@homeflare/alchemy 0.7.0 → 0.8.0

package/dist/openbao/jwt-config.d.ts

@@ -10,6 +10,11 @@
  *
  * ★ REPLACE SEMANTICS (REPLACE.md): `mount` changed → `replace`: the new mount gets the config;
  *   the old one keeps its own until that mount is disabled. There is no identity but the mount.
+ * ⛔ A MOVE ONTO A MOUNT WHOSE CONFIG EXISTS FAILS THE PLAN, like every other family's move onto an
+ *   occupied path (rename-identity.ts). With no delete, nothing is lost to a swap, which MEASURED
+ *   2026-09-21 ended with each config where it was declared. But the new generation writes over
+ *   the config it lands on, which changes who can log in on that mount: an issuer or key set
+ *   someone else manages, silently replaced. Move through a mount with no config instead.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/jwt-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-config.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAQ3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE9F,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAEH,eAAO,MAAM,aAAa,UACjB,qBAAqB,KAC3B,QAAQ,CAAC,0BAA0B,CAQpC,CAAC;AAEH,eAAO,MAAM,wBAAwB,uGA2BlC,CAAC"}
+{"version":3,"file":"jwt-config.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAO3B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE9F,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAYH,eAAO,MAAM,aAAa,UACjB,qBAAqB,KAC3B,QAAQ,CAAC,0BAA0B,CAQpC,CAAC;AAEH,eAAO,MAAM,wBAAwB,uGAgClC,CAAC"}

package/dist/openbao/jwt-role.d.ts

@@ -14,7 +14,8 @@
  *
  * ★ REPLACE SEMANTICS (REPLACE.md): `mount` or `name` changed → `replace`, create-first. The new
  *   path cannot collide with the old, so no `deleteFirst`. Under the default `retain` the old role
- *   stays live, and still admits logins, until removed by hand.
+ *   stays live, and still admits logins, until removed by hand. ⛔ A move onto a role that already
+ *   exists fails the plan (rename-identity.ts).
  * ★ `defaultRemovalPolicy: 'retain'`, like every Bao.* family.
  */
 import { Resource } from 'alchemy';

package/dist/openbao/jwt-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-role.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAOrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAEH,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,QAAQ,CAAC,oBAAoB,CAOhF,CAAC;AAEH,eAAO,MAAM,kBAAkB,iGAoC5B,CAAC"}
+{"version":3,"file":"jwt-role.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAMrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAcH,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,QAAQ,CAAC,oBAAoB,CAOhF,CAAC;AAEH,eAAO,MAAM,kBAAkB,iGAuC5B,CAAC"}

package/dist/openbao/kubernetes-role.d.ts

@@ -9,7 +9,8 @@
  *   and nothing else (path_role.go:239-256).
  *
  * ★ REPLACE SEMANTICS (REPLACE.md): `mount` or `name` changed → `replace`, create-first (the new
- *   path cannot collide). Under the default `retain` the old role stays live until removed by hand.
+ *   path cannot collide with the old). Under the default `retain` the old role stays live until
+ *   removed by hand. ⛔ A move onto a role that already exists fails the plan (rename-identity.ts).
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/kubernetes-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubernetes-role.d.ts","sourceRoot":"","sources":["../../src/openbao/kubernetes-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAO5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,kBAAkB,UACtB,sBAAsB,KAC5B,QAAQ,CAAC,2BAA2B,CAOrC,CAAC;AAEH,eAAO,MAAM,yBAAyB,wGAiCnC,CAAC"}
+{"version":3,"file":"kubernetes-role.d.ts","sourceRoot":"","sources":["../../src/openbao/kubernetes-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAUH,eAAO,MAAM,kBAAkB,UACtB,sBAAsB,KAC5B,QAAQ,CAAC,2BAA2B,CAOrC,CAAC;AAEH,eAAO,MAAM,yBAAyB,wGAoCnC,CAAC"}

package/dist/openbao/mfa-enforcement.d.ts

@@ -19,9 +19,12 @@
  *   default `retain` it never runs; with `destroy`, set `retain` to drop it from state and leave it
  *   live — which is what the server would do anyway.
  *
- * ★ REPLACE SEMANTICS (REPLACE.md): `name` changed → `replace`, create-first (names are per
- *   namespace; the new one cannot collide). Under `retain` BOTH enforcements then apply — fail
- *   closed. Under `destroy` the old one's delete is refused, so the deploy stops after creating.
+ * ★ REPLACE SEMANTICS (REPLACE.md): `name` changed → `replace`, create-first. Under `retain` BOTH
+ *   enforcements then apply — fail closed. Under `destroy` the old one's delete is refused, so the
+ *   deploy stops after creating. ⛔ A rename onto an enforcement that exists fails the plan
+ *   (rename-identity.ts): the upsert by name would otherwise rewrite, in place, what someone else's
+ *   enforcement demands. MEASURED 2026-09-21: a swap of two under `destroy` wrote each over the
+ *   other, then stopped on the two refused deletes.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/mfa-enforcement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-enforcement.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAMjC,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,sBAAuB,SAAQ,QAAQ,CACtD,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,sBAAsB,yDAEjC,CAAC;AAEH,KAAK,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC;AAmBjC,eAAO,MAAM,eAAe,UACnB,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAM7C,CAAC;AAEL,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,UACxB,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,gCAAgC,EAAE,QAAQ,EAAE,GAAG,CAe5D,CAAC;AAEL,eAAO,MAAM,8BAA8B,6GAkCxC,CAAC"}
+{"version":3,"file":"mfa-enforcement.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAMjC,MAAM,2BAA2B,CAAC;AAInC,YAAY,EACV,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,sBAAuB,SAAQ,QAAQ,CACtD,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,sBAAsB,yDAEjC,CAAC;AAEH,KAAK,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC;AAyBjC,eAAO,MAAM,eAAe,UACnB,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAM7C,CAAC;AAEL,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,UACxB,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,gCAAgC,EAAE,QAAQ,EAAE,GAAG,CAe5D,CAAC;AAEL,eAAO,MAAM,8BAA8B,6GAuCxC,CAAC"}

package/dist/openbao/mfa-totp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-totp.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAM3B,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAKH,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGrF,CAAC;AAEJ,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK/D,CAAC;AAEL,uEAAuE;AACvE,eAAO,MAAM,aAAa,UACjB,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAWxE,CAAC;AAEL,eAAO,MAAM,wBAAwB,uGA8BlC,CAAC"}
+{"version":3,"file":"mfa-totp.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAM3B,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAKH,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGrF,CAAC;AAEJ,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK/D,CAAC;AAEL,uEAAuE;AACvE,eAAO,MAAM,aAAa,UACjB,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAWxE,CAAC;AAEL,eAAO,MAAM,wBAAwB,uGA0ClC,CAAC"}

package/dist/openbao/pki-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pki-role.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAMrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AASH,eAAO,MAAM,kBAAkB,iGA4G5B,CAAC"}
+{"version":3,"file":"pki-role.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAMrB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAgBH,eAAO,MAAM,kBAAkB,iGAiH5B,CAAC"}

package/dist/openbao/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,cAAc,EAAoB,MAAM,kBAAkB,CAAC;AAInG,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3F,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAEH,eAAO,MAAM,iBAAiB,gGAuD3B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAKpB,MAAM,kBAAkB,CAAC;AAM1B,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3F,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAoBH,eAAO,MAAM,iBAAiB,gGAsD3B,CAAC"}

package/dist/openbao/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAMnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAYH,eAAO,MAAM,iBAAiB,oIA2H3B,CAAC"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAOnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAeH,eAAO,MAAM,iBAAiB,oIAuH3B,CAAC"}

package/dist/openbao/proxmox-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxmox-role.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,wBAAwB,CAAC;AAYhC,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAE9D,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,eAAO,MAAM,sBAAsB,qGAkKhC,CAAC"}
+{"version":3,"file":"proxmox-role.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,wBAAwB,CAAC;AAKhC,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAE9D,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAKH,eAAO,MAAM,sBAAsB,qGA6JhC,CAAC"}

package/dist/openbao/rename-identity.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The rename guard every Bao.* family whose identity is a name, a mount, or a catalog key shares:
+ * one `Identity` per family, and two steps built from rename.ts, `judgeRename` at the top of `diff`
+ * and `guardRename` at the top of `reconcile`. REPLACE.md has the audit behind both.
+ *
+ * ★ ONE DESCRIPTION OF "WHICH OBJECT", NOT TWELVE COPIES OF THE CHECK. The rename-safety fix went
+ *   in family by family, and the families it skipped were the ones that kept the bug: nine of them
+ *   judged the identity only after `isResolved(news)` and never asked whether the new path was
+ *   taken. 🔴 MEASURED 2026-09-21 through the engine (rename-families.test.ts): two Bao.AuthRole,
+ *   Bao.PkiRole, Bao.JwtRole, Bao.KubernetesRole, Bao.SshRole or Bao.Plugin resources that swapped
+ *   names under `RemovalPolicy.destroy()` both planned `replace`, each wrote over the other, and
+ *   both old deletes then removed what had just been written: a green deploy, both objects gone.
+ *   With any other prop still an Output, all nine planned `update` and left the old object live
+ *   under no state record; for Bao.MfaTotpMethod that wrote a second method and stranded every
+ *   enrolment.
+ */
+import * as Effect from 'effect/Effect';
+/** How one family names the object it manages — the thing a rename changes. */
+export interface Identity<A> {
+    /** `Bao.JwtRole` etc., for messages. */
+    readonly family: string;
+    /** The identity a set of props declares; undefined while any part of it is still an Output. */
+    readonly declared: (props: unknown) => string | undefined;
+    /** The identity a generation's attributes record. */
+    readonly recorded: (output: A) => string;
+    /** The API path an identity is read at, for the occupied check. Default: the identity. */
+    readonly pathOf?: ((identity: string) => string) | undefined;
+    /** How the server keys it (`policyKey`). Default: exact. */
+    readonly key?: ((identity: string) => string) | undefined;
+}
+/** A family keyed by `name` alone, read at `pathOf(name)`. */
+export declare const nameIdentity: <A extends {
+    readonly name: string;
+}>(family: string, pathOf: (name: string) => string, key?: (name: string) => string) => Identity<A>;
+/**
+ * A role at `rolePath(mount, name)`; the identity is that path. `defaultMount` is what an absent
+ * `mount` prop means — undefined when `mount` is required.
+ */
+export declare const roleIdentity: <A extends {
+    readonly mount: string;
+    readonly name: string;
+}>(family: string, rolePath: (mount: string, name: string) => string, defaultMount?: string, key?: (path: string) => string) => Identity<A>;
+/**
+ * ⚠️ THE LAST SEGMENT LOWERCASED: a role store that folds the name and not the mount. openbao v2.6.2
+ *   AppRole (builtin/credential/approle/path_role.go:1485, :1537) and Kubernetes
+ *   (builtin/credential/kubernetes/backend.go:362, path_role.go:396) both store `role/<lowercased
+ *   name>`, and JWT reads its `name` as a TypeLowerCaseString (builtin/credential/jwt/path_role.go:77),
+ *   while the router folds no case in a mount path. So `Host` → `host` is the same role, never a
+ *   replace that would delete, under `destroy`, the role it had just written.
+ */
+export declare const foldName: (path: string) => string;
+/**
+ * `diff`'s first step, before `isResolved(news)`: the move from the identity this resource last
+ * wrote or tried to the declared one, or undefined when both name the same object or either is not
+ * known yet. ⛔ Fails the plan when the new identity is already taken (`judgeMove`).
+ *
+ * ★ `olds` STANDS IN FOR `output` WHILE A CREATE OR A REPLACEMENT IS UNFINISHED, which is what
+ *   catches reverting a move whose new generation failed (rename.ts, `judgeMove`).
+ */
+export declare const judgeRename: <A>(identity: Identity<A>, olds: unknown, news: unknown, output: A | undefined) => Effect.Effect<{
+    from: string;
+    to: string;
+} | undefined, import("./bao-status.ts").BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * `reconcile`'s first step: an `update` whose prior attributes name another object dies before any
+ * read or write (`refuseMovedUpdate`). Only reached when the diff could not see the new identity.
+ */
+export declare const guardRename: <A>(identity: Identity<A>, news: unknown, output: A | undefined) => Effect.Effect<void>;
+//# sourceMappingURL=rename-identity.d.ts.map

package/dist/openbao/rename-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename-identity.d.ts","sourceRoot":"","sources":["../../src/openbao/rename-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AASxC,+EAA+E;AAC/E,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1D,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IACzC,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,SAAS,CAAC;IAC7D,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3D;AAED,8DAA8D;AAC9D,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,UACtD,MAAM,UACN,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,QAC1B,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,KAC7B,QAAQ,CAAC,CAAC,CAMX,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,UAC9E,MAAM,YACJ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,iBAClC,MAAM,QACf,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,KAC7B,QAAQ,CAAC,CAAC,CAKX,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,MACc,CAAC;AAEvD;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,YACjB,QAAQ,CAAC,CAAC,CAAC,QACf,OAAO,QACP,OAAO,UACL,CAAC,GAAG,SAAS;;;wGAQpB,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,YACjB,QAAQ,CAAC,CAAC,CAAC,QACf,OAAO,UACL,CAAC,GAAG,SAAS,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAOpB,CAAC"}

package/dist/openbao/rename.d.ts

@@ -1,6 +1,7 @@
 /**
- * Rename safety for the families whose identity is a name, or a mount and a name: Bao.Policy,
- * Bao.CloudflareRole and Bao.ProxmoxRole. REPLACE.md has the audit and what each answer does.
+ * Rename safety for the families whose identity is a name, a mount and a name, or a catalog key:
+ * the primitives. rename-identity.ts builds each family's diff and reconcile step from them, and
+ * REPLACE.md has the audit and what each answer does.
  *
  * ⛔ THE BUG THIS CLOSES, REPRODUCED 2026-09-21 AGAINST alchemy@2.0.0-beta.79's OWN PLAN AND APPLY
  *   (fake-stack.ts): a Bao.Policy deployed as `old`, then redeclared as `new` under
@@ -32,8 +33,16 @@ import * as Effect from 'effect/Effect';
 export declare const declaredString: (news: unknown, key: string) => string | undefined;
 /** True while an optional prop is declared but is not yet a value: an Output of a changing upstream. */
 export declare const isPendingProp: (news: unknown, key: string) => boolean;
-/** A role's API path from a diff's `news`, once both `mount` and `name` are resolved. */
-export declare const declaredRolePath: (news: unknown, rolePath: (mount: string, name: string) => string) => string | undefined;
+/**
+ * An optional string prop: `fallback` when it is absent, undefined while it is still an Output.
+ * ⚠️ Not `declaredString(…) ?? fallback`, which would read a pending mount as the default mount.
+ */
+export declare const declaredOr: (news: unknown, key: string, fallback: string) => string | undefined;
+/**
+ * A role's API path from a diff's `news`, once both `mount` and `name` are resolved. `defaultMount`
+ * is what an absent `mount` means; without one, an absent mount is unknown.
+ */
+export declare const declaredRolePath: (news: unknown, rolePath: (mount: string, name: string) => string, defaultMount?: string) => string | undefined;
 /**
  * How OpenBao keys an ACL policy: trimmed and lowercased. openbao v2.6.2
  * vault/policy/policy_store.go:698-700 (`sanitizeName`), applied by SetPolicy (:268), GetPolicy
@@ -57,14 +66,6 @@ export declare const policyKey: (name: string) => string;
  *   `refuseMovedUpdate` stops reconcile before it writes anything.
  */
 export declare const isMoved: (stored: string, declared: string | undefined, key?: (identity: string) => string) => boolean | undefined;
-/**
- * The role path a resource last wrote, or last tried to: its attributes once a write finished, else
- * the props of the create or replacement that did not (`output` is undefined for both).
- */
-export declare const triedRolePath: (output: {
-    readonly mount: string;
-    readonly name: string;
-} | undefined, olds: unknown, rolePath: (mount: string, name: string) => string) => string | undefined;
 /**
  * The diff's first question, asked before `isResolved(news)`: the move from the identity this
  * resource last wrote or tried (`tried`) to the declared one, or undefined when both name the same

package/dist/openbao/rename.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rename.d.ts","sourceRoot":"","sources":["../../src/openbao/rename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,SAAU,OAAO,OAAO,MAAM,KAAG,OAI1D,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,SACrB,OAAO,YACH,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,KAChD,MAAM,GAAG,SAIX,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAmC,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,WACV,MAAM,YACJ,MAAM,GAAG,SAAS,QACvB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,KAChC,OAAO,GAAG,SAAiF,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,aAAa,WAChB;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,QAC/D,OAAO,YACH,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,KAChD,MAAM,GAAG,SACmF,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,WACZ,MAAM,SACP,MAAM,GAAG,SAAS,YACf,MAAM,GAAG,SAAS,UACpB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,QAC/B,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM;;;wGAgB/B,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,WAAY,MAAM,QAAQ,MAAM,MAAM,MAAM,uCAOvE,CAAC"}
+{"version":3,"file":"rename.d.ts","sourceRoot":"","sources":["../../src/openbao/rename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,SAAU,OAAO,OAAO,MAAM,KAAG,OAI1D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,SAAU,OAAO,OAAO,MAAM,YAAY,MAAM,KAAG,MAAM,GAAG,SACH,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SACrB,OAAO,YACH,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,iBAClC,MAAM,KACpB,MAAM,GAAG,SAOX,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAmC,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,WACV,MAAM,YACJ,MAAM,GAAG,SAAS,QACvB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,KAChC,OAAO,GAAG,SAAiF,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,WACZ,MAAM,SACP,MAAM,GAAG,SAAS,YACf,MAAM,GAAG,SAAS,UACpB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,QAC/B,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM;;;wGAgB/B,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,WAAY,MAAM,QAAQ,MAAM,MAAM,MAAM,uCAOvE,CAAC"}

package/dist/openbao/ssh-role-erase.d.ts

@@ -0,0 +1,11 @@
+/**
+ * ⛔ THE FIELDS A WRITE WOULD SILENTLY DESTROY. Because the write is a full replace, a role
+ *   someone tuned by hand — `allowed_user_key_lengths` (a minimum RSA size), a
+ *   `key_id_format` the audit trail is grepped by, a `not_before_duration` widened to
+ *   survive clock skew, a non-default issuer — loses all of it the moment this resource
+ *   decides to update. A vanished key-length floor is a security regression that no plan
+ *   output would ever mention, and a vanished backdating window breaks signing on exactly
+ *   the skewed host it was added for. So reconcile refuses instead of writing.
+ */
+export declare const wouldErase: (live: Record<string, unknown>) => readonly string[];
+//# sourceMappingURL=ssh-role-erase.d.ts.map

package/dist/openbao/ssh-role-erase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-role-erase.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role-erase.ts"],"names":[],"mappings":"AAkCA;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,SAAS,MAAM,EAMzE,CAAC"}

package/dist/openbao/ssh-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-role.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,eAAe,EAQrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAyDH,eAAO,MAAM,kBAAkB,iGAqH5B,CAAC"}
+{"version":3,"file":"ssh-role.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,eAAe,EAOrB,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAeH,eAAO,MAAM,kBAAkB,iGAwH5B,CAAC"}

package/docs/caddy-admin.md

@@ -0,0 +1,24 @@
+# Caddy's admin endpoint — `@homeflare/alchemy/caddy`
+
+How the provider reaches Caddy's admin API, and what it refuses so a Caddyfile cannot cut it off.
+The overview is [caddy.md](./caddy.md).
+
+⛔ The admin API has no authentication. `localCaddyAdmin()` accepts only `http://` loopback
+(`127.0.0.0/8`, `localhost`, `[::1]`) or `unix:///path`; the default is `http://127.0.0.1:2019`.
+
+- **Host and Origin.** Caddy refuses a request whose `Host` is not an allowed origin (DNS-rebinding
+  guard; measured on Caddy 2.11.4: `403 host not allowed`), and checks `Origin` when one is sent or
+  `enforce_origin` is on. The transport sends both as the Caddy CLI does. A unix socket skips the
+  Host check entirely.
+- **`admin { origins … }`** narrowed, or **an SSH-forwarded port** (Caddy checks the Host against
+  ITS port): pass `hostHeader: 'localhost:2019'`.
+- **Another host's Caddy** (SSH later): forward its socket or port to loopback here and point a
+  `localCaddyAdmin()` at it, or implement `CaddyAdmin` over your own route. Never expose :2019.
+- **A Caddyfile cannot strand the provider.** Before loading, the adapted `admin` block is refused
+  if it turns the API off, listens off loopback or somewhere the transport does not reach (another
+  port, socket or loopback address: `[::1]` is not `127.0.0.1`, and `localhost` binds IPv4), allows
+  no Host the transport sends (its `origins`, or Caddy's loopback defaults when there are none), sets
+  `enforce_origin` over a unix socket (no Origin is sent there), enables `remote`, or pulls config.
+- ⛔ **No `admin` address means Caddy's default** (`localhost:2019`, or `$CADDY_ADMIN`) after the
+  load. That is refused unless the transport is at that default: a Caddy reached on a socket or
+  another port declares `admin <address>` in its Caddyfile.

package/docs/caddy.md

@@ -24,10 +24,12 @@ export const edge = Effect.gen(function* () {
   yield* LaunchdJob('caddy-daemon', {
     label: 'com.example.caddy',
     domain: 'system',
+    // --resume: a restart runs the last config Caddy accepted (see Managed Caddies below).
     // --envfile: a file a secret renderer (openbao-agent) writes; {env.CF_API_TOKEN} reads it.
     programArguments: [
       '/usr/local/bin/caddy',
       'run',
+      '--resume',
       '--config',
       file.path,
       '--adapter',
@@ -35,6 +37,8 @@ export const edge = Effect.gen(function* () {
       '--envfile',
       '/usr/local/etc/caddy.env',
     ],
+    // ⛔ Here, not in the envfile: Caddy fixes its autosave path before it reads --envfile.
+    environment: { XDG_CONFIG_HOME: '/usr/local/var/caddy-edge' },
     runAtLoad: true,
     keepAlive: true,
   });
@@ -56,15 +60,15 @@ export const providers = Layer.mergeAll(caddyProviders(), launchdProviders());
 | `endpoint`     | where the admin API was reached                                                      |
 | `sourceFile`   | as applied                                                                           |
 
-| step    | what happens                                                                                                                             |
-| ------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
-| plan    | `POST /adapt` the Caddyfile (side-effect free): a syntax error, a literal secret, no apps or an unsafe `admin` block fails the **plan**  |
-| apply   | `POST /load` with `text/caddyfile`, then `GET /config/` must hash to what `/adapt` produced; skipped when Caddy already runs it          |
-| refused | Caddy keeps the old config (it rolls back itself); the deploy fails with Caddy's reason and says whether the old config is still running |
-| read    | the digest of `GET /config/` — with no state, a running Caddy is **adopted** (its live config becomes the baseline)                      |
-| drift   | live ≠ stored → `update`: a hand `curl` to the API, or a restart that loaded a different file                                            |
-| replace | never — a new Caddyfile is a reload of the same Caddy                                                                                    |
-| delete  | ⛔ nothing. See [Removing it](#removing-it)                                                                                              |
+| step    | what happens                                                                                                                                       |
+| ------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| plan    | `POST /adapt` the Caddyfile (side-effect free): a syntax error, a literal secret, no apps or an unsafe `admin` block fails the **plan**            |
+| apply   | `POST /load` with `text/caddyfile`, then `GET /config/` must hash to what `/adapt` produced; skipped when Caddy already runs it                    |
+| refused | Caddy keeps the old config (it rolls back itself); the deploy fails with Caddy's reason and says whether the old config is still running           |
+| read    | the digest of `GET /config/`; with no state, the adoption probe — ⛔ a config that is not the declared one needs `--adopt` ([Adoption](#adoption)) |
+| drift   | live ≠ stored → `update`: a hand `curl` to the API, or a restart that loaded a different file                                                      |
+| replace | never — a new Caddyfile is a reload of the same Caddy                                                                                              |
+| delete  | ⛔ nothing. See [Removing it](#removing-it)                                                                                                        |
 
 The digests compare adapted JSON, not bytes: `/adapt` answers Go struct order, `GET /config/` sorted
 keys with `<>&` escaped and a trailing newline. `digest.ts` erases all three. ★ Measured 2026-09-21
@@ -86,31 +90,42 @@ before any admin API exists to load into. What bounds the cost:
   `/adapt` fails the plan. On the very first deploy the path is still an Output, Alchemy skips the
   adoption probe, and the check runs at apply instead.
 - ⚠️ **A Caddyfile that adapts but that Caddy refuses** (a port in use, a missing cert file) is on
-  disk when `/load` fails. Caddy keeps serving the old config — but a **restart before the fix loads
-  the refused file**. Fix and redeploy, or run Caddy with `--resume` (below).
+  disk when `/load` fails. Caddy keeps serving the old config, and a managed Caddy's restart runs its
+  autosave, not the refused file (below). Without `--resume` a **restart before the fix loads the
+  refused file**: fix and redeploy.
 - ⛔ Secrets are refused at declaration, before the HostFile exists (its `content` is a prop too).
 - ★ Both resources retain: removing them from a stack leaves the file a restart needs.
 
-## Autosave and `--resume`
-
-After every successful load (ours included) Caddy writes the config JSON to `autosave.json`
-(`$XDG_CONFIG_HOME/caddy/`, else `~/Library/Application Support/Caddy/` on macOS, `~/.config/caddy/`
-on Linux), unless the Caddyfile says `persist_config off`. ⚠️ A daemon started with no `HOME` and no
-`XDG_CONFIG_HOME` falls back to `./caddy/` under its working directory (storage.go AppConfigDir):
-set `XDG_CONFIG_HOME` in the launchd job so autosave lands where you expect.
-
-- **Without `--resume`** (the mini's Caddy today): a restart loads `--config`. The file and the
-  running config agree after every successful deploy; see the ⚠️ above for a failed one.
-- **With `caddy run --resume --config <file>`**: a restart loads `autosave.json` — the last config
-  Caddy **accepted** — and `--config` only when no autosave exists. A refused file on disk can then
-  never take sites down. The trade: a hand change through the API also survives a restart; the next
-  plan reports it as drift and the deploy puts the declaration back.
-- `--watch` reloads the file on change; our `/load` right after is then a no-op ("config is
-  unchanged").
-- `sourceFile` rides as `Caddy-Config-Source-File`, as `caddy reload` sends it. Without it a load
-  makes Caddy forget its source file, and SIGUSR1 stops reloading from it. The header only KEEPS the
-  file Caddy started with (caddy.go ClearLastConfigIfDifferent); it never sets a new one. ⚠️ Under
-  `--resume` with an autosave, Caddy records no source file at all, so SIGUSR1 has nothing to reload.
+## Managed Caddies: `--resume` and their own config dir
+
+★ **Decision, 2026-09-21.** A Caddy this package manages runs `caddy run --resume --config <file>`
+with `XDG_CONFIG_HOME` set to a directory of its own, so a restart runs the last config Caddy
+**accepted**. After every successful load (ours included) Caddy writes the config JSON to
+`$XDG_CONFIG_HOME/caddy/autosave.json`; `--resume` starts from it, and from `--config` only when no
+autosave exists (cmd/commandfuncs.go cmdRun). Read in caddyserver/caddy v2.11.4:
+
+- ★ **A refused Caddyfile on disk cannot take sites down.** The file is the first-boot fallback: a
+  new host, or an autosave someone deleted.
+- ★ **Its own directory,** so nothing else (a Homebrew service, a person's `caddy run`) writes the
+  autosave it resumes from. With neither `HOME` nor `XDG_CONFIG_HOME` a daemon would use `./caddy/`
+  under its working directory (storage.go AppConfigDir).
+- ⛔ **Set `XDG_CONFIG_HOME` in the job's `environment`, not the envfile.** The autosave path is
+  fixed when the binary starts (storage.go `var ConfigAutosavePath`), before `--envfile` is read.
+- ⛔ **No `persist_config off`** in a managed Caddyfile. It stops the autosave, so `--resume` starts
+  from a stale one (the last config before it) or, with none, from the file.
+- ⚠️ **A hand change through the API survives a restart.** The next plan reports it as drift, and the
+  deploy puts the declaration back.
+- ⚠️ **SIGUSR1 is not a way to change config.** After a resumed start Caddy records no source file
+  (cmdRun calls `SetLastConfig` only after loading `--config`), so SIGUSR1 is ignored with the log
+  line `last config unknown`. Our `Caddy-Config-Source-File` header keeps a source Caddy already
+  has (caddy.go ClearLastConfigIfDifferent) and never sets one. After a first boot from the file,
+  SIGUSR1 still reloads it: the text the deploy wrote. Change config by deploying. Editing the file
+  and running `caddy reload` is a hand `/load`, which the next plan reports as drift.
+- ⛔ **No `--watch`.** After a resumed start it has no file to watch, and falls back to a `Caddyfile`
+  in the working directory (cmd/main.go watchConfigFile).
+
+A Caddy not yet moved over (no `--resume`) restarts from `--config`: see the ⚠️ in
+[Order](#order-file-then-load).
 
 ## Secrets
 
@@ -133,31 +148,33 @@ bcrypt/argon2 hashes). It never echoes what it found. It is a tripwire, not a sc
 
 ## The admin endpoint
 
-⛔ The admin API has no authentication. `localCaddyAdmin()` accepts only `http://` loopback
-(`127.0.0.0/8`, `localhost`, `[::1]`) or `unix:///path`; the default is `http://127.0.0.1:2019`.
-
-- **Host and Origin.** Caddy refuses a request whose `Host` is not an allowed origin (DNS-rebinding
-  guard; measured on Caddy 2.11.4: `403 host not allowed`), and checks `Origin` when one is sent or
-  `enforce_origin` is on. The transport sends both as the Caddy CLI does. A unix socket skips the
-  Host check entirely.
-- **`admin { origins … }`** narrowed, or **an SSH-forwarded port** (Caddy checks the Host against
-  ITS port): pass `hostHeader: 'localhost:2019'`.
-- **Another host's Caddy** (SSH later): forward its socket or port to loopback here and point a
-  `localCaddyAdmin()` at it, or implement `CaddyAdmin` over your own route. Never expose :2019.
-- **A Caddyfile cannot strand the provider.** Before loading, the adapted `admin` block is refused
-  if it turns the API off, listens off loopback or somewhere the transport does not reach (another
-  port, socket or loopback address: `[::1]` is not `127.0.0.1`, and `localhost` binds IPv4), allows
-  no Host the transport sends (its `origins`, or Caddy's loopback defaults when there are none), sets
-  `enforce_origin` over a unix socket (no Origin is sent there), enables `remote`, or pulls config.
-- ⛔ **No `admin` address means Caddy's default** (`localhost:2019`, or `$CADDY_ADMIN`) after the
-  load. That is refused unless the transport is at that default: a Caddy reached on a socket or
-  another port declares `admin <address>` in its Caddyfile.
+⛔ The admin API has no authentication: `localCaddyAdmin()` accepts only `http://` loopback or
+`unix:///path` (default `http://127.0.0.1:2019`), and a Caddyfile whose `admin` block would move,
+expose or lock out the API is refused before it loads. Host/Origin checks, narrowed `origins`, SSH
+forwards and every refusal: [caddy-admin.md](./caddy-admin.md).
 
 ## Adoption
 
-With no state, `read` reports the running Caddy's live config as plain (owned) attributes, so the
-first deploy adopts it silently and its forced update loads the declared Caddyfile — a full replace
-of whatever ran before. ⚠️ Review the plan: the Caddy on this loopback admin API is the one you get.
+★ **Nothing is adopted silently** (decision, 2026-09-21) — the rule `HostFile` and `LaunchdJob` keep.
+With no state, `read` is Alchemy's adoption probe, and what the Caddy runs decides:
+
+| running                             | read      | plan                                                       |
+| ----------------------------------- | --------- | ---------------------------------------------------------- |
+| the declared config (same digest)   | ours      | adopted; the forced update loads nothing                   |
+| nothing (`null`, or no apps)        | absent    | create — nothing to take over, as an empty R2 lock is none |
+| anything else                       | `Unowned` | refused unless the deploy runs with `--adopt`              |
+| a Caddyfile that cannot be compared | `Unowned` | the same, with a warning saying why                        |
+| no Caddy answering                  | absent    | create, with a warning; the apply checks again             |
+
+- ⚠️ **Alchemy skips the probe while the props hold an Output** — always on `caddyWithFile()`'s first
+  deploy, whose `sourceFile` is the HostFile's path. So the apply of a create checks too, and fails
+  before any `/load` unless the deploy runs with `--adopt`. The HostFile is written by then (a file
+  already at the path is the HostFile's own `Unowned`); under `--resume` a restart still runs the
+  autosave.
+- ★ **That apply-time check resolves adoption as the planner does:** a resource-scoped `adopt(…)`,
+  else `--adopt`. So `.pipe(adopt(false))` still refuses under `--adopt`, and `adopt(true)` works.
+- ★ **An uncomparable Caddyfile is `Unowned`, not an error**: the same read recovers an interrupted
+  create with that deploy's props, and a throw would fail every later plan, the fixed one included.
 
 ## Removing it
 
@@ -177,4 +194,6 @@ it by hand at its admin API.
   its launchd job has Caddy listening. The transport retries a refused connection (`retries`,
   `retryDelayMs`; default 2 × 500 ms) — raise them, or rerun the deploy.
 - ⚠️ One `CaddyAdmin` per stack: the transport picks the Caddy, not a prop. Pointing it at another
-  Caddy plans an update that loads there; the old one keeps what it had.
+  Caddy plans an update; the old one keeps what it had. ⛔ State vouches only for the Caddy it was
+  applied to, so the apply loads there only if it serves nothing, runs the declared config or the
+  one last stored — anything else needs `--adopt`.

package/docs/launchd-sudo.md

@@ -0,0 +1,122 @@
+# Deploying a Mac host as yourself — `sudoRunner()`
+
+A host stack that declares system daemons needs root for a handful of calls. `sudoRunner()` lets
+the deploy run as you (the operator) and sends **only those calls** through `sudo -n`, in fixed
+argv shapes, logging each one. It is an explicit opt-in: nothing falls back to it, and
+`localRunner()` stays the default and never elevates.
+
+```ts
+import { launchdProviders, sudoRunner } from '@homeflare/alchemy/launchd';
+
+const runner = sudoRunner({
+  // ⛔ Required: the directories root may write. Each must be a real directory that root owns
+  //   and only root may write; that is checked at every privileged call.
+  prefixes: ['/Library/LaunchDaemons', '/opt/example'],
+  // log: (line) => …, // default: one line on stderr per privileged call
+});
+// Provide launchdProviders(runner) alongside the stack's other provider layers.
+```
+
+## What runs as root: the whole list
+
+Each is `/usr/bin/sudo -n -- <argv>`, every program by absolute path, never through a shell.
+
+| when                             | argv                                                                   |
+| -------------------------------- | ---------------------------------------------------------------------- |
+| a system job is bootstrapped     | `/bin/launchctl bootstrap system /Library/LaunchDaemons/<label>.plist` |
+| a system job is booted out       | `/bin/launchctl bootout system/<label>`                                |
+| (your own code, via `exec`)      | `/bin/launchctl kickstart [-k] [-p] system/<label>`                    |
+| a file under a prefix is written | `/usr/bin/install -S -m <0644> [-o <uid>] [-g <gid>] <staged> <path>`  |
+| a file under a prefix is removed | `/bin/rm -f -- <path>`                                                 |
+
+- A file's bytes never reach argv or the log: they are written, as you, to a `0600` file in a
+  fresh `0700` temp directory. `install` copies that file (and only that file) into place, and
+  the temp directory is removed afterwards, whether or not the install succeeded.
+- `install` writes a temp file beside the target and renames it (install(1) on macOS 27.2), so the
+  target is never torn. `-S` adds the fsync.
+- Owner and group are numeric ids, resolved by the provider before the call.
+
+## What stays as you
+
+- `launchctl print` and `print-disabled`. launchctl(1): "Anyone may read or query the system
+  domain"; measured on macOS 27.2, too (see `src/launchd/launchctl.ts`).
+- User and group lookups, `id -G`, every file read and `lstat`.
+- Files outside every prefix, and your own `gui/<uid>` jobs.
+
+★ So **a plan never calls sudo.** `read` and `diff` are reads; only an apply elevates.
+
+## Refused before sudo is asked
+
+- Any other argv. That includes a bare `bootout system` (which removes the whole system domain),
+  `bootstrap system <directory>` (which loads every plist in it), a plist anywhere but
+  `/Library/LaunchDaemons/<label>.plist` (the only place launchd loads daemons from at boot),
+  `rm -r`, `install -d`, a label under `org.nixos.`, `com.apple.` or `homebrew.mxcl.`, and any
+  argv whose program is `sudo`.
+- A system job's `bootstrap` or `bootout` when `/Library/LaunchDaemons` is not a prefix. ⚠️ Without
+  it a delete would boot the job out, then fail to remove its plist, which launchd loads again at
+  the next boot.
+- A prefix that is missing, a symlink, not owned by root, or writable by group or other. ⛔ A
+  symlinked prefix makes root write wherever it points, a path the log never names.
+- A path outside every prefix that needs root: another user as the owner, say.
+- A symlink or missing directory between the prefix and the file, or anything but a regular file
+  at the path. ⚠️ `install src <directory>` copies _into_ the directory, and a symlink to one does
+  the same.
+- A file you could not read back. Both providers read every write back, and read again at every
+  plan, as you. A root-only `0600` would be installed, then fail with `EACCES` and stay on disk
+  with no state. Membership comes from `id -G`, because macOS caps `getgroups()` at 16 (measured
+  2026-09-21: 16 against 18).
+- Another user's `gui/<uid>` or `user/<uid>` domain. Only the system domain is elevated.
+
+Every refusal above throws `SudoRefusedError`: nothing ran as root. A privileged command that ran
+and failed throws a plain `Error` with its exit code.
+
+## When sudo wants a password
+
+`sudo -n` never prompts. It fails at once, and the error says so: `a password is required, and
+this runner never prompts`. The command did not run. You have two options.
+
+1. **`sudo -v` just before the deploy.** This caches a ticket. By default it lasts 5 minutes and
+   is tied to one terminal (sudoers(5): `timestamp_timeout`, `timestamp_type`).
+   ⚠️ A deploy that outlives the ticket fails at its next privileged call. Every step is
+   idempotent (Alchemy requires `delete` to be), so `sudo -v` and deploying again converges. The
+   exception is a `LaunchdJob` label or domain change: it is delete-first, so if it fails between
+   the delete and the create, the job is down until you redeploy.
+2. **A `NOPASSWD` sudoers rule for exactly the shapes above.**
+   - ⛔ **That rule is root-equivalent.** Anyone who may `install` into `/Library/LaunchDaemons`
+     and `launchctl bootstrap system` can run any program as root. The allowlist protects you
+     from mistakes, not from the account that holds the rule.
+   - ⛔ **Never use wildcards in the arguments.** sudoers(5): in arguments, `*` also matches spaces
+     and `/`, so `/bin/rm -f -- /opt/example/*` matches `../../etc/x` and two paths at once. Use
+     `^…$` regular expressions (sudo 1.9.10 and later; macOS 27.2 ships 1.9.17p2) and forbid
+     `..`. Check the file with `visudo -c -f <file>` before you install it.
+   - ⚠️ The kit ships no tested rule. Nothing here has run sudo.
+
+⚠️ The error text sudo prints is **reasoned, not measured**. It comes from sudoers(5) and sudo(8)
+for sudo 1.9.17p2. A sudo refusal the runner does not recognise comes back as a failed command,
+with sudo's own stderr.
+
+## The log
+
+Each privileged call logs one line before it runs:
+
+```text
+homeflare/launchd sudo -n ["/bin/launchctl","bootstrap","system","/Library/LaunchDaemons/com.example.exporter.plist"]
+```
+
+The argv is written as JSON, so a space in a path cannot hide a second argument. The line holds
+the argv only, never file content. ⛔ A custom `log` should keep every line: the log is the only
+record of what ran as root.
+
+## Limits
+
+- ⚠️ **Moving a job from `system` to another user's `gui/<uid>` passes the plan and fails at
+  apply**, after the old job was already removed. The runner reports `privileged: true`, so the
+  plan-time check lets it through, and the refusal only comes at the write. Do that move as a
+  remove, then an add.
+- ⚠️ **Under a prefix, the runner writes as root.** An omitted owner is root, and an omitted group
+  is the directory's group (a new file's group on macOS).
+- ⚠️ **The checks guard against a mistaken declaration, not against a hostile one.** They run as
+  you, just before the call. The prefix itself must be root-only, but a directory _below_ it that
+  another user owns is not checked for that, and that user could swap what lies under it in
+  between. Keep every directory under a prefix root-owned, too. ACLs are not read, only mode bits.
+- ⛔ **macOS hosts.** Every argv shape was checked against macOS 27.2 man pages.