@homeflare/alchemy 0.38.0 → 0.40.0

package/dist/ceph/index.js

@@ -0,0 +1,1609 @@
+// src/ceph/auth-entity.ts
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect3 from "effect/Effect";
+
+// src/openbao/mount-path.ts
+var trimTrailing = (text, char) => {
+  let end = text.length;
+  while (end > 0 && text[end - 1] === char)
+    end -= 1;
+  return text.slice(0, end);
+};
+var trimRuns = (text, char) => {
+  let start = 0;
+  while (start < text.length && text[start] === char)
+    start += 1;
+  return trimTrailing(text.slice(start), char);
+};
+var trimTrailingSlashes = (text) => trimTrailing(text, "/");
+var trimSlashes = (text) => trimRuns(text, "/");
+var sshMountOf = (mount) => trimTrailingSlashes(mount ?? "ssh");
+
+// src/ceph/ceph-auth-form.ts
+var capsEqual = (a, b) => a.mon === b.mon && a.osd === b.osd && a.mgr === b.mgr;
+var cephCliPath = (mount, entity) => `${trimTrailingSlashes(mount)}/ceph/${entity}`;
+var cephDataPath = (mount, entity) => `${trimTrailingSlashes(mount)}/data/ceph/${entity}`;
+var identityMoved = (news, output) => output !== undefined && (output.entity !== news.entity || output.baoPath !== cephCliPath(news.mount, news.entity));
+var planCephAuthEntity = (news, output) => {
+  if (output === undefined)
+    return;
+  if (identityMoved(news, output))
+    return { action: "replace" };
+  return capsEqual(news.caps, output.caps) ? { action: "noop" } : { action: "update" };
+};
+var attributesOf = (props, fingerprint, node) => ({
+  baoPath: cephCliPath(props.mount, props.entity),
+  caps: props.caps,
+  entity: props.entity,
+  fingerprint,
+  node
+});
+
+// src/ceph/ceph-auth-reconcile.ts
+import * as Effect2 from "effect/Effect";
+
+// src/openbao/bao-http.ts
+import * as Cause from "effect/Cause";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schedule from "effect/Schedule";
+import * as Semaphore from "effect/Semaphore";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Headers from "effect/unstable/http/Headers";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+
+// src/openbao/bao-address.ts
+var DEFAULT_ADDRESS = "https://127.0.0.1:8200";
+var UNIX = "unix://";
+var readBaoVariable = (env, name) => env[name] ?? env[`VAULT_${name.slice("BAO_".length)}`] ?? "";
+var resolveAddress = (env) => {
+  const agent = readBaoVariable(env, "BAO_AGENT_ADDR");
+  const direct = readBaoVariable(env, "BAO_ADDR");
+  const raw = agent !== "" ? agent : direct !== "" ? direct : DEFAULT_ADDRESS;
+  const namespace = readBaoVariable(env, "BAO_NAMESPACE");
+  const socket = raw.startsWith(UNIX) ? raw.slice(UNIX.length) : undefined;
+  return {
+    base: socket === undefined ? raw.replace(/\/+$/, "") : "http://localhost",
+    namespace: namespace === "" ? undefined : namespace,
+    socket
+  };
+};
+var headersFor = (address, env) => {
+  const headers = { "X-Vault-Request": "true" };
+  if (address.namespace !== undefined)
+    headers["X-Vault-Namespace"] = address.namespace;
+  const token = readBaoVariable(env, "BAO_TOKEN");
+  if (token !== "")
+    headers["X-Vault-Token"] = token;
+  return headers;
+};
+
+// src/openbao/bao-status.ts
+class BaoError extends Error {
+  status;
+  method;
+  path;
+  errors;
+  constructor(status, method, path, errors) {
+    const code = status === 0 ? "no response" : String(status);
+    super(`OpenBao ${method} /v1/${path} -> ${code}: ${errors.join("; ") || "(no errors given)"}`);
+    this.status = status;
+    this.method = method;
+    this.path = path;
+    this.errors = errors;
+    this.name = "BaoError";
+  }
+}
+var objectOf = (text) => {
+  try {
+    const parsed = JSON.parse(text);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : undefined;
+  } catch {
+    return;
+  }
+};
+var errorsOf = (text) => {
+  const raw = objectOf(text)?.["errors"];
+  return Array.isArray(raw) && raw.every((entry) => typeof entry === "string") ? raw : undefined;
+};
+var settle = (intent, method, path, status, text) => {
+  const fail = (errors) => ({
+    error: new BaoError(status, method, path, errors)
+  });
+  if (status < 200 || status >= 300) {
+    const errors = errorsOf(text);
+    if (errors === undefined) {
+      return fail([`not an OpenBao error body (${String(text.length)} bytes)`]);
+    }
+    if (status === 404 && intent !== "write")
+      return { body: undefined };
+    return fail(errors);
+  }
+  if (text.trim() === "") {
+    return intent === "read" ? fail(["a successful read with an empty body"]) : { body: undefined };
+  }
+  const body = objectOf(text);
+  return body === undefined ? fail(["a success body that is not a JSON object"]) : { body };
+};
+
+// src/openbao/bao-http.ts
+var BaoEnv = Context.Reference("homeflare/openbao/BaoEnv", {
+  defaultValue: () => process.env
+});
+var MAX_IN_FLIGHT = 8;
+var BaoGate = Context.Reference("homeflare/openbao/BaoGate", {
+  defaultValue: () => Semaphore.makeUnsafe(MAX_IN_FLIGHT)
+});
+var BAO_TIMEOUT = "60 seconds";
+var retryTransport = (effect) => Effect.retry(effect, {
+  schedule: Schedule.spaced("750 millis"),
+  times: 2,
+  while: (error) => error instanceof BaoError && error.status === 0 || Cause.isTimeoutError(error)
+});
+var redactingToken = (effect) => Effect.gen(function* () {
+  const names = yield* Headers.CurrentRedactedNames;
+  return yield* Effect.provideService(effect, Headers.CurrentRedactedNames, [
+    ...names,
+    "x-vault-token"
+  ]);
+});
+var overSocket = (socket, method, path) => (effect) => {
+  if (socket === undefined)
+    return effect;
+  if (typeof Bun === "undefined") {
+    return Effect.fail(new BaoError(0, method, path, ["a unix:// address needs Bun fetch; this is not Bun"]));
+  }
+  return Effect.flatMap(Effect.serviceOption(FetchHttpClient.RequestInit), (defaults) => {
+    const init = { ...Option.getOrElse(defaults, () => ({})), unix: socket };
+    return Effect.provideService(effect, FetchHttpClient.RequestInit, init);
+  });
+};
+var baoCall = (intent, method, path, body) => Effect.gen(function* () {
+  const env = yield* BaoEnv;
+  const address = resolveAddress(env);
+  const client = yield* HttpClient.HttpClient;
+  const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(HttpClientRequest.setHeaders(headersFor(address, env)), body === undefined ? (self) => self : HttpClientRequest.bodyText(JSON.stringify(body), "application/json"));
+  const exchange = client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text2) => ({ status: response.status, text: text2 }))), Effect.timeout(BAO_TIMEOUT), Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])));
+  const gate = yield* BaoGate;
+  const { status, text } = yield* retryTransport(exchange.pipe(overSocket(address.socket, method, path), redactingToken, Semaphore.withPermits(gate, 1)));
+  const outcome = settle(intent, method, path, status, text);
+  return "error" in outcome ? yield* Effect.fail(outcome.error) : outcome.body;
+});
+var baoRead = (path) => Effect.map(baoCall("read", "GET", path), (body) => {
+  if (body === undefined)
+    return;
+  const data = body["data"];
+  return typeof data === "object" && data !== null ? data : body;
+});
+var baoWrite = (method, path, body) => Effect.asVoid(baoCall("write", method, path, body));
+var baoDelete = (path) => Effect.asVoid(baoCall("delete", "DELETE", path));
+
+// src/openbao/digest.ts
+var canonical = (text) => text.trimEnd();
+var sha256 = (text) => new Bun.CryptoHasher("sha256").update(canonical(text)).digest("hex");
+
+// src/ceph/ceph-config-options.ts
+var NAMED_CONFIG_OPTIONS = new Set([]);
+var LOCKOUT_EXACT = new Set([
+  "mon_host",
+  "public_network",
+  "cluster_network",
+  "public_addr",
+  "cluster_addr"
+]);
+var LOCKOUT_PATTERN = /^auth_\w*_required$|(^|_)key(ring)?($|_)/;
+var isLockoutConfigOption = (name) => LOCKOUT_EXACT.has(name) || LOCKOUT_PATTERN.test(name);
+
+// src/ceph/ceph-argv-config.ts
+var WHO = /^(global|mon|osd|mgr|mds|client)(\.[A-Za-z0-9_-]{1,32})?$/;
+var OPTION_NAME = /^[a-z][a-z0-9_]{0,63}$/;
+var CONFIG_VALUE = /^(?:[A-Za-z0-9][A-Za-z0-9 ._:/=,-]{0,255}|-[0-9]{1,255})$/;
+var configValueProblem = (value) => CONFIG_VALUE.test(value) ? undefined : `config value ${JSON.stringify(value)} contains characters outside the safe set`;
+var namedOptionProblem = (name) => {
+  if (!OPTION_NAME.test(name))
+    return `${JSON.stringify(name)} is not a plain ceph option name`;
+  if (isLockoutConfigOption(name))
+    return `${name} is a lockout-class option and can never be declared`;
+  return NAMED_CONFIG_OPTIONS.has(name) ? undefined : `${name} is not on the named option list (it starts empty — see ceph-config-options.ts)`;
+};
+var configProblem = (rest) => {
+  const [verb, who, name, ...extra] = rest;
+  if (who === undefined || !WHO.test(who)) {
+    return "config takes a bounded `<who>` (global/mon/osd/mgr/mds/client[.id])";
+  }
+  if (name === undefined)
+    return "config takes a `<name>` from the named option list";
+  if (verb === "get" || verb === "rm") {
+    return extra.length === 0 ? namedOptionProblem(name) : `config ${String(verb)} takes exactly \`<who> <name>\``;
+  }
+  if (verb === "set") {
+    const [value, ...more] = extra;
+    if (value === undefined || more.length !== 0)
+      return "config set takes exactly `<who> <name> <value>`";
+    const named = namedOptionProblem(name);
+    return named !== undefined ? named : configValueProblem(value);
+  }
+  return `ceph config ${String(verb)} is not on the allowlist`;
+};
+
+// src/ceph/ceph-argv.ts
+var CEPH_BIN = "/usr/bin/ceph";
+var ENTITY_PREFIX = "client.k8s-";
+var ENTITY = /^client\.k8s-[a-z0-9][a-z0-9-]{0,61}$/;
+var boundedEntityProblem = (entity) => ENTITY.test(entity) ? undefined : `entity must match \`${ENTITY_PREFIX}<name>\` (lowercase, digits, hyphens), got ${JSON.stringify(entity)}`;
+var MON_CAP = /^profile rbd$/;
+var POOL_SCOPED_CAP = /^profile rbd pool=[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;
+var DAEMONS = ["mon", "osd", "mgr"];
+var capProblem = (daemon, value) => {
+  if (value === undefined)
+    return `${daemon} cap is missing`;
+  const shape = daemon === "mon" ? MON_CAP : POOL_SCOPED_CAP;
+  return shape.test(value) ? undefined : `${daemon} cap ${JSON.stringify(value)} is not the design's plain pool-scoped rbd profile`;
+};
+var authGetProblem = (ops) => {
+  const [entity, ...extra] = ops;
+  if (entity === undefined || extra.length !== 0)
+    return "auth get takes exactly `<entity>`";
+  return boundedEntityProblem(entity);
+};
+var capsTripleProblem = (ops) => {
+  const [entity, ...pairs] = ops;
+  if (entity === undefined)
+    return `takes exactly \`<entity> ${DAEMONS.map((d) => `${d} <cap>`).join(" ")}\``;
+  const entityProblem = boundedEntityProblem(entity);
+  if (entityProblem !== undefined)
+    return entityProblem;
+  if (pairs.length !== DAEMONS.length * 2) {
+    return `takes exactly \`<entity> ${DAEMONS.map((d) => `${d} <cap>`).join(" ")}\``;
+  }
+  for (const [index, daemon] of DAEMONS.entries()) {
+    const key = pairs[index * 2];
+    const value = pairs[index * 2 + 1];
+    if (key !== daemon)
+      return `expected \`${daemon}\` in position ${String(index + 1)}, got ${JSON.stringify(key)}`;
+    const problem = capProblem(daemon, value);
+    if (problem !== undefined)
+      return problem;
+  }
+  return;
+};
+var authProblem = (rest) => {
+  const [verb, ...ops] = rest;
+  if (verb === "ls") {
+    return "auth ls prints every key on the cluster; use the committed read-only inventory " + "script instead, never this transport";
+  }
+  if (verb === "del")
+    return "auth del is refused entirely — lockout safety, never auto-delete (D3)";
+  if (verb === "get")
+    return authGetProblem(ops);
+  if (verb === "get-or-create")
+    return capsTripleProblem(ops);
+  if (verb === "caps")
+    return capsTripleProblem(ops);
+  return `ceph auth ${String(verb)} is not on the allowlist`;
+};
+var JSON_FORMAT = ["-f", "json"];
+var withJsonSuffix = (rest, check) => {
+  const suffix = rest.slice(-2);
+  if (suffix[0] !== JSON_FORMAT[0] || suffix[1] !== JSON_FORMAT[1]) {
+    return "every ceph call in this allowlist ends `-f json`";
+  }
+  return check(rest.slice(0, -2));
+};
+var cephCommandProblem = (argv) => {
+  const [bin, group, ...rest] = argv;
+  if (bin !== CEPH_BIN)
+    return `${JSON.stringify(bin)} is not the allowlisted ceph binary`;
+  if (group === "quorum_status") {
+    return rest.length === 2 && rest[0] === JSON_FORMAT[0] && rest[1] === JSON_FORMAT[1] ? undefined : "quorum_status takes exactly `-f json`";
+  }
+  if (group === "auth")
+    return withJsonSuffix(rest, authProblem);
+  if (group === "config")
+    return withJsonSuffix(rest, configProblem);
+  return `ceph ${String(group)} is not on the allowlist`;
+};
+var authGetArgv = (entity) => [
+  CEPH_BIN,
+  "auth",
+  "get",
+  entity,
+  ...JSON_FORMAT
+];
+var authGetOrCreateArgv = (entity, caps) => [
+  CEPH_BIN,
+  "auth",
+  "get-or-create",
+  entity,
+  ...DAEMONS.flatMap((daemon) => [daemon, caps[daemon]]),
+  ...JSON_FORMAT
+];
+var authCapsArgv = (entity, caps) => [
+  CEPH_BIN,
+  "auth",
+  "caps",
+  entity,
+  ...DAEMONS.flatMap((daemon) => [daemon, caps[daemon]]),
+  ...JSON_FORMAT
+];
+var quorumStatusArgv = () => [
+  CEPH_BIN,
+  "quorum_status",
+  ...JSON_FORMAT
+];
+
+// src/ceph/ceph-auth-parse.ts
+var isRecord = (value) => typeof value === "object" && value !== null;
+var parseCaps = (value, entity) => {
+  if (!isRecord(value))
+    throw new Error(`ceph auth: ${entity}'s entry has no caps object`);
+  const { mon, osd, mgr } = value;
+  if (typeof mon !== "string" || typeof osd !== "string" || typeof mgr !== "string") {
+    throw new Error(`ceph auth: ${entity}'s caps are missing a mon, osd or mgr string`);
+  }
+  return { mgr, mon, osd };
+};
+var parseKeyringEntry = (stdout, entity) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    throw new Error(`ceph auth ${entity}: stdout did not parse as JSON`);
+  }
+  const row = Array.isArray(parsed) ? parsed.find((entry) => isRecord(entry) && entry["entity"] === entity) : undefined;
+  if (!isRecord(row))
+    throw new Error(`ceph auth ${entity}: no matching entry in the JSON output`);
+  const { key } = row;
+  if (typeof key !== "string" || key.trim() === "") {
+    throw new Error(`ceph auth ${entity}: the entry has no key field`);
+  }
+  return { caps: parseCaps(row["caps"], entity), key };
+};
+var parseAuthGet = (result, entity) => {
+  if (result.exitCode !== 0) {
+    if (result.stderr.includes("ENOENT"))
+      return { kind: "absent" };
+    throw new Error(`ceph auth get ${entity} failed: ${result.stderr.trim().slice(0, 300)}`);
+  }
+  const { caps } = parseKeyringEntry(result.stdout, entity);
+  return { caps, kind: "present" };
+};
+var parseAuthGetOrCreate = (result, entity) => {
+  if (result.exitCode !== 0) {
+    throw new Error(`ceph auth get-or-create ${entity} failed: ${result.stderr.trim().slice(0, 300)}`);
+  }
+  return parseKeyringEntry(result.stdout, entity);
+};
+var parseQuorumStatus = (stdout) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch (cause) {
+    return { healthy: false, reason: `stdout did not parse as JSON (${String(cause)})` };
+  }
+  if (!isRecord(parsed))
+    return { healthy: false, reason: "stdout was not a JSON object" };
+  const quorum = parsed["quorum"];
+  return Array.isArray(quorum) && quorum.length > 0 ? { healthy: true } : { healthy: false, reason: "no non-empty `quorum` array in the quorum_status output" };
+};
+
+// src/ceph/ceph-transport.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+
+// src/linux/ssh-command.ts
+var ABSENT = 66;
+var shellQuote = (arg) => {
+  if (arg.includes("\x00"))
+    throw new Error("ssh: an argument contains NUL");
+  return `'${arg.replaceAll("'", `'\\''`)}'`;
+};
+var quoteArgv = (argv) => argv.map(shellQuote).join(" ");
+var marker = (nonce) => `__HF_RC_${nonce}=`;
+var frameScript = (script, nonce) => `(
+${script}
+)
+__hf=$?
+printf '\\n${marker(nonce)}%s\\n' "$__hf" >&2
+exit "$__hf"`;
+var parseFramed = (stderr, nonce) => {
+  const at = stderr.lastIndexOf(`
+${marker(nonce)}`);
+  if (at < 0)
+    return;
+  const digits = /^(\d+)\s*$/.exec(stderr.slice(at + marker(nonce).length + 1));
+  if (digits?.[1] === undefined)
+    return;
+  return { exitCode: Number(digits[1]), stderr: stderr.slice(0, at) };
+};
+var sshArgv = (host, script, options) => {
+  if (host === "" || host.startsWith("-")) {
+    throw new Error(`ssh: ${JSON.stringify(host)} is not a usable destination`);
+  }
+  return [
+    "ssh",
+    "-T",
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    `ConnectTimeout=${String(options.connectTimeoutSec)}`,
+    ...options.sshArgs ?? [],
+    host,
+    `/bin/sh -c ${shellQuote(script)}`
+  ];
+};
+
+// src/linux/ssh-runner.ts
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+
+// src/launchd/host-lookup.ts
+var NUMERIC = /^\d+$/;
+var userQuery = (platform, nameOrId) => platform === "darwin" ? [
+  "/usr/bin/dscacheutil",
+  "-q",
+  "user",
+  "-a",
+  NUMERIC.test(nameOrId) ? "uid" : "name",
+  nameOrId
+] : ["getent", "passwd", nameOrId];
+var groupQuery = (platform, nameOrId) => platform === "darwin" ? [
+  "/usr/bin/dscacheutil",
+  "-q",
+  "group",
+  "-a",
+  NUMERIC.test(nameOrId) ? "gid" : "name",
+  nameOrId
+] : ["getent", "group", nameOrId];
+var firstRecord = (stdout) => {
+  const fields = new Map;
+  for (const line of stdout.split(`
+`)) {
+    if (line.trim() === "") {
+      if (fields.size > 0)
+        break;
+      continue;
+    }
+    const at = line.indexOf(": ");
+    if (at <= 0)
+      continue;
+    const key = line.slice(0, at);
+    if (key === "password")
+      continue;
+    fields.set(key, line.slice(at + 2).trim());
+  }
+  return fields;
+};
+var toId = (text) => text !== undefined && NUMERIC.test(text) ? Number(text) : undefined;
+var parseUser = (platform, stdout) => {
+  if (platform === "darwin") {
+    const record = firstRecord(stdout);
+    const uid2 = toId(record.get("uid"));
+    const gid2 = toId(record.get("gid"));
+    const home2 = record.get("dir");
+    return uid2 === undefined || gid2 === undefined || home2 === undefined ? undefined : { gid: gid2, home: home2, uid: uid2 };
+  }
+  const fields = (stdout.split(`
+`)[0] ?? "").split(":");
+  const uid = toId(fields[2]);
+  const gid = toId(fields[3]);
+  const home = fields[5];
+  return uid === undefined || gid === undefined || home === undefined || home === "" ? undefined : { gid, home, uid };
+};
+var parseGroup = (platform, stdout) => {
+  if (platform === "darwin")
+    return toId(firstRecord(stdout).get("gid"));
+  return toId((stdout.split(`
+`)[0] ?? "").split(":")[2]);
+};
+
+// src/linux/ssh-scripts.ts
+var IF_PRESENT = (path) => `if [ -e ${path} ] || [ -L ${path} ]; then`;
+var statScript = (path) => {
+  const quoted = shellQuote(path);
+  return `${IF_PRESENT(quoted)} stat -c '%f %a %u %g %s' -- ${quoted}; else exit ${String(ABSENT)}; fi`;
+};
+var readScript = (path) => {
+  const quoted = shellQuote(path);
+  return `${IF_PRESENT(quoted)} base64 -- ${quoted}; else exit ${String(ABSENT)}; fi`;
+};
+var removeScript = (path) => `rm -f -- ${shellQuote(path)}`;
+var execScript = (argv) => quoteArgv(argv);
+var writeScript = (path, temp, options) => {
+  const target = shellQuote(path);
+  const staged = shellQuote(temp);
+  const bail = `{ rm -f -- ${staged}; exit`;
+  const owner = options.uid === undefined ? options.gid === undefined ? undefined : `:${String(options.gid)}` : options.gid === undefined ? String(options.uid) : `${String(options.uid)}:${String(options.gid)}`;
+  const chown = owner === undefined ? [] : [`chown ${owner} -- ${staged} || ${bail} 72; }`];
+  return [
+    "set -C",
+    "umask 077",
+    `cat > ${staged} || ${bail} 71; }`,
+    ...chown,
+    `chmod ${options.mode.toString(8).padStart(3, "0")} -- ${staged} || ${bail} 73; }`,
+    `mv -f -- ${staged} ${target} || ${bail} 74; }`
+  ].join(`
+`);
+};
+var TYPE_BITS = 61440;
+var KINDS = new Map([
+  [32768, "file"],
+  [16384, "directory"],
+  [40960, "symlink"]
+]);
+var parseStat = (stdout) => {
+  const fields = stdout.trim().split(/\s+/);
+  if (fields.length !== 5)
+    return;
+  const [rawMode, perms, uid, gid, size] = fields;
+  const raw = Number.parseInt(rawMode, 16);
+  const mode = Number.parseInt(perms, 8);
+  const numbers = [raw, mode, Number(uid), Number(gid), Number(size)];
+  if (numbers.some((value) => !Number.isSafeInteger(value) || value < 0))
+    return;
+  return {
+    gid: Number(gid),
+    kind: KINDS.get(raw & TYPE_BITS) ?? "other",
+    mode,
+    size: Number(size),
+    uid: Number(uid)
+  };
+};
+
+// src/linux/ssh-runner.ts
+var spawnSsh = (argv, timeoutMs, stdin) => new Promise((resolve, reject) => {
+  const [program, ...args] = argv;
+  const child = spawn(program, args, {
+    shell: false,
+    stdio: [stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+    timeout: timeoutMs
+  });
+  const out = [];
+  const err = [];
+  child.stdout?.on("data", (chunk) => out.push(chunk));
+  child.stderr?.on("data", (chunk) => err.push(chunk));
+  child.on("error", (cause) => {
+    reject(new Error(`ssh: ${cause.message}`));
+  });
+  if (stdin !== undefined && child.stdin !== null) {
+    child.stdin.on("error", () => {
+      return;
+    });
+    child.stdin.end(stdin);
+  }
+  child.on("close", (exitCode, signal) => {
+    resolve({
+      exitCode: exitCode ?? -1,
+      signal,
+      stderr: Buffer.concat(err).toString("utf8"),
+      stdout: Buffer.concat(out).toString("utf8")
+    });
+  });
+});
+var runRemote = async (options, nonce, script, stdin) => {
+  const argv = sshArgv(options.host, frameScript(script, nonce), {
+    connectTimeoutSec: options.connectTimeoutSec,
+    ...options.sshArgs === undefined ? {} : { sshArgs: options.sshArgs }
+  });
+  const raw = await spawnSsh(argv, options.execTimeoutMs, stdin);
+  const framed = parseFramed(raw.stderr, nonce);
+  if (framed === undefined) {
+    throw new Error(`ssh ${options.host}: the remote command did not report a status (ssh exit ` + `${String(raw.exitCode)}${raw.signal === null ? "" : `, killed by ${raw.signal}`}): ` + `${raw.stderr.trim().slice(0, 300)}`);
+  }
+  return { exitCode: framed.exitCode, stderr: framed.stderr, stdout: raw.stdout };
+};
+var decodeBase64 = (text) => new Uint8Array(Buffer.from(text.replaceAll(`
+`, ""), "base64"));
+var failed = (host, what, result) => new Error(`ssh ${host}: ${what} -> ${String(result.exitCode)}: ${result.stderr.trim().slice(0, 300)}`);
+var sshRunner = async (options) => {
+  const settings = {
+    connectTimeoutSec: options.connectTimeoutSec ?? 10,
+    execTimeoutMs: options.execTimeoutMs ?? 120000,
+    host: options.host,
+    ...options.sshArgs === undefined ? {} : { sshArgs: options.sshArgs }
+  };
+  const nonce = randomBytes(8).toString("hex");
+  const run = (script, stdin) => runRemote(settings, nonce, script, stdin);
+  const probe = await run("uname -s; id -u");
+  if (probe.exitCode !== 0)
+    throw failed(options.host, "uname -s; id -u", probe);
+  const [system, uid] = probe.stdout.trim().split(`
+`);
+  if (system !== "Linux" || uid === undefined || !/^\d+$/.test(uid)) {
+    throw new Error(`ssh ${options.host}: expected a Linux host, got ${JSON.stringify(probe.stdout.trim())}. ` + "sshRunner() sends GNU/BusyBox argv (stat -c, base64, mv -f); for a Mac use localRunner().");
+  }
+  const euid = Number(uid);
+  return {
+    effectiveUid: () => euid,
+    exec: (argv) => run(execScript(argv)),
+    lookupGroup: async (nameOrId) => {
+      const result = await run(execScript(groupQuery("linux", nameOrId)));
+      return result.exitCode === 0 ? parseGroup("linux", result.stdout) : undefined;
+    },
+    lookupUser: async (nameOrId) => {
+      const result = await run(execScript(userQuery("linux", nameOrId)));
+      return result.exitCode === 0 ? parseUser("linux", result.stdout) : undefined;
+    },
+    privileged: false,
+    readFile: async (path) => {
+      const result = await run(readScript(path));
+      if (result.exitCode === ABSENT)
+        return;
+      if (result.exitCode !== 0)
+        throw failed(options.host, `read ${path}`, result);
+      return decodeBase64(result.stdout);
+    },
+    removeFile: async (path) => {
+      const result = await run(removeScript(path));
+      if (result.exitCode !== 0)
+        throw failed(options.host, `remove ${path}`, result);
+    },
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    stat: async (path) => {
+      const result = await run(statScript(path));
+      if (result.exitCode === ABSENT)
+        return;
+      if (result.exitCode !== 0)
+        throw failed(options.host, `stat ${path}`, result);
+      const parsed = parseStat(result.stdout);
+      if (parsed === undefined) {
+        throw new Error(`ssh ${options.host}: stat ${path} printed an unexpected shape`);
+      }
+      return parsed;
+    },
+    writeFileAtomic: async (path, bytes, write) => {
+      const at = path.lastIndexOf("/");
+      const temp = `${path.slice(0, at)}/.${path.slice(at + 1)}.${randomBytes(6).toString("hex")}.tmp`;
+      const result = await run(writeScript(path, temp, write), bytes);
+      if (result.exitCode !== 0)
+        throw failed(options.host, `write ${path}`, result);
+    }
+  };
+};
+
+// src/launchd/job-form.ts
+import { createHash } from "node:crypto";
+
+// src/launchd/plist.ts
+class PlistError extends Error {
+  path;
+  constructor(path, detail) {
+    super(`plist ${path === "" ? "(root)" : path}: ${detail}`);
+    this.path = path;
+    this.name = "PlistError";
+  }
+}
+var HEADER = `<?xml version="1.0" encoding="UTF-8"?>
+` + '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" ' + `"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+` + `<plist version="1.0">
+`;
+var MAX_DEPTH = 32;
+var FORBIDDEN = /[\x00-\x08\x0B\x0C\x0E-\x1F\uD800-\uDFFF\uFFFE\uFFFF]/u;
+var escapeText = (text, path) => {
+  const bad = FORBIDDEN.exec(text);
+  if (bad !== null) {
+    const code = bad[0].codePointAt(0) ?? 0;
+    throw new PlistError(path, `U+${code.toString(16).toUpperCase().padStart(4, "0")} cannot appear in XML 1.0`);
+  }
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\r", "&#13;");
+};
+var isPlainObject = (value) => {
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var renderValue = (value, path, depth, out) => {
+  const pad = "\t".repeat(depth);
+  if (depth > MAX_DEPTH)
+    throw new PlistError(path, `nested deeper than ${String(MAX_DEPTH)}`);
+  if (typeof value === "string") {
+    out.push(`${pad}<string>${escapeText(value, path)}</string>`);
+    return;
+  }
+  if (typeof value === "boolean") {
+    out.push(`${pad}<${value ? "true" : "false"}/>`);
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value)) {
+      throw new PlistError(path, `${String(value)} is not a safe integer (no <real> support)`);
+    }
+    out.push(`${pad}<integer>${String(value === 0 ? 0 : value)}</integer>`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      out.push(`${pad}<array/>`);
+      return;
+    }
+    out.push(`${pad}<array>`);
+    for (const [index, item] of value.entries()) {
+      renderValue(item, `${path}[${String(index)}]`, depth + 1, out);
+    }
+    out.push(`${pad}</array>`);
+    return;
+  }
+  if (typeof value === "object" && value !== null && isPlainObject(value)) {
+    renderDict(value, path, depth, out);
+    return;
+  }
+  const kind = value === null ? "null" : typeof value;
+  throw new PlistError(path, `${kind} has no plist form — omit the key instead`);
+};
+var renderDict = (dict, path, depth, out) => {
+  const pad = "\t".repeat(depth);
+  const keys = Object.keys(dict).sort();
+  if (keys.length === 0) {
+    out.push(`${pad}<dict/>`);
+    return;
+  }
+  out.push(`${pad}<dict>`);
+  for (const key of keys) {
+    const child = path === "" ? key : `${path}.${key}`;
+    out.push(`${pad}	<key>${escapeText(key, child)}</key>`);
+    renderValue(dict[key], child, depth + 1, out);
+  }
+  out.push(`${pad}</dict>`);
+};
+var renderPlist = (dict) => {
+  if (typeof dict !== "object" || dict === null || Array.isArray(dict) || !isPlainObject(dict)) {
+    throw new PlistError("", "the top level of a launchd plist must be a dict");
+  }
+  const out = [];
+  renderDict(dict, "", 0, out);
+  return `${HEADER}${out.join(`
+`)}
+</plist>
+`;
+};
+
+// src/launchd/job-form.ts
+var parseDomain = (domain) => {
+  if (domain === "system")
+    return { kind: "system" };
+  const match = /^gui\/(\d+)$/.exec(domain);
+  return match?.[1] === undefined ? undefined : { kind: "gui", uid: Number(match[1]) };
+};
+var serviceTarget = (label, domain) => `${domain}/${label}`;
+var plistPathFor = (label, domain, home) => {
+  if (domain.kind === "system")
+    return `/Library/LaunchDaemons/${label}.plist`;
+  if (home === undefined || !home.startsWith("/")) {
+    throw new Error(`gui/${String(domain.uid)}: no home directory for that uid on this host`);
+  }
+  return `${home}/Library/LaunchAgents/${label}.plist`;
+};
+var OWNED_KEYS = [
+  "EnvironmentVariables",
+  "GroupName",
+  "KeepAlive",
+  "Label",
+  "Program",
+  "ProgramArguments",
+  "RunAtLoad",
+  "StandardErrorPath",
+  "StandardOutPath",
+  "StartCalendarInterval",
+  "StartInterval",
+  "ThrottleInterval",
+  "UserName",
+  "WorkingDirectory"
+];
+var calendarDict = (entry) => {
+  const dict = {};
+  if (entry.minute !== undefined)
+    dict["Minute"] = entry.minute;
+  if (entry.hour !== undefined)
+    dict["Hour"] = entry.hour;
+  if (entry.day !== undefined)
+    dict["Day"] = entry.day;
+  if (entry.weekday !== undefined)
+    dict["Weekday"] = entry.weekday;
+  if (entry.month !== undefined)
+    dict["Month"] = entry.month;
+  return dict;
+};
+var keepAliveValue = (keepAlive) => {
+  if (typeof keepAlive === "boolean")
+    return keepAlive;
+  const dict = {};
+  if (keepAlive.successfulExit !== undefined)
+    dict["SuccessfulExit"] = keepAlive.successfulExit;
+  if (keepAlive.crashed !== undefined)
+    dict["Crashed"] = keepAlive.crashed;
+  return dict;
+};
+var jobPlistDict = (props) => {
+  const dict = { ...props.extraKeys };
+  dict["Label"] = props.label;
+  dict["ProgramArguments"] = [...props.programArguments];
+  const env = props.environment ?? {};
+  if (Object.keys(env).length > 0)
+    dict["EnvironmentVariables"] = { ...env };
+  if (props.runAtLoad !== undefined)
+    dict["RunAtLoad"] = props.runAtLoad;
+  if (props.keepAlive !== undefined)
+    dict["KeepAlive"] = keepAliveValue(props.keepAlive);
+  if (props.startInterval !== undefined)
+    dict["StartInterval"] = props.startInterval;
+  const calendar = props.startCalendarInterval;
+  if (calendar !== undefined) {
+    dict["StartCalendarInterval"] = Array.isArray(calendar) ? calendar.map(calendarDict) : calendarDict(calendar);
+  }
+  if (props.throttleInterval !== undefined)
+    dict["ThrottleInterval"] = props.throttleInterval;
+  if (props.standardOutPath !== undefined)
+    dict["StandardOutPath"] = props.standardOutPath;
+  if (props.standardErrorPath !== undefined)
+    dict["StandardErrorPath"] = props.standardErrorPath;
+  if (props.workingDirectory !== undefined)
+    dict["WorkingDirectory"] = props.workingDirectory;
+  if (props.userName !== undefined)
+    dict["UserName"] = props.userName;
+  if (props.groupName !== undefined)
+    dict["GroupName"] = props.groupName;
+  return dict;
+};
+var sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
+var renderJob = (props) => {
+  const text = renderPlist(jobPlistDict(props));
+  const bytes = new TextEncoder().encode(text);
+  return { bytes, sha256: sha256Hex(bytes), text };
+};
+
+// src/linux/unit-text.ts
+var INSTALL_KEYS = new Set(["WantedBy", "RequiredBy", "UpsertedBy", "Also", "Alias"]);
+var hasInstallSection = (text) => {
+  if (!text.includes("[Install]"))
+    return false;
+  const after = text.slice(text.indexOf("[Install]"));
+  return [...INSTALL_KEYS].some((key) => new RegExp(`^${key}=`, "m").test(after));
+};
+var firstSubstantiveLine = (text) => text.split(`
+`).find((line) => !(line.trim() === "" || line.startsWith("#") || line.startsWith(";")));
+var textProblems = (text) => {
+  const found = [];
+  if (text.trim() === "")
+    found.push("the unit file is empty");
+  if (text.includes("\x00"))
+    found.push("the unit file contains NUL");
+  const first = firstSubstantiveLine(text);
+  if (first === undefined || !/^\s*\[[A-Za-z]+]/.test(first)) {
+    found.push("a unit file must begin with a [Section] (blank lines and #/; comments before it are fine)");
+  }
+  return found;
+};
+
+// src/linux/unit-form.ts
+var DEFAULT_UNIT_DIRECTORY = "/etc/systemd/system";
+var UNIT_SEARCH_DIRECTORIES = [
+  "/etc/systemd/system",
+  "/run/systemd/system",
+  "/usr/local/lib/systemd/system",
+  "/usr/lib/systemd/system",
+  "/lib/systemd/system"
+];
+var UNIT_WRITE = { gid: 0, mode: 420, uid: 0 };
+var digestOf = (text) => sha256Hex(new TextEncoder().encode(text));
+var configDigest = (restartOn) => digestOf((restartOn ?? []).join(`
+`));
+var isUnitRunning = (activeState, subState, started) => {
+  if (activeState === "active")
+    return true;
+  if (activeState !== "activating")
+    return false;
+  if (subState === "auto-restart" || subState === "auto-restart-queued")
+    return true;
+  return started;
+};
+var renderUnit = (sections) => `${sections.map((section) => [`[${section.name}]`, ...section.lines.map(([key, value]) => `${key}=${value}`)].join(`
+`)).join(`
+
+`)}
+`;
+var unitText = (props) => props.content ?? renderUnit(props.sections ?? []);
+var unitPathFor = (props) => `${props.directory ?? DEFAULT_UNIT_DIRECTORY}/${props.name}`;
+var NAME = /^[A-Za-z0-9][A-Za-z0-9_.@:-]*\.([a-z]+)$/;
+var TYPES = new Set([
+  "automount",
+  "device",
+  "mount",
+  "path",
+  "scope",
+  "service",
+  "slice",
+  "socket",
+  "swap",
+  "target",
+  "timer"
+]);
+var unitProblems = (props, expect) => {
+  const found = [];
+  const type = NAME.exec(props.name)?.[1];
+  if (type === undefined || !TYPES.has(type)) {
+    found.push(`name must be <unit>.<type> with a systemd unit type, got ${JSON.stringify(props.name)}`);
+  } else if (expect !== undefined && type !== expect) {
+    found.push(`this resource declares a .${expect} unit; ${props.name} is a .${type}`);
+  }
+  if (props.content === undefined === (props.sections === undefined)) {
+    found.push("declare exactly one of content or sections");
+  }
+  const directory = props.directory ?? DEFAULT_UNIT_DIRECTORY;
+  if (!directory.startsWith("/") || directory.endsWith("/") || directory.includes("/..")) {
+    found.push("directory must be an absolute, normalised path with no trailing slash");
+  }
+  found.push(...textProblems(unitText(props)));
+  if (props.enabled !== false && !UNIT_SEARCH_DIRECTORIES.includes(directory)) {
+    found.push(`an enabled unit must live where systemd looks for it by name (${UNIT_SEARCH_DIRECTORIES.join(", ")}); ` + `${directory} is not one of them. Move it, or declare enabled: false.`);
+  }
+  if (props.enabled !== false && !hasInstallSection(unitText(props))) {
+    found.push("enabled units need an [Install] section with WantedBy/RequiredBy/Also/Alias; without one " + 'systemd calls the unit "static" and `systemctl enable` has nothing to link. Add one, or ' + "declare enabled: false and let something else pull it in.");
+  }
+  if (type === "timer" && !unitText(props).includes("[Timer]")) {
+    found.push("a .timer needs a [Timer] section");
+  }
+  return found;
+};
+
+// src/launchd/secret-tripwire.ts
+var ALTERNATIVE = "props are stored unencrypted in Alchemy state. Have a secret renderer (e.g. openbao-agent) " + "write it to a root-owned file and declare the file path instead (FOO_FILE=/path, --foo-file /path).";
+var SECRET_NAME = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|API_?KEY|ACCESS_KEY|PRIVATE_KEY|SECRET_KEY|CREDENTIALS?)$/i;
+var INLINE_FLAG = /^--?[a-z0-9-]*(?:token|password|passwd|passphrase|secret|api-?key)=./i;
+var BARE_FLAG = /^--?(?:[a-z0-9]+-)*(?:token|password|passwd|passphrase|secret|api-?key)$/i;
+var PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
+var keyLeaves = (value, path) => {
+  if (typeof value === "string")
+    return PRIVATE_KEY.test(value) ? [path] : [];
+  if (Array.isArray(value)) {
+    return value.flatMap((item, index) => keyLeaves(item, `${path}[${String(index)}]`));
+  }
+  if (typeof value === "object" && value !== null) {
+    return Object.entries(value).flatMap(([key, item]) => keyLeaves(item, `${path}.${key}`));
+  }
+  return [];
+};
+var jobSecretProblems = (environment, argv, extraKeys) => {
+  const found = [];
+  for (const [name, value] of Object.entries(environment ?? {})) {
+    if (SECRET_NAME.test(name))
+      found.push(`environment ${name} looks like a secret: ${ALTERNATIVE}`);
+    else if (PRIVATE_KEY.test(value))
+      found.push(`environment ${name} holds a private key: ${ALTERNATIVE}`);
+  }
+  for (const [index, arg] of argv.entries()) {
+    if (INLINE_FLAG.test(arg)) {
+      found.push(`programArguments[${String(index)}] passes a secret inline: ${ALTERNATIVE}`);
+    } else if (BARE_FLAG.test(arg) && index + 1 < argv.length) {
+      found.push(`programArguments[${String(index + 1)}] follows a secret flag: ${ALTERNATIVE}`);
+    } else if (PRIVATE_KEY.test(arg)) {
+      found.push(`programArguments[${String(index)}] holds a private key: ${ALTERNATIVE}`);
+    }
+  }
+  for (const path of keyLeaves(extraKeys ?? {}, "extraKeys")) {
+    found.push(`${path} holds a private key: ${ALTERNATIVE}`);
+  }
+  return found;
+};
+var fileSecretProblems = (content) => PRIVATE_KEY.test(content) ? [`content holds a private key: ${ALTERNATIVE}`] : [];
+
+// src/launchd/host-file-form.ts
+var DEFAULT_MODE = 420;
+var identityProblems = (name, value) => {
+  if (value === undefined)
+    return [];
+  if (typeof value === "number") {
+    return Number.isSafeInteger(value) && value >= 0 ? [] : [`${name} must be a non-negative integer id`];
+  }
+  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\d+$/.test(value) ? [] : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];
+};
+var pathProblems = (path) => {
+  const found = [];
+  if (!path.startsWith("/"))
+    found.push("path must be absolute");
+  if (path.endsWith("/") || path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..")) {
+    found.push('path must be normalised (no trailing slash, no empty, "." or ".." segments)');
+  }
+  if (path.includes("\x00"))
+    found.push("path contains NUL");
+  return found;
+};
+var fileProblems = (props) => {
+  const found = pathProblems(props.path);
+  const mode = props.mode ?? DEFAULT_MODE;
+  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095)
+    found.push("mode must be 0–0o7777");
+  found.push(...identityProblems("owner", props.owner));
+  found.push(...identityProblems("group", props.group));
+  found.push(...fileSecretProblems(props.content));
+  return found;
+};
+
+// src/launchd/job-validate.ts
+var LABEL = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
+var RESERVED_LABEL_PREFIXES = [
+  "org.nixos.",
+  "com.apple.",
+  "homebrew.mxcl."
+];
+var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var RANGES = [
+  ["minute", 0, 59],
+  ["hour", 0, 23],
+  ["day", 1, 31],
+  ["weekday", 0, 7],
+  ["month", 1, 12]
+];
+var isInt = (value, min, max = Number.MAX_SAFE_INTEGER) => Number.isSafeInteger(value) && value >= min && value <= max;
+var calendarProblems = (entries) => {
+  if (entries.length === 0)
+    return ["startCalendarInterval is an empty list; omit it instead"];
+  const found = [];
+  for (const [index, entry] of entries.entries()) {
+    for (const [field, min, max] of RANGES) {
+      const value = entry[field];
+      if (value !== undefined && !isInt(value, min, max)) {
+        found.push(`startCalendarInterval[${String(index)}].${field} must be ${String(min)}–${String(max)}`);
+      }
+    }
+  }
+  return found;
+};
+var absolute = (name, value) => value === undefined || value.startsWith("/") ? [] : [`${name} must be an absolute path`];
+var identityProblems2 = (label, domainText) => {
+  const found = [];
+  if (!LABEL.test(label)) {
+    found.push("label must be 1–200 of [A-Za-z0-9._-], starting with a letter or digit");
+  }
+  const reserved = RESERVED_LABEL_PREFIXES.find((prefix) => label.startsWith(prefix));
+  if (reserved !== undefined) {
+    found.push(`label ${label} is under ${reserved}, which another tool owns; declare a new label`);
+  }
+  if (parseDomain(domainText) === undefined)
+    found.push(`domain must be 'system' or 'gui/<uid>', not ${domainText}`);
+  return found;
+};
+var jobProblems = (props) => {
+  const found = identityProblems2(props.label, props.domain);
+  const domain = parseDomain(props.domain);
+  const [program] = props.programArguments;
+  if (program === undefined)
+    found.push("programArguments must name a program");
+  else if (!program.startsWith("/"))
+    found.push("programArguments[0] must be an absolute path");
+  for (const name of Object.keys(props.environment ?? {})) {
+    if (!ENV_NAME.test(name))
+      found.push(`environment name ${JSON.stringify(name)} is not a valid variable name`);
+  }
+  found.push(...jobSecretProblems(props.environment, props.programArguments, props.extraKeys));
+  if (props.startInterval !== undefined && !isInt(props.startInterval, 1)) {
+    found.push("startInterval must be a positive whole number of seconds");
+  }
+  if (props.throttleInterval !== undefined && !isInt(props.throttleInterval, 0)) {
+    found.push("throttleInterval must be a non-negative whole number of seconds");
+  }
+  const calendar = props.startCalendarInterval;
+  if (calendar !== undefined) {
+    found.push(...calendarProblems(Array.isArray(calendar) ? calendar : [calendar]));
+  }
+  const keepAlive = props.keepAlive;
+  if (typeof keepAlive === "object" && keepAlive.successfulExit === undefined && keepAlive.crashed === undefined) {
+    found.push("keepAlive {} names no condition; use true, false, or a condition");
+  }
+  found.push(...absolute("standardOutPath", props.standardOutPath));
+  found.push(...absolute("standardErrorPath", props.standardErrorPath));
+  found.push(...absolute("workingDirectory", props.workingDirectory));
+  if (domain?.kind === "gui" && (props.userName !== undefined || props.groupName !== undefined)) {
+    found.push("userName/groupName apply only to the system domain; launchd ignores them for agents");
+  }
+  for (const key of Object.keys(props.extraKeys ?? {})) {
+    if (OWNED_KEYS.includes(key))
+      found.push(`extraKeys.${key} is owned by a typed prop; use that instead`);
+  }
+  return found;
+};
+
+// src/launchd/launchctl.ts
+var LAUNCHCTL = "/bin/launchctl";
+var NOT_FOUND = 113;
+var NO_DOMAIN = 112;
+var NO_DOMAIN_TEXT = "Could not find domain";
+
+class LaunchctlError extends Error {
+  constructor(command, exitCode, stderr) {
+    super(`launchctl ${command} -> ${String(exitCode)}: ${stderr.trim().slice(0, 300)}`);
+    this.name = "LaunchctlError";
+  }
+}
+var printFields = (stdout) => {
+  const fields = new Map;
+  const closers = [];
+  for (const line of stdout.split(`
+`)) {
+    if (closers.length === 0) {
+      if (fields.size === 0 && line.endsWith(" = {"))
+        closers.push("}");
+      continue;
+    }
+    if (line === closers[closers.length - 1]) {
+      closers.pop();
+      continue;
+    }
+    const opened = /^(\t+)\S.* = \{$/.exec(line);
+    if (opened?.[1] !== undefined && opened[1].length === closers.length) {
+      closers.push(`${opened[1]}}`);
+      continue;
+    }
+    const field = closers.length === 1 ? /^\t([a-z][a-z ]*[a-z]) = (.*)$/.exec(line) : null;
+    if (field?.[1] !== undefined && field[2] !== undefined && !fields.has(field[1])) {
+      fields.set(field[1], field[2]);
+    }
+  }
+  return fields;
+};
+var leadingInt = (text) => {
+  const match = text === undefined ? null : /^(-?\d+)/.exec(text);
+  return match?.[1] === undefined ? undefined : Number(match[1]);
+};
+var parsePrint = (stdout) => {
+  const fields = printFields(stdout);
+  const state = fields.get("state");
+  const pid = leadingInt(fields.get("pid"));
+  const lastExitCode = leadingInt(fields.get("last exit code"));
+  return {
+    loaded: true,
+    ...state === undefined ? {} : { state },
+    ...pid === undefined ? {} : { pid },
+    ...lastExitCode === undefined ? {} : { lastExitCode }
+  };
+};
+var parseDisabled = (stdout) => {
+  const disabled = new Set;
+  for (const match of stdout.matchAll(/^\s*"([^"]+)" => (\w+)\s*$/gm)) {
+    if (match[1] !== undefined && (match[2] === "disabled" || match[2] === "true")) {
+      disabled.add(match[1]);
+    }
+  }
+  return disabled;
+};
+var printService = async (runner, target) => {
+  const result = await runner.exec([LAUNCHCTL, "print", target]);
+  if (result.exitCode === NOT_FOUND)
+    return { loaded: false };
+  if (result.exitCode === NO_DOMAIN && result.stderr.includes(NO_DOMAIN_TEXT)) {
+    return { domainMissing: true, loaded: false };
+  }
+  if (result.exitCode !== 0)
+    throw new LaunchctlError(`print ${target}`, result.exitCode, result.stderr);
+  return parsePrint(result.stdout);
+};
+var isDisabled = async (runner, domain, label) => {
+  const result = await runner.exec([LAUNCHCTL, "print-disabled", domain]);
+  if (result.exitCode !== 0) {
+    throw new LaunchctlError(`print-disabled ${domain}`, result.exitCode, result.stderr);
+  }
+  return parseDisabled(result.stdout).has(label);
+};
+var bootstrap = async (runner, domain, plistPath) => {
+  const result = await runner.exec([LAUNCHCTL, "bootstrap", domain, plistPath]);
+  if (result.exitCode !== 0) {
+    throw new LaunchctlError(`bootstrap ${domain} ${plistPath}`, result.exitCode, result.stderr);
+  }
+};
+var waitUnloaded = async (runner, target, attempts = 120, intervalMs = 250) => {
+  for (let attempt = 0;attempt < attempts; attempt += 1) {
+    if (!(await printService(runner, target)).loaded)
+      return;
+    await runner.sleep(intervalMs);
+  }
+  throw new Error(`${target} is still loaded ${String(attempts * intervalMs / 1000)}s after bootout`);
+};
+var bootoutIfLoaded = async (runner, target) => {
+  if (!(await printService(runner, target)).loaded)
+    return;
+  const result = await runner.exec([LAUNCHCTL, "bootout", target]);
+  try {
+    await waitUnloaded(runner, target);
+  } catch (cause) {
+    if (result.exitCode === 0)
+      throw cause;
+    throw new LaunchctlError(`bootout ${target}`, result.exitCode, `${result.stderr.trim()} (and still loaded after waiting)`);
+  }
+};
+
+// src/launchd/sudo-allowlist.ts
+class SudoRefusedError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SudoRefusedError";
+  }
+}
+var SUDO = "/usr/bin/sudo";
+var INSTALL = "/usr/bin/install";
+var RM = "/bin/rm";
+var WRITES = new Set(["bootstrap", "bootout", "kickstart"]);
+var octalMode = (mode) => Number.isSafeInteger(mode) && mode >= 0 && mode <= 4095 ? mode.toString(8).padStart(4, "0") : undefined;
+var checkPrefixes = (prefixes) => {
+  if (prefixes.length === 0) {
+    throw new Error("sudoRunner: no prefixes. Name the directories root may write, e.g. /Library/LaunchDaemons.");
+  }
+  for (const prefix of prefixes) {
+    const found = prefix === "/" ? ['"/" would allow every path'] : pathProblems(prefix);
+    if (found.length > 0) {
+      throw new Error(`sudoRunner: prefix ${JSON.stringify(prefix)}: ${found.join("; ")}`);
+    }
+  }
+  return [...prefixes];
+};
+var prefixOf = (path, prefixes) => pathProblems(path).length > 0 ? undefined : prefixes.find((prefix) => path.startsWith(`${prefix}/`));
+var labelOk = (label) => LABEL.test(label) && !RESERVED_LABEL_PREFIXES.some((prefix) => label.startsWith(prefix));
+var systemLabel = (target) => {
+  const label = target?.startsWith("system/") === true ? target.slice("system/".length) : undefined;
+  return label !== undefined && labelOk(label) ? label : undefined;
+};
+var daemonPlist = (label, prefixes) => {
+  const path = plistPathFor(label, { kind: "system" }, undefined);
+  return prefixOf(path, prefixes) === undefined ? undefined : path;
+};
+var NO_DAEMON_PREFIX = "needs /Library/LaunchDaemons among the prefixes, where the job’s plist is written and removed";
+var launchctlProblem = (args, prefixes) => {
+  const [sub, ...rest] = args;
+  if (sub === "bootstrap") {
+    const given = rest[1] ?? "";
+    const name = given.slice(given.lastIndexOf("/") + 1);
+    const label = name.endsWith(".plist") ? name.slice(0, -".plist".length) : "";
+    const shaped = rest.length === 2 && rest[0] === "system" && labelOk(label);
+    if (!shaped)
+      return "bootstrap takes exactly `system /Library/LaunchDaemons/<label>.plist`";
+    const plist = daemonPlist(label, prefixes);
+    if (plist === undefined)
+      return `bootstrap ${NO_DAEMON_PREFIX}`;
+    return given === plist ? undefined : `bootstrap loads only ${plist}, never another path`;
+  }
+  if (sub === "bootout") {
+    const label = rest.length === 1 ? systemLabel(rest[0]) : undefined;
+    if (label === undefined)
+      return "bootout takes exactly `system/<label>`, never a bare domain";
+    return daemonPlist(label, prefixes) === undefined ? `bootout ${NO_DAEMON_PREFIX}` : undefined;
+  }
+  if (sub === "kickstart") {
+    const flags = rest.slice(0, -1);
+    const flagsOk = flags.every((flag) => flag === "-k" || flag === "-p") && new Set(flags).size === flags.length;
+    return flagsOk && systemLabel(rest[rest.length - 1]) !== undefined ? undefined : "kickstart takes only -k / -p, then `system/<label>`";
+  }
+  return `launchctl ${String(sub)} is never run as root`;
+};
+var ID = /^\d+$/;
+var idsOk = (ids) => {
+  const [flag, id, second, secondId] = ids;
+  if (ids.length === 0)
+    return true;
+  if (ids.length === 2)
+    return (flag === "-o" || flag === "-g") && ID.test(id ?? "");
+  return ids.length === 4 && flag === "-o" && ID.test(id ?? "") && second === "-g" && ID.test(secondId ?? "");
+};
+var privilegedProblem = (argv, context) => {
+  const [program, ...args] = argv;
+  const under = (path) => path !== undefined && prefixOf(path, context.prefixes) !== undefined;
+  if (program === LAUNCHCTL)
+    return launchctlProblem(args, context.prefixes);
+  if (program === INSTALL) {
+    const [safe, m, mode, ...rest] = args;
+    if (safe !== "-S" || m !== "-m" || mode === undefined || !/^[0-7]{4}$/.test(mode)) {
+      return "install takes exactly `-S -m <4 octal digits> [-o <uid>] [-g <gid>] <staged> <dest>`";
+    }
+    if (rest.length < 2 || !idsOk(rest.slice(0, -2)))
+      return "install takes only -o <uid> -g <gid>";
+    const [source, dest] = rest.slice(-2);
+    if (source === undefined || source !== context.staged) {
+      return "install copies only the file this runner staged";
+    }
+    return under(dest) ? undefined : "install destination is not under a declared prefix";
+  }
+  if (program === RM) {
+    const [force, end, path, ...extra] = args;
+    return force === "-f" && end === "--" && extra.length === 0 && under(path) ? undefined : "rm takes exactly `-f -- <path under a declared prefix>`";
+  }
+  return `${String(program)} is not on the sudo allowlist`;
+};
+var routeExec = (argv, operatorUid) => {
+  const [program, sub] = argv;
+  if (program === "sudo" || program?.endsWith("/sudo") === true) {
+    return {
+      refuse: "sudoRunner never passes a sudo argv through; it elevates only its allowlist"
+    };
+  }
+  if (program !== LAUNCHCTL || sub === undefined || !WRITES.has(sub))
+    return { as: "operator" };
+  const target = sub === "kickstart" ? argv[argv.length - 1] : argv[2];
+  if (target === "system" || target?.startsWith("system/") === true)
+    return { as: "root" };
+  const owner = /^(?:gui|user)\/(\d+)(?:\/|$)/.exec(target ?? "")?.[1];
+  if (owner === undefined || Number(owner) === operatorUid)
+    return { as: "operator" };
+  return {
+    refuse: `launchctl ${sub} ${String(target)}: that domain belongs to uid ${owner}, and sudoRunner ` + "elevates only the system domain. Deploy as that user, or as root."
+  };
+};
+
+// src/linux/sudo-allowlist-dir.ts
+var MKDIR = "/usr/bin/mkdir";
+var CHMOD = "/usr/bin/chmod";
+var CHOWN = "/usr/bin/chown";
+var RMDIR = "/usr/bin/rmdir";
+var parseDirMode = (text) => /^([0-7]{3}|[1-7][0-7]{3})$/.test(text) ? Number.parseInt(text, 8) : undefined;
+var DANGEROUS_MODE_BITS = 3090;
+var dirModeProblem = (mode) => {
+  if (mode === undefined)
+    return "mode";
+  return (mode & DANGEROUS_MODE_BITS) !== 0 ? "a mode with setuid/setgid or group/other write (this runner installs only 0–0o777 minus 0o022, no special bits)" : undefined;
+};
+var ROOT_OWNER = /^(\+0|:\+0|\+0:\+0)$/;
+var dirProgramProblem = (program, args, prefixes) => {
+  const under = (path2) => path2 !== undefined && prefixOf(path2, prefixes) !== undefined;
+  if (program === MKDIR) {
+    const [m, modeText, end2, path2, ...extra2] = args;
+    const mode = modeText === undefined ? undefined : parseDirMode(modeText);
+    if (m !== "-m" || mode === undefined || end2 !== "--" || extra2.length !== 0 || !under(path2)) {
+      return "mkdir takes exactly `-m <octal> -- <path under a declared prefix>`";
+    }
+    return dirModeProblem(mode);
+  }
+  if (program === CHMOD) {
+    const [modeText, end2, path2, ...extra2] = args;
+    const mode = modeText === undefined ? undefined : parseDirMode(modeText);
+    if (mode === undefined || end2 !== "--" || extra2.length !== 0 || !under(path2)) {
+      return "chmod takes exactly `<octal> -- <path under a declared prefix>`";
+    }
+    return dirModeProblem(mode);
+  }
+  if (program === CHOWN) {
+    const [owner, end2, path2, ...extra2] = args;
+    return owner !== undefined && ROOT_OWNER.test(owner) && end2 === "--" && extra2.length === 0 && under(path2) ? undefined : "chown takes exactly `+0`, `:+0` or `+0:+0` -- <path under a declared prefix>` — root " + "only, forced numeric; a directory this runner elevates never hands ownership to anyone else";
+  }
+  const [end, path, ...extra] = args;
+  return end === "--" && extra.length === 0 && under(path) ? undefined : "rmdir takes exactly `-- <path under a declared prefix>`";
+};
+
+// src/linux/sudo-allowlist-chown.ts
+var forceNumericOwner = (spec) => {
+  const [uidPart, gidPart] = spec.includes(":") ? spec.split(":") : [spec, undefined];
+  const uid = uidPart === undefined || uidPart === "" ? "" : `+${uidPart}`;
+  const gid = gidPart === undefined ? "" : `:+${gidPart}`;
+  return `${uid}${gid}`;
+};
+var SAFE_OWNER = /^(\+\d+(:\+\d+)?|:\+\d+)$/;
+var fileChownProblem = (args, temp) => {
+  const [owner, end, path, ...extra] = args;
+  if (owner !== undefined && SAFE_OWNER.test(owner) && end === "--" && extra.length === 0 && path === temp) {
+    return;
+  }
+  return "chown on the staged temp takes exactly `+<uid>`, `:+<gid>` or `+<uid>:+<gid>` -- " + "<the exact temp install just wrote>, numeric and +-forced";
+};
+var chownProblem = (args, context) => {
+  const path = args[args.length - 1];
+  if (context.temp !== undefined && path === context.temp)
+    return fileChownProblem(args, context.temp);
+  return dirProgramProblem(CHOWN, args, context.prefixes);
+};
+// src/linux/sudo-allowlist.ts
+var MV = "/usr/bin/mv";
+var RM2 = "/usr/bin/rm";
+var SYSTEMCTL_ABS = "/usr/bin/systemctl";
+var DIRECTORY_PROGRAMS = new Set([
+  "mkdir",
+  "chmod",
+  "chown",
+  "rmdir"
+]);
+var DIRECTORY_PROGRAMS_ABS = new Set([MKDIR, CHMOD, CHOWN, RMDIR]);
+var ABS_OF = {
+  chmod: CHMOD,
+  chown: CHOWN,
+  mkdir: MKDIR,
+  rmdir: RMDIR,
+  systemctl: SYSTEMCTL_ABS
+};
+var canonicalize = (argv) => {
+  const abs = ABS_OF[argv[0] ?? ""];
+  const program = abs ?? argv[0];
+  if (program === CHOWN) {
+    const [owner, ...rest] = argv.slice(1);
+    return [CHOWN, owner === undefined ? "" : forceNumericOwner(owner), ...rest];
+  }
+  return abs === undefined ? argv : [abs, ...argv.slice(1)];
+};
+var dirOf = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var installProblem = (args, context) => {
+  const [m, mode, t, dd, source, dest, ...extra] = args;
+  if (m !== "-m" || mode === undefined || !/^[0-7]{4}$/.test(mode) || t !== "-T" || dd !== "--" || extra.length !== 0) {
+    return "install takes exactly `-m <4 octal digits> -T -- <staged> <temp>`";
+  }
+  if (source === undefined || source !== context.staged) {
+    return "install copies only the file this runner staged";
+  }
+  if (dest === undefined || dest !== context.temp) {
+    return "install writes only the derived temp path for this write";
+  }
+  return prefixOf(dest, context.prefixes) === undefined ? "install destination is not under a declared prefix" : undefined;
+};
+var mvProblem = (args, context) => {
+  const [f, t, dd, source, dest] = args;
+  if (f !== "-f" || t !== "-T" || dd !== "--" || args.length !== 5) {
+    return "mv takes exactly `-f -T -- <temp> <dest>`";
+  }
+  if (source === undefined || source !== context.temp) {
+    return "mv moves only the temp path this runner just installed to";
+  }
+  if (dest === undefined || prefixOf(dest, context.prefixes) === undefined) {
+    return "mv destination is not under a declared prefix";
+  }
+  return dirOf(source) === dirOf(dest) ? undefined : "mv must stay inside the destination’s directory";
+};
+var rmProblem = (args, context) => {
+  const [force, end, path, ...extra] = args;
+  return force === "-f" && end === "--" && extra.length === 0 && path !== undefined && prefixOf(path, context.prefixes) !== undefined ? undefined : "rm takes exactly `-f -- <path under a declared prefix>`";
+};
+var BANNED_SYSTEMCTL_FLAGS = new Set([
+  "--user",
+  "--global",
+  "-H",
+  "-M",
+  "--root"
+]);
+var UNIT_WRITE_VERBS = new Set([
+  "enable",
+  "disable",
+  "start",
+  "stop",
+  "restart"
+]);
+var systemctlProblem = (args, prefixes) => {
+  if (args.some((arg) => BANNED_SYSTEMCTL_FLAGS.has(arg))) {
+    return "systemctl --user/--global/-H/-M/--root is never run as root";
+  }
+  const [verb, ...rest] = args;
+  if (verb === "daemon-reload")
+    return rest.length === 0 ? undefined : "daemon-reload takes no operands";
+  if (verb !== undefined && UNIT_WRITE_VERBS.has(verb)) {
+    const [dd, unit, ...extra] = rest;
+    return dd === "--" && unit !== undefined && NAME.test(unit) && extra.length === 0 ? undefined : `${verb} takes exactly \`-- <unit>\``;
+  }
+  return `systemctl ${String(verb)} is never run as root`;
+};
+var privilegedProblem2 = (argv, context) => {
+  const [program, ...args] = argv;
+  if (program === INSTALL)
+    return installProblem(args, context);
+  if (program === MV)
+    return mvProblem(args, context);
+  if (program === RM2)
+    return rmProblem(args, context);
+  if (program === SYSTEMCTL_ABS)
+    return systemctlProblem(args, context.prefixes);
+  if (program === CHOWN)
+    return chownProblem(args, context);
+  if (program === MKDIR || program === CHMOD || program === RMDIR) {
+    return dirProgramProblem(program, args, context.prefixes);
+  }
+  return `${String(program)} is not on the sudo allowlist`;
+};
+var routeExec2 = (argv, prefixes) => {
+  const [program, ...args] = argv;
+  if (program === "sudo" || program?.endsWith("/sudo") === true) {
+    return {
+      refuse: "sshSudoRunner never passes a sudo argv through; it elevates only its allowlist"
+    };
+  }
+  if (program === "systemctl" || program === SYSTEMCTL_ABS) {
+    if (args.some((arg) => BANNED_SYSTEMCTL_FLAGS.has(arg))) {
+      return { refuse: "sshSudoRunner refuses systemctl --user/--global/-H/-M/--root" };
+    }
+    const [verb] = args;
+    return verb === "daemon-reload" || verb !== undefined && UNIT_WRITE_VERBS.has(verb) ? { as: "root" } : { as: "operator" };
+  }
+  if (DIRECTORY_PROGRAMS.has(program ?? "") || DIRECTORY_PROGRAMS_ABS.has(program ?? "")) {
+    const path = args[args.length - 1];
+    return path !== undefined && prefixOf(path, prefixes) !== undefined ? { as: "root" } : { as: "operator" };
+  }
+  return { as: "operator" };
+};
+
+// src/ceph/ceph-transport.ts
+var CONNECT_TIMEOUT_SEC = 10;
+var EXEC_TIMEOUT_MS = 30000;
+var sshCephDial = async (node, argv) => {
+  const nonce = randomBytes2(8).toString("hex");
+  const script = `${SUDO} -n -- ${quoteArgv(argv)}`;
+  return runRemote({ connectTimeoutSec: CONNECT_TIMEOUT_SEC, execTimeoutMs: EXEC_TIMEOUT_MS, host: node }, nonce, script);
+};
+var defaultLog = (line) => process.stderr.write(`${line}
+`);
+var runCephCommand = async (options, argv) => {
+  const problem = cephCommandProblem(argv);
+  if (problem !== undefined) {
+    throw new SudoRefusedError(`ceph transport refused ${JSON.stringify(argv)}: ${problem}`);
+  }
+  if (options.nodes.length === 0)
+    throw new Error("ceph transport: no mon nodes were declared");
+  const dial = options.dial ?? sshCephDial;
+  const log = options.log ?? defaultLog;
+  const attempts = [];
+  for (const node of options.nodes) {
+    log(`homeflare/ceph sudo -n ${JSON.stringify(argv)} @ ${node}`);
+    try {
+      const result = await dial(node, argv);
+      return { ...result, node };
+    } catch (cause) {
+      attempts.push({ message: cause instanceof Error ? cause.message : String(cause), node });
+    }
+  }
+  const detail = attempts.map((a) => `${a.node}: ${a.message}`).join("; ");
+  throw new Error(`ceph transport: every mon node failed (never treated as absent) — ${detail}`);
+};
+var assertFreshQuorum = async (options) => {
+  const result = await runCephCommand(options, quorumStatusArgv());
+  if (result.exitCode !== 0) {
+    throw new Error(`ceph quorum_status failed after a write (mon ${result.node}): ` + `${result.stderr.trim().slice(0, 300)}`);
+  }
+  const quorum = parseQuorumStatus(result.stdout);
+  if (!quorum.healthy) {
+    throw new Error(`ceph quorum degraded after a write (mon ${result.node}): ${quorum.reason} — the write is ` + "reported as failed even if it landed; nothing here auto-repairs a quorum problem.");
+  }
+};
+
+// src/ceph/ceph-auth-reconcile.ts
+var asError = (cause) => cause instanceof Error ? cause : new Error(String(cause));
+var runCeph = (transport, argv) => Effect2.tryPromise({ catch: asError, try: () => runCephCommand(transport, argv) });
+var syncQuorum = (transport) => Effect2.tryPromise({ catch: asError, try: () => assertFreshQuorum(transport) });
+var neverAdopted = (entity) => new Error(`Ceph.AuthEntity ${entity}: already exists on the mon cluster and this stack holds no state ` + "for it. This family is never adopted — not even under --adopt — because taking it over " + "would mean fingerprinting a key this stack did not mint. Remove it by hand first, or bring " + "it under management through the coordinator’s own read-only inventory process.");
+var movedIdentity = (from, to) => new Error(`Ceph.AuthEntity: planned as an update, but its identity moved from ${from} to ${to}. ` + `Acting on ${to} now, with ${from}'s attributes, could re-cap an entity this generation ` + "never minted. Nothing was sent to any mon. Run the deploy again: once entity/mount fully " + "resolve at plan time this plans as a replace instead.");
+var reconcileCephAuthEntity = (props, output, deps) => Effect2.gen(function* () {
+  if (identityMoved(props, output))
+    return yield* Effect2.fail(movedIdentity(output?.entity ?? "", props.entity));
+  const transport = { nodes: props.nodes, ...deps };
+  const observed = yield* runCeph(transport, authGetArgv(props.entity)).pipe(Effect2.map((result2) => parseAuthGet(result2, props.entity)));
+  if (observed.kind === "absent") {
+    yield* baoWrite("POST", cephDataPath(props.mount, props.entity), {
+      data: { pending: true }
+    });
+    const result2 = yield* runCeph(transport, authGetOrCreateArgv(props.entity, props.caps));
+    const created = parseAuthGetOrCreate(result2, props.entity);
+    yield* baoWrite("POST", cephDataPath(props.mount, props.entity), {
+      data: { caps: created.caps, key: created.key }
+    });
+    yield* syncQuorum(transport);
+    return attributesOf(props, sha256(created.key), result2.node);
+  }
+  if (output === undefined)
+    return yield* Effect2.fail(neverAdopted(props.entity));
+  if (capsEqual(observed.caps, props.caps))
+    return output;
+  const result = yield* runCeph(transport, authCapsArgv(props.entity, props.caps));
+  yield* syncQuorum(transport);
+  return attributesOf(props, output.fingerprint, result.node);
+});
+
+// src/ceph/auth-entity.ts
+var CephAuthEntity = Resource("Ceph.AuthEntity", {
+  defaultRemovalPolicy: "retain"
+});
+var refusedDelete = (entity) => new Error(`Ceph.AuthEntity ${entity}: 'ceph auth del' is refused entirely — lockout safety, never ` + "auto-delete (D3). Nothing was sent to any mon. If the entity truly must go, remove it by " + "hand, deliberately, along with its OpenBao key — this family will never do it for you.");
+var CephAuthEntityProvider = () => Provider.effect(CephAuthEntity, Effect3.succeed(CephAuthEntity.Provider.of({
+  list: () => Effect3.succeed([]),
+  read: ({ output }) => Effect3.succeed(output),
+  diff: ({ news, output }) => Effect3.succeed(isResolved(news) ? planCephAuthEntity(news, output) : undefined),
+  reconcile: ({ news, output }) => reconcileCephAuthEntity(news, output, {}),
+  delete: ({ output }) => Effect3.die(refusedDelete(output.entity))
+})));
+export {
+  CephAuthEntity,
+  CephAuthEntityProvider,
+  assertFreshQuorum,
+  runCephCommand,
+  sshCephDial
+};
+
+//# debugId=B185E625634786EC64756E2164756E21
+//# sourceMappingURL=index.js.map