@homeflare/alchemy 0.7.0 → 0.10.0

package/src/openbao/adopt-recovery.test.ts

@@ -0,0 +1,71 @@
+/**
+ * Crash recovery survives the ownership rule: a deploy that dies after its write and before its
+ * commit leaves a `creating` (or `replacing`) row and a live object, and the next deploy must
+ * finish it WITHOUT `--adopt` — the object is ours (ownership/probe.ts, ownership/resume.ts).
+ * The crash is injected: the first read after a write answers 500, which is exactly a reconcile
+ * whose write landed and whose read-back, and so its commit, never did.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import { type Seen, crashAfterWrite } from './fake-bao.ts';
+import type { Estate } from './fake-engines-roles.ts';
+import { FAMILIES, withEstate } from './fake-families.ts';
+import { type FakeStack, writesOf } from './fake-stack.ts';
+
+const RESUME_REFUSED = /Cannot resume creating resource 'X'.*--adopt/s;
+
+type Run = (stack: FakeStack, estate: Estate, seen: Seen[], owner: FakeStack) => Promise<void>;
+const withCrashes = (body: (crashNext: () => void) => Run) => {
+  const fault = crashAfterWrite();
+  return withEstate(body(fault.crashNext), fault.wrap);
+};
+
+for (const row of FAMILIES) {
+  describe(`${row.family}: an interrupted create`, () => {
+    it('is resumed without --adopt when the object is what it wrote; nothing is rewritten', async () => {
+      await withCrashes((crashNext) => async (stack, estate, seen) => {
+        crashNext();
+        await assert.rejects(stack.deploy(row.declare('X', 'a', '15m')), /injected/);
+        assert.ok(row.has(estate, 'a'));
+        seen.length = 0;
+        assert.deepEqual(await stack.deploy(row.declare('X', 'a', '15m')), { X: 'create' });
+        assert.deepEqual(writesOf(seen), []);
+        assert.deepEqual(await stack.deploy(row.declare('X', 'a', '15m')), { X: 'noop' });
+      });
+    });
+
+    it('is refused when the object has since changed, and resumed with --adopt', async () => {
+      await withCrashes((crashNext) => async (stack, _estate, _seen, owner) => {
+        crashNext();
+        await assert.rejects(stack.deploy(row.declare('X', 'a', '15m')), /injected/);
+        // ★ Someone else rewrites it in between: another stack, taking it over with --adopt.
+        await owner.deploy(row.declare('O', 'a', '30m'), { adopt: true });
+        await assert.rejects(stack.deploy(row.declare('X', 'a', '15m')), RESUME_REFUSED);
+        const resumed = await stack.deploy(row.declare('X', 'a', '15m'), { adopt: true });
+        assert.deepEqual(resumed, { X: 'create' });
+      });
+    });
+  });
+}
+
+/** Bao.MfaTotpMethod never renames (mfa-totp.ts), so it has no replace to interrupt. */
+for (const row of FAMILIES.filter((each) => each.family !== 'Bao.MfaTotpMethod')) {
+  describe(`${row.family}: an interrupted replace`, () => {
+    it('is resumed without --adopt: the new generation it wrote is not taken over', async () => {
+      await withCrashes((crashNext) => async (stack, estate) => {
+        const { retain } = RemovalPolicy;
+        await stack.deploy(row.declare('X', 'a', '15m', retain));
+        crashNext();
+        await assert.rejects(stack.deploy(row.declare('X', 'b', '15m', retain)), /injected/);
+        assert.ok(row.has(estate, 'b'));
+        assert.deepEqual(await stack.deploy(row.declare('X', 'b', '15m', retain)), {
+          X: 'replace',
+        });
+        assert.deepEqual(await stack.deploy(row.declare('X', 'b', '15m', retain)), { X: 'noop' });
+      });
+    });
+  });
+}

package/src/openbao/auth-method-reconcile.ts

@@ -6,6 +6,7 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim } from '../ownership/adopt.ts';
 import {
   type BaoAuthMethodAttributes,
   type BaoAuthMethodProps,
@@ -36,22 +37,32 @@ const moveTarget = (props: BaoAuthMethodProps): MoveTarget => ({
   wire: (path) => `auth/${authPath(path)}`,
 });
 
-/** Converge one auth method. `stated` is the path in Alchemy's state, if any. */
+/**
+ * Converge one auth method. `stated` is the path in Alchemy's state, if any.
+ * ⛔ `claim`: the same first-reconcile takeover refusal as reconcileMount's (auth-method.ts passes it).
+ */
 export const reconcileAuthMethod = (
   news: BaoAuthMethodProps,
   stated: string | undefined,
   options?: RemountOptions,
+  claim?: Claim,
 ): Effect.Effect<BaoAuthMethodAttributes, BaoError | RemountError, HttpClient.HttpClient> =>
   Effect.gen(function* () {
     const move = planMove('Bao.AuthMethod', stated, news.path, news.remountFrom);
     if (move.kind === 'refuse') return yield* Effect.die(new Error(move.message));
+    const first = stated === undefined ? claim : undefined;
+    if (first !== undefined && move.kind === 'move') {
+      const source = yield* readMethod({ ...news, path: move.from });
+      if (source !== undefined)
+        yield* first(`Bao.AuthMethod ${move.from} (the remountFrom source)`);
+    }
     if (move.kind === 'move') yield* performMove(moveTarget(news), move.from, options);
 
     let live = yield* readMethod(news);
     if (live === undefined) {
       yield* enableAuthMethod(news);
       if (wantsTune(news)) yield* tuneAuthMethod(news);
-    } else if (!matches(live, news)) {
+    } else {
       if (live.type !== news.type) {
         return yield* Effect.die(
           new Error(
@@ -60,7 +71,8 @@ export const reconcileAuthMethod = (
           ),
         );
       }
-      yield* tuneAuthMethod(news);
+      if (first !== undefined) yield* first(`Bao.AuthMethod ${authPath(news.path)}`);
+      if (!matches(live, news)) yield* tuneAuthMethod(news);
     }
     live = yield* readMethod(news);
     if (live === undefined) {

package/src/openbao/auth-method.ts

@@ -19,6 +19,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { claimFor } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import {
   type BaoAuthMethodAttributes,
   type BaoAuthMethodProps,
@@ -54,12 +57,17 @@ export const BaoAuthMethodProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          return yield* readMethod(olds);
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const found = yield* readMethod(olds);
+          const ours = Effect.sync(() => found !== undefined && matches(found, olds));
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         diff: Effect.fn(function* ({ news, output }) {
-          if (output === undefined || !isResolved(news)) return undefined;
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
+          if (output === undefined) return undefined;
+          if (!isResolved(news)) return undefined;
           /**
            * ⛔ A CHANGED PATH FAILS HERE unless `remountFrom` names the old one — the same trap
            *   Bao.Mount had: reading the new path finds nothing, plans `update`, and enables an
@@ -81,8 +89,9 @@ export const BaoAuthMethodProvider = () =>
         }),
 
         /** The body, and the move, live in auth-method-reconcile.ts. */
-        reconcile: Effect.fn(function* ({ news, output }) {
-          return yield* reconcileAuthMethod(news, output?.path);
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
+          const claim = claimFor({ fqn, instanceId, output });
+          return yield* reconcileAuthMethod(news, output?.path, undefined, claim);
         }),
 
         /**
@@ -94,5 +103,5 @@ export const BaoAuthMethodProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/auth-role-form.test.ts

@@ -5,17 +5,11 @@
  *   sdk v2.6.2 framework.FieldData.Validate on the approle role fields (path_role.go:166-167,
  *   TypeDurationSecond): `secret_id_ttl: "2160h"` validates and parses to 7776000 seconds. A role
  *   read hands back that integer, which attributesOf renders as `90d` — the same role.
- * And what the diff calls a rename (a `replace`): only a change the server would not fold away.
+ * (What the diff calls a rename is pinned in rename-families.test.ts, `foldName`.)
  */
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
-import {
-  type BaoAuthRoleProps,
-  attributesOf,
-  isRename,
-  matches,
-  writeBody,
-} from './auth-role-form.ts';
+import { type BaoAuthRoleProps, attributesOf, matches, writeBody } from './auth-role-form.ts';
 
 const PROPS: BaoAuthRoleProps = {
   bindSecretId: true,
@@ -47,11 +41,3 @@ describe('auth role secret_id TTL', () => {
     assert.equal(matches(attributesOf(PROPS, { ...live, secret_id_ttl: 0 }), PROPS), false);
   });
 });
-
-describe('auth role rename', () => {
-  it('is a rename only when the lower-cased names differ, as the server stores them', () => {
-    assert.equal(isRename('pve-node--node-a', 'pve-node--node-b'), true);
-    assert.equal(isRename('Host-Cert', 'host-cert'), false);
-    assert.equal(isRename('host-cert', 'host-cert'), false);
-  });
-});

package/src/openbao/auth-role-form.ts

@@ -89,17 +89,6 @@ export const writeBody = (props: BaoAuthRoleProps): Record<string, string> => {
   return body;
 };
 
-/**
- * Whether a changed `name` names a DIFFERENT role — the diff's `replace` question.
- *
- * ⚠️ CASE-INSENSITIVELY, BECAUSE THE SERVER IS. AppRole stores `role/<lowercased name>` (openbao
- *   v2.6.2 builtin/credential/approle/path_role.go:1485, and roleEntry reads the same key, :1537),
- *   so `Host` → `host` is the SAME role: a `replace` there would write it, then — under `destroy` —
- *   delete the old generation, which is that same role.
- */
-export const isRename = (from: string, to: string): boolean =>
-  from.toLowerCase() !== to.toLowerCase();
-
 const samePolicies = (want: readonly string[], have: readonly string[]) =>
   want.length === have.length && want.every((policy, index) => policy === have[index]);
 

package/src/openbao/auth-role.ts

@@ -5,24 +5,28 @@
  *   are credential issuance, not configuration, and are OUT OF SCOPE. This declares the
  *   role shape an approle login inherits — policy names and TTL strings only.
  *
- * ★ `defaultRemovalPolicy: 'retain'` — deleting a role revokes every token bound to it.
- *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ * ★ `defaultRemovalPolicy: 'retain'` — deleting a role locks out every host that logs in with it:
+ *   its secret_ids go with it (the ⚠️ on `delete` below). Opt in with
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { refuseTakeover } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import {
   type BaoAuthRoleAttributes,
   type BaoAuthRoleProps,
   attributesOf,
-  isRename,
   matches,
   readPath,
   writeBody,
 } from './auth-role-form.ts';
 import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
+import { foldName, guardRename, judgeRename, nameIdentity } from './rename-identity.ts';
 
 export type { BaoAuthRoleAttributes, BaoAuthRoleProps };
 
@@ -38,6 +42,14 @@ export const BaoAuthRole = Resource<BaoAuthRole>('Bao.AuthRole', {
   defaultRemovalPolicy: 'retain',
 });
 
+/**
+ * ⚠️ CASE-INSENSITIVELY, BECAUSE THE SERVER IS. AppRole stores `role/<lowercased name>` (openbao
+ *   v2.6.2 builtin/credential/approle/path_role.go:1485, and roleEntry reads the same key,
+ *   :1537), so `Host` → `host` is the SAME role: a `replace` there would write it, then — under
+ *   `destroy` — delete the old generation, which is that same role.
+ */
+const IDENTITY = nameIdentity<BaoAuthRoleAttributes>('Bao.AuthRole', readPath, foldName);
+
 const readRole = (props: BaoAuthRoleProps) =>
   Effect.gen(function* () {
     const live = yield* baoRead(readPath(props.name));
@@ -57,35 +69,47 @@ export const BaoAuthRoleProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          return yield* readRole(olds);
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const found = yield* readRole(olds);
+          const ours = Effect.sync(() => found !== undefined && matches(found, olds));
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         /**
          * ⛔ IT COMPARES THE LIVE ROLE, NOT THE STORED DIGEST. A role edited in the OpenBao
          *   UI is exactly the drift the check-* gates exist to catch.
          */
-        diff: Effect.fn(function* ({ news, output }) {
-          if (output === undefined || !isResolved(news)) return undefined;
+        diff: Effect.fn(function* ({ news, olds, output }) {
           /**
-           * ⛔ A RENAMED ROLE IS A NEW ROLE — NEW role_id, NEW secret_ids — SO IT IS A `replace`.
-           *   Until 2026-09-21 a new `name` read nothing, planned `update` and wrote the new role,
-           *   leaving the old one live under no state record: its secret_ids kept logging in for
-           *   their whole TTL, and no plan would ever mention it again (REPLACE.md).
+           * ⛔ A RENAMED ROLE IS A NEW ROLE — NEW role_id, NEW secret_ids — SO IT IS A `replace`,
+           *   judged before `isResolved(news)` (rename-identity.ts). Until 2026-09-21 a new `name`
+           *   read nothing, planned `update` and wrote the new role, leaving the old one live
+           *   under no state record: its secret_ids kept logging in for their whole TTL, and no
+           *   plan would ever mention it again (REPLACE.md). ⛔ A rename onto a role that exists
+           *   fails the plan.
            * ⚠️ UNDER THE DEFAULT `retain` THE OLD ROLE STILL STAYS LIVE — retain keeps the old
            *   generation of a replace (Apply.ts:2164-2173). For per-host roles (host-approles.ts),
            *   opt into `RemovalPolicy.destroy()` or destroy the old role's accessors by hand.
            */
-          // ⚠️ Case-insensitively, because the server is — the ⚠️ on isRename in auth-role-form.ts.
-          if (isRename(output.name, news.name)) return { action: 'replace' } as const;
+          const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
+          if (output === undefined) return undefined;
+          if (move !== undefined) return { action: 'replace' } as const;
+          if (!isResolved(news)) return undefined;
           const live = yield* readRole(news);
           if (live === undefined) return { action: 'update' } as const;
           if (matches(live, news)) return { action: 'noop' } as const;
           return { action: 'update' } as const;
         }),
 
-        reconcile: Effect.fn(function* ({ news }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
+          // ⛔ An `update` across a rename the diff could not see — refused before any write.
+          yield* guardRename(IDENTITY, news, output);
           const live = yield* readRole(news);
+          const path = readPath(news.name);
+          if (live !== undefined)
+            yield* refuseTakeover({ fqn, instanceId, output }, `Bao.AuthRole ${path}`);
           if (live === undefined || !matches(live, news)) {
             yield* baoWrite('PUT', readPath(news.name), writeBody(news));
           }
@@ -101,13 +125,20 @@ export const BaoAuthRoleProvider = () =>
         }),
 
         /**
-         * ⛔ DELETING A ROLE REVOKES EVERY TOKEN BOUND TO IT. Idempotent as Alchemy requires
-         *   — already gone is success — but retain is the default for a reason.
+         * ⚠️ DELETING A ROLE DOES NOT REVOKE THE TOKENS IT ISSUED. openbao v2.6.2 pathRoleDelete
+         *   (builtin/credential/approle/path_role.go:1858-1902) deletes every secret_id
+         *   (flushRoleSecrets, validation.go:420-446), the role_id mapping and the role, so no new
+         *   login succeeds, and it revokes nothing. A token already issued lives to its TTL; only
+         *   its renewal fails, because pathLoginRenew (path_login.go:414-438) refuses once the role
+         *   is gone. So this is not a containment action: to contain a leaked token, revoke it or
+         *   its accessor. (Corrected 2026-09-21: this said the delete revoked every token.)
+         * Idempotent as Alchemy requires — already gone is success — but retain is the default,
+         *   because every host logging in with the role is locked out at the delete.
          */
         delete: Effect.fn(function* ({ output }) {
           yield* baoDelete(readPath(output.name));
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/cloudflare-role.ts

@@ -21,6 +21,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { refuseTakeover } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { groupKey, scopeOfResource } from './cloudflare-group-scope.ts';
 import { CloudflarePermissionGroups, type GroupRef } from './cloudflare-permission-groups.ts';
 import { resolvePolicies } from './cloudflare-policy.ts';
@@ -38,13 +41,7 @@ import {
   readCloudflareRole,
   writeCloudflareRole,
 } from './cloudflare-role-wire.ts';
-import {
-  declaredRolePath,
-  isMoved,
-  judgeMove,
-  refuseMovedUpdate,
-  triedRolePath,
-} from './rename.ts';
+import { guardRename, judgeRename, roleIdentity } from './rename-identity.ts';
 
 export type { BaoCloudflareRoleAttributes, BaoCloudflareRoleProps };
 
@@ -66,6 +63,9 @@ export const BaoCloudflareRole = Resource<BaoCloudflareRole>('Bao.CloudflareRole
   defaultRemovalPolicy: 'retain',
 });
 
+/** Exact: a trailing `/` on the mount is the same path (`rolePath` trims it). */
+const IDENTITY = roleIdentity<BaoCloudflareRoleAttributes>('Bao.CloudflareRole', rolePath);
+
 export const BaoCloudflareRoleProvider = () =>
   Provider.effect(
     BaoCloudflareRole,
@@ -109,9 +109,15 @@ export const BaoCloudflareRoleProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
           const live = yield* readCloudflareRole(olds.mount, olds.name);
-          return live === undefined ? undefined : attributesOf(olds, live);
+          const found = live === undefined ? undefined : attributesOf(olds, live);
+          const ours = Effect.gen(function* () {
+            if (live === undefined || refusalOf(olds) !== undefined) return false;
+            return differences(olds, yield* resolved(olds), live).length === 0;
+          });
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         /**
@@ -131,9 +137,8 @@ export const BaoCloudflareRoleProvider = () =>
          *   and the old id leaves the stack as an orphan delete, which `retain` keeps live.
          */
         diff: Effect.fn(function* ({ news, olds, output }) {
-          const tried = triedRolePath(output, olds, rolePath);
-          const declared = declaredRolePath(news, rolePath);
-          const move = yield* judgeMove('Bao.CloudflareRole', tried, declared, (path) => path);
+          const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           if (!isResolved(news)) return undefined;
@@ -150,19 +155,19 @@ export const BaoCloudflareRoleProvider = () =>
             : ({ action: 'update' } as const);
         }),
 
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           const path = rolePath(news.mount, news.name);
           // ⛔ An `update` across a move the diff could not see — refused before any write.
-          const before = output === undefined ? path : rolePath(output.mount, output.name);
-          if (isMoved(before, path) === true) {
-            return yield* refuseMovedUpdate('Bao.CloudflareRole', before, path);
-          }
+          yield* guardRename(IDENTITY, news, output);
           const refusal = refusalOf(news);
           if (refusal !== undefined) {
             return yield* Effect.die(new Error(`Bao.CloudflareRole ${path}: ${refusal}.`));
           }
           const policies = yield* resolved(news);
           const live = yield* readCloudflareRole(news.mount, news.name);
+          if (live !== undefined) {
+            yield* refuseTakeover({ fqn, instanceId, output }, `Bao.CloudflareRole ${path}`);
+          }
           /**
            * ⛔ ADOPTING A ROLE THAT ALREADY MATCHES MUST NOT REWRITE IT. Alchemy's `adopted` action
            *   routes through reconcile (policy.ts has the Apply.ts reading), so without this guard
@@ -207,5 +212,5 @@ export const BaoCloudflareRoleProvider = () =>
           return undefined;
         }),
       });
-    }),
+    }).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/fake-bao.ts

@@ -82,3 +82,55 @@ export const runFailure = <A, E>(
   env: BaoEnvironment,
   effect: Effect.Effect<A, E, HttpClient.HttpClient>,
 ) => Effect.runPromise(provided(env, Effect.flip(effect)));
+
+/**
+ * An injected crash between a write and its commit. Once armed, `crashNext()` fails the first read
+ * that follows a write with a 500 — a reconcile whose write landed and whose read-back, and so the
+ * engine's commit, never did — and `crashNext('write')` lands the next write and then answers it
+ * 500, for a reconcile that reads nothing back (Bao.Policy). Either leaves the `creating` /
+ * `replacing` row a killed deploy leaves.
+ */
+export const crashAfterWrite = () => {
+  let armed: 'read-back' | 'write' | undefined;
+  let wrote = false;
+  const CRASH: Reply = { json: { errors: ['injected: the deploy died here'] }, status: 500 };
+  return {
+    crashNext: (at: 'read-back' | 'write' = 'read-back') => {
+      armed = at;
+      wrote = false;
+    },
+    wrap:
+      (answer: (seen: Seen) => Reply) =>
+      (seen: Seen): Reply => {
+        if (armed === 'write' && seen.method !== 'GET') {
+          armed = undefined;
+          answer(seen);
+          return CRASH;
+        }
+        if (armed !== undefined && seen.method !== 'GET') wrote = true;
+        if (armed !== undefined && wrote && seen.method === 'GET') {
+          armed = undefined;
+          return CRASH;
+        }
+        return answer(seen);
+      },
+  };
+};
+
+/**
+ * A deploy killed BEFORE a resource's reconcile ran: the first write to a path ending in `suffix` is
+ * refused (500) without landing. Aimed at an upstream, it fails every create waiting on it after
+ * Apply has committed their `creating` rows — rows whose create never asked whose object sat at
+ * its identity (ownership/whole.ts).
+ */
+export const refuseWriteOnce = (suffix: string) => {
+  let armed = true;
+  return (answer: (seen: Seen) => Reply) =>
+    (seen: Seen): Reply => {
+      if (armed && seen.method !== 'GET' && seen.path.endsWith(suffix)) {
+        armed = false;
+        return { json: { errors: ['injected: the upstream was refused'] }, status: 500 };
+      }
+      return answer(seen);
+    };
+};

package/src/openbao/fake-core.ts

@@ -0,0 +1,141 @@
+/**
+ * The five families fake-families.ts does not cover — Bao.Policy, Bao.CloudflareRole,
+ * Bao.ProxmoxRole, Bao.Mount and Bao.AuthMethod — as rows of one table over one routed fake, so the
+ * ownership tests (adopt-core.test.ts) drive each through Alchemy's own plan and apply. Each row
+ * declares one object whose identity is fixed; `knob` is a duration-like prop that is NOT its
+ * identity, so an Output can stand in for it and a second owner can change it.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import type * as Output from 'alchemy/Output';
+import { BaoAuthMethod, BaoAuthMethodProvider } from './auth-method.ts';
+import { BaoAuthRoleProvider } from './auth-role.ts';
+import { groupKey } from './cloudflare-group-scope.ts';
+import { CloudflarePermissionGroups } from './cloudflare-permission-groups.ts';
+import { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';
+import type { Reply, Seen } from './fake-bao.ts';
+import { aclPolicies, cloudflareRoles, fakePolicyProviders, proxmoxRoles } from './fake-engines.ts';
+import { wireRoles } from './fake-engines-roles.ts';
+import { liveTable } from './fake-mounts.ts';
+import { type FakeStack, type StackBody, fakeStack, withFakeStack } from './fake-stack.ts';
+import { BaoMount, BaoMountProvider } from './mount.ts';
+import { BaoPolicy } from './policy.ts';
+import { BaoProxmoxRole, BaoProxmoxRoleProvider } from './proxmox-role.ts';
+
+/** Every group resolves, to an id named after it — these tests are about ownership, not groups. */
+const groups = Layer.succeed(CloudflarePermissionGroups, {
+  resolve: (_mount, refs) =>
+    Effect.succeed(new Map(refs.map((ref) => [groupKey(ref.name, ref.scope), `id-${ref.name}`]))),
+});
+
+export const coreProviders = Layer.mergeAll(
+  fakePolicyProviders,
+  BaoCloudflareRoleProvider().pipe(Layer.provide(groups)),
+  BaoProxmoxRoleProvider(),
+  BaoMountProvider(),
+  BaoAuthMethodProvider(),
+  // ★ For `upstream`: an AppRole whose `tokenTtl` is the Output a knob is fed.
+  BaoAuthRoleProvider(),
+  FetchHttpClient.layer,
+);
+
+/** Every store behind one answer, routed by path. */
+export const coreEstate = () => {
+  const stores = {
+    auth: liveTable('sys/auth', {}),
+    cloudflare: cloudflareRoles(),
+    mounts: liveTable('sys/mounts', {}),
+    policies: aclPolicies(),
+    proxmox: proxmoxRoles(),
+    roles: wireRoles(),
+  };
+  const answer = (seen: Seen): Reply => {
+    const path = seen.path.replace(/^\/v1\//, '');
+    if (path.startsWith('sys/policies/acl/')) return stores.policies(seen);
+    if (path.startsWith('sys/auth')) return stores.auth.answer(seen);
+    if (path.startsWith('sys/mounts') || path.startsWith('sys/remount')) {
+      return stores.mounts.answer(seen);
+    }
+    if (path.startsWith('cloudflare-acme-dns/')) return stores.cloudflare(seen);
+    if (path.startsWith('proxmox-lab/')) return stores.proxmox(seen);
+    return stores.roles(seen);
+  };
+  return Object.assign(answer, stores);
+};
+
+export type CoreEstate = ReturnType<typeof coreEstate>;
+
+type Text = string | Output.Output<string>;
+
+export interface CoreRow {
+  readonly family: string;
+  /** One resource, logical id `id`, at the row's fixed identity. */
+  readonly declare: (id: string, knob: Text) => StackBody;
+  /** Whether the fake holds the object. */
+  readonly has: (estate: CoreEstate) => boolean;
+}
+
+export const CORE: readonly CoreRow[] = [
+  {
+    // ★ The fragments directory IS the content (fake-engines.ts), so a knob changes the policy.
+    declare: (id, knob) => BaoPolicy(id, { fragments: knob, name: 'app' }),
+    family: 'Bao.Policy',
+    has: (estate) => estate.policies.live.has('sys/policies/acl/app'),
+  },
+  {
+    declare: (id, knob) =>
+      BaoCloudflareRole(id, {
+        description: 'Read DNS records on one zone. (zone: example.com)',
+        maxTtl: '1h',
+        mount: 'cloudflare-acme-dns',
+        name: 'dns-read',
+        policies: [
+          {
+            effect: 'allow',
+            groupOrder: 'declared',
+            groups: ['DNS Read'],
+            resource: 'com.cloudflare.api.account.zone.z1',
+          },
+        ],
+        ttl: knob,
+      }),
+    family: 'Bao.CloudflareRole',
+    has: (estate) => estate.cloudflare.live.has('cloudflare-acme-dns/roles/dns-read'),
+  },
+  {
+    declare: (id, knob) =>
+      BaoProxmoxRole(id, {
+        maxTtl: '6h',
+        mintUser: 'reader@pve',
+        mount: 'proxmox-lab',
+        name: 'read',
+        ttl: knob,
+      }),
+    family: 'Bao.ProxmoxRole',
+    has: (estate) => estate.proxmox.live.has('proxmox-lab/roles/read'),
+  },
+  {
+    declare: (id, knob) => BaoMount(id, { defaultLeaseTtl: knob, path: 'kv', type: 'kv' }),
+    family: 'Bao.Mount',
+    has: (estate) => estate.mounts.table.has('kv/'),
+  },
+  {
+    declare: (id, knob) => BaoAuthMethod(id, { defaultLeaseTtl: knob, path: 'jwt', type: 'jwt' }),
+    family: 'Bao.AuthMethod',
+    has: (estate) => estate.auth.table.has('jwt/'),
+  },
+];
+
+/** One stack over a fresh core estate, plus `owner`: a second stack over the same fake. */
+export const withCore = (
+  body: (stack: FakeStack, estate: CoreEstate, seen: Seen[], owner: FakeStack) => Promise<void>,
+  answer: (estate: CoreEstate) => (seen: Seen) => Reply = (estate) => estate,
+): Promise<void> => {
+  const estate = coreEstate();
+  return withFakeStack(coreProviders, answer(estate), (stack, bao) =>
+    body(stack, estate, bao.seen, fakeStack(coreProviders, { BAO_ADDR: bao.address }, 'Owner')),
+  );
+};