@homeflare/alchemy 0.39.0 → 0.40.0

package/README.md

@@ -304,14 +304,16 @@ import { ArgocdRepository, providers } from '@homeflare/alchemy/argocd';
 
 ## UniFi Network — `@homeflare/alchemy/unifi`
 
-`Unifi.Network` and `Unifi.FirewallZone`, generated from Ubiquiti's own UniFi Network
-Integration API 10.4.57 via `@distilled.cloud/unifi-network`. ⛔ **READ-ONLY, by Tim's rule
-(2026-09-24):** `reconcile`/`delete` both fail with a typed `UnifiWriteRefused` naming the
-policy — this family never calls a write operation, only `getNetworkDetails`/`getFirewallZone`
-and their list counterparts. ⛔ `read` answers `Unowned` on every match (never a silent adopt —
-`adopt(true)` is on by default via the `network`/`firewallZone` constructors), and a UniFi
-**Console ID** (part of a cloud-connector base URL) is never logged, committed or written to
-state: [docs/unifi.md](./docs/unifi.md).
+`Unifi.Network`, `Unifi.FirewallZone`, `Unifi.DnsPolicy`, `Unifi.AclRule` and
+`Unifi.AclRuleOrdering`, generated from Ubiquiti's own UniFi Network Integration API 10.4.57 via
+`@distilled.cloud/unifi-network`. ⛔ **READ-ONLY, by Tim's rule (2026-09-24):** `reconcile`/`delete`
+both fail with a typed `UnifiWriteRefused` naming the policy — no family here calls a write
+operation, only each object's own `get*` and its list counterpart. ⛔ `read` answers `Unowned` on
+every match (never a silent adopt — `adopt(true)` is on by default via each convenience
+constructor), and a UniFi **Console ID** (part of a cloud-connector base URL) is never logged,
+committed or written to state: [docs/unifi.md](./docs/unifi.md) (Network/FirewallZone),
+[docs/unifi-dns-policy.md](./docs/unifi-dns-policy.md) and
+[docs/unifi-acl-rule.md](./docs/unifi-acl-rule.md).
 
 ```ts
 import { declareNetwork, network, providers } from '@homeflare/alchemy/unifi';

package/dist/ceph/auth-entity.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `Ceph.AuthEntity` (K-A4) — a Ceph client auth entity (`client.k8s-*`), minted over the ssh
+ * mon-command transport and stored only in OpenBao. Design: docs/plans/2026-09-26-ceph-mon-
+ * transport.md, "`Ceph.AuthEntity` (K-A4)"; the loop itself lives in ceph-auth-reconcile.ts, the
+ * transport in ceph-transport.ts, the allowlist in ceph-argv.ts.
+ *
+ * ⛔ `read` AND `diff` NEVER SSH. "A plan never elevates" (../linux/sudo-runner.ts's own header
+ *   makes the same rule for the file family): this family's props/state comparison is the whole
+ *   of `diff`, and `read` hands back exactly the attributes state already holds. Live drift is
+ *   caught only at `reconcile` (which does elevate, on the admin lane) and by the post-deploy
+ *   operator check — this family cannot prove live convergence at plan time, and says so rather
+ *   than pretending an unprivileged probe exists where none does.
+ * ⛔ `delete` IS REFUSED UNCONDITIONALLY. `defaultRemovalPolicy: 'retain'` keeps Alchemy from ever
+ *   calling it on an ordinary `destroy`, and the handler itself refuses too — belt and suspenders
+ *   with ceph-argv.ts's own refusal of the `auth del` shape, so there is no path, `--adopt` or a
+ *   resource-level removal-policy override included, that ever reaches it (D3).
+ * ⛔ NEVER ADOPTED. See ceph-auth-reconcile.ts's header for why the generic `refuseTakeover` is not
+ *   used here.
+ * ⛔ ROWS ARE CREATES THROUGH THE FIRST-CREATE GATE, NO `adopt()` — `list` answers empty, the same
+ *   as every Ceph family in this kit (ceph-pool.ts's header has the reason a non-empty list would
+ *   invite exactly the takeover this family refuses).
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { CephAuthEntityAttributes, CephAuthEntityProps } from './ceph-auth-form.ts';
+export type { CephAuthEntityAttributes, CephAuthEntityProps } from './ceph-auth-form.ts';
+export type { CephCaps } from './ceph-auth-parse.ts';
+export interface CephAuthEntity extends Resource<'Ceph.AuthEntity', CephAuthEntityProps, CephAuthEntityAttributes, never, HttpClient.HttpClient> {
+}
+/** ★ `retain` — the delete handler below refuses regardless, but this stops Alchemy calling it. */
+export declare const CephAuthEntity: import("alchemy").ResourceClass<CephAuthEntity>;
+export declare const CephAuthEntityProvider: () => import("effect/Layer").Layer<Provider.Provider<CephAuthEntity>, never, HttpClient.HttpClient>;
+//# sourceMappingURL=auth-entity.d.ts.map

package/dist/ceph/auth-entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-entity.d.ts","sourceRoot":"","sources":["../../src/ceph/auth-entity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAIzF,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACzF,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,mGAAmG;AACnG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AASH,eAAO,MAAM,sBAAsB,qGAmBhC,CAAC"}

package/dist/ceph/ceph-argv-config.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `undefined` when `value` is a safe ceph config value — exported (like `boundedEntityProblem`)
+ * so the shape itself is directly testable, since `NAMED_CONFIG_OPTIONS` being empty today means
+ * `cephCommandProblem` never reaches this check on any real argv (`namedOptionProblem` refuses
+ * first) — this stays exercised until K-D's first named option arms the path for real.
+ */
+export declare const configValueProblem: (value: string) => string | undefined;
+/** `config get|set|rm <who> <name> [value]`, called with the operands after `config` stripped. */
+export declare const configProblem: (rest: readonly string[]) => string | undefined;
+//# sourceMappingURL=ceph-argv-config.d.ts.map

package/dist/ceph/ceph-argv-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-argv-config.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-argv-config.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,UAAW,MAAM,KAAG,MAAM,GAAG,SAG0B,CAAC;AAevF,kGAAkG;AAClG,eAAO,MAAM,aAAa,SAAU,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SAmBhE,CAAC"}

package/dist/ceph/ceph-argv.d.ts

@@ -0,0 +1,19 @@
+export { configValueProblem } from './ceph-argv-config.ts';
+/** ★ Absolute, so neither sudo nor `ceph` is looked up on the operator's PATH. */
+export declare const CEPH_BIN = "/usr/bin/ceph";
+/** Every entity this transport may ever touch starts with this. */
+export declare const ENTITY_PREFIX = "client.k8s-";
+/** `undefined` when `entity` is a name this transport may ever create, get or re-cap. */
+export declare const boundedEntityProblem: (entity: string) => string | undefined;
+declare const DAEMONS: readonly ['mon', 'osd', 'mgr'];
+/**
+ * `undefined` when `argv` is exactly an allowed ceph shape (the FULL argv `sudo -n` would run,
+ * `/usr/bin/ceph` included), else the reason it is not.
+ */
+export declare const cephCommandProblem: (argv: readonly string[]) => string | undefined;
+/** The exact argv for each allowed shape, so callers never hand-assemble one that could drift. */
+export declare const authGetArgv: (entity: string) => readonly string[];
+export declare const authGetOrCreateArgv: (entity: string, caps: Readonly<Record<(typeof DAEMONS)[number], string>>) => readonly string[];
+export declare const authCapsArgv: (entity: string, caps: Readonly<Record<(typeof DAEMONS)[number], string>>) => readonly string[];
+export declare const quorumStatusArgv: () => readonly string[];
+//# sourceMappingURL=ceph-argv.d.ts.map

package/dist/ceph/ceph-argv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-argv.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-argv.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,kFAAkF;AAClF,eAAO,MAAM,QAAQ,kBAAkB,CAAC;AAExC,mEAAmE;AACnE,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAK3C,yFAAyF;AACzF,eAAO,MAAM,oBAAoB,WAAY,MAAM,KAAG,MAAM,GAAG,SAGiD,CAAC;AAejH,QAAA,MAAM,OAAO,YAAI,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AA6E/C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,SAAU,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SAWrE,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,WAAW,WAAY,MAAM,KAAG,SAAS,MAAM,EAM3D,CAAC;AAEF,eAAO,MAAM,mBAAmB,WACtB,MAAM,QACR,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,KACvD,SAAS,MAAM,EAOjB,CAAC;AAEF,eAAO,MAAM,YAAY,WACf,MAAM,QACR,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,KACvD,SAAS,MAAM,EAOjB,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAO,SAAS,MAAM,EAIlD,CAAC"}

package/dist/ceph/ceph-auth-form.d.ts

@@ -0,0 +1,54 @@
+import type { CephCaps } from './ceph-auth-parse.ts';
+export type { CephCaps };
+export type CephAuthEntityProps = {
+    /** `client.k8s-<name>` — bounded by ceph-argv.ts's allowlist, checked on every transport call. */
+    readonly entity: string;
+    readonly caps: CephCaps;
+    /** TB4 mon ssh destinations, tried in this order (D1). At least one. */
+    readonly nodes: readonly string[];
+    /** OpenBao KV-v2 mount holding Talos/Ceph material, e.g. `talos-c1` (D2). */
+    readonly mount: string;
+};
+export type CephAuthEntityAttributes = {
+    readonly entity: string;
+    readonly caps: CephCaps;
+    /** `sha256(key)`, hex — never the key itself. */
+    readonly fingerprint: string;
+    /** CLI-style path (`<mount>/ceph/<entity>`) — safe to persist and log; the key is not here. */
+    readonly baoPath: string;
+    /** Which mon actually answered the write that produced this row. Never key material. */
+    readonly node: string;
+};
+export declare const capsEqual: (a: CephCaps, b: CephCaps) => boolean;
+/** The CLI-style path an operator's `bao kv get` would use — what `baoPath` records. */
+export declare const cephCliPath: (mount: string, entity: string) => string;
+/**
+ * The raw KV-v2 HTTP API path `../openbao/bao-http.ts`'s `baoRead`/`baoWrite` take — the CLI path
+ * with `data/` inserted, the same segment `bao kv get`/`bao kv put` insert themselves
+ * (`../talos/credentials.ts`'s header has the shipped-default bug this convention avoids: never
+ * include `data/` in the CLI-style path itself, only here).
+ */
+export declare const cephDataPath: (mount: string, entity: string) => string;
+export type CephAuthEntityPlan = {
+    readonly action: 'noop' | 'update' | 'replace';
+};
+/**
+ * Whether `output` (if any) names a different entity/mount than `news` declares — the one
+ * question both `planCephAuthEntity` and `reconcileCephAuthEntity`'s guard ask, so the comparison
+ * lives in exactly one place (rename-identity.ts's own header: "one description of which object,
+ * not twelve copies of the check").
+ */
+export declare const identityMoved: (news: Pick<CephAuthEntityProps, 'entity' | 'mount'>, output: CephAuthEntityAttributes | undefined) => boolean;
+/**
+ * ⛔ STATE ONLY, NO SSH — the design's own rule for this family ("a plan never elevates"; diff and
+ *   verify compare props against state, never the live cluster). `output === undefined` returns
+ *   `undefined`: a brand-new row plans as a create the same way every other family in this kit
+ *   does, and reconcile is where the actual ssh work — and the key material — ever appears.
+ *   A moved identity plans `replace` before caps are even considered: `defaultRemovalPolicy:
+ *   'retain'` means the old generation is simply left alone (Apply.ts skips its delete under
+ *   retain), and the new generation reconciles with `output: undefined`, which is exactly the
+ *   "never adopted" path if the new identity already has a live entity.
+ */
+export declare const planCephAuthEntity: (news: CephAuthEntityProps, output: CephAuthEntityAttributes | undefined) => CephAuthEntityPlan | undefined;
+export declare const attributesOf: (props: Pick<CephAuthEntityProps, 'caps' | 'entity' | 'mount'>, fingerprint: string, node: string) => CephAuthEntityAttributes;
+//# sourceMappingURL=ceph-auth-form.d.ts.map

package/dist/ceph/ceph-auth-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-auth-form.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-auth-form.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,YAAY,EAAE,QAAQ,EAAE,CAAC;AAEzB,MAAM,MAAM,mBAAmB,GAAG;IAChC,kGAAkG;IAClG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,eAAO,MAAM,SAAS,MAAO,QAAQ,KAAK,QAAQ,KAAG,OACE,CAAC;AAExD,wFAAwF;AACxF,eAAO,MAAM,WAAW,UAAW,MAAM,UAAU,MAAM,KAAG,MACZ,CAAC;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,YAAY,UAAW,MAAM,UAAU,MAAM,KAAG,MACR,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,CAAC;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,SAClB,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,OAAO,CAAC,UAC3C,wBAAwB,GAAG,SAAS,KAC3C,OAEyF,CAAC;AAE7F;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,SACvB,mBAAmB,UACjB,wBAAwB,GAAG,SAAS,KAC3C,kBAAkB,GAAG,SAIvB,CAAC;AAEF,eAAO,MAAM,YAAY,UAChB,IAAI,CAAC,mBAAmB,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,eAChD,MAAM,QACb,MAAM,KACX,wBAMD,CAAC"}

package/dist/ceph/ceph-auth-parse.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Parsing for the three ceph `-f json` shapes `Ceph.AuthEntity` reads: `auth get`, `auth
+ * get-or-create` and `quorum_status`. Pure: no I/O, tested with fixture stdout
+ * (ceph-auth-parse.test.ts) — there is no live mon to capture real output from yet, so every shape
+ * below is REASONED from public Ceph documentation, not measured, and an unexpected shape is
+ * always an error, never a guess.
+ *
+ * ⛔ `parseAuthGet`'S RETURN TYPE HAS NO `key` FIELD. Decision 65 (2026-09-26, LAND finding 5)
+ *   amended the design to let the observe step read `auth get`'s unfiltered stdout on every
+ *   reconcile, not only on create — but the key it carries is dropped in the same breath:
+ *   `parseKeyringEntry` reads it into a local binding and `parseAuthGet` never puts it in the
+ *   object it returns. Not a convention, a type: there is no field here to forget to strip.
+ * ⛔ `parseQuorumStatus` FAILS CLOSED. A JSON parse error, a missing `quorum` array or an empty one
+ *   all answer `{ healthy: false }`; nothing here ever calls an unparseable answer healthy.
+ */
+export type CephCaps = {
+    readonly mon: string;
+    readonly osd: string;
+    readonly mgr: string;
+};
+export type CephExecOutcome = {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+};
+export type CephAuthObserved = {
+    readonly kind: 'present';
+    readonly caps: CephCaps;
+} | {
+    readonly kind: 'absent';
+};
+/**
+ * ⚠️ ABSENCE IS RECOGNISED ONLY BY `ENOENT` IN STDERR (REASONED from `ceph auth get`'s documented
+ *   error text). Any other nonzero exit — a permission problem, a malformed entity ceph itself
+ *   refused, a mon mid-election — propagates as an error, never as "absent": the transient-read
+ *   test every family in this kit carries.
+ */
+export declare const parseAuthGet: (result: CephExecOutcome, entity: string) => CephAuthObserved;
+/**
+ * ⚠️ `get-or-create` NEVER READS AS ABSENT — REASONED: it either creates, returns the existing
+ *   entity unchanged, or fails outright (e.g. an existing entity with different caps). A nonzero
+ *   exit here is always an error.
+ */
+export declare const parseAuthGetOrCreate: (result: CephExecOutcome, entity: string) => {
+    readonly caps: CephCaps;
+    readonly key: string;
+};
+export type CephQuorum = {
+    readonly healthy: true;
+} | {
+    readonly healthy: false;
+    readonly reason: string;
+};
+/** REASONED shape (public `ceph quorum_status -f json` docs): an object with a `quorum` array. */
+export declare const parseQuorumStatus: (stdout: string) => CephQuorum;
+//# sourceMappingURL=ceph-auth-parse.d.ts.map

package/dist/ceph/ceph-auth-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-auth-parse.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-auth-parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5F,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AA6CF,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEhC;;;;;GAKG;AACH,eAAO,MAAM,YAAY,WAAY,eAAe,UAAU,MAAM,KAAG,gBAOtE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,WACvB,eAAe,UACf,MAAM,KACb;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAOjD,CAAC;AAEF,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,WAAY,MAAM,KAAG,UAYlD,CAAC"}

package/dist/ceph/ceph-auth-reconcile.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The observe -> ensure -> sync loop `Ceph.AuthEntity`'s reconcile runs (mon-transport doc,
+ * `Ceph.AuthEntity`). Split from auth-entity.ts so the loop itself — the part a fake-runner test
+ * actually exercises — is a plain function, the same split ceph-pool.ts and ssh-role.ts use.
+ *
+ * ⛔ NEVER ADOPTS. A live entity found present while this stack holds no attributes for it is
+ *   refused outright, `--adopt` included — the generic `refuseTakeover` (../ownership/adopt.ts)
+ *   is deliberately NOT used here, because it honours `--adopt` and this family's own design says
+ *   plainly: "Existing auth entities are recorded as observed inventory only — never adopted:
+ *   adopting one would mean reading and fingerprinting its key, and a key is only ever handled for
+ *   an entity this stack owns."
+ * ⛔ THE OBSERVE STEP READS `auth get`'S UNFILTERED STDOUT ON EVERY RECONCILE (decision 65,
+ *   2026-09-26, amending the design after LAND finding 5 — no node-side filter narrows it first).
+ *   The key that stdout carries is dropped in the same breath: `parseAuthGet` has no `key` field in
+ *   its return type at all, so there is no variable here ever holding it past that call. Only `auth
+ *   get-or-create`, run once on the create branch, yields a `key` value, and it goes straight to
+ *   OpenBao — never assigned to a variable this function returns, logs, or puts in the attributes
+ *   it hands back — `attributesOf` takes a fingerprint, never a key.
+ * ★ CAPS DRIFT NEVER RE-MINTS THE KEY. `auth caps` changes only what an entity may do; the returned
+ *   attributes reuse `output.fingerprint` unchanged.
+ * ⛔ A MOVED IDENTITY IS REFUSED HERE TOO, BELT AND SUSPENDERS WITH `planCephAuthEntity`'s
+ *   `replace`. `isResolved(news)` in auth-entity.ts's `diff` can defer to the engine's own
+ *   `update` fallback while any prop is still an Output (rename.ts's own header documents this
+ *   exact Alchemy behaviour for every other family this pattern protects) — a case in which
+ *   `planCephAuthEntity` never even runs. Reached with `output` naming a different entity/mount
+ *   than `props`, this refuses before any ssh call, the same shape of guard `guardRename`
+ *   (openbao/rename-identity.ts) runs first in every `Bao.*` reconcile.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type CephAuthEntityAttributes, type CephAuthEntityProps } from './ceph-auth-form.ts';
+import { type CephTransportOptions } from './ceph-transport.ts';
+export type CephAuthDeps = Pick<CephTransportOptions, 'dial' | 'log'>;
+export declare const reconcileCephAuthEntity: (props: CephAuthEntityProps, output: CephAuthEntityAttributes | undefined, deps: CephAuthDeps) => Effect.Effect<CephAuthEntityAttributes, Error, HttpClient.HttpClient>;
+//# sourceMappingURL=ceph-auth-reconcile.d.ts.map

package/dist/ceph/ceph-auth-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-auth-reconcile.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-auth-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,oBAAoB,EAAqC,MAAM,qBAAqB,CAAC;AAEnG,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;AA2BtE,eAAO,MAAM,uBAAuB,UAC3B,mBAAmB,UAClB,wBAAwB,GAAG,SAAS,QACtC,YAAY,KACjB,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CA2CnE,CAAC"}

package/dist/ceph/ceph-config-options.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The named Ceph config-option list — the only options `ceph config get/set/rm` may ever touch
+ * through the mon-command transport (ceph-argv.ts's `configProblem`). Design:
+ * docs/plans/2026-09-26-ceph-config-options.md, D-C1.
+ *
+ * ⛔ THE LIST STARTS EMPTY, AND EACH ADDITION IS ITS OWN REVIEWED PR LINE. Nothing in K-A4 adds to
+ *   it — `CephConfigOption` (K-D) is a separate, later family; this file exists now only so the
+ *   transport's allowlist has something to bound `config` against from day one, per the accepted
+ *   design ("config get/set for the named option list which starts EMPTY").
+ * ⛔ NEVER ADD ONE OF THE LOCKOUT CLASSES BELOW. `mon_host`, `public_network`, `cluster_network`,
+ *   `public_addr`, `cluster_addr`, every `auth_*_required` and every `key`/`keyring`-bearing
+ *   option re-address the mons or de-authenticate the whole cluster — cutting every VM disk — and
+ *   `isLockoutConfigOption` is a structural guard a test runs against this file's own list, not a
+ *   suggestion for the reviewer of the next PR line.
+ * ⛔ NEVER ADD A SECRET-VALUED OPTION. mgr module options can hold passwords (REASONED — no live
+ *   cluster to measure this against yet); a secret-bearing setting belongs in a vault-backed flow,
+ *   never a `ceph config set` argv, which lands in the runner's log and the node's sudo journal.
+ */
+/** Starts empty. Add one reviewed option name per PR line, never a batch. */
+export declare const NAMED_CONFIG_OPTIONS: ReadonlySet<string>;
+/** Whether `name` is a class this transport must never read a value for, adopt, or write. */
+export declare const isLockoutConfigOption: (name: string) => boolean;
+//# sourceMappingURL=ceph-config-options.d.ts.map

package/dist/ceph/ceph-config-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-config-options.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-config-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAe,CAAC;AAarE,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,SAAU,MAAM,KAAG,OACE,CAAC"}

package/dist/ceph/ceph-key-leak-assert.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Shared by the two test files that prove `Ceph.AuthEntity` never leaks a minted key through a
+ * parse-error message: ceph-auth-parse.test.ts (direct parser calls) and
+ * ceph-auth-reconcile-secrecy.test.ts (through the full reconcile loop). Split out so the leak
+ * check and the malformed-stdout fixtures are identical in both places — the property being
+ * proved (decision 65) is the same one, and two hand-copied versions are exactly the kind of thing
+ * that quietly drifts apart.
+ *
+ * ⛔ TEST-ONLY. Nothing in `src/` imports this outside a `.test.ts` file.
+ * ★ NO HYPHEN IN THE SENTINEL. LAND red team (2026-09-26), CONFIRMED: a JSON lexer's "unexpected
+ *   identifier" error for a bare (unquoted) token stops at the first character outside
+ *   `[A-Za-z0-9_$]`, so a hyphenated sentinel (`sentinel-ceph-key-...`) truncates to its first
+ *   word — `.not.toContain(SENTINEL)` on the FULL string then never fires even when that first
+ *   word leaked. Cephx keys are base64 (`[A-Za-z0-9+/=]`, no hyphen), so this sentinel is shaped
+ *   the same way, and every check here compares 8-character slices, not full-string containment.
+ */
+/** A cephx-shaped sentinel: looks like a real minted key, no hyphen anywhere to truncate on. */
+export declare const KEY_SHAPED_SENTINEL = "AQDsentinelKEYsentinelKEY0123456789abcd==";
+/** True if any 8-character window of `key` shows up anywhere in `message`. */
+export declare const leaksSliceOf: (message: string, key?: string) => boolean;
+/** `auth get`/`auth get-or-create` stdout with the key left as a bare (unquoted) JSON token. */
+export declare const unquotedKeyStdout: (entity: string, key?: string) => string;
+/** The same shape with a trailing comma after the entry — a different malformed-JSON path. */
+export declare const trailingCommaKeyStdout: (entity: string, key?: string) => string;
+//# sourceMappingURL=ceph-key-leak-assert.d.ts.map

package/dist/ceph/ceph-key-leak-assert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-key-leak-assert.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-key-leak-assert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,gGAAgG;AAChG,eAAO,MAAM,mBAAmB,8CAA8C,CAAC;AAE/E,8EAA8E;AAC9E,eAAO,MAAM,YAAY,YAAa,MAAM,QAAO,MAAM,KAAyB,OAKjF,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,WAAY,MAAM,QAAO,MAAM,KAAyB,MAC7C,CAAC;AAE1C,8FAA8F;AAC9F,eAAO,MAAM,sBAAsB,WAAY,MAAM,QAAO,MAAM,KAAyB,MAC/C,CAAC"}

package/dist/ceph/ceph-transport.d.ts

@@ -0,0 +1,37 @@
+export type CephExecResult = {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+};
+/** One attempt against one mon: run `argv` (already sudo-wrapped by the caller) and report. */
+export type CephDial = (node: string, argv: readonly string[]) => Promise<CephExecResult>;
+/** ★ A fresh nonce per attempt — this dial never reuses a connection or a marker across calls. */
+export declare const sshCephDial: CephDial;
+export type CephTransportOptions = {
+    /** TB4 mon ssh destinations, tried in this order. Required; at least one. */
+    readonly nodes: readonly string[];
+    readonly dial?: CephDial;
+    /** One line per attempted argv, before it dials. @default a line on stderr */
+    readonly log?: (line: string) => void;
+};
+/**
+ * Run one allowed ceph shape against the first mon that answers.
+ *
+ * ⛔ THE ALLOWLIST CHECK HAPPENS BEFORE THE FIRST NODE IS EVEN TRIED — a refused argv dials no
+ *   ssh at all, so a bug that builds a bad shape cannot leak so much as a connection attempt.
+ */
+export declare const runCephCommand: (options: CephTransportOptions, argv: readonly string[]) => Promise<CephExecResult & {
+    readonly node: string;
+}>;
+/**
+ * ★ LOCKOUT SAFETY, THE UFW-ESTABLISHED PATTERN: after every write, re-check quorum on a FRESH
+ *   connection (a new dial, never the one the write used) and fail the row if it degraded. Never
+ *   auto-repair, never continue — the caller's write is reported as failed even though it may
+ *   itself have succeeded, because a write that broke quorum is not a success this transport will
+ *   call one.
+ * ⚠️ THE SHAPE OF `quorum_status -f json` IS REASONED FROM PUBLIC CEPH DOCS, NOT MEASURED against
+ *   this estate's Ceph release — there is no mon yet. An unparseable or missing `quorum` array
+ *   fails closed as "degraded", never as "healthy"; see ceph-auth-parse.ts.
+ */
+export declare const assertFreshQuorum: (options: CephTransportOptions) => Promise<void>;
+//# sourceMappingURL=ceph-transport.d.ts.map

package/dist/ceph/ceph-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-transport.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-transport.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,+FAA+F;AAC/F,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAK1F,kGAAkG;AAClG,eAAO,MAAM,WAAW,EAAE,QAQzB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC,CAAC;AAIF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,YAChB,oBAAoB,QACvB,SAAS,MAAM,EAAE,KACtB,OAAO,CAAC,cAAc,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAsBpD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,YAAmB,oBAAoB,KAAG,OAAO,CAAC,IAAI,CAenF,CAAC"}

package/dist/ceph/fake-ceph-dial.d.ts

@@ -0,0 +1,35 @@
+/**
+ * A fake `CephDial` for the tests beside it — no ssh, no spawned process, ever. The same idea as
+ * `../linux/fake-sudo.ts` and `../openbao/fake-bao.ts`: production code is handed the real
+ * implementation, a test hands this instead, and neither one's internals change to make room for
+ * the other.
+ *
+ * ⛔ TEST-ONLY. Nothing in `src/` imports this outside a `.test.ts` file.
+ */
+import type { CephDial, CephExecResult } from './ceph-transport.ts';
+/** One call this fake received. */
+export type SeenCephCall = {
+    readonly node: string;
+    readonly argv: readonly string[];
+};
+/** What a scripted node answers: a result, or a thrown transport failure. */
+export type CephAnswer = {
+    readonly kind: 'result';
+    readonly result: CephExecResult;
+} | {
+    readonly kind: 'transport-error';
+    readonly message: string;
+};
+export type FakeCephDial = {
+    readonly dial: CephDial;
+    readonly seen: SeenCephCall[];
+};
+declare const ok: (stdout: string, exitCode?: number, stderr?: string) => CephAnswer;
+/**
+ * `script` maps a node to the fixed sequence of answers it gives, one per call that reaches it —
+ * the last entry repeats once exhausted. A node with no entry always transport-fails, which is
+ * exactly "an unreachable mon" without a special case.
+ */
+export declare const fakeCephDial: (script: Readonly<Record<string, readonly CephAnswer[]>>) => FakeCephDial;
+export { ok as fakeCephOk };
+//# sourceMappingURL=fake-ceph-dial.d.ts.map

package/dist/ceph/fake-ceph-dial.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-ceph-dial.d.ts","sourceRoot":"","sources":["../../src/ceph/fake-ceph-dial.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEpE,mCAAmC;AACnC,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvF,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;CAC/B,CAAC;AAEF,QAAA,MAAM,EAAE,WAAY,MAAM,yCAA8B,UAGtD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,YAAY,WACf,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC,CAAC,KACtD,YAiBF,CAAC;AAEF,OAAO,EAAE,EAAE,IAAI,UAAU,EAAE,CAAC"}

package/dist/ceph/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Ceph providers for Alchemy — the mon-command transport and `Ceph.AuthEntity` (K-A4).
+ *
+ * ⛔ THIS BARREL IS THE PUBLIC API, DELIBERATELY SMALLER THAN THE DIRECTORY — see
+ *   `../openbao/index.ts`'s header for why. The allowlist internals (ceph-argv.ts), the parsing
+ *   (ceph-auth-parse.ts) and the reconcile loop (ceph-auth-reconcile.ts) are exported by path for
+ *   a future `CephConfigOption` (K-D) or a test to reach directly, not published here.
+ */
+export type { CephAuthEntityAttributes, CephAuthEntityProps, CephCaps } from './auth-entity.ts';
+export { CephAuthEntity, CephAuthEntityProvider } from './auth-entity.ts';
+export type { CephDial, CephExecResult, CephTransportOptions } from './ceph-transport.ts';
+export { assertFreshQuorum, runCephCommand, sshCephDial } from './ceph-transport.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/ceph/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ceph/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC"}