@homeflare/alchemy 0.39.0 → 0.41.0

package/dist/ceph/ceph-key-leak-assert.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Shared by the two test files that prove `Ceph.AuthEntity` never leaks a minted key through a
+ * parse-error message: ceph-auth-parse.test.ts (direct parser calls) and
+ * ceph-auth-reconcile-secrecy.test.ts (through the full reconcile loop). Split out so the leak
+ * check and the malformed-stdout fixtures are identical in both places — the property being
+ * proved (decision 65) is the same one, and two hand-copied versions are exactly the kind of thing
+ * that quietly drifts apart.
+ *
+ * ⛔ TEST-ONLY. Nothing in `src/` imports this outside a `.test.ts` file.
+ * ★ NO HYPHEN IN THE SENTINEL. LAND red team (2026-09-26), CONFIRMED: a JSON lexer's "unexpected
+ *   identifier" error for a bare (unquoted) token stops at the first character outside
+ *   `[A-Za-z0-9_$]`, so a hyphenated sentinel (`sentinel-ceph-key-...`) truncates to its first
+ *   word — `.not.toContain(SENTINEL)` on the FULL string then never fires even when that first
+ *   word leaked. Cephx keys are base64 (`[A-Za-z0-9+/=]`, no hyphen), so this sentinel is shaped
+ *   the same way, and every check here compares 8-character slices, not full-string containment.
+ */
+/** A cephx-shaped sentinel: looks like a real minted key, no hyphen anywhere to truncate on. */
+export declare const KEY_SHAPED_SENTINEL = "AQDsentinelKEYsentinelKEY0123456789abcd==";
+/** True if any 8-character window of `key` shows up anywhere in `message`. */
+export declare const leaksSliceOf: (message: string, key?: string) => boolean;
+/** `auth get`/`auth get-or-create` stdout with the key left as a bare (unquoted) JSON token. */
+export declare const unquotedKeyStdout: (entity: string, key?: string) => string;
+/** The same shape with a trailing comma after the entry — a different malformed-JSON path. */
+export declare const trailingCommaKeyStdout: (entity: string, key?: string) => string;
+//# sourceMappingURL=ceph-key-leak-assert.d.ts.map

package/dist/ceph/ceph-key-leak-assert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-key-leak-assert.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-key-leak-assert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,gGAAgG;AAChG,eAAO,MAAM,mBAAmB,8CAA8C,CAAC;AAE/E,8EAA8E;AAC9E,eAAO,MAAM,YAAY,YAAa,MAAM,QAAO,MAAM,KAAyB,OAKjF,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,WAAY,MAAM,QAAO,MAAM,KAAyB,MAC7C,CAAC;AAE1C,8FAA8F;AAC9F,eAAO,MAAM,sBAAsB,WAAY,MAAM,QAAO,MAAM,KAAyB,MAC/C,CAAC"}

package/dist/ceph/ceph-transport.d.ts

@@ -0,0 +1,37 @@
+export type CephExecResult = {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+};
+/** One attempt against one mon: run `argv` (already sudo-wrapped by the caller) and report. */
+export type CephDial = (node: string, argv: readonly string[]) => Promise<CephExecResult>;
+/** ★ A fresh nonce per attempt — this dial never reuses a connection or a marker across calls. */
+export declare const sshCephDial: CephDial;
+export type CephTransportOptions = {
+    /** TB4 mon ssh destinations, tried in this order. Required; at least one. */
+    readonly nodes: readonly string[];
+    readonly dial?: CephDial;
+    /** One line per attempted argv, before it dials. @default a line on stderr */
+    readonly log?: (line: string) => void;
+};
+/**
+ * Run one allowed ceph shape against the first mon that answers.
+ *
+ * ⛔ THE ALLOWLIST CHECK HAPPENS BEFORE THE FIRST NODE IS EVEN TRIED — a refused argv dials no
+ *   ssh at all, so a bug that builds a bad shape cannot leak so much as a connection attempt.
+ */
+export declare const runCephCommand: (options: CephTransportOptions, argv: readonly string[]) => Promise<CephExecResult & {
+    readonly node: string;
+}>;
+/**
+ * ★ LOCKOUT SAFETY, THE UFW-ESTABLISHED PATTERN: after every write, re-check quorum on a FRESH
+ *   connection (a new dial, never the one the write used) and fail the row if it degraded. Never
+ *   auto-repair, never continue — the caller's write is reported as failed even though it may
+ *   itself have succeeded, because a write that broke quorum is not a success this transport will
+ *   call one.
+ * ⚠️ THE SHAPE OF `quorum_status -f json` IS REASONED FROM PUBLIC CEPH DOCS, NOT MEASURED against
+ *   this estate's Ceph release — there is no mon yet. An unparseable or missing `quorum` array
+ *   fails closed as "degraded", never as "healthy"; see ceph-auth-parse.ts.
+ */
+export declare const assertFreshQuorum: (options: CephTransportOptions) => Promise<void>;
+//# sourceMappingURL=ceph-transport.d.ts.map

package/dist/ceph/ceph-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-transport.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-transport.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,+FAA+F;AAC/F,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAK1F,kGAAkG;AAClG,eAAO,MAAM,WAAW,EAAE,QAQzB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC,CAAC;AAIF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,YAChB,oBAAoB,QACvB,SAAS,MAAM,EAAE,KACtB,OAAO,CAAC,cAAc,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAsBpD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,YAAmB,oBAAoB,KAAG,OAAO,CAAC,IAAI,CAenF,CAAC"}

package/dist/ceph/fake-ceph-dial.d.ts

@@ -0,0 +1,35 @@
+/**
+ * A fake `CephDial` for the tests beside it — no ssh, no spawned process, ever. The same idea as
+ * `../linux/fake-sudo.ts` and `../openbao/fake-bao.ts`: production code is handed the real
+ * implementation, a test hands this instead, and neither one's internals change to make room for
+ * the other.
+ *
+ * ⛔ TEST-ONLY. Nothing in `src/` imports this outside a `.test.ts` file.
+ */
+import type { CephDial, CephExecResult } from './ceph-transport.ts';
+/** One call this fake received. */
+export type SeenCephCall = {
+    readonly node: string;
+    readonly argv: readonly string[];
+};
+/** What a scripted node answers: a result, or a thrown transport failure. */
+export type CephAnswer = {
+    readonly kind: 'result';
+    readonly result: CephExecResult;
+} | {
+    readonly kind: 'transport-error';
+    readonly message: string;
+};
+export type FakeCephDial = {
+    readonly dial: CephDial;
+    readonly seen: SeenCephCall[];
+};
+declare const ok: (stdout: string, exitCode?: number, stderr?: string) => CephAnswer;
+/**
+ * `script` maps a node to the fixed sequence of answers it gives, one per call that reaches it —
+ * the last entry repeats once exhausted. A node with no entry always transport-fails, which is
+ * exactly "an unreachable mon" without a special case.
+ */
+export declare const fakeCephDial: (script: Readonly<Record<string, readonly CephAnswer[]>>) => FakeCephDial;
+export { ok as fakeCephOk };
+//# sourceMappingURL=fake-ceph-dial.d.ts.map

package/dist/ceph/fake-ceph-dial.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-ceph-dial.d.ts","sourceRoot":"","sources":["../../src/ceph/fake-ceph-dial.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEpE,mCAAmC;AACnC,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvF,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;CAC/B,CAAC;AAEF,QAAA,MAAM,EAAE,WAAY,MAAM,yCAA8B,UAGtD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,YAAY,WACf,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC,CAAC,KACtD,YAiBF,CAAC;AAEF,OAAO,EAAE,EAAE,IAAI,UAAU,EAAE,CAAC"}

package/dist/ceph/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Ceph providers for Alchemy — the mon-command transport and `Ceph.AuthEntity` (K-A4).
+ *
+ * ⛔ THIS BARREL IS THE PUBLIC API, DELIBERATELY SMALLER THAN THE DIRECTORY — see
+ *   `../openbao/index.ts`'s header for why. The allowlist internals (ceph-argv.ts), the parsing
+ *   (ceph-auth-parse.ts) and the reconcile loop (ceph-auth-reconcile.ts) are exported by path for
+ *   a future `CephConfigOption` (K-D) or a test to reach directly, not published here.
+ */
+export type { CephAuthEntityAttributes, CephAuthEntityProps, CephCaps } from './auth-entity.ts';
+export { CephAuthEntity, CephAuthEntityProvider } from './auth-entity.ts';
+export type { CephDial, CephExecResult, CephTransportOptions } from './ceph-transport.ts';
+export { assertFreshQuorum, runCephCommand, sshCephDial } from './ceph-transport.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/ceph/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ceph/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC"}