@homeflare/alchemy 0.19.0 → 0.20.0

package/dist/linux/region.d.ts

@@ -23,6 +23,17 @@ export type RegionSpec = {
     readonly comment?: string;
 };
 export declare const DEFAULT_COMMENT = "#";
+/**
+ * Whether two declarations name the SAME block.
+ *
+ * ⛔ THE COMMENT TOKEN IS PART OF THE IDENTITY, not a formatting preference. The markers are
+ *   matched as literal whole lines, so `# BEGIN pf` and `// BEGIN pf` are two different blocks:
+ *   changing the token leaves the old block invisible to every later read, exactly as renaming
+ *   does. A resource that treated either as a mere content change would splice a second block in
+ *   and never be able to find the first one again.
+ * ★ Whole-file mode is its own identity: `undefined` equals only `undefined`.
+ */
+export declare const sameRegion: (a: RegionSpec | undefined, b: RegionSpec | undefined) => boolean;
 export declare const regionProblems: (spec: RegionSpec) => string[];
 /**
  * The file's bytes with the block set to `body`, appended at the end when it is not there yet.

package/dist/linux/region.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"region.d.ts","sourceRoot":"","sources":["../../src/linux/region.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,UAAU,GAAG;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,eAAO,MAAM,eAAe,MAAM,CAAC;AAUnC,eAAO,MAAM,cAAc,SAAU,UAAU,KAAG,MAAM,EAYvD,CAAC;AA8BF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,QAAQ,UAAU,QAAQ,MAAM,KAAG,MAW3E,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,UAAU,SAAU,MAAM,QAAQ,UAAU,KAAG,MAAM,GAAG,SAMpE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,QAAQ,UAAU,KAAG,MAK7D,CAAC"}
+{"version":3,"file":"region.d.ts","sourceRoot":"","sources":["../../src/linux/region.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,UAAU,GAAG;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,eAAO,MAAM,eAAe,MAAM,CAAC;AAUnC;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,MAAO,UAAU,GAAG,SAAS,KAAK,UAAU,GAAG,SAAS,KAAG,OAGU,CAAC;AAE7F,eAAO,MAAM,cAAc,SAAU,UAAU,KAAG,MAAM,EAYvD,CAAC;AA8BF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,QAAQ,UAAU,QAAQ,MAAM,KAAG,MAW3E,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,UAAU,SAAU,MAAM,QAAQ,UAAU,KAAG,MAAM,GAAG,SAMpE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,QAAQ,UAAU,KAAG,MAK7D,CAAC"}

package/dist/linux/remote-file-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-file-lifecycle.d.ts","sourceRoot":"","sources":["../../src/linux/remote-file-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AAErE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,QAAQ,WACX,UAAU,QACZ,eAAe,UACb,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAed,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,WAChB,UAAU,SACX,eAAe,WACb,oBAAoB,sBAE5B,OAAO,CAAC,oBAAoB,CA6D9B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,WACb,UAAU,UACV,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAkBd,CAAC"}
+{"version":3,"file":"remote-file-lifecycle.d.ts","sourceRoot":"","sources":["../../src/linux/remote-file-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AAErE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,QAAQ,WACX,UAAU,QACZ,eAAe,UACb,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAgBd,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,WAChB,UAAU,SACX,eAAe,WACb,oBAAoB,sBAE5B,OAAO,CAAC,oBAAoB,CA6E9B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,WACb,UAAU,UACV,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAkBd,CAAC"}

package/dist/linux/remote-file-plan.d.ts

@@ -11,6 +11,28 @@ export type Identity = {
 /** Validate, then resolve owner and group names to ids through the runner. */
 export declare const identity: (runner: HostRunner, props: RemoteFileProps) => Promise<Identity>;
 export declare const digestOf: (text: string) => string;
+/** What this declaration now owns, compared with what the last deploy owned. */
+export type Move = 'none' | 'path' | 'region';
+/**
+ * Has the thing this resource owns MOVED since the last deploy — and if so, how?
+ *
+ * 🔴 WHY THIS EXISTS (found by review, reproduced against the fake host, 2026-09-22). Without it,
+ *   only `path` was identity and both of these read as a routine `update`:
+ *   - RENAMING THE REGION left the old block in the file FOREVER. The new markers were spliced in,
+ *     the old ones were never touched, and `delete` — which can only look for the name in state,
+ *     now the new one — could never remove them. Two `anchor` lines in a packet filter, two
+ *     entries in a host table, and nothing in the stack able to take either back.
+ *   - DROPPING `region` TOOK OVER THE WHOLE FILE. The plan said `update`; the apply replaced every
+ *     byte of a file belonging to a vendor package with this resource's four lines. That is the
+ *     one thing the managed-region design exists to make impossible.
+ * ⛔ A FLIP BETWEEN THE TWO MODES IS A REFUSAL, NOT A MOVE. Neither order is safe: writing the
+ *   whole file first destroys the other owner's bytes before anything can be undone, and removing
+ *   the block first destroys our own claim and then refuses. The operator destroys the resource
+ *   and declares a new one, which is the only sequence with a reviewable diff at each step.
+ * ★ A region-to-region rename IS safe as a move, because both blocks can exist at once: write the
+ *   new one, verify it, then take the old one out (remote-file-lifecycle.ts reconcileFile).
+ */
+export declare const relocation: (props: RemoteFileProps, output: RemoteFileAttributes) => Move;
 /** The digest of the part this resource owns, or `undefined` when that part is not there. */
 export declare const ownedDigest: (file: string | undefined, region: RegionSpec | undefined) => string | undefined;
 /** The file as it is now, plus the digest of the part this resource owns. */

package/dist/linux/remote-file-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-file-plan.d.ts","sourceRoot":"","sources":["../../src/linux/remote-file-plan.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAY,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,KAAK,UAAU,EAA4B,MAAM,aAAa,CAAC;AACxE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAErB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,OAAO,aAAoB,CAAC;AACzC,eAAO,MAAM,OAAO,aAAoB,CAAC;AAEzC,eAAO,MAAM,MAAM,SAAU,MAAM,WAAW,MAAM,KAAG,KACT,CAAC;AAK/C,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,WAAkB,UAAU,SAAS,eAAe,KAAG,OAAO,CAAC,QAAQ,CAc3F,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,MAAyC,CAAC;AAElF,6FAA6F;AAC7F,eAAO,MAAM,WAAW,SAChB,MAAM,GAAG,SAAS,UAChB,UAAU,GAAG,SAAS,KAC7B,MAAM,GAAG,SAKX,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,WACrB,UAAU,QACZ,MAAM,UACJ,UAAU,GAAG,SAAS,KAC7B,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAe1C,CAAC;AAQF,MAAM,MAAM,IAAI,GAAG;IACjB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS,WACZ,UAAU,SACX,eAAe,QAChB,QAAQ,KACb,OAAO,CAAC,IAAI,CA+Cd,CAAC"}
+{"version":3,"file":"remote-file-plan.d.ts","sourceRoot":"","sources":["../../src/linux/remote-file-plan.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAY,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,KAAK,UAAU,EAAwC,MAAM,aAAa,CAAC;AACpF,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAErB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,OAAO,aAAoB,CAAC;AACzC,eAAO,MAAM,OAAO,aAAoB,CAAC;AAEzC,eAAO,MAAM,MAAM,SAAU,MAAM,WAAW,MAAM,KAAG,KACT,CAAC;AAK/C,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,WAAkB,UAAU,SAAS,eAAe,KAAG,OAAO,CAAC,QAAQ,CAc3F,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,MAAyC,CAAC;AAElF,gFAAgF;AAChF,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,UAAU,UAAW,eAAe,UAAU,oBAAoB,KAAG,IAYjF,CAAC;AAEF,6FAA6F;AAC7F,eAAO,MAAM,WAAW,SAChB,MAAM,GAAG,SAAS,UAChB,UAAU,GAAG,SAAS,KAC7B,MAAM,GAAG,SAKX,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,WACrB,UAAU,QACZ,MAAM,UACJ,UAAU,GAAG,SAAS,KAC7B,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAe1C,CAAC;AAQF,MAAM,MAAM,IAAI,GAAG;IACjB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS,WACZ,UAAU,SACX,eAAe,QAChB,QAAQ,KACb,OAAO,CAAC,IAAI,CA+Cd,CAAC"}

package/dist/linux/remote-file.d.ts

@@ -6,10 +6,13 @@
  *   the host already says what we declare; then read back and compared.
  * - read — lstat plus the SHA-256 of the file and of the part this resource owns.
  * - diff — the declared digest against the stored AND the on-disk one, plus mode and owner.
- * - replace — only when `path` changes; create-before-delete.
+ * - replace — only when `path` changes; create-before-delete. A region renamed inside one file
+ *   is an update that writes the new block, verifies it, then takes the old one out.
  * - delete — removes the file, or in region mode only the block.
  *
  * ⛔ NEVER A SECRET — see remote-file-form.ts.
+ * ⛔ THE REGION IS PART OF THE IDENTITY. Renaming it, or changing its comment token, moves the block;
+ *   swapping between owning the whole file and owning a block is refused (remote-file-plan.ts).
  * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt` (docs/ownership.md): a file already at the path, or a
  *   block already carrying the markers, reads as `Unowned`.
  * ★ IT IS A SEPARATE RESOURCE FROM `Host.File`, not a flag on it: the two have different attributes

package/dist/linux/remote-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-file.d.ts","sourceRoot":"","sources":["../../src/linux/remote-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQnF,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEnF,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,6FA0C5B,CAAC"}
+{"version":3,"file":"remote-file.d.ts","sourceRoot":"","sources":["../../src/linux/remote-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQnF,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEnF,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,6FA0C5B,CAAC"}

package/dist/linux/unit-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unit-handlers.d.ts","sourceRoot":"","sources":["../../src/linux/unit-handlers.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,eAAO,MAAM,WAAW,WACd,UAAU,QACZ,gBAAgB,UACd,qBAAqB,GAAG,SAAS,KACxC,MAAM,CAAC,MAAM,CAAC,qBAAqB,GAAG,SAAS,EAAE,KAAK,CAKrD,CAAC;AAEL,eAAO,MAAM,WAAW,WACd,UAAU,cACN,MAAM,QACZ,KAAK,CAAC,gBAAgB,CAAC,UACrB,qBAAqB,GAAG,SAAS,WAChC,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,KAAK,CAgBvC,CAAC;AAEF,eAAO,MAAM,gBAAgB,WACnB,UAAU,QACZ;IACJ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC3C,WACQ,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAG1C,CAAC;AAEJ,eAAO,MAAM,aAAa,WAChB,UAAU,UACV,qBAAqB,KAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAA2C,CAAC"}
+{"version":3,"file":"unit-handlers.d.ts","sourceRoot":"","sources":["../../src/linux/unit-handlers.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAI9E,eAAO,MAAM,WAAW,WACd,UAAU,QACZ,gBAAgB,UACd,qBAAqB,GAAG,SAAS,KACxC,MAAM,CAAC,MAAM,CAAC,qBAAqB,GAAG,SAAS,EAAE,KAAK,CAKrD,CAAC;AAEL,eAAO,MAAM,WAAW,WACd,UAAU,cACN,MAAM,QACZ,KAAK,CAAC,gBAAgB,CAAC,UACrB,qBAAqB,GAAG,SAAS,WAChC,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,KAAK,CAsBvC,CAAC;AAEF,eAAO,MAAM,gBAAgB,WACnB,UAAU,QACZ;IACJ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC3C,WACQ,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAG1C,CAAC;AAEJ,eAAO,MAAM,aAAa,WAChB,UAAU,UACV,qBAAqB,KAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAA2C,CAAC"}

package/dist/linux/unit-lifecycle.d.ts

@@ -19,14 +19,10 @@
  *   start fail; unmasking here would silently overrule whoever masked it.
  */
 import type { Diff } from 'alchemy/Diff';
-import { type HostRunner } from '../launchd/runner.ts';
+import type { HostRunner } from '../launchd/runner.ts';
 import { type SystemdUnitAttributes, type SystemdUnitProps } from './unit-form.ts';
-/** Throw every refusal at once, so one plan shows the whole list. */
-export declare const assertValid: (props: SystemdUnitProps, expect?: string) => void;
 /** What is on the host now: the unit file's digest and systemd's view. `undefined` when neither. */
 export declare const readUnit: (runner: HostRunner, props: SystemdUnitProps) => Promise<SystemdUnitAttributes | undefined>;
-/** ⛔ Writing a unit file and driving systemd are root's, so refuse up front rather than mid-apply. */
-export declare const assertMayWrite: (runner: HostRunner, name: string) => void;
 export declare const diffUnit: (runner: HostRunner, news: SystemdUnitProps, output: SystemdUnitAttributes, expect?: string) => Promise<Diff>;
 /**
  * `adopt` is whether adoption is on AND this apply is a create or an unfinished generation of our

package/dist/linux/unit-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unit-lifecycle.d.ts","sourceRoot":"","sources":["../../src/linux/unit-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAOtB,MAAM,gBAAgB,CAAC;AAOxB,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAW,gBAAgB,WAAW,MAAM,KAAG,IAGtE,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,QAAQ,WACX,UAAU,SACX,gBAAgB,KACtB,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAK3C,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,cAAc,WAAY,UAAU,QAAQ,MAAM,KAAG,IAOjE,CAAC;AAYF,eAAO,MAAM,QAAQ,WACX,UAAU,QACZ,gBAAgB,UACd,qBAAqB,WACpB,MAAM,KACd,OAAO,CAAC,IAAI,CA0Bd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAChB,UAAU,SACX,gBAAgB,UACf,qBAAqB,GAAG,SAAS,4BAEhC,MAAM,KACd,OAAO,CAAC,qBAAqB,CA+C/B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,UAAU,WACb,UAAU,UACV,qBAAqB,KAC5B,OAAO,CAAC,IAAI,CAed,CAAC"}
+{"version":3,"file":"unit-lifecycle.d.ts","sourceRoot":"","sources":["../../src/linux/unit-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAMtB,MAAM,gBAAgB,CAAC;AAOxB,oGAAoG;AACpG,eAAO,MAAM,QAAQ,WACX,UAAU,SACX,gBAAgB,KACtB,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAK3C,CAAC;AAEF,eAAO,MAAM,QAAQ,WACX,UAAU,QACZ,gBAAgB,UACd,qBAAqB,WACpB,MAAM,KACd,OAAO,CAAC,IAAI,CA4Bd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAChB,UAAU,SACX,gBAAgB,UACf,qBAAqB,GAAG,SAAS,4BAEhC,MAAM,KACd,OAAO,CAAC,qBAAqB,CAqD/B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,UAAU,WACb,UAAU,UACV,qBAAqB,KAC5B,OAAO,CAAC,IAAI,CAed,CAAC"}

package/dist/linux/unit-preflight.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Everything Systemd.Unit checks before it touches the host — split from unit-lifecycle.ts so that
+ * a reconcile and a plan-time REPLACE run the very same checks.
+ *
+ * ★ WHY A REPLACE IS CHECKED AT PLAN TIME. A name or directory change is a delete-first replace,
+ *   and Alchemy runs `delete` on the old unit BEFORE `reconcile` on the new one (Apply.ts,
+ *   deleteOldGenerations under `node.deleteFirst`). A refusal that fired only in reconcile would
+ *   therefore arrive after the old unit was already stopped and its file removed: nothing running,
+ *   and a plan that had promised a clean swap.
+ * ★ EVERY CHECK HERE IS READ-ONLY. systemd has no `print-disabled` equivalent in this family —
+ *   masking is `systemctl show`'s LoadState / UnitFileState, which `showUnit` already returns.
+ *   Validation, that show, a file read and `HostRunner.checkWrite` write nothing. `systemctl
+ *   enable` itself stays an apply step; the ways it is known to fail (no `[Install]`, a directory
+ *   systemd does not search) are `unitProblems`, checked here before the plan may promise a swap.
+ */
+import { type HostRunner } from '../launchd/runner.ts';
+import { type UnitStatus } from './systemctl.ts';
+import { type SystemdUnitAttributes, type SystemdUnitProps } from './unit-form.ts';
+/** Throw every refusal at once, so one plan shows the whole list. */
+export declare const assertValid: (props: SystemdUnitProps, expect?: string) => void;
+/** ⛔ Writing a unit file and driving systemd are root's, so refuse up front rather than mid-apply. */
+export declare const assertMayWrite: (runner: HostRunner, name: string) => void;
+/**
+ * ⛔ A MASKED UNIT IS SOMEONE'S DECISION, NOT DRIFT. `systemctl mask` survives reboots and makes
+ *   start fail; unmasking here would silently overrule whoever masked it.
+ */
+export declare const assertUsable: (props: Pick<SystemdUnitProps, 'name'>, status: UnitStatus) => void;
+/**
+ * ⛔ A UNIT THIS RESOURCE DOES NOT OWN IS NEVER OVERWRITTEN. Alchemy's adoption probe guards a
+ *   create, but NOT the new name of a replace — the engine reads nothing there — so a rename onto
+ *   a unit file someone else already has would stop the old unit and write ours over theirs.
+ * ★ A file byte-identical to our render is exempt: it is this declaration's own leftover (a deploy
+ *   that died between write and reload), and rewriting it changes nothing.
+ */
+export declare const assertUnclaimed: (runner: HostRunner, props: SystemdUnitProps) => Promise<void>;
+/**
+ * The half of a rename check that needs only the NEW NAME: the old unit deletable, the new one
+ * writable and not masked.
+ * ★ ON ITS OWN it is for the rename unit-handlers.ts `diffHandler` spots while `content` is still
+ *   an Output. That plan is a delete-first replace too, so a masked target refused only in
+ *   reconcile would again arrive after the old unit was stopped. The unit file itself cannot be
+ *   compared until `content` resolves, so `assertUnclaimed` stays reconcile's job there.
+ */
+export declare const assertRenameTarget: (runner: HostRunner, old: SystemdUnitAttributes, name: string) => Promise<void>;
+/**
+ * A rename, checked at plan time: the new identity must be valid, writable, not masked and free,
+ * and the old one deletable — before the plan may promise a delete-first replace.
+ */
+export declare const assertReplaceable: (runner: HostRunner, next: SystemdUnitProps, old: SystemdUnitAttributes, expect?: string) => Promise<void>;
+//# sourceMappingURL=unit-preflight.d.ts.map

package/dist/linux/unit-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unit-preflight.d.ts","sourceRoot":"","sources":["../../src/linux/unit-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,KAAK,UAAU,EAAY,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAMtB,MAAM,gBAAgB,CAAC;AAKxB,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAW,gBAAgB,WAAW,MAAM,KAAG,IAGtE,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,cAAc,WAAY,UAAU,QAAQ,MAAM,KAAG,IAOjE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,UAAW,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,UAAU,KAAG,IAQxF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAClB,UAAU,SACX,gBAAgB,KACtB,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,WACrB,UAAU,OACb,qBAAqB,QACpB,MAAM,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,WACpB,UAAU,QACZ,gBAAgB,OACjB,qBAAqB,WACjB,MAAM,KACd,OAAO,CAAC,IAAI,CAKd,CAAC"}

package/dist/proxmox/index.d.ts

@@ -21,6 +21,18 @@
  * ★ THE VENDOR CONSTRAINT READER JOINED 2026-09-22 (codegen/README.md). `constraintsFor` and
  *   `violations` are exported so a CONSUMING stack can assert its own declarations offline — the
  *   `deploy:pbs` that failed on a 128-character comment had no way to ask that question.
+ * ★ THE CEPH DAEMON, FILESYSTEM AND OSD RESOURCES JOINED 2026-09-22, BECAUSE EACH IS ALREADY
+ *   ADOPT-ONLY BY SHAPE and a live cluster measured that way was waiting on nothing but this line.
+ *   `ProxmoxCephDaemon` (mon/mgr/mds) and `ProxmoxCephFs` compare nothing, so no edit can plan a
+ *   replace; `ProxmoxCephOsd` never POSTs unless `dev` is declared. All three default to `retain`,
+ *   so deleting a declaration drops a state row and leaves the quorum member, the filesystem or
+ *   the replica alone. ceph-adopt.test.ts pins adopting each as reads only, and removing each as
+ *   no DELETE, through Alchemy's own Plan and Apply.
+ * ⛔ `ProxmoxCephFlag` STAYS PROVIDER-ONLY, AND ON PURPOSE. A flag is a hand on the brake, not
+ *   configuration: a declared `noout: false` clears an operator's `noout` on EVERY deploy,
+ *   including one run for an unrelated resource in the middle of a maintenance window
+ *   (ceph-flag.ts has the whole argument). A stack that wants a flag set must reach for the
+ *   Provider deliberately; the barrel does not offer the sentence by default.
  * ★ Anything else unlisted is still reachable by path if you genuinely need
  *   it — that is a deliberate, visible act rather than an accident of barrelling.
  */
@@ -28,10 +40,10 @@ export { ProxmoxAcl, ProxmoxAclProvider } from './acl.ts';
 export { type AlertmanagerBodyOptions, alertmanagerAlertBody } from './alertmanager-body.ts';
 export { ProxmoxApiTokenProvider } from './api-token.ts';
 export { ProxmoxBackupJob, ProxmoxBackupJobProvider } from './backup-job.ts';
-export { ProxmoxCephDaemonProvider } from './ceph-daemon.ts';
+export { ProxmoxCephDaemon, ProxmoxCephDaemonProvider } from './ceph-daemon.ts';
 export { ProxmoxCephFlagProvider } from './ceph-flag.ts';
-export { ProxmoxCephFsProvider } from './ceph-fs.ts';
-export { ProxmoxCephOsdProvider } from './ceph-osd.ts';
+export { ProxmoxCephFs, ProxmoxCephFsProvider } from './ceph-fs.ts';
+export { ProxmoxCephOsd, ProxmoxCephOsdProvider } from './ceph-osd.ts';
 export { ProxmoxCephPool, ProxmoxCephPoolProvider } from './ceph-pool.ts';
 export { constraintsFor, formViolations } from './constraint-guard.ts';
 export { type EndpointConstraints, type EndpointKey, type ParamConstraint, violations, } from './constraints.ts';

package/dist/proxmox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxmox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,KAAK,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,0BAA0B,GAChC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,KAAK,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxmox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,KAAK,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,0BAA0B,GAChC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,KAAK,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC"}

package/dist/proxmox/index.js

@@ -4998,9 +4998,12 @@ export {
   ProxmoxApiTokenProvider,
   ProxmoxBackupJob,
   ProxmoxBackupJobProvider,
+  ProxmoxCephDaemon,
   ProxmoxCephDaemonProvider,
   ProxmoxCephFlagProvider,
+  ProxmoxCephFs,
   ProxmoxCephFsProvider,
+  ProxmoxCephOsd,
   ProxmoxCephOsdProvider,
   ProxmoxCephPool,
   ProxmoxCephPoolProvider,
@@ -5049,5 +5052,5 @@ export {
   violations
 };
 
-//# debugId=35B6C615E87D256B64756E2164756E21
+//# debugId=05300B16A7B5007464756E2164756E21
 //# sourceMappingURL=index.js.map