paratix 0.10.0 → 0.12.2

package/dist/index.js

@@ -1,72 +1,75 @@
 import {
-  printCommandFailure,
-  printModuleResult,
-  printRecipeHeader,
-  printRecipeModuleResult,
-  runSignalModules,
-  startModuleSpinner,
-  withRecipeOutputScope
-} from "./chunk-47PTUZZR.js";
-import {
+  CommandError,
   NEEDS_APPLY,
   apt,
   archive,
+  assertValidModuleMetaEntries,
+  assertValidModuleMetaEntry,
   command,
   compose,
+  createNullPrototypeEnvironment,
   cron,
+  describeHostValidationFailure,
   detectPackageManager,
+  diffEnvironmentToMetaEntries,
   download,
+  environmentMeta,
+  environmentToMetaEntries,
   failed,
   failedCommand,
   file,
+  getRunnerAbortSignal,
   git,
   group,
   hostname,
+  inspectRedactedDiagnosticValue,
+  isBooleanEnvironmentMetaEntry,
+  isEnvironmentMetaEntry,
+  isLazyEnvironmentMetaEntry,
+  isNumberEnvironmentMetaEntry,
   isPackageInstalled,
+  isSshdPortMetaEntry,
+  isStringEnvironmentMetaEntry,
+  isSystemHostMetaEntry,
+  isSystemRebootMetaEntry,
+  maskRegisteredSecrets,
+  mergeEnvironmentFromMeta,
+  meta,
   mount,
   net,
   op,
   pkg,
   quadlet,
   releaseUpgrade,
+  resolveEnvironment,
   rsync,
+  sanitizeTerminalText,
   script,
   service,
+  shellQuote,
   ssh,
   sshd,
+  sshdPortMeta,
+  swap,
   sysctl,
   system,
-  systemd,
-  ufw,
-  user
-} from "./chunk-M7GETOJ5.js";
-import {
-  CommandError,
-  assertValidModuleMetaEntries,
-  assertValidModuleMetaEntry,
-  diffEnvironmentToMetaEntries,
-  environmentMeta,
-  environmentToMetaEntries,
-  isBooleanEnvironmentMetaEntry,
-  isEnvironmentMetaEntry,
-  isLazyEnvironmentMetaEntry,
-  isNumberEnvironmentMetaEntry,
-  isSshdPortMetaEntry,
-  isStringEnvironmentMetaEntry,
-  isSystemHostMetaEntry,
-  isSystemRebootMetaEntry,
-  mergeEnvironmentFromMeta,
-  meta,
-  shellQuote,
-  sshdPortMeta,
   systemHostMeta,
   systemRebootMeta,
+  systemd,
+  timer,
+  ufw,
+  user,
+  validateHostLabel,
   validateSshConfig
-} from "./chunk-NRDLYHJL.js";
+} from "./chunk-YOSHYUST.js";
 
 // src/conditionalModules.ts
 function createConditionalApplyState(environment) {
-  return { environment: { ...environment }, meta: [], status: "ok" };
+  return {
+    environment: Object.assign(createNullPrototypeEnvironment(), environment),
+    meta: [],
+    status: "ok"
+  };
 }
 function markConditionalApplyChanged(state) {
   return { ...state, status: "changed" };
@@ -74,7 +77,15 @@ function markConditionalApplyChanged(state) {
 async function executeConditionalApply(parameters) {
   const { dryRun, environment, module, ssh: ssh2 } = parameters;
   if (dryRun && module._applyDryRun != null) {
-    return module._applyDryRun(ssh2, environment);
+    return module._applyDryRun(ssh2, environment, {
+      shutdownSignal: parameters.shutdownSignal
+    });
+  }
+  if (module._supportsChildStepHook === true) {
+    return module.apply(ssh2, environment, {
+      onChildStep: parameters.onChildStep,
+      shutdownSignal: parameters.shutdownSignal
+    });
   }
   return module.apply(ssh2, environment);
 }
@@ -82,35 +93,61 @@ function shouldExecuteConditionalApply(module, dryRun) {
   if (!dryRun) return true;
   return module._applyDryRun != null || module._dryRunBlocker === true || module._dryRunMetaProducer === true;
 }
-async function mergeConditionalApplyState(state, result) {
+function getConditionalChildConnection(module, ssh2) {
+  return module.local === true ? null : ssh2;
+}
+async function mergeConditionalApplyState(preserveControlPlaneMeta, state, result) {
   const environment = await mergeEnvironmentFromMeta(state.environment, result.meta);
+  const resultMeta = result.meta == null || preserveControlPlaneMeta ? result.meta : result.meta.filter(isEnvironmentMetaEntry);
   return {
     environment,
     flushSignals: result._flushSignals === true ? true : state.flushSignals,
-    meta: result.meta == null ? state.meta : [...state.meta, ...result.meta],
+    meta: resultMeta == null ? state.meta : [...state.meta, ...resultMeta],
     status: result.status === "changed" ? "changed" : state.status,
     stopRun: result._stopRun === true ? true : state.stopRun
   };
 }
+async function notifyConditionalChildStep(parameters) {
+  if (parameters.onChildStep == null) return;
+  await parameters.onChildStep({
+    _flushSignals: parameters.result._flushSignals,
+    _stopRun: parameters.result._stopRun,
+    env: parameters.environment,
+    meta: parameters.result.meta,
+    status: parameters.result.status
+  });
+}
+async function processConditionalApplyResult(parameters) {
+  const state = await mergeConditionalApplyState(
+    parameters.preserveControlPlaneMeta,
+    parameters.state,
+    parameters.result
+  );
+  await notifyConditionalChildStep({
+    environment: state.environment,
+    onChildStep: parameters.onChildStep,
+    result: parameters.result
+  });
+  return state;
+}
 async function applyConditionalModules(parameters) {
   const { dryRun = false, modules, ssh: ssh2 } = parameters;
+  const preserveControlPlaneMeta = parameters.onChildStep == null;
+  const shutdownSignal = parameters.shutdownSignal ?? (() => null);
   let state = createConditionalApplyState(parameters.environment);
   for (const currentModule of modules) {
-    const checkResult = await currentModule.check(ssh2, state.environment);
-    if (checkResult === "ok") continue;
-    if (!shouldExecuteConditionalApply(currentModule, dryRun)) {
-      state = markConditionalApplyChanged(state);
-      continue;
-    }
-    const result = await executeConditionalApply({
+    const step = await applyConditionalModuleStep({
+      currentModule,
       dryRun,
-      environment: state.environment,
-      module: currentModule,
-      ssh: ssh2
+      onChildStep: parameters.onChildStep,
+      preserveControlPlaneMeta,
+      shutdownSignal,
+      ssh: ssh2,
+      state
     });
-    if (result.status === "failed") return result;
-    state = await mergeConditionalApplyState(state, result);
-    if (state.stopRun === true) break;
+    if (step.kind === "failed") return step.result;
+    state = step.state;
+    if (step.kind === "break") break;
   }
   return {
     _flushSignals: state.flushSignals,
@@ -119,6 +156,34 @@ async function applyConditionalModules(parameters) {
     status: state.status
   };
 }
+async function applyConditionalModuleStep(parameters) {
+  if (parameters.shutdownSignal() != null) {
+    return { kind: "break", state: parameters.state };
+  }
+  const connection = getConditionalChildConnection(parameters.currentModule, parameters.ssh);
+  const checkResult = await parameters.currentModule.check(connection, parameters.state.environment);
+  if (checkResult === "ok") return { kind: "continue", state: parameters.state };
+  if (parameters.shutdownSignal() != null) return { kind: "break", state: parameters.state };
+  if (!shouldExecuteConditionalApply(parameters.currentModule, parameters.dryRun)) {
+    return { kind: "continue", state: markConditionalApplyChanged(parameters.state) };
+  }
+  const result = await executeConditionalApply({
+    dryRun: parameters.dryRun,
+    environment: parameters.state.environment,
+    module: parameters.currentModule,
+    onChildStep: parameters.onChildStep,
+    shutdownSignal: parameters.shutdownSignal,
+    ssh: connection
+  });
+  if (result.status === "failed") return { kind: "failed", result };
+  const state = await processConditionalApplyResult({
+    onChildStep: parameters.onChildStep,
+    preserveControlPlaneMeta: parameters.preserveControlPlaneMeta,
+    result,
+    state: parameters.state
+  });
+  return { kind: state.stopRun === true ? "break" : "continue", state };
+}
 function shouldExecuteConditionalDryRun(module) {
   return module._applyDryRun != null || module._dryRunBlocker === true || module._dryRunMetaProducer === true;
 }
@@ -126,9 +191,10 @@ function whenNeedsDryRunApply(modules) {
   return modules.some((module) => shouldExecuteConditionalDryRun(module));
 }
 async function checkConditionalModules(modules, ssh2, environment) {
-  const currentEnvironment = { ...environment };
+  const currentEnvironment = Object.assign(createNullPrototypeEnvironment(), environment);
   for (const currentModule of modules) {
-    const result = await currentModule.check(ssh2, currentEnvironment);
+    const connection = getConditionalChildConnection(currentModule, ssh2);
+    const result = await currentModule.check(connection, currentEnvironment);
     if (result === NEEDS_APPLY) {
       return NEEDS_APPLY;
     }
@@ -137,11 +203,17 @@ async function checkConditionalModules(modules, ssh2, environment) {
 }
 function createWhenDryRunApply(condition, modules, needsDryRunApply) {
   if (!needsDryRunApply) return void 0;
-  return async (ssh2, environment) => {
+  return async (ssh2, environment, options) => {
     if (!await condition(ssh2, environment)) {
       return { status: "skipped" };
     }
-    return applyConditionalModules({ dryRun: true, environment, modules, ssh: ssh2 });
+    return applyConditionalModules({
+      dryRun: true,
+      environment,
+      modules,
+      shutdownSignal: options?.shutdownSignal,
+      ssh: ssh2
+    });
   };
 }
 function createConditionalModule(parameters) {
@@ -152,14 +224,21 @@ function createConditionalModule(parameters) {
     needsDryRunApply
   );
   return {
+    _supportsChildStepHook: true,
     ...parameters.modules.some((module) => module._dryRunBlocker === true) ? { _dryRunBlocker: true } : {},
     ...parameters.modules.some((module) => module._dryRunMetaProducer === true) ? { _dryRunMetaProducer: true } : {},
     ...applyDryRun == null ? {} : { _applyDryRun: applyDryRun },
-    async apply(ssh2, environment) {
+    async apply(ssh2, environment, options) {
       if (!await parameters.condition(ssh2, environment)) {
         return { status: "skipped" };
       }
-      return applyConditionalModules({ environment, modules: parameters.modules, ssh: ssh2 });
+      return applyConditionalModules({
+        environment,
+        modules: parameters.modules,
+        onChildStep: options?.onChildStep,
+        shutdownSignal: options?.shutdownSignal,
+        ssh: ssh2
+      });
     },
     async check(ssh2, environment) {
       if (!await parameters.condition(ssh2, environment)) {
@@ -170,6 +249,8 @@ function createConditionalModule(parameters) {
     name: parameters.name
   };
 }
+
+// src/conditionalGuards.ts
 function filesystemTypeName(testFlag) {
   switch (testFlag) {
     case "-d": {
@@ -189,7 +270,7 @@ function filesystemTypeName(testFlag) {
 function createFilesystemGuard(parameters) {
   const typeName = filesystemTypeName(parameters.testFlag);
   return createConditionalModule({
-    condition: async (ssh2) => {
+    async condition(ssh2) {
       if (ssh2 == null) return false;
       const exists = await ssh2.test(`test ${parameters.testFlag} ${shellQuote(parameters.path)}`);
       return parameters.invert ? !exists : exists;
@@ -200,7 +281,7 @@ function createFilesystemGuard(parameters) {
 }
 function createCommandGuard(commandName, invert, modules) {
   return createConditionalModule({
-    condition: async (ssh2) => {
+    async condition(ssh2) {
       if (ssh2 == null) return false;
       const exists = await ssh2.test(`command -v ${shellQuote(commandName)} >/dev/null 2>&1`);
       return invert ? !exists : exists;
@@ -211,7 +292,7 @@ function createCommandGuard(commandName, invert, modules) {
 }
 function createPackageGuard(packageName, invert, modules) {
   return createConditionalModule({
-    condition: async (ssh2) => {
+    async condition(ssh2) {
       if (ssh2 == null) return false;
       const pm = await detectPackageManager(ssh2);
       if (pm == null) return false;
@@ -269,17 +350,70 @@ function fail(message) {
     name: `fail: ${message}`
   };
 }
+function normalizePauseAbortReason(reason) {
+  if (reason instanceof Error) return reason;
+  if (reason === void 0 || reason === null) return new Error("pause aborted");
+  if (typeof reason === "string") return new Error(reason);
+  return new Error("pause aborted");
+}
+async function waitForEnterOrAbort(abortSignal) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const onData = (chunk) => {
+      const input = Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk);
+      if (!input.includes("\n") && !input.includes("\r")) return;
+      if (settled) return;
+      settled = true;
+      cleanup();
+      process.stdin.pause();
+      resolve();
+    };
+    const onAbort = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      process.stdin.pause();
+      reject(normalizePauseAbortReason(abortSignal?.reason));
+    };
+    const onClosed = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      process.stdin.pause();
+      reject(new Error("pause input closed before Enter"));
+    };
+    const onError = (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      process.stdin.pause();
+      reject(error instanceof Error ? error : new Error("pause input error"));
+    };
+    function cleanup() {
+      process.stdin.removeListener("data", onData);
+      process.stdin.removeListener("end", onClosed);
+      process.stdin.removeListener("close", onClosed);
+      process.stdin.removeListener("error", onError);
+      abortSignal?.removeEventListener("abort", onAbort);
+    }
+    if (abortSignal?.aborted === true) {
+      onAbort();
+      return;
+    }
+    process.stdin.on("end", onClosed);
+    process.stdin.on("close", onClosed);
+    process.stdin.on("error", onError);
+    process.stdin.on("data", onData);
+    process.stdin.resume();
+    abortSignal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
 function pause(message) {
   return {
     async apply() {
       const promptText = message ?? "Press enter to continue...";
       process.stdout.write(`  [pause] ${promptText} `);
-      await new Promise((resolve) => {
-        process.stdin.once("data", () => {
-          process.stdin.pause();
-          resolve();
-        });
-      });
+      await waitForEnterOrAbort(getRunnerAbortSignal());
       return { status: "ok" };
     },
     // eslint-disable-next-line @typescript-eslint/require-await -- Interface requires async
@@ -377,6 +511,656 @@ var when = Object.assign(baseWhen, {
   symlinkMissing: (path, ...modules) => createFilesystemGuard({ invert: true, modules, path, testFlag: "-L" })
 });
 
+// src/firstRunContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var firstRunContext = new AsyncLocalStorage();
+function isFirstRun() {
+  return firstRunContext.getStore() === true;
+}
+
+// src/dryRunDispatch.ts
+function shouldExecuteApplyDuringDryRun(module, diffEnabled) {
+  if (module._dryRunBlocker === true || module._dryRunMetaProducer === true) return true;
+  if (diffEnabled && module._dryRunDiffProducer === true && module._applyDryRun != null) return true;
+  return module._applyDryRun != null && module._dryRunDiffProducer !== true;
+}
+
+// src/output.ts
+import pc from "picocolors";
+
+// src/outputFormatting.ts
+import { stripVTControlCharacters } from "util";
+var PACKAGE_MODULE_SUFFIX_LENGTH = 2;
+var PACKAGE_COLUMN_GAP_WIDTH = 2;
+var DEFAULT_TERMINAL_COLUMNS = 100;
+var MIN_PACKAGE_COLUMNS_WIDTH = 24;
+var MIN_PACKAGE_COLUMN_WIDTH = 18;
+var MIN_ANIMATED_LINE_COLUMNS = 8;
+function splitPackageModuleName(name) {
+  for (const prefix of ["package.installed: ", "package.absent: "]) {
+    if (!name.startsWith(prefix)) continue;
+    const packages = name.slice(prefix.length).split(",").map((entry) => entry.trim()).filter(Boolean);
+    if (packages.length === 0) return null;
+    return {
+      packages,
+      summaryName: prefix.slice(0, -PACKAGE_MODULE_SUFFIX_LENGTH)
+    };
+  }
+  return null;
+}
+function getPackageColumns(parameters) {
+  if (parameters.packages.length <= 1) return parameters.packages;
+  const availableWidth = Math.max(
+    (parameters.terminalColumns ?? DEFAULT_TERMINAL_COLUMNS) - parameters.continuationIndentWidth,
+    MIN_PACKAGE_COLUMNS_WIDTH
+  );
+  const widestPackage = Math.max(...parameters.packages.map((entry) => entry.length));
+  const columnWidth = Math.max(widestPackage + PACKAGE_COLUMN_GAP_WIDTH, MIN_PACKAGE_COLUMN_WIDTH);
+  const columnCount = Math.max(Math.floor(availableWidth / columnWidth), 1);
+  const rowCount = Math.ceil(parameters.packages.length / columnCount);
+  return Array.from(
+    { length: rowCount },
+    (_row, rowIndex) => Array.from({ length: columnCount }, (_column, columnIndex) => {
+      const packageIndex = rowIndex + columnIndex * rowCount;
+      const packageName = parameters.packages.at(packageIndex);
+      if (packageName == null) return "";
+      const isLastVisibleColumn = columnIndex === columnCount - 1 || packageIndex + rowCount >= parameters.packages.length;
+      return isLastVisibleColumn ? packageName : packageName.padEnd(columnWidth);
+    }).filter(Boolean).join("")
+  );
+}
+function getPackageSummaryDetail(packageCount, detail) {
+  const packageLabel = packageCount === 1 ? "1 package" : `${packageCount} packages`;
+  return detail == null ? packageLabel : `${packageLabel} \xB7 ${detail}`;
+}
+function fitAnimatedModuleLine(line, columns) {
+  if (columns === void 0 || columns < MIN_ANIMATED_LINE_COLUMNS) return line;
+  const plainLine = stripVTControlCharacters(line);
+  if (plainLine.length < columns) return line;
+  return `${plainLine.slice(0, columns - 1)}\u2026`;
+}
+function formatDisplayModule(parameters) {
+  const packageModule = splitPackageModuleName(parameters.name);
+  if (packageModule == null) {
+    return {
+      detail: parameters.detail,
+      detailLines: [],
+      name: parameters.name
+    };
+  }
+  return {
+    detail: getPackageSummaryDetail(packageModule.packages.length, parameters.detail),
+    detailLines: parameters.status === "waiting" ? [] : getPackageColumns({
+      continuationIndentWidth: parameters.continuationIndentWidth,
+      packages: packageModule.packages,
+      terminalColumns: parameters.terminalColumns
+    }),
+    name: packageModule.summaryName
+  };
+}
+
+// src/output.ts
+var CAUSE_INSPECT_DEPTH = 2;
+var CAUSE_INSPECT_MAX_STRING_LENGTH = 1024;
+var CAUSE_REDACT_BINARY_MAX_DEPTH = CAUSE_INSPECT_DEPTH + 1;
+var MODULE_NAME_WIDTH = 56;
+var MIN_MODULE_NAME_WIDTH = 12;
+var OUTPUT_INDENT_UNIT = "  ";
+var SPINNER_FRAME_INTERVAL_MS = 80;
+var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var STATUS_ICONS = {
+  changed: pc.yellow("\u21BA"),
+  failed: pc.red("\u2717"),
+  ok: pc.green("\u2713"),
+  skipped: pc.dim("\u2298"),
+  waiting: pc.cyan("\u23F8")
+};
+var activeSpinner = null;
+var activeRecipeGuideDepths = [];
+var pendingRecipeClosureGuideDepths = [];
+var recipeOutputDepth = -1;
+function supportsAnimatedModuleOutput() {
+  return process.stdout.isTTY && typeof process.stdout.clearLine === "function" && typeof process.stdout.cursorTo === "function";
+}
+function getModuleIcon(status, waitingFrame) {
+  return status === "waiting" ? pc.cyan(waitingFrame ?? "|") : STATUS_ICONS[status];
+}
+function getModuleStatusText(status) {
+  switch (status) {
+    case "changed": {
+      return pc.yellow(status);
+    }
+    case "failed": {
+      return pc.red(status);
+    }
+    case "ok": {
+      return pc.green(status);
+    }
+    case "skipped": {
+      return pc.dim(status);
+    }
+    case "waiting": {
+      return pc.cyan("running");
+    }
+  }
+}
+function getCurrentOutputDepth() {
+  return Math.max(recipeOutputDepth, 0);
+}
+function getGuideDot(depth) {
+  return depth % 2 === 0 ? pc.gray("\xB7") : pc.cyan("\xB7");
+}
+function buildGuideIndent(baseIndent, options) {
+  const indentCharacters = Array.from(baseIndent);
+  const guideDepths = [
+    ...options?.activeGuideDepths ?? activeRecipeGuideDepths,
+    ...options?.extraGuideDepths ?? []
+  ];
+  for (const guideDepth of guideDepths) {
+    const guideCharacterIndex = OUTPUT_INDENT_UNIT.length * (guideDepth + 1);
+    if (guideCharacterIndex >= indentCharacters.length) continue;
+    indentCharacters[guideCharacterIndex] = options?.colorize === false ? "\xB7" : getGuideDot(guideDepth);
+  }
+  return indentCharacters.join("");
+}
+function clearPendingRecipeClosureGuides() {
+  pendingRecipeClosureGuideDepths = [];
+}
+function getModuleIndent() {
+  if (recipeOutputDepth < 0) {
+    return OUTPUT_INDENT_UNIT;
+  }
+  return OUTPUT_INDENT_UNIT.repeat(getCurrentOutputDepth() + 2);
+}
+function getRecipeHeaderIndent() {
+  if (recipeOutputDepth < 0) return "";
+  return OUTPUT_INDENT_UNIT.repeat(getCurrentOutputDepth() + 1);
+}
+function getErrorIndent() {
+  return `${getModuleIndent()}\u2502 `;
+}
+function getContinuationIndent() {
+  return `${getModuleIndent()}   `;
+}
+async function withRecipeOutputScope(scopedOperation) {
+  recipeOutputDepth += 1;
+  try {
+    return await scopedOperation();
+  } finally {
+    activeRecipeGuideDepths = activeRecipeGuideDepths.filter((depth) => depth !== recipeOutputDepth);
+    pendingRecipeClosureGuideDepths = [recipeOutputDepth];
+    recipeOutputDepth -= 1;
+  }
+}
+function renderModuleLine(parameters) {
+  const { detail, extraGuideDepths = [], name, status, waitingFrame } = parameters;
+  const baseIndent = getModuleIndent();
+  const indent = buildGuideIndent(baseIndent, { extraGuideDepths });
+  const icon = getModuleIcon(status, waitingFrame);
+  const statusText = getModuleStatusText(status);
+  const detailSuffix = detail == null ? "" : `  ${pc.dim(detail)}`;
+  const alignedNameWidth = Math.max(MODULE_NAME_WIDTH - baseIndent.length, MIN_MODULE_NAME_WIDTH);
+  return `${indent}${icon}  ${name.padEnd(alignedNameWidth)}  ${statusText}${detailSuffix}`;
+}
+function writeAnimatedModuleLine(line) {
+  process.stdout.clearLine(0);
+  process.stdout.cursorTo(0);
+  process.stdout.write(fitAnimatedModuleLine(line, process.stdout.columns));
+}
+function stopAnimatedModuleLine(clearCurrentLine = false) {
+  if (activeSpinner == null) return;
+  clearInterval(activeSpinner.interval);
+  activeSpinner = null;
+  if (clearCurrentLine && supportsAnimatedModuleOutput()) {
+    process.stdout.clearLine(0);
+    process.stdout.cursorTo(0);
+  }
+}
+function startModuleSpinner(name, detail) {
+  if (!supportsAnimatedModuleOutput()) return;
+  clearPendingRecipeClosureGuides();
+  stopAnimatedModuleLine();
+  const maskedName = maskRegisteredSecrets(name);
+  const maskedDetail = detail == null ? void 0 : maskRegisteredSecrets(detail);
+  const displayModule = formatDisplayModule({
+    continuationIndentWidth: getContinuationIndent().length,
+    detail: maskedDetail,
+    name: maskedName,
+    status: "waiting",
+    terminalColumns: process.stdout.columns
+  });
+  const spinner = {
+    detail: displayModule.detail,
+    frameIndex: 0,
+    interval: setInterval(() => {
+      spinner.frameIndex = (spinner.frameIndex + 1) % SPINNER_FRAMES.length;
+      writeAnimatedModuleLine(
+        renderModuleLine({
+          detail: spinner.detail,
+          name: displayModule.name,
+          status: "waiting",
+          waitingFrame: SPINNER_FRAMES[spinner.frameIndex]
+        })
+      );
+    }, SPINNER_FRAME_INTERVAL_MS)
+  };
+  if (typeof spinner.interval.unref === "function") spinner.interval.unref();
+  activeSpinner = spinner;
+  writeAnimatedModuleLine(
+    renderModuleLine({
+      detail: displayModule.detail,
+      name: displayModule.name,
+      status: "waiting",
+      waitingFrame: SPINNER_FRAMES[0]
+    })
+  );
+}
+function printRecipeHeader(name) {
+  stopAnimatedModuleLine(true);
+  clearPendingRecipeClosureGuides();
+  const header = pc.bold(pc.blue(`[${name}]`));
+  console.log(`${buildGuideIndent(getRecipeHeaderIndent())}${header}`);
+  if (recipeOutputDepth >= 0) {
+    activeRecipeGuideDepths = [...activeRecipeGuideDepths, recipeOutputDepth];
+  }
+}
+function colorizeDiffLine(line) {
+  if (line.startsWith("---") || line.startsWith("+++") || line.startsWith("@@")) {
+    return pc.dim(line);
+  }
+  if (line.startsWith("-")) return pc.red(line);
+  if (line.startsWith("+")) return pc.green(line);
+  return pc.dim(line);
+}
+function renderDiffLines(diff) {
+  if (diff.trim() === "") return [];
+  const sanitized = sanitizeTerminalText(maskRegisteredSecrets(diff));
+  return sanitized.split("\n").map((line) => `\u2502 ${colorizeDiffLine(line)}`);
+}
+function writeContinuationLine(line, extraGuideDepths, via) {
+  const composed = `${buildGuideIndent(getContinuationIndent(), { extraGuideDepths })}${line}`;
+  if (via === "stdout") {
+    process.stdout.write(`${composed}
+`);
+  } else {
+    console.log(composed);
+  }
+}
+function writeContinuationBlock(parameters) {
+  for (const detailLine of parameters.detailLines) {
+    writeContinuationLine(pc.dim(detailLine), parameters.extraGuideDepths, parameters.via);
+  }
+  for (const diffLine of parameters.diffLines) {
+    writeContinuationLine(diffLine, parameters.extraGuideDepths, parameters.via);
+  }
+}
+function printRenderedModuleResult(parameters) {
+  const extraGuideDepths = parameters.extraGuideDepths ?? [];
+  const maskedName = maskRegisteredSecrets(parameters.name);
+  const maskedDetail = parameters.detail == null ? void 0 : maskRegisteredSecrets(parameters.detail);
+  const displayModule = formatDisplayModule({
+    continuationIndentWidth: `${buildGuideIndent(
+      OUTPUT_INDENT_UNIT.repeat(Math.max(getCurrentOutputDepth() + 2, 1)),
+      { extraGuideDepths }
+    )}   `.length,
+    detail: maskedDetail,
+    name: maskedName,
+    status: parameters.status,
+    terminalColumns: process.stdout.columns
+  });
+  const line = renderModuleLine({
+    detail: displayModule.detail,
+    extraGuideDepths,
+    name: displayModule.name,
+    status: parameters.status
+  });
+  const diffLines = parameters.diff == null ? [] : renderDiffLines(parameters.diff);
+  const usesSpinner = supportsAnimatedModuleOutput() && activeSpinner != null;
+  if (usesSpinner) {
+    stopAnimatedModuleLine();
+    writeAnimatedModuleLine(line);
+    process.stdout.write("\n");
+  } else {
+    console.log(line);
+  }
+  writeContinuationBlock({
+    detailLines: displayModule.detailLines,
+    diffLines,
+    extraGuideDepths,
+    via: usesSpinner ? "stdout" : "console"
+  });
+}
+function printModuleResult(name, status, detail, diff) {
+  clearPendingRecipeClosureGuides();
+  printRenderedModuleResult({ detail, diff, name, status });
+}
+function printRecipeModuleResult(name, status, detail, diff) {
+  printRenderedModuleResult({
+    detail,
+    diff,
+    extraGuideDepths: pendingRecipeClosureGuideDepths,
+    name,
+    status
+  });
+  clearPendingRecipeClosureGuides();
+}
+function printCommandError(stdout, stderr) {
+  const maskedStdout = sanitizeTerminalText(maskRegisteredSecrets(stdout));
+  const maskedStderr = sanitizeTerminalText(maskRegisteredSecrets(stderr));
+  const lines = [];
+  if (maskedStderr.trim()) {
+    lines.push(...maskedStderr.trim().split("\n"));
+  }
+  if (maskedStdout.trim()) {
+    lines.push(...maskedStdout.trim().split("\n"));
+  }
+  if (lines.length > 0) {
+    console.error(pc.red(`${getErrorIndent()}Error output:`));
+    for (const line of lines) {
+      console.error(pc.red(`${getErrorIndent()}${line}`));
+    }
+  }
+}
+function printVerboseCommandError(stdout, stderr) {
+  const maskedStdout = sanitizeTerminalText(maskRegisteredSecrets(stdout));
+  const maskedStderr = sanitizeTerminalText(maskRegisteredSecrets(stderr));
+  if (maskedStderr.trim()) {
+    console.error(pc.red(`${getErrorIndent()}Full stderr:`));
+    for (const line of maskedStderr.trim().split("\n")) {
+      console.error(pc.red(`${getErrorIndent()}${line}`));
+    }
+  }
+  if (maskedStdout.trim()) {
+    console.error(pc.red(`${getErrorIndent()}Full stdout:`));
+    for (const line of maskedStdout.trim().split("\n")) {
+      console.error(pc.red(`${getErrorIndent()}${line}`));
+    }
+  }
+}
+function printVerboseErrorBlock(label, content) {
+  if (!content.trim()) {
+    return;
+  }
+  console.error(pc.red(`${getErrorIndent()}${label}`));
+  for (const line of content.trim().split("\n")) {
+    console.error(pc.red(`${getErrorIndent()}${line}`));
+  }
+}
+function getErrorCause(error) {
+  return error.cause;
+}
+function printVerboseErrorCause(cause, depth, visitedCauses) {
+  const label = `Cause ${depth}:`;
+  if (cause instanceof Error) {
+    if (visitedCauses.has(cause)) {
+      printVerboseErrorBlock(label, "<cycle detected>");
+      return;
+    }
+    visitedCauses.add(cause);
+    const stack = cause.stack?.trim() ?? "";
+    const stackOrMessage = stack.length > 0 ? stack : String(cause);
+    printVerboseErrorBlock(label, maskRegisteredSecrets(stackOrMessage));
+    const nestedCause = getErrorCause(cause);
+    if (nestedCause !== void 0) {
+      printVerboseErrorCause(nestedCause, depth + 1, visitedCauses);
+    }
+    return;
+  }
+  printVerboseErrorBlock(label, maskRegisteredSecrets(formatCauseValue(cause)));
+}
+function printVerboseGenericError(error) {
+  const stack = error.stack?.trim() ?? "";
+  const stackOrMessage = stack.length > 0 ? stack : String(error);
+  printVerboseErrorBlock("Full stack:", maskRegisteredSecrets(stackOrMessage));
+  const cause = getErrorCause(error);
+  if (cause !== void 0) {
+    const visitedCauses = /* @__PURE__ */ new WeakSet();
+    visitedCauses.add(error);
+    printVerboseErrorCause(cause, 1, visitedCauses);
+  }
+}
+function formatCauseValue(cause) {
+  if (cause instanceof Error) return cause.message;
+  return inspectRedactedDiagnosticValue(cause, {
+    depth: CAUSE_INSPECT_DEPTH,
+    maxStringLength: CAUSE_INSPECT_MAX_STRING_LENGTH,
+    redactMaxDepth: CAUSE_REDACT_BINARY_MAX_DEPTH
+  });
+}
+function printCauseChain(error) {
+  const visited = /* @__PURE__ */ new WeakSet();
+  visited.add(error);
+  let cause = getErrorCause(error);
+  while (cause !== void 0) {
+    if (cause instanceof Error) {
+      if (visited.has(cause)) return;
+      visited.add(cause);
+    }
+    console.error(pc.red(`${getErrorIndent()}Cause: ${maskRegisteredSecrets(formatCauseValue(cause))}`));
+    if (cause instanceof CommandError) {
+      printVerboseCommandError(
+        maskRegisteredSecrets(cause.fullStdout),
+        maskRegisteredSecrets(cause.fullStderr)
+      );
+    }
+    cause = cause instanceof Error ? getErrorCause(cause) : void 0;
+  }
+}
+function printCommandFailure(error, verbose) {
+  if (verbose && error instanceof CommandError) {
+    const summaryLine = error.message.split("\n")[0];
+    printCommandError("", maskRegisteredSecrets(summaryLine));
+    printVerboseCommandError(
+      maskRegisteredSecrets(error.fullStdout),
+      maskRegisteredSecrets(error.fullStderr)
+    );
+    return;
+  }
+  printCommandError("", maskRegisteredSecrets(String(error)));
+  if (error instanceof Error) {
+    if (!(error instanceof CommandError)) {
+      printCauseChain(error);
+    }
+    if (verbose) {
+      printVerboseGenericError(error);
+    }
+  }
+}
+
+// src/dryRunRecipe.ts
+function interruptedDryRunResult(parameters) {
+  return {
+    env: parameters.currentEnvironment,
+    meta: parameters.aggregatedMeta.length === 0 ? void 0 : parameters.aggregatedMeta,
+    shouldBreak: true,
+    status: parameters.aggregatedStatus === "changed" ? "changed" : void 0
+  };
+}
+async function executeDryRunBlockingModule(parameters) {
+  const { childModule, connection, diff, environment, verbose } = parameters;
+  if (parameters.shutdownSignal() != null) return { env: environment, shouldBreak: true };
+  startModuleSpinner(childModule.name);
+  const result = childModule._applyDryRun == null ? await childModule.apply(connection, environment) : await childModule._applyDryRun(connection, environment, {
+    shutdownSignal: parameters.shutdownSignal
+  });
+  const nextEnvironment = result.meta == null ? environment : await mergeEnvironmentFromMeta(environment, result.meta);
+  const diffOutput = diff ? result.diff : void 0;
+  printModuleResult(
+    childModule.name,
+    result.status,
+    result._dryRunDetail ?? "(dry-run)",
+    diffOutput
+  );
+  if (result.status === "failed" && result.error != null) {
+    printCommandFailure(result.error, verbose);
+  }
+  return {
+    env: nextEnvironment,
+    meta: result.meta,
+    shouldBreak: result.status === "failed" || result._stopRun === true,
+    status: result.status,
+    stopRun: result._stopRun
+  };
+}
+async function executeDryRunChildModule(parameters) {
+  const { childModule, diff, environment, ssh: ssh2, verbose } = parameters;
+  if (parameters.shutdownSignal() != null) return { env: environment, shouldBreak: true };
+  const connection = childModule.local === true ? null : ssh2;
+  startModuleSpinner(childModule.name);
+  const checkResult = await childModule.check(connection, environment);
+  if (parameters.shutdownSignal() != null) return { env: environment, shouldBreak: true };
+  if (checkResult !== "ok" && shouldExecuteApplyDuringDryRun(childModule, diff)) {
+    return executeDryRunBlockingModule({
+      childModule,
+      connection,
+      diff,
+      environment,
+      shutdownSignal: parameters.shutdownSignal,
+      verbose
+    });
+  }
+  const status = checkResult === "ok" ? "ok" : "changed";
+  const suffix = checkResult === "ok" ? void 0 : "(dry-run)";
+  printModuleResult(childModule.name, status, suffix);
+  return { env: environment, shouldBreak: false, status };
+}
+function applyDryRunChildResult(accumulator, result) {
+  return {
+    aggregatedMeta: result.meta == null ? accumulator.aggregatedMeta : [...accumulator.aggregatedMeta, ...result.meta],
+    aggregatedStatus: result.status === "changed" ? "changed" : accumulator.aggregatedStatus,
+    currentEnvironment: result.env
+  };
+}
+async function runDryRunChildLoop(parameters) {
+  let accumulator = parameters.accumulator;
+  for (const childModule of parameters.recipeModule._modules) {
+    if (parameters.shutdownSignal() != null) {
+      return interruptedDryRunResult({
+        aggregatedMeta: accumulator.aggregatedMeta,
+        aggregatedStatus: accumulator.aggregatedStatus,
+        currentEnvironment: accumulator.currentEnvironment
+      });
+    }
+    const result = await executeDryRunChildModule({
+      childModule,
+      diff: parameters.diff,
+      environment: accumulator.currentEnvironment,
+      shutdownSignal: parameters.shutdownSignal,
+      ssh: parameters.ssh,
+      verbose: parameters.verbose
+    });
+    if (result.shouldBreak) return result;
+    accumulator = applyDryRunChildResult(accumulator, result);
+  }
+  return accumulator;
+}
+async function dryRunRecipeModule(parameters) {
+  return withRecipeOutputScope(async () => {
+    const { environment, recipeModule, ssh: ssh2 } = parameters;
+    printRecipeHeader(recipeModule.name);
+    const shutdownSignal = parameters.shutdownSignal ?? (() => null);
+    const loopResult = await runDryRunChildLoop({
+      accumulator: {
+        aggregatedMeta: [],
+        aggregatedStatus: "ok",
+        currentEnvironment: environment
+      },
+      diff: parameters.options?.diff ?? false,
+      recipeModule,
+      shutdownSignal,
+      ssh: ssh2,
+      verbose: parameters.options?.verbose ?? false
+    });
+    if ("shouldBreak" in loopResult) return loopResult;
+    return {
+      env: loopResult.currentEnvironment,
+      meta: loopResult.aggregatedMeta.length === 0 ? void 0 : loopResult.aggregatedMeta,
+      shouldBreak: false,
+      status: loopResult.aggregatedStatus
+    };
+  });
+}
+
+// src/signalOrchestration.ts
+function handleSignalResult(parameters) {
+  const { hooks, result, signalName, verbose } = parameters;
+  printModuleResult(`signal: ${signalName}`, result.status);
+  if (result.status === "failed" && result.error != null) {
+    printCommandFailure(result.error, verbose);
+  }
+  hooks?.onSignalFinished?.(result.status);
+  return result.status === "failed" ? "failed" : "changed";
+}
+function handleSignalFailure(parameters) {
+  const { error, hooks, signalName, verbose } = parameters;
+  printModuleResult(`signal: ${signalName}`, "failed");
+  printCommandFailure(error, verbose);
+  hooks?.onSignalFinished?.("failed");
+  return "failed";
+}
+async function applySignalMeta(parameters) {
+  assertValidModuleMetaEntries(parameters.result.meta);
+  const nextEnvironment = parameters.result.status === "failed" ? parameters.currentEnvironment : await mergeEnvironmentFromMeta(parameters.currentEnvironment, parameters.result.meta);
+  await parameters.onSignalStep?.({
+    env: nextEnvironment,
+    meta: parameters.result.meta,
+    status: parameters.result.status
+  });
+  return nextEnvironment;
+}
+async function runOneSignal(parameters) {
+  const connection = parameters.signal.local === true ? null : parameters.ssh;
+  startModuleSpinner(`signal: ${parameters.signal.name}`);
+  const result = parameters.shutdownSignal == null ? await parameters.signal.apply(connection, parameters.currentEnvironment) : await parameters.signal.apply(connection, parameters.currentEnvironment, {
+    shutdownSignal: parameters.shutdownSignal
+  });
+  const nextEnvironment = await applySignalMeta({
+    currentEnvironment: parameters.currentEnvironment,
+    onSignalStep: parameters.onSignalStep,
+    result
+  });
+  return {
+    nextEnvironment,
+    status: handleSignalResult({
+      hooks: parameters.hooks,
+      result,
+      signalName: parameters.signal.name,
+      verbose: parameters.verbose
+    })
+  };
+}
+async function runSignalModules(parameters) {
+  const getShutdownSignal = parameters.shutdownSignal ?? (() => null);
+  const verbose = parameters.verbose ?? false;
+  let currentEnvironment = parameters.environment;
+  let status = "changed";
+  for (const signal of parameters.signals) {
+    if (getShutdownSignal() != null) break;
+    parameters.hooks?.onSignalStarted?.();
+    try {
+      const signalStep = await runOneSignal({
+        currentEnvironment,
+        hooks: parameters.hooks,
+        onSignalStep: parameters.onSignalStep,
+        shutdownSignal: parameters.shutdownSignal,
+        signal,
+        ssh: parameters.ssh,
+        verbose
+      });
+      currentEnvironment = signalStep.nextEnvironment;
+      if (signalStep.status === "failed") status = "failed";
+    } catch (error) {
+      status = handleSignalFailure({
+        error,
+        hooks: parameters.hooks,
+        signalName: signal.name,
+        verbose
+      });
+    }
+  }
+  return status;
+}
+
 // src/recipe.ts
 var INTERRUPTED_BEFORE_APPLY = /* @__PURE__ */ Symbol("recipe-interrupted-before-apply");
 function isRecipeModuleLike(module) {
@@ -422,12 +1206,21 @@ async function executeOneModule(parameters) {
   if ((parameters.shutdownSignal?.() ?? null) != null) {
     return INTERRUPTED_BEFORE_APPLY;
   }
-  const result = await targetModule.apply(connection, currentEnvironment);
+  const result = await applyRecipeChild({
+    connection,
+    currentEnvironment,
+    onChildStep: parameters.onChildStep,
+    onSignalStep: parameters.onSignalStep,
+    shutdownSignal: parameters.shutdownSignal,
+    signalHooks: parameters.signalHooks,
+    targetModule,
+    verbose
+  });
   printRecipeChildResult(targetModule, result);
   if (result.status === "failed" && result.error != null) {
     printCommandFailure(result.error, verbose);
   }
-  const environment = await mergeEnvironmentFromMeta(currentEnvironment, result.meta);
+  const environment = result.status === "failed" ? currentEnvironment : await mergeEnvironmentFromMeta(currentEnvironment, result.meta);
   return {
     _flushSignals: result._flushSignals,
     _stopRun: result._stopRun,
@@ -440,6 +1233,24 @@ async function checkRecipeChild(targetModule, connection, currentEnvironment) {
   startModuleSpinner(targetModule.name);
   return targetModule.check(connection, currentEnvironment);
 }
+async function applyRecipeChild(parameters) {
+  if (isRecipeModuleLike(parameters.targetModule)) {
+    return parameters.targetModule.apply(parameters.connection, parameters.currentEnvironment, {
+      onChildStep: parameters.onChildStep,
+      onSignalStep: parameters.onSignalStep,
+      shutdownSignal: parameters.shutdownSignal,
+      signalHooks: parameters.signalHooks,
+      verbose: parameters.verbose
+    });
+  }
+  if (parameters.targetModule._supportsChildStepHook === true && (parameters.onChildStep != null || parameters.shutdownSignal != null)) {
+    return parameters.targetModule.apply(parameters.connection, parameters.currentEnvironment, {
+      onChildStep: parameters.onChildStep,
+      shutdownSignal: parameters.shutdownSignal
+    });
+  }
+  return parameters.targetModule.apply(parameters.connection, parameters.currentEnvironment);
+}
 async function applyExecutedRecipeStep(parameters) {
   if (parameters.step == null) return parameters.state;
   if (parameters.step === INTERRUPTED_BEFORE_APPLY) return null;
@@ -519,7 +1330,13 @@ async function executeModules(modules, ssh2, parameters) {
   const shutdownSignal = parameters.shutdownSignal ?? (() => null);
   const verbose = parameters.verbose ?? false;
   let state = {
-    env: { ...parameters.environment },
+    // R-0000079: preserve the null-prototype guarantee that
+    // R-0000069/R-0000070/R-0000074 establish for the runner-level
+    // environment. Plain object spread (`{ ...environment }`) would create a
+    // map with `Object.prototype`, exposing the first child module of every
+    // recipe to a polluted-fähige environment. Mirror the meta.ts:214
+    // approach.
+    env: Object.assign(createNullPrototypeEnvironment(), parameters.environment),
     meta: void 0,
     signalsPending: false,
     status: "ok"
@@ -528,7 +1345,10 @@ async function executeModules(modules, ssh2, parameters) {
     if (shutdownSignal() != null) break;
     const step = await executeRecipeChildStep({
       currentEnvironment: state.env,
+      onChildStep,
+      onSignalStep: parameters.onSignalStep,
       shutdownSignal,
+      signalHooks: parameters.signalHooks,
       ssh: ssh2,
       targetModule: currentModule,
       verbose
@@ -609,11 +1429,51 @@ async function applyRecipe(parameters) {
 function shouldRunRecipeSignalsAtEnd(state, signals2) {
   return state.signalsPending && state.status === "changed" && signals2 != null;
 }
+function shouldExecuteRecipeDryRun(module) {
+  return module._applyDryRun != null || module._dryRunBlocker === true || module._dryRunMetaProducer === true;
+}
+function recipeNeedsDryRunApply(modules) {
+  return modules.some((module) => shouldExecuteRecipeDryRun(module));
+}
+function createRecipeDryRunApply(name, modules, needsDryRunApply) {
+  if (!needsDryRunApply) return void 0;
+  return async (ssh2, environment, parameters) => {
+    const result = await dryRunRecipeModule({
+      environment,
+      recipeModule: {
+        _isRecipe: true,
+        _modules: modules,
+        async apply() {
+          await Promise.resolve();
+          return { status: "ok" };
+        },
+        async check() {
+          await Promise.resolve();
+          return "ok";
+        },
+        name
+      },
+      shutdownSignal: parameters?.shutdownSignal,
+      ssh: ssh2
+    });
+    return {
+      _stopRun: result.stopRun,
+      meta: result.meta,
+      status: result.status ?? "ok"
+    };
+  };
+}
 function recipe(name, modules, options) {
+  const needsDryRunApply = recipeNeedsDryRunApply(modules);
+  const applyDryRun = createRecipeDryRunApply(name, modules, needsDryRunApply);
   return {
+    ...modules.some((module) => module._dryRunBlocker === true) ? { _dryRunBlocker: true } : {},
+    ...modules.some((module) => module._dryRunMetaProducer === true) ? { _dryRunMetaProducer: true } : {},
+    ...applyDryRun == null ? {} : { _applyDryRun: applyDryRun },
     _isRecipe: true,
     _modules: modules,
     _signals: options?.signals,
+    _supportsChildStepHook: true,
     async apply(ssh2, environment, parameters) {
       return applyRecipe({
         environment,
@@ -626,6 +1486,7 @@ function recipe(name, modules, options) {
     },
     async check(ssh2, environment) {
       for (const childModule of modules) {
+        if (getRunnerAbortSignal()?.aborted === true) return NEEDS_APPLY;
         const connection = childModule.local === true ? null : ssh2;
         let result;
         try {
@@ -642,17 +1503,44 @@ function recipe(name, modules, options) {
 }
 
 // src/server.ts
-function server(config) {
-  if (config.host.length === 0) {
+function isModuleLike(value) {
+  if (value === null || typeof value !== "object") return false;
+  return "apply" in value && "check" in value && "name" in value && typeof value.name === "string" && value.name.length > 0 && typeof value.check === "function" && typeof value.apply === "function";
+}
+function validateModuleList(modules, property, options) {
+  if (!Array.isArray(modules)) {
+    throw new TypeError(`ServerDefinition: ${property} must be an array of modules`);
+  }
+  if (options?.requireNonEmpty === true && modules.length === 0) {
+    throw new Error("ServerDefinition: run must contain at least one module");
+  }
+  for (const [index, module] of modules.entries()) {
+    if (!isModuleLike(module)) {
+      throw new Error(
+        `ServerDefinition: ${property}[${index}] must be a module with name, check, and apply`
+      );
+    }
+  }
+}
+function validateServerDefinition(config, options) {
+  const hostValidationFailure = validateHostLabel(config.host);
+  if (hostValidationFailure === "empty") {
     throw new Error("ServerDefinition: host is required");
   }
+  if (hostValidationFailure != null) {
+    throw new Error(
+      `ServerDefinition: host ${describeHostValidationFailure(hostValidationFailure)}`
+    );
+  }
   if (config.name.length === 0) {
     throw new Error("ServerDefinition: name is required");
   }
   validateSshConfig(config.ssh);
-  if (config.run.length === 0) {
-    throw new Error("ServerDefinition: run must contain at least one module");
-  }
+  validateModuleList(config.run, "run", { requireNonEmpty: options?.allowEmptyRun !== true });
+  if (config.signals !== void 0) validateModuleList(config.signals, "signals");
+}
+function server(config) {
+  validateServerDefinition(config);
   return config;
 }
 export {
@@ -680,6 +1568,7 @@ export {
   hostname,
   isBooleanEnvironmentMetaEntry,
   isEnvironmentMetaEntry,
+  isFirstRun,
   isLazyEnvironmentMetaEntry,
   isNumberEnvironmentMetaEntry,
   isSshdPortMetaEntry,
@@ -696,6 +1585,7 @@ export {
   quadlet,
   recipe,
   releaseUpgrade,
+  resolveEnvironment,
   rsync,
   script,
   server,
@@ -705,11 +1595,13 @@ export {
   ssh,
   sshd,
   sshdPortMeta,
+  swap,
   sysctl,
   system,
   systemHostMeta,
   systemRebootMeta,
   systemd,
+  timer,
   ufw,
   user,
   when