@homeflare/alchemy 0.54.0 → 0.55.0

package/dist/ceph/ceph-argv-config.d.ts

@@ -1,10 +1,13 @@
 /**
  * `undefined` when `value` is a safe ceph config value — exported (like `boundedEntityProblem`)
- * so the shape itself is directly testable, since `NAMED_CONFIG_OPTIONS` being empty today means
- * `cephCommandProblem` never reaches this check on any real argv (`namedOptionProblem` refuses
- * first) — this stays exercised until K-D's first named option arms the path for real.
+ * so the shape itself is directly testable independently of whichever options are named.
  */
 export declare const configValueProblem: (value: string) => string | undefined;
+/**
+ * `undefined` when `name` may be declared for `who`, adopted, read by value or written — see
+ * ceph-config-options.ts's header for why the list starts empty and stays reviewed line by line.
+ */
+export declare const namedOptionProblem: (who: string, name: string) => string | undefined;
 /** `config get|set|rm <who> <name> [value]`, called with the operands after `config` stripped. */
 export declare const configProblem: (rest: readonly string[]) => string | undefined;
 //# sourceMappingURL=ceph-argv-config.d.ts.map

package/dist/ceph/ceph-argv-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-argv-config.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-argv-config.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,UAAW,MAAM,KAAG,MAAM,GAAG,SAG0B,CAAC;AAevF,kGAAkG;AAClG,eAAO,MAAM,aAAa,SAAU,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SAmBhE,CAAC"}
+{"version":3,"file":"ceph-argv-config.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-argv-config.ts"],"names":[],"mappings":"AAwCA;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAAW,MAAM,KAAG,MAAM,GAAG,SAG0B,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,QAAQ,MAAM,KAAG,MAAM,GAAG,SAUvE,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,aAAa,SAAU,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SAmBhE,CAAC"}

package/dist/ceph/ceph-argv.d.ts

@@ -16,4 +16,12 @@ export declare const authGetArgv: (entity: string) => readonly string[];
 export declare const authGetOrCreateArgv: (entity: string, caps: Readonly<Record<(typeof DAEMONS)[number], string>>) => readonly string[];
 export declare const authCapsArgv: (entity: string, caps: Readonly<Record<(typeof DAEMONS)[number], string>>) => readonly string[];
 export declare const quorumStatusArgv: () => readonly string[];
+/**
+ * `config set <who> <name> <value>` — `Ceph.ConfigOption`'s write. ⚠️ The VALUE is in argv, so it
+ * lands in the runner's log and the node's sudo journal; acceptable only because the named option
+ * list carries no secret-valued option (ceph-config-options.ts).
+ */
+export declare const configSetArgv: (who: string, name: string, value: string) => readonly string[];
+/** `config rm <who> <name>` — `Ceph.ConfigOption`'s delete; idempotent on the ceph side. */
+export declare const configRmArgv: (who: string, name: string) => readonly string[];
 //# sourceMappingURL=ceph-argv.d.ts.map

package/dist/ceph/ceph-argv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-argv.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-argv.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,kFAAkF;AAClF,eAAO,MAAM,QAAQ,kBAAkB,CAAC;AAExC,mEAAmE;AACnE,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAK3C,yFAAyF;AACzF,eAAO,MAAM,oBAAoB,WAAY,MAAM,KAAG,MAAM,GAAG,SAGiD,CAAC;AAejH,QAAA,MAAM,OAAO,YAAI,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AA6E/C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,SAAU,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SAWrE,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,WAAW,WAAY,MAAM,KAAG,SAAS,MAAM,EAM3D,CAAC;AAEF,eAAO,MAAM,mBAAmB,WACtB,MAAM,QACR,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,KACvD,SAAS,MAAM,EAOjB,CAAC;AAEF,eAAO,MAAM,YAAY,WACf,MAAM,QACR,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,KACvD,SAAS,MAAM,EAOjB,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAO,SAAS,MAAM,EAIlD,CAAC"}
+{"version":3,"file":"ceph-argv.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-argv.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,kFAAkF;AAClF,eAAO,MAAM,QAAQ,kBAAkB,CAAC;AAExC,mEAAmE;AACnE,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAK3C,yFAAyF;AACzF,eAAO,MAAM,oBAAoB,WAAY,MAAM,KAAG,MAAM,GAAG,SAGiD,CAAC;AAejH,QAAA,MAAM,OAAO,YAAI,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AA6E/C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,SAAU,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SAWrE,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,WAAW,WAAY,MAAM,KAAG,SAAS,MAAM,EAM3D,CAAC;AAEF,eAAO,MAAM,mBAAmB,WACtB,MAAM,QACR,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,KACvD,SAAS,MAAM,EAOjB,CAAC;AAEF,eAAO,MAAM,YAAY,WACf,MAAM,QACR,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,KACvD,SAAS,MAAM,EAOjB,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAO,SAAS,MAAM,EAIlD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,QAAS,MAAM,QAAQ,MAAM,SAAS,MAAM,KAAG,SAAS,MAAM,EAQvF,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,YAAY,QAAS,MAAM,QAAQ,MAAM,KAAG,SAAS,MAAM,EAOvE,CAAC"}

package/dist/ceph/ceph-config-option-form.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Props, attributes and the pure helpers for `Ceph.ConfigOption` (K-D) — split from
+ * config-option.ts the same way ceph-auth-form.ts is split from auth-entity.ts: nothing here
+ * talks to a cluster, so every rule is unit-tested without PVE or ssh.
+ * Design: docs/plans/2026-09-26-ceph-config-options.md.
+ *
+ * ⛔ VALIDATION IS THE TRANSPORT'S OWN ALLOWLIST, NOT A SECOND COPY OF IT. `configOptionProblem`
+ *   builds the exact `config set` argv the write would run and asks `cephCommandProblem` — so the
+ *   named list (ceph-config-options.ts), the per-option `<who>` bound, the lockout classes and the
+ *   flag-shaped-value refusal can never disagree between plan time and write time.
+ */
+import type { ListNodeCephCfgDbResponseBodyItem } from '@distilled.cloud/proxmox/nodes';
+import type { WithTarget } from '../proxmox/resource-spec.ts';
+export interface CephConfigOptionProps extends WithTarget {
+    /**
+     * The PVE node whose `GET /nodes/{node}/ceph/cfg/db` answers the mon config db — the plan-time
+     * read. Any node of the Ceph cluster answers the same db.
+     */
+    node: string;
+    /** ssh destinations of the mon hosts the write (`config set`/`rm`) is tried against, in order. */
+    monNodes: readonly string[];
+    /** The config section: `global`, `mon`, `osd`, `mgr`, `mds`, `client`, optionally `.<id>`. */
+    who: string;
+    /** The option name — must be on `NAMED_CONFIG_OPTIONS` for exactly this `who`. */
+    name: string;
+    /**
+     * The value as ceph stores it — a string, compared byte-for-byte with what the config db reports.
+     * ⚠️ Spell it the way ceph echoes it back (`false`, not `0`), or every plan is an `update`.
+     */
+    value: string;
+}
+export interface CephConfigOptionAttributes {
+    who: string;
+    name: string;
+    /** The mon-db value observed after the last reconcile. The only field `matches` compares. */
+    value: string;
+}
+/** One row of the mon config db, as the PVE API reports it (`ceph config dump`'s shape). */
+export type CfgDbRow = Pick<ListNodeCephCfgDbResponseBodyItem, 'section' | 'name' | 'value' | 'mask'>;
+/** `undefined` when props may be declared at all; else why not. Runs before any read or write. */
+export declare const configOptionProblem: (props: CephConfigOptionProps) => string | undefined;
+/**
+ * The live row for exactly `{who, name}` with NO mask. ⚠️ A masked row (`osd/class:ssd`) is a
+ * different setting the bare `config set <who>` neither writes nor removes, so it is never matched.
+ */
+export declare const findLive: (rows: readonly CfgDbRow[], who: string, name: string) => CephConfigOptionAttributes | undefined;
+export declare const matches: (live: CephConfigOptionAttributes | undefined, props: CephConfigOptionProps) => boolean;
+//# sourceMappingURL=ceph-config-option-form.d.ts.map

package/dist/ceph/ceph-config-option-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-config-option-form.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-config-option-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D,MAAM,WAAW,qBAAsB,SAAQ,UAAU;IACvD;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,KAAK,EAAE,MAAM,CAAC;CACf;AAED,4FAA4F;AAC5F,MAAM,MAAM,QAAQ,GAAG,IAAI,CACzB,iCAAiC,EACjC,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CACtC,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,UAAW,qBAAqB,KAAG,MAAM,GAAG,SAM3E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,QAAQ,SACb,SAAS,QAAQ,EAAE,OACpB,MAAM,QACL,MAAM,KACX,0BAA0B,GAAG,SAG/B,CAAC;AAEF,eAAO,MAAM,OAAO,SACZ,0BAA0B,GAAG,SAAS,SACrC,qBAAqB,YACuB,CAAC"}

package/dist/ceph/ceph-config-option-reconcile.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The observe -> ensure -> sync loop and the delete for `Ceph.ConfigOption` (K-D) — plain
+ * functions, so a fake-runner test drives the real loop (same split as ceph-auth-reconcile.ts).
+ *
+ * ★ OBSERVE IS THE PVE API, WRITES ARE THE SSH MON TRANSPORT. The PVE API is read-only for the
+ *   config db (`GET /nodes/{node}/ceph/cfg/db`; no write endpoint exists), so writes go through
+ *   ceph-transport.ts's `runCephCommand` — the one transport every Ceph family in this kit uses,
+ *   allowlist-checked before it dials — and each write is followed by `assertFreshQuorum`.
+ * ★ A DEPLOY WITH NO DRIFT MAKES ZERO WRITES (S10). If the observed mon-db value already equals
+ *   props — an adopted, already-set option included — nothing reaches ssh at all.
+ * ⛔ A FAILED READ IS NEVER "ABSENT". The caller's `readRows` propagates its own failure; only a
+ *   successful read with no matching row means the option is unset.
+ * ⛔ READ BACK AFTER EVERY WRITE and refuse to record a value the mon db does not report.
+ */
+import * as Effect from 'effect/Effect';
+import { type CephConfigOptionAttributes, type CephConfigOptionProps, type CfgDbRow } from './ceph-config-option-form.ts';
+import { type CephTransportOptions } from './ceph-transport.ts';
+export type CephConfigDeps = Pick<CephTransportOptions, 'dial' | 'log'>;
+export declare const reconcileCephConfigOption: <E, R>(props: CephConfigOptionProps, readRows: Effect.Effect<readonly CfgDbRow[], E, R>, deps: CephConfigDeps) => Effect.Effect<CephConfigOptionAttributes, E | Error, R>;
+/** Idempotent: an option already absent from the mon db is success, with nothing sent. */
+export declare const deleteCephConfigOption: <E, R>(props: Pick<CephConfigOptionProps, 'who' | 'name' | 'monNodes'>, readRows: Effect.Effect<readonly CfgDbRow[], E, R>, deps: CephConfigDeps) => Effect.Effect<void, E | Error, R>;
+//# sourceMappingURL=ceph-config-option-reconcile.d.ts.map

package/dist/ceph/ceph-config-option-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-config-option-reconcile.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-config-option-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,QAAQ,EAId,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,KAAK,oBAAoB,EAAqC,MAAM,qBAAqB,CAAC;AAEnG,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;AAsBxE,eAAO,MAAM,yBAAyB,GAAI,CAAC,EAAE,CAAC,SACrC,qBAAqB,YAClB,MAAM,CAAC,MAAM,CAAC,SAAS,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,QAC5C,cAAc,KACnB,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAuBrD,CAAC;AAEL,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,GAAI,CAAC,EAAE,CAAC,SAClC,IAAI,CAAC,qBAAqB,EAAE,KAAK,GAAG,MAAM,GAAG,UAAU,CAAC,YACrD,MAAM,CAAC,MAAM,CAAC,SAAS,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,QAC5C,cAAc,KACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAK/B,CAAC"}

package/dist/ceph/ceph-config-options.d.ts

@@ -3,10 +3,14 @@
  * through the mon-command transport (ceph-argv.ts's `configProblem`). Design:
  * docs/plans/2026-09-26-ceph-config-options.md, D-C1.
  *
- * ⛔ THE LIST STARTS EMPTY, AND EACH ADDITION IS ITS OWN REVIEWED PR LINE. Nothing in K-A4 adds to
- *   it — `CephConfigOption` (K-D) is a separate, later family; this file exists now only so the
- *   transport's allowlist has something to bound `config` against from day one, per the accepted
- *   design ("config get/set for the named option list which starts EMPTY").
+ * ⛔ THE LIST STARTED EMPTY, AND EACH ADDITION IS ITS OWN REVIEWED PR LINE. `Ceph.ConfigOption`
+ *   (K-D, config-option.ts) is the only declarer; it refuses any `{who, name}` this map does not
+ *   carry before planning, and the transport's allowlist (ceph-argv-config.ts) refuses it again
+ *   before anything dials. One entry per line, each with a comment saying what it does and why it
+ *   is managed — never a batch.
+ * ★ EACH ENTRY ALSO NAMES THE `<who>` IT MAY BE SET FOR. This is the config-options design's
+ *   acceptance test #1 ("`<who>` bounded to the declared daemons"): an option listed for `mgr`
+ *   can never be written to `global`, `client.admin` or any other section through this transport.
  * ⛔ NEVER ADD ONE OF THE LOCKOUT CLASSES BELOW. `mon_host`, `public_network`, `cluster_network`,
  *   `public_addr`, `cluster_addr`, every `auth_*_required` and every `key`/`keyring`-bearing
  *   option re-address the mons or de-authenticate the whole cluster — cutting every VM disk — and
@@ -16,8 +20,13 @@
  *   cluster to measure this against yet); a secret-bearing setting belongs in a vault-backed flow,
  *   never a `ceph config set` argv, which lands in the runner's log and the node's sudo journal.
  */
-/** Starts empty. Add one reviewed option name per PR line, never a batch. */
-export declare const NAMED_CONFIG_OPTIONS: ReadonlySet<string>;
+/**
+ * option name -> the `<who>` sections it may be set for. Add one reviewed line per PR, never a
+ * batch; the structural test (ceph-config-options.test.ts) runs the lockout guard over every key.
+ */
+export declare const NAMED_CONFIG_OPTIONS: ReadonlyMap<string, readonly string[]>;
+/** The `<who>` sections `name` may be set for — empty when the option is not on the list. */
+export declare const allowedWhoFor: (name: string) => readonly string[];
 /** Whether `name` is a class this transport must never read a value for, adopt, or write. */
 export declare const isLockoutConfigOption: (name: string) => boolean;
 //# sourceMappingURL=ceph-config-options.d.ts.map

package/dist/ceph/ceph-config-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-config-options.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-config-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAe,CAAC;AAarE,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,SAAU,MAAM,KAAG,OACE,CAAC"}
+{"version":3,"file":"ceph-config-options.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-config-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAOtE,CAAC;AAEH,6FAA6F;AAC7F,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,SAAS,MAAM,EACtB,CAAC;AAgBvC,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,SAAU,MAAM,KAAG,OACE,CAAC"}

package/dist/ceph/config-option.d.ts

@@ -0,0 +1,10 @@
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type { PveRequirements } from '../proxmox/resource-spec.ts';
+import { type CephConfigOptionAttributes, type CephConfigOptionProps } from './ceph-config-option-form.ts';
+export type { CephConfigOptionAttributes, CephConfigOptionProps, } from './ceph-config-option-form.ts';
+export interface CephConfigOption extends Resource<'Ceph.ConfigOption', CephConfigOptionProps, CephConfigOptionAttributes, never, PveRequirements> {
+}
+export declare const CephConfigOption: import("alchemy").ResourceClass<CephConfigOption>;
+export declare const CephConfigOptionProvider: () => import("effect/Layer").Layer<Provider.Provider<CephConfigOption>, never, import("effect/http/HttpClient").HttpClient>;
+//# sourceMappingURL=config-option.d.ts.map

package/dist/ceph/config-option.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-option.d.ts","sourceRoot":"","sources":["../../src/ceph/config-option.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAI3B,MAAM,8BAA8B,CAAC;AAMtC,YAAY,EACV,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAWH,eAAO,MAAM,wBAAwB,6HAsClC,CAAC"}

package/dist/ceph/index.d.ts

@@ -1,13 +1,17 @@
 /**
- * Ceph providers for Alchemy — the mon-command transport and `Ceph.AuthEntity` (K-A4).
+ * Ceph providers for Alchemy — the mon-command transport, `Ceph.AuthEntity` (K-A4) and
+ * `Ceph.ConfigOption` (K-D).
  *
  * ⛔ THIS BARREL IS THE PUBLIC API, DELIBERATELY SMALLER THAN THE DIRECTORY — see
  *   `../openbao/index.ts`'s header for why. The allowlist internals (ceph-argv.ts), the parsing
- *   (ceph-auth-parse.ts) and the reconcile loop (ceph-auth-reconcile.ts) are exported by path for
- *   a future `CephConfigOption` (K-D) or a test to reach directly, not published here.
+ *   (ceph-auth-parse.ts) and the reconcile loops (ceph-auth-reconcile.ts,
+ *   ceph-config-option-reconcile.ts) are reached by path from tests, not published here.
  */
 export type { CephAuthEntityAttributes, CephAuthEntityProps, CephCaps } from './auth-entity.ts';
 export { CephAuthEntity, CephAuthEntityProvider } from './auth-entity.ts';
 export type { CephDial, CephExecResult, CephTransportOptions } from './ceph-transport.ts';
 export { assertFreshQuorum, runCephCommand, sshCephDial } from './ceph-transport.ts';
+export type { CephConfigOptionAttributes, CephConfigOptionProps } from './config-option.ts';
+export { CephConfigOption, CephConfigOptionProvider } from './config-option.ts';
+export { NAMED_CONFIG_OPTIONS } from './ceph-config-options.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/ceph/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ceph/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ceph/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACrF,YAAY,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/ceph/index.js

@@ -187,7 +187,10 @@ var canonical = (text) => text.trimEnd();
 var sha256 = (text) => new Bun.CryptoHasher("sha256").update(canonical(text)).digest("hex");
 
 // src/ceph/ceph-config-options.ts
-var NAMED_CONFIG_OPTIONS = new Set([]);
+var NAMED_CONFIG_OPTIONS = new Map([
+  ["mgr/prometheus/exclude_perf_counters", ["mgr"]]
+]);
+var allowedWhoFor = (name) => NAMED_CONFIG_OPTIONS.get(name) ?? [];
 var LOCKOUT_EXACT = new Set([
   "mon_host",
   "public_network",
@@ -195,20 +198,23 @@ var LOCKOUT_EXACT = new Set([
   "public_addr",
   "cluster_addr"
 ]);
-var LOCKOUT_PATTERN = /^auth_\w*_required$|(^|_)key(ring)?($|_)/;
+var LOCKOUT_PATTERN = /^auth_\w*_required$|(^|[_/])key(ring)?($|[_/])/;
 var isLockoutConfigOption = (name) => LOCKOUT_EXACT.has(name) || LOCKOUT_PATTERN.test(name);
 
 // src/ceph/ceph-argv-config.ts
 var WHO = /^(global|mon|osd|mgr|mds|client)(\.[A-Za-z0-9_-]{1,32})?$/;
-var OPTION_NAME = /^[a-z][a-z0-9_]{0,63}$/;
+var OPTION_NAME = /^(?:[a-z][a-z0-9_]{0,63}|mgr\/[a-z][a-z0-9_]{0,31}\/[a-z][a-z0-9_]{0,63})$/;
 var CONFIG_VALUE = /^(?:[A-Za-z0-9][A-Za-z0-9 ._:/=,-]{0,255}|-[0-9]{1,255})$/;
 var configValueProblem = (value) => CONFIG_VALUE.test(value) ? undefined : `config value ${JSON.stringify(value)} contains characters outside the safe set`;
-var namedOptionProblem = (name) => {
+var namedOptionProblem = (who, name) => {
   if (!OPTION_NAME.test(name))
     return `${JSON.stringify(name)} is not a plain ceph option name`;
   if (isLockoutConfigOption(name))
     return `${name} is a lockout-class option and can never be declared`;
-  return NAMED_CONFIG_OPTIONS.has(name) ? undefined : `${name} is not on the named option list (it starts empty — see ceph-config-options.ts)`;
+  if (!NAMED_CONFIG_OPTIONS.has(name))
+    return `${name} is not on the named option list (each entry is a reviewed PR line — see ceph-config-options.ts)`;
+  const allowed = allowedWhoFor(name);
+  return allowed.includes(who) ? undefined : `${name} may only be set for ${allowed.join("/")} on the named option list, not ${JSON.stringify(who)}`;
 };
 var configProblem = (rest) => {
   const [verb, who, name, ...extra] = rest;
@@ -218,13 +224,13 @@ var configProblem = (rest) => {
   if (name === undefined)
     return "config takes a `<name>` from the named option list";
   if (verb === "get" || verb === "rm") {
-    return extra.length === 0 ? namedOptionProblem(name) : `config ${String(verb)} takes exactly \`<who> <name>\``;
+    return extra.length === 0 ? namedOptionProblem(who, name) : `config ${String(verb)} takes exactly \`<who> <name>\``;
   }
   if (verb === "set") {
     const [value, ...more] = extra;
     if (value === undefined || more.length !== 0)
       return "config set takes exactly `<who> <name> <value>`";
-    const named = namedOptionProblem(name);
+    const named = namedOptionProblem(who, name);
     return named !== undefined ? named : configValueProblem(value);
   }
   return `ceph config ${String(verb)} is not on the allowlist`;
@@ -335,6 +341,23 @@ var quorumStatusArgv = () => [
   "quorum_status",
   ...JSON_FORMAT
 ];
+var configSetArgv = (who, name, value) => [
+  CEPH_BIN,
+  "config",
+  "set",
+  who,
+  name,
+  value,
+  ...JSON_FORMAT
+];
+var configRmArgv = (who, name) => [
+  CEPH_BIN,
+  "config",
+  "rm",
+  who,
+  name,
+  ...JSON_FORMAT
+];
 
 // src/ceph/ceph-auth-parse.ts
 var isRecord = (value) => typeof value === "object" && value !== null;
@@ -1598,13 +1621,345 @@ var CephAuthEntityProvider = () => Provider.effect(CephAuthEntity, Effect3.succe
   reconcile: ({ news, output }) => reconcileCephAuthEntity(news, output, {}),
   delete: ({ output }) => Effect3.die(refusedDelete(output.entity))
 })));
+// src/ceph/config-option.ts
+import * as nodes from "@distilled.cloud/proxmox/nodes";
+import { Resource as Resource2 } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved2 } from "alchemy/Diff";
+import * as Provider2 from "alchemy/Provider";
+import * as Effect10 from "effect/Effect";
+
+// src/proxmox/credentials.ts
+var VALID_TIER = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var mintTier = (target, role) => {
+  if (target.scheme !== "pve")
+    return role;
+  const tier = target.roles?.[role];
+  if (tier === undefined)
+    return role;
+  if (!VALID_TIER.test(tier)) {
+    throw new Error(`PveTarget.roles.${role} = ${JSON.stringify(tier)} is not a valid OpenBao tier name -- ` + 'it would be interpolated straight into "<mount>/creds/<tier>" and must be a plain name ' + '(letters, digits, ".", "_", "-", not starting with one of those and not "..").');
+  }
+  return tier;
+};
+
+// src/proxmox/distilled-pve.ts
+import * as Effect7 from "effect/Effect";
+import * as Result2 from "effect/Result";
+import { credentials as distilledPveCredentials } from "@distilled.cloud/proxmox/Credentials";
+import * as ProxmoxRetry from "@distilled.cloud/proxmox/Retry";
+
+// src/proxmox/lease-cache.ts
+import * as Cache from "effect/Cache";
+import * as Duration from "effect/Duration";
+import * as Effect5 from "effect/Effect";
+import * as Exit from "effect/Exit";
+
+// src/proxmox/mint.ts
+import * as Effect4 from "effect/Effect";
+import * as Option2 from "effect/Option";
+import * as FetchHttpClient2 from "effect/http/FetchHttpClient";
+import * as Headers2 from "effect/http/Headers";
+import * as HttpClient3 from "effect/http/HttpClient";
+import * as HttpClientRequest2 from "effect/http/HttpClientRequest";
+
+// src/proxmox/credential-errors.ts
+import * as Data from "effect/Data";
+
+class PveCredentialDenied extends Data.TaggedError("PveCredentialDenied") {
+  get message() {
+    return `OpenBao GET /v1/${this.mount}/creds/${this.tier} -> 403: ${this.detail}. This identity's ` + "AppRole has no grant for this role -- a refused read, not evidence the object is gone.";
+  }
+}
+
+// src/proxmox/mint.ts
+var baoVariable = (env, name) => env[`BAO_${name}`] ?? env[`VAULT_${name}`] ?? "";
+var mint = (target, role, env = process.env) => Effect4.gen(function* () {
+  const tier = mintTier(target, role);
+  const path = `${target.mount}/creds/${tier}`;
+  const refuse = (status2, detail) => new Error(`OpenBao GET /v1/${path} -> ${status2 === 0 ? "no response" : status2}: ${detail}`);
+  const address = baoVariable(env, "AGENT_ADDR") || baoVariable(env, "ADDR") || "https://127.0.0.1:8200";
+  const socket = address.startsWith("unix://") ? address.slice("unix://".length) : undefined;
+  const base = socket === undefined ? address.replace(/\/+$/, "") : "http://localhost";
+  const headers = { "X-Vault-Request": "true" };
+  const namespace = baoVariable(env, "NAMESPACE");
+  if (namespace !== "")
+    headers["X-Vault-Namespace"] = namespace;
+  const token = baoVariable(env, "TOKEN");
+  if (token !== "")
+    headers["X-Vault-Token"] = token;
+  if (socket !== undefined && !("Bun" in globalThis)) {
+    return yield* Effect4.fail(refuse(0, "a unix:// address needs Bun fetch; this is not Bun"));
+  }
+  const client = yield* HttpClient3.HttpClient;
+  const redacted = yield* Headers2.CurrentRedactedNames;
+  const defaults = Option2.getOrElse(yield* Effect4.serviceOption(FetchHttpClient2.RequestInit), () => ({}));
+  const request = HttpClientRequest2.get(`${base}/v1/${path}`).pipe(HttpClientRequest2.setHeaders(headers));
+  const exchange = client.execute(request).pipe(Effect4.flatMap((response) => Effect4.map(response.text, (text2) => ({ status: response.status, text: text2 }))), Effect4.timeout("60 seconds"), Effect4.provideService(Headers2.CurrentRedactedNames, [...redacted, "x-vault-token"]));
+  const init = { ...defaults, unix: socket };
+  const { status, text } = yield* (socket === undefined ? exchange : Effect4.provideService(exchange, FetchHttpClient2.RequestInit, init)).pipe(Effect4.mapError((cause) => refuse(0, cause.message)));
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    parsed = undefined;
+  }
+  if (status < 200 || status >= 300) {
+    const errors = parsed?.errors;
+    const isOpenBaoBody = Array.isArray(errors);
+    const detail = isOpenBaoBody ? errors.map(String).join("; ") : "not an OpenBao error body";
+    if (status === 403 && isOpenBaoBody) {
+      return yield* Effect4.fail(new PveCredentialDenied({ detail, mount: target.mount, tier }));
+    }
+    return yield* Effect4.fail(refuse(status, detail || "(no errors given)"));
+  }
+  const tokenId = parsed?.data?.token_id;
+  const secret = parsed?.data?.secret;
+  if (typeof tokenId !== "string" || typeof secret !== "string") {
+    return yield* Effect4.fail(new Error(`${target.mount}/creds/${tier} returned no token_id/secret. Either this approle lacks ` + `the grant, or the mount is not ${target.mount}. Say which mount and role you needed ` + `than falling back to a stored credential -- every stored PVE token is read-only.`));
+  }
+  const lease = parsed?.lease_duration;
+  const leaseSeconds = typeof lease === "number" ? lease : 0;
+  return { leaseSeconds, secret, tokenId };
+});
+var authorization = (credential, target) => target.scheme === "pbs" ? `PBSAPIToken=${credential.tokenId}:${credential.secret}` : `PVEAPIToken=${credential.tokenId}=${credential.secret}`;
+
+// src/proxmox/lease-cache.ts
+var REMINT_MARGIN_SECONDS = 60;
+var keyOf = (target, role) => ({
+  mount: target.mount,
+  scheme: target.scheme,
+  tier: mintTier(target, role)
+});
+var timeToLive = (exit) => Exit.isSuccess(exit) && exit.value.leaseSeconds > REMINT_MARGIN_SECONDS ? Duration.seconds(exit.value.leaseSeconds - REMINT_MARGIN_SECONDS) : Duration.zero;
+var makeLeases = (mintFor) => Cache.makeWith(mintFor, { capacity: 64, requireServicesAt: "lookup", timeToLive });
+var targetForKey = (key) => key.scheme === "pbs" ? { api: "https://pbs.invalid/api2/json", mount: key.mount, scheme: "pbs" } : { members: [], mount: key.mount, roles: { read: key.tier }, scheme: "pve" };
+var mintForKey = (key, env = process.env) => mint(targetForKey(key), key.scheme === "pbs" ? key.tier : "read", env);
+var leases = Effect5.runSync(makeLeases(mintForKey));
+var leased = (target, role) => Cache.get(leases, keyOf(target, role));
+
+// src/proxmox/members.ts
+import * as Cause2 from "effect/Cause";
+import * as Effect6 from "effect/Effect";
+import * as Result from "effect/Result";
+import * as HttpClient5 from "effect/http/HttpClient";
+import * as HttpClientError from "effect/http/HttpClientError";
+var PVE_API_PORT = 8006;
+var pveApiBase = (member) => `https://${member}:${String(PVE_API_PORT)}/api2/json`;
+var MEMBER_TIMEOUT = "20 seconds";
+var lastGoodByMount = new Map;
+var noteGoodMember = (target, member) => {
+  lastGoodByMount.set(target.mount, member);
+};
+var orderedMembers = (target) => {
+  const preferred = lastGoodByMount.get(target.mount);
+  if (preferred === undefined || !target.members.includes(preferred))
+    return target.members;
+  return [preferred, ...target.members.filter((member) => member !== preferred)];
+};
+var errorCode = (cause) => {
+  if (cause !== null && typeof cause === "object") {
+    if ("code" in cause && typeof cause.code === "string")
+      return cause.code;
+    if ("cause" in cause)
+      return errorCode(cause.cause);
+  }
+  return;
+};
+var isTimeoutCause = (cause) => {
+  const code = errorCode(cause);
+  if (code === "AbortError" || code === "ETIMEDOUT" || code === "UND_ERR_CONNECT_TIMEOUT") {
+    return true;
+  }
+  return cause instanceof Error && /timed out|timeout/i.test(cause.message);
+};
+var PRE_SEND_CODES = new Set(["ConnectionRefused", "ECONNREFUSED", "ENOTFOUND", "EAI_AGAIN"]);
+var isCertificateCode = (code) => /^(ERR_TLS_CERT_|CERT_|UNABLE_TO_VERIFY_|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT)/.test(code);
+var isPreSendCause = (cause) => {
+  const code = errorCode(cause);
+  return code !== undefined && (PRE_SEND_CODES.has(code) || isCertificateCode(code));
+};
+var isTransportFailure = (cause) => {
+  if (Cause2.isTimeoutError(cause))
+    return true;
+  if (!HttpClientError.isHttpClientError(cause))
+    return false;
+  const tag = cause.reason._tag;
+  return tag === "TransportError" || tag === "InvalidUrlError" || tag === "EncodeError";
+};
+var isPreSendTransport = (cause) => {
+  if (!HttpClientError.isHttpClientError(cause))
+    return false;
+  const { reason } = cause;
+  if (reason._tag === "InvalidUrlError" || reason._tag === "EncodeError")
+    return true;
+  if (reason._tag === "TransportError") {
+    if (isTimeoutCause(reason.cause))
+      return false;
+    return isPreSendCause(reason.cause);
+  }
+  return false;
+};
+var describeTransport = (cause) => {
+  if (Cause2.isTimeoutError(cause))
+    return `timed out after ${String(MEMBER_TIMEOUT)}`;
+  if (HttpClientError.isHttpClientError(cause))
+    return cause.message;
+  return String(cause);
+};
+var executeOnCluster = (target, method, path, build, timeout4 = MEMBER_TIMEOUT) => Effect6.gen(function* () {
+  const client = yield* HttpClient5.HttpClient;
+  const isWrite = method !== "GET";
+  const attempts = [];
+  for (const member of orderedMembers(target)) {
+    const outcome = yield* client.execute(build(pveApiBase(member))).pipe(Effect6.timeout(timeout4), Effect6.result);
+    if (Result.isSuccess(outcome)) {
+      noteGoodMember(target, member);
+      return outcome.success;
+    }
+    const why = describeTransport(outcome.failure);
+    attempts.push({ member, why });
+    const mayRetry = isWrite ? isPreSendTransport(outcome.failure) : isTransportFailure(outcome.failure);
+    if (!mayRetry) {
+      return yield* Effect6.fail({ attempts, method, path, tag: "cluster" });
+    }
+  }
+  return yield* Effect6.fail({ attempts, method, path, tag: "cluster" });
+});
+
+// src/proxmox/distilled-pve.ts
+class PveClusterExhausted extends Error {
+  attempts;
+  constructor(attempts) {
+    super(`all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join("; ")}`);
+    this.attempts = attempts;
+    this.name = "PveClusterExhausted";
+  }
+}
+var runPveWith = (target, credential, isWrite, op, timeout5 = MEMBER_TIMEOUT) => Effect7.gen(function* () {
+  const attempts = [];
+  for (const member of orderedMembers(target)) {
+    const credLayer = distilledPveCredentials({
+      baseUrl: pveApiBase(member),
+      secret: credential.secret,
+      tokenId: credential.tokenId
+    });
+    const outcome = yield* op.pipe(ProxmoxRetry.none, Effect7.provide(credLayer), Effect7.timeout(timeout5), Effect7.result);
+    if (Result2.isSuccess(outcome)) {
+      noteGoodMember(target, member);
+      return outcome.success;
+    }
+    const mayRetry = isWrite ? isPreSendTransport(outcome.failure) : isTransportFailure(outcome.failure);
+    if (!mayRetry)
+      return yield* Effect7.fail(outcome.failure);
+    attempts.push({ member, why: describeTransport(outcome.failure) });
+  }
+  return yield* Effect7.fail(new PveClusterExhausted(attempts));
+});
+var runPve = (target, role, isWrite, op) => Effect7.gen(function* () {
+  const credential = yield* leased(target, role);
+  return yield* runPveWith(target, credential, isWrite, op);
+});
+
+// src/proxmox/unreadable-read.ts
+import * as Effect8 from "effect/Effect";
+var UNREADABLE = Symbol("pve-unreadable");
+var readOrUnreadable = (effect2) => effect2.pipe(Effect8.catchTag("PveCredentialDenied", () => Effect8.succeed(UNREADABLE)));
+var unreadableWarning = (type, identity, mount, tier) => Effect8.logWarning(`${type} ${identity}: the read of ${mount}/creds/${tier} was refused (no grant for this ` + "credential's role) -- reporting noop rather than forcing an update with nothing compared. " + "Re-plan on a lane that can read this object before trusting this row.");
+
+// src/ceph/ceph-config-option-form.ts
+var configOptionProblem = (props) => {
+  if (props.monNodes.length === 0)
+    return "monNodes must name at least one mon ssh destination";
+  const problem = cephCommandProblem(configSetArgv(props.who, props.name, props.value));
+  return problem === undefined ? undefined : `Ceph.ConfigOption ${props.who}/${props.name}: ${problem}`;
+};
+var findLive = (rows, who, name) => {
+  const row = rows.find((r) => r.section === who && r.name === name && (r.mask ?? "") === "");
+  return row === undefined ? undefined : { name, value: String(row.value), who };
+};
+var matches = (live, props) => live !== undefined && live.value === props.value;
+
+// src/ceph/ceph-config-option-reconcile.ts
+import * as Effect9 from "effect/Effect";
+var asError2 = (cause) => cause instanceof Error ? cause : new Error(String(cause));
+var runWrite = (transport, argv) => Effect9.gen(function* () {
+  const result3 = yield* Effect9.tryPromise({
+    catch: asError2,
+    try: () => runCephCommand(transport, argv)
+  });
+  if (result3.exitCode !== 0) {
+    return yield* Effect9.fail(new Error(`ceph ${argv.slice(1, 3).join(" ")} failed on mon ${result3.node} (exit ` + `${String(result3.exitCode)}): ${result3.stderr.trim().slice(0, 300)}`));
+  }
+  yield* Effect9.tryPromise({ catch: asError2, try: () => assertFreshQuorum(transport) });
+});
+var reconcileCephConfigOption = (props, readRows, deps) => Effect9.gen(function* () {
+  const problem = configOptionProblem(props);
+  if (problem !== undefined)
+    return yield* Effect9.fail(new Error(problem));
+  const live = findLive(yield* readRows, props.who, props.name);
+  if (live !== undefined && matches(live, props))
+    return live;
+  yield* runWrite({ nodes: props.monNodes, ...deps }, configSetArgv(props.who, props.name, props.value));
+  const after = findLive(yield* readRows, props.who, props.name);
+  if (after === undefined || !matches(after, props)) {
+    return yield* Effect9.fail(new Error(`Ceph.ConfigOption ${props.who}/${props.name}: 'ceph config set' succeeded but the mon ` + `config db reports ${after === undefined ? "no value" : JSON.stringify(after.value)}, ` + `not ${JSON.stringify(props.value)}. Not recorded — check \`ceph config dump\`.`));
+  }
+  return after;
+});
+var deleteCephConfigOption = (props, readRows, deps) => Effect9.gen(function* () {
+  const live = findLive(yield* readRows, props.who, props.name);
+  if (live === undefined)
+    return;
+  yield* runWrite({ nodes: props.monNodes, ...deps }, configRmArgv(props.who, props.name));
+});
+
+// src/ceph/config-option.ts
+var CephConfigOption = Resource2("Ceph.ConfigOption", {
+  defaultRemovalPolicy: "retain"
+});
+var readRows = (props) => runPve(props.target, "read", false, nodes.listNodeCephCfgDb({ node: props.node }));
+var refuse = (props) => {
+  const problem = configOptionProblem(props);
+  return problem === undefined ? Effect10.void : Effect10.fail(new Error(problem));
+};
+var CephConfigOptionProvider = () => Provider2.effect(CephConfigOption, Effect10.succeed(CephConfigOption.Provider.of({
+  list: () => Effect10.succeed([]),
+  read: Effect10.fn(function* ({ olds, output }) {
+    const live = findLive(yield* readRows(olds), olds.who, olds.name);
+    if (live === undefined)
+      return;
+    return output !== undefined ? live : Unowned(live);
+  }),
+  diff: Effect10.fn(function* ({ news, output }) {
+    if (!isResolved2(news))
+      return;
+    yield* refuse(news);
+    if (output === undefined)
+      return;
+    if (output.who !== news.who || output.name !== news.name)
+      return { action: "replace" };
+    const rows = yield* readOrUnreadable(readRows(news));
+    if (rows === UNREADABLE) {
+      yield* unreadableWarning("Ceph.ConfigOption", `${news.who}/${news.name}`, news.target.mount, mintTier(news.target, "read"));
+      return { action: "noop" };
+    }
+    const live = findLive(rows, news.who, news.name);
+    return { action: matches(live, news) ? "noop" : "update" };
+  }),
+  reconcile: ({ news }) => reconcileCephConfigOption(news, readRows(news), {}),
+  delete: ({ olds }) => deleteCephConfigOption(olds, readRows(olds), {})
+})));
 export {
   CephAuthEntity,
   CephAuthEntityProvider,
+  CephConfigOption,
+  CephConfigOptionProvider,
+  NAMED_CONFIG_OPTIONS,
   assertFreshQuorum,
   runCephCommand,
   sshCephDial
 };
 
-//# debugId=9CE9ABE5EAEA3BE264756E2164756E21
+//# debugId=6A14FAFFC2879E5164756E2164756E21
 //# sourceMappingURL=index.js.map