@homeflare/alchemy 0.7.0 → 0.10.0

package/src/openbao/rename-families.test.ts

@@ -0,0 +1,122 @@
+/**
+ * The nine batch-2 families, renamed through Alchemy's own plan and apply (fake-stack.ts), one row
+ * each (fake-families.ts). 🔴 Before rename-identity.ts, MEASURED 2026-09-21 against these fakes:
+ *   · a swap under destroy was a GREEN deploy that deleted both objects, for Bao.AuthRole,
+ *     Bao.PkiRole, Bao.JwtRole, Bao.KubernetesRole, Bao.SshRole and Bao.Plugin, and a shift left
+ *     only `c`. Bao.JwtAuthConfig wrote each config over the other (it has no delete), and
+ *     Bao.MfaLoginEnforcement did the same, then stopped on its two refused deletes;
+ *   · a rename landing with another pending Output planned `update` for all nine and left the old
+ *     object live and unrecorded; for Bao.MfaTotpMethod that wrote a second method;
+ *   · with the identity itself pending, all nine wrote the new object and kept the old.
+ * What each family's identity folds or defaults is pinned in rename-identity.test.ts.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as Output from 'alchemy/Output';
+import * as Effect from 'effect/Effect';
+import type { Estate } from './fake-engines-roles.ts';
+import { FAMILIES, type Family, pairOf, upstream, withEstate } from './fake-families.ts';
+import { writesOf } from './fake-stack.ts';
+
+const OCCUPIED = /would land on an object that already exists/;
+/** Bao.MfaTotpMethod never replaces: every rename is refused (mfa-totp.ts). */
+const STRANDS = /would strand every enrolled secret/;
+const isTotp = (row: Family) => row.family === 'Bao.MfaTotpMethod';
+
+const snapshot = (estate: Estate) => [
+  new Map(estate.roles.live),
+  new Map(estate.plugins.live),
+  new Map(estate.totp.live),
+];
+
+/** Another prop of the row pending: the upstream's `tokenTtl` changes in the same deploy. */
+const pendingKnob = (row: Family) => (ttl: string, name: string) =>
+  Effect.gen(function* () {
+    const up = yield* upstream(ttl);
+    yield* row.declare('Subject', name, up.tokenTtl);
+  });
+
+/** The identity itself pending: `r-15m`, then `r-30m`. */
+const pendingName = (row: Family) => (ttl: string) =>
+  Effect.gen(function* () {
+    const up = yield* upstream(ttl);
+    yield* row.declare('Subject', Output.interpolate`r-${up.tokenTtl}`, '15m');
+  });
+
+for (const row of FAMILIES) {
+  describe(`${row.family}: a rename`, () => {
+    const pair = pairOf(row);
+    const refusal = isTotp(row) ? STRANDS : OCCUPIED;
+
+    /**
+     * ★ THE CONTROL: the identity a generation RECORDS must be the one its props DECLARE. If the two
+     *   spellings drift apart (a default mount, a version, a trailing `/`), every later plan reads as
+     *   a move onto the resource's own object and fails, or replaces it, under destroy, onto itself.
+     */
+    it('redeployed unchanged is a noop that writes nothing', async () => {
+      await withEstate(async (stack, _estate, seen) => {
+        await stack.deploy(pair('a', 'b'));
+        seen.length = 0;
+        assert.deepEqual(await stack.deploy(pair('a', 'b')), { X: 'noop', Y: 'noop' });
+        assert.deepEqual(writesOf(seen), []);
+      });
+    });
+
+    it('onto a name its sibling holds (a swap, under destroy) writes and deletes nothing', async () => {
+      await withEstate(async (stack, estate, seen) => {
+        await stack.deploy(pair('a', 'b'));
+        const before = snapshot(estate);
+        seen.length = 0;
+        await assert.rejects(stack.deploy(pair('b', 'a')), refusal);
+        assert.deepEqual(writesOf(seen), []);
+        assert.deepEqual(snapshot(estate), before);
+      });
+    });
+
+    it('onto a name still held while that one moves on (a shift) writes nothing', async () => {
+      await withEstate(async (stack, estate, seen) => {
+        await stack.deploy(pair('a', 'b'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(pair('b', 'c')), refusal);
+        assert.deepEqual(writesOf(seen), []);
+        assert.ok(row.has(estate, 'a') && row.has(estate, 'b') && !row.has(estate, 'c'));
+      });
+    });
+
+    it('that lands with another prop pending is judged at plan, not planned as update', async () => {
+      await withEstate(async (stack, estate, seen) => {
+        const body = pendingKnob(row);
+        await stack.deploy(body('15m', 'a'));
+        if (isTotp(row)) {
+          seen.length = 0;
+          await assert.rejects(stack.deploy(body('30m', 'b')), STRANDS);
+          // ★ At plan: not even the upstream's update is applied.
+          assert.deepEqual(writesOf(seen), []);
+          return;
+        }
+        assert.deepEqual(await stack.deploy(body('30m', 'b')), {
+          Subject: 'replace',
+          Upstream: 'update',
+        });
+        // ★ The default retain keeps the old generation; the new one is written.
+        assert.ok(row.has(estate, 'a') && row.has(estate, 'b'));
+      });
+    });
+
+    it('to a name not known until apply is refused before any write, then judged', async () => {
+      await withEstate(async (stack, estate) => {
+        const body = pendingName(row);
+        await stack.deploy(body('15m'));
+        const moved = isTotp(row) ? /renaming from `r-15m`/ : /identity moved from \S*r-15m\S* to/;
+        await assert.rejects(stack.deploy(body('30m')), moved);
+        assert.ok(!row.has(estate, 'r-30m'));
+        if (isTotp(row)) {
+          await assert.rejects(stack.deploy(body('30m')), STRANDS);
+          return;
+        }
+        assert.deepEqual(await stack.deploy(body('30m')), { Subject: 'replace', Upstream: 'noop' });
+        assert.ok(row.has(estate, 'r-30m'));
+      });
+    });
+  });
+}

package/src/openbao/rename-identity.test.ts

@@ -0,0 +1,129 @@
+/**
+ * What each family counts as "the same object": the case the server folds, the mount an absent prop
+ * means, a trailing `/`, and a plugin's version. rename-identity.ts spells an identity twice, as the
+ * diff's props DECLARE it and as a generation's attributes RECORD it, and the two must agree, or a
+ * plan reads a resource's own object as a move onto somebody else's. Run through Alchemy's own plan
+ * and apply (fake-stack.ts) against fake-engines-roles.ts.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import { rowOf, withEstate } from './fake-families.ts';
+import { writesOf } from './fake-stack.ts';
+import { BaoJwtAuthConfig } from './jwt-config.ts';
+import { BaoPkiRole } from './pki-role.ts';
+import { BaoPlugin } from './plugin.ts';
+import { foldName } from './rename-identity.ts';
+
+const OCCUPIED = /would land on an object that already exists/;
+
+describe('a change of case the server folds away is not a rename', () => {
+  it('foldName lowercases the name segment only; a mount path keeps its case', () => {
+    assert.equal(foldName('Host-Cert'), 'host-cert');
+    assert.equal(foldName('auth/K8s/role/App'), 'auth/K8s/role/app');
+  });
+
+  it('Bao.AuthRole: `Host-A` after `host-a` under destroy is a noop, nothing deleted', async () => {
+    const row = rowOf('Bao.AuthRole');
+    await withEstate(async (stack, estate, seen) => {
+      await stack.deploy(row.declare('Role', 'host-a', '15m', RemovalPolicy.destroy));
+      seen.length = 0;
+      const plan = await stack.deploy(row.declare('Role', 'Host-A', '15m', RemovalPolicy.destroy));
+      assert.deepEqual(plan, { Role: 'noop' });
+      assert.deepEqual(writesOf(seen), []);
+      assert.ok(row.has(estate, 'host-a'));
+    });
+  });
+
+  /**
+   * ★ Both refuse an upper-case name (`problems`), so the change is refused either way. Folded, it is
+   *   refused for what it is; compared exactly, the plan read `role/App`, the server folded that to
+   *   the role's own `role/app`, and the move was refused as landing on an object that exists.
+   */
+  for (const family of ['Bao.JwtRole', 'Bao.KubernetesRole']) {
+    it(`${family}: \`App\` after \`app\` is the same role, refused only for its case`, async () => {
+      const row = rowOf(family);
+      await withEstate(async (stack, estate, seen) => {
+        await stack.deploy(row.declare('Role', 'app', '15m', RemovalPolicy.destroy));
+        seen.length = 0;
+        const again = stack.deploy(row.declare('Role', 'App', '15m', RemovalPolicy.destroy));
+        await assert.rejects(again, /must be lower case/);
+        assert.deepEqual(writesOf(seen), []);
+        assert.ok(row.has(estate, 'app'));
+      });
+    });
+  }
+});
+
+describe('the mount an absent prop means, and a trailing `/`, are the same mount', () => {
+  it('Bao.JwtAuthConfig with no `mount` redeploys as a noop: the default is `jwt`', async () => {
+    const config = () =>
+      BaoJwtAuthConfig('Config', {
+        boundIssuer: 'https://issuer.example.com',
+        jwksUrl: 'https://issuer.example.com/keys',
+      });
+    await withEstate(async (stack, estate, seen) => {
+      await stack.deploy(config());
+      seen.length = 0;
+      assert.deepEqual(await stack.deploy(config()), { Config: 'noop' });
+      assert.deepEqual(writesOf(seen), []);
+      assert.ok(estate.roles.live.has('auth/jwt/config'));
+    });
+  });
+
+  it('Bao.PkiRole: `pki/` after the default mount is the same role, a noop', async () => {
+    const role = (mount?: string) =>
+      BaoPkiRole('Role', {
+        allowedDomains: ['example.com'],
+        maxTtl: '8760h',
+        name: 'web',
+        ttl: '15m',
+        ...(mount === undefined ? {} : { mount }),
+      }).pipe(RemovalPolicy.destroy());
+    await withEstate(async (stack, estate, seen) => {
+      await stack.deploy(role());
+      seen.length = 0;
+      assert.deepEqual(await stack.deploy(role('pki/')), { Role: 'noop' });
+      assert.deepEqual(writesOf(seen), []);
+      assert.ok(estate.roles.live.has('pki/roles/web'));
+    });
+  });
+});
+
+describe('Bao.Plugin: the version is part of the catalog key', () => {
+  const CATALOG = 'sys/plugins/catalog/secret/example';
+  const plugin = (version: string) =>
+    BaoPlugin('Plugin', {
+      command: 'plugin-example',
+      name: 'example',
+      sha256: 'a'.repeat(64),
+      type: 'secret',
+      version,
+    }).pipe(RemovalPolicy.destroy());
+
+  it('a bump registers the new version, then deregisters the old one', async () => {
+    await withEstate(async (stack, estate, seen) => {
+      await stack.deploy(plugin('v1.0.0'));
+      seen.length = 0;
+      assert.deepEqual(await stack.deploy(plugin('v1.1.0')), { Plugin: 'replace' });
+      assert.deepEqual(writesOf(seen), [
+        `PUT /v1/${CATALOG}`,
+        `DELETE /v1/${CATALOG}?version=v1.0.0`,
+      ]);
+      assert.deepEqual([...estate.plugins.live.keys()], [`${CATALOG}?version=v1.1.0`]);
+    });
+  });
+
+  it('a bump onto a version already registered by hand fails the plan', async () => {
+    await withEstate(async (stack, estate, seen) => {
+      await stack.deploy(plugin('v1.0.0'));
+      const byHand = { builtin: false, command: 'plugin-example', version: 'v1.1.0' };
+      estate.plugins.live.set(`${CATALOG}?version=v1.1.0`, byHand);
+      seen.length = 0;
+      await assert.rejects(stack.deploy(plugin('v1.1.0')), OCCUPIED);
+      assert.deepEqual(writesOf(seen), []);
+    });
+  });
+});

package/src/openbao/rename-identity.ts

@@ -0,0 +1,117 @@
+/**
+ * The rename guard every Bao.* family whose identity is a name, a mount, or a catalog key shares:
+ * one `Identity` per family, and two steps built from rename.ts, `judgeRename` at the top of `diff`
+ * and `guardRename` at the top of `reconcile`. REPLACE.md has the audit behind both.
+ *
+ * ★ ONE DESCRIPTION OF "WHICH OBJECT", NOT TWELVE COPIES OF THE CHECK. The rename-safety fix went
+ *   in family by family, and the families it skipped were the ones that kept the bug: nine of them
+ *   judged the identity only after `isResolved(news)` and never asked whether the new path was
+ *   taken. 🔴 MEASURED 2026-09-21 through the engine (rename-families.test.ts): two Bao.AuthRole,
+ *   Bao.PkiRole, Bao.JwtRole, Bao.KubernetesRole, Bao.SshRole or Bao.Plugin resources that swapped
+ *   names under `RemovalPolicy.destroy()` both planned `replace`, each wrote over the other, and
+ *   both old deletes then removed what had just been written: a green deploy, both objects gone.
+ *   With any other prop still an Output, all nine planned `update` and left the old object live
+ *   under no state record; for Bao.MfaTotpMethod that wrote a second method and stranded every
+ *   enrolment.
+ */
+import * as Effect from 'effect/Effect';
+import {
+  declaredRolePath,
+  declaredString,
+  isMoved,
+  judgeMove,
+  refuseMovedUpdate,
+} from './rename.ts';
+
+/** How one family names the object it manages — the thing a rename changes. */
+export interface Identity<A> {
+  /** `Bao.JwtRole` etc., for messages. */
+  readonly family: string;
+  /** The identity a set of props declares; undefined while any part of it is still an Output. */
+  readonly declared: (props: unknown) => string | undefined;
+  /** The identity a generation's attributes record. */
+  readonly recorded: (output: A) => string;
+  /** The API path an identity is read at, for the occupied check. Default: the identity. */
+  readonly pathOf?: ((identity: string) => string) | undefined;
+  /** How the server keys it (`policyKey`). Default: exact. */
+  readonly key?: ((identity: string) => string) | undefined;
+}
+
+/** A family keyed by `name` alone, read at `pathOf(name)`. */
+export const nameIdentity = <A extends { readonly name: string }>(
+  family: string,
+  pathOf: (name: string) => string,
+  key?: (name: string) => string,
+): Identity<A> => ({
+  declared: (props) => declaredString(props, 'name'),
+  family,
+  key,
+  pathOf,
+  recorded: (output) => output.name,
+});
+
+/**
+ * A role at `rolePath(mount, name)`; the identity is that path. `defaultMount` is what an absent
+ * `mount` prop means — undefined when `mount` is required.
+ */
+export const roleIdentity = <A extends { readonly mount: string; readonly name: string }>(
+  family: string,
+  rolePath: (mount: string, name: string) => string,
+  defaultMount?: string,
+  key?: (path: string) => string,
+): Identity<A> => ({
+  declared: (props) => declaredRolePath(props, rolePath, defaultMount),
+  family,
+  key,
+  recorded: (output) => rolePath(output.mount, output.name),
+});
+
+/**
+ * ⚠️ THE LAST SEGMENT LOWERCASED: a role store that folds the name and not the mount. openbao v2.6.2
+ *   AppRole (builtin/credential/approle/path_role.go:1485, :1537) and Kubernetes
+ *   (builtin/credential/kubernetes/backend.go:362, path_role.go:396) both store `role/<lowercased
+ *   name>`, and JWT reads its `name` as a TypeLowerCaseString (builtin/credential/jwt/path_role.go:77),
+ *   while the router folds no case in a mount path. So `Host` → `host` is the same role, never a
+ *   replace that would delete, under `destroy`, the role it had just written.
+ */
+export const foldName = (path: string): string =>
+  path.replace(/[^/]+$/, (name) => name.toLowerCase());
+
+/**
+ * `diff`'s first step, before `isResolved(news)`: the move from the identity this resource last
+ * wrote or tried to the declared one, or undefined when both name the same object or either is not
+ * known yet. ⛔ Fails the plan when the new identity is already taken (`judgeMove`).
+ *
+ * ★ `olds` STANDS IN FOR `output` WHILE A CREATE OR A REPLACEMENT IS UNFINISHED, which is what
+ *   catches reverting a move whose new generation failed (rename.ts, `judgeMove`).
+ */
+export const judgeRename = <A>(
+  identity: Identity<A>,
+  olds: unknown,
+  news: unknown,
+  output: A | undefined,
+) =>
+  judgeMove(
+    identity.family,
+    output === undefined ? identity.declared(olds) : identity.recorded(output),
+    identity.declared(news),
+    identity.pathOf ?? ((path) => path),
+    identity.key,
+  );
+
+/**
+ * `reconcile`'s first step: an `update` whose prior attributes name another object dies before any
+ * read or write (`refuseMovedUpdate`). Only reached when the diff could not see the new identity.
+ */
+export const guardRename = <A>(
+  identity: Identity<A>,
+  news: unknown,
+  output: A | undefined,
+): Effect.Effect<void> => {
+  if (output === undefined) return Effect.void;
+  const from = identity.recorded(output);
+  const to = identity.declared(news);
+  return to !== undefined && isMoved(from, to, identity.key) === true
+    ? refuseMovedUpdate(identity.family, from, to)
+    : Effect.void;
+};

package/src/openbao/rename.ts

@@ -1,6 +1,7 @@
 /**
- * Rename safety for the families whose identity is a name, or a mount and a name: Bao.Policy,
- * Bao.CloudflareRole and Bao.ProxmoxRole. REPLACE.md has the audit and what each answer does.
+ * Rename safety for the families whose identity is a name, a mount and a name, or a catalog key:
+ * the primitives. rename-identity.ts builds each family's diff and reconcile step from them, and
+ * REPLACE.md has the audit and what each answer does.
  *
  * ⛔ THE BUG THIS CLOSES, REPRODUCED 2026-09-21 AGAINST alchemy@2.0.0-beta.79's OWN PLAN AND APPLY
  *   (fake-stack.ts): a Bao.Policy deployed as `old`, then redeclared as `new` under
@@ -46,12 +47,26 @@ export const isPendingProp = (news: unknown, key: string): boolean => {
   return value !== undefined && typeof value !== 'string';
 };
 
-/** A role's API path from a diff's `news`, once both `mount` and `name` are resolved. */
+/**
+ * An optional string prop: `fallback` when it is absent, undefined while it is still an Output.
+ * ⚠️ Not `declaredString(…) ?? fallback`, which would read a pending mount as the default mount.
+ */
+export const declaredOr = (news: unknown, key: string, fallback: string): string | undefined =>
+  isPendingProp(news, key) ? undefined : (declaredString(news, key) ?? fallback);
+
+/**
+ * A role's API path from a diff's `news`, once both `mount` and `name` are resolved. `defaultMount`
+ * is what an absent `mount` means; without one, an absent mount is unknown.
+ */
 export const declaredRolePath = (
   news: unknown,
   rolePath: (mount: string, name: string) => string,
+  defaultMount?: string,
 ): string | undefined => {
-  const mount = declaredString(news, 'mount');
+  const mount =
+    defaultMount === undefined
+      ? declaredString(news, 'mount')
+      : declaredOr(news, 'mount', defaultMount);
   const name = declaredString(news, 'name');
   return mount === undefined || name === undefined ? undefined : rolePath(mount, name);
 };
@@ -85,17 +100,6 @@ export const isMoved = (
   key: (identity: string) => string = exact,
 ): boolean | undefined => (declared === undefined ? undefined : key(stored) !== key(declared));
 
-/**
- * The role path a resource last wrote, or last tried to: its attributes once a write finished, else
- * the props of the create or replacement that did not (`output` is undefined for both).
- */
-export const triedRolePath = (
-  output: { readonly mount: string; readonly name: string } | undefined,
-  olds: unknown,
-  rolePath: (mount: string, name: string) => string,
-): string | undefined =>
-  output === undefined ? declaredRolePath(olds, rolePath) : rolePath(output.mount, output.name);
-
 /**
  * The diff's first question, asked before `isResolved(news)`: the move from the identity this
  * resource last wrote or tried (`tried`) to the declared one, or undefined when both name the same

package/src/openbao/role-reconcile.ts

@@ -15,6 +15,8 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim, Owner } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
 import { baoRead, baoWrite } from './bao-http.ts';
 import type { BaoError } from './bao-status.ts';
 
@@ -40,6 +42,21 @@ export const readRoleAt = <A>(
     live === undefined ? undefined : { attributes: spec.attributesOf(live), live },
   );
 
+/**
+ * `read`: the live attributes — `Unowned` with no state unless our own interrupted create wrote
+ * them, which is `planRole`'s `noop` against that create's props (ownership/probe.ts).
+ */
+export const readOwnedRole = <A extends object>(
+  ask: Owner,
+  spec: RoleSpec<A>,
+): Effect.Effect<A | undefined, BaoError, HttpClient.HttpClient> =>
+  Effect.flatMap(readRoleAt(spec), (found) => {
+    const ours = Effect.sync(
+      () => found !== undefined && spec.problems.length === 0 && spec.matches(found.attributes),
+    );
+    return ownedRead(ask, found?.attributes, ours);
+  });
+
 /** `update` or `noop` — the part of a diff after the identity checks. */
 export const planRole = <A>(
   spec: RoleSpec<A>,
@@ -53,12 +70,18 @@ export const planRole = <A>(
 const refuse = (spec: { readonly family: string; readonly path: string }, message: string) =>
   Effect.die(new Error(`${spec.family} ${spec.path}: ${message}`));
 
+/**
+ * ⛔ `claim` — every provider passes it — refuses, before any write, a create that finds a live
+ *   object this stack holds no state for (ownership/adopt.ts).
+ */
 export const reconcileRole = <A>(
   spec: RoleSpec<A>,
+  claim?: Claim,
 ): Effect.Effect<A, BaoError, HttpClient.HttpClient> =>
   Effect.gen(function* () {
     if (spec.problems.length > 0) return yield* refuse(spec, spec.problems.join('; '));
     const found = yield* readRoleAt(spec);
+    if (found !== undefined && claim !== undefined) yield* claim(`${spec.family} ${spec.path}`);
     if (found === undefined || !spec.matches(found.attributes)) {
       const lost = found === undefined ? [] : (spec.wouldErase?.(found.live) ?? []);
       if (lost.length > 0) {

package/src/openbao/ssh-role-erase.ts

@@ -0,0 +1,50 @@
+/**
+ * Bao.SshRole's guard against its own full-replace write: the live fields a write would reset that
+ * the declaration does not model. Split from ssh-role.ts, whose reconcile calls it.
+ */
+import { extMap } from './ssh-role-form.ts';
+
+/**
+ * Fields this resource deliberately does not model, mapped to the value OpenBao's own write
+ * puts there when nobody says otherwise. The templating flags change how a principal is
+ * DERIVED at signing time, which is a different kind of decision from which principals
+ * exist; the rest are issuance mechanics. MEASURED against all three live roles — every one
+ * of them sits on exactly these values, so the guard below fires on nothing that exists.
+ */
+const UNMANAGED_DEFAULTS: Readonly<Record<string, unknown>> = {
+  algorithm_signer: 'default',
+  allow_commas_in_identity_templates: false,
+  allow_user_key_ids: false,
+  allowed_domains_template: false,
+  allowed_users_template: false,
+  default_extensions_template: false,
+  default_user_template: false,
+  issuer_ref: 'default',
+  key_id_format: '',
+  not_before_duration: 30,
+};
+
+/**
+ * ⚠️ ABSENT AND EMPTY BOTH COUNT AS "NEVER SET". A role this resource wrote omits these
+ *   fields entirely, so a stricter test would refuse on the provider's own output and
+ *   deadlock the update after next.
+ */
+const isDefault = (live: Record<string, unknown>, field: string) =>
+  live[field] === undefined || live[field] === '' || live[field] === UNMANAGED_DEFAULTS[field];
+
+/**
+ * ⛔ THE FIELDS A WRITE WOULD SILENTLY DESTROY. Because the write is a full replace, a role
+ *   someone tuned by hand — `allowed_user_key_lengths` (a minimum RSA size), a
+ *   `key_id_format` the audit trail is grepped by, a `not_before_duration` widened to
+ *   survive clock skew, a non-default issuer — loses all of it the moment this resource
+ *   decides to update. A vanished key-length floor is a security regression that no plan
+ *   output would ever mention, and a vanished backdating window breaks signing on exactly
+ *   the skewed host it was added for. So reconcile refuses instead of writing.
+ */
+export const wouldErase = (live: Record<string, unknown>): readonly string[] => {
+  const lost = Object.keys(UNMANAGED_DEFAULTS).filter((field) => !isDefault(live, field));
+  if (Object.keys(extMap(live['allowed_user_key_lengths'])).length > 0) {
+    lost.push('allowed_user_key_lengths');
+  }
+  return lost.sort();
+};