@homeflare/alchemy 0.8.0 → 0.10.1

package/README.md

@@ -104,6 +104,11 @@ Cloudflare and Proxmox roles, plugins — plus `assertBaoIdentity` (call it firs
 ⛔ **Metadata only.** Alchemy stores props and attributes unencrypted, so no secret, CA key,
 plugin `env` or OIDC client secret is declarable. Every family defaults to `retain` on destroy.
 
+⛔ **Nothing is adopted without `--adopt`** (0.9.0), for every family and even when the live object
+is identical to the declaration; an interrupted create of this stack's own resumes when its row
+can prove it (one killed while a prop was an `Output` needs `--adopt`). The same rule holds for
+`HostFile`, `LaunchdJob`, `CaddyConfig` and `ProxmoxLxc`: [docs/ownership.md](./docs/ownership.md).
+
 ★ **Usage lives beside the code**, so it ships in the tarball with it:
 [src/openbao/README.md](./src/openbao/README.md). What each resource does on a rename is in
 [src/openbao/REPLACE.md](./src/openbao/REPLACE.md) — read it before changing a path or name.
@@ -131,9 +136,10 @@ one is logged (argv only, never content) before it runs. A plan never calls sudo
 
 - ⛔ **Opt-in, never a fallback**, and it never prompts: if sudo needs a password, the call fails at
   once and says to run `sudo -v`, or to grant exactly these commands `NOPASSWD`.
-- ⚠️ Refused before sudo is asked: any other argv, a prefix that is not a real directory only root
-  may write, a path outside every prefix that needs root, a symlink on the way, a file you could
-  not read back, and another user's `gui/<uid>`.
+- ⚠️ Refused before sudo is asked: any other argv, a prefix — or any directory below it on the way
+  to the file — that is not a real directory only root may write, a root-owned file that would be
+  group/world-writable, setuid or setgid, a path outside every prefix that needs root, a file you
+  could not read back, and another user's `gui/<uid>`. A plan that will write runs the same checks.
 - Full list, sudoers cautions and limits: [docs/launchd-sudo.md](./docs/launchd-sudo.md).
 
 ## Caddy — `@homeflare/alchemy/caddy`
@@ -151,16 +157,21 @@ with `HostFile`; `caddyProviders()` provides the transport, `http://127.0.0.1:20
 - ★ **Managed Caddies run `--resume` with their own `XDG_CONFIG_HOME`**, so a restart runs the last
   config Caddy accepted — and after one, SIGUSR1 has no file to reload. Why, and the rest: same doc.
 
-## Credentials
+## Proxmox — `@homeflare/alchemy/proxmox`
+
+PVE and PBS objects over the PVE API, and `ProxmoxLxc` for containers. What the subpath never does
+to a guest, and why: [docs/proxmox.md](./docs/proxmox.md).
 
-`CLOUDFLARE_API_TOKEN` is read from the environment at call time, never at module scope.
-`MeshNode` instead resolves credentials and the account the way `Cloudflare.providers()` does
-(an Alchemy profile, or `CLOUDFLARE_API_TOKEN` + `CLOUDFLARE_ACCOUNT_ID` in CI).
+## Adopt verifier — `hf-adopt-verify` / `@homeflare/alchemy/verify`
+
+⛔ A plan prints `adopted` for a match and for a drift alike. Before a gated deploy run
+`bunx --bun hf-adopt-verify --config alchemy.run.ts --stage live`: Alchemy's planner, no writes,
+each row's own diff, exit 0 only when all are no-ops. [docs/adopt-verify.md](./docs/adopt-verify.md)
+
+## Credentials
 
-⛔ **Mint a short-lived, scoped token** — do not reuse a long-lived one, and never a Global
-API Key. An empty value fails closed with a message saying so, because an empty render is
-a denied grant rather than a missing file, and `Bearer ` + nothing 401s in a way that reads
-like a bad credential.
+⛔ **Mint a short-lived, scoped token** — never a long-lived one, never a Global API Key. How each
+subpath reads its credential, and why an empty one fails closed: [docs/credentials.md](./docs/credentials.md).
 
 ## Peers — and one override you need
 

package/dist/caddy/config-lifecycle.d.ts

@@ -70,7 +70,7 @@ export type Applied = {
  * What this apply may load over — config.ts decides from the state and the adopt setting:
  *   · `takeOver` — any running config: the state was applied to THIS Caddy (an update, drift
  *     correction, or a create the engine adopted), or adoption is on (`--adopt`, or the
- *     resource's own `adopt(true)` — host-effect.ts adoptEnabled).
+ *     resource's own `adopt(true)` — ownership/adopt.ts adoptEnabled).
  *   · otherwise only a claimable one — plus, as `stored`, the digest the state last recorded: a
  *     Caddy reached at a NEW endpoint that runs exactly that is the same config under another name.
  */

package/dist/caddy/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/caddy/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,iBAAiB,EAAyB,MAAM,YAAY,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGhF,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAsBH,eAAO,MAAM,mBAAmB,8FAsF7B,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/caddy/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAAE,iBAAiB,EAAyB,MAAM,YAAY,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGhF,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAsBH,eAAO,MAAM,mBAAmB,8FAsF7B,CAAC"}

package/dist/caddy/index.js

@@ -292,17 +292,13 @@ var loadCaddyfile = async (admin, caddyfile, sourceFile) => {
 };
 // src/caddy/config.ts
 import { Resource } from "alchemy";
-import { Unowned } from "alchemy/AdoptPolicy";
+import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
-import * as Effect2 from "effect/Effect";
+import * as Effect6 from "effect/Effect";
 
 // src/launchd/host-effect.ts
-import { AdoptPolicy } from "alchemy/AdoptPolicy";
-import { AlchemyContext } from "alchemy/AlchemyContext";
-import { Stack } from "alchemy/Stack";
 import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
 var lift = (step) => Effect.tryPromise({
   catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
   try: step
@@ -313,17 +309,183 @@ var resolvedString = (news, key) => {
   const value = news[key];
   return typeof value === "string" ? value : undefined;
 };
-var adoptEnabled = (fqn) => Effect.gen(function* () {
-  const stack = yield* Effect.serviceOption(Stack);
-  const scoped = Option.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
+
+// src/ownership/adopt.ts
+import { AdoptPolicy } from "alchemy/AdoptPolicy";
+import { AlchemyContext } from "alchemy/AlchemyContext";
+import { Stack as Stack3 } from "alchemy/Stack";
+import * as Effect5 from "effect/Effect";
+import * as Option4 from "effect/Option";
+
+// src/ownership/resume.ts
+import { Unowned } from "alchemy/AdoptPolicy";
+import { Artifacts } from "alchemy/Artifacts";
+import * as Effect2 from "effect/Effect";
+import * as Option from "effect/Option";
+var PROVEN = "homeflare/ownership/resumes";
+var UNFINISHED = "homeflare/ownership/unfinished";
+var note = (key, instanceId) => Effect2.gen(function* () {
+  const bag = yield* Effect2.serviceOption(Artifacts);
+  if (Option.isSome(bag))
+    yield* bag.value.set(key, instanceId);
+});
+var noted = (key, instanceId) => Effect2.gen(function* () {
+  const bag = yield* Effect2.serviceOption(Artifacts);
+  if (Option.isNone(bag))
+    return false;
+  return (yield* bag.value.get(key)) === instanceId;
+});
+var noteUnfinished = (instanceId) => Effect2.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect2.gen(function* () {
+  yield* noteUnfinished(instanceId);
+  const unproven = () => Effect2.succeed(undefined);
+  const found = yield* recovered.pipe(Effect2.catch(unproven), Effect2.catchDefect(unproven));
+  if (found === undefined || found === null || Unowned.is(found))
+    return;
+  yield* note(PROVEN, instanceId);
+});
+var resumes = (instanceId) => noted(PROVEN, instanceId);
+var unfinished = (instanceId) => noted(UNFINISHED, instanceId);
+var provingResumes = (service) => {
+  const { diff, read } = service;
+  if (diff === undefined || read === undefined)
+    return service;
+  const proving = (input) => Effect2.gen(function* () {
+    if (input.output === undefined) {
+      yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
+    }
+    return yield* diff(input);
+  });
+  return { ...service, diff: proving };
+};
+
+// src/ownership/rows.ts
+import { Stack as Stack2 } from "alchemy/Stack";
+import { State, isActionState } from "alchemy/State/State";
+import * as Effect4 from "effect/Effect";
+import * as Option3 from "effect/Option";
+
+// src/ownership/whole.ts
+import { Stack } from "alchemy/Stack";
+import * as Effect3 from "effect/Effect";
+import * as Option2 from "effect/Option";
+var absent = (value) => value === undefined || value === null;
+var isPlainObject2 = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var carries = (declared, recorded) => {
+  if (absent(declared))
+    return true;
+  if (absent(recorded))
+    return false;
+  if (Array.isArray(declared)) {
+    if (!Array.isArray(recorded))
+      return false;
+    return declared.every((each, index) => carries(each, recorded[index]));
+  }
+  if (isPlainObject2(declared)) {
+    if (!isPlainObject2(recorded))
+      return false;
+    return Object.entries(declared).every(([key, each]) => carries(each, recorded[key]));
+  }
+  return true;
+};
+var wholeDeclaration = (fqn, props) => Effect3.map(Effect3.serviceOption(Stack), (stack) => {
+  const declared = Option2.isSome(stack) ? stack.value.resources[fqn] : undefined;
+  return declared !== undefined && carries(declared.Props, props);
+});
+
+// src/ownership/rows.ts
+var storeOf = Effect4.gen(function* () {
+  const stack = yield* Effect4.serviceOption(Stack2);
+  const state = yield* Effect4.serviceOption(State);
+  if (Option3.isNone(stack) || Option3.isNone(state))
+    return;
+  const store = yield* state.value;
+  const where = { stack: stack.value.name, stage: stack.value.stage };
+  return { resources: stack.value.resources, store, where };
+});
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect4.orElseSucceed(() => {
+  return;
+}));
+var generationOf = (row, instanceId) => {
+  let at = row;
+  while (typeof at === "object" && at !== null && !isActionState(at)) {
+    const generation = at;
+    if (generation.instanceId === instanceId)
+      return generation;
+    at = generation.old;
+  }
+  return;
+};
+var recordedGeneration = (fqn, instanceId) => Effect4.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  for (const at of [fqn, ...found.resources[fqn]?.FormerFqns ?? []]) {
+    const generation = generationOf(yield* rowAt(found.store, found.where, at), instanceId);
+    if (generation !== undefined)
+      return generation;
+  }
+  return;
+});
+var recordedInstance = (fqn, instanceId) => Effect4.gen(function* () {
+  const generation = yield* recordedGeneration(fqn, instanceId);
+  if (generation === undefined)
+    return "absent";
+  return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
+});
+var isCreate = (fqn, instanceId) => Effect4.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var forgetRefusedCreate = (fqn, instanceId) => Effect4.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  const row = yield* rowAt(found.store, found.where, fqn);
+  const mine = row;
+  if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
+    return;
+  }
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect4.ignore);
+});
+
+// src/ownership/adopt.ts
+var adoptEnabled = (fqn) => Effect5.gen(function* () {
+  const stack = yield* Effect5.serviceOption(Stack3);
+  const scoped = Option4.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
   if (scoped !== undefined)
     return scoped;
-  const policy = yield* Effect.serviceOption(AdoptPolicy);
-  if (Option.isSome(policy))
+  const policy = yield* Effect5.serviceOption(AdoptPolicy);
+  if (Option4.isSome(policy))
     return policy.value;
-  const context = yield* Effect.serviceOption(AlchemyContext);
-  return Option.isSome(context) ? context.value.adopt : false;
+  const context = yield* Effect5.serviceOption(AlchemyContext);
+  return Option4.isSome(context) ? context.value.adopt : false;
+});
+var adoptable = (owner) => Effect5.gen(function* () {
+  if (yield* isCreate(owner.fqn, owner.instanceId))
+    return true;
+  return yield* unfinished(owner.instanceId);
+});
+var adoptsAtApply = (owner) => Effect5.gen(function* () {
+  if (!(yield* adoptEnabled(owner.fqn)))
+    return false;
+  return yield* adoptable(owner);
+});
+var refuseTakeover = (owner, what) => Effect5.gen(function* () {
+  if (owner.output !== undefined)
+    return;
+  if (yield* resumes(owner.instanceId))
+    return;
+  const may = yield* adoptable(owner);
+  if (may && (yield* adoptEnabled(owner.fqn)))
+    return;
+  yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
+  const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
+  return yield* Effect5.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
 });
+var claimFor = (owner) => (what) => refuseTakeover(owner, what);
 
 // src/caddy/admin-guard.ts
 var DEFAULT_ADMIN_PORT = 2019;
@@ -629,46 +791,46 @@ var CaddyConfig = Resource("Caddy.Config", {
   defaultRemovalPolicy: "retain"
 });
 var unreachable = (error) => error instanceof CaddyUnreachableError;
-var planWithoutCaddy = (admin, fallback) => (error) => Effect2.as(Effect2.logWarning(`Caddy.Config: no Caddy at ${admin.endpoint} (${error.message}); planning without it — ` + "the Caddyfile is validated when the deploy reaches Caddy"), fallback);
-var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect2.gen(function* () {
+var planWithoutCaddy = (admin, fallback) => (error) => Effect6.as(Effect6.logWarning(`Caddy.Config: no Caddy at ${admin.endpoint} (${error.message}); planning without it — ` + "the Caddyfile is validated when the deploy reaches Caddy"), fallback);
+var CaddyConfigProvider = () => Provider.effect(CaddyConfig, Effect6.gen(function* () {
   const admin = yield* CaddyAdminService;
-  const probe = (caddyfile, sourceFile) => Effect2.flatMap(lift(() => probeLive(admin, caddyfile, sourceFile)), (found) => {
+  const probe = (caddyfile, sourceFile) => Effect6.flatMap(lift(() => probeLive(admin, caddyfile, sourceFile)), (found) => {
     if (found === undefined)
-      return Effect2.succeed(undefined);
+      return Effect6.succeed(undefined);
     if (found.ours)
-      return Effect2.succeed(found.attributes);
-    const unowned = Unowned(found.attributes);
-    return found.unchecked === undefined ? Effect2.succeed(unowned) : Effect2.as(Effect2.logWarning(`Caddy.Config at ${admin.endpoint}: the running config could not be compared ` + `with the declared Caddyfile (${found.unchecked}), so it is not treated as ours`), unowned);
+      return Effect6.succeed(found.attributes);
+    const unowned = Unowned2(found.attributes);
+    return found.unchecked === undefined ? Effect6.succeed(unowned) : Effect6.as(Effect6.logWarning(`Caddy.Config at ${admin.endpoint}: the running config could not be compared ` + `with the declared Caddyfile (${found.unchecked}), so it is not treated as ours`), unowned);
   });
   return CaddyConfig.Provider.of({
-    list: () => Effect2.succeed([]),
-    read: ({ olds, output }) => (output === undefined ? probe(resolvedString(olds, "caddyfile"), resolvedString(olds, "sourceFile")) : lift(() => readLive(admin, resolvedString(olds, "sourceFile")))).pipe(Effect2.catchIf(unreachable, planWithoutCaddy(admin, undefined))),
+    list: () => Effect6.succeed([]),
+    read: ({ olds, output }) => (output === undefined ? probe(resolvedString(olds, "caddyfile"), resolvedString(olds, "sourceFile")) : lift(() => readLive(admin, resolvedString(olds, "sourceFile")))).pipe(Effect6.catchIf(unreachable, planWithoutCaddy(admin, undefined))),
     diff: ({ news, output }) => {
       if (output === undefined)
-        return Effect2.succeed(undefined);
+        return Effect6.succeed(undefined);
       const update = planWithoutCaddy(admin, { action: "update" });
       if (isResolved(news)) {
-        return lift(() => diffConfig(admin, news, output)).pipe(Effect2.catchIf(unreachable, update));
+        return lift(() => diffConfig(admin, news, output)).pipe(Effect6.catchIf(unreachable, update));
       }
       const caddyfile = resolvedString(news, "caddyfile");
       if (caddyfile === undefined)
-        return Effect2.succeed(undefined);
+        return Effect6.succeed(undefined);
       return lift(async () => {
         await diffConfig(admin, { caddyfile }, output);
         return { action: "update" };
-      }).pipe(Effect2.catchIf(unreachable, update));
+      }).pipe(Effect6.catchIf(unreachable, update));
     },
-    reconcile: ({ fqn, news, output }) => Effect2.gen(function* () {
+    reconcile: ({ fqn, news, output }) => Effect6.gen(function* () {
       const sameCaddy = output !== undefined && output.endpoint === admin.endpoint;
       const takeOver = sameCaddy || (yield* adoptEnabled(fqn));
       const stored = output === undefined ? {} : { stored: output.configSha256 };
       const applied = yield* lift(() => reconcileConfig(admin, news, { takeOver, ...stored }));
       for (const warning of applied.warnings) {
-        yield* Effect2.logWarning(`Caddy.Config at ${admin.endpoint}: ${warning}`);
+        yield* Effect6.logWarning(`Caddy.Config at ${admin.endpoint}: ${warning}`);
       }
       return applied.attributes;
     }),
-    delete: () => Effect2.void
+    delete: () => Effect6.void
   });
 }));
 // src/caddy/local-admin.ts
@@ -766,15 +928,15 @@ var localCaddyAdmin = (options = {}) => {
 import * as Layer2 from "effect/Layer";
 var caddyProviders = (admin = localCaddyAdmin()) => CaddyConfigProvider().pipe(Layer2.provide(caddyAdminLayer(admin)));
 // src/caddy/with-file.ts
-import * as Effect4 from "effect/Effect";
+import * as Effect8 from "effect/Effect";
 import * as RemovalPolicy from "alchemy/RemovalPolicy";
 
 // src/launchd/host-file.ts
 import { Resource as Resource2 } from "alchemy";
-import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
+import { Unowned as Unowned3 } from "alchemy/AdoptPolicy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect3 from "effect/Effect";
+import * as Effect7 from "effect/Effect";
 
 // src/launchd/host-file-form.ts
 var DEFAULT_MODE = 420;
@@ -859,17 +1021,26 @@ var readFileAttributes = async (runner, path) => {
     uid: stat.uid
   };
 };
+var writeOptionsOf = (want) => ({
+  mode: want.mode,
+  ...want.uid === undefined ? {} : { uid: want.uid },
+  ...want.gid === undefined ? {} : { gid: want.gid }
+});
 var matches = (live, want) => live.sha256 === want.sha256 && live.mode === want.mode && (want.uid === undefined || live.uid === want.uid) && (want.gid === undefined || live.gid === want.gid);
 var diffFile = async (runner, news, output) => {
-  if (news.path !== output.path)
-    return { action: "replace" };
   const want = await desiredFile(runner, news);
+  const writes = async (diff) => {
+    await runner.checkWrite?.(news.path, writeOptionsOf(want));
+    return diff;
+  };
+  if (news.path !== output.path)
+    return writes({ action: "replace" });
   if (want.sha256 !== output.sha256)
-    return { action: "update" };
+    return writes({ action: "update" });
   const live = await readFileAttributes(runner, news.path);
-  return live !== undefined && matches(live, want) ? { action: "noop" } : { action: "update" };
+  return live !== undefined && matches(live, want) ? { action: "noop" } : writes({ action: "update" });
 };
-var reconcileFile = async (runner, props, output) => {
+var reconcileFile = async (runner, props, output, adopt = false) => {
   const want = await desiredFile(runner, props);
   if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {
     throw refuse3(props.path, `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy as root ` + "or through a privileged HostRunner (sudoRunner() with this path under a prefix). This " + "provider never calls sudo itself.");
@@ -881,15 +1052,12 @@ var reconcileFile = async (runner, props, output) => {
   const before = stat === undefined ? undefined : await readFileAttributes(runner, props.path);
   const moved = output !== undefined && output.path !== props.path;
   const prior = moved ? undefined : output;
-  if (prior === undefined && before !== undefined && !matches(before, want)) {
+  const takeOver = adopt && output === undefined;
+  if (prior === undefined && before !== undefined && !matches(before, want) && !takeOver) {
     throw refuse3(props.path, "already exists and is not this resource. Remove it, or declare it as a new resource and " + "deploy with --adopt.");
   }
   if (before === undefined || !matches(before, want)) {
-    await runner.writeFileAtomic(props.path, want.bytes, {
-      mode: want.mode,
-      ...want.uid === undefined ? {} : { uid: want.uid },
-      ...want.gid === undefined ? {} : { gid: want.gid }
-    });
+    await runner.writeFileAtomic(props.path, want.bytes, writeOptionsOf(want));
   }
   const after = await readFileAttributes(runner, props.path);
   if (after === undefined || !matches(after, want)) {
@@ -914,34 +1082,34 @@ var deleteFile = async (runner, output) => {
 
 // src/launchd/host-file.ts
 var HostFile = Resource2("Host.File");
-var HostFileProvider = () => Provider2.effect(HostFile, Effect3.gen(function* () {
+var HostFileProvider = () => Provider2.effect(HostFile, Effect7.gen(function* () {
   const runner = yield* HostRunnerService;
   return HostFile.Provider.of({
-    list: () => Effect3.succeed([]),
+    list: () => Effect7.succeed([]),
     read: ({ olds, output }) => lift(async () => {
       const found = await readFileAttributes(runner, olds.path);
       if (found === undefined)
         return;
-      return output === undefined ? Unowned2(found) : found;
+      return output === undefined ? Unowned3(found) : found;
     }),
-    diff: ({ news, output }) => {
+    diff: ({ instanceId, news, output }) => {
       if (output === undefined)
-        return Effect3.succeed(undefined);
+        return noteUnfinished(instanceId);
       if (isResolved2(news))
         return lift(() => diffFile(runner, news, output));
       const path = resolvedString(news, "path");
-      return Effect3.succeed(path !== undefined && path !== output.path ? { action: "replace" } : undefined);
+      return Effect7.succeed(path !== undefined && path !== output.path ? { action: "replace" } : undefined);
     },
-    reconcile: ({ news, output }) => lift(() => reconcileFile(runner, news, output)),
+    reconcile: ({ fqn, instanceId, news, output }) => Effect7.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) => lift(() => reconcileFile(runner, news, output, adopt))),
     delete: ({ output }) => lift(() => deleteFile(runner, output))
   });
 }));
 
 // src/caddy/with-file.ts
-var caddyWithFile = (id, props) => Effect4.gen(function* () {
+var caddyWithFile = (id, props) => Effect8.gen(function* () {
   const found = configProblems({ caddyfile: props.caddyfile, sourceFile: props.path });
   if (found.length > 0) {
-    return yield* Effect4.fail(new Error(`caddyWithFile ${id}: ${found.join("; ")}`));
+    return yield* Effect8.fail(new Error(`caddyWithFile ${id}: ${found.join("; ")}`));
   }
   const file = yield* HostFile(`${id}-file`, {
     content: props.caddyfile,
@@ -966,5 +1134,5 @@ export {
   localCaddyAdmin
 };
 
-//# debugId=7B177B132A41844D64756E2164756E21
+//# debugId=13AB2C6EDF123C4E64756E2164756E21
 //# sourceMappingURL=index.js.map