@homeflare/alchemy 0.8.0 → 0.10.0

package/dist/launchd/fake-runner.d.ts

@@ -15,6 +15,7 @@ export type FakeOptions = {
     groups?: Record<string, number>;
 };
 export declare const fakeRunner: (options?: FakeOptions) => {
+    acls: Map<string, string[]>;
     calls: string[][];
     disabled: Set<string>;
     dirs: Map<string, number>;

package/dist/launchd/fake-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/fake-runner.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAgB,MAAM,aAAa,CAAC;AAE5F,KAAK,KAAK,GAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC;AAEnG,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AA0BF,eAAO,MAAM,UAAU,aAAa,WAAW;;;;;;;;;;0BAaZ,UAAU,GAAG,SAAS;QACrD,6FAA6F;wBAChE,UAAU,GAAG,SAAS;;QAEnD,uFAAuF;;;CA4G1F,CAAC"}
+{"version":3,"file":"fake-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/fake-runner.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAgB,MAAM,aAAa,CAAC;AAE5F,KAAK,KAAK,GAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC;AAEnG,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AA0BF,eAAO,MAAM,UAAU,aAAa,WAAW;;;;;;;;;;;0BAuBZ,UAAU,GAAG,SAAS;QACrD,6FAA6F;wBAChE,UAAU,GAAG,SAAS;;QAEnD,uFAAuF;;;CAsH1F,CAAC"}

package/dist/launchd/fake-sudo.d.ts

@@ -11,6 +11,7 @@ export declare const SUDO_SAYS: {
 /** `groups` is the operator's `id -G`; `'unknown'` models that lookup failing. */
 export declare const fakeSudoHost: (groups?: readonly number[] | 'unknown', prefixes?: readonly string[]) => {
     fake: {
+        acls: Map<string, string[]>;
         calls: string[][];
         disabled: Set<string>;
         dirs: Map<string, number>;

package/dist/launchd/fake-sudo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-sudo.d.ts","sourceRoot":"","sources":["../../src/launchd/fake-sudo.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI1D,eAAO,MAAM,QAAQ,MAAM,CAAC;AAC5B,eAAO,MAAM,QAAQ,UAA6C,CAAC;AAInE,qGAAqG;AACrG,eAAO,MAAM,SAAS;aACpB,MAAM,EACJ,uGAAuG;aACzG,gBAAgB,EAAE,uCAAuC;aACzD,aAAa,EAAE,kDAAkD;aACjE,QAAQ,EAAE,gCAAgC;CAClC,CAAC;AAoBX,kFAAkF;AAClF,eAAO,MAAM,YAAY,YACf,SAAS,MAAM,EAAE,GAAG,SAAS,aAC3B,SAAS,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsBzB,uFAAuF;cACzE,IAAI,GAAG,MAAM,OAAO,SAAS;QAC3C,qEAAqE;wBACxC,UAAU,GAAG,SAAS;;QAEnD,8DAA8D;;;;CAqDjE,CAAC"}
+{"version":3,"file":"fake-sudo.d.ts","sourceRoot":"","sources":["../../src/launchd/fake-sudo.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI1D,eAAO,MAAM,QAAQ,MAAM,CAAC;AAC5B,eAAO,MAAM,QAAQ,UAA6C,CAAC;AAInE,qGAAqG;AACrG,eAAO,MAAM,SAAS;aACpB,MAAM,EACJ,uGAAuG;aACzG,gBAAgB,EAAE,uCAAuC;aACzD,aAAa,EAAE,kDAAkD;aACjE,QAAQ,EAAE,gCAAgC;CAClC,CAAC;AAoBX,kFAAkF;AAClF,eAAO,MAAM,YAAY,YACf,SAAS,MAAM,EAAE,GAAG,SAAS,aAC3B,SAAS,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsBzB,uFAAuF;cACzE,IAAI,GAAG,MAAM,OAAO,SAAS;QAC3C,qEAAqE;wBACxC,UAAU,GAAG,SAAS;;QAEnD,8DAA8D;;;;CAqDjE,CAAC"}

package/dist/launchd/host-effect.d.ts

@@ -1,3 +1,12 @@
+/**
+ * The one place a HostRunner's promises become Effects — plus the one probe of an unresolved
+ * `news` both providers' diffs share. (The engine's adopt setting lives in ownership/adopt.ts.)
+ *
+ * ★ The lifecycle files are plain async functions over a HostRunner (see runner.ts for why the
+ *   runner is promise-based), so each provider handler is a single `lift(() => step(runner, …))`.
+ * ⚠️ A thrown Error stays that Error — its message is the refusal a deploy prints. Anything else
+ *   thrown is wrapped, so the failure channel is always an Error with a readable message.
+ */
 import * as Effect from 'effect/Effect';
 export declare const lift: <A>(step: () => Promise<A>) => Effect.Effect<A, Error>;
 /**
@@ -7,22 +16,4 @@ export declare const lift: <A>(step: () => Promise<A>) => Effect.Effect<A, Error
  *   string is resolved by definition, so `typeof` is the whole test.
  */
 export declare const resolvedString: (news: unknown, key: string) => string | undefined;
-/**
- * Whether the resource at `fqn` may be adopted, resolved exactly as the planner resolves it (alchemy
- * beta.79 Plan.ts: `resource.Adopt ?? shouldAdopt`): a resource-scoped `adopt(…)`, else the
- * `AdoptPolicy` service, else `AlchemyContext.adopt`, else off.
- * ★ FOR A CREATE THE ENGINE NEVER PROBED. Alchemy skips the adoption probe while `news` holds an
- *   Output, so an ownership check that must still honour `--adopt` can only run at apply. All three
- *   reach the apply: Alchemist runs plan AND apply under the session context, which provides the
- *   services from the CLI flag and the Stack the resources registered on (Alchemist/Session.ts,
- *   routes/stack.ts; Apply.ts reads the same Stack).
- * ⛔ THE RESOURCE-SCOPED SETTING WINS, BOTH WAYS. The engine captures `adopt(…)` on the resource at
- *   registration (Resource.ts `Adopt`, into `Stack.resources[fqn]`) and never hands it to a
- *   provider. Reading only the deploy-wide flag let `--adopt` take over a resource declared
- *   `.pipe(adopt(false))` — which the planner refuses — and refused one declared `adopt(true)`.
- * ⚠️ `resources` carries an `@internal` comment in Alchemy's source, but it is in the published types
- *   and the planner reads `Adopt` from it. caddy/adopt-scope.test.ts registers through the real
- *   `Resource`, so an upgrade that stops recording it there fails the suite.
- */
-export declare const adoptEnabled: (fqn: string) => Effect.Effect<boolean>;
 //# sourceMappingURL=host-effect.d.ts.map

package/dist/launchd/host-effect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-effect.d.ts","sourceRoot":"","sources":["../../src/launchd/host-effect.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,eAAO,MAAM,IAAI,GAAI,CAAC,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAInE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,QAAS,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAS5D,CAAC"}
+{"version":3,"file":"host-effect.d.ts","sourceRoot":"","sources":["../../src/launchd/host-effect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,IAAI,GAAI,CAAC,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAInE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC"}

package/dist/launchd/host-file-lifecycle.d.ts

@@ -21,8 +21,21 @@ type Desired = {
 export declare const desiredFile: (runner: HostRunner, props: HostFileProps) => Promise<Desired>;
 /** The file as it is now, or `undefined` when nothing is at the path. Non-files read with no digest. */
 export declare const readFileAttributes: (runner: HostRunner, path: string) => Promise<HostFileAttributes | undefined>;
+/**
+ * ★ A PLAN THAT WILL WRITE ASKS THE RUNNER FIRST (`checkWrite`, when it has one): sudoRunner's
+ *   refusals — a setuid or group-writable root file, a directory under a prefix another user may
+ *   change — then fail the plan, before any resource is applied, instead of halfway through it.
+ */
 export declare const diffFile: (runner: HostRunner, news: HostFileProps, output: HostFileAttributes) => Promise<Diff>;
-export declare const reconcileFile: (runner: HostRunner, props: HostFileProps, output?: HostFileAttributes) => Promise<HostFileAttributes>;
+/**
+ * `adopt` is whether adoption is on AND this apply is a create or an unfinished generation of our
+ * own (ownership/adopt.ts adoptsAtApply). It lets such a generation take over a file already at the
+ * path — the takeover the plan's probe would have allowed, had it run. ⛔ A move onto an occupied
+ *   path stays refused, both ways the engine drives one: an `update` across the move (`moved`,
+ *   below), and a fresh replace's new generation, which the caller never marks adoptable (its
+ *   `output` is undefined too, so this function cannot tell it from a create by itself).
+ */
+export declare const reconcileFile: (runner: HostRunner, props: HostFileProps, output?: HostFileAttributes, adopt?: boolean) => Promise<HostFileAttributes>;
 /** Remove the file. Idempotent. ⛔ Refuses a path that has since become a symlink or directory. */
 export declare const deleteFile: (runner: HostRunner, output: HostFileAttributes) => Promise<void>;
 export {};

package/dist/launchd/host-file-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-file-lifecycle.d.ts","sourceRoot":"","sources":["../../src/launchd/host-file-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAEnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,aAAa,CAAC;AAE5D,KAAK,OAAO,GAAG;IACb,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAOF,0EAA0E;AAC1E,eAAO,MAAM,WAAW,WAAkB,UAAU,SAAS,aAAa,KAAG,OAAO,CAAC,OAAO,CAqB3F,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,kBAAkB,WACrB,UAAU,QACZ,MAAM,KACX,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAYxC,CAAC;AAQF,eAAO,MAAM,QAAQ,WACX,UAAU,QACZ,aAAa,UACX,kBAAkB,KACzB,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,eAAO,MAAM,aAAa,WAChB,UAAU,SACX,aAAa,WACX,kBAAkB,KAC1B,OAAO,CAAC,kBAAkB,CA2D5B,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,UAAU,WAAkB,UAAU,UAAU,kBAAkB,KAAG,OAAO,CAAC,IAAI,CAK7F,CAAC"}
+{"version":3,"file":"host-file-lifecycle.d.ts","sourceRoot":"","sources":["../../src/launchd/host-file-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAEnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,UAAU,EAAmC,MAAM,aAAa,CAAC;AAE/E,KAAK,OAAO,GAAG;IACb,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAOF,0EAA0E;AAC1E,eAAO,MAAM,WAAW,WAAkB,UAAU,SAAS,aAAa,KAAG,OAAO,CAAC,OAAO,CAqB3F,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,kBAAkB,WACrB,UAAU,QACZ,MAAM,KACX,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAYxC,CAAC;AAcF;;;;GAIG;AACH,eAAO,MAAM,QAAQ,WACX,UAAU,QACZ,aAAa,UACX,kBAAkB,KACzB,OAAO,CAAC,IAAI,CAad,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,WAChB,UAAU,SACX,aAAa,WACX,kBAAkB,sBAE1B,OAAO,CAAC,kBAAkB,CA0D5B,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,UAAU,WAAkB,UAAU,UAAU,kBAAkB,KAAG,OAAO,CAAC,IAAI,CAK7F,CAAC"}

package/dist/launchd/host-file.d.ts

@@ -9,7 +9,8 @@
  * - delete — removes the file.
  *
  * ⛔ NEVER A SECRET — see host-file-form.ts. Secret files stay rendered by openbao-agent.
- * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`: a file already at the path reads as `Unowned`.
+ * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`: a file already at the path reads as `Unowned`, and where
+ *   the plan never asked, reconcile refuses it unless adoption is on (docs/ownership.md).
  * ★ IT LIVES IN THE launchd SUBPATH because the two travel together: a Mac host stack declares a
  *   daemon's config file and the daemon that reads it, through the same HostRunner.
  */

package/dist/launchd/host-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-file.d.ts","sourceRoot":"","sources":["../../src/launchd/host-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,MAAM,WAAW,QAAS,SAAQ,QAAQ,CAAC,WAAW,EAAE,aAAa,EAAE,kBAAkB,CAAC;CAAG;AAE7F,eAAO,MAAM,QAAQ,2CAAkC,CAAC;AAExD,eAAO,MAAM,gBAAgB,2FAgC1B,CAAC"}
+{"version":3,"file":"host-file.d.ts","sourceRoot":"","sources":["../../src/launchd/host-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,MAAM,WAAW,QAAS,SAAQ,QAAQ,CAAC,WAAW,EAAE,aAAa,EAAE,kBAAkB,CAAC;CAAG;AAE7F,eAAO,MAAM,QAAQ,2CAAkC,CAAC;AAExD,eAAO,MAAM,gBAAgB,2FAsC1B,CAAC"}