@homeflare/alchemy 0.7.0 → 0.8.0

package/README.md

@@ -119,17 +119,37 @@ delete-first.
 - ⛔ **No silent sudo:** the system domain needs a deploy started as root, or a `privileged` runner.
 - ⚠️ `org.nixos.*` jobs are never adopted. Guide and nix-darwin cutover: [docs/launchd.md](./docs/launchd.md).
 
+### Deploying as yourself — `sudoRunner()`
+
+```ts
+launchdProviders(sudoRunner({ prefixes: ['/Library/LaunchDaemons', '/opt/example'] }));
+```
+
+The deploy runs as you. Only `launchctl bootstrap | bootout | kickstart` in the system domain, and
+`install` / `rm` of a file under a declared prefix, go through `sudo -n`, in exact argv shapes. Each
+one is logged (argv only, never content) before it runs. A plan never calls sudo.
+
+- ⛔ **Opt-in, never a fallback**, and it never prompts: if sudo needs a password, the call fails at
+  once and says to run `sudo -v`, or to grant exactly these commands `NOPASSWD`.
+- ⚠️ Refused before sudo is asked: any other argv, a prefix that is not a real directory only root
+  may write, a path outside every prefix that needs root, a symlink on the way, a file you could
+  not read back, and another user's `gui/<uid>`.
+- Full list, sudoers cautions and limits: [docs/launchd-sudo.md](./docs/launchd-sudo.md).
+
 ## Caddy — `@homeflare/alchemy/caddy`
 
 `CaddyConfig` declares a running Caddy's config as Caddyfile text, applied through Caddy's own admin
 API: `POST /load` (graceful reload; Caddy keeps the old config if it refuses the new one, and the
-deploy says why), `GET /config/` for drift. A running Caddy is adopted on first read.
-`caddyWithFile()` also writes the file Caddy starts from, with `HostFile`; `caddyProviders()` provides
-the transport, `http://127.0.0.1:2019` by default.
+deploy says why), `GET /config/` for drift. `caddyWithFile()` also writes the file Caddy starts from,
+with `HostFile`; `caddyProviders()` provides the transport, `http://127.0.0.1:2019` by default.
 
+- ⛔ **Nothing is adopted silently:** a running Caddy whose config is not the declared one plans as
+  `Unowned`, and the deploy needs `--adopt`.
 - ⛔ **No secrets in the Caddyfile** (state is unencrypted): `{env.NAME}` / `{file./path}` placeholders.
 - ⛔ **The admin API stays on loopback or a unix socket**, and a Caddyfile that would move it is refused.
-- ⛔ **Delete never unloads or stops Caddy.** Order of file and load, `--resume`: [docs/caddy.md](./docs/caddy.md).
+- ⛔ **Delete never unloads or stops Caddy.** Order of file and load: [docs/caddy.md](./docs/caddy.md).
+- ★ **Managed Caddies run `--resume` with their own `XDG_CONFIG_HOME`**, so a restart runs the last
+  config Caddy accepted — and after one, SIGUSR1 has no file to reload. Why, and the rest: same doc.
 
 ## Credentials
 
@@ -144,12 +164,6 @@ like a bad credential.
 
 ## Peers — and one override you need
 
-```sh
-bun add @homeflare/alchemy alchemy@2.0.0-beta.79 effect@4.0.0-rc.115 \
-        @effect/platform-node@4.0.0-rc.115 cloudflare@4.5.0 mime@4.1.0 \
-        @distilled.cloud/cloudflare@1.0.0-rc.12
-```
-
 ⚠️ Peers, not dependencies: Alchemy's resource registry and Effect's context both break if
 two copies load in one process.
 
@@ -167,33 +181,8 @@ two copies load in one process.
 }
 ```
 
-🔴 **Why, measured 2026-09-16 on 0.1.0 and re-checked 2026-09-17 against Alchemy 78.**
-Effect's `rc` line is not semver-compatible with itself. Alchemy 78's peer is
-`effect >= 4.0.0-rc.115`; an unlocked `@effect/platform-node-shared` still floats to the
-next rc and breaks at import. Pin the whole set.
-
-| what resolves                                                 | what happens                                           |
-| ------------------------------------------------------------- | ------------------------------------------------------ |
-| Alchemy 77 + `effect` → rc.115 (measured 2026-09-16)          | `TypeError: Config.string is not a function` at import |
-| `@effect/platform-node-shared` newer than the pinned `effect` | `Cannot find module 'effect/ByteSize'`                 |
-| `rolldown` → 1.2.9 via vite's `~1.2.6` (measured 2026-09-16)  | `GET …/rolldown-1.2.9.tgz - 404` at `bun add`          |
-| no `mime` (measured 2026-09-17 against Alchemy 78)            | `Cannot find package 'mime'` from cloudflare-runtime   |
-
-Alchemy 78 adapted to rc.115 — that first row is why we used to pin 112, not a reason to
-stay there. The override is still the only thing that holds the set together.
-
-⚠️ `@effect/platform-node` is **required, not optional**: Alchemy's module graph reaches
-`Cloudflare/Workers/WorkerBridge → @effect/platform-node/NodeServices` even when you only
-import the Proxmox subpath.
-
-⚠️ So is `mime`. Alchemy 78's `@alchemy.run/cloudflare-runtime` imported it without
-declaring it (measured 2026-09-17). 79 declares it; the peer stays so a consumer
-that followed the 78 README does not drop a required line.
-
-⚠️ So is `cloudflare`. It was marked optional in 0.1.1, which claimed the `/cloudflare`
-subpath would degrade without it — measured 2026-09-16, the subpath does not load at all:
-`Cannot find package 'cloudflare'`. An optional peer should mean a feature is absent, not
-that an import fails.
+Why each peer is required and each pin exists — the measurements, and the error a missing one
+produces: [docs/peers.md](./docs/peers.md).
 
 ## License
 

package/dist/caddy/config-lifecycle.d.ts

@@ -9,9 +9,11 @@
  *   · live ≠ stored — DRIFT: a hand `curl` to the API, or a restart that loaded a different file
  *     (or an `autosave.json` holding someone else's change, under `--resume`).
  *   · declared = live — nothing to load, whatever the state says.
+ * With NO state there is no stored digest, and the question is whose config is running: see
+ * `claimable` below, which both the adoption probe and the apply ask.
  */
 import type { Diff } from 'alchemy/Diff';
-import type { CaddyAdmin } from './admin.ts';
+import { type CaddyAdmin } from './admin.ts';
 import { type CaddyConfigAttributes, type CaddyConfigProps } from './config-form.ts';
 type Desired = {
     readonly digest: string;
@@ -26,6 +28,31 @@ type Desired = {
 export declare const desiredConfig: (admin: CaddyAdmin, props: CaddyConfigProps) => Promise<Desired>;
 /** What is running now, as attributes. `sourceFile` is carried over, never discovered. */
 export declare const readLive: (admin: CaddyAdmin, sourceFile?: string) => Promise<CaddyConfigAttributes>;
+/**
+ * ⛔ WITH NO STATE, A RUNNING CONFIG IS THIS STACK'S ONLY IF IT IS THE DECLARED ONE (decision,
+ *   2026-09-21: CaddyConfig must not adopt silently — the house rule HostFile and LaunchdJob keep).
+ *   Anything else was put there by a person, another tool or another stack, and loading over it
+ *   replaces every site it serves. ★ A config that serves nothing (`null`, or no apps) is claimable
+ *   too: there is nothing to take over, as an empty R2 lock rule set reads as no lock.
+ */
+export declare const claimable: (running: unknown, declaredDigest: string) => boolean;
+export type Probe = {
+    readonly attributes: CaddyConfigAttributes;
+    /** The live config IS the declared one: adopting it changes nothing. */
+    readonly ours: boolean;
+    /** Why the declaration could not be compared, when it could not — the Caddy is then not ours. */
+    readonly unchecked?: string;
+};
+/**
+ * The adoption probe — `read` with no state: `undefined` when Caddy serves nothing (plan a create),
+ * else the live attributes and whether they are provably ours (the provider brands the rest
+ * `Unowned`, and the plan refuses them without `--adopt`).
+ * ⛔ IT NEVER THROWS OVER THE DECLARATION. The engine also runs this read to recover an interrupted
+ *   create, with THAT deploy's props (Plan.ts, `status: "creating"`) — so a Caddyfile that failed to
+ *   adapt then would fail every later plan, the one carrying the fix included. What cannot be
+ *   compared is "not proven ours", with the reason; the next diff or apply validates the Caddyfile.
+ */
+export declare const probeLive: (admin: CaddyAdmin, caddyfile: string | undefined, sourceFile?: string) => Promise<Probe | undefined>;
 /**
  * ★ NEVER `replace`. Nothing in the props names a different object: a new Caddyfile is a reload of
  *   the same Caddy, and `sourceFile` is a header. (Which Caddy is the transport's business — see
@@ -39,7 +66,26 @@ export type Applied = {
     /** Whether a `POST /load` was sent (false when Caddy already ran this config). */
     readonly loaded: boolean;
 };
-/** Load the Caddyfile unless Caddy already runs it, then read it back and insist it matches. */
-export declare const reconcileConfig: (admin: CaddyAdmin, props: CaddyConfigProps) => Promise<Applied>;
+/**
+ * What this apply may load over — config.ts decides from the state and the adopt setting:
+ *   · `takeOver` — any running config: the state was applied to THIS Caddy (an update, drift
+ *     correction, or a create the engine adopted), or adoption is on (`--adopt`, or the
+ *     resource's own `adopt(true)` — host-effect.ts adoptEnabled).
+ *   · otherwise only a claimable one — plus, as `stored`, the digest the state last recorded: a
+ *     Caddy reached at a NEW endpoint that runs exactly that is the same config under another name.
+ */
+export type Authority = {
+    readonly takeOver: boolean;
+    readonly stored?: string;
+};
+/**
+ * Load the Caddyfile unless Caddy already runs it, then read it back and insist it matches.
+ * ⛔ WITHOUT `takeOver`, A CONFIG THE STACK CANNOT CLAIM IS NEVER LOADED OVER. The engine's adoption
+ *   probe cannot guard every create: it is skipped while `news` holds an Output — ALWAYS on
+ *   caddyWithFile's first deploy (`sourceFile` is its HostFile's path) — and a Caddy that was down at
+ *   plan time read as nothing. Nor does state vouch for a Caddy the transport NOW reaches at another
+ *   endpoint (diff plans that as an update). Refused here, before any `/load`, like HostFile's.
+ */
+export declare const reconcileConfig: (admin: CaddyAdmin, props: CaddyConfigProps, authority: Authority) => Promise<Applied>;
 export {};
 //# sourceMappingURL=config-lifecycle.d.ts.map

package/dist/caddy/config-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-lifecycle.d.ts","sourceRoot":"","sources":["../../src/caddy/config-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAQ7C,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAEtB,MAAM,kBAAkB,CAAC;AAQ1B,KAAK,OAAO,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAcjF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,UACjB,UAAU,SACV,gBAAgB,KACtB,OAAO,CAAC,OAAO,CAUjB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,QAAQ,UACZ,UAAU,eACJ,MAAM,KAClB,OAAO,CAAC,qBAAqB,CAI9B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,UAAU,UACd,UAAU,QACX,gBAAgB,UACd,qBAAqB,KAC5B,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,eAAe,UACnB,UAAU,SACV,gBAAgB,KACtB,OAAO,CAAC,OAAO,CAmCjB,CAAC"}
+{"version":3,"file":"config-lifecycle.d.ts","sourceRoot":"","sources":["../../src/caddy/config-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,KAAK,UAAU,EAAyB,MAAM,YAAY,CAAC;AAQpE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAEtB,MAAM,kBAAkB,CAAC;AAQ1B,KAAK,OAAO,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAcjF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,UACjB,UAAU,SACV,gBAAgB,KACtB,OAAO,CAAC,OAAO,CAUjB,CAAC;AAYF,0FAA0F;AAC1F,eAAO,MAAM,QAAQ,UACZ,UAAU,eACJ,MAAM,KAClB,OAAO,CAAC,qBAAqB,CACiC,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,YAAa,OAAO,kBAAkB,MAAM,KAAG,OACD,CAAC;AAErE,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,UACb,UAAU,aACN,MAAM,GAAG,SAAS,eAChB,MAAM,KAClB,OAAO,CAAC,KAAK,GAAG,SAAS,CAmB3B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,UAAU,UACd,UAAU,QACX,gBAAgB,UACd,qBAAqB,KAC5B,OAAO,CAAC,IAAI,CAYd,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,UACnB,UAAU,SACV,gBAAgB,aACZ,SAAS,KACnB,OAAO,CAAC,OAAO,CA8CjB,CAAC"}

package/dist/caddy/config.d.ts

@@ -5,8 +5,7 @@
  * - create / update — `POST /adapt` (validate), `POST /load` with `text/caddyfile` (a graceful
  *   reload; Caddy keeps the old config if it refuses the new one, and the error names why), then
  *   `GET /config/` and insist it matches. Skipped when Caddy already runs this config.
- * - read — the digest of `GET /config/`. ★ WITH NO STATE, A RUNNING CADDY IS ADOPTED: its live
- *   config becomes the starting point, and the deploy's forced update loads the declared one.
+ * - read — the digest of `GET /config/`. With no state it is the adoption probe (below).
  * - diff — declared, live and stored digests (config-lifecycle.ts). Never `replace`.
  * - delete — ⛔ NOTHING. See below.
  *
@@ -15,6 +14,11 @@
  *   servers. `retain` is the default (the engine never calls delete); with `destroy` the handler
  *   still only forgets. It never calls `/stop` (which exits the process) or `DELETE /config/`.
  *   To empty a Caddy, do it by hand at its admin API.
+ * ⛔ NOTHING IS ADOPTED SILENTLY (decision, 2026-09-21 — the house rule HostFile and LaunchdJob
+ *   keep). With no state, a running Caddy whose live config IS the declared one reads as ours (the
+ *   adoption changes nothing); any other config reads as `Unowned`, and the plan refuses it unless
+ *   the deploy runs with `--adopt`. A Caddy serving nothing reads as absent: a create. Where the
+ *   engine skips that probe, reconcile refuses the same takeover (config-lifecycle.ts).
  * ⛔ `caddyfile` IS NEVER A SECRET — see config-form.ts; refused before anything is sent.
  * ⚠️ WHICH CADDY is the transport's (providers.ts), not a prop: one CaddyAdmin per stack.
  */

package/dist/caddy/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/caddy/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,iBAAiB,EAAyB,MAAM,YAAY,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGhF,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAsBH,eAAO,MAAM,mBAAmB,8FAsD7B,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/caddy/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,iBAAiB,EAAyB,MAAM,YAAY,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGhF,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAsBH,eAAO,MAAM,mBAAmB,8FAsF7B,CAAC"}

package/dist/caddy/fake-caddy.d.ts

@@ -17,6 +17,7 @@
  * ★ `listenPort` is the port Caddy BELIEVES it listens on — its Host check uses it — while the
  *   fake really listens on an ephemeral one: a Caddy on its default :2019 behind a forward.
  */
+import type { CaddyAdmin } from './admin.ts';
 export type Seen = {
     readonly method: string;
     readonly path: string;
@@ -40,4 +41,14 @@ export declare const fakeCaddy: (options?: {
     origins?: string[];
     listenPort?: number;
 }) => FakeCaddy;
+/**
+ * A fake Caddy on its DEFAULT :2019 behind a forward (`hostHeader`), and the transport to it.
+ * ★ Addressed that way so a Caddyfile with no `admin` line — the common case — passes the guard.
+ *   A Caddy reached on any other port needs `admin <address>` declared, or the first load would
+ *   move it (admin-guard.ts).
+ */
+export declare const fakeDefaultCaddy: (running?: unknown) => {
+    admin: CaddyAdmin;
+    caddy: FakeCaddy;
+};
 //# sourceMappingURL=fake-caddy.d.ts.map

package/dist/caddy/fake-caddy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-caddy.d.ts","sourceRoot":"","sources":["../../src/caddy/fake-caddy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtB,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,IAAI,IAAI,IAAI,CAAC;CACd,CAAC;AAqDF,eAAO,MAAM,SAAS,aACX;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KACrF,SAoEF,CAAC"}
+{"version":3,"file":"fake-caddy.d.ts","sourceRoot":"","sources":["../../src/caddy/fake-caddy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtB,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,IAAI,IAAI,IAAI,CAAC;CACd,CAAC;AAqDF,eAAO,MAAM,SAAS,aACX;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KACrF,SAoEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,aAAc,OAAO,KAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAQzF,CAAC"}

package/dist/caddy/index.d.ts

@@ -6,7 +6,8 @@
  *   the digest, the guards and the admin calls are internals; an `export *` would publish them.
  * ⛔ THE ADMIN API STAYS ON LOOPBACK OR A UNIX SOCKET. It has no authentication; localCaddyAdmin()
  *   refuses any other address, and a Caddyfile that would move or expose it is refused before load.
- * Guide, order of file and load, `--resume` and secrets: docs/caddy.md.
+ * ⛔ NOTHING IS ADOPTED SILENTLY: a running config that is not the declared one needs `--adopt`.
+ * Guide, order of file and load, adoption, `--resume` and secrets: docs/caddy.md.
  */
 export type { CaddyAdmin, CaddyAdminListener, CaddyAdminRequest, CaddyAdminResponse, } from './admin.ts';
 export { CaddyAdminService, CaddyUnreachableError, caddyAdminLayer } from './admin.ts';

package/dist/caddy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/caddy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/caddy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/caddy/index.js

@@ -292,12 +292,17 @@ var loadCaddyfile = async (admin, caddyfile, sourceFile) => {
 };
 // src/caddy/config.ts
 import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
 import * as Effect2 from "effect/Effect";
 
 // src/launchd/host-effect.ts
+import { AdoptPolicy } from "alchemy/AdoptPolicy";
+import { AlchemyContext } from "alchemy/AlchemyContext";
+import { Stack } from "alchemy/Stack";
 import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
 var lift = (step) => Effect.tryPromise({
   catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
   try: step
@@ -308,6 +313,17 @@ var resolvedString = (news, key) => {
   const value = news[key];
   return typeof value === "string" ? value : undefined;
 };
+var adoptEnabled = (fqn) => Effect.gen(function* () {
+  const stack = yield* Effect.serviceOption(Stack);
+  const scoped = Option.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
+  if (scoped !== undefined)
+    return scoped;
+  const policy = yield* Effect.serviceOption(AdoptPolicy);
+  if (Option.isSome(policy))
+    return policy.value;
+  const context = yield* Effect.serviceOption(AlchemyContext);
+  return Option.isSome(context) ? context.value.adopt : false;
+});
 
 // src/caddy/admin-guard.ts
 var DEFAULT_ADMIN_PORT = 2019;
@@ -544,20 +560,48 @@ var desiredConfig = async (admin, props) => {
     throw refuse(admin, guard.join("; "));
   return { digest: configDigest(adapted.config), warnings: adapted.warnings };
 };
-var readLive = async (admin, sourceFile) => ({
-  configSha256: configDigest(await readRunningConfig(admin)),
+var attributesOf = (admin, running, sourceFile) => ({
+  configSha256: configDigest(running),
   endpoint: admin.endpoint,
   ...sourceFile === undefined ? {} : { sourceFile }
 });
+var readLive = async (admin, sourceFile) => attributesOf(admin, await readRunningConfig(admin), sourceFile);
+var claimable = (running, declaredDigest) => servesNothing(running) || configDigest(running) === declaredDigest;
+var probeLive = async (admin, caddyfile, sourceFile) => {
+  const running = await readRunningConfig(admin);
+  if (servesNothing(running))
+    return;
+  const attributes = attributesOf(admin, running, sourceFile);
+  if (caddyfile === undefined) {
+    return { attributes, ours: false, unchecked: "the stored Caddyfile is not plain text" };
+  }
+  try {
+    const want = await desiredConfig(admin, { caddyfile });
+    return { attributes, ours: claimable(running, want.digest) };
+  } catch (cause) {
+    if (cause instanceof CaddyUnreachableError)
+      throw cause;
+    return {
+      attributes,
+      ours: false,
+      unchecked: cause instanceof Error ? cause.message : String(cause)
+    };
+  }
+};
 var diffConfig = async (admin, news, output) => {
   const want = await desiredConfig(admin, news);
   const live = await readLive(admin);
   const converged = want.digest === live.configSha256 && live.configSha256 === output.configSha256 && news.sourceFile === output.sourceFile && admin.endpoint === output.endpoint;
   return converged ? { action: "noop" } : { action: "update" };
 };
-var reconcileConfig = async (admin, props) => {
+var reconcileConfig = async (admin, props, authority) => {
   const want = await desiredConfig(admin, props);
-  const before = configDigest(await readRunningConfig(admin));
+  const running = await readRunningConfig(admin);
+  const before = configDigest(running);
+  const known = before === authority.stored || claimable(running, want.digest);
+  if (!authority.takeOver && !known) {
+    throw refuse(admin, `Caddy runs config ${short(before)}, which this stack did not load, and the Caddyfile adapts ` + `to ${short(want.digest)} — loading it would replace every site that config serves. ` + "Deploy with --adopt (or wrap the resource in adopt(true)) to take this Caddy over, or " + "point caddyProviders() at the Caddy you meant.");
+  }
   let warnings = want.warnings;
   const loaded = before !== want.digest;
   if (loaded) {
@@ -588,9 +632,17 @@ var unreachable = (error) => error instanceof CaddyUnreachableError;
 var planWithoutCaddy = (admin, fallback) => (error) => Effect2.as(Effect2.logWarning(`Caddy.Config: no Caddy at ${admin.endpoint} (${error.message}); planning without it — ` + "the Caddyfile is validated when the deploy reaches Caddy"), fallback);
 var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect2.gen(function* () {
   const admin = yield* CaddyAdminService;
+  const probe = (caddyfile, sourceFile) => Effect2.flatMap(lift(() => probeLive(admin, caddyfile, sourceFile)), (found) => {
+    if (found === undefined)
+      return Effect2.succeed(undefined);
+    if (found.ours)
+      return Effect2.succeed(found.attributes);
+    const unowned = Unowned(found.attributes);
+    return found.unchecked === undefined ? Effect2.succeed(unowned) : Effect2.as(Effect2.logWarning(`Caddy.Config at ${admin.endpoint}: the running config could not be compared ` + `with the declared Caddyfile (${found.unchecked}), so it is not treated as ours`), unowned);
+  });
   return CaddyConfig.Provider.of({
     list: () => Effect2.succeed([]),
-    read: ({ olds }) => lift(() => readLive(admin, resolvedString(olds, "sourceFile"))).pipe(Effect2.catchIf(unreachable, planWithoutCaddy(admin, undefined))),
+    read: ({ olds, output }) => (output === undefined ? probe(resolvedString(olds, "caddyfile"), resolvedString(olds, "sourceFile")) : lift(() => readLive(admin, resolvedString(olds, "sourceFile")))).pipe(Effect2.catchIf(unreachable, planWithoutCaddy(admin, undefined))),
     diff: ({ news, output }) => {
       if (output === undefined)
         return Effect2.succeed(undefined);
@@ -606,8 +658,11 @@ var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect2.gen(functio
         return { action: "update" };
       }).pipe(Effect2.catchIf(unreachable, update));
     },
-    reconcile: ({ news }) => Effect2.gen(function* () {
-      const applied = yield* lift(() => reconcileConfig(admin, news));
+    reconcile: ({ fqn, news, output }) => Effect2.gen(function* () {
+      const sameCaddy = output !== undefined && output.endpoint === admin.endpoint;
+      const takeOver = sameCaddy || (yield* adoptEnabled(fqn));
+      const stored = output === undefined ? {} : { stored: output.configSha256 };
+      const applied = yield* lift(() => reconcileConfig(admin, news, { takeOver, ...stored }));
       for (const warning of applied.warnings) {
         yield* Effect2.logWarning(`Caddy.Config at ${admin.endpoint}: ${warning}`);
       }
@@ -716,7 +771,7 @@ import * as RemovalPolicy from "alchemy/RemovalPolicy";
 
 // src/launchd/host-file.ts
 import { Resource as Resource2 } from "alchemy";
-import { Unowned } from "alchemy/AdoptPolicy";
+import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
 import * as Effect3 from "effect/Effect";
@@ -731,9 +786,8 @@ var identityProblems = (name, value) => {
   }
   return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
 };
-var fileProblems = (props) => {
+var pathProblems = (path) => {
   const found = [];
-  const { path } = props;
   if (!path.startsWith("/"))
     found.push("path must be absolute");
   if (path.endsWith("/") || path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..")) {
@@ -741,6 +795,10 @@ var fileProblems = (props) => {
   }
   if (path.includes("\x00"))
     found.push("path contains NUL");
+  return found;
+};
+var fileProblems = (props) => {
+  const found = pathProblems(props.path);
   const mode = props.mode ?? DEFAULT_MODE;
   if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
     found.push("mode must be 0–0o7777");
@@ -814,7 +872,7 @@ var diffFile = async (runner, news, output) => {
 var reconcileFile = async (runner, props, output) => {
   const want = await desiredFile(runner, props);
   if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {
-    throw refuse3(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy as root ` + "or through a privileged HostRunner (privileged: true). This provider never calls sudo.");
+    throw refuse3(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy as root ` + "or through a privileged HostRunner (sudoRunner() with this path under a prefix). This " + "provider never calls sudo itself.");
   }
   const stat = await runner.stat(props.path);
   if (stat !== undefined && stat.kind !== "file") {
@@ -864,7 +922,7 @@ var HostFileProvider = () => Provider2.effect(HostFile, Effect3.gen(function* ()
       const found = await readFileAttributes(runner, olds.path);
       if (found === undefined)
         return;
-      return output === undefined ? Unowned(found) : found;
+      return output === undefined ? Unowned2(found) : found;
     }),
     diff: ({ news, output }) => {
       if (output === undefined)
@@ -908,5 +966,5 @@ export {
   localCaddyAdmin
 };
 
-//# debugId=205F5FF536DDDFA164756E2164756E21
+//# debugId=7B177B132A41844D64756E2164756E21
 //# sourceMappingURL=index.js.map