@homeflare/alchemy 0.8.0 → 0.10.0

package/dist/launchd/job-lifecycle.d.ts

@@ -28,7 +28,14 @@ export declare const readJob: (runner: HostRunner, props: Identity) => Promise<L
  */
 export declare const replaceDiff: (runner: HostRunner, next: Identity, full: LaunchdJobProps | undefined, output: LaunchdJobAttributes) => Promise<Diff>;
 export declare const diffJob: (runner: HostRunner, news: LaunchdJobProps, output: LaunchdJobAttributes) => Promise<Diff>;
-export declare const reconcileJob: (runner: HostRunner, props: LaunchdJobProps, output: LaunchdJobAttributes | undefined) => Promise<LaunchdJobAttributes>;
+/**
+ * `adopt` is whether adoption is on AND this apply is a create or an unfinished generation of our
+ * own (ownership/adopt.ts adoptsAtApply): it lets such a generation take over a job already on the
+ * host, as the plan's probe would have. A rename onto an occupied label stays refused, as it is at
+ * plan time (assertReplaceable) — including a label taken between that plan and a fresh replace's
+ * new generation, which the caller never marks adoptable.
+ */
+export declare const reconcileJob: (runner: HostRunner, props: LaunchdJobProps, output: LaunchdJobAttributes | undefined, adopt?: boolean) => Promise<LaunchdJobAttributes>;
 /** Boot out, then remove the plist. Idempotent: an absent job and an absent file are success. */
 export declare const deleteJob: (runner: HostRunner, output: LaunchdJobAttributes) => Promise<void>;
 //# sourceMappingURL=job-lifecycle.d.ts.map

package/dist/launchd/job-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-lifecycle.d.ts","sourceRoot":"","sources":["../../src/launchd/job-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAIrB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,QAAQ,EASd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmB9C,uGAAuG;AACvG,eAAO,MAAM,OAAO,WACV,UAAU,SACX,QAAQ,KACd,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAM1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,WACd,UAAU,QACZ,QAAQ,QACR,eAAe,GAAG,SAAS,UACzB,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,eAAO,MAAM,OAAO,WACV,UAAU,QACZ,eAAe,UACb,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAad,CAAC;AAEF,eAAO,MAAM,YAAY,WACf,UAAU,SACX,eAAe,UACd,oBAAoB,GAAG,SAAS,KACvC,OAAO,CAAC,oBAAoB,CAsE9B,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,SAAS,WACZ,UAAU,UACV,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAQd,CAAC"}
+{"version":3,"file":"job-lifecycle.d.ts","sourceRoot":"","sources":["../../src/launchd/job-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAIrB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,QAAQ,EAWd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmB9C,uGAAuG;AACvG,eAAO,MAAM,OAAO,WACV,UAAU,SACX,QAAQ,KACd,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAM1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,WACd,UAAU,QACZ,QAAQ,QACR,eAAe,GAAG,SAAS,UACzB,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,eAAO,MAAM,OAAO,WACV,UAAU,QACZ,eAAe,UACb,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAiBd,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,WACf,UAAU,SACX,eAAe,UACd,oBAAoB,GAAG,SAAS,sBAEvC,OAAO,CAAC,oBAAoB,CAgE9B,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,SAAS,WACZ,UAAU,UACV,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAQd,CAAC"}

package/dist/launchd/job-preflight.d.ts

@@ -12,13 +12,25 @@
  */
 import { type LaunchdJobAttributes, type LaunchdJobProps, type ParsedDomain } from './job-form.ts';
 import { type ServiceStatus } from './launchctl.ts';
-import { type HostRunner } from './runner.ts';
+import { type HostRunner, type WriteOptions } from './runner.ts';
 export type Location = {
     readonly domain: ParsedDomain;
     readonly plistPath: string;
     readonly target: string;
 };
 export type Identity = Pick<LaunchdJobProps, 'label' | 'domain'>;
+/**
+ * ⚠️ launchd refuses a daemon plist that is not root:wheel or is group/world-writable ("bad
+ *   ownership/permissions"), so the system domain always writes 0644 root:wheel. An agent's plist
+ *   belongs to its user. REASONED from launchd's documented behaviour, not measured here (no
+ *   bootstrap was run to write this); the nix-darwin daemons on the reference host are 0644 root.
+ */
+export declare const plistWriteOptions: (domain: ParsedDomain) => WriteOptions;
+/**
+ * PLAN TIME, for a plan that will write the plist: the runner's own pre-write refusals
+ * (HostRunner.checkWrite — sudoRunner's directory and mode checks), reading only.
+ */
+export declare const checkPlistWrite: (runner: HostRunner, location: Location) => Promise<void>;
 export declare const refuse: (label: string, message: string) => Error;
 /** Throw every refusal at once, so one plan shows the whole list. */
 export declare const assertValid: (props: LaunchdJobProps) => void;

package/dist/launchd/job-preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-preflight.d.ts","sourceRoot":"","sources":["../../src/launchd/job-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,YAAY,EAKlB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,KAAK,aAAa,EAA4B,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,aAAa,CAAC;AAE5D,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;AAEjE,eAAO,MAAM,MAAM,UAAW,MAAM,WAAW,MAAM,KAAG,KACT,CAAC;AAEhD,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,IAGpD,CAAC;AAEF,eAAO,MAAM,MAAM,WAAkB,UAAU,SAAS,QAAQ,KAAG,OAAO,CAAC,QAAQ,CAUlF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,WAAY,UAAU,SAAS,MAAM,UAAU,YAAY,KAAG,IAiBxF,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,SAAS,WACZ,UAAU,SACX,QAAQ,KACd,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAwBvD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAClB,UAAU,SACX,MAAM,YACH,QAAQ,UACV,aAAa,kBACL,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,WACpB,UAAU,QACZ,QAAQ,QACR,eAAe,GAAG,SAAS,OAC5B,oBAAoB,kBACT,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,IAAI,CAQd,CAAC"}
+{"version":3,"file":"job-preflight.d.ts","sourceRoot":"","sources":["../../src/launchd/job-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,YAAY,EAKlB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,KAAK,aAAa,EAA4B,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,YAAY,EAAgB,MAAM,aAAa,CAAC;AAE/E,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,WAAY,YAAY,KAAG,YACsC,CAAC;AAEhG;;;GAGG;AACH,eAAO,MAAM,eAAe,WAAkB,UAAU,YAAY,QAAQ,KAAG,OAAO,CAAC,IAAI,CACd,CAAC;AAE9E,eAAO,MAAM,MAAM,UAAW,MAAM,WAAW,MAAM,KAAG,KACT,CAAC;AAEhD,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,IAGpD,CAAC;AAEF,eAAO,MAAM,MAAM,WAAkB,UAAU,SAAS,QAAQ,KAAG,OAAO,CAAC,QAAQ,CAUlF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,WAAY,UAAU,SAAS,MAAM,UAAU,YAAY,KAAG,IAiBxF,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,SAAS,WACZ,UAAU,SACX,QAAQ,KACd,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAwBvD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAClB,UAAU,SACX,MAAM,YACH,QAAQ,UACV,aAAa,kBACL,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,WACpB,UAAU,QACZ,QAAQ,QACR,eAAe,GAAG,SAAS,OAC5B,oBAAoB,kBACT,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,IAAI,CASd,CAAC"}

package/dist/launchd/job.d.ts

@@ -18,7 +18,8 @@
  * ⛔ ENVIRONMENT IS NON-SECRET ONLY — see the ⛔ on LaunchdJobProps.environment.
  * ⛔ NO SILENT SUDO — see assertMayWrite in job-preflight.ts.
  * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`. A label already loaded, or a plist already on disk, reads
- *   as `Unowned`, so Alchemy refuses to take it over unless asked. Labels under `org.nixos.`,
+ *   as `Unowned`, so Alchemy refuses to take it over unless asked — and reconcile, where the plan
+ *   never asked, honours the same `--adopt` / `adopt(…)` (docs/ownership.md). Labels under `org.nixos.`,
  *   `com.apple.` and `homebrew.mxcl.` are refused outright (job-validate.ts) — declare a new label
  *   and cut over instead (docs/launchd.md).
  */

package/dist/launchd/job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job.d.ts","sourceRoot":"","sources":["../../src/launchd/job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,6FA6C5B,CAAC"}
+{"version":3,"file":"job.d.ts","sourceRoot":"","sources":["../../src/launchd/job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,6FAmD5B,CAAC"}

package/dist/launchd/runner.d.ts

@@ -72,6 +72,13 @@ export interface HostRunner {
      * ⚠️ The parent directory must exist; creating it would invent an owner and mode nobody declared.
      */
     writeFileAtomic(path: string, bytes: Uint8Array, options: WriteOptions): Promise<void>;
+    /**
+     * PLAN TIME: refuse, reading only and writing nothing, a write this runner would refuse at
+     * apply — so the plan shows it before any resource is applied. Optional: a runner without it
+     * refuses at the write. ★ sudoRunner implements it with the checks it makes before `sudo -n`;
+     *   ⛔ it never elevates, so a plan still never calls sudo.
+     */
+    checkWrite?(path: string, options: WriteOptions): Promise<void>;
     /** Remove a file. Idempotent: nothing at `path` is success. */
     removeFile(path: string): Promise<void>;
     /** A user by name or numeric id, or `undefined` when the host has none. */

package/dist/launchd/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/launchd/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,sGAAsG;AACtG,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1D,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,YAAY,IAAI,MAAM,CAAC;IACvB,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACxD,uDAAuD;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAClD;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,+DAA+D;IAC/D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,2EAA2E;IAC3E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC5D,kFAAkF;IAClF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3D,gFAAgF;IAChF,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;;AAED,uEAAuE;AACvE,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,eAAe,WAAY,UAAU,KAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;AAE3C,oFAAoF;AACpF,eAAO,MAAM,YAAY,WAAY,UAAU,KAAG,OACA,CAAC"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/launchd/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,sGAAsG;AACtG,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1D,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,YAAY,IAAI,MAAM,CAAC;IACvB,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACxD,uDAAuD;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAClD;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF;;;;;OAKG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,+DAA+D;IAC/D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,2EAA2E;IAC3E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC5D,kFAAkF;IAClF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3D,gFAAgF;IAChF,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;;AAED,uEAAuE;AACvE,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,eAAe,WAAY,UAAU,KAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;AAE3C,oFAAoF;AACpF,eAAO,MAAM,YAAY,WAAY,UAAU,KAAG,OACA,CAAC"}

package/dist/launchd/sudo-acl.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The ACL half of sudo-guard.ts: mode bits say a directory is root's alone, and an ACL can say
+ * otherwise. On macOS an `allow add_file,add_subdirectory,delete_child` entry lets its holder swap
+ * what lies under a root-owned `0755` directory — a symlink where the file was — between the
+ * guard's lstat checks and the privileged call, exactly as group write would. An inheritable
+ * `allow write` hands every file root installs there to its holder.
+ *
+ * ★ READ WITH `ls -lden`, AS THE OPERATOR — no sudo, and the same read at plan time and before the
+ *   write. MEASURED 2026-09-21 on macOS 27.2: each entry prints on its own line after the path's,
+ *   as ` 0: <qualifier> [inherited ]allow|deny <perms>`; `-n` makes the qualifier a UUID, never a
+ *   name with a space in it. The `+` flag after the mode is NOT reliable — `@` (extended
+ *   attributes) replaces it in the listing — so the entries are what is read.
+ * ⚠️ A DENY ENTRY GRANTS NOTHING (macOS puts `everyone deny delete` on home folders), and an allow
+ *   of read-only rights (`list`, `search`, `readattr` …) swaps nothing, so neither refuses.
+ */
+import type { HostRunner } from './runner.ts';
+export declare const LS = "/bin/ls";
+/** The allow entries in `ls -lden` output that grant a write right, as printed. */
+export declare const aclGrants: (listing: string) => string[];
+/**
+ * ⛔ Refuse when any directory in `chain` carries an ACL entry that lets someone write it, or when
+ *   the ACLs cannot be read at all (fail closed). `path` names the file in the refusal.
+ */
+export declare const assertNoAclGrants: (base: HostRunner, path: string, chain: readonly string[]) => Promise<void>;
+//# sourceMappingURL=sudo-acl.d.ts.map

package/dist/launchd/sudo-acl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-acl.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,eAAO,MAAM,EAAE,YAAY,CAAC;AAgB5B,mFAAmF;AACnF,eAAO,MAAM,SAAS,YAAa,MAAM,KAAG,MAAM,EAOnB,CAAC;AAEhC;;;GAGG;AACH,eAAO,MAAM,iBAAiB,SACtB,UAAU,QACV,MAAM,SACL,SAAS,MAAM,EAAE,KACvB,OAAO,CAAC,IAAI,CAed,CAAC"}

package/dist/launchd/sudo-guard.d.ts

@@ -5,14 +5,26 @@
  * ⛔ WHAT IS LOGGED IS WHAT IS WRITTEN. A symlinked directory under a prefix would make
  *   `install` or `rm`, running as root, act on a path the log never named. So every directory
  *   between the prefix and the file must be a real directory.
- * ⚠️ These checks run before the privileged call, so they guard against a mistaken declaration, not
- *   against someone who can already write inside a prefix and swap a path in between. The prefix
- *   itself is checked to be root-only (prefixProblem); a directory BELOW it that another user owns
- *   is not, and that user could swap what lies under it in that window.
+ * ⛔ EVERY DIRECTORY FROM THE PREFIX DOWN IS ROOT'S ALONE (decided 2026-09-21). A directory below
+ *   the prefix that another user owns, or that group or other may write, lets that user swap what
+ *   lies under it — a symlink where the file was — between these checks and the privileged call.
+ *   So each one must be owned by root and not group/other-writable (rootOnlyProblem), exactly as
+ *   the prefix itself must.
+ * ⛔ AND EVERY DIRECTORY ABOVE THE PREFIX (red team, 2026-09-21). Whoever may write the prefix's
+ *   parent may rename the prefix away and put a symlink in its place between these checks and the
+ *   privileged call — the same swap one level up. So `/` down to the prefix's parent must be
+ *   root-only too (a root-owned symlink among them, `/etc` -> `private/etc`, is root's own and is
+ *   followed; its target is root's choice, and not walked).
+ * ⛔ AND NO ACL THAT SAYS OTHERWISE (sudo-acl.ts): mode bits are not the whole answer on macOS.
+ * ⚠️ These checks run before the privileged call, as the deploying user. They guard against a
+ *   mistaken declaration and against every user but root; root itself could still change a path
+ *   in that window.
  */
 import type { HostRunner, WriteOptions } from './runner.ts';
 /** The directories strictly between `prefix` and the file at `path`. */
 export declare const betweenDirs: (prefix: string, path: string) => string[];
+/** The directories strictly above `prefix`: `/`, then each one down to the prefix's parent. */
+export declare const aboveDirs: (prefix: string) => string[];
 /**
  * What must be at `path` itself: a regular file, or (for a write or a remove) nothing yet.
  * ⚠️ A DIRECTORY AT THE DESTINATION IS THE TRAP: `install src dir` copies INTO the directory
@@ -24,6 +36,21 @@ export type Expect = 'file' | 'file-or-absent';
  * prefix and `path`, and anything but a file at it.
  */
 export declare const assertPlainPath: (base: HostRunner, prefix: string, path: string, expect: Expect) => Promise<'file' | 'absent'>;
+/**
+ * ⛔ A ROOT-OWNED FILE UNDER A PREFIX IS ROOT'S TO CHANGE, AND ONLY ROOT'S (decided 2026-09-21).
+ *   Group- or world-writable, anyone in that class rewrites a file root installed — a daemon's
+ *   config, a script a LaunchDaemon runs as root — which is root by another name. Setuid or setgid,
+ *   it runs as root (or its group) for whoever executes it. install(1) would apply either, as root.
+ * ★ Root-owned is an omitted owner (the runner installs as root under a prefix) or uid 0. A file
+ *   handed to another user is that user's to change; the sticky bit changes nothing on a file.
+ */
+export declare const modeProblem: (options: WriteOptions) => string | undefined;
+/**
+ * Every check a write under `prefix` meets before anything is staged or run as root: the mode, the
+ * path (assertPlainPath) and the read-back (assertReadableBack). ★ Reads only, as the deploying
+ *   user — so sudoRunner's `checkWrite` runs it at PLAN time too, and a plan still never calls sudo.
+ */
+export declare const assertInstallable: (base: HostRunner, prefix: string, path: string, options: WriteOptions, groups: readonly number[] | undefined) => Promise<void>;
 /**
  * POSIX read permission for one uid: owner class, else group class, else other. `undefined` when
  * only group membership could decide and the groups are unknown.

package/dist/launchd/sudo-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sudo-guard.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAY,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAMtE,wEAAwE;AACxE,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,KAAG,MAAM,EAMhE,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;AAuB/C;;;GAGG;AACH,eAAO,MAAM,eAAe,SACpB,UAAU,UACR,MAAM,QACR,MAAM,UACJ,MAAM,KACb,OAAO,CAAC,MAAM,GAAG,QAAQ,CAwB3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SACZ;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,OACtE,MAAM,UACH,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,GAAG,SASZ,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,SACvB,UAAU,QACV,MAAM,WACH,YAAY,UACb,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,CAAC,IAAI,CAYd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAgB,UAAU,KAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAI5F,CAAC"}
+{"version":3,"file":"sudo-guard.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAY,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAOtE,wEAAwE;AACxE,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,KAAG,MAAM,EAMhE,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,SAAS,WAAY,MAAM,KAAG,MAAM,EAGhD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;AAuB/C;;;GAGG;AACH,eAAO,MAAM,eAAe,SACpB,UAAU,UACR,MAAM,QACR,MAAM,UACJ,MAAM,KACb,OAAO,CAAC,MAAM,GAAG,QAAQ,CA6C3B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,YAAa,YAAY,KAAG,MAAM,GAAG,SAO5D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,SACtB,UAAU,UACR,MAAM,QACR,MAAM,WACH,YAAY,UACb,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SACZ;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,OACtE,MAAM,UACH,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,GAAG,SASZ,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,SACvB,UAAU,QACV,MAAM,WACH,YAAY,UACb,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,CAAC,IAAI,CAYd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAgB,UAAU,KAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAI5F,CAAC"}

package/dist/launchd/sudo-runner.d.ts

@@ -21,9 +21,9 @@
  * ★ `install -S`: install(1) on macOS 27.2 (read 2026-09-21) always writes a temp file in the
  *   target directory and renames it, so the file is never torn, and -S adds the fsync that
  *   localRunner's `handle.sync()` does.
- * ⚠️ REASONED, NOT MEASURED: sudo's failure text. The kit never runs sudo. The strings below follow
- *   sudoers(5) for sudo 1.9.17p2 on macOS 27.2 ("a password is required": -n was given but a
- *   password was needed) and sudo(8) (sudo exits 1 when it fails itself).
+ * ⚠️ REASONED, NOT MEASURED: sudo's failure text (sudo-said.ts has the strings and their sources).
+ * ⛔ EVERY CHECK BEFORE SUDO ALSO RUNS AT PLAN TIME (`checkWrite`, 2026-09-21): the mode, the
+ *   directories from the prefix down, the read-back. Reads only, as the operator — never sudo.
  */
 import { type LocalRunnerOptions } from './local-runner.ts';
 import type { HostRunner } from './runner.ts';

package/dist/launchd/sudo-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sudo-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,KAAK,kBAAkB,EAA0B,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EAAc,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAIL,gBAAgB,EAMjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG;IACnD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,uFAAuF;IACvF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,QAAQ,GAAG;IACrB,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,CAAC;AA2BF,eAAO,MAAM,cAAc,eAAgB,SAAS,MAAM,EAAE,QAAQ,QAAQ,KAAG,UA2H9E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,YAAa,iBAAiB,KAAG,UAYvD,CAAC"}
+{"version":3,"file":"sudo-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,KAAK,kBAAkB,EAAe,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAc,UAAU,EAAgB,MAAM,aAAa,CAAC;AACxE,OAAO,EAIL,gBAAgB,EAMjB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG;IACnD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,uFAAuF;IACvF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,QAAQ,GAAG;IACrB,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,CAAC;AAEF,eAAO,MAAM,cAAc,eAAgB,SAAS,MAAM,EAAE,QAAQ,QAAQ,KAAG,UAgI9E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,YAAa,iBAAiB,KAAG,UAYvD,CAAC"}

package/dist/launchd/sudo-said.d.ts

@@ -0,0 +1,10 @@
+import type { ExecResult } from './runner.ts';
+import { SudoRefusedError } from './sudo-allowlist.ts';
+/** ★ An EACCES outside every prefix is almost always a directory the stack forgot to declare. */
+export declare const undeclared: (path: string, prefixes: readonly string[]) => (cause: unknown) => never;
+/**
+ * The refusal sudo itself answered for `shown` (the argv as JSON), or `undefined` when the command
+ * ran — whatever its own exit code. ★ `SudoRefusedError` always means nothing ran as root.
+ */
+export declare const sudoRefusal: (shown: string, result: ExecResult) => SudoRefusedError | undefined;
+//# sourceMappingURL=sudo-said.d.ts.map

package/dist/launchd/sudo-said.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-said.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-said.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAcvD,iGAAiG;AACjG,eAAO,MAAM,UAAU,SACd,MAAM,YAAY,SAAS,MAAM,EAAE,aAClC,OAAO,KAAG,KAQjB,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,UAAW,MAAM,UAAU,UAAU,KAAG,gBAAgB,GAAG,SAelF,CAAC"}

package/dist/openbao/auth-method-reconcile.d.ts

@@ -6,10 +6,14 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim } from '../ownership/adopt.ts';
 import { type BaoAuthMethodAttributes, type BaoAuthMethodProps } from './auth-method-form.ts';
 import type { BaoError } from './bao-status.ts';
 import type { RemountError, RemountOptions } from './remount-wire.ts';
 export declare const readMethod: (props: BaoAuthMethodProps) => Effect.Effect<BaoAuthMethodAttributes | undefined, BaoError, HttpClient.HttpClient>;
-/** Converge one auth method. `stated` is the path in Alchemy's state, if any. */
-export declare const reconcileAuthMethod: (news: BaoAuthMethodProps, stated: string | undefined, options?: RemountOptions) => Effect.Effect<BaoAuthMethodAttributes, BaoError | RemountError, HttpClient.HttpClient>;
+/**
+ * Converge one auth method. `stated` is the path in Alchemy's state, if any.
+ * ⛔ `claim`: the same first-reconcile takeover refusal as reconcileMount's (auth-method.ts passes it).
+ */
+export declare const reconcileAuthMethod: (news: BaoAuthMethodProps, stated: string | undefined, options?: RemountOptions, claim?: Claim) => Effect.Effect<BaoAuthMethodAttributes, BaoError | RemountError, HttpClient.HttpClient>;
 //# sourceMappingURL=auth-method-reconcile.d.ts.map

package/dist/openbao/auth-method-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-method-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,UAAU,UACd,kBAAkB,KACxB,MAAM,CAAC,MAAM,CAAC,uBAAuB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAKjF,CAAC;AAUL,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,SACxB,kBAAkB,UAChB,MAAM,GAAG,SAAS,YAChB,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CA8BpF,CAAC"}
+{"version":3,"file":"auth-method-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,UAAU,UACd,kBAAkB,KACxB,MAAM,CAAC,MAAM,CAAC,uBAAuB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAKjF,CAAC;AAUL;;;GAGG;AACH,eAAO,MAAM,mBAAmB,SACxB,kBAAkB,UAChB,MAAM,GAAG,SAAS,YAChB,cAAc,UAChB,KAAK,KACZ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CAqCpF,CAAC"}

package/dist/openbao/auth-method.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-method.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,uBAAuB,CAAC;AAK/B,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,CAAC;AAE5D,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,aAAa,gDAExB,CAAC;AAEH,eAAO,MAAM,qBAAqB,oGAqD/B,CAAC"}
+{"version":3,"file":"auth-method.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,uBAAuB,CAAC;AAK/B,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,CAAC;AAE5D,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,aAAa,gDAExB,CAAC;AAEH,eAAO,MAAM,qBAAqB,oGA2D/B,CAAC"}

package/dist/openbao/auth-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAKtB,MAAM,qBAAqB,CAAC;AAI7B,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAiBH,eAAO,MAAM,mBAAmB,kGA6E7B,CAAC"}
+{"version":3,"file":"auth-role.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAKtB,MAAM,qBAAqB,CAAC;AAI7B,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAiBH,eAAO,MAAM,mBAAmB,kGAoF7B,CAAC"}

package/dist/openbao/cloudflare-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-role.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,0BAA0B,EAAiB,MAAM,mCAAmC,CAAC;AAE9F,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAQnC,YAAY,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAKH,eAAO,MAAM,yBAAyB,qIAyInC,CAAC"}
+{"version":3,"file":"cloudflare-role.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE,OAAO,EAAE,0BAA0B,EAAiB,MAAM,mCAAmC,CAAC;AAE9F,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAQnC,YAAY,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAKH,eAAO,MAAM,yBAAyB,qIAmJnC,CAAC"}

package/dist/openbao/fake-bao.d.ts

@@ -36,5 +36,23 @@ export declare const withFake: (answer: Answer, body: (bao: Fake) => Promise<voi
 export declare const run: <A, E>(env: BaoEnvironment, effect: Effect.Effect<A, E, HttpClient.HttpClient>) => Promise<A>;
 /** The effect's failure — rejects if it succeeded. */
 export declare const runFailure: <A, E>(env: BaoEnvironment, effect: Effect.Effect<A, E, HttpClient.HttpClient>) => Promise<E>;
+/**
+ * An injected crash between a write and its commit. Once armed, `crashNext()` fails the first read
+ * that follows a write with a 500 — a reconcile whose write landed and whose read-back, and so the
+ * engine's commit, never did — and `crashNext('write')` lands the next write and then answers it
+ * 500, for a reconcile that reads nothing back (Bao.Policy). Either leaves the `creating` /
+ * `replacing` row a killed deploy leaves.
+ */
+export declare const crashAfterWrite: () => {
+    crashNext: (at?: 'read-back' | 'write') => void;
+    wrap: (answer: (seen: Seen) => Reply) => (seen: Seen) => Reply;
+};
+/**
+ * A deploy killed BEFORE a resource's reconcile ran: the first write to a path ending in `suffix` is
+ * refused (500) without landing. Aimed at an upstream, it fails every create waiting on it after
+ * Apply has committed their `creating` rows — rows whose create never asked whose object sat at
+ * its identity (ownership/whole.ts).
+ */
+export declare const refuseWriteOnce: (suffix: string) => (answer: (seen: Seen) => Reply) => (seen: Seen) => Reply;
 export {};
 //# sourceMappingURL=fake-bao.d.ts.map

package/dist/openbao/fake-bao.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-bao.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-bao.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,qCAAqC;AACrC,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,KAAK,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAAC,IAAI,IAAI,IAAI,CAAA;CAAE,CAAC;AAErF,6FAA6F;AAC7F,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAErD,eAAO,MAAM,OAAO,WAAY,MAAM,SAAS,MAAM,KAAG,IAwBvD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,QAAQ,WACX,MAAM,QACR,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,SAC3B,MAAM,kBAQd,CAAC;AAKF,gFAAgF;AAChF,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,OACjB,cAAc,UACX,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,eACP,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,OACxB,cAAc,UACX,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,eACM,CAAC"}
+{"version":3,"file":"fake-bao.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-bao.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,qCAAqC;AACrC,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,KAAK,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAAC,IAAI,IAAI,IAAI,CAAA;CAAE,CAAC;AAErF,6FAA6F;AAC7F,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAErD,eAAO,MAAM,OAAO,WAAY,MAAM,SAAS,MAAM,KAAG,IAwBvD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,QAAQ,WACX,MAAM,QACR,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,SAC3B,MAAM,kBAQd,CAAC;AAKF,gFAAgF;AAChF,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,OACjB,cAAc,UACX,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,eACP,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,OACxB,cAAc,UACX,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,eACM,CAAC;AAE3D;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;IAKxB,SAAS,QAAO,WAAW,GAAG,OAAO;IAIrC,IAAI,WACO,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,YACvB,IAAI,KAAG,KAAK;CAcxB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAAY,MAAM,cAE5B,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,YAC5B,IAAI,KAAG,KAOjB,CAAC"}

package/dist/openbao/fake-core.d.ts

@@ -0,0 +1,39 @@
+import * as Layer from 'effect/Layer';
+import type * as Output from 'alchemy/Output';
+import { BaoAuthMethod } from './auth-method.ts';
+import { BaoCloudflareRole } from './cloudflare-role.ts';
+import type { Reply, Seen } from './fake-bao.ts';
+import { type FakeStack, type StackBody } from './fake-stack.ts';
+import { BaoMount } from './mount.ts';
+import { BaoPolicy } from './policy.ts';
+import { BaoProxmoxRole } from './proxmox-role.ts';
+export declare const coreProviders: Layer.Layer<import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Provider<BaoAuthMethod> | import("alchemy").Provider<import("./auth-role.ts").BaoAuthRole> | import("alchemy").Provider<BaoCloudflareRole> | import("alchemy").Provider<BaoMount> | import("alchemy").Provider<BaoPolicy> | import("alchemy").Provider<BaoProxmoxRole>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** Every store behind one answer, routed by path. */
+export declare const coreEstate: () => ((seen: Seen) => Reply) & {
+    auth: {
+        answer: (seen: Seen) => Reply;
+        readonly table: Map<string, string>;
+    };
+    cloudflare: import("./fake-engines.ts").Store;
+    mounts: {
+        answer: (seen: Seen) => Reply;
+        readonly table: Map<string, string>;
+    };
+    policies: import("./fake-engines.ts").Store;
+    proxmox: import("./fake-engines.ts").Store;
+    roles: import("./fake-engines.ts").Store;
+};
+export type CoreEstate = ReturnType<typeof coreEstate>;
+type Text = string | Output.Output<string>;
+export interface CoreRow {
+    readonly family: string;
+    /** One resource, logical id `id`, at the row's fixed identity. */
+    readonly declare: (id: string, knob: Text) => StackBody;
+    /** Whether the fake holds the object. */
+    readonly has: (estate: CoreEstate) => boolean;
+}
+export declare const CORE: readonly CoreRow[];
+/** One stack over a fresh core estate, plus `owner`: a second stack over the same fake. */
+export declare const withCore: (body: (stack: FakeStack, estate: CoreEstate, seen: Seen[], owner: FakeStack) => Promise<void>, answer?: (estate: CoreEstate) => (seen: Seen) => Reply) => Promise<void>;
+export {};
+//# sourceMappingURL=fake-core.d.ts.map

package/dist/openbao/fake-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-core.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-core.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAyB,MAAM,kBAAkB,CAAC;AAIxE,OAAO,EAAE,iBAAiB,EAA6B,MAAM,sBAAsB,CAAC;AACpF,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAA4B,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAoB,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,cAAc,EAA0B,MAAM,mBAAmB,CAAC;AAQ3E,eAAO,MAAM,aAAa,2ZASzB,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,UAAU,gBASC,IAAI,KAAG,KAAK;;;;;;;;;;;;;CAYnC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAEvD,KAAK,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAE3C,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC;IACxD,yCAAyC;IACzC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC;CAC/C;AAED,eAAO,MAAM,IAAI,EAAE,SAAS,OAAO,EAiDlC,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,QAAQ,SACb,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,WACrF,CAAC,MAAM,EAAE,UAAU,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,KACpD,OAAO,CAAC,IAAI,CAKd,CAAC"}

package/dist/openbao/fake-families.d.ts

@@ -12,7 +12,7 @@ import type * as Output from 'alchemy/Output';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
 import { BaoAuthRole } from './auth-role.ts';
-import type { Seen } from './fake-bao.ts';
+import type { Reply, Seen } from './fake-bao.ts';
 import { type Estate } from './fake-engines-roles.ts';
 import { type FakeStack, type StackBody } from './fake-stack.ts';
 import { BaoJwtAuthConfig } from './jwt-config.ts';
@@ -24,8 +24,11 @@ import { BaoPkiRole } from './pki-role.ts';
 import { BaoPlugin } from './plugin.ts';
 import { BaoSshRole } from './ssh-role.ts';
 export declare const familyProviders: Layer.Layer<import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Provider<BaoAuthRole> | import("alchemy").Provider<BaoJwtAuthConfig> | import("alchemy").Provider<BaoJwtRole> | import("alchemy").Provider<BaoKubernetesRole> | import("alchemy").Provider<BaoMfaLoginEnforcement> | import("alchemy").Provider<BaoMfaTotpMethod> | import("alchemy").Provider<BaoPkiRole> | import("alchemy").Provider<BaoPlugin> | import("alchemy").Provider<BaoSshRole>, never, import("effect/unstable/http/HttpClient").HttpClient>;
-/** One stack over a fresh estate: every family's provider, and every call the fake saw. */
-export declare const withEstate: (body: (stack: FakeStack, estate: Estate, seen: Seen[]) => Promise<void>) => Promise<void>;
+/**
+ * One stack over a fresh estate: every family's provider, and every call the fake saw — plus
+ * `owner`, a SECOND stack over the same fake with its own state: another owner of the same names.
+ */
+export declare const withEstate: (body: (stack: FakeStack, estate: Estate, seen: Seen[], owner: FakeStack) => Promise<void>, answer?: (estate: Estate) => (seen: Seen) => Reply) => Promise<void>;
 /** The row for one family, by name. */
 export declare const rowOf: (family: string) => Family;
 type Text = string | Output.Output<string>;

package/dist/openbao/fake-families.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-families.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-families.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,aAAa,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAuB,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAiB,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAA4B,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAsB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAA6B,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAkC,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAA4B,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAsB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAqB,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAsB,MAAM,eAAe,CAAC;AAE/D,eAAO,MAAM,eAAe,ghBAW3B,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,UAAU,SACf,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,KACtE,OAAO,CAAC,IAAI,CAGd,CAAC;AAEF,uCAAuC;AACvC,eAAO,MAAM,KAAK,WAAY,MAAM,KAAG,MAItC,CAAC;AAEF,KAAK,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC3C,KAAK,OAAO,GAAG,OAAO,aAAa,CAAC,OAAO,CAAC;AAE5C,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,SAAS,CAAC;IACvF,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACzD;AAQD,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EA6FrC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,MAAM,QACX,MAAM,SACR,MAAM,KAAK,MAAM,KAAG,SAIpB,CAAC;AAEP,kFAAkF;AAClF,eAAO,MAAM,QAAQ,QAAS,MAAM,4FACsC,CAAC"}
+{"version":3,"file":"fake-families.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-families.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,aAAa,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAuB,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAA4B,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAA4B,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAsB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAA6B,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAkC,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAA4B,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAsB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAqB,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAsB,MAAM,eAAe,CAAC;AAE/D,eAAO,MAAM,eAAe,ghBAW3B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,SACf,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,WACjF,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,KAChD,OAAO,CAAC,IAAI,CAKd,CAAC;AAEF,uCAAuC;AACvC,eAAO,MAAM,KAAK,WAAY,MAAM,KAAG,MAItC,CAAC;AAEF,KAAK,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC3C,KAAK,OAAO,GAAG,OAAO,aAAa,CAAC,OAAO,CAAC;AAE5C,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,SAAS,CAAC;IACvF,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACzD;AAQD,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EA6FrC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,MAAM,QACX,MAAM,SACR,MAAM,KAAK,MAAM,KAAG,SAIpB,CAAC;AAEP,kFAAkF;AAClF,eAAO,MAAM,QAAQ,QAAS,MAAM,4FACsC,CAAC"}

package/dist/openbao/fake-mounts.d.ts

@@ -0,0 +1,16 @@
+/**
+ * A fake mount table for fake-bao — `sys/mounts` (secrets engines) or `sys/auth` (auth methods):
+ * enable, tune, read, the listing a 400 is settled against (mount-wire.ts), and `sys/remount`.
+ * Split out of mount-move.test.ts so the engine-level ownership tests drive Bao.Mount and
+ * Bao.AuthMethod through the same table.
+ *
+ * ⛔ TEST-ONLY — see fake-bao.ts. No provider imports this file.
+ */
+import type { Reply, Seen } from './fake-bao.ts';
+/** The table keyed `<path>/` as the server keys it; `initial` maps a bare path to its type. */
+export declare const liveTable: (prefix: string, initial: Record<string, string>) => {
+    answer: (seen: Seen) => Reply;
+    /** The live table as `<path>/` → type, the shape the move tests compare. */
+    readonly table: Map<string, string>;
+};
+//# sourceMappingURL=fake-mounts.d.ts.map

package/dist/openbao/fake-mounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-mounts.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-mounts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOjD,+FAA+F;AAC/F,eAAO,MAAM,SAAS,WAAY,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;mBAQjD,IAAI,KAAG,KAAK;IA4ChC,4EAA4E;;CAK/E,CAAC"}

package/dist/openbao/fake-stack.d.ts

@@ -6,9 +6,13 @@ import { type Fake, type Reply, type Seen } from './fake-bao.ts';
 export type Planned = Readonly<Record<string, string>>;
 /** A stack body: resource declarations, as an `alchemy.run.ts` would write them. */
 export type StackBody = Effect.Effect<unknown, unknown, unknown>;
+/** What the CLI would set for one deploy: `adopt` is `--adopt` (the AdoptPolicy service). */
+export type DeployOptions = {
+    readonly adopt?: boolean;
+};
 export interface FakeStack {
     /** Plan, then apply, `body`. Resolves to the plan; rejects with the apply's failure. */
-    readonly deploy: (body: StackBody) => Promise<Planned>;
+    readonly deploy: (body: StackBody, options?: DeployOptions) => Promise<Planned>;
 }
 /**
  * One stack over one state store, shared by every `deploy`, so the second deploy plans against what

package/dist/openbao/fake-stack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-stack.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-stack.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,KAAK,IAAI,EAAE,KAAK,KAAK,EAAE,KAAK,IAAI,EAAW,MAAM,eAAe,CAAC;AAE1E,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvD,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEjE,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAiBD;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,aACzB,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAC/B,cAAc,oBAElB,SA4BF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAU,IAAI,EAAE,CAAC,EAAE,GAAG,aACnC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAC5B,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,QACvB,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,KACnD,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,QAAQ,SAAU,SAAS,IAAI,EAAE,KAAG,MAAM,EACoC,CAAC"}
+{"version":3,"file":"fake-stack.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-stack.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,KAAK,IAAI,EAAE,KAAK,KAAK,EAAE,KAAK,IAAI,EAAW,MAAM,eAAe,CAAC;AAE1E,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvD,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEjE,6FAA6F;AAC7F,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjF;AAiBD;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,aACzB,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAC/B,cAAc,oBAElB,SAoCF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAU,IAAI,EAAE,CAAC,EAAE,GAAG,aACnC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAC5B,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,QACvB,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,KACnD,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,QAAQ,SAAU,SAAS,IAAI,EAAE,KAAG,MAAM,EACoC,CAAC"}