@homeflare/alchemy 0.6.0 → 0.8.0

package/dist/launchd/job-validate.d.ts

@@ -7,6 +7,8 @@
  *   declaration says; a plan that fails is cheaper than a job that quietly does nothing.
  */
 import { type LaunchdJobProps } from './job-form.ts';
+/** ★ Labels become file names: no `/`, no leading dot, nothing a path could re-interpret. */
+export declare const LABEL: RegExp;
 /**
  * ⛔ LABELS OTHER TOOLS OWN ARE NEVER DECLARED HERE. nix-darwin (`org.nixos.*`) rewrites its plists
  *   on every activation and unloads any it no longer lists; macOS owns `com.apple.*`; `brew

package/dist/launchd/job-validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-validate.d.ts","sourceRoot":"","sources":["../../src/launchd/job-validate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,eAAe,CAAC;AAMvB;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAIpD,CAAC;AAkCF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,UAAW,MAAM,cAAc,MAAM,KAAG,MAAM,EAY1E,CAAC;AAEF,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,MAAM,EAkD1D,CAAC"}
+{"version":3,"file":"job-validate.d.ts","sourceRoot":"","sources":["../../src/launchd/job-validate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,eAAe,CAAC;AAGvB,6FAA6F;AAC7F,eAAO,MAAM,KAAK,QAAuC,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAIpD,CAAC;AAkCF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,UAAW,MAAM,cAAc,MAAM,KAAG,MAAM,EAY1E,CAAC;AAEF,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,MAAM,EAkD1D,CAAC"}

package/dist/launchd/local-runner.d.ts

@@ -3,5 +3,7 @@ export type LocalRunnerOptions = {
     /** Kill a spawned program after this long. @default 120_000 */
     readonly execTimeoutMs?: number;
 };
+/** The errno code of a thrown fs error (`ENOENT`, `EACCES`, …), if it has one. */
+export declare const errnoCode: (cause: unknown) => string | undefined;
 export declare const localRunner: (options?: LocalRunnerOptions) => HostRunner;
 //# sourceMappingURL=local-runner.d.ts.map

package/dist/launchd/local-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/local-runner.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAwB,UAAU,EAAgB,MAAM,aAAa,CAAC;AAElF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAyEF,eAAO,MAAM,WAAW,aAAa,kBAAkB,KAAQ,UAgD9D,CAAC"}
+{"version":3,"file":"local-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/local-runner.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAwB,UAAU,EAAgB,MAAM,aAAa,CAAC;AAElF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,MAAM,GAAG,SAGrC,CAAC;AAqEhB,eAAO,MAAM,WAAW,aAAa,kBAAkB,KAAQ,UAgD9D,CAAC"}

package/dist/launchd/providers.d.ts

@@ -7,7 +7,8 @@
  *   written by the same identity on the same host — a stack cannot write the file as one user and
  *   bootstrap the job as another by accident.
  * ⚠️ The default is localRunner(): this process, never elevated. A system-domain job therefore
- *   needs the deploy itself started as root, or a runner passed here with `privileged: true`.
+ *   needs the deploy itself started as root, or a runner passed here with `privileged: true` —
+ *   `launchdProviders(sudoRunner({ prefixes }))` is the kit's own (sudo-runner.ts).
  */
 import * as Layer from 'effect/Layer';
 import { type HostRunner } from './runner.ts';

package/dist/launchd/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/launchd/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,aAAa,CAAC;AAE/D,eAAO,MAAM,gBAAgB,YAAY,UAAU,yJAGhD,CAAC"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/launchd/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,aAAa,CAAC;AAE/D,eAAO,MAAM,gBAAgB,YAAY,UAAU,yJAGhD,CAAC"}

package/dist/launchd/runner.d.ts

@@ -47,13 +47,15 @@ export type HostUser = {
 };
 export interface HostRunner {
     /**
-     * ⛔ DECLARED, NEVER INFERRED. `true` only when every call this runner makes already runs with
-     *   root's authority — a runner that talks to a root helper, say. The providers refuse
+     * ⛔ DECLARED, NEVER INFERRED. `true` only when this runner can do every root-needing call the
+     *   providers make of it: every call already runs as root (a runner that talks to a root helper,
+     *   say), or the runner elevates exactly those calls (sudoRunner). The providers refuse
      *   system-domain writes unless `effectiveUid()` is 0 or this is `true`, so claiming it falsely
      *   turns that refusal into an EACCES halfway through a deploy.
-     * ⛔ THE KIT NEVER ELEVATES. No runner here calls `sudo`: a deploy that prompts for a password
-     *   mid-plan, or silently uses a cached sudo ticket, is exactly the "no silent sudo" failure. A
-     *   consumer who wants elevation writes that runner deliberately and sets this flag.
+     * ⛔ THE KIT NEVER ELEVATES SILENTLY. localRunner() never calls `sudo`: a deploy that prompts for
+     *   a password mid-plan, or quietly borrows a cached sudo ticket, is exactly the "no silent sudo"
+     *   failure. sudoRunner() does call `sudo -n`, but only when a stack passes it explicitly, only
+     *   for the argv shapes in sudo-allowlist.ts, and logging each one (decided 2026-09-21).
      */
     readonly privileged: boolean;
     /** The uid file writes and launchctl calls run as. */

package/dist/launchd/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/launchd/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,sGAAsG;AACtG,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1D,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,UAAU;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,YAAY,IAAI,MAAM,CAAC;IACvB,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACxD,uDAAuD;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAClD;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,+DAA+D;IAC/D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,2EAA2E;IAC3E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC5D,kFAAkF;IAClF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3D,gFAAgF;IAChF,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;;AAED,uEAAuE;AACvE,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,eAAe,WAAY,UAAU,KAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;AAE3C,oFAAoF;AACpF,eAAO,MAAM,YAAY,WAAY,UAAU,KAAG,OACA,CAAC"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/launchd/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,sGAAsG;AACtG,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1D,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,YAAY,IAAI,MAAM,CAAC;IACvB,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACxD,uDAAuD;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAClD;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,+DAA+D;IAC/D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,2EAA2E;IAC3E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC5D,kFAAkF;IAClF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3D,gFAAgF;IAChF,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;;AAED,uEAAuE;AACvE,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,eAAe,WAAY,UAAU,KAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;AAE3C,oFAAoF;AACpF,eAAO,MAAM,YAAY,WAAY,UAAU,KAAG,OACA,CAAC"}

package/dist/launchd/secret-tripwire.d.ts

@@ -13,6 +13,7 @@
  *   an innocently named variable passes; nothing here can make a secret safe to declare.
  */
 import type { PlistDict } from './plist.ts';
+export declare const PRIVATE_KEY: RegExp;
 /**
  * Refusals for a job's environment, argv and extraKeys. Empty means nothing tripped.
  * ★ extraKeys too: it is a prop like the others, so it lands in state just the same.

package/dist/launchd/secret-tripwire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-tripwire.d.ts","sourceRoot":"","sources":["../../src/launchd/secret-tripwire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AAgCxD;;;GAGG;AACH,eAAO,MAAM,iBAAiB,gBACf,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,QACnD,SAAS,MAAM,EAAE,cACX,SAAS,KACpB,MAAM,EAsBR,CAAC;AAEF,yCAAyC;AACzC,eAAO,MAAM,kBAAkB,YAAa,MAAM,KAAG,MAAM,EACuB,CAAC"}
+{"version":3,"file":"secret-tripwire.d.ts","sourceRoot":"","sources":["../../src/launchd/secret-tripwire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AAgBxD,eAAO,MAAM,WAAW,QAA0C,CAAC;AAgBnE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,gBACf,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,QACnD,SAAS,MAAM,EAAE,cACX,SAAS,KACpB,MAAM,EAsBR,CAAC;AAEF,yCAAyC;AACzC,eAAO,MAAM,kBAAkB,YAAa,MAAM,KAAG,MAAM,EACuB,CAAC"}

package/dist/launchd/sudo-allowlist.d.ts

@@ -0,0 +1,47 @@
+/**
+ * A privileged call that was refused before it ran: by the allowlist, by a host check
+ * (sudo-guard.ts), or by sudo itself. ★ Here, beside the allowlist, so the guard and the runner
+ *   throw the same class and a caller can tell "nothing ran as root" from "it ran and failed".
+ */
+export declare class SudoRefusedError extends Error {
+    constructor(message: string);
+}
+/** ★ Absolute program paths, so neither sudo nor the command is looked up on the caller's PATH. */
+export declare const SUDO = "/usr/bin/sudo";
+export declare const INSTALL = "/usr/bin/install";
+export declare const RM = "/bin/rm";
+/** A mode as `install -m` takes it: four octal digits, so `0644` and `4755` are both exact. */
+export declare const octalMode: (mode: number) => string | undefined;
+/** Validate the stack's prefixes once, when the runner is built. */
+export declare const checkPrefixes: (prefixes: readonly string[]) => readonly string[];
+/**
+ * The declared prefix `path` is strictly under, or `undefined`.
+ * ⚠️ `${prefix}/`, never a bare startsWith: `/opt/example` must not admit `/opt/example-other`.
+ */
+export declare const prefixOf: (path: string, prefixes: readonly string[]) => string | undefined;
+/** The one source `install` may copy and the prefixes, for the call being checked. */
+export type AllowContext = {
+    readonly prefixes: readonly string[];
+    readonly staged?: string;
+};
+/** `undefined` when `argv` is exactly an allowed privileged shape, else the reason it is not. */
+export declare const privilegedProblem: (argv: readonly string[], context: AllowContext) => string | undefined;
+/** Where one exec goes: run as the deploying user, run as root through the allowlist, or refused. */
+export type Route = {
+    readonly as: 'operator';
+} | {
+    readonly as: 'root';
+} | {
+    readonly refuse: string;
+};
+/**
+ * ★ WHY THIS REFUSES AS WELL AS ROUTES. sudoRunner reports `privileged: true`, which switches off
+ *   the providers' own "another user's gui domain needs root" refusal (job-preflight.ts). This
+ *   runner elevates only the system domain, so it gives that refusal back itself. (A write into
+ *   another user's LaunchAgents is refused by the writer first: outside every prefix, a foreign
+ *   owner needs root. This covers the delete, which reaches launchctl before any file.)
+ * ⚠️ Reads (`print`, `print-disabled`) always run as the deploying user: launchctl(1) says anyone
+ *   may read or query the system domain, and launchctl.ts measured it on 2026-09-21.
+ */
+export declare const routeExec: (argv: readonly string[], operatorUid: number) => Route;
+//# sourceMappingURL=sudo-allowlist.d.ts.map

package/dist/launchd/sudo-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-allowlist.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-allowlist.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,mGAAmG;AACnG,eAAO,MAAM,IAAI,kBAAkB,CAAC;AACpC,eAAO,MAAM,OAAO,qBAAqB,CAAC;AAC1C,eAAO,MAAM,EAAE,YAAY,CAAC;AAK5B,+FAA+F;AAC/F,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAM,GAAG,SAGnC,CAAC;AAEhB,oEAAoE;AACpE,eAAO,MAAM,aAAa,aAAc,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAa1E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,YAAY,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SAGhB,CAAC;AA6E/D,sFAAsF;AACtF,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,SACtB,SAAS,MAAM,EAAE,WACd,YAAY,KACpB,MAAM,GAAG,SAyBX,CAAC;AAEF,qGAAqG;AACrG,MAAM,MAAM,KAAK,GACb;IAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhC;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,SAAU,SAAS,MAAM,EAAE,eAAe,MAAM,KAAG,KAiBxE,CAAC"}

package/dist/launchd/sudo-guard.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The checks sudo-runner.ts makes against the host, as the deploying user, before it runs anything
+ * as root. sudo-allowlist.ts checks the argv; this checks what the paths in it actually are.
+ *
+ * ⛔ WHAT IS LOGGED IS WHAT IS WRITTEN. A symlinked directory under a prefix would make
+ *   `install` or `rm`, running as root, act on a path the log never named. So every directory
+ *   between the prefix and the file must be a real directory.
+ * ⚠️ These checks run before the privileged call, so they guard against a mistaken declaration, not
+ *   against someone who can already write inside a prefix and swap a path in between. The prefix
+ *   itself is checked to be root-only (prefixProblem); a directory BELOW it that another user owns
+ *   is not, and that user could swap what lies under it in that window.
+ */
+import type { HostRunner, WriteOptions } from './runner.ts';
+/** The directories strictly between `prefix` and the file at `path`. */
+export declare const betweenDirs: (prefix: string, path: string) => string[];
+/**
+ * What must be at `path` itself: a regular file, or (for a write or a remove) nothing yet.
+ * ⚠️ A DIRECTORY AT THE DESTINATION IS THE TRAP: `install src dir` copies INTO the directory
+ *   (install(1)), and install decides that with stat, so a symlink to a directory does the same.
+ */
+export type Expect = 'file' | 'file-or-absent';
+/**
+ * Refuse a prefix that is not a root-only directory, a symlink or a non-directory between the
+ * prefix and `path`, and anything but a file at it.
+ */
+export declare const assertPlainPath: (base: HostRunner, prefix: string, path: string, expect: Expect) => Promise<'file' | 'absent'>;
+/**
+ * POSIX read permission for one uid: owner class, else group class, else other. `undefined` when
+ * only group membership could decide and the groups are unknown.
+ * ⚠️ EXACTLY ONE CLASS APPLIES. A group member gets the group bits even when the other bits are
+ *   wider (`0604` hides a file from its group), so "other can read" is not enough on its own.
+ */
+export declare const canRead: (file: {
+    readonly uid: number;
+    readonly gid: number;
+    readonly mode: number;
+}, uid: number, groups: readonly number[] | undefined) => boolean | undefined;
+/**
+ * ⛔ REFUSE A FILE THE DEPLOYING USER COULD NOT READ BACK, before writing it. Both providers read
+ *   every write back to verify it (host-file-lifecycle.ts, job-lifecycle.ts) and read it again at
+ *   every plan, as the deploying user; this runner elevates writes, never reads. A root-only
+ *   `0600` would be installed, then fail the read-back with EACCES and stay on disk with no state,
+ *   so every later plan would fail too.
+ * ★ An omitted owner is root (under a prefix the runner writes as root). An omitted group is the
+ *   parent directory's, which is the group a new file gets on macOS.
+ * ⚠️ Unknown groups never refuse: the read-back after the write stays the final judge.
+ */
+export declare const assertReadableBack: (base: HostRunner, path: string, options: WriteOptions, groups: readonly number[] | undefined) => Promise<void>;
+/**
+ * The deploying user's groups, from `id -G`; `undefined` when that fails.
+ * ⚠️ NOT process.getgroups(). MEASURED 2026-09-21 on macOS 27.2: getgroups() returned 16 groups
+ *   where `id -G` returned 18, because macOS caps a process's own list at 16. A group past the
+ *   16th would read as "not a member" and refuse a file the user can in fact read.
+ */
+export declare const operatorGroups: (base: HostRunner) => Promise<readonly number[] | undefined>;
+//# sourceMappingURL=sudo-guard.d.ts.map

package/dist/launchd/sudo-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-guard.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAY,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAMtE,wEAAwE;AACxE,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,KAAG,MAAM,EAMhE,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;AAuB/C;;;GAGG;AACH,eAAO,MAAM,eAAe,SACpB,UAAU,UACR,MAAM,QACR,MAAM,UACJ,MAAM,KACb,OAAO,CAAC,MAAM,GAAG,QAAQ,CAwB3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SACZ;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,OACtE,MAAM,UACH,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,GAAG,SASZ,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,SACvB,UAAU,QACV,MAAM,WACH,YAAY,UACb,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,CAAC,IAAI,CAYd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAgB,UAAU,KAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAI5F,CAAC"}

package/dist/launchd/sudo-runner.d.ts

@@ -0,0 +1,60 @@
+/**
+ * sudoRunner(): the kit's one elevating HostRunner. The deploy runs as the operator, and only the
+ * calls that need root go through `sudo -n`, in the exact shapes sudo-allowlist.ts names:
+ *
+ * - `launchctl bootstrap | bootout | kickstart` in the system domain;
+ * - a file under a prefix the stack declared: staged in a private temp file as the operator, then
+ *   `sudo -n install -S -m <mode> [-o <uid>] [-g <gid>] <staged> <path>`; removed with
+ *   `sudo -n rm -f -- <path>`.
+ *
+ * Everything else (reads, lookups, the operator's own files and gui domain) goes to localRunner().
+ *
+ * ★ DECIDED 2026-09-21. A host stack deploys as the operator rather than as root, so a provider bug
+ *   or a wrong declaration can do no more than this list. It is an explicit opt-in,
+ *   `launchdProviders(sudoRunner({ prefixes }))`, and nothing ever falls back to it: localRunner()
+ *   stays the default and never elevates.
+ * ⛔ `sudo -n`, NEVER A PROMPT. A deploy that stops mid-apply to ask for a password is the failure
+ *   "no silent sudo" exists to prevent. With -n, sudo fails at once, and that failure becomes an
+ *   error saying what to do.
+ * ⛔ EVERY PRIVILEGED ARGV IS LOGGED BEFORE IT RUNS, and it is only ever an argv: a file's bytes
+ *   travel through the staged file, never through argv, so a log line cannot carry content.
+ * ★ `install -S`: install(1) on macOS 27.2 (read 2026-09-21) always writes a temp file in the
+ *   target directory and renames it, so the file is never torn, and -S adds the fsync that
+ *   localRunner's `handle.sync()` does.
+ * ⚠️ REASONED, NOT MEASURED: sudo's failure text. The kit never runs sudo. The strings below follow
+ *   sudoers(5) for sudo 1.9.17p2 on macOS 27.2 ("a password is required": -n was given but a
+ *   password was needed) and sudo(8) (sudo exits 1 when it fails itself).
+ */
+import { type LocalRunnerOptions } from './local-runner.ts';
+import type { HostRunner } from './runner.ts';
+import { SudoRefusedError } from './sudo-allowlist.ts';
+import { type Staged } from './sudo-stage.ts';
+export { SudoRefusedError };
+export type SudoRunnerOptions = LocalRunnerOptions & {
+    /**
+     * The directories root may install into and remove from: `/Library/LaunchDaemons` for system
+     * jobs (bootstrap and bootout are refused without it), plus wherever the stack's root-owned
+     * HostFiles live. ⛔ Required: absolute, normalised, never `/`; and at every privileged call a
+     * real directory that root owns and only root may write (sudo-guard.ts). Outside every prefix a
+     * file is written as the deploying user, or refused when that needs root.
+     */
+    readonly prefixes: readonly string[];
+    /** Receives one line per privileged argv, before it runs. @default a line on stderr */
+    readonly log?: (line: string) => void;
+};
+/** What a sudo runner is built from. ★ Split out so the tests swap the host, never the logic. */
+export type SudoDeps = {
+    /** Runs everything, including `sudo` itself. localRunner() for the real one. */
+    readonly base: HostRunner;
+    readonly stage: (bytes: Uint8Array) => Promise<Staged>;
+    /** The deploying user's groups, for the read-back check; `undefined` when unknown. */
+    readonly groups: () => Promise<readonly number[] | undefined>;
+    readonly log: (line: string) => void;
+};
+export declare const makeSudoRunner: (prefixList: readonly string[], deps: SudoDeps) => HostRunner;
+/**
+ * The real sudo runner: localRunner() for everything, `/usr/bin/sudo -n` for the allowlist.
+ * Pass it explicitly: `launchdProviders(sudoRunner({ prefixes: ['/Library/LaunchDaemons'] }))`.
+ */
+export declare const sudoRunner: (options: SudoRunnerOptions) => HostRunner;
+//# sourceMappingURL=sudo-runner.d.ts.map

package/dist/launchd/sudo-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,KAAK,kBAAkB,EAA0B,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EAAc,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAIL,gBAAgB,EAMjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG;IACnD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,uFAAuF;IACvF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,QAAQ,GAAG;IACrB,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,CAAC;AA2BF,eAAO,MAAM,cAAc,eAAgB,SAAS,MAAM,EAAE,QAAQ,QAAQ,KAAG,UA2H9E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,YAAa,iBAAiB,KAAG,UAYvD,CAAC"}

package/dist/launchd/sudo-stage.d.ts

@@ -0,0 +1,7 @@
+/** A file staged for `install`, and how to remove it again. */
+export type Staged = {
+    readonly path: string;
+    readonly dispose: () => Promise<void>;
+};
+export declare const stageFile: (bytes: Uint8Array) => Promise<Staged>;
+//# sourceMappingURL=sudo-stage.d.ts.map

package/dist/launchd/sudo-stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-stage.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-stage.ts"],"names":[],"mappings":"AAaA,+DAA+D;AAC/D,MAAM,MAAM,MAAM,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AAEtF,eAAO,MAAM,SAAS,UAAiB,UAAU,KAAG,OAAO,CAAC,MAAM,CAWjE,CAAC"}

package/dist/openbao/auth-role-form.d.ts

@@ -33,15 +33,6 @@ export declare const readPath: (name: string) => string;
  * ★ ALL STRINGS, EXACTLY THE `k=v` PAIRS `bao write` USED TO SEND — see `baoWrite` in bao-http.ts.
  */
 export declare const writeBody: (props: BaoAuthRoleProps) => Record<string, string>;
-/**
- * Whether a changed `name` names a DIFFERENT role — the diff's `replace` question.
- *
- * ⚠️ CASE-INSENSITIVELY, BECAUSE THE SERVER IS. AppRole stores `role/<lowercased name>` (openbao
- *   v2.6.2 builtin/credential/approle/path_role.go:1485, and roleEntry reads the same key, :1537),
- *   so `Host` → `host` is the SAME role: a `replace` there would write it, then — under `destroy` —
- *   delete the old generation, which is that same role.
- */
-export declare const isRename: (from: string, to: string) => boolean;
 /** True when live already matches the declaration on every managed field. */
 export declare const matches: (attributes: BaoAuthRoleAttributes, props: BaoAuthRoleProps) => boolean;
 //# sourceMappingURL=auth-role-form.d.ts.map

package/dist/openbao/auth-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-form.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,eAAO,MAAM,YAAY,UAChB,gBAAgB,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,qBAWF,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAgC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,SAAS,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAYxE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,MAAM,MAAM,KAAG,OACX,CAAC;AAW1C,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAUjF,CAAC"}
+{"version":3,"file":"auth-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-form.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,eAAO,MAAM,YAAY,UAChB,gBAAgB,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,qBAWF,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAgC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,SAAS,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAYxE,CAAC;AAWF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAUjF,CAAC"}

package/dist/openbao/auth-role.d.ts

@@ -5,8 +5,9 @@
  *   are credential issuance, not configuration, and are OUT OF SCOPE. This declares the
  *   role shape an approle login inherits — policy names and TTL strings only.
  *
- * ★ `defaultRemovalPolicy: 'retain'` — deleting a role revokes every token bound to it.
- *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ * ★ `defaultRemovalPolicy: 'retain'` — deleting a role locks out every host that logs in with it:
+ *   its secret_ids go with it (the ⚠️ on `delete` below). Opt in with
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/auth-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAMtB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AASH,eAAO,MAAM,mBAAmB,kGAiE7B,CAAC"}
+{"version":3,"file":"auth-role.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAKtB,MAAM,qBAAqB,CAAC;AAI7B,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAiBH,eAAO,MAAM,mBAAmB,kGA6E7B,CAAC"}

package/dist/openbao/cloudflare-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-role.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,0BAA0B,EAAiB,MAAM,mCAAmC,CAAC;AAE9F,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAOnC,YAAY,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,yBAAyB,qIA+HnC,CAAC"}
+{"version":3,"file":"cloudflare-role.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,0BAA0B,EAAiB,MAAM,mCAAmC,CAAC;AAE9F,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAQnC,YAAY,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAKH,eAAO,MAAM,yBAAyB,qIAyInC,CAAC"}

package/dist/openbao/fake-engines-roles.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Fakes of the stores behind the batch-2 families, for fake-bao: every role engine, JWT auth config
+ * and login-MFA enforcements (`wireRoles`), the TOTP method table (`totpMethods`) and the plugin
+ * catalog (`pluginCatalog`), behind one answer (`fakeEstate`). As in fake-engines.ts, each keys its
+ * objects the way the real server does, because a rename test is only as good as the fake's idea of
+ * "the same object".
+ *
+ * ⛔ TEST-ONLY — see fake-bao.ts. No provider imports this file.
+ */
+import type { Reply, Seen } from './fake-bao.ts';
+import { type Store } from './fake-engines.ts';
+/** Every role engine, JWT auth config and MFA login enforcement. A write replaces the object. */
+export declare const wireRoles: () => Store;
+/**
+ * `sys/plugins/catalog/<type>/<name>`. A register names its version in the body; a read or a delete
+ * names it in `?version=` (plugin-form.ts versionedPath).
+ */
+export declare const pluginCatalog: () => Store;
+/**
+ * `identity/mfa/method/totp`: an upsert by `method_name` (identity/mfa.go:159-230), listed with
+ * every other type under `identity/mfa/method?list=true` (mfa-wire.ts). Keyed by the server-made
+ * id.
+ */
+export declare const totpMethods: () => Store;
+/** All three behind one answer, routed by path, for a stack that mixes the families. */
+export declare const fakeEstate: () => ((seen: Seen) => Reply) & {
+    plugins: Store;
+    roles: Store;
+    totp: Store;
+};
+export type Estate = ReturnType<typeof fakeEstate>;
+//# sourceMappingURL=fake-engines-roles.d.ts.map

package/dist/openbao/fake-engines-roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-engines-roles.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-engines-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAU,KAAK,KAAK,EAAmC,MAAM,mBAAmB,CAAC;AAwCxF,iGAAiG;AACjG,eAAO,MAAM,SAAS,QAAO,KAI1B,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,aAAa,QAAO,KAO9B,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,KAuB9B,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,UAAU,gBAIC,IAAI,KAAG,KAAK;;;;CAMnC,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}

package/dist/openbao/fake-engines.d.ts

@@ -0,0 +1,36 @@
+import * as Layer from 'effect/Layer';
+import type { Reply, Seen } from './fake-bao.ts';
+export type Stored = Record<string, unknown>;
+/** An answer for fake-bao that also exposes what it holds, keyed by API path (no `/v1/`). */
+export type Store = ((seen: Seen) => Reply) & {
+    readonly live: Map<string, Stored>;
+};
+export declare const ABSENT: Reply;
+/**
+ * A store of objects by API path. `key` turns a request path (and a write's body) into the key the
+ * server would store it under.
+ */
+export declare const store: <B extends Stored = Record<string, string>>(write: (path: string, body: B, before: Stored | undefined) => Stored, key?: (path: string, body?: B) => string) => Store;
+export declare const lastSegment: (path: string) => string;
+/**
+ * `sys/policies/acl/<name>`. It strips the policy's trailing newline on write (measured on the live
+ * server — digest.ts), and keys the name as OpenBao does: trimmed and lowercased (`policyKey`).
+ */
+export declare const aclPolicies: () => Store;
+/**
+ * `<mount>/roles/<name>` on the Cloudflare engine. A write parses the duration text into seconds and
+ * re-marshals `policies` (path_roles.go:117-146, :199-210). Names are stored verbatim.
+ */
+export declare const cloudflareRoles: () => Store;
+/**
+ * `<mount>/roles/<name>` on the proxmox engine. A write MERGES into the stored role, and TTLs go over
+ * as seconds (homeflare-openbao-plugins secrets/proxmox/path_roles.go, pathRolesWrite).
+ */
+export declare const proxmoxRoles: () => Store;
+/**
+ * Bao.Policy's provider over fragment directories that exist only here: `…/empty` holds no file,
+ * `…/two` holds two, and any other directory one. Each file is one grant named after its own path,
+ * so a directory's content is its name.
+ */
+export declare const fakePolicyProviders: Layer.Layer<import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Provider<import("./policy.ts").BaoPolicy>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=fake-engines.d.ts.map

package/dist/openbao/fake-engines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-engines.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-engines.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAMjD,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7C,6FAA6F;AAC7F,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAErF,eAAO,MAAM,MAAM,EAAE,KAA6C,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,KAAK,GAAI,CAAC,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SACtD,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,QAC/D,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,MAAM,KACtC,KAqBF,CAAC;AAEF,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,MAAsC,CAAC;AAElF;;;GAGG;AACH,eAAO,MAAM,WAAW,QAAO,KAU5B,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAO,KAQ9B,CAAC;AAEN;;;GAGG;AACH,eAAO,MAAM,YAAY,QAAO,KAS3B,CAAC;AAEN;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,8LAiB/B,CAAC"}

package/dist/openbao/fake-families.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The nine batch-2 families as rows of one table, so a rename test can run each of them through
+ * Alchemy's own plan and apply (fake-stack.ts) against one fake (fake-engines-roles.ts). Every row
+ * declares a resource whose identity is `name` (for Bao.JwtAuthConfig, the mount), with `knob`, a
+ * duration, in a prop that is NOT its identity: the pending Output in "a rename lands with another
+ * pending prop".
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import type * as Output from 'alchemy/Output';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import { BaoAuthRole } from './auth-role.ts';
+import type { Seen } from './fake-bao.ts';
+import { type Estate } from './fake-engines-roles.ts';
+import { type FakeStack, type StackBody } from './fake-stack.ts';
+import { BaoJwtAuthConfig } from './jwt-config.ts';
+import { BaoJwtRole } from './jwt-role.ts';
+import { BaoKubernetesRole } from './kubernetes-role.ts';
+import { BaoMfaLoginEnforcement } from './mfa-enforcement.ts';
+import { BaoMfaTotpMethod } from './mfa-totp.ts';
+import { BaoPkiRole } from './pki-role.ts';
+import { BaoPlugin } from './plugin.ts';
+import { BaoSshRole } from './ssh-role.ts';
+export declare const familyProviders: Layer.Layer<import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Provider<BaoAuthRole> | import("alchemy").Provider<BaoJwtAuthConfig> | import("alchemy").Provider<BaoJwtRole> | import("alchemy").Provider<BaoKubernetesRole> | import("alchemy").Provider<BaoMfaLoginEnforcement> | import("alchemy").Provider<BaoMfaTotpMethod> | import("alchemy").Provider<BaoPkiRole> | import("alchemy").Provider<BaoPlugin> | import("alchemy").Provider<BaoSshRole>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** One stack over a fresh estate: every family's provider, and every call the fake saw. */
+export declare const withEstate: (body: (stack: FakeStack, estate: Estate, seen: Seen[]) => Promise<void>) => Promise<void>;
+/** The row for one family, by name. */
+export declare const rowOf: (family: string) => Family;
+type Text = string | Output.Output<string>;
+type Removal = typeof RemovalPolicy.destroy;
+export interface Family {
+    readonly family: string;
+    /** One resource, logical id `id`, whose identity is `name`. */
+    readonly declare: (id: string, name: Text, knob: Text, removal?: Removal) => StackBody;
+    /** Whether the fake holds the object `name` names. */
+    readonly has: (estate: Estate, name: string) => boolean;
+}
+export declare const FAMILIES: readonly Family[];
+/**
+ * Two of one family, `X` and `Y`, under destroy: the shape a swap or a shift needs. Their knobs
+ * differ, so a generation that lands on the other's name has to write over it.
+ */
+export declare const pairOf: (row: Family) => (x: string, y: string) => StackBody;
+/** An AppRole whose `tokenTtl` attribute is the Output the other rows are fed. */
+export declare const upstream: (ttl: string) => Effect.Effect<BaoAuthRole, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export {};
+//# sourceMappingURL=fake-families.d.ts.map

package/dist/openbao/fake-families.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-families.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-families.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,aAAa,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAuB,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAiB,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAA4B,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAsB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAA6B,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAkC,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAA4B,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAsB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAqB,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAsB,MAAM,eAAe,CAAC;AAE/D,eAAO,MAAM,eAAe,ghBAW3B,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,UAAU,SACf,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,KACtE,OAAO,CAAC,IAAI,CAGd,CAAC;AAEF,uCAAuC;AACvC,eAAO,MAAM,KAAK,WAAY,MAAM,KAAG,MAItC,CAAC;AAEF,KAAK,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC3C,KAAK,OAAO,GAAG,OAAO,aAAa,CAAC,OAAO,CAAC;AAE5C,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,SAAS,CAAC;IACvF,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACzD;AAQD,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EA6FrC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,MAAM,QACX,MAAM,SACR,MAAM,KAAK,MAAM,KAAG,SAIpB,CAAC;AAEP,kFAAkF;AAClF,eAAO,MAAM,QAAQ,QAAS,MAAM,4FACsC,CAAC"}

package/dist/openbao/fake-stack.d.ts

@@ -0,0 +1,29 @@
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import type { BaoEnvironment } from './bao-address.ts';
+import { type Fake, type Reply, type Seen } from './fake-bao.ts';
+/** The planned action for each resource, deletions included, keyed by FQN. */
+export type Planned = Readonly<Record<string, string>>;
+/** A stack body: resource declarations, as an `alchemy.run.ts` would write them. */
+export type StackBody = Effect.Effect<unknown, unknown, unknown>;
+export interface FakeStack {
+    /** Plan, then apply, `body`. Resolves to the plan; rejects with the apply's failure. */
+    readonly deploy: (body: StackBody) => Promise<Planned>;
+}
+/**
+ * One stack over one state store, shared by every `deploy`, so the second deploy plans against what
+ * the first one recorded.
+ *
+ * ⚠️ THE CASTS ARE AT THE ENGINE'S TYPED BOUNDARY, NOT IN THE PROVIDERS. `Alchemy.Stack` types its body
+ *   against every service a CLI run provides. Here the body needs only the providers given, and a
+ *   missing one fails the test by name ("Provider not found for …").
+ */
+export declare const fakeStack: <ROut, E, RIn>(providers: Layer.Layer<ROut, E, RIn>, env: BaoEnvironment, name?: string) => FakeStack;
+/**
+ * A fake engine answering with `answer`, and one stack over it, for one test. The fake stops however
+ * `body` ends.
+ */
+export declare const withFakeStack: <ROut, E, RIn>(providers: Layer.Layer<ROut, E, RIn>, answer: (seen: Seen) => Reply, body: (stack: FakeStack, bao: Fake) => Promise<void>) => Promise<void>;
+/** Every call that changed something, as `METHOD /v1/path`, in order. */
+export declare const writesOf: (seen: readonly Seen[]) => string[];
+//# sourceMappingURL=fake-stack.d.ts.map

package/dist/openbao/fake-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-stack.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-stack.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,KAAK,IAAI,EAAE,KAAK,KAAK,EAAE,KAAK,IAAI,EAAW,MAAM,eAAe,CAAC;AAE1E,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvD,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEjE,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAiBD;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,aACzB,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAC/B,cAAc,oBAElB,SA4BF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAU,IAAI,EAAE,CAAC,EAAE,GAAG,aACnC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAC5B,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,QACvB,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,KACnD,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,QAAQ,SAAU,SAAS,IAAI,EAAE,KAAG,MAAM,EACoC,CAAC"}

package/dist/openbao/host-approles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-approles.d.ts","sourceRoot":"","sources":["../../src/openbao/host-approles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;CAC3D;AAKD,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,wDAAwD;AACxD,eAAO,MAAM,YAAY,cAAe,MAAM,QAAQ,MAAM,KAAG,MAClB,CAAC;AAyB9C;;;GAGG;AACH,eAAO,MAAM,YAAY,UAAW,iBAAiB,KAAG,SAAS,gBAAgB,EA+BhF,CAAC"}
+{"version":3,"file":"host-approles.d.ts","sourceRoot":"","sources":["../../src/openbao/host-approles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;CAC3D;AAKD,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,wDAAwD;AACxD,eAAO,MAAM,YAAY,cAAe,MAAM,QAAQ,MAAM,KAAG,MAClB,CAAC;AAyB9C;;;GAGG;AACH,eAAO,MAAM,YAAY,UAAW,iBAAiB,KAAG,SAAS,gBAAgB,EA8ChF,CAAC"}