@homeflare/alchemy 0.8.0 → 0.10.1

package/dist/verify/args.d.ts

@@ -0,0 +1,16 @@
+import type { VerifyOptions, VerifyTarget } from './verify.ts';
+export declare const USAGE = "Usage: hf-adopt-verify --stage <stage> [--config alchemy.run.ts] [options]\n\nPlans the stack with Alchemy's own planner, never writes, and reports each row\nwithout a state row: what the engine planned, the provider's read and its own\ndiff (before Alchemy forces adopted rows to update), and the declared fields\nthat differ from the live object. Exits 0 when every row is a no-op, 1 when\nany is not, 2 when it could not tell.\n\n  -c, --config <file>   stack entrypoint (default alchemy.run.ts)\n      --stage <stage>   stage to verify (default $ALCHEMY_STAGE; required)\n      --profile <name>  Alchemy auth profile\n      --env-file <file> .env file layered under the environment\n      --all             report every declared row and pending deletion\n      --json            print the report as JSON\n  -h, --help            this text\n";
+export type Parsed = {
+    readonly kind: 'help';
+} | {
+    readonly kind: 'error';
+    readonly message: string;
+} | {
+    readonly kind: 'run';
+    readonly target: VerifyTarget;
+    readonly options: VerifyOptions;
+    readonly json: boolean;
+};
+/** Parse argv (without the runtime and script) against the environment. Never throws. */
+export declare const parseVerifyArgs: (argv: readonly string[], env: Readonly<Record<string, string | undefined>>) => Parsed;
+//# sourceMappingURL=args.d.ts.map

package/dist/verify/args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../src/verify/args.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,eAAO,MAAM,KAAK,i1BAejB,CAAC;AAEF,MAAM,MAAM,MAAM,GACd;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;AAkBN,yFAAyF;AACzF,eAAO,MAAM,eAAe,SACpB,SAAS,MAAM,EAAE,OAClB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAChD,MAoBF,CAAC"}

package/dist/verify/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/verify/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/verify/cli.ts"],"names":[],"mappings":""}

package/dist/verify/cli.js

@@ -0,0 +1,370 @@
+#!/usr/bin/env node
+
+// src/verify/cli.ts
+import { runMain } from "alchemy/Util/PlatformServices";
+import * as Cause from "effect/Cause";
+import * as Console from "effect/Console";
+import * as Effect5 from "effect/Effect";
+
+// src/verify/args.ts
+import { parseArgs } from "node:util";
+var USAGE = `Usage: hf-adopt-verify --stage <stage> [--config alchemy.run.ts] [options]
+
+Plans the stack with Alchemy's own planner, never writes, and reports each row
+without a state row: what the engine planned, the provider's read and its own
+diff (before Alchemy forces adopted rows to update), and the declared fields
+that differ from the live object. Exits 0 when every row is a no-op, 1 when
+any is not, 2 when it could not tell.
+
+  -c, --config <file>   stack entrypoint (default alchemy.run.ts)
+      --stage <stage>   stage to verify (default $ALCHEMY_STAGE; required)
+      --profile <name>  Alchemy auth profile
+      --env-file <file> .env file layered under the environment
+      --all             report every declared row and pending deletion
+      --json            print the report as JSON
+  -h, --help            this text
+`;
+var parse = (argv) => parseArgs({
+  args: [...argv],
+  allowPositionals: false,
+  options: {
+    all: { type: "boolean", default: false },
+    config: { type: "string", short: "c", default: "alchemy.run.ts" },
+    "env-file": { type: "string" },
+    help: { type: "boolean", short: "h", default: false },
+    json: { type: "boolean", default: false },
+    profile: { type: "string" },
+    stage: { type: "string" }
+  },
+  strict: true
+});
+var parseVerifyArgs = (argv, env) => {
+  let parsed;
+  try {
+    parsed = parse(argv);
+  } catch (error) {
+    return { kind: "error", message: error instanceof Error ? error.message : String(error) };
+  }
+  const { values } = parsed;
+  if (values.help)
+    return { kind: "help" };
+  const stage = values.stage ?? env["ALCHEMY_STAGE"];
+  if (stage === undefined || stage === "") {
+    return { kind: "error", message: "pass --stage (or set ALCHEMY_STAGE): no stage is guessed" };
+  }
+  const target = {
+    entrypoint: values.config,
+    stage,
+    ...values.profile === undefined ? {} : { profile: values.profile },
+    ...values["env-file"] === undefined ? {} : { envFile: values["env-file"] }
+  };
+  return { json: values.json, kind: "run", options: { all: values.all }, target };
+};
+
+// src/verify/report.ts
+var exitCodeOf = (report) => report.rows.every((row) => row.ok) ? 0 : 1;
+var pad = (text, width) => text.padEnd(width);
+var line = (row, widths) => {
+  const head = [
+    row.ok ? "ok  " : "FAIL",
+    pad(row.planned, widths.planned),
+    pad(row.diff, 8),
+    pad(row.read, 9),
+    pad(row.type, widths.type),
+    row.fqn
+  ].join("  ");
+  const changed = row.changed.length > 0 ? `  changed: ${row.changed.join(", ")}` : "";
+  return row.why === "" ? `${head}${changed}` : `${head}${changed}
+      ${row.why}`;
+};
+var formatReport = (report, all) => {
+  const scope = all ? "every row" : "rows without state";
+  const title = `hf-adopt-verify ${report.stack}/${report.stage}: ${String(report.rows.length)} ${scope} (of ${String(report.declared)} declared)`;
+  if (report.rows.length === 0) {
+    return `${title}
+nothing to verify — every declared row already has state. --all checks those too.
+`;
+  }
+  const widths = {
+    planned: Math.max(7, ...report.rows.map((row) => row.planned.length)),
+    type: Math.max(4, ...report.rows.map((row) => row.type.length))
+  };
+  const header = ["    ", pad("planned", widths.planned), pad("diff", 8), pad("read", 9)].concat([pad("type", widths.type), "fqn"]).join("  ");
+  const failed = report.rows.filter((row) => !row.ok).length;
+  const verdict = failed === 0 ? "every row is a no-op: the deploy writes nothing to them" : `${String(failed)} row(s) are NOT a no-op: the deploy would write, create or delete`;
+  return [title, "", header, ...report.rows.map((row) => line(row, widths)), "", verdict, ""].join(`
+`);
+};
+
+// src/verify/verify.ts
+import * as Alchemist from "alchemy/Alchemist";
+import * as Plan from "alchemy/Plan";
+import { State, isActionState } from "alchemy/State";
+import * as Effect4 from "effect/Effect";
+
+// src/verify/plan-scope.ts
+import {
+  ArtifactStore,
+  Artifacts,
+  createArtifactStore,
+  makeScopedArtifacts
+} from "alchemy/Artifacts";
+import { InstanceId } from "alchemy/InstanceId";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+var inPlanScope = (fqn, instanceId) => (effect) => Effect.gen(function* () {
+  const store = Option.getOrElse(yield* Effect.serviceOption(ArtifactStore), createArtifactStore);
+  return yield* effect.pipe(Effect.provideService(Artifacts, makeScopedArtifacts(store, fqn)), Effect.provideService(InstanceId, instanceId));
+});
+
+// src/verify/recheck.ts
+import * as Effect3 from "effect/Effect";
+
+// src/verify/rows.ts
+import { deepEqual, isResolved } from "alchemy/Diff";
+var changedFields = (declared, live) => {
+  if (typeof declared !== "object" || declared === null)
+    return [];
+  if (typeof live !== "object" || live === null)
+    return [];
+  const actual = live;
+  return Object.entries(declared).filter(([key, value]) => value !== undefined && (key in actual) && isResolved(value)).filter(([key, value]) => !deepEqual(value, actual[key])).map(([key]) => key).sort();
+};
+var STILL_LIVE = new Set(["adopted", "noop"]);
+var isNoop = (planned, diff, stateRow) => STILL_LIVE.has(planned) && (diff === "noop" || diff === "none" && stateRow && planned === "noop");
+var proven = (recheck) => recheck === undefined || recheck === "noop";
+var notes = (row) => [
+  row.read === "unowned" ? "unowned: the deploy needs --adopt or adopt(true)" : "",
+  row.recheck === "noop" ? `${row.changed.join(", ")} differ, but the diff says noop even given the live values: ` + "the family does not manage them, and the deploy leaves them alone" : ""
+].filter((note) => note !== "").join("; ");
+var reason = (row, ok) => {
+  if (ok)
+    return notes(row);
+  if (isNoop(row.planned, row.diff, row.stateRow)) {
+    const live = `the live ${row.changed.join(", ")}`;
+    if (row.recheck === "failed") {
+      return `asked again with ${live} as recorded props, the provider's diff failed: not proven`;
+    }
+    if (!proven(row.recheck)) {
+      return `the provider's diff compares recorded props, not the live object: given ${live} it ` + `says ${String(row.recheck)}, and the deploy's forced reconcile writes`;
+    }
+    return `${String(row.bindings)} binding(s) change: the deploy reconciles them though the diff is noop`;
+  }
+  if (row.planned === "delete")
+    return "no longer declared: the deploy deletes it";
+  if (row.planned === "orphaned")
+    return "no longer declared: the deploy drops its state (retain)";
+  if (row.read === "failed")
+    return "the verifier's own read of it failed";
+  if (row.planned === "create") {
+    if (row.stateRow)
+      return "an interrupted create: the deploy finishes creating it";
+    return row.read === "absent" ? "the read found nothing, so the deploy CREATES it (a lane that cannot see it reads the same)" : "never probed (a prop is an Output of another resource, or the provider has no read): " + "the deploy CREATES it";
+  }
+  if (row.diff === "update")
+    return "the provider's diff says update: the deploy writes";
+  if (row.diff === "replace")
+    return "the provider's diff says replace: a new one, then a delete";
+  if (row.diff === "none") {
+    return "the provider has no diff, so the engine compared the declaration with itself";
+  }
+  return `the engine plans ${row.planned} although the diff says ${row.diff} (a renamed row, changed bindings or --force)`;
+};
+var rowFor = (fqn, node, stateRow, seen) => {
+  const observed = seen.get(fqn);
+  const recheck = observed?.recheck;
+  const base = {
+    bindings: (node.bindings ?? []).filter((binding) => binding.action !== "noop").length,
+    changed: changedFields(observed?.diff?.news, observed?.read?.attributes),
+    diff: observed?.diff?.answer ?? "not-run",
+    fqn,
+    planned: node.action,
+    read: observed?.read?.answer ?? "not-read",
+    ...recheck === undefined ? {} : { recheck },
+    stateRow,
+    type: node.resource.Type
+  };
+  const ok = isNoop(base.planned, base.diff, stateRow) && proven(recheck) && base.bindings === 0;
+  return { ...base, ok, why: reason(base, ok) };
+};
+var taskRow = (fqn, task) => ({
+  bindings: 0,
+  changed: [],
+  diff: "not-run",
+  fqn,
+  ok: task.action === "noop",
+  planned: task.action,
+  read: "not-read",
+  stateRow: task.action !== "run",
+  type: task.def.Type,
+  why: task.action === "noop" ? "" : `a stack task: the deploy will ${task.action} it`
+});
+var rowsOf = (plan, stateRows, seen, all) => {
+  const declared = Object.entries(plan.resources).filter(([fqn]) => all || !stateRows.has(fqn)).map(([fqn, node]) => rowFor(fqn, node, stateRows.has(fqn), seen));
+  const removed = all ? Object.entries(plan.deletions).flatMap(([fqn, node]) => node === undefined ? [] : [rowFor(fqn, node, true, seen)]) : [];
+  const tasks = Object.entries(plan.actions ?? {}).flatMap(([fqn, task]) => task === undefined || !all && task.action === "noop" ? [] : [taskRow(fqn, task)]);
+  return [...declared, ...removed, ...tasks].sort((a, b) => a.fqn.localeCompare(b.fqn));
+};
+
+// src/verify/spy.ts
+import { Unowned, stripUnowned } from "alchemy/AdoptPolicy";
+import {
+  isProviderCollectionService,
+  isProviderService
+} from "alchemy/Provider";
+import * as Context from "effect/Context";
+import * as Effect2 from "effect/Effect";
+var seenFor = (seen, fqn) => {
+  const existing = seen.get(fqn);
+  if (existing !== undefined)
+    return existing;
+  const fresh = {};
+  seen.set(fqn, fresh);
+  return fresh;
+};
+var WRITE_REFUSED = "hf-adopt-verify never writes";
+var refuse = (type, operation) => () => Effect2.die(new Error(`${WRITE_REFUSED}: ${type}.${operation} was called during a verification. Alchemy's planner ` + "does not call it, so something other than Plan.make is driving these providers."));
+var readAnswer = (attributes) => attributes === undefined ? "absent" : Unowned.is(attributes) ? "unowned" : "found";
+var diffAnswer = (diff) => {
+  const action = diff?.action;
+  return action === "noop" || action === "update" || action === "replace" ? action : "none";
+};
+var spyService = (type, service, seen) => {
+  const read = service.read;
+  const diff = service.diff;
+  const modes = service.modes;
+  const watched = {
+    ...service,
+    diff: (input) => (diff === undefined ? Effect2.succeed(undefined) : diff(input)).pipe(Effect2.tap((answer) => Effect2.sync(() => {
+      seenFor(seen, input.fqn).diff = { answer: diffAnswer(answer), input, news: input.news };
+    }))),
+    reconcile: refuse(type, "reconcile"),
+    delete: refuse(type, "delete")
+  };
+  if (read !== undefined) {
+    watched.read = (input) => read(input).pipe(Effect2.tap((answer) => Effect2.sync(() => {
+      const attributes = answer === undefined ? undefined : stripUnowned(answer);
+      seenFor(seen, input.fqn).read = { answer: readAnswer(answer), attributes };
+    })));
+  }
+  if (service.precreate !== undefined)
+    watched.precreate = refuse(type, "precreate");
+  if (modes !== undefined) {
+    watched.modes = {
+      live: Effect2.map(modes.live, (variant) => spyService(type, variant, seen)),
+      local: Effect2.map(modes.local, (variant) => spyService(type, variant, seen))
+    };
+  }
+  return watched;
+};
+var spyCollection = (collection, seen) => {
+  const providers = Object.fromEntries(Object.entries(collection.providers).map(([type, service]) => [
+    type,
+    spyService(type, service, seen)
+  ]));
+  return { ...collection, get: (type) => providers[type], providers };
+};
+var spyContext = (context, seen) => {
+  const services = new Map;
+  for (const [key, value] of context.mapUnsafe) {
+    services.set(key, isProviderService(value) ? spyService(key, value, seen) : isProviderCollectionService(value) ? spyCollection(value, seen) : value);
+  }
+  return Context.makeUnsafe(services);
+};
+
+// src/verify/recheck.ts
+var recheck = (fqn, node, seen) => Effect3.gen(function* () {
+  const observed = seen.get(fqn);
+  const first = observed?.diff;
+  const input = first?.input;
+  const diff = node.provider?.diff;
+  if (node.action !== "adopted" || first?.answer !== "noop" || input === undefined)
+    return;
+  const live = observed?.read?.attributes;
+  const changed = changedFields(input.news, live);
+  if (live === undefined || changed.length === 0)
+    return;
+  if (diff === undefined || node.state === undefined)
+    return;
+  const olds = {
+    ...input.olds,
+    ...Object.fromEntries(changed.map((key) => [key, live[key]]))
+  };
+  const asked = diff({ ...input, olds });
+  const answer = yield* asked.pipe(inPlanScope(fqn, node.state.instanceId), Effect3.map(diffAnswer), Effect3.catchCause(() => Effect3.succeed("failed")));
+  if (observed !== undefined) {
+    observed.diff = first;
+    observed.recheck = answer;
+  }
+});
+
+// src/verify/verify.ts
+var readWithState = (fqn, node) => Effect4.gen(function* () {
+  const read = node.provider?.read;
+  if (read === undefined || node.state === undefined)
+    return;
+  yield* read({
+    fqn,
+    id: node.resource.LogicalId,
+    instanceId: node.state.instanceId,
+    olds: node.state.props,
+    output: node.state.attr
+  }).pipe(inPlanScope(fqn, node.state.instanceId));
+});
+var withState = (stack, nodes) => Effect4.gen(function* () {
+  const store = yield* yield* State;
+  const found = yield* Effect4.all(Object.entries(nodes).map(([fqn, node]) => store.get({ fqn, stack: stack.name, stage: stack.stage }).pipe(Effect4.map((row) => row === undefined || isActionState(row) || row.instanceId !== node.state?.instanceId ? [] : [fqn]))), { concurrency: 8 });
+  return new Set(found.flat());
+});
+var verifySession = (session, options = {}) => {
+  const seen = new Map;
+  const all2 = options.all === true;
+  const plan = Plan.make(session.stack);
+  return Effect4.gen(function* () {
+    const planned = yield* plan;
+    const stateRows = yield* withState(session.stack, planned.resources);
+    yield* Effect4.all(Object.entries(planned.resources).map(([fqn, node]) => recheck(fqn, node, seen)), { concurrency: 8 });
+    if (all2) {
+      const stateful = Object.entries(planned.resources).filter(([fqn]) => stateRows.has(fqn));
+      yield* Effect4.all(stateful.map(([fqn, node]) => readWithState(fqn, node).pipe(Effect4.catchCause(() => Effect4.sync(() => {
+        const entry = seen.get(fqn) ?? {};
+        entry.read = { answer: "failed", attributes: undefined };
+        seen.set(fqn, entry);
+      })))), { concurrency: 8 });
+    }
+    return {
+      declared: Object.keys(planned.resources).length,
+      rows: rowsOf(planned, stateRows, seen, all2),
+      stack: session.stack.name,
+      stage: session.stack.stage
+    };
+  }).pipe(Effect4.provide(spyContext(session.context, seen)), Effect4.scoped);
+};
+var verifyStack = (target, options = {}) => Effect4.gen(function* () {
+  const session = yield* Alchemist.open(target, { adopt: true });
+  return yield* verifySession(session, options);
+}).pipe(Effect4.scoped, Effect4.provide(Alchemist.layer()));
+
+// src/verify/cli.ts
+var setExit = (code) => Effect5.sync(() => {
+  process.exitCode = code;
+});
+var program = Effect5.gen(function* () {
+  const parsed = parseVerifyArgs(process.argv.slice(2), process.env);
+  if (parsed.kind === "help")
+    return yield* Console.log(USAGE);
+  if (parsed.kind === "error") {
+    yield* Console.error(`hf-adopt-verify: ${parsed.message}
+
+${USAGE}`);
+    return yield* setExit(2);
+  }
+  const report = yield* verifyStack(parsed.target, parsed.options);
+  yield* Console.log(parsed.json ? JSON.stringify(report, null, 2) : formatReport(report, parsed.options.all === true));
+  yield* setExit(exitCodeOf(report));
+}).pipe(Effect5.catchCause((cause) => Console.error(`hf-adopt-verify: the plan could not be verified
+${Cause.pretty(cause)}`).pipe(Effect5.andThen(setExit(2)))));
+runMain(program);
+
+//# debugId=66D8EFB2DE677D6964756E2164756E21
+//# sourceMappingURL=cli.js.map

package/dist/verify/cli.js.map

@@ -0,0 +1,17 @@
+{
+  "version": 3,
+  "sources": ["../src/verify/cli.ts", "../src/verify/args.ts", "../src/verify/report.ts", "../src/verify/verify.ts", "../src/verify/plan-scope.ts", "../src/verify/recheck.ts", "../src/verify/rows.ts", "../src/verify/spy.ts"],
+  "sourcesContent": [
+    "#!/usr/bin/env node\n/**\n * `hf-adopt-verify` — the bin. Parse, verify, print, exit 0 / 1 / 2.\n *\n * ★ `runMain` IS ALCHEMY'S (alchemy/Util/PlatformServices), so this runs under bun or node the way\n *   `alchemy` itself does, and exits once the report is out rather than lingering on keep-alive\n *   sockets. Run it where the stack's `alchemy` runs: `bunx --bun hf-adopt-verify …` next to\n *   `bun ./node_modules/alchemy/bin/cli.js plan …`, because the entrypoint it imports is\n *   TypeScript.\n * ⛔ EXIT 2 IS \"COULD NOT TELL\", NEVER A PASS. A plan that fails — a provider that dies, an\n *   `adopt(false)` row that is not ours, a state store it cannot read — prints the cause and exits\n *   2, so a gate reading `!= 0` stops either way.\n */\nimport { runMain } from 'alchemy/Util/PlatformServices';\nimport * as Cause from 'effect/Cause';\nimport * as Console from 'effect/Console';\nimport * as Effect from 'effect/Effect';\nimport { USAGE, parseVerifyArgs } from './args.ts';\nimport { exitCodeOf, formatReport } from './report.ts';\nimport { verifyStack } from './verify.ts';\n\nconst setExit = (code: number) =>\n  Effect.sync(() => {\n    process.exitCode = code;\n  });\n\nconst program = Effect.gen(function* () {\n  const parsed = parseVerifyArgs(process.argv.slice(2), process.env);\n  if (parsed.kind === 'help') return yield* Console.log(USAGE);\n  if (parsed.kind === 'error') {\n    yield* Console.error(`hf-adopt-verify: ${parsed.message}\\n\\n${USAGE}`);\n    return yield* setExit(2);\n  }\n  const report = yield* verifyStack(parsed.target, parsed.options);\n  yield* Console.log(\n    parsed.json\n      ? JSON.stringify(report, null, 2)\n      : formatReport(report, parsed.options.all === true),\n  );\n  yield* setExit(exitCodeOf(report));\n}).pipe(\n  Effect.catchCause((cause) =>\n    Console.error(`hf-adopt-verify: the plan could not be verified\\n${Cause.pretty(cause)}`).pipe(\n      Effect.andThen(setExit(2)),\n    ),\n  ),\n);\n\nrunMain(program);\n",
+    "/**\n * `hf-adopt-verify`'s flags — the ones `alchemy plan` takes, so a stack script can swap one\n * command for the other.\n *\n * ★ `node:util` parseArgs, NOT effect's CLI module. Alchemy builds its CLI on\n *   `effect/unstable/cli`, but that needs a CliConfig and a Terminal layer to parse six flags; the\n *   standard library parses them with no service at all, which keeps this pure and testable.\n * ⛔ `--stage` HAS NO GUESSED DEFAULT. Alchemy falls back to `live_$USER`; a gate that silently\n *   verified the wrong stage would pass for the wrong reason. It comes from the flag or from\n *   `$ALCHEMY_STAGE`, or the run stops.\n */\nimport { parseArgs } from 'node:util';\nimport type { VerifyOptions, VerifyTarget } from './verify.ts';\n\nexport const USAGE = `Usage: hf-adopt-verify --stage <stage> [--config alchemy.run.ts] [options]\n\nPlans the stack with Alchemy's own planner, never writes, and reports each row\nwithout a state row: what the engine planned, the provider's read and its own\ndiff (before Alchemy forces adopted rows to update), and the declared fields\nthat differ from the live object. Exits 0 when every row is a no-op, 1 when\nany is not, 2 when it could not tell.\n\n  -c, --config <file>   stack entrypoint (default alchemy.run.ts)\n      --stage <stage>   stage to verify (default $ALCHEMY_STAGE; required)\n      --profile <name>  Alchemy auth profile\n      --env-file <file> .env file layered under the environment\n      --all             report every declared row and pending deletion\n      --json            print the report as JSON\n  -h, --help            this text\n`;\n\nexport type Parsed =\n  | { readonly kind: 'help' }\n  | { readonly kind: 'error'; readonly message: string }\n  | {\n      readonly kind: 'run';\n      readonly target: VerifyTarget;\n      readonly options: VerifyOptions;\n      readonly json: boolean;\n    };\n\nconst parse = (argv: readonly string[]) =>\n  parseArgs({\n    args: [...argv],\n    allowPositionals: false,\n    options: {\n      all: { type: 'boolean', default: false },\n      config: { type: 'string', short: 'c', default: 'alchemy.run.ts' },\n      'env-file': { type: 'string' },\n      help: { type: 'boolean', short: 'h', default: false },\n      json: { type: 'boolean', default: false },\n      profile: { type: 'string' },\n      stage: { type: 'string' },\n    },\n    strict: true,\n  });\n\n/** Parse argv (without the runtime and script) against the environment. Never throws. */\nexport const parseVerifyArgs = (\n  argv: readonly string[],\n  env: Readonly<Record<string, string | undefined>>,\n): Parsed => {\n  let parsed: ReturnType<typeof parse>;\n  try {\n    parsed = parse(argv);\n  } catch (error) {\n    return { kind: 'error', message: error instanceof Error ? error.message : String(error) };\n  }\n  const { values } = parsed;\n  if (values.help) return { kind: 'help' };\n  const stage = values.stage ?? env['ALCHEMY_STAGE'];\n  if (stage === undefined || stage === '') {\n    return { kind: 'error', message: 'pass --stage (or set ALCHEMY_STAGE): no stage is guessed' };\n  }\n  const target: VerifyTarget = {\n    entrypoint: values.config,\n    stage,\n    ...(values.profile === undefined ? {} : { profile: values.profile }),\n    ...(values['env-file'] === undefined ? {} : { envFile: values['env-file'] }),\n  };\n  return { json: values.json, kind: 'run', options: { all: values.all }, target };\n};\n",
+    "/**\n * The verifier's answer, for a terminal and for a gate.\n *\n * ⛔ NAMES, NEVER VALUES. A row lists which declared fields differ from the live object, not what\n *   either side holds: the tool runs over any stack, and a prop or an attribute can be a secret.\n *   `alchemy plan --detailed` shows declared values; the family's own read shows live ones.\n */\nimport type { AdoptRow } from './rows.ts';\nimport type { AdoptReport } from './verify.ts';\n\n/** 0 when every reported row is a no-op, 1 when any is not. (2 is the CLI's: it could not tell.) */\nexport const exitCodeOf = (report: AdoptReport): 0 | 1 =>\n  report.rows.every((row) => row.ok) ? 0 : 1;\n\nconst pad = (text: string, width: number) => text.padEnd(width);\n\nconst line = (row: AdoptRow, widths: { planned: number; type: number }) => {\n  const head = [\n    row.ok ? 'ok  ' : 'FAIL',\n    pad(row.planned, widths.planned),\n    pad(row.diff, 8),\n    pad(row.read, 9),\n    pad(row.type, widths.type),\n    row.fqn,\n  ].join('  ');\n  const changed = row.changed.length > 0 ? `  changed: ${row.changed.join(', ')}` : '';\n  return row.why === '' ? `${head}${changed}` : `${head}${changed}\\n      ${row.why}`;\n};\n\n/** Plain text, one row per line, with the reason under any row that is not a no-op. */\nexport const formatReport = (report: AdoptReport, all: boolean): string => {\n  const scope = all ? 'every row' : 'rows without state';\n  const title = `hf-adopt-verify ${report.stack}/${report.stage}: ${String(report.rows.length)} ${scope} (of ${String(report.declared)} declared)`;\n  if (report.rows.length === 0) {\n    return `${title}\\nnothing to verify — every declared row already has state. --all checks those too.\\n`;\n  }\n  const widths = {\n    planned: Math.max(7, ...report.rows.map((row) => row.planned.length)),\n    type: Math.max(4, ...report.rows.map((row) => row.type.length)),\n  };\n  const header = ['    ', pad('planned', widths.planned), pad('diff', 8), pad('read', 9)]\n    .concat([pad('type', widths.type), 'fqn'])\n    .join('  ');\n  const failed = report.rows.filter((row) => !row.ok).length;\n  const verdict =\n    failed === 0\n      ? 'every row is a no-op: the deploy writes nothing to them'\n      : `${String(failed)} row(s) are NOT a no-op: the deploy would write, create or delete`;\n  return [title, '', header, ...report.rows.map((row) => line(row, widths)), '', verdict, ''].join(\n    '\\n',\n  );\n};\n",
+    "/**\n * Prove a deploy's adoptions are no-ops — with Alchemy's own planner, before anything is written.\n *\n * ★ THE ENGINE PLANS, THIS ONLY WATCHES. `verifySession` runs `Plan.make` — the same call\n *   `alchemy plan` makes (Alchemist routes/stack.ts) — over the session's context with every\n *   provider swapped for a watched copy (spy.ts). Output resolution, the state lookup, rename\n *   migrations, the adoption probe and `adopt(…)` all stay the engine's; nothing here re-derives\n *   them. What it adds is the provider's own `diff` answer, which Plan.ts overwrites for every\n *   adopted row (`forceUpdateAfterAdoption`), and the state-row check that says which rows ARE\n *   adoptions.\n *\n * ⛔ READ-ONLY BY CONSTRUCTION. The planner calls `read` and `diff`; spy.ts replaces `reconcile`,\n *   `delete` and `precreate` with refusals; nothing here calls `apply`. `--all` adds one `read` per\n *   row with state, and recheck.ts one more `diff` for an adopted `noop` whose read differs from\n *   the declaration — both still reads by Alchemy's provider contract.\n * ⚠️ READS ARE NOT FREE FOR EVERY FAMILY. A kit PVE/PBS read mints a lease through OpenBao, which\n *   creates a short-lived API token on the cluster, exactly as `alchemy plan` does.\n */\nimport * as Alchemist from 'alchemy/Alchemist';\nimport * as Plan from 'alchemy/Plan';\nimport type { ProviderService } from 'alchemy/Provider';\nimport type { CompiledStack } from 'alchemy/Stack';\nimport { State, isActionState } from 'alchemy/State';\nimport type * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport { inPlanScope } from './plan-scope.ts';\nimport { recheck } from './recheck.ts';\nimport { type AdoptRow, type PlanView, rowsOf } from './rows.ts';\nimport { type Observations, spyContext } from './spy.ts';\n\nexport interface VerifyOptions {\n  /** Report every declared row and every pending deletion, not only rows without state. */\n  readonly all?: boolean;\n}\n\nexport interface AdoptReport {\n  readonly stack: string;\n  readonly stage: string;\n  /** Resources the stack declares. */\n  readonly declared: number;\n  readonly rows: readonly AdoptRow[];\n}\n\n/** An imported stack and the context it plans under — what `Alchemist.open` returns. */\nexport interface VerifySession {\n  readonly stack: CompiledStack<unknown, unknown>;\n  readonly context: Context.Context<unknown>;\n}\n\n/** The plan-node fields `--all` needs to read a row that has state, and the recheck to replay a diff. */\ntype StatefulNode = {\n  readonly action: string;\n  readonly provider?: ProviderService;\n  readonly resource: { readonly LogicalId: string };\n  readonly state?: {\n    readonly instanceId: string;\n    readonly props: object;\n    readonly attr: object | undefined;\n  };\n};\n\n/** ⚠️ In the scope Plan.ts gives its own reads (plan-scope.ts). */\nconst readWithState = (fqn: string, node: StatefulNode) =>\n  Effect.gen(function* () {\n    const read = node.provider?.read;\n    if (read === undefined || node.state === undefined) return;\n    yield* read({\n      fqn,\n      id: node.resource.LogicalId,\n      instanceId: node.state.instanceId,\n      olds: node.state.props,\n      output: node.state.attr,\n    }).pipe(inPlanScope(fqn, node.state.instanceId));\n  });\n\n/**\n * Which planned rows plan FROM a resource row the stage's state store holds for them.\n *\n * ⚠️ THE ROW MUST BE THE ONE THE NODE PLANS FROM, NOT MERELY A ROW AT THE SAME FQN. Alchemy lets a\n *   rename hand its old id to a new resource in the same deploy (Rename.ts: `Bucket(\"Assets\")\n *   .pipe(renamedFrom(\"Bucket\"))` beside a fresh `Bucket(\"Bucket\")`). The store still holds the\n *   renamer's row at `Bucket`, so a check by FQN alone called the reuser stateful and the default\n *   report hid its `create`. Matching the node's `state.instanceId` also sees the renamer, whose\n *   row still sits at its FORMER FQN, as a row without state.\n */\nconst withState = (\n  stack: CompiledStack<unknown, unknown>,\n  nodes: Readonly<Record<string, StatefulNode>>,\n) =>\n  Effect.gen(function* () {\n    const store = yield* yield* State;\n    const found = yield* Effect.all(\n      Object.entries(nodes).map(([fqn, node]) =>\n        store\n          .get({ fqn, stack: stack.name, stage: stack.stage })\n          .pipe(\n            Effect.map((row) =>\n              row === undefined ||\n              isActionState(row) ||\n              (row as { readonly instanceId?: unknown }).instanceId !== node.state?.instanceId\n                ? []\n                : [fqn],\n            ),\n          ),\n      ),\n      { concurrency: 8 },\n    );\n    return new Set(found.flat());\n  });\n\n/**\n * Plan `session.stack` with watched providers and report each row without state (or, with\n * `all`, every row). Never writes.\n */\nexport const verifySession = (\n  session: VerifySession,\n  options: VerifyOptions = {},\n): Effect.Effect<AdoptReport, unknown> => {\n  const seen: Observations = new Map();\n  const all = options.all === true;\n  // ⚠️ THE CAST IS AT THE ENGINE'S TYPED BOUNDARY. `Plan.make` declares only `State` and hides the\n  //   rest behind a ts-expect-error; the session context carries all of it, as in routes/stack.ts.\n  const plan = Plan.make(session.stack) as unknown as Effect.Effect<\n    PlanView & { readonly resources: Readonly<Record<string, StatefulNode>> },\n    unknown\n  >;\n  return Effect.gen(function* () {\n    const planned = yield* plan;\n    const stateRows = yield* withState(session.stack, planned.resources);\n    // ★ Before the rows are judged: an adopted `noop` beside a differing read is asked again.\n    yield* Effect.all(\n      Object.entries(planned.resources).map(([fqn, node]) => recheck(fqn, node, seen)),\n      { concurrency: 8 },\n    );\n    if (all) {\n      const stateful = Object.entries(planned.resources).filter(([fqn]) => stateRows.has(fqn));\n      yield* Effect.all(\n        stateful.map(([fqn, node]) =>\n          readWithState(fqn, node).pipe(\n            Effect.catchCause(() =>\n              Effect.sync(() => {\n                const entry = seen.get(fqn) ?? {};\n                entry.read = { answer: 'failed', attributes: undefined };\n                seen.set(fqn, entry);\n              }),\n            ),\n          ),\n        ),\n        { concurrency: 8 },\n      );\n    }\n    return {\n      declared: Object.keys(planned.resources).length,\n      rows: rowsOf(planned, stateRows, seen, all),\n      stack: session.stack.name,\n      stage: session.stack.stage,\n    } satisfies AdoptReport;\n  }).pipe(Effect.provide(spyContext(session.context, seen)), Effect.scoped);\n};\n\n/** Where the stack lives — the fields `alchemy plan` takes as flags. */\nexport interface VerifyTarget {\n  /** The stack entrypoint, e.g. `alchemy.run.ts`. */\n  readonly entrypoint: string;\n  readonly stage: string;\n  readonly profile?: string;\n  readonly envFile?: string;\n}\n\n/**\n * Import the stack the way the Alchemy CLI does and verify it.\n *\n * ★ `adopt: true`, ALWAYS, AND IT CANNOT WRITE. Planning is side-effect free (Plan.ts keeps the\n *   adopted state in memory, alchemy#793), so the flag only lets an `Unowned` row reach its\n *   `diff` instead of failing the plan — the report marks it, because the real deploy then needs\n *   `--adopt`. A resource declared `.pipe(adopt(false))` still fails the plan, as it would deploy.\n */\nexport const verifyStack = (\n  target: VerifyTarget,\n  options: VerifyOptions = {},\n): Effect.Effect<AdoptReport, unknown> =>\n  Effect.gen(function* () {\n    const session = yield* Alchemist.open(target, { adopt: true });\n    return yield* verifySession(session, options);\n  }).pipe(Effect.scoped, Effect.provide(Alchemist.layer()));\n",
+    "/**\n * The scope Plan.ts gives every provider call it makes, for the calls the verifier makes itself\n * after the plan: `--all`'s reads (verify.ts) and the recheck's diffs (recheck.ts).\n *\n * ⚠️ RE-CREATED, BECAUSE Plan.ts DOES NOT EXPORT IT (`providePlanScope`, alchemy beta.79): a scoped\n *   `Artifacts` bag over the run's `ArtifactStore` (a fresh one when none is provided) and the row's\n *   `InstanceId`. A kit family that consults either — the ownership helpers do — sees what it\n *   would see under `alchemy plan`. Moved here from verify.ts once a second caller needed it.\n */\nimport {\n  ArtifactStore,\n  Artifacts,\n  createArtifactStore,\n  makeScopedArtifacts,\n} from 'alchemy/Artifacts';\nimport { InstanceId } from 'alchemy/InstanceId';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\n\nexport const inPlanScope =\n  (fqn: string, instanceId: string) =>\n  <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, E, Exclude<R, Artifacts | InstanceId>> =>\n    Effect.gen(function* () {\n      const store = Option.getOrElse(\n        yield* Effect.serviceOption(ArtifactStore),\n        createArtifactStore,\n      );\n      return yield* effect.pipe(\n        Effect.provideService(Artifacts, makeScopedArtifacts(store, fqn)),\n        Effect.provideService(InstanceId, instanceId),\n      );\n    }) as Effect.Effect<A, E, Exclude<R, Artifacts | InstanceId>>;\n",
+    "/**\n * Ask an adopted row's `diff` a second time, with the live values as its recorded props, when its\n * first `noop` sits beside a read that differs from the declaration.\n *\n * 🔴 WHY (red-teamed 2026-09-21). Plan.ts hands an adopted row's diff `olds: news`, because the\n *   adopted state carries `props: news`. A diff that compares the RECORDED props with the\n *   declaration therefore answers `noop` whatever the cloud holds, and the forced reconcile then\n *   writes. Alchemy's own `Cloudflare.R2Bucket` diff is that shape (beta.79\n *   Cloudflare/R2/Bucket.ts, `olds.domains` against `news.domains`). The verifier said `ok`,\n *   exited 0, and listed the drift under `changed` on the same line. rows.ts already refused to\n *   trust a MISSING diff for this reason; a diff that never looks at the live object is the same\n *   blind spot one level down.\n *\n * ★ THE QUESTION IS \"WOULD YOU STILL SAY noop IF STATE HAD RECORDED WHAT THE READ FOUND?\" It is the\n *   planner's own input, replayed with one change: `olds` carries the read's value for each field\n *   in `changed`. A diff that reads the live object ignores `olds` and answers as before. Every kit\n *   PVE/PBS family re-reads (`pveOperations.diff`), so a field its `matches` leaves out, such as\n *   CephPool's autoscaled `pg_num`, still passes. A diff that compares `olds` now sees the drift.\n *\n * ⛔ ONLY `diff`, a read by Alchemy's contract, and through the WATCHED provider, so every write\n *   path still answers with spy.ts's refusal. The first answer is put back afterwards: the report's\n *   `diff` column stays what the planner heard.\n * ⚠️ IT CAN ONLY TURN A PASS INTO A FAIL. It runs on a row that would otherwise pass (adopted,\n *   `noop`, something in `changed`), and anything but a second `noop`, a failure included, fails it.\n * ⚠️ SAME-NAMED FIELDS ONLY, like `changed`: a drift in a field whose attribute has another name is\n *   invisible to both. Whether a `reconcile` PUTs identical values anyway is still up to the\n *   provider (docs/adopt-verify.md, Limits).\n */\nimport type { ProviderService } from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { inPlanScope } from './plan-scope.ts';\nimport { changedFields } from './rows.ts';\nimport { type Observations, type RecheckAnswer, diffAnswer } from './spy.ts';\n\n/** The plan-node fields a recheck needs. */\nexport interface RecheckNode {\n  readonly action: string;\n  readonly provider?: ProviderService;\n  readonly state?: { readonly instanceId: string };\n}\n\n/** Recheck one planned row if it needs it; the answer lands in `seen` as `recheck`. */\nexport const recheck = (fqn: string, node: RecheckNode, seen: Observations): Effect.Effect<void> =>\n  Effect.gen(function* () {\n    const observed = seen.get(fqn);\n    const first = observed?.diff;\n    const input = first?.input;\n    const diff = node.provider?.diff;\n    if (node.action !== 'adopted' || first?.answer !== 'noop' || input === undefined) return;\n    const live = observed?.read?.attributes as Record<string, unknown> | undefined;\n    const changed = changedFields(input.news, live);\n    if (live === undefined || changed.length === 0) return;\n    if (diff === undefined || node.state === undefined) return;\n    const olds = {\n      ...(input.olds as object),\n      ...Object.fromEntries(changed.map((key) => [key, live[key]])),\n    };\n    // ⚠️ THE CAST IS THE ENGINE'S BOUNDARY, as in verify.ts: the diff's requirements are the\n    //   session's, which verifySession provides around this call.\n    const asked = diff({ ...input, olds } as typeof input) as Effect.Effect<unknown>;\n    const answer: RecheckAnswer = yield* asked.pipe(\n      inPlanScope(fqn, node.state.instanceId),\n      Effect.map(diffAnswer),\n      Effect.catchCause(() => Effect.succeed('failed' as const)),\n    );\n    // The watched diff recorded the replay over the planner's answer; put the planner's back.\n    if (observed !== undefined) {\n      observed.diff = first;\n      observed.recheck = answer;\n    }\n  });\n",
+    "/**\n * One report row per planned resource: what the engine planned, what the provider said, and\n * whether that adds up to \"this deploy leaves the object alone\".\n *\n * ★ PURE, SO THE VERDICT IS TESTABLE WITHOUT AN ENGINE. verify.ts gathers the three inputs — the\n *   plan, which FQNs have a state row, and what the watched providers answered (spy.ts) — and\n *   this file only decides.\n */\nimport { deepEqual, isResolved } from 'alchemy/Diff';\nimport type { DiffAnswer, Observations, ReadAnswer, RecheckAnswer } from './spy.ts';\n\nexport interface AdoptRow {\n  readonly fqn: string;\n  readonly type: string;\n  /**\n   * Whether the row plans from a row the state store holds for it (verify.ts `withState`). An\n   * adoption is a row without one.\n   */\n  readonly stateRow: boolean;\n  /** The engine's action — what `alchemy plan` prints (`adopted`, `create`, `noop`, …). */\n  readonly planned: string;\n  /** What the provider's `read` answered, or `not-read` when nothing asked it. */\n  readonly read: ReadAnswer;\n  /** What the provider's own `diff` answered BEFORE Plan.ts forced it (spy.ts). */\n  readonly diff: DiffAnswer;\n  /**\n   * Declared fields whose live value differs, by NAME only — values can be secrets. Compared on\n   * same-named keys of the declaration and the read's attributes, so a family whose attributes\n   * rename a field cannot show it here. The diff answer is the verdict; a name here beside an\n   * adopted `noop` only makes recheck.ts ask that diff again.\n   */\n  readonly changed: readonly string[];\n  /**\n   * What the provider's `diff` answered when asked again with the live values of `changed` as its\n   * recorded props (recheck.ts). Absent when it was not asked: only an adopted `noop` with\n   * something in `changed` is.\n   */\n  readonly recheck?: RecheckAnswer;\n  /** Bindings the engine will create, update or delete — reconcile applies them even on `noop`. */\n  readonly bindings: number;\n  readonly ok: boolean;\n  /** Why the row is not a no-op, or a note on one that is; empty when there is nothing to say. */\n  readonly why: string;\n}\n\n/** The slice of an Alchemy plan node this file reads. */\nexport interface NodeView {\n  readonly action: string;\n  readonly resource: { readonly Type: string };\n  readonly bindings?: readonly { readonly action: string }[];\n}\n\n/** A stack task (an Alchemy action): `run`, `noop` or `delete`. It has no provider to ask. */\nexport interface TaskView {\n  readonly action: string;\n  readonly def: { readonly Type: string };\n}\n\n/** The slice of an Alchemy `Plan` this file reads. */\nexport interface PlanView {\n  readonly resources: Readonly<Record<string, NodeView>>;\n  readonly deletions: Readonly<Record<string, NodeView | undefined>>;\n  readonly actions?: Readonly<Record<string, TaskView | undefined>>;\n}\n\n/** Same-named, declared, resolved fields where the live value differs. */\nexport const changedFields = (declared: unknown, live: unknown): string[] => {\n  if (typeof declared !== 'object' || declared === null) return [];\n  if (typeof live !== 'object' || live === null) return [];\n  const actual = live as Record<string, unknown>;\n  return Object.entries(declared as Record<string, unknown>)\n    .filter(([key, value]) => value !== undefined && key in actual && isResolved(value))\n    .filter(([key, value]) => !deepEqual(value, actual[key]))\n    .map(([key]) => key)\n    .sort();\n};\n\nconst STILL_LIVE = new Set(['adopted', 'noop']);\n\n/**\n * ⛔ `adopted` NEEDS THE PROVIDER'S OWN `noop`. With no diff (`none`) the engine compared the\n *   declaration with the declaration — an adopted row's state carries `props: news` (Plan.ts) — so\n *   its noop proves nothing. A row with state is different: there the engine compared against the\n *   props it last deployed, which is the same check `alchemy plan` makes.\n */\nconst isNoop = (planned: string, diff: DiffAnswer, stateRow: boolean) =>\n  STILL_LIVE.has(planned) &&\n  (diff === 'noop' || (diff === 'none' && stateRow && planned === 'noop'));\n\n/**\n * ⛔ AND A `noop` MUST SURVIVE BEING ASKED WITH THE LIVE VALUES. A diff that compares recorded props\n *   answers an adopted row `noop` whatever the cloud holds; recheck.ts asks it again, and only a\n *   second `noop` (or no need to ask) proves anything.\n */\nconst proven = (recheck: RecheckAnswer | undefined) => recheck === undefined || recheck === 'noop';\n\n/** Notes on a row that passes: nothing to say is the common case. */\nconst notes = (row: Omit<AdoptRow, 'ok' | 'why'>): string =>\n  [\n    row.read === 'unowned' ? 'unowned: the deploy needs --adopt or adopt(true)' : '',\n    row.recheck === 'noop'\n      ? `${row.changed.join(', ')} differ, but the diff says noop even given the live values: ` +\n        'the family does not manage them, and the deploy leaves them alone'\n      : '',\n  ]\n    .filter((note) => note !== '')\n    .join('; ');\n\nconst reason = (row: Omit<AdoptRow, 'ok' | 'why'>, ok: boolean): string => {\n  if (ok) return notes(row);\n  if (isNoop(row.planned, row.diff, row.stateRow)) {\n    const live = `the live ${row.changed.join(', ')}`;\n    if (row.recheck === 'failed') {\n      return `asked again with ${live} as recorded props, the provider's diff failed: not proven`;\n    }\n    if (!proven(row.recheck)) {\n      return (\n        `the provider's diff compares recorded props, not the live object: given ${live} it ` +\n        `says ${String(row.recheck)}, and the deploy's forced reconcile writes`\n      );\n    }\n    return `${String(row.bindings)} binding(s) change: the deploy reconciles them though the diff is noop`;\n  }\n  if (row.planned === 'delete') return 'no longer declared: the deploy deletes it';\n  if (row.planned === 'orphaned') return 'no longer declared: the deploy drops its state (retain)';\n  if (row.read === 'failed') return \"the verifier's own read of it failed\";\n  if (row.planned === 'create') {\n    if (row.stateRow) return 'an interrupted create: the deploy finishes creating it';\n    return row.read === 'absent'\n      ? 'the read found nothing, so the deploy CREATES it (a lane that cannot see it reads the same)'\n      : 'never probed (a prop is an Output of another resource, or the provider has no read): ' +\n          'the deploy CREATES it';\n  }\n  if (row.diff === 'update') return \"the provider's diff says update: the deploy writes\";\n  if (row.diff === 'replace') return \"the provider's diff says replace: a new one, then a delete\";\n  if (row.diff === 'none') {\n    return 'the provider has no diff, so the engine compared the declaration with itself';\n  }\n  return `the engine plans ${row.planned} although the diff says ${row.diff} (a renamed row, changed bindings or --force)`;\n};\n\nexport const rowFor = (\n  fqn: string,\n  node: NodeView,\n  stateRow: boolean,\n  seen: Observations,\n): AdoptRow => {\n  const observed = seen.get(fqn);\n  const recheck = observed?.recheck;\n  const base = {\n    bindings: (node.bindings ?? []).filter((binding) => binding.action !== 'noop').length,\n    changed: changedFields(observed?.diff?.news, observed?.read?.attributes),\n    diff: observed?.diff?.answer ?? 'not-run',\n    fqn,\n    planned: node.action,\n    read: observed?.read?.answer ?? 'not-read',\n    ...(recheck === undefined ? {} : { recheck }),\n    stateRow,\n    type: node.resource.Type,\n  } satisfies Omit<AdoptRow, 'ok' | 'why'>;\n  /**\n   * ⚠️ A NOOP DIFF DOES NOT COVER BINDINGS. Plan.ts diffs them separately and hands every\n   *   non-noop binding to `reconcile`, which an adopted row reaches anyway — a Worker adopted with\n   *   a new binding writes although its own diff said nothing changed.\n   */\n  const ok = isNoop(base.planned, base.diff, stateRow) && proven(recheck) && base.bindings === 0;\n  return { ...base, ok, why: reason(base, ok) };\n};\n\n/**\n * ⚠️ A TASK THAT RUNS IS A WRITE THE PROVIDERS NEVER SEE, so it is reported in both modes; a task\n *   that would not run appears only with `all`.\n */\nconst taskRow = (fqn: string, task: TaskView): AdoptRow => ({\n  bindings: 0,\n  changed: [],\n  diff: 'not-run',\n  fqn,\n  ok: task.action === 'noop',\n  planned: task.action,\n  read: 'not-read',\n  stateRow: task.action !== 'run',\n  type: task.def.Type,\n  why: task.action === 'noop' ? '' : `a stack task: the deploy will ${task.action} it`,\n});\n\n/**\n * The rows to report. Without `all`, only rows WITHOUT a state row — the adoptions and creates a\n * deploy would perform — which is the question this tool exists for, plus any task that runs. With\n * `all`, every declared row, every pending deletion and every task.\n */\nexport const rowsOf = (\n  plan: PlanView,\n  stateRows: ReadonlySet<string>,\n  seen: Observations,\n  all: boolean,\n): AdoptRow[] => {\n  const declared = Object.entries(plan.resources)\n    .filter(([fqn]) => all || !stateRows.has(fqn))\n    .map(([fqn, node]) => rowFor(fqn, node, stateRows.has(fqn), seen));\n  const removed = all\n    ? Object.entries(plan.deletions).flatMap(([fqn, node]) =>\n        node === undefined ? [] : [rowFor(fqn, node, true, seen)],\n      )\n    : [];\n  const tasks = Object.entries(plan.actions ?? {}).flatMap(([fqn, task]) =>\n    task === undefined || (!all && task.action === 'noop') ? [] : [taskRow(fqn, task)],\n  );\n  return [...declared, ...removed, ...tasks].sort((a, b) => a.fqn.localeCompare(b.fqn));\n};\n",
+    "/**\n * The providers a stack registered, wrapped so the plan can be watched and can never write.\n *\n * ★ WHY A WRAPPER AND NOT A LOG LINE. alchemy beta.79 Plan.ts loses the provider's answer on the one\n *   path that matters: after the cold-start adoption probe it sets `forceUpdateAfterAdoption` and\n *   maps a `noop` diff to `update`, and the node says `adopted` either way. Nothing is logged, and\n *   `alchemy plan` has no JSON output — `describePlan` carries only the forced action. The engine\n *   resolves every provider from the Effect context by resource type (Provider.ts\n *   `tryFindProviderRegistrationByType`), so the one honest place to hear the raw answer is the\n *   provider service itself. This hands Alchemy's own `Plan.make` a context whose providers record\n *   what `read` and `diff` answered, per FQN, and otherwise behave exactly as registered.\n *\n * ⛔ EVERY WRITE PATH DIES. `reconcile`, `delete` and `precreate` are replaced, not wrapped: the\n *   planner never calls them, and a verifier that could reach one by accident is worse than none.\n *   `read`, `diff`, `list`, `tail` and `logs` pass through — each is a read by Alchemy's contract.\n *\n * ⚠️ A MISSING `diff` IS WRAPPED AS ONE ANSWERING `undefined`, which is exactly what the planner\n *   does without one (`provider?.diff?.(…)` then its own props compare), so behaviour is unchanged\n *   and the report can say `none` instead of guessing. A missing `read` stays missing: adding one\n *   would make the planner probe where it otherwise would not.\n */\nimport { Unowned, stripUnowned } from 'alchemy/AdoptPolicy';\nimport {\n  type ProviderCollectionService,\n  type ProviderService,\n  isProviderCollectionService,\n  isProviderService,\n} from 'alchemy/Provider';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\n\nexport type ReadAnswer = 'found' | 'unowned' | 'absent' | 'failed' | 'not-read';\nexport type DiffAnswer = 'noop' | 'update' | 'replace' | 'none' | 'not-run';\n/** What the diff answered when asked again with the live values as its recorded props (recheck.ts). */\nexport type RecheckAnswer = DiffAnswer | 'failed';\n\n/** Exactly what the planner handed a provider's `diff`. */\nexport type DiffInput = Parameters<NonNullable<ProviderService['diff']>>[0];\n\n/** What one FQN's provider answered during the plan — the LAST answer of each kind. */\nexport interface Seen {\n  read?: { readonly answer: ReadAnswer; readonly attributes: unknown };\n  /**\n   * ★ `input` IS THE WHOLE CALL, NOT ONLY `news`, so recheck.ts can ask the same question again\n   *   with one field changed. In memory only; the report carries field names, never values. An\n   *   observation built by hand without it (rows.ts's tests) is simply never rechecked.\n   */\n  diff?: { readonly answer: DiffAnswer; readonly news: unknown; readonly input?: DiffInput };\n  recheck?: RecheckAnswer;\n}\n\n/** Keyed by FQN. Filled while the plan runs; read once it is done. */\nexport type Observations = Map<string, Seen>;\n\nconst seenFor = (seen: Observations, fqn: string): Seen => {\n  const existing = seen.get(fqn);\n  if (existing !== undefined) return existing;\n  const fresh: Seen = {};\n  seen.set(fqn, fresh);\n  return fresh;\n};\n\n/** The refusal every write path answers with. Exported so a test can match it. */\nexport const WRITE_REFUSED = 'hf-adopt-verify never writes';\n\nconst refuse = (type: string, operation: string) => () =>\n  Effect.die(\n    new Error(\n      `${WRITE_REFUSED}: ${type}.${operation} was called during a verification. Alchemy's planner ` +\n        'does not call it, so something other than Plan.make is driving these providers.',\n    ),\n  );\n\nconst readAnswer = (attributes: unknown): ReadAnswer =>\n  attributes === undefined ? 'absent' : Unowned.is(attributes) ? 'unowned' : 'found';\n\nexport const diffAnswer = (diff: unknown): DiffAnswer => {\n  const action = (diff as { action?: unknown } | undefined)?.action;\n  return action === 'noop' || action === 'update' || action === 'replace' ? action : 'none';\n};\n\n/**\n * One provider service, watched. ⚠️ The spread keeps `version`, `aliases`, `mode`, `stables`,\n * `list` and the rest exactly as registered — the planner reads several of them.\n */\nexport const spyService = (type: string, service: ProviderService, seen: Observations) => {\n  const read = service.read;\n  const diff = service.diff;\n  const modes = service.modes;\n  const watched: ProviderService = {\n    ...service,\n    diff: (input) =>\n      (diff === undefined ? Effect.succeed(undefined) : diff(input)).pipe(\n        Effect.tap((answer) =>\n          Effect.sync(() => {\n            seenFor(seen, input.fqn).diff = { answer: diffAnswer(answer), input, news: input.news };\n          }),\n        ),\n      ),\n    reconcile: refuse(type, 'reconcile'),\n    delete: refuse(type, 'delete'),\n  };\n  if (read !== undefined) {\n    watched.read = (input) =>\n      read(input).pipe(\n        Effect.tap((answer) =>\n          Effect.sync(() => {\n            const attributes = answer === undefined ? undefined : stripUnowned(answer);\n            seenFor(seen, input.fqn).read = { answer: readAnswer(answer), attributes };\n          }),\n        ),\n      );\n  }\n  if (service.precreate !== undefined) watched.precreate = refuse(type, 'precreate');\n  // ⚠️ A `ProviderLayer.dual` registration resolves a per-mode variant at plan time\n  //   (Provider.ts `providerForMode`); wrapping only the registration would miss it.\n  if (modes !== undefined) {\n    watched.modes = {\n      live: Effect.map(modes.live, (variant) => spyService(type, variant, seen)),\n      local: Effect.map(modes.local, (variant) => spyService(type, variant, seen)),\n    };\n  }\n  return watched;\n};\n\nconst spyCollection = (\n  collection: ProviderCollectionService,\n  seen: Observations,\n): ProviderCollectionService => {\n  const providers = Object.fromEntries(\n    Object.entries(collection.providers).map(([type, service]) => [\n      type,\n      spyService(type, service, seen),\n    ]),\n  );\n  return { ...collection, get: (type: string) => providers[type] as never, providers };\n};\n\n/**\n * The same context with every provider service — direct or inside a `Provider.collection` —\n * replaced by its watched copy. Everything else (the state store, the stack, credentials) is the\n * very object the session built.\n */\nexport const spyContext = <R>(\n  context: Context.Context<R>,\n  seen: Observations,\n): Context.Context<R> => {\n  const services = new Map<string, unknown>();\n  for (const [key, value] of context.mapUnsafe) {\n    services.set(\n      key,\n      isProviderService(value)\n        ? spyService(key, value, seen)\n        : isProviderCollectionService(value)\n          ? spyCollection(value, seen)\n          : value,\n    );\n  }\n  return Context.makeUnsafe<R>(services);\n};\n"
+  ],
+  "mappings": ";;;AAaA;AACA;AACA;AACA;;;ACLA;AAGO,IAAM,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA2BrB,IAAM,QAAQ,CAAC,SACb,UAAU;AAAA,EACR,MAAM,CAAC,GAAG,IAAI;AAAA,EACd,kBAAkB;AAAA,EAClB,SAAS;AAAA,IACP,KAAK,EAAE,MAAM,WAAW,SAAS,MAAM;AAAA,IACvC,QAAQ,EAAE,MAAM,UAAU,OAAO,KAAK,SAAS,iBAAiB;AAAA,IAChE,YAAY,EAAE,MAAM,SAAS;AAAA,IAC7B,MAAM,EAAE,MAAM,WAAW,OAAO,KAAK,SAAS,MAAM;AAAA,IACpD,MAAM,EAAE,MAAM,WAAW,SAAS,MAAM;AAAA,IACxC,SAAS,EAAE,MAAM,SAAS;AAAA,IAC1B,OAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AAAA,EACA,QAAQ;AACV,CAAC;AAGI,IAAM,kBAAkB,CAC7B,MACA,QACW;AAAA,EACX,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,MAAM,IAAI;AAAA,IACnB,OAAO,OAAO;AAAA,IACd,OAAO,EAAE,MAAM,SAAS,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA;AAAA,EAE1F,QAAQ,WAAW;AAAA,EACnB,IAAI,OAAO;AAAA,IAAM,OAAO,EAAE,MAAM,OAAO;AAAA,EACvC,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,EAClC,IAAI,UAAU,aAAa,UAAU,IAAI;AAAA,IACvC,OAAO,EAAE,MAAM,SAAS,SAAS,2DAA2D;AAAA,EAC9F;AAAA,EACA,MAAM,SAAuB;AAAA,IAC3B,YAAY,OAAO;AAAA,IACnB;AAAA,OACI,OAAO,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;AAAA,OAC9D,OAAO,gBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,OAAO,YAAY;AAAA,EAC5E;AAAA,EACA,OAAO,EAAE,MAAM,OAAO,MAAM,MAAM,OAAO,SAAS,EAAE,KAAK,OAAO,IAAI,GAAG,OAAO;AAAA;;;ACrEzE,IAAM,aAAa,CAAC,WACzB,OAAO,KAAK,MAAM,CAAC,QAAQ,IAAI,EAAE,IAAI,IAAI;AAE3C,IAAM,MAAM,CAAC,MAAc,UAAkB,KAAK,OAAO,KAAK;AAE9D,IAAM,OAAO,CAAC,KAAe,WAA8C;AAAA,EACzE,MAAM,OAAO;AAAA,IACX,IAAI,KAAK,SAAS;AAAA,IAClB,IAAI,IAAI,SAAS,OAAO,OAAO;AAAA,IAC/B,IAAI,IAAI,MAAM,CAAC;AAAA,IACf,IAAI,IAAI,MAAM,CAAC;AAAA,IACf,IAAI,IAAI,MAAM,OAAO,IAAI;AAAA,IACzB,IAAI;AAAA,EACN,EAAE,KAAK,IAAI;AAAA,EACX,MAAM,UAAU,IAAI,QAAQ,SAAS,IAAI,cAAc,IAAI,QAAQ,KAAK,IAAI,MAAM;AAAA,EAClF,OAAO,IAAI,QAAQ,KAAK,GAAG,OAAO,YAAY,GAAG,OAAO;AAAA,QAAkB,IAAI;AAAA;AAIzE,IAAM,eAAe,CAAC,QAAqB,QAAyB;AAAA,EACzE,MAAM,QAAQ,MAAM,cAAc;AAAA,EAClC,MAAM,QAAQ,mBAAmB,OAAO,SAAS,OAAO,UAAU,OAAO,OAAO,KAAK,MAAM,KAAK,aAAa,OAAO,OAAO,QAAQ;AAAA,EACnI,IAAI,OAAO,KAAK,WAAW,GAAG;AAAA,IAC5B,OAAO,GAAG;AAAA;AAAA;AAAA,EACZ;AAAA,EACA,MAAM,SAAS;AAAA,IACb,SAAS,KAAK,IAAI,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC,QAAQ,IAAI,QAAQ,MAAM,CAAC;AAAA,IACpE,MAAM,KAAK,IAAI,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,MAAM,CAAC;AAAA,EAChE;AAAA,EACA,MAAM,SAAS,CAAC,QAAQ,IAAI,WAAW,OAAO,OAAO,GAAG,IAAI,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC,EACnF,OAAO,CAAC,IAAI,QAAQ,OAAO,IAAI,GAAG,KAAK,CAAC,EACxC,KAAK,IAAI;AAAA,EACZ,MAAM,SAAS,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;AAAA,EACpD,MAAM,UACJ,WAAW,IACP,4DACA,GAAG,OAAO,MAAM;AAAA,EACtB,OAAO,CAAC,OAAO,IAAI,QAAQ,GAAG,OAAO,KAAK,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,EAAE,KAC1F;AAAA,CACF;AAAA;;;AChCF;AACA;AAGA;AAEA;;;ACfA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA;AACA;AACA;AAEO,IAAM,cACX,CAAC,KAAa,eACd,CACE,WAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAe,iBACnB,OAAc,qBAAc,aAAa,GACzC,mBACF;AAAA,EACA,OAAO,OAAO,OAAO,KACZ,sBAAe,WAAW,oBAAoB,OAAO,GAAG,CAAC,GACzD,sBAAe,YAAY,UAAU,CAC9C;AAAA,CACD;;;ACJL;;;ACrBA;AA0DO,IAAM,gBAAgB,CAAC,UAAmB,SAA4B;AAAA,EAC3E,IAAI,OAAO,aAAa,YAAY,aAAa;AAAA,IAAM,OAAO,CAAC;AAAA,EAC/D,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM,OAAO,CAAC;AAAA,EACvD,MAAM,SAAS;AAAA,EACf,OAAO,OAAO,QAAQ,QAAmC,EACtD,OAAO,EAAE,KAAK,WAAW,UAAU,cAAa,OAAO,WAAU,WAAW,KAAK,CAAC,EAClF,OAAO,EAAE,KAAK,WAAW,CAAC,UAAU,OAAO,OAAO,IAAI,CAAC,EACvD,IAAI,EAAE,SAAS,GAAG,EAClB,KAAK;AAAA;AAGV,IAAM,aAAa,IAAI,IAAI,CAAC,WAAW,MAAM,CAAC;AAQ9C,IAAM,SAAS,CAAC,SAAiB,MAAkB,aACjD,WAAW,IAAI,OAAO,MACrB,SAAS,UAAW,SAAS,UAAU,YAAY,YAAY;AAOlE,IAAM,SAAS,CAAC,YAAuC,YAAY,aAAa,YAAY;AAG5F,IAAM,QAAQ,CAAC,QACb;AAAA,EACE,IAAI,SAAS,YAAY,qDAAqD;AAAA,EAC9E,IAAI,YAAY,SACZ,GAAG,IAAI,QAAQ,KAAK,IAAI,kEACxB,sEACA;AACN,EACG,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,IAAI;AAEd,IAAM,SAAS,CAAC,KAAmC,OAAwB;AAAA,EACzE,IAAI;AAAA,IAAI,OAAO,MAAM,GAAG;AAAA,EACxB,IAAI,OAAO,IAAI,SAAS,IAAI,MAAM,IAAI,QAAQ,GAAG;AAAA,IAC/C,MAAM,OAAO,YAAY,IAAI,QAAQ,KAAK,IAAI;AAAA,IAC9C,IAAI,IAAI,YAAY,UAAU;AAAA,MAC5B,OAAO,oBAAoB;AAAA,IAC7B;AAAA,IACA,IAAI,CAAC,OAAO,IAAI,OAAO,GAAG;AAAA,MACxB,OACE,2EAA2E,aAC3E,QAAQ,OAAO,IAAI,OAAO;AAAA,IAE9B;AAAA,IACA,OAAO,GAAG,OAAO,IAAI,QAAQ;AAAA,EAC/B;AAAA,EACA,IAAI,IAAI,YAAY;AAAA,IAAU,OAAO;AAAA,EACrC,IAAI,IAAI,YAAY;AAAA,IAAY,OAAO;AAAA,EACvC,IAAI,IAAI,SAAS;AAAA,IAAU,OAAO;AAAA,EAClC,IAAI,IAAI,YAAY,UAAU;AAAA,IAC5B,IAAI,IAAI;AAAA,MAAU,OAAO;AAAA,IACzB,OAAO,IAAI,SAAS,WAChB,gGACA,0FACE;AAAA,EACR;AAAA,EACA,IAAI,IAAI,SAAS;AAAA,IAAU,OAAO;AAAA,EAClC,IAAI,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EACnC,IAAI,IAAI,SAAS,QAAQ;AAAA,IACvB,OAAO;AAAA,EACT;AAAA,EACA,OAAO,oBAAoB,IAAI,kCAAkC,IAAI;AAAA;AAGhE,IAAM,SAAS,CACpB,KACA,MACA,UACA,SACa;AAAA,EACb,MAAM,WAAW,KAAK,IAAI,GAAG;AAAA,EAC7B,MAAM,UAAU,UAAU;AAAA,EAC1B,MAAM,OAAO;AAAA,IACX,WAAW,KAAK,YAAY,CAAC,GAAG,OAAO,CAAC,YAAY,QAAQ,WAAW,MAAM,EAAE;AAAA,IAC/E,SAAS,cAAc,UAAU,MAAM,MAAM,UAAU,MAAM,UAAU;AAAA,IACvE,MAAM,UAAU,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,SAAS,KAAK;AAAA,IACd,MAAM,UAAU,MAAM,UAAU;AAAA,OAC5B,YAAY,YAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,IAC3C;AAAA,IACA,MAAM,KAAK,SAAS;AAAA,EACtB;AAAA,EAMA,MAAM,KAAK,OAAO,KAAK,SAAS,KAAK,MAAM,QAAQ,KAAK,OAAO,OAAO,KAAK,KAAK,aAAa;AAAA,EAC7F,OAAO,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAO9C,IAAM,UAAU,CAAC,KAAa,UAA8B;AAAA,EAC1D,UAAU;AAAA,EACV,SAAS,CAAC;AAAA,EACV,MAAM;AAAA,EACN;AAAA,EACA,IAAI,KAAK,WAAW;AAAA,EACpB,SAAS,KAAK;AAAA,EACd,MAAM;AAAA,EACN,UAAU,KAAK,WAAW;AAAA,EAC1B,MAAM,KAAK,IAAI;AAAA,EACf,KAAK,KAAK,WAAW,SAAS,KAAK,iCAAiC,KAAK;AAC3E;AAOO,IAAM,SAAS,CACpB,MACA,WACA,MACA,QACe;AAAA,EACf,MAAM,WAAW,OAAO,QAAQ,KAAK,SAAS,EAC3C,OAAO,EAAE,SAAS,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,EAC5C,IAAI,EAAE,KAAK,UAAU,OAAO,KAAK,MAAM,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC;AAAA,EACnE,MAAM,UAAU,MACZ,OAAO,QAAQ,KAAK,SAAS,EAAE,QAAQ,EAAE,KAAK,UAC5C,SAAS,YAAY,CAAC,IAAI,CAAC,OAAO,KAAK,MAAM,MAAM,IAAI,CAAC,CAC1D,IACA,CAAC;AAAA,EACL,MAAM,QAAQ,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,UAC9D,SAAS,aAAc,CAAC,OAAO,KAAK,WAAW,SAAU,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CACnF;AAAA,EACA,OAAO,CAAC,GAAG,UAAU,GAAG,SAAS,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;AAAA;;;AC3LtF;AACA;AAAA;AAAA;AAAA;AAMA;AACA;AAyBA,IAAM,UAAU,CAAC,MAAoB,QAAsB;AAAA,EACzD,MAAM,WAAW,KAAK,IAAI,GAAG;AAAA,EAC7B,IAAI,aAAa;AAAA,IAAW,OAAO;AAAA,EACnC,MAAM,QAAc,CAAC;AAAA,EACrB,KAAK,IAAI,KAAK,KAAK;AAAA,EACnB,OAAO;AAAA;AAIF,IAAM,gBAAgB;AAE7B,IAAM,SAAS,CAAC,MAAc,cAAsB,MAC3C,YACL,IAAI,MACF,GAAG,kBAAkB,QAAQ,mEAC3B,iFACJ,CACF;AAEF,IAAM,aAAa,CAAC,eAClB,eAAe,YAAY,WAAW,QAAQ,GAAG,UAAU,IAAI,YAAY;AAEtE,IAAM,aAAa,CAAC,SAA8B;AAAA,EACvD,MAAM,SAAU,MAA2C;AAAA,EAC3D,OAAO,WAAW,UAAU,WAAW,YAAY,WAAW,YAAY,SAAS;AAAA;AAO9E,IAAM,aAAa,CAAC,MAAc,SAA0B,SAAuB;AAAA,EACxF,MAAM,OAAO,QAAQ;AAAA,EACrB,MAAM,OAAO,QAAQ;AAAA,EACrB,MAAM,QAAQ,QAAQ;AAAA,EACtB,MAAM,UAA2B;AAAA,OAC5B;AAAA,IACH,MAAM,CAAC,WACJ,SAAS,YAAmB,gBAAQ,SAAS,IAAI,KAAK,KAAK,GAAG,KACtD,YAAI,CAAC,WACH,aAAK,MAAM;AAAA,MAChB,QAAQ,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,WAAW,MAAM,GAAG,OAAO,MAAM,MAAM,KAAK;AAAA,KACvF,CACH,CACF;AAAA,IACF,WAAW,OAAO,MAAM,WAAW;AAAA,IACnC,QAAQ,OAAO,MAAM,QAAQ;AAAA,EAC/B;AAAA,EACA,IAAI,SAAS,WAAW;AAAA,IACtB,QAAQ,OAAO,CAAC,UACd,KAAK,KAAK,EAAE,KACH,YAAI,CAAC,WACH,aAAK,MAAM;AAAA,MAChB,MAAM,aAAa,WAAW,YAAY,YAAY,aAAa,MAAM;AAAA,MACzE,QAAQ,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,WAAW,MAAM,GAAG,WAAW;AAAA,KAC1E,CACH,CACF;AAAA,EACJ;AAAA,EACA,IAAI,QAAQ,cAAc;AAAA,IAAW,QAAQ,YAAY,OAAO,MAAM,WAAW;AAAA,EAGjF,IAAI,UAAU,WAAW;AAAA,IACvB,QAAQ,QAAQ;AAAA,MACd,MAAa,YAAI,MAAM,MAAM,CAAC,YAAY,WAAW,MAAM,SAAS,IAAI,CAAC;AAAA,MACzE,OAAc,YAAI,MAAM,OAAO,CAAC,YAAY,WAAW,MAAM,SAAS,IAAI,CAAC;AAAA,IAC7E;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,gBAAgB,CACpB,YACA,SAC8B;AAAA,EAC9B,MAAM,YAAY,OAAO,YACvB,OAAO,QAAQ,WAAW,SAAS,EAAE,IAAI,EAAE,MAAM,aAAa;AAAA,IAC5D;AAAA,IACA,WAAW,MAAM,SAAS,IAAI;AAAA,EAChC,CAAC,CACH;AAAA,EACA,OAAO,KAAK,YAAY,KAAK,CAAC,SAAiB,UAAU,OAAgB,UAAU;AAAA;AAQ9E,IAAM,aAAa,CACxB,SACA,SACuB;AAAA,EACvB,MAAM,WAAW,IAAI;AAAA,EACrB,YAAY,KAAK,UAAU,QAAQ,WAAW;AAAA,IAC5C,SAAS,IACP,KACA,kBAAkB,KAAK,IACnB,WAAW,KAAK,OAAO,IAAI,IAC3B,4BAA4B,KAAK,IAC/B,cAAc,OAAO,IAAI,IACzB,KACR;AAAA,EACF;AAAA,EACA,OAAe,mBAAc,QAAQ;AAAA;;;AFpHhC,IAAM,UAAU,CAAC,KAAa,MAAmB,SAC/C,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,KAAK,IAAI,GAAG;AAAA,EAC7B,MAAM,QAAQ,UAAU;AAAA,EACxB,MAAM,QAAQ,OAAO;AAAA,EACrB,MAAM,OAAO,KAAK,UAAU;AAAA,EAC5B,IAAI,KAAK,WAAW,aAAa,OAAO,WAAW,UAAU,UAAU;AAAA,IAAW;AAAA,EAClF,MAAM,OAAO,UAAU,MAAM;AAAA,EAC7B,MAAM,UAAU,cAAc,MAAM,MAAM,IAAI;AAAA,EAC9C,IAAI,SAAS,aAAa,QAAQ,WAAW;AAAA,IAAG;AAAA,EAChD,IAAI,SAAS,aAAa,KAAK,UAAU;AAAA,IAAW;AAAA,EACpD,MAAM,OAAO;AAAA,OACP,MAAM;AAAA,OACP,OAAO,YAAY,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AAAA,EAC9D;AAAA,EAGA,MAAM,QAAQ,KAAK,KAAK,OAAO,KAAK,CAAiB;AAAA,EACrD,MAAM,SAAwB,OAAO,MAAM,KACzC,YAAY,KAAK,KAAK,MAAM,UAAU,GAC/B,YAAI,UAAU,GACd,mBAAW,MAAa,gBAAQ,QAAiB,CAAC,CAC3D;AAAA,EAEA,IAAI,aAAa,WAAW;AAAA,IAC1B,SAAS,OAAO;AAAA,IAChB,SAAS,UAAU;AAAA,EACrB;AAAA,CACD;;;AFRH,IAAM,gBAAgB,CAAC,KAAa,SAC3B,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,KAAK,UAAU;AAAA,EAC5B,IAAI,SAAS,aAAa,KAAK,UAAU;AAAA,IAAW;AAAA,EACpD,OAAO,KAAK;AAAA,IACV;AAAA,IACA,IAAI,KAAK,SAAS;AAAA,IAClB,YAAY,KAAK,MAAM;AAAA,IACvB,MAAM,KAAK,MAAM;AAAA,IACjB,QAAQ,KAAK,MAAM;AAAA,EACrB,CAAC,EAAE,KAAK,YAAY,KAAK,KAAK,MAAM,UAAU,CAAC;AAAA,CAChD;AAYH,IAAM,YAAY,CAChB,OACA,UAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,OAAO;AAAA,EAC5B,MAAM,QAAQ,OAAc,YAC1B,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,KAAK,UAC/B,MACG,IAAI,EAAE,KAAK,OAAO,MAAM,MAAM,OAAO,MAAM,MAAM,CAAC,EAClD,KACQ,YAAI,CAAC,QACV,QAAQ,aACR,cAAc,GAAG,KAChB,IAA0C,eAAe,KAAK,OAAO,aAClE,CAAC,IACD,CAAC,GAAG,CACV,CACF,CACJ,GACA,EAAE,aAAa,EAAE,CACnB;AAAA,EACA,OAAO,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,CAC5B;AAMI,IAAM,gBAAgB,CAC3B,SACA,UAAyB,CAAC,MACc;AAAA,EACxC,MAAM,OAAqB,IAAI;AAAA,EAC/B,MAAM,OAAM,QAAQ,QAAQ;AAAA,EAG5B,MAAM,OAAY,UAAK,QAAQ,KAAK;AAAA,EAIpC,OAAc,YAAI,UAAU,GAAG;AAAA,IAC7B,MAAM,UAAU,OAAO;AAAA,IACvB,MAAM,YAAY,OAAO,UAAU,QAAQ,OAAO,QAAQ,SAAS;AAAA,IAEnE,OAAc,YACZ,OAAO,QAAQ,QAAQ,SAAS,EAAE,IAAI,EAAE,KAAK,UAAU,QAAQ,KAAK,MAAM,IAAI,CAAC,GAC/E,EAAE,aAAa,EAAE,CACnB;AAAA,IACA,IAAI,MAAK;AAAA,MACP,MAAM,WAAW,OAAO,QAAQ,QAAQ,SAAS,EAAE,OAAO,EAAE,SAAS,UAAU,IAAI,GAAG,CAAC;AAAA,MACvF,OAAc,YACZ,SAAS,IAAI,EAAE,KAAK,UAClB,cAAc,KAAK,IAAI,EAAE,KAChB,mBAAW,MACT,aAAK,MAAM;AAAA,QAChB,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,CAAC;AAAA,QAChC,MAAM,OAAO,EAAE,QAAQ,UAAU,YAAY,UAAU;AAAA,QACvD,KAAK,IAAI,KAAK,KAAK;AAAA,OACpB,CACH,CACF,CACF,GACA,EAAE,aAAa,EAAE,CACnB;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,UAAU,OAAO,KAAK,QAAQ,SAAS,EAAE;AAAA,MACzC,MAAM,OAAO,SAAS,WAAW,MAAM,IAAG;AAAA,MAC1C,OAAO,QAAQ,MAAM;AAAA,MACrB,OAAO,QAAQ,MAAM;AAAA,IACvB;AAAA,GACD,EAAE,KAAY,gBAAQ,WAAW,QAAQ,SAAS,IAAI,CAAC,GAAU,cAAM;AAAA;AAoBnE,IAAM,cAAc,CACzB,QACA,UAAyB,CAAC,MAEnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,OAAiB,eAAK,QAAQ,EAAE,OAAO,KAAK,CAAC;AAAA,EAC7D,OAAO,OAAO,cAAc,SAAS,OAAO;AAAA,CAC7C,EAAE,KAAY,gBAAe,gBAAkB,gBAAM,CAAC,CAAC;;;AHnK1D,IAAM,UAAU,CAAC,SACR,aAAK,MAAM;AAAA,EAChB,QAAQ,WAAW;AAAA,CACpB;AAEH,IAAM,UAAiB,YAAI,UAAU,GAAG;AAAA,EACtC,MAAM,SAAS,gBAAgB,QAAQ,KAAK,MAAM,CAAC,GAAG,QAAQ,GAAG;AAAA,EACjE,IAAI,OAAO,SAAS;AAAA,IAAQ,OAAO,OAAe,YAAI,KAAK;AAAA,EAC3D,IAAI,OAAO,SAAS,SAAS;AAAA,IAC3B,OAAe,cAAM,oBAAoB,OAAO;AAAA;AAAA,EAAc,OAAO;AAAA,IACrE,OAAO,OAAO,QAAQ,CAAC;AAAA,EACzB;AAAA,EACA,MAAM,SAAS,OAAO,YAAY,OAAO,QAAQ,OAAO,OAAO;AAAA,EAC/D,OAAe,YACb,OAAO,OACH,KAAK,UAAU,QAAQ,MAAM,CAAC,IAC9B,aAAa,QAAQ,OAAO,QAAQ,QAAQ,IAAI,CACtD;AAAA,EACA,OAAO,QAAQ,WAAW,MAAM,CAAC;AAAA,CAClC,EAAE,KACM,mBAAW,CAAC,UACT,cAAM;AAAA,EAA0D,aAAO,KAAK,GAAG,EAAE,KAChF,gBAAQ,QAAQ,CAAC,CAAC,CAC3B,CACF,CACF;AAEA,QAAQ,OAAO;",
+  "debugId": "66D8EFB2DE677D6964756E2164756E21",
+  "names": []
+}

package/dist/verify/fake-engine.d.ts

@@ -0,0 +1,65 @@
+/**
+ * A test-only stack: Alchemy's real Plan and Apply over an in-memory state store, and a fake family
+ * whose "cloud" is a Map — so the verifier runs against the engine's own plans with no network.
+ *
+ * ★ THE ENGINE, NOT A HAND-BUILT PLAN. What the verifier claims is about alchemy beta.79: that an
+ *   adopted row's `diff` answer is lost to `forceUpdateAfterAdoption`, that Apply then reconciles
+ *   it, and that a watched plan never writes. openbao/fake-stack.ts measured the same engine for
+ *   the Bao families; this one is family-neutral and records every provider call in order.
+ * ⛔ TEST-ONLY. No provider imports this file.
+ */
+import * as Alchemy from 'alchemy';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import { type AdoptReport, type VerifyOptions } from './verify.ts';
+export interface ThingProps {
+    name: string;
+    comment?: string;
+}
+export interface ThingAttributes {
+    name: string;
+    comment: string;
+}
+export interface Thing extends Alchemy.Resource<'Test.Thing', ThingProps, ThingAttributes> {
+}
+export declare const Thing: Alchemy.ResourceClass<Thing>;
+/** The same object with no `diff`, like a provider that never wrote one. */
+export interface Blind extends Alchemy.Resource<'Test.Blind', ThingProps, ThingAttributes> {
+}
+export declare const Blind: Alchemy.ResourceClass<Blind>;
+/**
+ * The same object with a `diff` that compares the RECORDED props with the declaration and never
+ * the live object — the shape of Alchemy's own `Cloudflare.R2Bucket` diff (beta.79
+ * Cloudflare/R2/Bucket.ts: `olds.domains` against `news.domains`). recheck.ts exists for it.
+ */
+export interface Recorded extends Alchemy.Resource<'Test.Recorded', ThingProps, ThingAttributes> {
+}
+export declare const Recorded: Alchemy.ResourceClass<Recorded>;
+/** The fake cloud: what exists, what is someone else's, and every call made to it, in order. */
+export interface Cloud {
+    readonly live: Map<string, string>;
+    readonly unowned: Set<string>;
+    readonly calls: string[];
+}
+export declare const cloudOf: (live?: Record<string, string>) => Cloud;
+/** Every call that would change the cloud. */
+export declare const writesOf: (cloud: Cloud) => string[];
+/** Both fake families over `cloud` — also what tests/fixtures/verify-stack.ts registers. */
+export declare const thingProviders: (cloud: Cloud) => Layer.Layer<Alchemy.Provider<Blind> | Alchemy.Provider<Recorded> | Alchemy.Provider<Thing>, never, never>;
+/** A stack body: resource declarations, as an `alchemy.run.ts` would write them. */
+export type Body = Effect.Effect<unknown, unknown, unknown>;
+export interface FakeEngine {
+    /** Plan and apply `body`, as `alchemy deploy --adopt` would; resolves to the planned actions. */
+    readonly deploy: (body: Body) => Promise<Record<string, string>>;
+    /** Verify `body` against what the earlier deploys recorded. */
+    readonly verify: (body: Body, options?: VerifyOptions) => Promise<AdoptReport>;
+}
+/**
+ * One stack over one state store and any providers, shared by every call — a family's own test
+ * hands in its real provider over a fake transport (proxmox/ceph-pool-adopt.test.ts).
+ * ⚠️ THE CASTS ARE AT THE ENGINE'S TYPED BOUNDARY — openbao/fake-stack.ts has the reasoning.
+ */
+export declare const engineOver: <ROut, E, RIn>(layer: Layer.Layer<ROut, E, RIn>) => FakeEngine;
+/** The fake family over `cloud`. */
+export declare const fakeEngine: (cloud: Cloud) => FakeEngine;
+//# sourceMappingURL=fake-engine.d.ts.map

package/dist/verify/fake-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-engine.d.ts","sourceRoot":"","sources":["../../src/verify/fake-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAiB,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D,4EAA4E;AAC5E,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,QAAS,SAAQ,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AACnG,eAAO,MAAM,QAAQ,iCAA8C,CAAC;AAEpE,gGAAgG;AAChG,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAQ,KAI1D,CAAC;AAEH,8CAA8C;AAC9C,eAAO,MAAM,QAAQ,UAAW,KAAK,KAAG,MAAM,EAC2C,CAAC;AAyB1F,4FAA4F;AAC5F,eAAO,MAAM,cAAc,UAAW,KAAK,8GAmCxC,CAAC;AAEJ,oFAAoF;AACpF,MAAM,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAK5D,MAAM,WAAW,UAAU;IACzB,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CAChF;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAG,UAuC3E,CAAC;AAEF,oCAAoC;AACpC,eAAO,MAAM,UAAU,UAAW,KAAK,KAAG,UAA+C,CAAC"}

package/dist/verify/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `@homeflare/alchemy/verify` — prove a deploy's adoptions are no-ops before it runs.
+ *
+ * ★ ONE TOOL FOR EVERY STACK, NOT A TEST PER REPO. A stack runs `hf-adopt-verify --config
+ *   alchemy.run.ts --stage live` before a gated deploy, or calls `verifyStack` from its own
+ *   script; both plan with Alchemy's planner and never write. docs/adopt-verify.md has the why,
+ *   the report's columns, and what each kit family does on an adopted deploy.
+ * ⛔ A SUBPATH OF ITS OWN: it imports the stack module from disk and reads the state store, which
+ *   is host access, so it never rides along with the runtime-neutral root entry.
+ */
+export { type Parsed, USAGE, parseVerifyArgs } from './args.ts';
+export { exitCodeOf, formatReport } from './report.ts';
+export { type AdoptRow, type NodeView, type PlanView, type TaskView, changedFields, rowsOf, } from './rows.ts';
+export { type DiffAnswer, type Observations, type ReadAnswer, type RecheckAnswer, type Seen, WRITE_REFUSED, spyContext, } from './spy.ts';
+export { type AdoptReport, type VerifyOptions, type VerifySession, type VerifyTarget, verifySession, verifyStack, } from './verify.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/verify/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/verify/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,aAAa,EACb,MAAM,GACP,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,IAAI,EACT,aAAa,EACb,UAAU,GACX,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,aAAa,EACb,WAAW,GACZ,MAAM,aAAa,CAAC"}