@homeflare/alchemy 0.7.0 → 0.10.0

package/dist/openbao/jwt-config.d.ts

@@ -10,6 +10,11 @@
  *
  * ★ REPLACE SEMANTICS (REPLACE.md): `mount` changed → `replace`: the new mount gets the config;
  *   the old one keeps its own until that mount is disabled. There is no identity but the mount.
+ * ⛔ A MOVE ONTO A MOUNT WHOSE CONFIG EXISTS FAILS THE PLAN, like every other family's move onto an
+ *   occupied path (rename-identity.ts). With no delete, nothing is lost to a swap, which MEASURED
+ *   2026-09-21 ended with each config where it was declared. But the new generation writes over
+ *   the config it lands on, which changes who can log in on that mount: an issuer or key set
+ *   someone else manages, silently replaced. Move through a mount with no config instead.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/jwt-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-config.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAQ3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE9F,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAEH,eAAO,MAAM,aAAa,UACjB,qBAAqB,KAC3B,QAAQ,CAAC,0BAA0B,CAQpC,CAAC;AAEH,eAAO,MAAM,wBAAwB,uGA2BlC,CAAC"}
+{"version":3,"file":"jwt-config.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAO3B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,KAAK,QAAQ,EAA0C,MAAM,qBAAqB,CAAC;AAE5F,YAAY,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE9F,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAYH,eAAO,MAAM,aAAa,UACjB,qBAAqB,KAC3B,QAAQ,CAAC,0BAA0B,CAQpC,CAAC;AAEH,eAAO,MAAM,wBAAwB,uGAiClC,CAAC"}

package/dist/openbao/jwt-role.d.ts

@@ -14,7 +14,8 @@
  *
  * ★ REPLACE SEMANTICS (REPLACE.md): `mount` or `name` changed → `replace`, create-first. The new
  *   path cannot collide with the old, so no `deleteFirst`. Under the default `retain` the old role
- *   stays live, and still admits logins, until removed by hand.
+ *   stays live, and still admits logins, until removed by hand. ⛔ A move onto a role that already
+ *   exists fails the plan (rename-identity.ts).
  * ★ `defaultRemovalPolicy: 'retain'`, like every Bao.* family.
  */
 import { Resource } from 'alchemy';

package/dist/openbao/jwt-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-role.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAOrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAEH,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,QAAQ,CAAC,oBAAoB,CAOhF,CAAC;AAEH,eAAO,MAAM,kBAAkB,iGAoC5B,CAAC"}
+{"version":3,"file":"jwt-role.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAMrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,KAAK,QAAQ,EAA0C,MAAM,qBAAqB,CAAC;AAE5F,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAcH,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,QAAQ,CAAC,oBAAoB,CAOhF,CAAC;AAEH,eAAO,MAAM,kBAAkB,iGAwC5B,CAAC"}

package/dist/openbao/kubernetes-role.d.ts

@@ -9,7 +9,8 @@
  *   and nothing else (path_role.go:239-256).
  *
  * ★ REPLACE SEMANTICS (REPLACE.md): `mount` or `name` changed → `replace`, create-first (the new
- *   path cannot collide). Under the default `retain` the old role stays live until removed by hand.
+ *   path cannot collide with the old). Under the default `retain` the old role stays live until
+ *   removed by hand. ⛔ A move onto a role that already exists fails the plan (rename-identity.ts).
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/kubernetes-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubernetes-role.d.ts","sourceRoot":"","sources":["../../src/openbao/kubernetes-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAO5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,kBAAkB,UACtB,sBAAsB,KAC5B,QAAQ,CAAC,2BAA2B,CAOrC,CAAC;AAEH,eAAO,MAAM,yBAAyB,wGAiCnC,CAAC"}
+{"version":3,"file":"kubernetes-role.d.ts","sourceRoot":"","sources":["../../src/openbao/kubernetes-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,KAAK,QAAQ,EAA0C,MAAM,qBAAqB,CAAC;AAE5F,YAAY,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAUH,eAAO,MAAM,kBAAkB,UACtB,sBAAsB,KAC5B,QAAQ,CAAC,2BAA2B,CAOrC,CAAC;AAEH,eAAO,MAAM,yBAAyB,wGAwCnC,CAAC"}

package/dist/openbao/mfa-enforcement.d.ts

@@ -19,14 +19,18 @@
  *   default `retain` it never runs; with `destroy`, set `retain` to drop it from state and leave it
  *   live — which is what the server would do anyway.
  *
- * ★ REPLACE SEMANTICS (REPLACE.md): `name` changed → `replace`, create-first (names are per
- *   namespace; the new one cannot collide). Under `retain` BOTH enforcements then apply — fail
- *   closed. Under `destroy` the old one's delete is refused, so the deploy stops after creating.
+ * ★ REPLACE SEMANTICS (REPLACE.md): `name` changed → `replace`, create-first. Under `retain` BOTH
+ *   enforcements then apply — fail closed. Under `destroy` the old one's delete is refused, so the
+ *   deploy stops after creating. ⛔ A rename onto an enforcement that exists fails the plan
+ *   (rename-identity.ts): the upsert by name would otherwise rewrite, in place, what someone else's
+ *   enforcement demands. MEASURED 2026-09-21: a swap of two under `destroy` wrote each over the
+ *   other, then stopped on the two refused deletes.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import { type BaoMfaLoginEnforcementAttributes, type BaoMfaLoginEnforcementProps } from './mfa-enforcement-form.ts';
 export type { BaoMfaLoginEnforcementAttributes, BaoMfaLoginEnforcementProps, } from './mfa-enforcement-form.ts';
@@ -35,7 +39,10 @@ export interface BaoMfaLoginEnforcement extends Resource<'Bao.MfaLoginEnforcemen
 export declare const BaoMfaLoginEnforcement: import("alchemy").ResourceClass<BaoMfaLoginEnforcement>;
 type Env = HttpClient.HttpClient;
 export declare const planEnforcement: (props: BaoMfaLoginEnforcementProps) => Effect.Effect<'noop' | 'update', BaoError, Env>;
-/** Write when live differs, then prove it by reading back. */
-export declare const reconcileEnforcement: (props: BaoMfaLoginEnforcementProps) => Effect.Effect<BaoMfaLoginEnforcementAttributes, BaoError, Env>;
+/**
+ * Write when live differs, then prove it by reading back.
+ * ⛔ `claim` (the provider passes it): a create never takes over an enforcement it finds by name.
+ */
+export declare const reconcileEnforcement: (props: BaoMfaLoginEnforcementProps, claim?: Claim) => Effect.Effect<BaoMfaLoginEnforcementAttributes, BaoError, Env>;
 export declare const BaoMfaLoginEnforcementProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoMfaLoginEnforcement>, never, HttpClient.HttpClient>;
 //# sourceMappingURL=mfa-enforcement.d.ts.map

package/dist/openbao/mfa-enforcement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-enforcement.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAMjC,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,sBAAuB,SAAQ,QAAQ,CACtD,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,sBAAsB,yDAEjC,CAAC;AAEH,KAAK,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC;AAmBjC,eAAO,MAAM,eAAe,UACnB,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAM7C,CAAC;AAEL,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,UACxB,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,gCAAgC,EAAE,QAAQ,EAAE,GAAG,CAe5D,CAAC;AAEL,eAAO,MAAM,8BAA8B,6GAkCxC,CAAC"}
+{"version":3,"file":"mfa-enforcement.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,KAAK,EAAY,MAAM,uBAAuB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAMjC,MAAM,2BAA2B,CAAC;AAInC,YAAY,EACV,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,sBAAuB,SAAQ,QAAQ,CACtD,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,sBAAsB,yDAEjC,CAAC;AAEH,KAAK,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC;AAyBjC,eAAO,MAAM,eAAe,UACnB,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAM7C,CAAC;AAEL;;;GAGG;AACH,eAAO,MAAM,oBAAoB,UACxB,2BAA2B,UAC1B,KAAK,KACZ,MAAM,CAAC,MAAM,CAAC,gCAAgC,EAAE,QAAQ,EAAE,GAAG,CAkB5D,CAAC;AAEL,eAAO,MAAM,8BAA8B,6GA2CxC,CAAC"}

package/dist/openbao/mfa-totp.d.ts

@@ -19,6 +19,7 @@ import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import { type BaoMfaTotpMethodAttributes, type BaoMfaTotpMethodProps } from './mfa-totp-form.ts';
 export type { BaoMfaTotpMethodAttributes, BaoMfaTotpMethodProps, BaoTotpAlgorithm, } from './mfa-totp-form.ts';
@@ -27,7 +28,10 @@ export interface BaoMfaTotpMethod extends Resource<'Bao.MfaTotpMethod', BaoMfaTo
 export declare const BaoMfaTotpMethod: import("alchemy").ResourceClass<BaoMfaTotpMethod>;
 export declare const readTotp: (props: BaoMfaTotpMethodProps) => Effect.Effect<BaoMfaTotpMethodAttributes | undefined, BaoError, HttpClient.HttpClient>;
 export declare const planTotp: (props: BaoMfaTotpMethodProps) => Effect.Effect<'noop' | 'update', BaoError, HttpClient.HttpClient>;
-/** Upsert by name when live differs, then prove it by reading back. */
-export declare const reconcileTotp: (props: BaoMfaTotpMethodProps) => Effect.Effect<BaoMfaTotpMethodAttributes, BaoError, HttpClient.HttpClient>;
+/**
+ * Upsert by name when live differs, then prove it by reading back.
+ * ⛔ `claim` (the provider passes it): a create never takes over a method it finds by that name.
+ */
+export declare const reconcileTotp: (props: BaoMfaTotpMethodProps, claim?: Claim) => Effect.Effect<BaoMfaTotpMethodAttributes, BaoError, HttpClient.HttpClient>;
 export declare const BaoMfaTotpMethodProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoMfaTotpMethod>, never, HttpClient.HttpClient>;
 //# sourceMappingURL=mfa-totp.d.ts.map

package/dist/openbao/mfa-totp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-totp.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAM3B,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAKH,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGrF,CAAC;AAEJ,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK/D,CAAC;AAEL,uEAAuE;AACvE,eAAO,MAAM,aAAa,UACjB,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAWxE,CAAC;AAEL,eAAO,MAAM,wBAAwB,uGA8BlC,CAAC"}
+{"version":3,"file":"mfa-totp.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,KAAK,EAAY,MAAM,uBAAuB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAM3B,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAKH,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGrF,CAAC;AAEJ,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK/D,CAAC;AAEL;;;GAGG;AACH,eAAO,MAAM,aAAa,UACjB,qBAAqB,UACpB,KAAK,KACZ,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAYxE,CAAC;AAEL,eAAO,MAAM,wBAAwB,uGAiDlC,CAAC"}

package/dist/openbao/mount-reconcile.d.ts

@@ -4,6 +4,7 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import { type BaoMountAttributes, type BaoMountProps } from './mount-form.ts';
 import type { RemountError, RemountOptions } from './remount-wire.ts';
@@ -11,6 +12,9 @@ export declare const readMount: (props: BaoMountProps) => Effect.Effect<BaoMount
 /**
  * Converge one mount. `stated` is the path in Alchemy's state (undefined on a first reconcile).
  * Dies on a refusal; fails with OpenBao's own error on a refused call.
+ * ⛔ `claim` (mount.ts always passes it) refuses, before any write, a first reconcile that would take
+ *   over a live mount: the one at the path, or the `remountFrom` source it would move
+ *   (ownership/adopt.ts).
  */
-export declare const reconcileMount: (news: BaoMountProps, stated: string | undefined, options?: RemountOptions) => Effect.Effect<BaoMountAttributes, BaoError | RemountError, HttpClient.HttpClient>;
+export declare const reconcileMount: (news: BaoMountProps, stated: string | undefined, options?: RemountOptions, claim?: Claim) => Effect.Effect<BaoMountAttributes, BaoError | RemountError, HttpClient.HttpClient>;
 //# sourceMappingURL=mount-reconcile.d.ts.map

package/dist/openbao/mount-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-reconcile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAKnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,SAAS,UACb,aAAa,KACnB,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK5E,CAAC;AAUL;;;GAGG;AACH,eAAO,MAAM,cAAc,SACnB,aAAa,UACX,MAAM,GAAG,SAAS,YAChB,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CA8B/E,CAAC"}
+{"version":3,"file":"mount-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-reconcile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAKnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,SAAS,UACb,aAAa,KACnB,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK5E,CAAC;AAUL;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,SACnB,aAAa,UACX,MAAM,GAAG,SAAS,YAChB,cAAc,UAChB,KAAK,KACZ,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CAoC/E,CAAC"}

package/dist/openbao/mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../src/openbao/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,aAAa,EAAW,MAAM,iBAAiB,CAAC;AAKvF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAElD,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,QAAQ,2CAEnB,CAAC;AAEH,eAAO,MAAM,gBAAgB,+FAuE1B,CAAC"}
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../src/openbao/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,aAAa,EAAW,MAAM,iBAAiB,CAAC;AAKvF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAElD,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,QAAQ,2CAEnB,CAAC;AAEH,eAAO,MAAM,gBAAgB,+FA6E1B,CAAC"}

package/dist/openbao/pki-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pki-role.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAMrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AASH,eAAO,MAAM,kBAAkB,iGA4G5B,CAAC"}
+{"version":3,"file":"pki-role.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAMrB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAgBH,eAAO,MAAM,kBAAkB,iGAyH5B,CAAC"}

package/dist/openbao/plugin-reconcile.d.ts

@@ -4,6 +4,7 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import { type BaoPluginAttributes, type BaoPluginForm, type BaoPluginProps } from './plugin-form.ts';
 type Entry = {
@@ -12,7 +13,10 @@ type Entry = {
 };
 /** Live entry, plus the raw body — reconcile needs the raw half for `oci` and `declarative`. */
 export declare const readEntry: (form: BaoPluginForm) => Effect.Effect<Entry | undefined, BaoError, HttpClient.HttpClient>;
-/** Register when the live entry differs, then prove it by reading back. Dies on a refusal. */
-export declare const reconcilePlugin: (props: BaoPluginProps) => Effect.Effect<BaoPluginAttributes, BaoError, HttpClient.HttpClient>;
+/**
+ * Register when the live entry differs, then prove it by reading back. Dies on a refusal.
+ * ⛔ `claim` (the provider passes it): a create never takes over an entry already registered.
+ */
+export declare const reconcilePlugin: (props: BaoPluginProps, claim?: Claim) => Effect.Effect<BaoPluginAttributes, BaoError, HttpClient.HttpClient>;
 export {};
 //# sourceMappingURL=plugin-reconcile.d.ts.map

package/dist/openbao/plugin-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin-reconcile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,cAAc,EAMpB,MAAM,kBAAkB,CAAC;AAG1B,KAAK,KAAK,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAElG,gGAAgG;AAChG,eAAO,MAAM,SAAS,SACd,aAAa,KAClB,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGhE,CAAC;AAuBJ,8FAA8F;AAC9F,eAAO,MAAM,eAAe,UACnB,cAAc,KACpB,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAsCjE,CAAC"}
+{"version":3,"file":"plugin-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin-reconcile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,cAAc,EAMpB,MAAM,kBAAkB,CAAC;AAG1B,KAAK,KAAK,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAElG,gGAAgG;AAChG,eAAO,MAAM,SAAS,SACd,aAAa,KAClB,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGhE,CAAC;AA0BJ;;;GAGG;AACH,eAAO,MAAM,eAAe,UACnB,cAAc,UACb,KAAK,KACZ,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAyCjE,CAAC"}

package/dist/openbao/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,cAAc,EAAoB,MAAM,kBAAkB,CAAC;AAInG,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3F,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAEH,eAAO,MAAM,iBAAiB,gGAuD3B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAMpB,MAAM,kBAAkB,CAAC;AAM1B,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3F,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAoBH,eAAO,MAAM,iBAAiB,gGA6D3B,CAAC"}

package/dist/openbao/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAMnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAYH,eAAO,MAAM,iBAAiB,oIA2H3B,CAAC"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAUnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAeH,eAAO,MAAM,iBAAiB,oIAiI3B,CAAC"}

package/dist/openbao/proxmox-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxmox-role.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,wBAAwB,CAAC;AAYhC,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAE9D,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,eAAO,MAAM,sBAAsB,qGAkKhC,CAAC"}
+{"version":3,"file":"proxmox-role.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,wBAAwB,CAAC;AAKhC,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAE9D,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAKH,eAAO,MAAM,sBAAsB,qGAmKhC,CAAC"}

package/dist/openbao/rename-identity.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The rename guard every Bao.* family whose identity is a name, a mount, or a catalog key shares:
+ * one `Identity` per family, and two steps built from rename.ts, `judgeRename` at the top of `diff`
+ * and `guardRename` at the top of `reconcile`. REPLACE.md has the audit behind both.
+ *
+ * ★ ONE DESCRIPTION OF "WHICH OBJECT", NOT TWELVE COPIES OF THE CHECK. The rename-safety fix went
+ *   in family by family, and the families it skipped were the ones that kept the bug: nine of them
+ *   judged the identity only after `isResolved(news)` and never asked whether the new path was
+ *   taken. 🔴 MEASURED 2026-09-21 through the engine (rename-families.test.ts): two Bao.AuthRole,
+ *   Bao.PkiRole, Bao.JwtRole, Bao.KubernetesRole, Bao.SshRole or Bao.Plugin resources that swapped
+ *   names under `RemovalPolicy.destroy()` both planned `replace`, each wrote over the other, and
+ *   both old deletes then removed what had just been written: a green deploy, both objects gone.
+ *   With any other prop still an Output, all nine planned `update` and left the old object live
+ *   under no state record; for Bao.MfaTotpMethod that wrote a second method and stranded every
+ *   enrolment.
+ */
+import * as Effect from 'effect/Effect';
+/** How one family names the object it manages — the thing a rename changes. */
+export interface Identity<A> {
+    /** `Bao.JwtRole` etc., for messages. */
+    readonly family: string;
+    /** The identity a set of props declares; undefined while any part of it is still an Output. */
+    readonly declared: (props: unknown) => string | undefined;
+    /** The identity a generation's attributes record. */
+    readonly recorded: (output: A) => string;
+    /** The API path an identity is read at, for the occupied check. Default: the identity. */
+    readonly pathOf?: ((identity: string) => string) | undefined;
+    /** How the server keys it (`policyKey`). Default: exact. */
+    readonly key?: ((identity: string) => string) | undefined;
+}
+/** A family keyed by `name` alone, read at `pathOf(name)`. */
+export declare const nameIdentity: <A extends {
+    readonly name: string;
+}>(family: string, pathOf: (name: string) => string, key?: (name: string) => string) => Identity<A>;
+/**
+ * A role at `rolePath(mount, name)`; the identity is that path. `defaultMount` is what an absent
+ * `mount` prop means — undefined when `mount` is required.
+ */
+export declare const roleIdentity: <A extends {
+    readonly mount: string;
+    readonly name: string;
+}>(family: string, rolePath: (mount: string, name: string) => string, defaultMount?: string, key?: (path: string) => string) => Identity<A>;
+/**
+ * ⚠️ THE LAST SEGMENT LOWERCASED: a role store that folds the name and not the mount. openbao v2.6.2
+ *   AppRole (builtin/credential/approle/path_role.go:1485, :1537) and Kubernetes
+ *   (builtin/credential/kubernetes/backend.go:362, path_role.go:396) both store `role/<lowercased
+ *   name>`, and JWT reads its `name` as a TypeLowerCaseString (builtin/credential/jwt/path_role.go:77),
+ *   while the router folds no case in a mount path. So `Host` → `host` is the same role, never a
+ *   replace that would delete, under `destroy`, the role it had just written.
+ */
+export declare const foldName: (path: string) => string;
+/**
+ * `diff`'s first step, before `isResolved(news)`: the move from the identity this resource last
+ * wrote or tried to the declared one, or undefined when both name the same object or either is not
+ * known yet. ⛔ Fails the plan when the new identity is already taken (`judgeMove`).
+ *
+ * ★ `olds` STANDS IN FOR `output` WHILE A CREATE OR A REPLACEMENT IS UNFINISHED, which is what
+ *   catches reverting a move whose new generation failed (rename.ts, `judgeMove`).
+ */
+export declare const judgeRename: <A>(identity: Identity<A>, olds: unknown, news: unknown, output: A | undefined) => Effect.Effect<{
+    from: string;
+    to: string;
+} | undefined, import("./bao-status.ts").BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * `reconcile`'s first step: an `update` whose prior attributes name another object dies before any
+ * read or write (`refuseMovedUpdate`). Only reached when the diff could not see the new identity.
+ */
+export declare const guardRename: <A>(identity: Identity<A>, news: unknown, output: A | undefined) => Effect.Effect<void>;
+//# sourceMappingURL=rename-identity.d.ts.map

package/dist/openbao/rename-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename-identity.d.ts","sourceRoot":"","sources":["../../src/openbao/rename-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AASxC,+EAA+E;AAC/E,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1D,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IACzC,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,SAAS,CAAC;IAC7D,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3D;AAED,8DAA8D;AAC9D,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,UACtD,MAAM,UACN,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,QAC1B,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,KAC7B,QAAQ,CAAC,CAAC,CAMX,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,UAC9E,MAAM,YACJ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,iBAClC,MAAM,QACf,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,KAC7B,QAAQ,CAAC,CAAC,CAKX,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,MACc,CAAC;AAEvD;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,YACjB,QAAQ,CAAC,CAAC,CAAC,QACf,OAAO,QACP,OAAO,UACL,CAAC,GAAG,SAAS;;;wGAQpB,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,YACjB,QAAQ,CAAC,CAAC,CAAC,QACf,OAAO,UACL,CAAC,GAAG,SAAS,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAOpB,CAAC"}

package/dist/openbao/rename.d.ts

@@ -1,6 +1,7 @@
 /**
- * Rename safety for the families whose identity is a name, or a mount and a name: Bao.Policy,
- * Bao.CloudflareRole and Bao.ProxmoxRole. REPLACE.md has the audit and what each answer does.
+ * Rename safety for the families whose identity is a name, a mount and a name, or a catalog key:
+ * the primitives. rename-identity.ts builds each family's diff and reconcile step from them, and
+ * REPLACE.md has the audit and what each answer does.
  *
  * ⛔ THE BUG THIS CLOSES, REPRODUCED 2026-09-21 AGAINST alchemy@2.0.0-beta.79's OWN PLAN AND APPLY
  *   (fake-stack.ts): a Bao.Policy deployed as `old`, then redeclared as `new` under
@@ -32,8 +33,16 @@ import * as Effect from 'effect/Effect';
 export declare const declaredString: (news: unknown, key: string) => string | undefined;
 /** True while an optional prop is declared but is not yet a value: an Output of a changing upstream. */
 export declare const isPendingProp: (news: unknown, key: string) => boolean;
-/** A role's API path from a diff's `news`, once both `mount` and `name` are resolved. */
-export declare const declaredRolePath: (news: unknown, rolePath: (mount: string, name: string) => string) => string | undefined;
+/**
+ * An optional string prop: `fallback` when it is absent, undefined while it is still an Output.
+ * ⚠️ Not `declaredString(…) ?? fallback`, which would read a pending mount as the default mount.
+ */
+export declare const declaredOr: (news: unknown, key: string, fallback: string) => string | undefined;
+/**
+ * A role's API path from a diff's `news`, once both `mount` and `name` are resolved. `defaultMount`
+ * is what an absent `mount` means; without one, an absent mount is unknown.
+ */
+export declare const declaredRolePath: (news: unknown, rolePath: (mount: string, name: string) => string, defaultMount?: string) => string | undefined;
 /**
  * How OpenBao keys an ACL policy: trimmed and lowercased. openbao v2.6.2
  * vault/policy/policy_store.go:698-700 (`sanitizeName`), applied by SetPolicy (:268), GetPolicy
@@ -57,14 +66,6 @@ export declare const policyKey: (name: string) => string;
  *   `refuseMovedUpdate` stops reconcile before it writes anything.
  */
 export declare const isMoved: (stored: string, declared: string | undefined, key?: (identity: string) => string) => boolean | undefined;
-/**
- * The role path a resource last wrote, or last tried to: its attributes once a write finished, else
- * the props of the create or replacement that did not (`output` is undefined for both).
- */
-export declare const triedRolePath: (output: {
-    readonly mount: string;
-    readonly name: string;
-} | undefined, olds: unknown, rolePath: (mount: string, name: string) => string) => string | undefined;
 /**
  * The diff's first question, asked before `isResolved(news)`: the move from the identity this
  * resource last wrote or tried (`tried`) to the declared one, or undefined when both name the same

package/dist/openbao/rename.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rename.d.ts","sourceRoot":"","sources":["../../src/openbao/rename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,SAAU,OAAO,OAAO,MAAM,KAAG,OAI1D,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,SACrB,OAAO,YACH,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,KAChD,MAAM,GAAG,SAIX,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAmC,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,WACV,MAAM,YACJ,MAAM,GAAG,SAAS,QACvB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,KAChC,OAAO,GAAG,SAAiF,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,aAAa,WAChB;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,QAC/D,OAAO,YACH,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,KAChD,MAAM,GAAG,SACmF,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,WACZ,MAAM,SACP,MAAM,GAAG,SAAS,YACf,MAAM,GAAG,SAAS,UACpB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,QAC/B,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM;;;wGAgB/B,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,WAAY,MAAM,QAAQ,MAAM,MAAM,MAAM,uCAOvE,CAAC"}
+{"version":3,"file":"rename.d.ts","sourceRoot":"","sources":["../../src/openbao/rename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,SAAU,OAAO,OAAO,MAAM,KAAG,OAI1D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,SAAU,OAAO,OAAO,MAAM,YAAY,MAAM,KAAG,MAAM,GAAG,SACH,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SACrB,OAAO,YACH,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,iBAClC,MAAM,KACpB,MAAM,GAAG,SAOX,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAmC,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,WACV,MAAM,YACJ,MAAM,GAAG,SAAS,QACvB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,KAChC,OAAO,GAAG,SAAiF,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,WACZ,MAAM,SACP,MAAM,GAAG,SAAS,YACf,MAAM,GAAG,SAAS,UACpB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,QAC/B,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM;;;wGAgB/B,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,WAAY,MAAM,QAAQ,MAAM,MAAM,MAAM,uCAOvE,CAAC"}

package/dist/openbao/role-reconcile.d.ts

@@ -15,6 +15,7 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim, Owner } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 export interface RoleSpec<A> {
     /** `Bao.JwtRole` etc., for messages. */
@@ -33,8 +34,17 @@ type Found<A> = {
     readonly live: Record<string, unknown>;
 };
 export declare const readRoleAt: <A>(spec: RoleSpec<A>) => Effect.Effect<Found<A> | undefined, BaoError, HttpClient.HttpClient>;
+/**
+ * `read`: the live attributes — `Unowned` with no state unless our own interrupted create wrote
+ * them, which is `planRole`'s `noop` against that create's props (ownership/probe.ts).
+ */
+export declare const readOwnedRole: <A extends object>(ask: Owner, spec: RoleSpec<A>) => Effect.Effect<A | undefined, BaoError, HttpClient.HttpClient>;
 /** `update` or `noop` — the part of a diff after the identity checks. */
 export declare const planRole: <A>(spec: RoleSpec<A>) => Effect.Effect<'noop' | 'update', BaoError, HttpClient.HttpClient>;
-export declare const reconcileRole: <A>(spec: RoleSpec<A>) => Effect.Effect<A, BaoError, HttpClient.HttpClient>;
+/**
+ * ⛔ `claim` — every provider passes it — refuses, before any write, a create that finds a live
+ *   object this stack holds no state for (ownership/adopt.ts).
+ */
+export declare const reconcileRole: <A>(spec: RoleSpec<A>, claim?: Claim) => Effect.Effect<A, BaoError, HttpClient.HttpClient>;
 export {};
 //# sourceMappingURL=role-reconcile.d.ts.map

package/dist/openbao/role-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/role-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,SAAS,MAAM,EAAE,CAAC;CAC5E;AAED,KAAK,KAAK,CAAC,CAAC,IAAI;IAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEnF,eAAO,MAAM,UAAU,GAAI,CAAC,QACpB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGnE,CAAC;AAEJ,yEAAyE;AACzE,eAAO,MAAM,QAAQ,GAAI,CAAC,QAClB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK/D,CAAC;AAKL,eAAO,MAAM,aAAa,GAAI,CAAC,QACvB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CA0B/C,CAAC"}
+{"version":3,"file":"role-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/role-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,SAAS,MAAM,EAAE,CAAC;CAC5E;AAED,KAAK,KAAK,CAAC,CAAC,IAAI;IAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEnF,eAAO,MAAM,UAAU,GAAI,CAAC,QACpB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGnE,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,SAAS,MAAM,OACvC,KAAK,QACJ,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAM3D,CAAC;AAEL,yEAAyE;AACzE,eAAO,MAAM,QAAQ,GAAI,CAAC,QAClB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK/D,CAAC;AAKL;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,QACvB,QAAQ,CAAC,CAAC,CAAC,UACT,KAAK,KACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CA2B/C,CAAC"}

package/dist/openbao/ssh-role-erase.d.ts

@@ -0,0 +1,11 @@
+/**
+ * ⛔ THE FIELDS A WRITE WOULD SILENTLY DESTROY. Because the write is a full replace, a role
+ *   someone tuned by hand — `allowed_user_key_lengths` (a minimum RSA size), a
+ *   `key_id_format` the audit trail is grepped by, a `not_before_duration` widened to
+ *   survive clock skew, a non-default issuer — loses all of it the moment this resource
+ *   decides to update. A vanished key-length floor is a security regression that no plan
+ *   output would ever mention, and a vanished backdating window breaks signing on exactly
+ *   the skewed host it was added for. So reconcile refuses instead of writing.
+ */
+export declare const wouldErase: (live: Record<string, unknown>) => readonly string[];
+//# sourceMappingURL=ssh-role-erase.d.ts.map

package/dist/openbao/ssh-role-erase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-role-erase.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role-erase.ts"],"names":[],"mappings":"AAkCA;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,SAAS,MAAM,EAMzE,CAAC"}

package/dist/openbao/ssh-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-role.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,eAAe,EAQrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAyDH,eAAO,MAAM,kBAAkB,iGAqH5B,CAAC"}
+{"version":3,"file":"ssh-role.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,eAAe,EAOrB,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAeH,eAAO,MAAM,kBAAkB,iGA+H5B,CAAC"}

package/dist/ownership/adopt.d.ts

@@ -0,0 +1,52 @@
+import * as Effect from 'effect/Effect';
+/**
+ * Whether the resource at `fqn` may be adopted, resolved exactly as the planner resolves it (alchemy
+ * beta.79 Plan.ts: `resource.Adopt ?? shouldAdopt`): a resource-scoped `adopt(…)`, else the
+ * `AdoptPolicy` service, else `AlchemyContext.adopt`, else off.
+ * ★ FOR A CREATE THE ENGINE NEVER PROBED. Alchemy skips the adoption probe while `news` holds an
+ *   Output, so an ownership check that must still honour `--adopt` can only run at apply. All three
+ *   reach the apply: Alchemist runs plan AND apply under the session context, which provides the
+ *   services from the CLI flag and the Stack the resources registered on (Alchemist/Session.ts,
+ *   routes/stack.ts; Apply.ts reads the same Stack).
+ * ⛔ THE RESOURCE-SCOPED SETTING WINS, BOTH WAYS. The engine captures `adopt(…)` on the resource at
+ *   registration (Resource.ts `Adopt`, into `Stack.resources[fqn]`) and never hands it to a
+ *   provider. Reading only the deploy-wide flag let `--adopt` take over a resource declared
+ *   `.pipe(adopt(false))` — which the planner refuses — and refused one declared `adopt(true)`.
+ * ⚠️ `resources` carries an `@internal` comment in Alchemy's source, but it is in the published types
+ *   and the planner reads `Adopt` from it. caddy/adopt-scope.test.ts registers through the real
+ *   `Resource`, so an upgrade that stops recording it there fails the suite.
+ */
+export declare const adoptEnabled: (fqn: string) => Effect.Effect<boolean>;
+/** The three fields of a `reconcile` (or `read`) call that say whose object this is. */
+export type Owner = {
+    readonly fqn: string;
+    readonly instanceId: string;
+    /** The attributes state holds; `undefined` on a create. */
+    readonly output: unknown;
+};
+/** Whether a stateless `reconcile` may take over a live object: adoption on, for an adoptable one. */
+export declare const adoptsAtApply: (owner: Owner) => Effect.Effect<boolean>;
+/** A lifecycle helper's hook for refuseTakeover, bound to one call's Owner: `(what) => …`. */
+export type Claim = (what: string) => Effect.Effect<void>;
+/**
+ * `reconcile`'s check, called with the live object it found BEFORE any write: dies unless that
+ * object may be written. It may when state already vouches for it (`output`), when this apply
+ * resumes the resource's own interrupted create or replace and its diff proved the object that
+ * generation's (resume.ts), or when adoption is on for a create or an unfinished generation
+ * (adoptable).
+ * ⛔ WHY IT EXISTS AT ALL: THE PROBE DOES NOT GUARD EVERY CREATE. Alchemy skips it while `news` holds
+ *   an Output (Plan.ts), a new generation of a replace is never probed, and an object can appear
+ *   between plan and apply. Each of those used to be a silent takeover: written over, then recorded
+ *   as ours, and deleted with the stack under `destroy`.
+ * ⚠️ A CHECK, THEN A WRITE — NOT A LOCK. Two creates of one name in the same deploy run
+ *   concurrently, both read nothing, and both write (measured with the fakes, 2026-09-21). Nothing
+ *   between a read and a write can close that; declare each name once.
+ * ⚠️ AN IDENTICAL OBJECT IS STILL A TAKEOVER (decided 2026-09-21). Nothing would be written, but the
+ *   state row would claim it, and a later delete would remove what another owner still relies on.
+ * ⛔ A REFUSED CREATE FORGETS ITS `creating` ROW (rows.ts forgetRefusedCreate), or the next plan's
+ *   recovery read would adopt the very object this refused.
+ */
+export declare const refuseTakeover: (owner: Owner, what: string) => Effect.Effect<void>;
+/** refuseTakeover bound to one call's Owner, for a lifecycle helper that finds the live object. */
+export declare const claimFor: (owner: Owner) => Claim;
+//# sourceMappingURL=adopt.d.ts.map

package/dist/ownership/adopt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.d.ts","sourceRoot":"","sources":["../../src/ownership/adopt.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,QAAS,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAS5D,CAAC;AAEL,wFAAwF;AACxF,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAmBF,sGAAsG;AACtG,eAAO,MAAM,aAAa,UAAW,KAAK,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAI9D,CAAC;AAEL,8FAA8F;AAC9F,MAAM,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,UAAW,KAAK,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAiB1E,CAAC;AAEL,mGAAmG;AACnG,eAAO,MAAM,QAAQ,UACX,KAAK,KAAG,KAEa,CAAC"}

package/dist/ownership/probe.d.ts

@@ -0,0 +1,13 @@
+import * as Effect from 'effect/Effect';
+import type { Owner } from './adopt.ts';
+/**
+ * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
+ * or the recovery read (header): `found` is ours only when the state store records this instance
+ * with its whole declaration AND `settled` — the family's own "live matches these props" — says so.
+ * ⛔ `settled` NEVER FAILS THE READ. The recovery read runs with the INTERRUPTED deploy's props, so
+ *   a declaration that cannot be evaluated any more (a fragments directory since moved, a group
+ *   name since renamed) would fail every later plan, the fix included. It reads as "not proven
+ *   ours" instead — `Unowned`, which `--adopt` resolves — with the reason logged.
+ */
+export declare const ownedRead: <A extends object, E, R>(ask: Owner, found: A | undefined, settled: Effect.Effect<boolean, E, R>) => Effect.Effect<A | undefined, never, R>;
+//# sourceMappingURL=probe.d.ts.map

package/dist/ownership/probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../src/ownership/probe.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGxC;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,OACzC,KAAK,SACH,CAAC,GAAG,SAAS,WACX,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KACpC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,CAsBpC,CAAC"}

package/dist/ownership/resume.d.ts

@@ -0,0 +1,40 @@
+import * as Effect from 'effect/Effect';
+/**
+ * `diff`'s note for a row with no attributes: `instanceId` is an unfinished generation of this
+ * resource's own, which `--adopt` may resume when nothing proves it (adopt.ts adoptable). Returns
+ * `undefined`, a diff's "defer to the engine".
+ */
+export declare const noteUnfinished: (instanceId: string) => Effect.Effect<undefined>;
+/**
+ * Note `instanceId` unfinished, and a proven resume when `recovered` — the family's `read` of the
+ * row's props, asked with no attributes — answers a plain object: ours. `Unowned`, nothing, or a
+ * read that fails or dies proves nothing. ⚠️ Never fails the plan: an unproven resume is refused
+ * at apply instead, unless `--adopt`.
+ */
+export declare const noteResume: <R>(instanceId: string, recovered: Effect.Effect<unknown, unknown, R>) => Effect.Effect<void, never, R>;
+/** Whether the plan for this apply noted `instanceId` as a proven resumed create or replace. */
+export declare const resumes: (instanceId: string) => Effect.Effect<boolean>;
+/** Whether the plan for this apply saw `instanceId` as an unfinished generation (proven or not). */
+export declare const unfinished: (instanceId: string) => Effect.Effect<boolean>;
+/** The fields of a `read` or `diff` call provingResumes uses; a family's own input carries more. */
+type Ask = {
+    readonly id: string;
+    readonly fqn: string;
+    readonly instanceId: string;
+    readonly olds: unknown;
+    readonly output: unknown;
+};
+type Hook = Effect.Effect<unknown, unknown, unknown>;
+/** The two hooks provingResumes wraps, as Alchemy's ProviderService declares them. */
+interface Resumable {
+    read?(input: Ask): Hook;
+    diff?(input: Ask): Hook;
+}
+/**
+ * A provider whose `diff`, for a row with no attributes, first asks the provider's own `read` whether
+ * the live object is that unfinished generation's (noteResume), then runs as written. Every Bao.*
+ * family is built through it, so their diffs answer such a row with a plain `undefined`.
+ */
+export declare const provingResumes: <S extends Resumable>(service: S) => S;
+export {};
+//# sourceMappingURL=resume.d.ts.map

package/dist/ownership/resume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume.d.ts","sourceRoot":"","sources":["../../src/ownership/resume.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAmBxC;;;;GAIG;AACH,eAAO,MAAM,cAAc,eAAgB,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CACvB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,cACd,MAAM,aACP,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,KAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAO3B,CAAC;AAEL,gGAAgG;AAChG,eAAO,MAAM,OAAO,eAAgB,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAA8B,CAAC;AAEjG,oGAAoG;AACpG,eAAO,MAAM,UAAU,eAAgB,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CACtC,CAAC;AAEhC,oGAAoG;AACpG,KAAK,GAAG,GAAG;IACT,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AACF,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAErD,sFAAsF;AACtF,UAAU,SAAS;IACjB,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,CAAC,SAAS,SAAS,WAAW,CAAC,KAAG,CAYhE,CAAC"}

package/dist/ownership/rows.d.ts

@@ -0,0 +1,33 @@
+import * as Effect from 'effect/Effect';
+/**
+ * What the state store says of `instanceId` for this resource (at its FQN, or at a former FQN its
+ * `renamedFrom` names — the planner migrates that row before it recovers it):
+ *   · `absent`  — no row holds it. ★ This is what separates the probe from the recovery read: the
+ *     probe's instance id is minted for the probe (Plan.ts `generateInstanceId()`), 128 random bits
+ *     no row can hold.
+ *   · `partial` — a row holds it, but its props lack part of the declaration: a prop stripped at
+ *     commit because it was still an Output (whole.ts). Those props cannot prove an object ours.
+ *   · `whole`   — a row holds it with every prop the declaration names.
+ */
+export type Recorded = 'absent' | 'partial' | 'whole';
+export declare const recordedInstance: (fqn: string, instanceId: string) => Effect.Effect<Recorded>;
+/**
+ * Whether this apply's `instanceId` is a CREATE: the row Apply committed for it is `creating`.
+ * ⛔ A REPLACE'S NEW GENERATION IS NOT ONE. Apply commits it as `replacing`, and the planner never
+ *   offers it adoption — the probe runs only for a resource with no state — so `--adopt` must not
+ *   let it write over whatever sits at its new identity (adopt.ts adoptsAtApply).
+ */
+export declare const isCreate: (fqn: string, instanceId: string) => Effect.Effect<boolean>;
+/**
+ * ⛔ A REFUSED CREATE MUST NOT LEAVE A ROW THAT CLAIMS THE OBJECT IT REFUSED. Apply commits a
+ *   `creating` row for this instance before it calls reconcile, and a failed reconcile leaves it
+ *   there. The next plan's recovery read would then find our instance id and an object that can
+ *   match its props — a prop that was an Output is stripped from the row, and an omitted prop is
+ *   "not managed" — and adopt exactly what this apply refused. 🔴 MEASURED 2026-09-21: Bao.Mount
+ *   and Bao.AuthMethod did (openbao/adopt-core.test.ts). So the row goes, and state reads as if
+ *   the create never started: the next plan probes, and the probe answers `Unowned`.
+ * ⚠️ ONLY a `creating` row of THIS instance with no attributes — the one Apply just wrote. A
+ *   `replacing` row carries the previous generation in `old` and is never touched.
+ */
+export declare const forgetRefusedCreate: (fqn: string, instanceId: string) => Effect.Effect<void>;
+//# sourceMappingURL=rows.d.ts.map

package/dist/ownership/rows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rows.d.ts","sourceRoot":"","sources":["../../src/ownership/rows.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAkDxC;;;;;;;;;GASG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtD,eAAO,MAAM,gBAAgB,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAKrF,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAI7E,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAUpF,CAAC"}

package/dist/ownership/whole.d.ts

@@ -0,0 +1,14 @@
+import * as Effect from 'effect/Effect';
+/**
+ * Whether `recorded` carries a value everywhere `declared` does. Plain objects and arrays are
+ * walked; any other declared value — a literal, an Output, an Effect — needs a value in the row.
+ */
+export declare const carries: (declared: unknown, recorded: unknown) => boolean;
+/**
+ * Whether `props` — one generation's, from the state store — carry the whole declaration of the
+ * resource at `fqn`. ⛔ FALSE WITH NOTHING TO COMPARE: no Stack in context, or a resource no longer
+ *   declared (an orphan's delete). That object then reads as `Unowned` and Apply leaves it in place
+ *   with a note, rather than deleting what it cannot prove it made.
+ */
+export declare const wholeDeclaration: (fqn: string, props: unknown) => Effect.Effect<boolean>;
+//# sourceMappingURL=whole.d.ts.map