against`);
     return problems;
@@ -59,8 +65,9 @@ var checkAlchemyPatch = async (projectDir, alchemyVersion = PATCHED_ALCHEMY_VERS
 export {
   DuplicateResourceIdError,
   PATCHED_ALCHEMY_VERSION,
+  PATCHED_ALCHEMY_VERSIONS,
   checkAlchemyPatch
 };
 
-//# debugId=BFEA50A1CBA14B6A64756E2164756E21
+//# debugId=461D34CD68FB220064756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/scope/index.js.map

@@ -2,10 +2,10 @@
   "version": 3,
   "sources": ["../src/scope/duplicate-id.ts", "../src/scope/patch-check.ts"],
   "sourcesContent": [
-    "/**\n * `DuplicateResourceIdError` and the pinned alchemy version the kit's patch targets.\n *\n * ★ THE FIX ITSELF IS NOT HERE. A second resource of a different type claiming an id already\n *   taken in one stack scope is refused by a PATCH to `alchemy`'s own `Resource.ts` — see\n *   `../../patches/alchemy@2.0.0-beta.81.patch` and docs/duplicate-resource-id.md for why a\n *   kit-side `Proxy` wrapper (PR 468's first version, replaced by this PR) cannot actually\n *   catch the incident it was built for: wrapping `@homeflare/alchemy`'s OWN resource exports\n *   never reaches `NixJobRetirement`, a resource homeflare-mini declares directly against\n *   `alchemy`'s `Resource()`, so the measured collision still succeeded silently in BOTH\n *   orderings. This file now holds only:\n *\n *   1. `DuplicateResourceIdError` — the exact shape the patched `alchemy` throws, duplicated\n *      here (not imported — `alchemy` cannot depend on `@homeflare/alchemy`) purely so a\n *      consumer can write `Effect.catchTag(\"DuplicateResourceIdError\", …)` against a type this\n *      package exports, without needing to know alchemy carries its own copy of the same tag.\n *      Effect dispatches `catchTag` on the `_tag` STRING, not `instanceof`, so either class\n *      works identically as a catch target.\n *   2. `PATCHED_ALCHEMY_VERSION` — the exact alchemy version the patch was cut against.\n *      Hardcoded, like `ESTATE_VERSIONS` in `@homeflare/config/versions` (the same reasoning:\n *      a second source of truth derived by import would cross `tsconfig.build.json`'s\n *      `rootDir: \"src\"` boundary to reach `package.json`). `duplicate-id.test.ts` asserts it\n *      still matches this package's own `peerDependencies.alchemy`, so a pin bump that forgets\n *      to re-cut the patch fails a test here instead of silently shipping a patch filename that\n *      no longer matches what consumers install.\n */\nimport * as Data from 'effect/Data';\n\n/**\n * Mirrors the error the patched `alchemy@2.0.0-beta.81` throws at registration — same `_tag`,\n * same fields — for a consumer that wants to `catchTag` it without importing from `alchemy`'s\n * own patched internals.\n *\n * ⚠️ ONLY `Type` IS COMPARED, NEVER `Props`. A platform-typed resource's tagged pattern\n * (`alchemy`'s own `Platform.ts` ~581) rewrites `Props` on a resource already registered, and a\n * bare-tag forward reference legitimately registers with `Props: undefined` until its\n * `.make(...)` Layer builds (`MissingImplementationError`'s own doc comment in `Resource.ts`).\n * Comparing props as well as type would make both of those die. `Type` is stable from a\n * resource's very first `yield*` and is exactly what distinguishes \"the same resource,\n * referenced twice\" (fine) from \"two different resources that picked the same id\" (refused).\n */\nexport class DuplicateResourceIdError extends Data.TaggedError('DuplicateResourceIdError')<{\n  message: string;\n  fqn: string;\n  /** The type that first claimed `fqn`. */\n  firstType: string;\n  /** The different type that tried to claim it again. */\n  secondType: string;\n}> {}\n\n/**\n * The exact `alchemy` version `patches/alchemy@2.0.0-beta.81.patch` was cut against.\n * `duplicate-id.test.ts` keeps this honest against `package.json`'s own `peerDependencies`.\n */\nexport const PATCHED_ALCHEMY_VERSION: string = '2.0.0-beta.81';\n",
-    "/**\n * A consuming stack's own `check` calls `checkAlchemyPatch` to assert it actually carries the\n * duplicate-resource-id fix — not just that SOME version of `alchemy` is installed, but that\n * THIS install carries the patch, for the alchemy version it was cut against.\n *\n * ★ WHY A BUMP CAN OTHERWISE DROP IT SILENTLY. `patchedDependencies` keys a patch to an EXACT\n *   version string (`alchemy@2.0.0-beta.81`). `bun add alchemy@2.0.0-beta.82` leaves that key\n *   pointing at a version nothing installs anymore — `bun install` neither errors nor warns,\n *   it just stops applying the patch, and the stack is back to the original silent collision\n *   with every other gate still green. This check is what turns that bump into a failing\n *   `check`, the same way `tests/dist.test.ts` turns a build regression into a failing test\n *   instead of a surprise three repos downstream (this package's own AGENTS.md, \"the smoke\n *   test is not optional\").\n * ★ A STATIC CHECK, mirroring `@homeflare/config/check`'s `checkCopy`/`checkOxfmt` — not a\n *   functional probe that spins up a `Stack`/`Resource`/`Effect` harness on every `check` run.\n *   The functional proof that the patch's LOGIC works lives in this package's own\n *   `duplicate-id.test.ts`, against the exact pinned version; a consumer's `check` only needs\n *   to know whether ITS install carries that same patch, applied — three file reads, no\n *   `effect` runtime pulled into every repo's check step.\n * ⛔ IT REPORTS, IT DOES NOT REPAIR, same as `checkProject` in `@homeflare/config/check` — this\n *   never edits `package.json` or re-runs `bun install` for the caller.\n */\nimport { PATCHED_ALCHEMY_VERSION } from './duplicate-id.ts';\n\n/** One thing wrong with a consuming stack's alchemy patch, in the imperative. */\nexport type PatchProblem = string;\n\nconst patchKey = (version: string) => `alchemy@${version}`;\n\n/** Where THIS package's own shipped copy of the patch lives, however it was installed. */\nconst shippedPatchPath = (version: string): string =>\n  new URL(`../../patches/${patchKey(version)}.patch`, import.meta.url).pathname;\n\ntype PackageJson = {\n  readonly patchedDependencies?: Readonly<Record<string, string>>;\n};\n\n/**\n * @param projectDir The consuming stack's OWN repo root (where its `package.json` and\n *   `patches/` directory live) — never this kit's own.\n * @param alchemyVersion The version to check for — defaults to the version this package's\n *   own shipped patch targets ({@link PATCHED_ALCHEMY_VERSION}); a caller only overrides it to\n *   test a different pin.\n */\nexport const checkAlchemyPatch = async (\n  projectDir: string,\n  alchemyVersion: string = PATCHED_ALCHEMY_VERSION,\n): Promise<readonly PatchProblem[]> => {\n  const problems: PatchProblem[] = [];\n  const key = patchKey(alchemyVersion);\n\n  const installedPkg = Bun.file(`${projectDir}/node_modules/alchemy/package.json`);\n  if (!(await installedPkg.exists())) {\n    problems.push('node_modules/alchemy: not installed — nothing to check the patch against');\n    return problems;\n  }\n  const installedVersion = ((await installedPkg.json()) as { version?: string }).version;\n  if (installedVersion !== alchemyVersion) {\n    problems.push(\n      `node_modules/alchemy is ${installedVersion ?? 'unknown'}, but the duplicate-resource-id ` +\n        `patch targets ${alchemyVersion} — bump the patch (@homeflare/alchemy's own ` +\n        'patches/) before bumping alchemy, or this install has no protection at all',\n    );\n    return problems;\n  }\n\n  const pkgFile = Bun.file(`${projectDir}/package.json`);\n  if (!(await pkgFile.exists())) {\n    problems.push('package.json: missing');\n    return problems;\n  }\n  const pkg = (await pkgFile.json()) as PackageJson;\n  const declaredPath = pkg.patchedDependencies?.[key];\n  if (declaredPath === undefined) {\n    problems.push(\n      `package.json: patchedDependencies has no entry for \"${key}\" — this stack has no ` +\n        'duplicate-resource-id protection at all; see @homeflare/alchemy/docs/duplicate-resource-id.md',\n    );\n    return problems;\n  }\n\n  const theirs = Bun.file(`${projectDir}/${declaredPath}`);\n  if (!(await theirs.exists())) {\n    problems.push(`package.json declares \"${key}\" at ${declaredPath}, but that file is missing`);\n    return problems;\n  }\n  const ours = Bun.file(shippedPatchPath(alchemyVersion));\n  if (!(await ours.exists())) {\n    // The kit's own tarball is missing its patch — a packaging bug, not the consumer's.\n    problems.push(`@homeflare/alchemy ships no patches/${key}.patch to compare against`);\n    return problems;\n  }\n  if ((await theirs.text()) !== (await ours.text())) {\n    problems.push(\n      `${declaredPath}: differs from @homeflare/alchemy's shipped patch — re-copy it, ` +\n        'or say why it differs',\n    );\n  }\n\n  // Declared and byte-identical is not yet APPLIED: a hand-edited patchedDependencies entry,\n  // or an install under a package manager that does not support bun's patch format, leaves\n  // node_modules unpatched with nothing above noticing. One cheap textual proof it landed.\n  const resourceSrc = Bun.file(`${projectDir}/node_modules/alchemy/src/Resource.ts`);\n  const resourceLib = Bun.file(`${projectDir}/node_modules/alchemy/lib/Resource.js`);\n  const marker = 'DuplicateResourceIdError';\n  const [srcText, libText] = await Promise.all([\n    resourceSrc.exists().then((ok) => (ok ? resourceSrc.text() : '')),\n    resourceLib.exists().then((ok) => (ok ? resourceLib.text() : '')),\n  ]);\n  if (!srcText.includes(marker) && !libText.includes(marker)) {\n    problems.push(\n      'node_modules/alchemy/{src/Resource.ts,lib/Resource.js}: neither contains the patch — ' +\n        'declared in package.json but not applied; re-run `bun install`',\n    );\n  }\n\n  return problems;\n};\n"
+    "/**\n * `DuplicateResourceIdError` and the pinned alchemy version the kit's patch targets.\n *\n * ★ THE FIX ITSELF IS NOT HERE. A second resource of a different type claiming an id already\n *   taken in one stack scope is refused by a PATCH to `alchemy`'s own `Resource.ts` — see\n *   `../../patches/alchemy@2.0.0-beta.81.patch` and docs/duplicate-resource-id.md for why a\n *   kit-side `Proxy` wrapper (PR 468's first version, replaced by this PR) cannot actually\n *   catch the incident it was built for: wrapping `@homeflare/alchemy`'s OWN resource exports\n *   never reaches `NixJobRetirement`, a resource homeflare-mini declares directly against\n *   `alchemy`'s `Resource()`, so the measured collision still succeeded silently in BOTH\n *   orderings. This file now holds only:\n *\n *   1. `DuplicateResourceIdError` — the exact shape the patched `alchemy` throws, duplicated\n *      here (not imported — `alchemy` cannot depend on `@homeflare/alchemy`) purely so a\n *      consumer can write `Effect.catchTag(\"DuplicateResourceIdError\", …)` against a type this\n *      package exports, without needing to know alchemy carries its own copy of the same tag.\n *      Effect dispatches `catchTag` on the `_tag` STRING, not `instanceof`, so either class\n *      works identically as a catch target.\n *   2. `PATCHED_ALCHEMY_VERSION` — the exact alchemy version THIS package's own peer pin and\n *      devDependency sit at, and the one `duplicate-id.test.ts` drives its real `Stack` against.\n *      Hardcoded, like `ESTATE_VERSIONS` in `@homeflare/config/versions` (the same reasoning:\n *      a second source of truth derived by import would cross `tsconfig.build.json`'s\n *      `rootDir: \"src\"` boundary to reach `package.json`). `duplicate-id.test.ts` asserts it\n *      still matches this package's own `peerDependencies.alchemy`, so a pin bump that forgets\n *      to re-cut the patch fails a test here instead of silently shipping a patch filename that\n *      no longer matches what consumers install.\n *   3. `PATCHED_ALCHEMY_VERSIONS` — every alchemy version this package ships a CUT patch for\n *      (currently beta.81 and beta.83, kit PR shipping beta.83's — a consumer on beta.82 or\n *      beta.84 is NOT covered merely by being \"close\"; `bun`'s patch format keys to an exact\n *      version string, and a patch cut against one version is not guaranteed to even apply to\n *      another — see docs/duplicate-resource-id.md for why a diff was taken between the two\n *      tarballs rather than assumed). `checkAlchemyPatch` (`patch-check.ts`) walks this list to\n *      find the shipped patch matching a consumer's ACTUAL install, so a stack on beta.83 is not\n *      forced to pin the single oldest supported version just to pass its own check.\n */\nimport * as Data from 'effect/Data';\n\n/**\n * Mirrors the error the patched `alchemy@2.0.0-beta.81` throws at registration — same `_tag`,\n * same fields — for a consumer that wants to `catchTag` it without importing from `alchemy`'s\n * own patched internals.\n *\n * ⚠️ ONLY `Type` IS COMPARED, NEVER `Props`. A platform-typed resource's tagged pattern\n * (`alchemy`'s own `Platform.ts` ~581) rewrites `Props` on a resource already registered, and a\n * bare-tag forward reference legitimately registers with `Props: undefined` until its\n * `.make(...)` Layer builds (`MissingImplementationError`'s own doc comment in `Resource.ts`).\n * Comparing props as well as type would make both of those die. `Type` is stable from a\n * resource's very first `yield*` and is exactly what distinguishes \"the same resource,\n * referenced twice\" (fine) from \"two different resources that picked the same id\" (refused).\n */\nexport class DuplicateResourceIdError extends Data.TaggedError('DuplicateResourceIdError')<{\n  message: string;\n  fqn: string;\n  /** The type that first claimed `fqn`. */\n  firstType: string;\n  /** The different type that tried to claim it again. */\n  secondType: string;\n}> {}\n\n/**\n * The exact `alchemy` version `patches/alchemy@2.0.0-beta.81.patch` was cut against — this\n * package's own peer pin, and the version `duplicate-id.test.ts` drives a real `Stack` over.\n * `duplicate-id.test.ts` keeps this honest against `package.json`'s own `peerDependencies`.\n *\n * ⛔ STAYS, MEANING BETA.81 — do not repoint this at beta.83. A consumer that calls\n * `checkAlchemyPatch` with an explicit `alchemyVersion` (or reads this constant directly)\n * must keep getting the same answer it always has; {@link PATCHED_ALCHEMY_VERSIONS} is the\n * list a caller walks to find ALL supported pins, this one constant is not retargeted to mean\n * \"whichever is newest.\"\n */\nexport const PATCHED_ALCHEMY_VERSION: string = '2.0.0-beta.81';\n\n/**\n * Every alchemy version `@homeflare/alchemy` ships a cut `patches/alchemy@<version>.patch`\n * for, oldest first. `checkAlchemyPatch` uses this to pick the shipped patch matching a\n * consumer's ACTUAL installed version instead of only ever checking against\n * {@link PATCHED_ALCHEMY_VERSION}. `patch-check.test.ts` and the static patch-coverage test\n * both assert every entry here has a real `patches/alchemy@<version>.patch` file.\n */\nexport const PATCHED_ALCHEMY_VERSIONS: readonly string[] = ['2.0.0-beta.81', '2.0.0-beta.83'];\n",
+    "/**\n * A consuming stack's own `check` calls `checkAlchemyPatch` to assert it actually carries the\n * duplicate-resource-id fix — not just that SOME version of `alchemy` is installed, but that\n * THIS install carries the patch, for the alchemy version it was cut against.\n *\n * ★ WHY A BUMP CAN OTHERWISE DROP IT SILENTLY. `patchedDependencies` keys a patch to an EXACT\n *   version string (`alchemy@2.0.0-beta.81`). `bun add alchemy@2.0.0-beta.82` leaves that key\n *   pointing at a version nothing installs anymore — `bun install` neither errors nor warns,\n *   it just stops applying the patch, and the stack is back to the original silent collision\n *   with every other gate still green. This check is what turns that bump into a failing\n *   `check`, the same way `tests/dist.test.ts` turns a build regression into a failing test\n *   instead of a surprise three repos downstream (this package's own AGENTS.md, \"the smoke\n *   test is not optional\").\n * ★ A STATIC CHECK, mirroring `@homeflare/config/check`'s `checkCopy`/`checkOxfmt` — not a\n *   functional probe that spins up a `Stack`/`Resource`/`Effect` harness on every `check` run.\n *   The functional proof that the patch's LOGIC works lives in this package's own\n *   `duplicate-id.test.ts`, against the exact pinned version; a consumer's `check` only needs\n *   to know whether ITS install carries that same patch, applied — three file reads, no\n *   `effect` runtime pulled into every repo's check step.\n * ⛔ IT REPORTS, IT DOES NOT REPAIR, same as `checkProject` in `@homeflare/config/check` — this\n *   never edits `package.json` or re-runs `bun install` for the caller.\n */\nimport { PATCHED_ALCHEMY_VERSION, PATCHED_ALCHEMY_VERSIONS } from './duplicate-id.ts';\n\n/** One thing wrong with a consuming stack's alchemy patch, in the imperative. */\nexport type PatchProblem = string;\n\nconst patchKey = (version: string) => `alchemy@${version}`;\n\n/** Where THIS package's own shipped copy of the patch lives, however it was installed. */\nconst shippedPatchPath = (version: string): string =>\n  new URL(`../../patches/${patchKey(version)}.patch`, import.meta.url).pathname;\n\ntype PackageJson = {\n  readonly patchedDependencies?: Readonly<Record<string, string>>;\n};\n\n/**\n * @param projectDir The consuming stack's OWN repo root (where its `package.json` and\n *   `patches/` directory live) — never this kit's own.\n * @param alchemyVersion The version to check for. Omitted (the normal case): the version\n *   actually installed at `projectDir` is used, so a consumer on ANY version this package\n *   ships a patch for ({@link PATCHED_ALCHEMY_VERSIONS}) passes without having to pin\n *   {@link PATCHED_ALCHEMY_VERSION} specifically — a stack on beta.83 is checked against the\n *   beta.83 patch, one on beta.81 against the beta.81 patch. A caller passes this explicitly\n *   only to assert a SPECIFIC pin regardless of what happens to be installed (as the tests do).\n */\nexport const checkAlchemyPatch = async (\n  projectDir: string,\n  alchemyVersion?: string,\n): Promise<readonly PatchProblem[]> => {\n  const problems: PatchProblem[] = [];\n\n  const installedPkg = Bun.file(`${projectDir}/node_modules/alchemy/package.json`);\n  if (!(await installedPkg.exists())) {\n    problems.push('node_modules/alchemy: not installed — nothing to check the patch against');\n    return problems;\n  }\n  const installedVersion = ((await installedPkg.json()) as { version?: string }).version;\n\n  // No explicit ask: check against whatever is ACTUALLY installed, not a single hardcoded\n  // pin — that is what lets a beta.83 consumer pass without also being on beta.81.\n  const targetVersion = alchemyVersion ?? installedVersion ?? PATCHED_ALCHEMY_VERSION;\n  const key = patchKey(targetVersion);\n\n  if (!PATCHED_ALCHEMY_VERSIONS.includes(targetVersion)) {\n    problems.push(\n      // ★ Name the version being CHECKED: with an explicit `alchemyVersion` it can differ from\n      //   the installed one, and naming the installed version then blames a supported one.\n      `alchemy ${targetVersion} (installed: ${installedVersion ?? 'unknown'}) is a version ` +\n        `@homeflare/alchemy has ` +\n        `no duplicate-resource-id patch for — supported versions are ` +\n        `${PATCHED_ALCHEMY_VERSIONS.join(', ')}; cut a new patches/${key}.patch ` +\n        \"(@homeflare/alchemy's own patches/) before bumping alchemy, or this install has no \" +\n        'protection at all',\n    );\n    return problems;\n  }\n  if (installedVersion !== targetVersion) {\n    problems.push(\n      `node_modules/alchemy is ${installedVersion ?? 'unknown'}, but the duplicate-resource-id ` +\n        `check was asked for ${targetVersion} — pass the installed version explicitly, or omit ` +\n        'alchemyVersion to check against whatever is actually installed',\n    );\n    return problems;\n  }\n\n  const pkgFile = Bun.file(`${projectDir}/package.json`);\n  if (!(await pkgFile.exists())) {\n    problems.push('package.json: missing');\n    return problems;\n  }\n  const pkg = (await pkgFile.json()) as PackageJson;\n  const declaredPath = pkg.patchedDependencies?.[key];\n  if (declaredPath === undefined) {\n    problems.push(\n      `package.json: patchedDependencies has no entry for \"${key}\" — this stack has no ` +\n        'duplicate-resource-id protection at all; see @homeflare/alchemy/docs/duplicate-resource-id.md',\n    );\n    return problems;\n  }\n\n  const theirs = Bun.file(`${projectDir}/${declaredPath}`);\n  if (!(await theirs.exists())) {\n    problems.push(`package.json declares \"${key}\" at ${declaredPath}, but that file is missing`);\n    return problems;\n  }\n  const ours = Bun.file(shippedPatchPath(targetVersion));\n  if (!(await ours.exists())) {\n    // The kit's own tarball is missing its patch — a packaging bug, not the consumer's.\n    problems.push(`@homeflare/alchemy ships no patches/${key}.patch to compare against`);\n    return problems;\n  }\n  if ((await theirs.text()) !== (await ours.text())) {\n    problems.push(\n      `${declaredPath}: differs from @homeflare/alchemy's shipped patch — re-copy it, ` +\n        'or say why it differs',\n    );\n  }\n\n  // Declared and byte-identical is not yet APPLIED: a hand-edited patchedDependencies entry,\n  // or an install under a package manager that does not support bun's patch format, leaves\n  // node_modules unpatched with nothing above noticing. One cheap textual proof it landed.\n  const resourceSrc = Bun.file(`${projectDir}/node_modules/alchemy/src/Resource.ts`);\n  const resourceLib = Bun.file(`${projectDir}/node_modules/alchemy/lib/Resource.js`);\n  const marker = 'DuplicateResourceIdError';\n  const [srcText, libText] = await Promise.all([\n    resourceSrc.exists().then((ok) => (ok ? resourceSrc.text() : '')),\n    resourceLib.exists().then((ok) => (ok ? resourceLib.text() : '')),\n  ]);\n  if (!srcText.includes(marker) && !libText.includes(marker)) {\n    problems.push(\n      'node_modules/alchemy/{src/Resource.ts,lib/Resource.js}: neither contains the patch — ' +\n        'declared in package.json but not applied; re-run `bun install`',\n    );\n  }\n\n  return problems;\n};\n"
   ],
-  "mappings": ";AA0BA;AAAA;AAeO,MAAM,iCAAsC,iBAAY,0BAA0B,EAOtF;AAAC;AAMG,IAAM,0BAAkC;;AC3B/C,IAAM,WAAW,CAAC,YAAoB,WAAW;AAGjD,IAAM,mBAAmB,CAAC,YACxB,IAAI,IAAI,iBAAiB,SAAS,OAAO,WAAW,YAAY,GAAG,EAAE;AAahE,IAAM,oBAAoB,OAC/B,YACA,iBAAyB,4BACY;AAAA,EACrC,MAAM,WAA2B,CAAC;AAAA,EAClC,MAAM,MAAM,SAAS,cAAc;AAAA,EAEnC,MAAM,eAAe,IAAI,KAAK,GAAG,8CAA8C;AAAA,EAC/E,IAAI,CAAE,MAAM,aAAa,OAAO,GAAI;AAAA,IAClC,SAAS,KAAK,0EAA0E;AAAA,IACxF,OAAO;AAAA,EACT;AAAA,EACA,MAAM,oBAAqB,MAAM,aAAa,KAAK,GAA4B;AAAA,EAC/E,IAAI,qBAAqB,gBAAgB;AAAA,IACvC,SAAS,KACP,2BAA2B,oBAAoB,8CAC7C,iBAAiB,+DACjB,4EACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,UAAU,IAAI,KAAK,GAAG,yBAAyB;AAAA,EACrD,IAAI,CAAE,MAAM,QAAQ,OAAO,GAAI;AAAA,IAC7B,SAAS,KAAK,uBAAuB;AAAA,IACrC,OAAO;AAAA,EACT;AAAA,EACA,MAAM,MAAO,MAAM,QAAQ,KAAK;AAAA,EAChC,MAAM,eAAe,IAAI,sBAAsB;AAAA,EAC/C,IAAI,iBAAiB,WAAW;AAAA,IAC9B,SAAS,KACP,uDAAuD,8BACrD,+FACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,IAAI,KAAK,GAAG,cAAc,cAAc;AAAA,EACvD,IAAI,CAAE,MAAM,OAAO,OAAO,GAAI;AAAA,IAC5B,SAAS,KAAK,0BAA0B,WAAW,wCAAwC;AAAA,IAC3F,OAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,IAAI,KAAK,iBAAiB,cAAc,CAAC;AAAA,EACtD,IAAI,CAAE,MAAM,KAAK,OAAO,GAAI;AAAA,IAE1B,SAAS,KAAK,uCAAuC,8BAA8B;AAAA,IACnF,OAAO;AAAA,EACT;AAAA,EACA,IAAK,MAAM,OAAO,KAAK,MAAQ,MAAM,KAAK,KAAK,GAAI;AAAA,IACjD,SAAS,KACP,GAAG,iFACD,uBACJ;AAAA,EACF;AAAA,EAKA,MAAM,cAAc,IAAI,KAAK,GAAG,iDAAiD;AAAA,EACjF,MAAM,cAAc,IAAI,KAAK,GAAG,iDAAiD;AAAA,EACjF,MAAM,SAAS;AAAA,EACf,OAAO,SAAS,WAAW,MAAM,QAAQ,IAAI;AAAA,IAC3C,YAAY,OAAO,EAAE,KAAK,CAAC,OAAQ,KAAK,YAAY,KAAK,IAAI,EAAG;AAAA,IAChE,YAAY,OAAO,EAAE,KAAK,CAAC,OAAQ,KAAK,YAAY,KAAK,IAAI,EAAG;AAAA,EAClE,CAAC;AAAA,EACD,IAAI,CAAC,QAAQ,SAAS,MAAM,KAAK,CAAC,QAAQ,SAAS,MAAM,GAAG;AAAA,IAC1D,SAAS,KACP,0FACE,gEACJ;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;",
-  "debugId": "BFEA50A1CBA14B6A64756E2164756E21",
+  "mappings": ";AAmCA;AAAA;AAeO,MAAM,iCAAsC,iBAAY,0BAA0B,EAOtF;AAAC;AAaG,IAAM,0BAAkC;AASxC,IAAM,2BAA8C,CAAC,iBAAiB,eAAe;;ACpD5F,IAAM,WAAW,CAAC,YAAoB,WAAW;AAGjD,IAAM,mBAAmB,CAAC,YACxB,IAAI,IAAI,iBAAiB,SAAS,OAAO,WAAW,YAAY,GAAG,EAAE;AAgBhE,IAAM,oBAAoB,OAC/B,YACA,mBACqC;AAAA,EACrC,MAAM,WAA2B,CAAC;AAAA,EAElC,MAAM,eAAe,IAAI,KAAK,GAAG,8CAA8C;AAAA,EAC/E,IAAI,CAAE,MAAM,aAAa,OAAO,GAAI;AAAA,IAClC,SAAS,KAAK,0EAA0E;AAAA,IACxF,OAAO;AAAA,EACT;AAAA,EACA,MAAM,oBAAqB,MAAM,aAAa,KAAK,GAA4B;AAAA,EAI/E,MAAM,gBAAgB,kBAAkB,oBAAoB;AAAA,EAC5D,MAAM,MAAM,SAAS,aAAa;AAAA,EAElC,IAAI,CAAC,yBAAyB,SAAS,aAAa,GAAG;AAAA,IACrD,SAAS,KAGP,WAAW,6BAA6B,oBAAoB,6BAC1D,4BACA,iEACA,GAAG,yBAAyB,KAAK,IAAI,wBAAwB,eAC7D,wFACA,mBACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,IAAI,qBAAqB,eAAe;AAAA,IACtC,SAAS,KACP,2BAA2B,oBAAoB,8CAC7C,uBAAuB,oEACvB,gEACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,UAAU,IAAI,KAAK,GAAG,yBAAyB;AAAA,EACrD,IAAI,CAAE,MAAM,QAAQ,OAAO,GAAI;AAAA,IAC7B,SAAS,KAAK,uBAAuB;AAAA,IACrC,OAAO;AAAA,EACT;AAAA,EACA,MAAM,MAAO,MAAM,QAAQ,KAAK;AAAA,EAChC,MAAM,eAAe,IAAI,sBAAsB;AAAA,EAC/C,IAAI,iBAAiB,WAAW;AAAA,IAC9B,SAAS,KACP,uDAAuD,8BACrD,+FACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,IAAI,KAAK,GAAG,cAAc,cAAc;AAAA,EACvD,IAAI,CAAE,MAAM,OAAO,OAAO,GAAI;AAAA,IAC5B,SAAS,KAAK,0BAA0B,WAAW,wCAAwC;AAAA,IAC3F,OAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,IAAI,KAAK,iBAAiB,aAAa,CAAC;AAAA,EACrD,IAAI,CAAE,MAAM,KAAK,OAAO,GAAI;AAAA,IAE1B,SAAS,KAAK,uCAAuC,8BAA8B;AAAA,IACnF,OAAO;AAAA,EACT;AAAA,EACA,IAAK,MAAM,OAAO,KAAK,MAAQ,MAAM,KAAK,KAAK,GAAI;AAAA,IACjD,SAAS,KACP,GAAG,iFACD,uBACJ;AAAA,EACF;AAAA,EAKA,MAAM,cAAc,IAAI,KAAK,GAAG,iDAAiD;AAAA,EACjF,MAAM,cAAc,IAAI,KAAK,GAAG,iDAAiD;AAAA,EACjF,MAAM,SAAS;AAAA,EACf,OAAO,SAAS,WAAW,MAAM,QAAQ,IAAI;AAAA,IAC3C,YAAY,OAAO,EAAE,KAAK,CAAC,OAAQ,KAAK,YAAY,KAAK,IAAI,EAAG;AAAA,IAChE,YAAY,OAAO,EAAE,KAAK,CAAC,OAAQ,KAAK,YAAY,KAAK,IAAI,EAAG;AAAA,EAClE,CAAC;AAAA,EACD,IAAI,CAAC,QAAQ,SAAS,MAAM,KAAK,CAAC,QAAQ,SAAS,MAAM,GAAG;AAAA,IAC1D,SAAS,KACP,0FACE,gEACJ;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;",
+  "debugId": "461D34CD68FB220064756E2164756E21",
   "names": []
 }

package/dist/scope/patch-check.d.ts

@@ -3,9 +3,12 @@ export type PatchProblem = string;
 /**
  * @param projectDir The consuming stack's OWN repo root (where its `package.json` and
  *   `patches/` directory live) — never this kit's own.
- * @param alchemyVersion The version to check for — defaults to the version this package's
- *   own shipped patch targets ({@link PATCHED_ALCHEMY_VERSION}); a caller only overrides it to
- *   test a different pin.
+ * @param alchemyVersion The version to check for. Omitted (the normal case): the version
+ *   actually installed at `projectDir` is used, so a consumer on ANY version this package
+ *   ships a patch for ({@link PATCHED_ALCHEMY_VERSIONS}) passes without having to pin
+ *   {@link PATCHED_ALCHEMY_VERSION} specifically — a stack on beta.83 is checked against the
+ *   beta.83 patch, one on beta.81 against the beta.81 patch. A caller passes this explicitly
+ *   only to assert a SPECIFIC pin regardless of what happens to be installed (as the tests do).
  */
 export declare const checkAlchemyPatch: (projectDir: string, alchemyVersion?: string) => Promise<readonly PatchProblem[]>;
 //# sourceMappingURL=patch-check.d.ts.map

package/dist/scope/patch-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patch-check.d.ts","sourceRoot":"","sources":["../../src/scope/patch-check.ts"],"names":[],"mappings":"AAwBA,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAYlC;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,eAChB,MAAM,mBACF,MAAM,KACrB,OAAO,CAAC,SAAS,YAAY,EAAE,CAsEjC,CAAC"}
+{"version":3,"file":"patch-check.d.ts","sourceRoot":"","sources":["../../src/scope/patch-check.ts"],"names":[],"mappings":"AAwBA,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAYlC;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,eAChB,MAAM,mBACD,MAAM,KACtB,OAAO,CAAC,SAAS,YAAY,EAAE,CAwFjC,CAAC"}

package/docs/duplicate-resource-id.md

@@ -66,6 +66,29 @@ It touches three files so every consumer resolution path is covered: `src/Resour
 registering the same collision under `bun test` and under plain `node` both die with the
 identical message.
 
+### Supported versions
+
+`patchedDependencies` keys to an EXACT version string, and `bun`'s patch format is not
+guaranteed to apply across versions even when the surrounding file is otherwise unchanged — so
+each alchemy version this covers gets its OWN cut, byte-diffed against that version's real
+tarball, not a renamed copy:
+
+| alchemy version | patch file                            |
+| --------------- | ------------------------------------- |
+| `2.0.0-beta.81` | `patches/alchemy@2.0.0-beta.81.patch` |
+| `2.0.0-beta.83` | `patches/alchemy@2.0.0-beta.83.patch` |
+
+Between beta.81 and beta.83, upstream's only change touching these three files was an
+unrelated, cosmetic rewrite of `isResource` (a function body collapsed to an arrow
+expression) earlier in `src/Resource.ts` / `lib/Resource.js` — `lib/Resource.d.ts` is
+byte-identical between the two. The patched spot itself (the `TODO(sam)` branch and its
+surrounding context) is unchanged content, shifted by the line count that earlier rewrite
+added or removed. `PATCHED_ALCHEMY_VERSIONS` (`@homeflare/alchemy/scope`) is the authoritative
+list; `checkAlchemyPatch` walks it to find the entry matching what is actually installed.
+A version not in that list — beta.82 included — has no patch cut for it; adopt the nearest
+supported version's workflow below and open an issue, rather than assuming an untested patch
+applies.
+
 **Only `Type` is compared, never `Props`.** Comparing props as well would be wrong: a
 platform-typed resource's tagged pattern (`alchemy`'s own `Platform.ts` ~581) rewrites `Props`
 on a resource already registered, and a bare-tag forward reference legitimately registers with
@@ -74,15 +97,18 @@ first `yield*`; `Props` is not.
 
 ## Adopting it in a consuming stack
 
+Pick the file matching the stack's OWN installed `alchemy` version from the table above —
+here shown for beta.83; beta.81 is identical with the version string swapped:
+
 ```sh
-cp node_modules/@homeflare/alchemy/patches/alchemy@2.0.0-beta.81.patch patches/
+cp node_modules/@homeflare/alchemy/patches/alchemy@2.0.0-beta.83.patch patches/
 ```
 
 then add, in the stack's own root `package.json`:
 
 ```json
 "patchedDependencies": {
-  "alchemy@2.0.0-beta.81": "patches/alchemy@2.0.0-beta.81.patch"
+  "alchemy@2.0.0-beta.83": "patches/alchemy@2.0.0-beta.83.patch"
 }
 ```
 
@@ -107,11 +133,18 @@ if (problems.length > 0) {
 }
 ```
 
+With no second argument, it checks against whatever `alchemy` version is ACTUALLY installed
+at that stack's root — a stack on beta.83 is checked against the beta.83 patch, one on beta.81
+against the beta.81 patch, neither has to pin `PATCHED_ALCHEMY_VERSION` (which stays beta.81,
+for the consumer that already reads it directly) to pass. Pass a version explicitly only to
+assert a SPECIFIC pin regardless of what is installed.
+
 It is a static check — three file reads, no `effect` runtime spun up — covering: alchemy
-installed at the wrong version for the patch, no `patchedDependencies` entry at all, the
-referenced file missing or differing from this package's own shipped copy, and (the one failure
-mode none of those other checks would catch) declared and byte-identical but never actually
-applied.
+installed at a version `@homeflare/alchemy` has no shipped patch for at all (`PATCHED_ALCHEMY_VERSIONS`
+names every version it DOES cover), an explicit ask that disagrees with what is installed, no
+`patchedDependencies` entry at all, the referenced file missing or differing from this
+package's own shipped copy, and (the one failure mode none of those other checks would catch)
+declared and byte-identical but never actually applied.
 
 ## Upstream
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.60.0",
+  "version": "0.61.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/patches/alchemy@2.0.0-beta.83.patch

@@ -0,0 +1,149 @@
+diff --git a/lib/Resource.d.ts b/lib/Resource.d.ts
+index 07b92ae..bfd1a13 100644
+--- a/lib/Resource.d.ts
++++ b/lib/Resource.d.ts
+@@ -228,6 +228,24 @@ export declare class MissingImplementationError extends MissingImplementationErr
+     id: string;
+ }> {
+ }
++declare const DuplicateResourceIdError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
++    readonly _tag: "DuplicateResourceIdError";
++} & Readonly<A>;
++/**
++ * HOMEFLARE PATCH (homeflare-kit PR superseding #468; re-cut for alchemy@2.0.0-beta.83) — see
++ * Resource.ts for the full comment.
++ * A second resource of a DIFFERENT type registered at a logical id an earlier resource
++ * already claimed in the same scope (namespace + id, i.e. the same FQN).
++ */
++export declare class DuplicateResourceIdError extends DuplicateResourceIdError_base<{
++    message: string;
++    fqn: string;
++    /** The type that first claimed `fqn`. */
++    firstType: string;
++    /** The different type that tried to claim it again. */
++    secondType: string;
++}> {
++}
+ export declare const missingImplementation: (type: string, id: string) => MissingImplementationError;
+ /**
+  * Creates a resource constructor for a concrete resource type.
+diff --git a/lib/Resource.js b/lib/Resource.js
+index cbc4f09..b57d530 100644
+--- a/lib/Resource.js
++++ b/lib/Resource.js
+@@ -4,7 +4,7 @@ import * as Effectable from "effect/Effectable";
+ import * as Layer from "effect/Layer";
+ import * as Option from "effect/Option";
+ import { AdoptPolicy } from "./AdoptPolicy.js";
+-import { toFqn } from "./FQN.js";
++import { toFqn, toPath } from "./FQN.js";
+ import { CurrentNamespace } from "./Namespace.js";
+ import * as Output from "./Output.js";
+ import { Provider } from "./Provider.js";
+@@ -58,6 +58,14 @@ export const isResourceOfType = (value, type) => (typeof value === "object" || t
+  */
+ export class MissingImplementationError extends Data.TaggedError("MissingImplementationError") {
+ }
++/**
++ * HOMEFLARE PATCH (homeflare-kit PR superseding #468; re-cut for alchemy@2.0.0-beta.83) — see
++ * Resource.ts for the full comment.
++ * A second resource of a DIFFERENT type registered at a logical id an earlier resource
++ * already claimed in the same scope (namespace + id, i.e. the same FQN).
++ */
++export class DuplicateResourceIdError extends Data.TaggedError("DuplicateResourceIdError") {
++}
+ export const missingImplementation = (type, id) => new MissingImplementationError({
+     type,
+     id,
+@@ -126,7 +134,17 @@ export function Resource(type, options) {
+                     conflictingMode: ambientMode,
+                 }));
+             }
+-            // // TODO(sam): check if props are different and die
++            // HOMEFLARE PATCH: Type, not Props — see Resource.ts for why.
++            if (existing.Type !== type) {
++                return yield* Effect.die(new DuplicateResourceIdError({
++                    message: `REFUSING: duplicate resource id "${fqn}" in scope ` +
++                        `${toPath(namespace).join("/") || "(root)"}: first declared by ` +
++                        `${existing.Type}, again by ${type}`,
++                    fqn,
++                    firstType: existing.Type,
++                    secondType: type,
++                }));
++            }
+             return existing;
+         }
+         const bind = (...args) => typeof args[0] === "string"
+diff --git a/src/Resource.ts b/src/Resource.ts
+index c4d0a36..29e5ca7 100644
+--- a/src/Resource.ts
++++ b/src/Resource.ts
+@@ -5,7 +5,7 @@ import * as Layer from "effect/Layer";
+ import * as Option from "effect/Option";
+ import type { Pipeable } from "effect/Pipeable";
+ import { AdoptPolicy } from "./AdoptPolicy.ts";
+-import { toFqn } from "./FQN.ts";
++import { toFqn, toPath } from "./FQN.ts";
+ import type { Input, InputProps, PropsInput } from "./Input.ts";
+ import { CurrentNamespace, type NamespaceNode } from "./Namespace.ts";
+ import * as Output from "./Output.ts";
+@@ -292,6 +292,30 @@ export class MissingImplementationError extends Data.TaggedError("MissingImpleme
+   id: string;
+ }> {}
+ 
++/**
++ * A second resource of a DIFFERENT type registered (`yield*`ed) at a logical id an earlier
++ * resource already claimed in the same scope (namespace + id, i.e. the same FQN).
++ *
++ * ★ HOMEFLARE PATCH (homeflare-kit PR superseding #468, 2026-10-19; re-cut for
++ *   alchemy@2.0.0-beta.83). Upstream's own idempotent-registration branch below used to
++ *   return the FIRST-registered resource for ANY second `yield*` at an already-claimed FQN —
++ *   correct for "the same resource read from two call sites," but it never compared `Type`,
++ *   so a second, DIFFERENT resource that merely picked the same id silently lost: its props
++ *   were never written to `stack.resources`, so neither `Plan.make` nor any later inspection
++ *   could tell two different resources ever registered. Measured: `NixJobRetirement` and
++ *   `Caddy.Config` both declaring id `caddy` in one stack planned `[caddy] noop` and dropped
++ *   the retirement entirely. This error, and the `Type` check below, close that gap. Only
++ *   `Type` is compared, not `Props` — see the check's own comment for why.
++ */
++export class DuplicateResourceIdError extends Data.TaggedError("DuplicateResourceIdError")<{
++  message: string;
++  fqn: string;
++  /** The type that first claimed `fqn`. */
++  firstType: string;
++  /** The different type that tried to claim it again. */
++  secondType: string;
++}> {}
++
+ export const missingImplementation = (type: string, id: string) =>
+   new MissingImplementationError({
+     type,
+@@ -372,7 +396,27 @@ export function Resource<R extends ResourceLike>(
+             }),
+           );
+         }
+-        // // TODO(sam): check if props are different and die
++        // HOMEFLARE PATCH: the TODO above asked whether PROPS differ; this checks TYPE
++        // instead, which is the question that actually matters. Comparing props would be
++        // wrong — `Platform.ts`'s own tagged resources rewrite Props after first registration
++        // (Platform.ts ~581), and a bare-tag forward reference legitimately registers with
++        // `Props: undefined` until its `.make(...)` Layer builds (MissingImplementationError's
++        // own doc comment above). Type is stable from the resource's very first `yield*` and is
++        // exactly what distinguishes "the same resource, referenced twice" from "two different
++        // resources that picked the same id."
++        if (existing.Type !== type) {
++          return yield* Effect.die(
++            new DuplicateResourceIdError({
++              message:
++                `REFUSING: duplicate resource id "${fqn}" in scope ` +
++                `${toPath(namespace).join("/") || "(root)"}: first declared by ` +
++                `${existing.Type}, again by ${type}`,
++              fqn,
++              firstType: existing.Type,
++              secondType: type,
++            }),
++          );
++        }
+         return existing;
+       }
+       const bind = (

package/src/scope/duplicate-id.ts

@@ -16,13 +16,22 @@
  *      package exports, without needing to know alchemy carries its own copy of the same tag.
  *      Effect dispatches `catchTag` on the `_tag` STRING, not `instanceof`, so either class
  *      works identically as a catch target.
- *   2. `PATCHED_ALCHEMY_VERSION` — the exact alchemy version the patch was cut against.
+ *   2. `PATCHED_ALCHEMY_VERSION` — the exact alchemy version THIS package's own peer pin and
+ *      devDependency sit at, and the one `duplicate-id.test.ts` drives its real `Stack` against.
  *      Hardcoded, like `ESTATE_VERSIONS` in `@homeflare/config/versions` (the same reasoning:
  *      a second source of truth derived by import would cross `tsconfig.build.json`'s
  *      `rootDir: "src"` boundary to reach `package.json`). `duplicate-id.test.ts` asserts it
  *      still matches this package's own `peerDependencies.alchemy`, so a pin bump that forgets
  *      to re-cut the patch fails a test here instead of silently shipping a patch filename that
  *      no longer matches what consumers install.
+ *   3. `PATCHED_ALCHEMY_VERSIONS` — every alchemy version this package ships a CUT patch for
+ *      (currently beta.81 and beta.83, kit PR shipping beta.83's — a consumer on beta.82 or
+ *      beta.84 is NOT covered merely by being "close"; `bun`'s patch format keys to an exact
+ *      version string, and a patch cut against one version is not guaranteed to even apply to
+ *      another — see docs/duplicate-resource-id.md for why a diff was taken between the two
+ *      tarballs rather than assumed). `checkAlchemyPatch` (`patch-check.ts`) walks this list to
+ *      find the shipped patch matching a consumer's ACTUAL install, so a stack on beta.83 is not
+ *      forced to pin the single oldest supported version just to pass its own check.
  */
 import * as Data from 'effect/Data';
 
@@ -49,7 +58,23 @@ export class DuplicateResourceIdError extends Data.TaggedError('DuplicateResourc
 }> {}
 
 /**
- * The exact `alchemy` version `patches/alchemy@2.0.0-beta.81.patch` was cut against.
+ * The exact `alchemy` version `patches/alchemy@2.0.0-beta.81.patch` was cut against — this
+ * package's own peer pin, and the version `duplicate-id.test.ts` drives a real `Stack` over.
  * `duplicate-id.test.ts` keeps this honest against `package.json`'s own `peerDependencies`.
+ *
+ * ⛔ STAYS, MEANING BETA.81 — do not repoint this at beta.83. A consumer that calls
+ * `checkAlchemyPatch` with an explicit `alchemyVersion` (or reads this constant directly)
+ * must keep getting the same answer it always has; {@link PATCHED_ALCHEMY_VERSIONS} is the
+ * list a caller walks to find ALL supported pins, this one constant is not retargeted to mean
+ * "whichever is newest."
  */
 export const PATCHED_ALCHEMY_VERSION: string = '2.0.0-beta.81';
+
+/**
+ * Every alchemy version `@homeflare/alchemy` ships a cut `patches/alchemy@<version>.patch`
+ * for, oldest first. `checkAlchemyPatch` uses this to pick the shipped patch matching a
+ * consumer's ACTUAL installed version instead of only ever checking against
+ * {@link PATCHED_ALCHEMY_VERSION}. `patch-check.test.ts` and the static patch-coverage test
+ * both assert every entry here has a real `patches/alchemy@<version>.patch` file.
+ */
+export const PATCHED_ALCHEMY_VERSIONS: readonly string[] = ['2.0.0-beta.81', '2.0.0-beta.83'];

package/src/scope/index.ts

@@ -2,8 +2,9 @@
  * `@homeflare/alchemy/scope` — a consuming stack's own check that it carries the
  * duplicate-resource-id patch, and the error shape that patch throws.
  *
- * The fix itself is a patch to `alchemy`'s own `Resource.ts`
- * (`../../patches/alchemy@2.0.0-beta.81.patch`), applied at EACH consuming stack's own root
+ * The fix itself is a patch to `alchemy`'s own `Resource.ts`, one per supported alchemy version
+ * (`../../patches/alchemy@<version>.patch`, listed in `PATCHED_ALCHEMY_VERSIONS`: beta.81 and
+ * beta.83), applied at EACH consuming stack's own root
  * (`alchemy` is a peer dependency here, so `patchedDependencies` in this package's manifest
  * only reaches this package's own install, never a consumer's). docs/duplicate-resource-id.md
  * has the full guide, the exact `bun patch` workflow, and what this does and does not cover.
@@ -18,5 +19,9 @@
  * }
  * ```
  */
-export { DuplicateResourceIdError, PATCHED_ALCHEMY_VERSION } from './duplicate-id.ts';
+export {
+  DuplicateResourceIdError,
+  PATCHED_ALCHEMY_VERSION,
+  PATCHED_ALCHEMY_VERSIONS,
+} from './duplicate-id.ts';
 export { checkAlchemyPatch, type PatchProblem } from './patch-check.ts';

package/src/scope/patch-check.test.ts

@@ -2,18 +2,27 @@
  * `checkAlchemyPatch` against a fixture consumer directory — every failure mode a consuming
  * stack's own `check` should catch, built one `mkdtemp` at a time rather than against this
  * repo's own tree, so each case controls exactly what is "installed".
+ *
+ * ★ TWO SUPPORTED VERSIONS, NOT ONE. `@homeflare/alchemy` ships a cut patch for both
+ *   `2.0.0-beta.81` ({@link PATCHED_ALCHEMY_VERSION}) and `2.0.0-beta.83` — a consumer on
+ *   either passes `checkAlchemyPatch` without pinning a specific version; one on neither is
+ *   the "unlisted version" case below.
  */
 import { mkdtempSync, rmSync } from 'node:fs';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, describe, expect, test } from 'bun:test';
-import { PATCHED_ALCHEMY_VERSION } from './duplicate-id.ts';
+import { PATCHED_ALCHEMY_VERSION, PATCHED_ALCHEMY_VERSIONS } from './duplicate-id.ts';
 import { checkAlchemyPatch } from './patch-check.ts';
 
-const OUR_PATCH = await Bun.file(
-  new URL(`../../patches/alchemy@${PATCHED_ALCHEMY_VERSION}.patch`, import.meta.url),
-).text();
+const BETA_83 = '2.0.0-beta.83';
+
+const shippedPatch = (version: string) =>
+  Bun.file(new URL(`../../patches/alchemy@${version}.patch`, import.meta.url)).text();
+
+const OUR_PATCH_81 = await shippedPatch(PATCHED_ALCHEMY_VERSION);
+const OUR_PATCH_83 = await shippedPatch(BETA_83);
 
 let dir: string | undefined;
 afterEach(() => {
@@ -44,19 +53,31 @@ const installAlchemy = async (
   await writeFile(join(alchemyDir, 'lib', 'Resource.js'), marker);
 };
 
+/** Declares `patchedDependencies` for `version`, pointing at a copy of `patchContent`. */
+const declarePatch = async (root: string, version: string, patchContent: string) => {
+  await mkdir(join(root, 'patches'), { recursive: true });
+  await writeFile(join(root, 'patches', 'alchemy.patch'), patchContent);
+  await writePkg(root, {
+    patchedDependencies: { [`alchemy@${version}`]: 'patches/alchemy.patch' },
+  });
+};
+
 describe('checkAlchemyPatch', () => {
   test('alchemy not installed at all', async () => {
     const root = scratch();
     expect(await checkAlchemyPatch(root)).toEqual([expect.stringContaining('not installed')]);
   });
 
-  test('installed alchemy is a different version than the patch targets', async () => {
+  test('installed alchemy is a version this package has no shipped patch for', async () => {
     const root = scratch();
     await installAlchemy(root, { version: '2.0.0-beta.999' });
     const problems = await checkAlchemyPatch(root);
     expect(problems).toHaveLength(1);
     expect(problems[0]).toContain('2.0.0-beta.999');
-    expect(problems[0]).toContain(PATCHED_ALCHEMY_VERSION);
+    // Every supported version is named, so the caller knows what to re-cut against.
+    for (const supported of PATCHED_ALCHEMY_VERSIONS) {
+      expect(problems[0]).toContain(supported);
+    }
   });
 
   test('right version installed, but package.json has no patchedDependencies entry', async () => {
@@ -80,11 +101,7 @@ describe('checkAlchemyPatch', () => {
   test('the referenced patch file differs from what @homeflare/alchemy ships', async () => {
     const root = scratch();
     await installAlchemy(root);
-    await mkdir(join(root, 'patches'), { recursive: true });
-    await writeFile(join(root, 'patches', 'alchemy.patch'), 'not the real patch');
-    await writePkg(root, {
-      patchedDependencies: { [`alchemy@${PATCHED_ALCHEMY_VERSION}`]: 'patches/alchemy.patch' },
-    });
+    await declarePatch(root, PATCHED_ALCHEMY_VERSION, 'not the real patch');
     const problems = await checkAlchemyPatch(root);
     expect(problems).toEqual([expect.stringContaining('differs')]);
   });
@@ -92,23 +109,34 @@ describe('checkAlchemyPatch', () => {
   test('declared and byte-identical, but never actually applied', async () => {
     const root = scratch();
     await installAlchemy(root, { applied: false });
-    await mkdir(join(root, 'patches'), { recursive: true });
-    await writeFile(join(root, 'patches', 'alchemy.patch'), OUR_PATCH);
-    await writePkg(root, {
-      patchedDependencies: { [`alchemy@${PATCHED_ALCHEMY_VERSION}`]: 'patches/alchemy.patch' },
-    });
+    await declarePatch(root, PATCHED_ALCHEMY_VERSION, OUR_PATCH_81);
     const problems = await checkAlchemyPatch(root);
     expect(problems).toEqual([expect.stringContaining('not applied')]);
   });
 
-  test('declared, byte-identical, and applied: no problems', async () => {
+  test('beta.81, declared, byte-identical, and applied: no problems', async () => {
     const root = scratch();
     await installAlchemy(root);
-    await mkdir(join(root, 'patches'), { recursive: true });
-    await writeFile(join(root, 'patches', 'alchemy.patch'), OUR_PATCH);
-    await writePkg(root, {
-      patchedDependencies: { [`alchemy@${PATCHED_ALCHEMY_VERSION}`]: 'patches/alchemy.patch' },
-    });
+    await declarePatch(root, PATCHED_ALCHEMY_VERSION, OUR_PATCH_81);
+    expect(await checkAlchemyPatch(root)).toEqual([]);
+  });
+
+  test('beta.83, declared, byte-identical, and applied: no problems, no version argument needed', async () => {
+    const root = scratch();
+    await installAlchemy(root, { version: BETA_83 });
+    await declarePatch(root, BETA_83, OUR_PATCH_83);
+    // No explicit alchemyVersion — a beta.83 consumer must pass by what is ACTUALLY
+    // installed, not by also being pinned to PATCHED_ALCHEMY_VERSION (beta.81).
     expect(await checkAlchemyPatch(root)).toEqual([]);
   });
+
+  test('an explicit alchemyVersion that does not match what is installed is still a problem', async () => {
+    const root = scratch();
+    await installAlchemy(root, { version: BETA_83 });
+    await declarePatch(root, BETA_83, OUR_PATCH_83);
+    const problems = await checkAlchemyPatch(root, PATCHED_ALCHEMY_VERSION);
+    expect(problems).toHaveLength(1);
+    expect(problems[0]).toContain(BETA_83);
+    expect(problems[0]).toContain(PATCHED_ALCHEMY_VERSION);
+  });
 });

package/src/scope/patch-check.ts

@@ -20,7 +20,7 @@
  * ⛔ IT REPORTS, IT DOES NOT REPAIR, same as `checkProject` in `@homeflare/config/check` — this
  *   never edits `package.json` or re-runs `bun install` for the caller.
  */
-import { PATCHED_ALCHEMY_VERSION } from './duplicate-id.ts';
+import { PATCHED_ALCHEMY_VERSION, PATCHED_ALCHEMY_VERSIONS } from './duplicate-id.ts';
 
 /** One thing wrong with a consuming stack's alchemy patch, in the imperative. */
 export type PatchProblem = string;
@@ -38,16 +38,18 @@ type PackageJson = {
 /**
  * @param projectDir The consuming stack's OWN repo root (where its `package.json` and
  *   `patches/` directory live) — never this kit's own.
- * @param alchemyVersion The version to check for — defaults to the version this package's
- *   own shipped patch targets ({@link PATCHED_ALCHEMY_VERSION}); a caller only overrides it to
- *   test a different pin.
+ * @param alchemyVersion The version to check for. Omitted (the normal case): the version
+ *   actually installed at `projectDir` is used, so a consumer on ANY version this package
+ *   ships a patch for ({@link PATCHED_ALCHEMY_VERSIONS}) passes without having to pin
+ *   {@link PATCHED_ALCHEMY_VERSION} specifically — a stack on beta.83 is checked against the
+ *   beta.83 patch, one on beta.81 against the beta.81 patch. A caller passes this explicitly
+ *   only to assert a SPECIFIC pin regardless of what happens to be installed (as the tests do).
  */
 export const checkAlchemyPatch = async (
   projectDir: string,
-  alchemyVersion: string = PATCHED_ALCHEMY_VERSION,
+  alchemyVersion?: string,
 ): Promise<readonly PatchProblem[]> => {
   const problems: PatchProblem[] = [];
-  const key = patchKey(alchemyVersion);
 
   const installedPkg = Bun.file(`${projectDir}/node_modules/alchemy/package.json`);
   if (!(await installedPkg.exists())) {
@@ -55,11 +57,30 @@ export const checkAlchemyPatch = async (
     return problems;
   }
   const installedVersion = ((await installedPkg.json()) as { version?: string }).version;
-  if (installedVersion !== alchemyVersion) {
+
+  // No explicit ask: check against whatever is ACTUALLY installed, not a single hardcoded
+  // pin — that is what lets a beta.83 consumer pass without also being on beta.81.
+  const targetVersion = alchemyVersion ?? installedVersion ?? PATCHED_ALCHEMY_VERSION;
+  const key = patchKey(targetVersion);
+
+  if (!PATCHED_ALCHEMY_VERSIONS.includes(targetVersion)) {
+    problems.push(
+      // ★ Name the version being CHECKED: with an explicit `alchemyVersion` it can differ from
+      //   the installed one, and naming the installed version then blames a supported one.
+      `alchemy ${targetVersion} (installed: ${installedVersion ?? 'unknown'}) is a version ` +
+        `@homeflare/alchemy has ` +
+        `no duplicate-resource-id patch for — supported versions are ` +
+        `${PATCHED_ALCHEMY_VERSIONS.join(', ')}; cut a new patches/${key}.patch ` +
+        "(@homeflare/alchemy's own patches/) before bumping alchemy, or this install has no " +
+        'protection at all',
+    );
+    return problems;
+  }
+  if (installedVersion !== targetVersion) {
     problems.push(
       `node_modules/alchemy is ${installedVersion ?? 'unknown'}, but the duplicate-resource-id ` +
-        `patch targets ${alchemyVersion} — bump the patch (@homeflare/alchemy's own ` +
-        'patches/) before bumping alchemy, or this install has no protection at all',
+        `check was asked for ${targetVersion} — pass the installed version explicitly, or omit ` +
+        'alchemyVersion to check against whatever is actually installed',
     );
     return problems;
   }
@@ -84,7 +105,7 @@ export const checkAlchemyPatch = async (
     problems.push(`package.json declares "${key}" at ${declaredPath}, but that file is missing`);
     return problems;
   }
-  const ours = Bun.file(shippedPatchPath(alchemyVersion));
+  const ours = Bun.file(shippedPatchPath(targetVersion));
   if (!(await ours.exists())) {
     // The kit's own tarball is missing its patch — a packaging bug, not the consumer's.
     problems.push(`@homeflare/alchemy ships no patches/${key}.patch to compare against`);

package/src/scope/patch-coverage.test.ts

@@ -0,0 +1,50 @@
+/**
+ * Static coverage: every version `PATCHED_ALCHEMY_VERSIONS` claims to support actually has a
+ * shipped `patches/alchemy@<version>.patch` carrying the `DuplicateResourceIdError` fix.
+ *
+ * ★ STATIC, NOT FUNCTIONAL — no network. Proving a patch APPLIES to the real upstream tarball
+ *   needs `npm pack alchemy@<version>` pulled live and diffed, which this suite's own CI lane
+ *   cannot assume has network access (and must not: patch-check.ts's own header explains why a
+ *   consumer's `check` stays a static file read rather than a network-dependent probe). The
+ *   patch for {@link PATCHED_ALCHEMY_VERSION} (beta.81) already has that proof the hard way —
+ *   `duplicate-id.test.ts` drives a REAL patched `Stack` over the devDependency `alchemy`
+ *   install, which only passes because `bun install`'s `patchedDependencies` actually applied
+ *   it. This test is the one that would catch a version ADDED to the list here without a
+ *   patch file ever being cut for it, or a patch file that silently regressed back to the
+ *   upstream TODO.
+ */
+import { describe, expect, test } from 'bun:test';
+import { PATCHED_ALCHEMY_VERSIONS } from './duplicate-id.ts';
+
+/** `test.each` wants a plain mutable array of a known element type, not `readonly string[]`. */
+const versions: string[] = [...PATCHED_ALCHEMY_VERSIONS];
+
+const patchFile = (version: string) =>
+  Bun.file(new URL(`../../patches/alchemy@${version}.patch`, import.meta.url));
+
+describe('every supported alchemy version ships a cut patch', () => {
+  test.each(versions)('alchemy@%s has a patches/ file', async (version: string) => {
+    expect(await patchFile(version).exists()).toBe(true);
+  });
+
+  test.each(versions)(
+    'alchemy@%s patch carries the DuplicateResourceIdError fix',
+    async (version: string) => {
+      const text = await patchFile(version).text();
+      expect(text).toContain('DuplicateResourceIdError');
+      // The TODO it replaces must be gone from the ADDED ("+") side of the diff — present
+      // only as part of a removed ("-") line, never re-introduced unpatched.
+      const addedLines = text.split('\n').filter((line) => line.startsWith('+'));
+      expect(addedLines.some((line) => line.includes('TODO(sam)'))).toBe(false);
+    },
+  );
+
+  test('touches the three files every consumer resolution path needs', async () => {
+    for (const version of PATCHED_ALCHEMY_VERSIONS) {
+      const text = await patchFile(version).text();
+      expect(text).toContain('a/src/Resource.ts');
+      expect(text).toContain('a/lib/Resource.js');
+      expect(text).toContain('a/lib/Resource.d.ts');
+    }
+  });
+});