@homeflare/alchemy 0.7.0 → 0.10.0

package/dist/launchd/job-lifecycle.d.ts

@@ -28,7 +28,14 @@ export declare const readJob: (runner: HostRunner, props: Identity) => Promise<L
  */
 export declare const replaceDiff: (runner: HostRunner, next: Identity, full: LaunchdJobProps | undefined, output: LaunchdJobAttributes) => Promise<Diff>;
 export declare const diffJob: (runner: HostRunner, news: LaunchdJobProps, output: LaunchdJobAttributes) => Promise<Diff>;
-export declare const reconcileJob: (runner: HostRunner, props: LaunchdJobProps, output: LaunchdJobAttributes | undefined) => Promise<LaunchdJobAttributes>;
+/**
+ * `adopt` is whether adoption is on AND this apply is a create or an unfinished generation of our
+ * own (ownership/adopt.ts adoptsAtApply): it lets such a generation take over a job already on the
+ * host, as the plan's probe would have. A rename onto an occupied label stays refused, as it is at
+ * plan time (assertReplaceable) — including a label taken between that plan and a fresh replace's
+ * new generation, which the caller never marks adoptable.
+ */
+export declare const reconcileJob: (runner: HostRunner, props: LaunchdJobProps, output: LaunchdJobAttributes | undefined, adopt?: boolean) => Promise<LaunchdJobAttributes>;
 /** Boot out, then remove the plist. Idempotent: an absent job and an absent file are success. */
 export declare const deleteJob: (runner: HostRunner, output: LaunchdJobAttributes) => Promise<void>;
 //# sourceMappingURL=job-lifecycle.d.ts.map

package/dist/launchd/job-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-lifecycle.d.ts","sourceRoot":"","sources":["../../src/launchd/job-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAIrB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,QAAQ,EASd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmB9C,uGAAuG;AACvG,eAAO,MAAM,OAAO,WACV,UAAU,SACX,QAAQ,KACd,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAM1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,WACd,UAAU,QACZ,QAAQ,QACR,eAAe,GAAG,SAAS,UACzB,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,eAAO,MAAM,OAAO,WACV,UAAU,QACZ,eAAe,UACb,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAad,CAAC;AAEF,eAAO,MAAM,YAAY,WACf,UAAU,SACX,eAAe,UACd,oBAAoB,GAAG,SAAS,KACvC,OAAO,CAAC,oBAAoB,CAsE9B,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,SAAS,WACZ,UAAU,UACV,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAQd,CAAC"}
+{"version":3,"file":"job-lifecycle.d.ts","sourceRoot":"","sources":["../../src/launchd/job-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAIrB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,QAAQ,EAWd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmB9C,uGAAuG;AACvG,eAAO,MAAM,OAAO,WACV,UAAU,SACX,QAAQ,KACd,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAM1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,WACd,UAAU,QACZ,QAAQ,QACR,eAAe,GAAG,SAAS,UACzB,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,eAAO,MAAM,OAAO,WACV,UAAU,QACZ,eAAe,UACb,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAiBd,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,WACf,UAAU,SACX,eAAe,UACd,oBAAoB,GAAG,SAAS,sBAEvC,OAAO,CAAC,oBAAoB,CAgE9B,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,SAAS,WACZ,UAAU,UACV,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAQd,CAAC"}

package/dist/launchd/job-preflight.d.ts

@@ -12,13 +12,25 @@
  */
 import { type LaunchdJobAttributes, type LaunchdJobProps, type ParsedDomain } from './job-form.ts';
 import { type ServiceStatus } from './launchctl.ts';
-import { type HostRunner } from './runner.ts';
+import { type HostRunner, type WriteOptions } from './runner.ts';
 export type Location = {
     readonly domain: ParsedDomain;
     readonly plistPath: string;
     readonly target: string;
 };
 export type Identity = Pick<LaunchdJobProps, 'label' | 'domain'>;
+/**
+ * ⚠️ launchd refuses a daemon plist that is not root:wheel or is group/world-writable ("bad
+ *   ownership/permissions"), so the system domain always writes 0644 root:wheel. An agent's plist
+ *   belongs to its user. REASONED from launchd's documented behaviour, not measured here (no
+ *   bootstrap was run to write this); the nix-darwin daemons on the reference host are 0644 root.
+ */
+export declare const plistWriteOptions: (domain: ParsedDomain) => WriteOptions;
+/**
+ * PLAN TIME, for a plan that will write the plist: the runner's own pre-write refusals
+ * (HostRunner.checkWrite — sudoRunner's directory and mode checks), reading only.
+ */
+export declare const checkPlistWrite: (runner: HostRunner, location: Location) => Promise<void>;
 export declare const refuse: (label: string, message: string) => Error;
 /** Throw every refusal at once, so one plan shows the whole list. */
 export declare const assertValid: (props: LaunchdJobProps) => void;

package/dist/launchd/job-preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-preflight.d.ts","sourceRoot":"","sources":["../../src/launchd/job-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,YAAY,EAKlB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,KAAK,aAAa,EAA4B,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,aAAa,CAAC;AAE5D,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;AAEjE,eAAO,MAAM,MAAM,UAAW,MAAM,WAAW,MAAM,KAAG,KACT,CAAC;AAEhD,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,IAGpD,CAAC;AAEF,eAAO,MAAM,MAAM,WAAkB,UAAU,SAAS,QAAQ,KAAG,OAAO,CAAC,QAAQ,CAUlF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,WAAY,UAAU,SAAS,MAAM,UAAU,YAAY,KAAG,IAgBxF,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,SAAS,WACZ,UAAU,SACX,QAAQ,KACd,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAwBvD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAClB,UAAU,SACX,MAAM,YACH,QAAQ,UACV,aAAa,kBACL,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,WACpB,UAAU,QACZ,QAAQ,QACR,eAAe,GAAG,SAAS,OAC5B,oBAAoB,kBACT,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,IAAI,CAQd,CAAC"}
+{"version":3,"file":"job-preflight.d.ts","sourceRoot":"","sources":["../../src/launchd/job-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,YAAY,EAKlB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,KAAK,aAAa,EAA4B,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,YAAY,EAAgB,MAAM,aAAa,CAAC;AAE/E,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,WAAY,YAAY,KAAG,YACsC,CAAC;AAEhG;;;GAGG;AACH,eAAO,MAAM,eAAe,WAAkB,UAAU,YAAY,QAAQ,KAAG,OAAO,CAAC,IAAI,CACd,CAAC;AAE9E,eAAO,MAAM,MAAM,UAAW,MAAM,WAAW,MAAM,KAAG,KACT,CAAC;AAEhD,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,IAGpD,CAAC;AAEF,eAAO,MAAM,MAAM,WAAkB,UAAU,SAAS,QAAQ,KAAG,OAAO,CAAC,QAAQ,CAUlF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,WAAY,UAAU,SAAS,MAAM,UAAU,YAAY,KAAG,IAiBxF,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,SAAS,WACZ,UAAU,SACX,QAAQ,KACd,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAwBvD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAClB,UAAU,SACX,MAAM,YACH,QAAQ,UACV,aAAa,kBACL,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,WACpB,UAAU,QACZ,QAAQ,QACR,eAAe,GAAG,SAAS,OAC5B,oBAAoB,kBACT,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,IAAI,CASd,CAAC"}

package/dist/launchd/job-validate.d.ts

@@ -7,6 +7,8 @@
  *   declaration says; a plan that fails is cheaper than a job that quietly does nothing.
  */
 import { type LaunchdJobProps } from './job-form.ts';
+/** ★ Labels become file names: no `/`, no leading dot, nothing a path could re-interpret. */
+export declare const LABEL: RegExp;
 /**
  * ⛔ LABELS OTHER TOOLS OWN ARE NEVER DECLARED HERE. nix-darwin (`org.nixos.*`) rewrites its plists
  *   on every activation and unloads any it no longer lists; macOS owns `com.apple.*`; `brew

package/dist/launchd/job-validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-validate.d.ts","sourceRoot":"","sources":["../../src/launchd/job-validate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,eAAe,CAAC;AAMvB;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAIpD,CAAC;AAkCF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,UAAW,MAAM,cAAc,MAAM,KAAG,MAAM,EAY1E,CAAC;AAEF,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,MAAM,EAkD1D,CAAC"}
+{"version":3,"file":"job-validate.d.ts","sourceRoot":"","sources":["../../src/launchd/job-validate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,eAAe,CAAC;AAGvB,6FAA6F;AAC7F,eAAO,MAAM,KAAK,QAAuC,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAIpD,CAAC;AAkCF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,UAAW,MAAM,cAAc,MAAM,KAAG,MAAM,EAY1E,CAAC;AAEF,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,MAAM,EAkD1D,CAAC"}

package/dist/launchd/job.d.ts

@@ -18,7 +18,8 @@
  * ⛔ ENVIRONMENT IS NON-SECRET ONLY — see the ⛔ on LaunchdJobProps.environment.
  * ⛔ NO SILENT SUDO — see assertMayWrite in job-preflight.ts.
  * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`. A label already loaded, or a plist already on disk, reads
- *   as `Unowned`, so Alchemy refuses to take it over unless asked. Labels under `org.nixos.`,
+ *   as `Unowned`, so Alchemy refuses to take it over unless asked — and reconcile, where the plan
+ *   never asked, honours the same `--adopt` / `adopt(…)` (docs/ownership.md). Labels under `org.nixos.`,
  *   `com.apple.` and `homebrew.mxcl.` are refused outright (job-validate.ts) — declare a new label
  *   and cut over instead (docs/launchd.md).
  */

package/dist/launchd/job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job.d.ts","sourceRoot":"","sources":["../../src/launchd/job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,6FA6C5B,CAAC"}
+{"version":3,"file":"job.d.ts","sourceRoot":"","sources":["../../src/launchd/job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,6FAmD5B,CAAC"}

package/dist/launchd/local-runner.d.ts

@@ -3,5 +3,7 @@ export type LocalRunnerOptions = {
     /** Kill a spawned program after this long. @default 120_000 */
     readonly execTimeoutMs?: number;
 };
+/** The errno code of a thrown fs error (`ENOENT`, `EACCES`, …), if it has one. */
+export declare const errnoCode: (cause: unknown) => string | undefined;
 export declare const localRunner: (options?: LocalRunnerOptions) => HostRunner;
 //# sourceMappingURL=local-runner.d.ts.map

package/dist/launchd/local-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/local-runner.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAwB,UAAU,EAAgB,MAAM,aAAa,CAAC;AAElF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAyEF,eAAO,MAAM,WAAW,aAAa,kBAAkB,KAAQ,UAgD9D,CAAC"}
+{"version":3,"file":"local-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/local-runner.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAwB,UAAU,EAAgB,MAAM,aAAa,CAAC;AAElF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,MAAM,GAAG,SAGrC,CAAC;AAqEhB,eAAO,MAAM,WAAW,aAAa,kBAAkB,KAAQ,UAgD9D,CAAC"}

package/dist/launchd/providers.d.ts

@@ -7,7 +7,8 @@
  *   written by the same identity on the same host — a stack cannot write the file as one user and
  *   bootstrap the job as another by accident.
  * ⚠️ The default is localRunner(): this process, never elevated. A system-domain job therefore
- *   needs the deploy itself started as root, or a runner passed here with `privileged: true`.
+ *   needs the deploy itself started as root, or a runner passed here with `privileged: true` —
+ *   `launchdProviders(sudoRunner({ prefixes }))` is the kit's own (sudo-runner.ts).
  */
 import * as Layer from 'effect/Layer';
 import { type HostRunner } from './runner.ts';

package/dist/launchd/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/launchd/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,aAAa,CAAC;AAE/D,eAAO,MAAM,gBAAgB,YAAY,UAAU,yJAGhD,CAAC"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/launchd/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,aAAa,CAAC;AAE/D,eAAO,MAAM,gBAAgB,YAAY,UAAU,yJAGhD,CAAC"}

package/dist/launchd/runner.d.ts

@@ -47,13 +47,15 @@ export type HostUser = {
 };
 export interface HostRunner {
     /**
-     * ⛔ DECLARED, NEVER INFERRED. `true` only when every call this runner makes already runs with
-     *   root's authority — a runner that talks to a root helper, say. The providers refuse
+     * ⛔ DECLARED, NEVER INFERRED. `true` only when this runner can do every root-needing call the
+     *   providers make of it: every call already runs as root (a runner that talks to a root helper,
+     *   say), or the runner elevates exactly those calls (sudoRunner). The providers refuse
      *   system-domain writes unless `effectiveUid()` is 0 or this is `true`, so claiming it falsely
      *   turns that refusal into an EACCES halfway through a deploy.
-     * ⛔ THE KIT NEVER ELEVATES. No runner here calls `sudo`: a deploy that prompts for a password
-     *   mid-plan, or silently uses a cached sudo ticket, is exactly the "no silent sudo" failure. A
-     *   consumer who wants elevation writes that runner deliberately and sets this flag.
+     * ⛔ THE KIT NEVER ELEVATES SILENTLY. localRunner() never calls `sudo`: a deploy that prompts for
+     *   a password mid-plan, or quietly borrows a cached sudo ticket, is exactly the "no silent sudo"
+     *   failure. sudoRunner() does call `sudo -n`, but only when a stack passes it explicitly, only
+     *   for the argv shapes in sudo-allowlist.ts, and logging each one (decided 2026-09-21).
      */
     readonly privileged: boolean;
     /** The uid file writes and launchctl calls run as. */
@@ -70,6 +72,13 @@ export interface HostRunner {
      * ⚠️ The parent directory must exist; creating it would invent an owner and mode nobody declared.
      */
     writeFileAtomic(path: string, bytes: Uint8Array, options: WriteOptions): Promise<void>;
+    /**
+     * PLAN TIME: refuse, reading only and writing nothing, a write this runner would refuse at
+     * apply — so the plan shows it before any resource is applied. Optional: a runner without it
+     * refuses at the write. ★ sudoRunner implements it with the checks it makes before `sudo -n`;
+     *   ⛔ it never elevates, so a plan still never calls sudo.
+     */
+    checkWrite?(path: string, options: WriteOptions): Promise<void>;
     /** Remove a file. Idempotent: nothing at `path` is success. */
     removeFile(path: string): Promise<void>;
     /** A user by name or numeric id, or `undefined` when the host has none. */

package/dist/launchd/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/launchd/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,sGAAsG;AACtG,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1D,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,UAAU;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,YAAY,IAAI,MAAM,CAAC;IACvB,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACxD,uDAAuD;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAClD;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,+DAA+D;IAC/D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,2EAA2E;IAC3E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC5D,kFAAkF;IAClF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3D,gFAAgF;IAChF,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;;AAED,uEAAuE;AACvE,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,eAAe,WAAY,UAAU,KAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;AAE3C,oFAAoF;AACpF,eAAO,MAAM,YAAY,WAAY,UAAU,KAAG,OACA,CAAC"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/launchd/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,sGAAsG;AACtG,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1D,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,YAAY,IAAI,MAAM,CAAC;IACvB,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACxD,uDAAuD;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAClD;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF;;;;;OAKG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,+DAA+D;IAC/D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,2EAA2E;IAC3E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC5D,kFAAkF;IAClF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3D,gFAAgF;IAChF,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;;AAED,uEAAuE;AACvE,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,eAAe,WAAY,UAAU,KAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;AAE3C,oFAAoF;AACpF,eAAO,MAAM,YAAY,WAAY,UAAU,KAAG,OACA,CAAC"}

package/dist/launchd/sudo-acl.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The ACL half of sudo-guard.ts: mode bits say a directory is root's alone, and an ACL can say
+ * otherwise. On macOS an `allow add_file,add_subdirectory,delete_child` entry lets its holder swap
+ * what lies under a root-owned `0755` directory — a symlink where the file was — between the
+ * guard's lstat checks and the privileged call, exactly as group write would. An inheritable
+ * `allow write` hands every file root installs there to its holder.
+ *
+ * ★ READ WITH `ls -lden`, AS THE OPERATOR — no sudo, and the same read at plan time and before the
+ *   write. MEASURED 2026-09-21 on macOS 27.2: each entry prints on its own line after the path's,
+ *   as ` 0: <qualifier> [inherited ]allow|deny <perms>`; `-n` makes the qualifier a UUID, never a
+ *   name with a space in it. The `+` flag after the mode is NOT reliable — `@` (extended
+ *   attributes) replaces it in the listing — so the entries are what is read.
+ * ⚠️ A DENY ENTRY GRANTS NOTHING (macOS puts `everyone deny delete` on home folders), and an allow
+ *   of read-only rights (`list`, `search`, `readattr` …) swaps nothing, so neither refuses.
+ */
+import type { HostRunner } from './runner.ts';
+export declare const LS = "/bin/ls";
+/** The allow entries in `ls -lden` output that grant a write right, as printed. */
+export declare const aclGrants: (listing: string) => string[];
+/**
+ * ⛔ Refuse when any directory in `chain` carries an ACL entry that lets someone write it, or when
+ *   the ACLs cannot be read at all (fail closed). `path` names the file in the refusal.
+ */
+export declare const assertNoAclGrants: (base: HostRunner, path: string, chain: readonly string[]) => Promise<void>;
+//# sourceMappingURL=sudo-acl.d.ts.map

package/dist/launchd/sudo-acl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-acl.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,eAAO,MAAM,EAAE,YAAY,CAAC;AAgB5B,mFAAmF;AACnF,eAAO,MAAM,SAAS,YAAa,MAAM,KAAG,MAAM,EAOnB,CAAC;AAEhC;;;GAGG;AACH,eAAO,MAAM,iBAAiB,SACtB,UAAU,QACV,MAAM,SACL,SAAS,MAAM,EAAE,KACvB,OAAO,CAAC,IAAI,CAed,CAAC"}

package/dist/launchd/sudo-allowlist.d.ts

@@ -0,0 +1,47 @@
+/**
+ * A privileged call that was refused before it ran: by the allowlist, by a host check
+ * (sudo-guard.ts), or by sudo itself. ★ Here, beside the allowlist, so the guard and the runner
+ *   throw the same class and a caller can tell "nothing ran as root" from "it ran and failed".
+ */
+export declare class SudoRefusedError extends Error {
+    constructor(message: string);
+}
+/** ★ Absolute program paths, so neither sudo nor the command is looked up on the caller's PATH. */
+export declare const SUDO = "/usr/bin/sudo";
+export declare const INSTALL = "/usr/bin/install";
+export declare const RM = "/bin/rm";
+/** A mode as `install -m` takes it: four octal digits, so `0644` and `4755` are both exact. */
+export declare const octalMode: (mode: number) => string | undefined;
+/** Validate the stack's prefixes once, when the runner is built. */
+export declare const checkPrefixes: (prefixes: readonly string[]) => readonly string[];
+/**
+ * The declared prefix `path` is strictly under, or `undefined`.
+ * ⚠️ `${prefix}/`, never a bare startsWith: `/opt/example` must not admit `/opt/example-other`.
+ */
+export declare const prefixOf: (path: string, prefixes: readonly string[]) => string | undefined;
+/** The one source `install` may copy and the prefixes, for the call being checked. */
+export type AllowContext = {
+    readonly prefixes: readonly string[];
+    readonly staged?: string;
+};
+/** `undefined` when `argv` is exactly an allowed privileged shape, else the reason it is not. */
+export declare const privilegedProblem: (argv: readonly string[], context: AllowContext) => string | undefined;
+/** Where one exec goes: run as the deploying user, run as root through the allowlist, or refused. */
+export type Route = {
+    readonly as: 'operator';
+} | {
+    readonly as: 'root';
+} | {
+    readonly refuse: string;
+};
+/**
+ * ★ WHY THIS REFUSES AS WELL AS ROUTES. sudoRunner reports `privileged: true`, which switches off
+ *   the providers' own "another user's gui domain needs root" refusal (job-preflight.ts). This
+ *   runner elevates only the system domain, so it gives that refusal back itself. (A write into
+ *   another user's LaunchAgents is refused by the writer first: outside every prefix, a foreign
+ *   owner needs root. This covers the delete, which reaches launchctl before any file.)
+ * ⚠️ Reads (`print`, `print-disabled`) always run as the deploying user: launchctl(1) says anyone
+ *   may read or query the system domain, and launchctl.ts measured it on 2026-09-21.
+ */
+export declare const routeExec: (argv: readonly string[], operatorUid: number) => Route;
+//# sourceMappingURL=sudo-allowlist.d.ts.map

package/dist/launchd/sudo-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-allowlist.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-allowlist.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,mGAAmG;AACnG,eAAO,MAAM,IAAI,kBAAkB,CAAC;AACpC,eAAO,MAAM,OAAO,qBAAqB,CAAC;AAC1C,eAAO,MAAM,EAAE,YAAY,CAAC;AAK5B,+FAA+F;AAC/F,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAM,GAAG,SAGnC,CAAC;AAEhB,oEAAoE;AACpE,eAAO,MAAM,aAAa,aAAc,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAa1E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,YAAY,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SAGhB,CAAC;AA6E/D,sFAAsF;AACtF,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,SACtB,SAAS,MAAM,EAAE,WACd,YAAY,KACpB,MAAM,GAAG,SAyBX,CAAC;AAEF,qGAAqG;AACrG,MAAM,MAAM,KAAK,GACb;IAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhC;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,SAAU,SAAS,MAAM,EAAE,eAAe,MAAM,KAAG,KAiBxE,CAAC"}

package/dist/launchd/sudo-guard.d.ts

@@ -0,0 +1,83 @@
+/**
+ * The checks sudo-runner.ts makes against the host, as the deploying user, before it runs anything
+ * as root. sudo-allowlist.ts checks the argv; this checks what the paths in it actually are.
+ *
+ * ⛔ WHAT IS LOGGED IS WHAT IS WRITTEN. A symlinked directory under a prefix would make
+ *   `install` or `rm`, running as root, act on a path the log never named. So every directory
+ *   between the prefix and the file must be a real directory.
+ * ⛔ EVERY DIRECTORY FROM THE PREFIX DOWN IS ROOT'S ALONE (decided 2026-09-21). A directory below
+ *   the prefix that another user owns, or that group or other may write, lets that user swap what
+ *   lies under it — a symlink where the file was — between these checks and the privileged call.
+ *   So each one must be owned by root and not group/other-writable (rootOnlyProblem), exactly as
+ *   the prefix itself must.
+ * ⛔ AND EVERY DIRECTORY ABOVE THE PREFIX (red team, 2026-09-21). Whoever may write the prefix's
+ *   parent may rename the prefix away and put a symlink in its place between these checks and the
+ *   privileged call — the same swap one level up. So `/` down to the prefix's parent must be
+ *   root-only too (a root-owned symlink among them, `/etc` -> `private/etc`, is root's own and is
+ *   followed; its target is root's choice, and not walked).
+ * ⛔ AND NO ACL THAT SAYS OTHERWISE (sudo-acl.ts): mode bits are not the whole answer on macOS.
+ * ⚠️ These checks run before the privileged call, as the deploying user. They guard against a
+ *   mistaken declaration and against every user but root; root itself could still change a path
+ *   in that window.
+ */
+import type { HostRunner, WriteOptions } from './runner.ts';
+/** The directories strictly between `prefix` and the file at `path`. */
+export declare const betweenDirs: (prefix: string, path: string) => string[];
+/** The directories strictly above `prefix`: `/`, then each one down to the prefix's parent. */
+export declare const aboveDirs: (prefix: string) => string[];
+/**
+ * What must be at `path` itself: a regular file, or (for a write or a remove) nothing yet.
+ * ⚠️ A DIRECTORY AT THE DESTINATION IS THE TRAP: `install src dir` copies INTO the directory
+ *   (install(1)), and install decides that with stat, so a symlink to a directory does the same.
+ */
+export type Expect = 'file' | 'file-or-absent';
+/**
+ * Refuse a prefix that is not a root-only directory, a symlink or a non-directory between the
+ * prefix and `path`, and anything but a file at it.
+ */
+export declare const assertPlainPath: (base: HostRunner, prefix: string, path: string, expect: Expect) => Promise<'file' | 'absent'>;
+/**
+ * ⛔ A ROOT-OWNED FILE UNDER A PREFIX IS ROOT'S TO CHANGE, AND ONLY ROOT'S (decided 2026-09-21).
+ *   Group- or world-writable, anyone in that class rewrites a file root installed — a daemon's
+ *   config, a script a LaunchDaemon runs as root — which is root by another name. Setuid or setgid,
+ *   it runs as root (or its group) for whoever executes it. install(1) would apply either, as root.
+ * ★ Root-owned is an omitted owner (the runner installs as root under a prefix) or uid 0. A file
+ *   handed to another user is that user's to change; the sticky bit changes nothing on a file.
+ */
+export declare const modeProblem: (options: WriteOptions) => string | undefined;
+/**
+ * Every check a write under `prefix` meets before anything is staged or run as root: the mode, the
+ * path (assertPlainPath) and the read-back (assertReadableBack). ★ Reads only, as the deploying
+ *   user — so sudoRunner's `checkWrite` runs it at PLAN time too, and a plan still never calls sudo.
+ */
+export declare const assertInstallable: (base: HostRunner, prefix: string, path: string, options: WriteOptions, groups: readonly number[] | undefined) => Promise<void>;
+/**
+ * POSIX read permission for one uid: owner class, else group class, else other. `undefined` when
+ * only group membership could decide and the groups are unknown.
+ * ⚠️ EXACTLY ONE CLASS APPLIES. A group member gets the group bits even when the other bits are
+ *   wider (`0604` hides a file from its group), so "other can read" is not enough on its own.
+ */
+export declare const canRead: (file: {
+    readonly uid: number;
+    readonly gid: number;
+    readonly mode: number;
+}, uid: number, groups: readonly number[] | undefined) => boolean | undefined;
+/**
+ * ⛔ REFUSE A FILE THE DEPLOYING USER COULD NOT READ BACK, before writing it. Both providers read
+ *   every write back to verify it (host-file-lifecycle.ts, job-lifecycle.ts) and read it again at
+ *   every plan, as the deploying user; this runner elevates writes, never reads. A root-only
+ *   `0600` would be installed, then fail the read-back with EACCES and stay on disk with no state,
+ *   so every later plan would fail too.
+ * ★ An omitted owner is root (under a prefix the runner writes as root). An omitted group is the
+ *   parent directory's, which is the group a new file gets on macOS.
+ * ⚠️ Unknown groups never refuse: the read-back after the write stays the final judge.
+ */
+export declare const assertReadableBack: (base: HostRunner, path: string, options: WriteOptions, groups: readonly number[] | undefined) => Promise<void>;
+/**
+ * The deploying user's groups, from `id -G`; `undefined` when that fails.
+ * ⚠️ NOT process.getgroups(). MEASURED 2026-09-21 on macOS 27.2: getgroups() returned 16 groups
+ *   where `id -G` returned 18, because macOS caps a process's own list at 16. A group past the
+ *   16th would read as "not a member" and refuse a file the user can in fact read.
+ */
+export declare const operatorGroups: (base: HostRunner) => Promise<readonly number[] | undefined>;
+//# sourceMappingURL=sudo-guard.d.ts.map

package/dist/launchd/sudo-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-guard.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAY,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAOtE,wEAAwE;AACxE,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,KAAG,MAAM,EAMhE,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,SAAS,WAAY,MAAM,KAAG,MAAM,EAGhD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;AAuB/C;;;GAGG;AACH,eAAO,MAAM,eAAe,SACpB,UAAU,UACR,MAAM,QACR,MAAM,UACJ,MAAM,KACb,OAAO,CAAC,MAAM,GAAG,QAAQ,CA6C3B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,YAAa,YAAY,KAAG,MAAM,GAAG,SAO5D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,SACtB,UAAU,UACR,MAAM,QACR,MAAM,WACH,YAAY,UACb,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SACZ;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,OACtE,MAAM,UACH,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,GAAG,SASZ,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,SACvB,UAAU,QACV,MAAM,WACH,YAAY,UACb,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,CAAC,IAAI,CAYd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAgB,UAAU,KAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAI5F,CAAC"}

package/dist/launchd/sudo-runner.d.ts

@@ -0,0 +1,60 @@
+/**
+ * sudoRunner(): the kit's one elevating HostRunner. The deploy runs as the operator, and only the
+ * calls that need root go through `sudo -n`, in the exact shapes sudo-allowlist.ts names:
+ *
+ * - `launchctl bootstrap | bootout | kickstart` in the system domain;
+ * - a file under a prefix the stack declared: staged in a private temp file as the operator, then
+ *   `sudo -n install -S -m <mode> [-o <uid>] [-g <gid>] <staged> <path>`; removed with
+ *   `sudo -n rm -f -- <path>`.
+ *
+ * Everything else (reads, lookups, the operator's own files and gui domain) goes to localRunner().
+ *
+ * ★ DECIDED 2026-09-21. A host stack deploys as the operator rather than as root, so a provider bug
+ *   or a wrong declaration can do no more than this list. It is an explicit opt-in,
+ *   `launchdProviders(sudoRunner({ prefixes }))`, and nothing ever falls back to it: localRunner()
+ *   stays the default and never elevates.
+ * ⛔ `sudo -n`, NEVER A PROMPT. A deploy that stops mid-apply to ask for a password is the failure
+ *   "no silent sudo" exists to prevent. With -n, sudo fails at once, and that failure becomes an
+ *   error saying what to do.
+ * ⛔ EVERY PRIVILEGED ARGV IS LOGGED BEFORE IT RUNS, and it is only ever an argv: a file's bytes
+ *   travel through the staged file, never through argv, so a log line cannot carry content.
+ * ★ `install -S`: install(1) on macOS 27.2 (read 2026-09-21) always writes a temp file in the
+ *   target directory and renames it, so the file is never torn, and -S adds the fsync that
+ *   localRunner's `handle.sync()` does.
+ * ⚠️ REASONED, NOT MEASURED: sudo's failure text (sudo-said.ts has the strings and their sources).
+ * ⛔ EVERY CHECK BEFORE SUDO ALSO RUNS AT PLAN TIME (`checkWrite`, 2026-09-21): the mode, the
+ *   directories from the prefix down, the read-back. Reads only, as the operator — never sudo.
+ */
+import { type LocalRunnerOptions } from './local-runner.ts';
+import type { HostRunner } from './runner.ts';
+import { SudoRefusedError } from './sudo-allowlist.ts';
+import { type Staged } from './sudo-stage.ts';
+export { SudoRefusedError };
+export type SudoRunnerOptions = LocalRunnerOptions & {
+    /**
+     * The directories root may install into and remove from: `/Library/LaunchDaemons` for system
+     * jobs (bootstrap and bootout are refused without it), plus wherever the stack's root-owned
+     * HostFiles live. ⛔ Required: absolute, normalised, never `/`; and at every privileged call a
+     * real directory that root owns and only root may write (sudo-guard.ts). Outside every prefix a
+     * file is written as the deploying user, or refused when that needs root.
+     */
+    readonly prefixes: readonly string[];
+    /** Receives one line per privileged argv, before it runs. @default a line on stderr */
+    readonly log?: (line: string) => void;
+};
+/** What a sudo runner is built from. ★ Split out so the tests swap the host, never the logic. */
+export type SudoDeps = {
+    /** Runs everything, including `sudo` itself. localRunner() for the real one. */
+    readonly base: HostRunner;
+    readonly stage: (bytes: Uint8Array) => Promise<Staged>;
+    /** The deploying user's groups, for the read-back check; `undefined` when unknown. */
+    readonly groups: () => Promise<readonly number[] | undefined>;
+    readonly log: (line: string) => void;
+};
+export declare const makeSudoRunner: (prefixList: readonly string[], deps: SudoDeps) => HostRunner;
+/**
+ * The real sudo runner: localRunner() for everything, `/usr/bin/sudo -n` for the allowlist.
+ * Pass it explicitly: `launchdProviders(sudoRunner({ prefixes: ['/Library/LaunchDaemons'] }))`.
+ */
+export declare const sudoRunner: (options: SudoRunnerOptions) => HostRunner;
+//# sourceMappingURL=sudo-runner.d.ts.map

package/dist/launchd/sudo-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,KAAK,kBAAkB,EAAe,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAc,UAAU,EAAgB,MAAM,aAAa,CAAC;AACxE,OAAO,EAIL,gBAAgB,EAMjB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG;IACnD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,uFAAuF;IACvF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,QAAQ,GAAG;IACrB,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,CAAC;AAEF,eAAO,MAAM,cAAc,eAAgB,SAAS,MAAM,EAAE,QAAQ,QAAQ,KAAG,UAgI9E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,YAAa,iBAAiB,KAAG,UAYvD,CAAC"}

package/dist/launchd/sudo-said.d.ts

@@ -0,0 +1,10 @@
+import type { ExecResult } from './runner.ts';
+import { SudoRefusedError } from './sudo-allowlist.ts';
+/** ★ An EACCES outside every prefix is almost always a directory the stack forgot to declare. */
+export declare const undeclared: (path: string, prefixes: readonly string[]) => (cause: unknown) => never;
+/**
+ * The refusal sudo itself answered for `shown` (the argv as JSON), or `undefined` when the command
+ * ran — whatever its own exit code. ★ `SudoRefusedError` always means nothing ran as root.
+ */
+export declare const sudoRefusal: (shown: string, result: ExecResult) => SudoRefusedError | undefined;
+//# sourceMappingURL=sudo-said.d.ts.map

package/dist/launchd/sudo-said.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-said.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-said.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAcvD,iGAAiG;AACjG,eAAO,MAAM,UAAU,SACd,MAAM,YAAY,SAAS,MAAM,EAAE,aAClC,OAAO,KAAG,KAQjB,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,UAAW,MAAM,UAAU,UAAU,KAAG,gBAAgB,GAAG,SAelF,CAAC"}

package/dist/launchd/sudo-stage.d.ts

@@ -0,0 +1,7 @@
+/** A file staged for `install`, and how to remove it again. */
+export type Staged = {
+    readonly path: string;
+    readonly dispose: () => Promise<void>;
+};
+export declare const stageFile: (bytes: Uint8Array) => Promise<Staged>;
+//# sourceMappingURL=sudo-stage.d.ts.map

package/dist/launchd/sudo-stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-stage.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-stage.ts"],"names":[],"mappings":"AAaA,+DAA+D;AAC/D,MAAM,MAAM,MAAM,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AAEtF,eAAO,MAAM,SAAS,UAAiB,UAAU,KAAG,OAAO,CAAC,MAAM,CAWjE,CAAC"}

package/dist/openbao/auth-method-reconcile.d.ts

@@ -6,10 +6,14 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim } from '../ownership/adopt.ts';
 import { type BaoAuthMethodAttributes, type BaoAuthMethodProps } from './auth-method-form.ts';
 import type { BaoError } from './bao-status.ts';
 import type { RemountError, RemountOptions } from './remount-wire.ts';
 export declare const readMethod: (props: BaoAuthMethodProps) => Effect.Effect<BaoAuthMethodAttributes | undefined, BaoError, HttpClient.HttpClient>;
-/** Converge one auth method. `stated` is the path in Alchemy's state, if any. */
-export declare const reconcileAuthMethod: (news: BaoAuthMethodProps, stated: string | undefined, options?: RemountOptions) => Effect.Effect<BaoAuthMethodAttributes, BaoError | RemountError, HttpClient.HttpClient>;
+/**
+ * Converge one auth method. `stated` is the path in Alchemy's state, if any.
+ * ⛔ `claim`: the same first-reconcile takeover refusal as reconcileMount's (auth-method.ts passes it).
+ */
+export declare const reconcileAuthMethod: (news: BaoAuthMethodProps, stated: string | undefined, options?: RemountOptions, claim?: Claim) => Effect.Effect<BaoAuthMethodAttributes, BaoError | RemountError, HttpClient.HttpClient>;
 //# sourceMappingURL=auth-method-reconcile.d.ts.map

package/dist/openbao/auth-method-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-method-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,UAAU,UACd,kBAAkB,KACxB,MAAM,CAAC,MAAM,CAAC,uBAAuB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAKjF,CAAC;AAUL,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,SACxB,kBAAkB,UAChB,MAAM,GAAG,SAAS,YAChB,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CA8BpF,CAAC"}
+{"version":3,"file":"auth-method-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,UAAU,UACd,kBAAkB,KACxB,MAAM,CAAC,MAAM,CAAC,uBAAuB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAKjF,CAAC;AAUL;;;GAGG;AACH,eAAO,MAAM,mBAAmB,SACxB,kBAAkB,UAChB,MAAM,GAAG,SAAS,YAChB,cAAc,UAChB,KAAK,KACZ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CAqCpF,CAAC"}

package/dist/openbao/auth-method.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-method.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,uBAAuB,CAAC;AAK/B,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,CAAC;AAE5D,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,aAAa,gDAExB,CAAC;AAEH,eAAO,MAAM,qBAAqB,oGAqD/B,CAAC"}
+{"version":3,"file":"auth-method.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,uBAAuB,CAAC;AAK/B,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,CAAC;AAE5D,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,aAAa,gDAExB,CAAC;AAEH,eAAO,MAAM,qBAAqB,oGA2D/B,CAAC"}

package/dist/openbao/auth-role-form.d.ts

@@ -33,15 +33,6 @@ export declare const readPath: (name: string) => string;
  * ★ ALL STRINGS, EXACTLY THE `k=v` PAIRS `bao write` USED TO SEND — see `baoWrite` in bao-http.ts.
  */
 export declare const writeBody: (props: BaoAuthRoleProps) => Record<string, string>;
-/**
- * Whether a changed `name` names a DIFFERENT role — the diff's `replace` question.
- *
- * ⚠️ CASE-INSENSITIVELY, BECAUSE THE SERVER IS. AppRole stores `role/<lowercased name>` (openbao
- *   v2.6.2 builtin/credential/approle/path_role.go:1485, and roleEntry reads the same key, :1537),
- *   so `Host` → `host` is the SAME role: a `replace` there would write it, then — under `destroy` —
- *   delete the old generation, which is that same role.
- */
-export declare const isRename: (from: string, to: string) => boolean;
 /** True when live already matches the declaration on every managed field. */
 export declare const matches: (attributes: BaoAuthRoleAttributes, props: BaoAuthRoleProps) => boolean;
 //# sourceMappingURL=auth-role-form.d.ts.map

package/dist/openbao/auth-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-form.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,eAAO,MAAM,YAAY,UAChB,gBAAgB,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,qBAWF,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAgC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,SAAS,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAYxE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,MAAM,MAAM,KAAG,OACX,CAAC;AAW1C,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAUjF,CAAC"}
+{"version":3,"file":"auth-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-form.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,eAAO,MAAM,YAAY,UAChB,gBAAgB,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,qBAWF,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAgC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,SAAS,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAYxE,CAAC;AAWF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAUjF,CAAC"}

package/dist/openbao/auth-role.d.ts

@@ -5,8 +5,9 @@
  *   are credential issuance, not configuration, and are OUT OF SCOPE. This declares the
  *   role shape an approle login inherits — policy names and TTL strings only.
  *
- * ★ `defaultRemovalPolicy: 'retain'` — deleting a role revokes every token bound to it.
- *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ * ★ `defaultRemovalPolicy: 'retain'` — deleting a role locks out every host that logs in with it:
+ *   its secret_ids go with it (the ⚠️ on `delete` below). Opt in with
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/auth-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAMtB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AASH,eAAO,MAAM,mBAAmB,kGAiE7B,CAAC"}
+{"version":3,"file":"auth-role.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAKtB,MAAM,qBAAqB,CAAC;AAI7B,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAiBH,eAAO,MAAM,mBAAmB,kGAoF7B,CAAC"}

package/dist/openbao/cloudflare-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-role.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,0BAA0B,EAAiB,MAAM,mCAAmC,CAAC;AAE9F,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAcnC,YAAY,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,yBAAyB,qIA8InC,CAAC"}
+{"version":3,"file":"cloudflare-role.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE,OAAO,EAAE,0BAA0B,EAAiB,MAAM,mCAAmC,CAAC;AAE9F,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAQnC,YAAY,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAKH,eAAO,MAAM,yBAAyB,qIAmJnC,CAAC"}

package/dist/openbao/fake-bao.d.ts

@@ -36,5 +36,23 @@ export declare const withFake: (answer: Answer, body: (bao: Fake) => Promise<voi
 export declare const run: <A, E>(env: BaoEnvironment, effect: Effect.Effect<A, E, HttpClient.HttpClient>) => Promise<A>;
 /** The effect's failure — rejects if it succeeded. */
 export declare const runFailure: <A, E>(env: BaoEnvironment, effect: Effect.Effect<A, E, HttpClient.HttpClient>) => Promise<E>;
+/**
+ * An injected crash between a write and its commit. Once armed, `crashNext()` fails the first read
+ * that follows a write with a 500 — a reconcile whose write landed and whose read-back, and so the
+ * engine's commit, never did — and `crashNext('write')` lands the next write and then answers it
+ * 500, for a reconcile that reads nothing back (Bao.Policy). Either leaves the `creating` /
+ * `replacing` row a killed deploy leaves.
+ */
+export declare const crashAfterWrite: () => {
+    crashNext: (at?: 'read-back' | 'write') => void;
+    wrap: (answer: (seen: Seen) => Reply) => (seen: Seen) => Reply;
+};
+/**
+ * A deploy killed BEFORE a resource's reconcile ran: the first write to a path ending in `suffix` is
+ * refused (500) without landing. Aimed at an upstream, it fails every create waiting on it after
+ * Apply has committed their `creating` rows — rows whose create never asked whose object sat at
+ * its identity (ownership/whole.ts).
+ */
+export declare const refuseWriteOnce: (suffix: string) => (answer: (seen: Seen) => Reply) => (seen: Seen) => Reply;
 export {};
 //# sourceMappingURL=fake-bao.d.ts.map

package/dist/openbao/fake-bao.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-bao.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-bao.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,qCAAqC;AACrC,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,KAAK,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAAC,IAAI,IAAI,IAAI,CAAA;CAAE,CAAC;AAErF,6FAA6F;AAC7F,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAErD,eAAO,MAAM,OAAO,WAAY,MAAM,SAAS,MAAM,KAAG,IAwBvD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,QAAQ,WACX,MAAM,QACR,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,SAC3B,MAAM,kBAQd,CAAC;AAKF,gFAAgF;AAChF,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,OACjB,cAAc,UACX,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,eACP,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,OACxB,cAAc,UACX,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,eACM,CAAC"}
+{"version":3,"file":"fake-bao.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-bao.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,qCAAqC;AACrC,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,KAAK,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAAC,IAAI,IAAI,IAAI,CAAA;CAAE,CAAC;AAErF,6FAA6F;AAC7F,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAErD,eAAO,MAAM,OAAO,WAAY,MAAM,SAAS,MAAM,KAAG,IAwBvD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,QAAQ,WACX,MAAM,QACR,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,SAC3B,MAAM,kBAQd,CAAC;AAKF,gFAAgF;AAChF,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,OACjB,cAAc,UACX,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,eACP,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,OACxB,cAAc,UACX,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,eACM,CAAC;AAE3D;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;IAKxB,SAAS,QAAO,WAAW,GAAG,OAAO;IAIrC,IAAI,WACO,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,YACvB,IAAI,KAAG,KAAK;CAcxB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAAY,MAAM,cAE5B,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,YAC5B,IAAI,KAAG,KAOjB,CAAC"}