@homeflare/alchemy 0.8.0 → 0.10.1

package/dist/openbao/jwt-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-config.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAO3B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE9F,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAYH,eAAO,MAAM,aAAa,UACjB,qBAAqB,KAC3B,QAAQ,CAAC,0BAA0B,CAQpC,CAAC;AAEH,eAAO,MAAM,wBAAwB,uGAgClC,CAAC"}
+{"version":3,"file":"jwt-config.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAO3B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,KAAK,QAAQ,EAA0C,MAAM,qBAAqB,CAAC;AAE5F,YAAY,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE9F,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAYH,eAAO,MAAM,aAAa,UACjB,qBAAqB,KAC3B,QAAQ,CAAC,0BAA0B,CAQpC,CAAC;AAEH,eAAO,MAAM,wBAAwB,uGAiClC,CAAC"}

package/dist/openbao/jwt-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-role.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAMrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAcH,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,QAAQ,CAAC,oBAAoB,CAOhF,CAAC;AAEH,eAAO,MAAM,kBAAkB,iGAuC5B,CAAC"}
+{"version":3,"file":"jwt-role.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAMrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,KAAK,QAAQ,EAA0C,MAAM,qBAAqB,CAAC;AAE5F,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAcH,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,QAAQ,CAAC,oBAAoB,CAOhF,CAAC;AAEH,eAAO,MAAM,kBAAkB,iGAwC5B,CAAC"}

package/dist/openbao/kubernetes-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubernetes-role.d.ts","sourceRoot":"","sources":["../../src/openbao/kubernetes-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAUH,eAAO,MAAM,kBAAkB,UACtB,sBAAsB,KAC5B,QAAQ,CAAC,2BAA2B,CAOrC,CAAC;AAEH,eAAO,MAAM,yBAAyB,wGAoCnC,CAAC"}
+{"version":3,"file":"kubernetes-role.d.ts","sourceRoot":"","sources":["../../src/openbao/kubernetes-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,KAAK,QAAQ,EAA0C,MAAM,qBAAqB,CAAC;AAE5F,YAAY,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAUH,eAAO,MAAM,kBAAkB,UACtB,sBAAsB,KAC5B,QAAQ,CAAC,2BAA2B,CAOrC,CAAC;AAEH,eAAO,MAAM,yBAAyB,wGAwCnC,CAAC"}

package/dist/openbao/mfa-enforcement.d.ts

@@ -30,6 +30,7 @@ import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import { type BaoMfaLoginEnforcementAttributes, type BaoMfaLoginEnforcementProps } from './mfa-enforcement-form.ts';
 export type { BaoMfaLoginEnforcementAttributes, BaoMfaLoginEnforcementProps, } from './mfa-enforcement-form.ts';
@@ -38,7 +39,10 @@ export interface BaoMfaLoginEnforcement extends Resource<'Bao.MfaLoginEnforcemen
 export declare const BaoMfaLoginEnforcement: import("alchemy").ResourceClass<BaoMfaLoginEnforcement>;
 type Env = HttpClient.HttpClient;
 export declare const planEnforcement: (props: BaoMfaLoginEnforcementProps) => Effect.Effect<'noop' | 'update', BaoError, Env>;
-/** Write when live differs, then prove it by reading back. */
-export declare const reconcileEnforcement: (props: BaoMfaLoginEnforcementProps) => Effect.Effect<BaoMfaLoginEnforcementAttributes, BaoError, Env>;
+/**
+ * Write when live differs, then prove it by reading back.
+ * ⛔ `claim` (the provider passes it): a create never takes over an enforcement it finds by name.
+ */
+export declare const reconcileEnforcement: (props: BaoMfaLoginEnforcementProps, claim?: Claim) => Effect.Effect<BaoMfaLoginEnforcementAttributes, BaoError, Env>;
 export declare const BaoMfaLoginEnforcementProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoMfaLoginEnforcement>, never, HttpClient.HttpClient>;
 //# sourceMappingURL=mfa-enforcement.d.ts.map

package/dist/openbao/mfa-enforcement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-enforcement.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAMjC,MAAM,2BAA2B,CAAC;AAInC,YAAY,EACV,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,sBAAuB,SAAQ,QAAQ,CACtD,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,sBAAsB,yDAEjC,CAAC;AAEH,KAAK,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC;AAyBjC,eAAO,MAAM,eAAe,UACnB,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAM7C,CAAC;AAEL,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,UACxB,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,gCAAgC,EAAE,QAAQ,EAAE,GAAG,CAe5D,CAAC;AAEL,eAAO,MAAM,8BAA8B,6GAuCxC,CAAC"}
+{"version":3,"file":"mfa-enforcement.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,KAAK,EAAY,MAAM,uBAAuB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAMjC,MAAM,2BAA2B,CAAC;AAInC,YAAY,EACV,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,sBAAuB,SAAQ,QAAQ,CACtD,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,sBAAsB,yDAEjC,CAAC;AAEH,KAAK,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC;AAyBjC,eAAO,MAAM,eAAe,UACnB,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAM7C,CAAC;AAEL;;;GAGG;AACH,eAAO,MAAM,oBAAoB,UACxB,2BAA2B,UAC1B,KAAK,KACZ,MAAM,CAAC,MAAM,CAAC,gCAAgC,EAAE,QAAQ,EAAE,GAAG,CAkB5D,CAAC;AAEL,eAAO,MAAM,8BAA8B,6GA2CxC,CAAC"}

package/dist/openbao/mfa-totp.d.ts

@@ -19,6 +19,7 @@ import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import { type BaoMfaTotpMethodAttributes, type BaoMfaTotpMethodProps } from './mfa-totp-form.ts';
 export type { BaoMfaTotpMethodAttributes, BaoMfaTotpMethodProps, BaoTotpAlgorithm, } from './mfa-totp-form.ts';
@@ -27,7 +28,10 @@ export interface BaoMfaTotpMethod extends Resource<'Bao.MfaTotpMethod', BaoMfaTo
 export declare const BaoMfaTotpMethod: import("alchemy").ResourceClass<BaoMfaTotpMethod>;
 export declare const readTotp: (props: BaoMfaTotpMethodProps) => Effect.Effect<BaoMfaTotpMethodAttributes | undefined, BaoError, HttpClient.HttpClient>;
 export declare const planTotp: (props: BaoMfaTotpMethodProps) => Effect.Effect<'noop' | 'update', BaoError, HttpClient.HttpClient>;
-/** Upsert by name when live differs, then prove it by reading back. */
-export declare const reconcileTotp: (props: BaoMfaTotpMethodProps) => Effect.Effect<BaoMfaTotpMethodAttributes, BaoError, HttpClient.HttpClient>;
+/**
+ * Upsert by name when live differs, then prove it by reading back.
+ * ⛔ `claim` (the provider passes it): a create never takes over a method it finds by that name.
+ */
+export declare const reconcileTotp: (props: BaoMfaTotpMethodProps, claim?: Claim) => Effect.Effect<BaoMfaTotpMethodAttributes, BaoError, HttpClient.HttpClient>;
 export declare const BaoMfaTotpMethodProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoMfaTotpMethod>, never, HttpClient.HttpClient>;
 //# sourceMappingURL=mfa-totp.d.ts.map

package/dist/openbao/mfa-totp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-totp.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAM3B,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAKH,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGrF,CAAC;AAEJ,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK/D,CAAC;AAEL,uEAAuE;AACvE,eAAO,MAAM,aAAa,UACjB,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAWxE,CAAC;AAEL,eAAO,MAAM,wBAAwB,uGA0ClC,CAAC"}
+{"version":3,"file":"mfa-totp.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,KAAK,EAAY,MAAM,uBAAuB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAM3B,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAKH,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGrF,CAAC;AAEJ,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK/D,CAAC;AAEL;;;GAGG;AACH,eAAO,MAAM,aAAa,UACjB,qBAAqB,UACpB,KAAK,KACZ,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAYxE,CAAC;AAEL,eAAO,MAAM,wBAAwB,uGAiDlC,CAAC"}

package/dist/openbao/mount-reconcile.d.ts

@@ -4,6 +4,7 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import { type BaoMountAttributes, type BaoMountProps } from './mount-form.ts';
 import type { RemountError, RemountOptions } from './remount-wire.ts';
@@ -11,6 +12,9 @@ export declare const readMount: (props: BaoMountProps) => Effect.Effect<BaoMount
 /**
  * Converge one mount. `stated` is the path in Alchemy's state (undefined on a first reconcile).
  * Dies on a refusal; fails with OpenBao's own error on a refused call.
+ * ⛔ `claim` (mount.ts always passes it) refuses, before any write, a first reconcile that would take
+ *   over a live mount: the one at the path, or the `remountFrom` source it would move
+ *   (ownership/adopt.ts).
  */
-export declare const reconcileMount: (news: BaoMountProps, stated: string | undefined, options?: RemountOptions) => Effect.Effect<BaoMountAttributes, BaoError | RemountError, HttpClient.HttpClient>;
+export declare const reconcileMount: (news: BaoMountProps, stated: string | undefined, options?: RemountOptions, claim?: Claim) => Effect.Effect<BaoMountAttributes, BaoError | RemountError, HttpClient.HttpClient>;
 //# sourceMappingURL=mount-reconcile.d.ts.map

package/dist/openbao/mount-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-reconcile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAKnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,SAAS,UACb,aAAa,KACnB,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK5E,CAAC;AAUL;;;GAGG;AACH,eAAO,MAAM,cAAc,SACnB,aAAa,UACX,MAAM,GAAG,SAAS,YAChB,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CA8B/E,CAAC"}
+{"version":3,"file":"mount-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-reconcile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAKnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,SAAS,UACb,aAAa,KACnB,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK5E,CAAC;AAUL;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,SACnB,aAAa,UACX,MAAM,GAAG,SAAS,YAChB,cAAc,UAChB,KAAK,KACZ,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CAoC/E,CAAC"}

package/dist/openbao/mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../src/openbao/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,aAAa,EAAW,MAAM,iBAAiB,CAAC;AAKvF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAElD,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,QAAQ,2CAEnB,CAAC;AAEH,eAAO,MAAM,gBAAgB,+FAuE1B,CAAC"}
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../src/openbao/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,aAAa,EAAW,MAAM,iBAAiB,CAAC;AAKvF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAElD,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,QAAQ,2CAEnB,CAAC;AAEH,eAAO,MAAM,gBAAgB,+FA6E1B,CAAC"}

package/dist/openbao/pki-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pki-role.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAMrB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAgBH,eAAO,MAAM,kBAAkB,iGAiH5B,CAAC"}
+{"version":3,"file":"pki-role.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAMrB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAgBH,eAAO,MAAM,kBAAkB,iGAyH5B,CAAC"}

package/dist/openbao/plugin-reconcile.d.ts

@@ -4,6 +4,7 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import { type BaoPluginAttributes, type BaoPluginForm, type BaoPluginProps } from './plugin-form.ts';
 type Entry = {
@@ -12,7 +13,10 @@ type Entry = {
 };
 /** Live entry, plus the raw body — reconcile needs the raw half for `oci` and `declarative`. */
 export declare const readEntry: (form: BaoPluginForm) => Effect.Effect<Entry | undefined, BaoError, HttpClient.HttpClient>;
-/** Register when the live entry differs, then prove it by reading back. Dies on a refusal. */
-export declare const reconcilePlugin: (props: BaoPluginProps) => Effect.Effect<BaoPluginAttributes, BaoError, HttpClient.HttpClient>;
+/**
+ * Register when the live entry differs, then prove it by reading back. Dies on a refusal.
+ * ⛔ `claim` (the provider passes it): a create never takes over an entry already registered.
+ */
+export declare const reconcilePlugin: (props: BaoPluginProps, claim?: Claim) => Effect.Effect<BaoPluginAttributes, BaoError, HttpClient.HttpClient>;
 export {};
 //# sourceMappingURL=plugin-reconcile.d.ts.map

package/dist/openbao/plugin-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin-reconcile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,cAAc,EAMpB,MAAM,kBAAkB,CAAC;AAG1B,KAAK,KAAK,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAElG,gGAAgG;AAChG,eAAO,MAAM,SAAS,SACd,aAAa,KAClB,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGhE,CAAC;AAuBJ,8FAA8F;AAC9F,eAAO,MAAM,eAAe,UACnB,cAAc,KACpB,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAsCjE,CAAC"}
+{"version":3,"file":"plugin-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin-reconcile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,cAAc,EAMpB,MAAM,kBAAkB,CAAC;AAG1B,KAAK,KAAK,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAElG,gGAAgG;AAChG,eAAO,MAAM,SAAS,SACd,aAAa,KAClB,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGhE,CAAC;AA0BJ;;;GAGG;AACH,eAAO,MAAM,eAAe,UACnB,cAAc,UACb,KAAK,KACZ,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAyCjE,CAAC"}

package/dist/openbao/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAKpB,MAAM,kBAAkB,CAAC;AAM1B,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3F,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAoBH,eAAO,MAAM,iBAAiB,gGAsD3B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAMpB,MAAM,kBAAkB,CAAC;AAM1B,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3F,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAoBH,eAAO,MAAM,iBAAiB,gGA6D3B,CAAC"}

package/dist/openbao/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAOnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAeH,eAAO,MAAM,iBAAiB,oIAuH3B,CAAC"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAUnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAeH,eAAO,MAAM,iBAAiB,oIAiI3B,CAAC"}

package/dist/openbao/proxmox-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxmox-role.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,wBAAwB,CAAC;AAKhC,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAE9D,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAKH,eAAO,MAAM,sBAAsB,qGA6JhC,CAAC"}
+{"version":3,"file":"proxmox-role.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,wBAAwB,CAAC;AAKhC,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAE9D,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAKH,eAAO,MAAM,sBAAsB,qGAmKhC,CAAC"}

package/dist/openbao/role-reconcile.d.ts

@@ -15,6 +15,7 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim, Owner } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 export interface RoleSpec<A> {
     /** `Bao.JwtRole` etc., for messages. */
@@ -33,8 +34,17 @@ type Found<A> = {
     readonly live: Record<string, unknown>;
 };
 export declare const readRoleAt: <A>(spec: RoleSpec<A>) => Effect.Effect<Found<A> | undefined, BaoError, HttpClient.HttpClient>;
+/**
+ * `read`: the live attributes — `Unowned` with no state unless our own interrupted create wrote
+ * them, which is `planRole`'s `noop` against that create's props (ownership/probe.ts).
+ */
+export declare const readOwnedRole: <A extends object>(ask: Owner, spec: RoleSpec<A>) => Effect.Effect<A | undefined, BaoError, HttpClient.HttpClient>;
 /** `update` or `noop` — the part of a diff after the identity checks. */
 export declare const planRole: <A>(spec: RoleSpec<A>) => Effect.Effect<'noop' | 'update', BaoError, HttpClient.HttpClient>;
-export declare const reconcileRole: <A>(spec: RoleSpec<A>) => Effect.Effect<A, BaoError, HttpClient.HttpClient>;
+/**
+ * ⛔ `claim` — every provider passes it — refuses, before any write, a create that finds a live
+ *   object this stack holds no state for (ownership/adopt.ts).
+ */
+export declare const reconcileRole: <A>(spec: RoleSpec<A>, claim?: Claim) => Effect.Effect<A, BaoError, HttpClient.HttpClient>;
 export {};
 //# sourceMappingURL=role-reconcile.d.ts.map

package/dist/openbao/role-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/role-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,SAAS,MAAM,EAAE,CAAC;CAC5E;AAED,KAAK,KAAK,CAAC,CAAC,IAAI;IAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEnF,eAAO,MAAM,UAAU,GAAI,CAAC,QACpB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGnE,CAAC;AAEJ,yEAAyE;AACzE,eAAO,MAAM,QAAQ,GAAI,CAAC,QAClB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK/D,CAAC;AAKL,eAAO,MAAM,aAAa,GAAI,CAAC,QACvB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CA0B/C,CAAC"}
+{"version":3,"file":"role-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/role-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,SAAS,MAAM,EAAE,CAAC;CAC5E;AAED,KAAK,KAAK,CAAC,CAAC,IAAI;IAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEnF,eAAO,MAAM,UAAU,GAAI,CAAC,QACpB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGnE,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,SAAS,MAAM,OACvC,KAAK,QACJ,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAM3D,CAAC;AAEL,yEAAyE;AACzE,eAAO,MAAM,QAAQ,GAAI,CAAC,QAClB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK/D,CAAC;AAKL;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,QACvB,QAAQ,CAAC,CAAC,CAAC,UACT,KAAK,KACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CA2B/C,CAAC"}

package/dist/openbao/ssh-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-role.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,eAAe,EAOrB,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAeH,eAAO,MAAM,kBAAkB,iGAwH5B,CAAC"}
+{"version":3,"file":"ssh-role.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,eAAe,EAOrB,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAeH,eAAO,MAAM,kBAAkB,iGA+H5B,CAAC"}

package/dist/ownership/adopt.d.ts

@@ -0,0 +1,52 @@
+import * as Effect from 'effect/Effect';
+/**
+ * Whether the resource at `fqn` may be adopted, resolved exactly as the planner resolves it (alchemy
+ * beta.79 Plan.ts: `resource.Adopt ?? shouldAdopt`): a resource-scoped `adopt(…)`, else the
+ * `AdoptPolicy` service, else `AlchemyContext.adopt`, else off.
+ * ★ FOR A CREATE THE ENGINE NEVER PROBED. Alchemy skips the adoption probe while `news` holds an
+ *   Output, so an ownership check that must still honour `--adopt` can only run at apply. All three
+ *   reach the apply: Alchemist runs plan AND apply under the session context, which provides the
+ *   services from the CLI flag and the Stack the resources registered on (Alchemist/Session.ts,
+ *   routes/stack.ts; Apply.ts reads the same Stack).
+ * ⛔ THE RESOURCE-SCOPED SETTING WINS, BOTH WAYS. The engine captures `adopt(…)` on the resource at
+ *   registration (Resource.ts `Adopt`, into `Stack.resources[fqn]`) and never hands it to a
+ *   provider. Reading only the deploy-wide flag let `--adopt` take over a resource declared
+ *   `.pipe(adopt(false))` — which the planner refuses — and refused one declared `adopt(true)`.
+ * ⚠️ `resources` carries an `@internal` comment in Alchemy's source, but it is in the published types
+ *   and the planner reads `Adopt` from it. caddy/adopt-scope.test.ts registers through the real
+ *   `Resource`, so an upgrade that stops recording it there fails the suite.
+ */
+export declare const adoptEnabled: (fqn: string) => Effect.Effect<boolean>;
+/** The three fields of a `reconcile` (or `read`) call that say whose object this is. */
+export type Owner = {
+    readonly fqn: string;
+    readonly instanceId: string;
+    /** The attributes state holds; `undefined` on a create. */
+    readonly output: unknown;
+};
+/** Whether a stateless `reconcile` may take over a live object: adoption on, for an adoptable one. */
+export declare const adoptsAtApply: (owner: Owner) => Effect.Effect<boolean>;
+/** A lifecycle helper's hook for refuseTakeover, bound to one call's Owner: `(what) => …`. */
+export type Claim = (what: string) => Effect.Effect<void>;
+/**
+ * `reconcile`'s check, called with the live object it found BEFORE any write: dies unless that
+ * object may be written. It may when state already vouches for it (`output`), when this apply
+ * resumes the resource's own interrupted create or replace and its diff proved the object that
+ * generation's (resume.ts), or when adoption is on for a create or an unfinished generation
+ * (adoptable).
+ * ⛔ WHY IT EXISTS AT ALL: THE PROBE DOES NOT GUARD EVERY CREATE. Alchemy skips it while `news` holds
+ *   an Output (Plan.ts), a new generation of a replace is never probed, and an object can appear
+ *   between plan and apply. Each of those used to be a silent takeover: written over, then recorded
+ *   as ours, and deleted with the stack under `destroy`.
+ * ⚠️ A CHECK, THEN A WRITE — NOT A LOCK. Two creates of one name in the same deploy run
+ *   concurrently, both read nothing, and both write (measured with the fakes, 2026-09-21). Nothing
+ *   between a read and a write can close that; declare each name once.
+ * ⚠️ AN IDENTICAL OBJECT IS STILL A TAKEOVER (decided 2026-09-21). Nothing would be written, but the
+ *   state row would claim it, and a later delete would remove what another owner still relies on.
+ * ⛔ A REFUSED CREATE FORGETS ITS `creating` ROW (rows.ts forgetRefusedCreate), or the next plan's
+ *   recovery read would adopt the very object this refused.
+ */
+export declare const refuseTakeover: (owner: Owner, what: string) => Effect.Effect<void>;
+/** refuseTakeover bound to one call's Owner, for a lifecycle helper that finds the live object. */
+export declare const claimFor: (owner: Owner) => Claim;
+//# sourceMappingURL=adopt.d.ts.map

package/dist/ownership/adopt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.d.ts","sourceRoot":"","sources":["../../src/ownership/adopt.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,QAAS,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAS5D,CAAC;AAEL,wFAAwF;AACxF,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAmBF,sGAAsG;AACtG,eAAO,MAAM,aAAa,UAAW,KAAK,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAI9D,CAAC;AAEL,8FAA8F;AAC9F,MAAM,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,UAAW,KAAK,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAiB1E,CAAC;AAEL,mGAAmG;AACnG,eAAO,MAAM,QAAQ,UACX,KAAK,KAAG,KAEa,CAAC"}

package/dist/ownership/probe.d.ts

@@ -0,0 +1,13 @@
+import * as Effect from 'effect/Effect';
+import type { Owner } from './adopt.ts';
+/**
+ * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
+ * or the recovery read (header): `found` is ours only when the state store records this instance
+ * with its whole declaration AND `settled` — the family's own "live matches these props" — says so.
+ * ⛔ `settled` NEVER FAILS THE READ. The recovery read runs with the INTERRUPTED deploy's props, so
+ *   a declaration that cannot be evaluated any more (a fragments directory since moved, a group
+ *   name since renamed) would fail every later plan, the fix included. It reads as "not proven
+ *   ours" instead — `Unowned`, which `--adopt` resolves — with the reason logged.
+ */
+export declare const ownedRead: <A extends object, E, R>(ask: Owner, found: A | undefined, settled: Effect.Effect<boolean, E, R>) => Effect.Effect<A | undefined, never, R>;
+//# sourceMappingURL=probe.d.ts.map

package/dist/ownership/probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../src/ownership/probe.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGxC;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,OACzC,KAAK,SACH,CAAC,GAAG,SAAS,WACX,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KACpC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,CAsBpC,CAAC"}

package/dist/ownership/resume.d.ts

@@ -0,0 +1,40 @@
+import * as Effect from 'effect/Effect';
+/**
+ * `diff`'s note for a row with no attributes: `instanceId` is an unfinished generation of this
+ * resource's own, which `--adopt` may resume when nothing proves it (adopt.ts adoptable). Returns
+ * `undefined`, a diff's "defer to the engine".
+ */
+export declare const noteUnfinished: (instanceId: string) => Effect.Effect<undefined>;
+/**
+ * Note `instanceId` unfinished, and a proven resume when `recovered` — the family's `read` of the
+ * row's props, asked with no attributes — answers a plain object: ours. `Unowned`, nothing, or a
+ * read that fails or dies proves nothing. ⚠️ Never fails the plan: an unproven resume is refused
+ * at apply instead, unless `--adopt`.
+ */
+export declare const noteResume: <R>(instanceId: string, recovered: Effect.Effect<unknown, unknown, R>) => Effect.Effect<void, never, R>;
+/** Whether the plan for this apply noted `instanceId` as a proven resumed create or replace. */
+export declare const resumes: (instanceId: string) => Effect.Effect<boolean>;
+/** Whether the plan for this apply saw `instanceId` as an unfinished generation (proven or not). */
+export declare const unfinished: (instanceId: string) => Effect.Effect<boolean>;
+/** The fields of a `read` or `diff` call provingResumes uses; a family's own input carries more. */
+type Ask = {
+    readonly id: string;
+    readonly fqn: string;
+    readonly instanceId: string;
+    readonly olds: unknown;
+    readonly output: unknown;
+};
+type Hook = Effect.Effect<unknown, unknown, unknown>;
+/** The two hooks provingResumes wraps, as Alchemy's ProviderService declares them. */
+interface Resumable {
+    read?(input: Ask): Hook;
+    diff?(input: Ask): Hook;
+}
+/**
+ * A provider whose `diff`, for a row with no attributes, first asks the provider's own `read` whether
+ * the live object is that unfinished generation's (noteResume), then runs as written. Every Bao.*
+ * family is built through it, so their diffs answer such a row with a plain `undefined`.
+ */
+export declare const provingResumes: <S extends Resumable>(service: S) => S;
+export {};
+//# sourceMappingURL=resume.d.ts.map

package/dist/ownership/resume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume.d.ts","sourceRoot":"","sources":["../../src/ownership/resume.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAmBxC;;;;GAIG;AACH,eAAO,MAAM,cAAc,eAAgB,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CACvB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,cACd,MAAM,aACP,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,KAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAO3B,CAAC;AAEL,gGAAgG;AAChG,eAAO,MAAM,OAAO,eAAgB,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAA8B,CAAC;AAEjG,oGAAoG;AACpG,eAAO,MAAM,UAAU,eAAgB,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CACtC,CAAC;AAEhC,oGAAoG;AACpG,KAAK,GAAG,GAAG;IACT,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AACF,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAErD,sFAAsF;AACtF,UAAU,SAAS;IACjB,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,CAAC,SAAS,SAAS,WAAW,CAAC,KAAG,CAYhE,CAAC"}

package/dist/ownership/rows.d.ts

@@ -0,0 +1,33 @@
+import * as Effect from 'effect/Effect';
+/**
+ * What the state store says of `instanceId` for this resource (at its FQN, or at a former FQN its
+ * `renamedFrom` names — the planner migrates that row before it recovers it):
+ *   · `absent`  — no row holds it. ★ This is what separates the probe from the recovery read: the
+ *     probe's instance id is minted for the probe (Plan.ts `generateInstanceId()`), 128 random bits
+ *     no row can hold.
+ *   · `partial` — a row holds it, but its props lack part of the declaration: a prop stripped at
+ *     commit because it was still an Output (whole.ts). Those props cannot prove an object ours.
+ *   · `whole`   — a row holds it with every prop the declaration names.
+ */
+export type Recorded = 'absent' | 'partial' | 'whole';
+export declare const recordedInstance: (fqn: string, instanceId: string) => Effect.Effect<Recorded>;
+/**
+ * Whether this apply's `instanceId` is a CREATE: the row Apply committed for it is `creating`.
+ * ⛔ A REPLACE'S NEW GENERATION IS NOT ONE. Apply commits it as `replacing`, and the planner never
+ *   offers it adoption — the probe runs only for a resource with no state — so `--adopt` must not
+ *   let it write over whatever sits at its new identity (adopt.ts adoptsAtApply).
+ */
+export declare const isCreate: (fqn: string, instanceId: string) => Effect.Effect<boolean>;
+/**
+ * ⛔ A REFUSED CREATE MUST NOT LEAVE A ROW THAT CLAIMS THE OBJECT IT REFUSED. Apply commits a
+ *   `creating` row for this instance before it calls reconcile, and a failed reconcile leaves it
+ *   there. The next plan's recovery read would then find our instance id and an object that can
+ *   match its props — a prop that was an Output is stripped from the row, and an omitted prop is
+ *   "not managed" — and adopt exactly what this apply refused. 🔴 MEASURED 2026-09-21: Bao.Mount
+ *   and Bao.AuthMethod did (openbao/adopt-core.test.ts). So the row goes, and state reads as if
+ *   the create never started: the next plan probes, and the probe answers `Unowned`.
+ * ⚠️ ONLY a `creating` row of THIS instance with no attributes — the one Apply just wrote. A
+ *   `replacing` row carries the previous generation in `old` and is never touched.
+ */
+export declare const forgetRefusedCreate: (fqn: string, instanceId: string) => Effect.Effect<void>;
+//# sourceMappingURL=rows.d.ts.map

package/dist/ownership/rows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rows.d.ts","sourceRoot":"","sources":["../../src/ownership/rows.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAkDxC;;;;;;;;;GASG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtD,eAAO,MAAM,gBAAgB,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAKrF,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAI7E,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAUpF,CAAC"}

package/dist/ownership/whole.d.ts

@@ -0,0 +1,14 @@
+import * as Effect from 'effect/Effect';
+/**
+ * Whether `recorded` carries a value everywhere `declared` does. Plain objects and arrays are
+ * walked; any other declared value — a literal, an Output, an Effect — needs a value in the row.
+ */
+export declare const carries: (declared: unknown, recorded: unknown) => boolean;
+/**
+ * Whether `props` — one generation's, from the state store — carry the whole declaration of the
+ * resource at `fqn`. ⛔ FALSE WITH NOTHING TO COMPARE: no Stack in context, or a resource no longer
+ *   declared (an orphan's delete). That object then reads as `Unowned` and Apply leaves it in place
+ *   with a note, rather than deleting what it cannot prove it made.
+ */
+export declare const wholeDeclaration: (fqn: string, props: unknown) => Effect.Effect<boolean>;
+//# sourceMappingURL=whole.d.ts.map

package/dist/ownership/whole.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whole.d.ts","sourceRoot":"","sources":["../../src/ownership/whole.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAWxC;;;GAGG;AACH,eAAO,MAAM,OAAO,aAAc,OAAO,YAAY,OAAO,KAAG,OAY9D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,QAAS,MAAM,SAAS,OAAO,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAIhF,CAAC"}

package/dist/proxmox/ceph-pool-form.d.ts

@@ -174,9 +174,9 @@ export declare const hint: (value: number | undefined) => number | undefined;
  * the way storage.ts's `mutable` serves both of its forms. `name` is the path's last segment on an
  * update and is not repeated here.
  *
- * ⚠️ SAFE TO RE-APPLY TO A POOL THAT ALREADY MATCHES, which reconcile relies on. MEASURED in
- *   PVE::Ceph::Tools::set_pool (Tools.pm:293-300): it reads `osd pool get all` first and SKIPS
- *   every setting whose value did not change, so re-sending the declared set costs one mon read.
+ * ⚠️ SAFE TO RE-APPLY TO A POOL THAT ALREADY MATCHES (reconcile leaned on it until update-guard.ts).
+ *   MEASURED in PVE::Ceph::Tools::set_pool (Tools.pm:293-300): it reads `osd pool get all` first
+ *   and SKIPS every unchanged setting, so the undrifted fields that ride along cost one mon read.
  * ⛔ BUT A SETTING THAT DID CHANGE AND CANNOT BE APPLIED KILLS THE WHOLE PUT. Tools.pm:310 dies
  *   with "Could not set: <fields>" if any parameter is left unapplied, so a pool carrying Ceph's
  *   `nosizechange` fails an entire update over one field. That is why the `no*` flags are reported

package/dist/proxmox/ceph-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EASnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,eAAe,EAA+B,MAAM,eAAe,CAAC;AAGlF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAElD,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,kGAAkG;AAClG,eAAO,MAAM,eAAe,kDAE1B,CAAC;AAiEH,eAAO,MAAM,uBAAuB,qIA4EjC,CAAC"}
+{"version":3,"file":"ceph-pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EASnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,eAAe,EAA+B,MAAM,eAAe,CAAC;AAIlF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAElD,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,kGAAkG;AAClG,eAAO,MAAM,eAAe,kDAE1B,CAAC;AAiEH,eAAO,MAAM,uBAAuB,qIAkFjC,CAAC"}

package/dist/proxmox/fake-bao-env.d.ts

@@ -0,0 +1,3 @@
+/** Run `body` with every BAO_* / VAULT_* unset except `BAO_ADDR=address`, then restore them. */
+export declare const withFakeBao: <A>(address: string, body: () => Promise<A>) => Promise<A>;
+//# sourceMappingURL=fake-bao-env.d.ts.map

package/dist/proxmox/fake-bao-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-bao-env.d.ts","sourceRoot":"","sources":["../../src/proxmox/fake-bao-env.ts"],"names":[],"mappings":"AAcA,gGAAgG;AAChG,eAAO,MAAM,WAAW,GAAU,CAAC,WAAW,MAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,CAYvF,CAAC"}

package/dist/proxmox/fake-pve-lxc.d.ts

@@ -0,0 +1,42 @@
+export type Seen = {
+    readonly method: string;
+    readonly path: string;
+    readonly form: URLSearchParams;
+};
+export type FakePve = {
+    /** Live configs, keyed `node/vmid`. Mutate freely between deploys to simulate hand edits. */
+    readonly guests: Map<string, Record<string, unknown>>;
+    /** Extra `GET /cluster/resources` rows — a QEMU VM, or a guest on another node. */
+    readonly others: {
+        vmid: number | string;
+        node: string;
+        type: string;
+    }[];
+    /** Forced answers for `GET …/config`, keyed `node/vmid`: an HTTP status and a JSON body. */
+    readonly configErrors: Map<string, {
+        status: number;
+        body: unknown;
+    }>;
+    /**
+     * Guests that read as ABSENT for the next N cluster listings (their config GET 500s meanwhile),
+     * keyed `node/vmid` — a guest that appears between a plan and its deploy.
+     */
+    readonly vanish: Map<string, number>;
+    /** Config keys a `PUT …/config` accepts with 200 and then does not store. */
+    readonly ignore: Set<string>;
+    /** How every task ends, and whether a task-starting call answers with no UPID at all. */
+    readonly task: {
+        exit: string;
+        noUpid: boolean;
+    };
+    readonly seen: Seen[];
+    readonly fetch: typeof fetch;
+    readonly stop: () => void;
+};
+/** The member hostname a test target names, and the OpenBao address the mint is pointed at. */
+export declare const FAKE_MEMBER = "pve-a.test";
+export declare const FAKE_BAO = "http://bao.test:8200";
+export declare const fakePve: () => FakePve;
+/** Every call that changed something, as `METHOD path`, in order — OpenBao mints excluded. */
+export declare const writesOf: (fake: FakePve) => string[];
+//# sourceMappingURL=fake-pve-lxc.d.ts.map

package/dist/proxmox/fake-pve-lxc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-pve-lxc.d.ts","sourceRoot":"","sources":["../../src/proxmox/fake-pve-lxc.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG;IACpB,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACzE,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtE;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;CAC3B,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,WAAW,eAAe,CAAC;AACxC,eAAO,MAAM,QAAQ,yBAAyB,CAAC;AAwC/C,eAAO,MAAM,OAAO,QAAO,OAoH1B,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,QAAQ,SAAU,OAAO,aAG0C,CAAC"}

package/dist/proxmox/fake-pve.d.ts

@@ -0,0 +1,38 @@
+/**
+ * A PVE cluster and the OpenBao that mints for it, both answered in-process by one stub `fetch` —
+ * so a family's REAL provider can run through Alchemy's engine with every call recorded.
+ *
+ * ★ A STUB `fetch`, NOT A SERVER. client.test.ts remaps hosts onto Bun.serve to test failover;
+ *   here the question is only which calls a lifecycle makes, and a stub answers every URL without
+ *   a socket, so nothing can reach a real host whatever the environment says.
+ * ⛔ AND THE ENVIRONMENT IS EMPTIED ANYWAY (`withoutBao`, fake-bao-env.ts), so a token in the
+ *   shell running the tests is never read.
+ * ⚠️ `lease_duration: 0` KEEPS THE LEASE CACHE COLD (lease-cache.ts `timeToLive`), so no fake
+ *   credential outlives the test that minted it.
+ * ⛔ TEST-ONLY. No provider imports this file.
+ */
+import * as Layer from 'effect/Layer';
+import type { PveTarget } from './credentials.ts';
+export declare const FAKE_TARGET: PveTarget;
+export interface PveCall {
+    readonly method: string;
+    /** Relative to `/api2/json/`, query included — the string a family passes to `pve()`. */
+    readonly path: string;
+    readonly form: Readonly<Record<string, string>>;
+}
+/** Answers one call with its `data`; `undefined` is PVE's `{"data": null}`. */
+export type PveAnswer = (call: PveCall) => unknown;
+export interface FakePve {
+    readonly calls: PveCall[];
+    /** Every call that is not a GET, as `METHOD path`. */
+    readonly writes: () => string[];
+    /** Provide over a provider layer: `Provider().pipe(Layer.provideMerge(fake.layer))`. */
+    readonly layer: ReturnType<typeof transport>;
+}
+/** Effect's own fetch client over a stub — client.test.ts wires failover the same way. */
+declare const transport: (stub: typeof fetch) => Layer.Layer<import("effect/unstable/http/HttpClient").HttpClient, never, never>;
+export declare const fakePve: (answer: PveAnswer) => FakePve;
+/** Run `body` against the stub's OpenBao (fake-bao-env.ts), then forget the member failover state. */
+export declare const withoutBao: <A>(body: () => Promise<A>) => Promise<A>;
+export {};
+//# sourceMappingURL=fake-pve.d.ts.map

package/dist/proxmox/fake-pve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-pve.d.ts","sourceRoot":"","sources":["../../src/proxmox/fake-pve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIlD,eAAO,MAAM,WAAW,EAAE,SAIzB,CAAC;AAEF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAED,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;AAEnD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,EAAE,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;CAC9C;AAED,0FAA0F;AAC1F,QAAA,MAAM,SAAS,SAAU,OAAO,KAAK,oFACuD,CAAC;AAE7F,eAAO,MAAM,OAAO,WAAY,SAAS,KAAG,OAuB3C,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,UAAU,GAAI,CAAC,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,CACO,CAAC"}

package/dist/proxmox/index.d.ts

@@ -6,8 +6,12 @@
  *   provider needs but a consumer should not depend on. An `export *` here would publish
  *   every helper as API and make the next refactor a breaking change.
  * ★ Control-plane Resource constructors (Storage, SDN, access, HA, backup,
- *   metrics, PBS) sit next to their Providers. Guests and NIC apply stay
+ *   metrics, PBS) sit next to their Providers. NIC apply and QEMU stay
  *   Provider-only so a stack cannot declare them by accident.
+ * ★ `ProxmoxLxc` JOINED THEM 2026-09-21, AND IT WAS KEPT OFF UNTIL IT COULD NOT HURT A GUEST.
+ *   The provider-only version diffed four fields and would have planned a create over any read
+ *   failure. The Resource now adopts from the live config, refuses every change PVE cannot make
+ *   in place, and retains on destroy (lxc.ts).
  * ★ Anything else unlisted is still reachable by path if you genuinely need
  *   it — that is a deliberate, visible act rather than an accident of barrelling.
  */
@@ -23,7 +27,7 @@ export { ProxmoxFirewallAliasProvider } from './firewall-alias.ts';
 export { ProxmoxGroup, ProxmoxGroupProvider } from './group.ts';
 export { ProxmoxHaResource, ProxmoxHaResourceProvider } from './ha-resource.ts';
 export { ProxmoxHaRule, ProxmoxHaRuleProvider } from './ha-rule.ts';
-export { ProxmoxLxcProvider } from './lxc.ts';
+export { type LxcAttributes, type LxcProps, ProxmoxLxc, ProxmoxLxcProvider } from './lxc.ts';
 export { ProxmoxMetricServer, ProxmoxMetricServerProvider } from './metric-server.ts';
 export { ProxmoxNetworkApplyProvider } from './network-apply.ts';
 export { ProxmoxNodeNetworkProvider } from './node-network.ts';

package/dist/proxmox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxmox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxmox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC"}