@homeflare/alchemy 0.1.0

package/dist/openbao/cloudflare-permission-groups-solve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-permission-groups-solve.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-permission-groups-solve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEjE,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,SAAS,aAAa,EAAE,CAAC;CACjD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,aACf,SAAS,YAAY,EAAE,QAC3B,WAAW,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC,KAC/C,WAAW,EAmBV,CAAC;AAIL,eAAO,MAAM,WAAW,iBAAkB,SAAS,WAAW,EAAE,KAAG,MAsElE,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,WAAY,MAAM,KAAG,MAAM,EAYvD,CAAC"}

package/dist/openbao/cloudflare-permission-groups.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Permission-group (name, SCOPE) → ID, behind ONE interface with two sources.
+ *
+ * ⛔ THE KEY IS THE PAIR, AND THAT IS NOT PEDANTRY. MEASURED 2026-09-15 the hour the grant went
+ *   live: of the account's 401 groups, SEVEN names are listed twice — `Access: Apps and Policies
+ *   Read`/`Revoke`/`Write`, `Disable ESC Read`/`Write`, `Logs Read`/`Write` — each pair one id
+ *   scoped `com.cloudflare.api.account` and one scoped `com.cloudflare.api.account.zone`. Keyed by
+ *   name alone the whole plan fails as ambiguous; keyed by name alone and forgiving, cfhf.py:148's
+ *   last-one-wins picks a group gated at the wrong scope and the token is refused at first use.
+ *   The asking ENTRY says which: its `scope` (roles.yaml `groups_scope:`), else its resource.
+ *
+ * ★ A SERVICE, NOT A TABLE. roles.yaml names groups (`DNS Read`); a role stores IDs. apply-roles.py
+ *   resolved them per account with a Cloudflare parent credential (cfhf.py:147-148), which agents
+ *   may not use. So Bao.CloudflareRole asks this service, and the stack chooses the source:
+ *
+ *   a) `permissionGroupsFromEngine` — `GET <mount>/permission-groups` on the Cloudflare engine,
+ *      answered under the mount's own parent. ★ DEPLOYED AND WIRED 2026-09-15: `bao path-help
+ *      cloudflare-<account>-platform` lists `^permission-groups$` on plugin v0.0.0-dev, and
+ *      cloudflare-roles.ts now provides this source to the stack.
+ *   b) `permissionGroupsFromLiveRoles` — ⚠️ TEMPORARY, AND STILL HERE ON PURPOSE. 2026-09-15: no
+ *      longer the stack's source, and NOT yet deletable. Two things gate that — (1) the live
+ *      `result_info` envelope pinned in ../../platform/secrets/vault/plugin/cloudflare/
+ *      client_result_info.go, whose own header names this deletion as what it gates, and (2)
+ *      cloudflare-parity.ts, which calls cloudflare-permission-groups-solve.ts directly for the
+ *      OFFLINE proof against a production export and has no engine to ask. So (b) and the solver
+ *      stay, one import from being the layer again (cloudflare-roles.ts), until the last step of
+ *      docs/ledger/openbao-permission-groups-engine-2026-09-15.md is done.
+ *
+ * ⛔ AN UNKNOWN NAME FAILS THE OPERATION. Dropping it would write a policy one group short, and the
+ *   engine refuses an empty ID (path_roles.go:181-185) but not a SHORTER list: the minted token is
+ *   quietly narrower than declared, and the consumer finds out at 403.
+ */
+import * as Context from 'effect/Context';
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+import type { ExpandedRole } from './cloudflare-roles-expand.ts';
+export declare class CloudflareGroupsError extends Error {
+    readonly scope: string;
+    readonly problems: readonly string[];
+    constructor(scope: string, problems: readonly string[]);
+}
+/** ⛔ Keyed by `groupKey(name, scope)` throughout — see cloudflare-group-scope.ts. */
+type Groups = ReadonlyMap<string, string>;
+/** One group a role asks for: its name, and the scope the entry naming it is gated at. */
+export interface GroupRef {
+    readonly name: string;
+    readonly scope: string;
+}
+declare const CloudflarePermissionGroups_base: Context.ServiceClass<CloudflarePermissionGroups, "homeflare/openbao/CloudflarePermissionGroups", {
+    /** The ID of every ref, keyed by `groupKey` — or a failure naming what did not resolve. */
+    readonly resolve: (mount: string, refs: readonly GroupRef[]) => Effect.Effect<Groups, BaoError | CloudflareGroupsError, HttpClient.HttpClient>;
+}>;
+export declare class CloudflarePermissionGroups extends CloudflarePermissionGroups_base {
+}
+/**
+ * ★ ONE FETCH PER MOUNT PER RUN, not one per role — 586 roles would otherwise ask 586 times.
+ * ⚠️ A FAILURE IS CACHED TOO (Effect.cached keeps the Exit), so one sealed-vault 503 fails every
+ *   role on that mount for the rest of the run. That is the honest outcome for a plan: retrying
+ *   586 times against a sealed server would only make the failure slower.
+ */
+export declare const permissionGroupsFromEngine: () => Effect.Effect<{
+    /** The ID of every ref, keyed by `groupKey` — or a failure naming what did not resolve. */
+    readonly resolve: (mount: string, refs: readonly GroupRef[]) => Effect.Effect<Groups, BaoError | CloudflareGroupsError, HttpClient.HttpClient>;
+}, never, never>;
+/**
+ * b) ⚠️ TEMPORARY, AND NO LONGER THE STACK'S SOURCE SINCE 2026-09-15 — see the header for the two
+ *   things that gate deleting it. Reads every DECLARED role of an account — no LIST, because an
+ *   undeclared live role carries IDs with no names to pair them with — and solves the account at
+ *   once.
+ * 🔴 WHAT RETIRED IT, 2026-09-15 10:13: `alchemy deploy` could not create
+ *   `cloudflare-{<account>,testing}-platform/roles/r2-backup-mini` — `unknown group "Workers R2
+ *   Storage Bucket Item Write" — no live role on account <account> carries it; a NEW group needs
+ *   the engine endpoint`. That is this source's documented blind spot arriving, not a bug in it.
+ *
+ * ★ PER ACCOUNT, NOT PER MOUNT, BECAUSE ONE MOUNT CANNOT SOLVE ITSELF. MEASURED on the snapshot:
+ *   `aimto-app-alchemy-os-create` on the platform mount pairs `Email Routing Rules Write` and
+ *   `DNS Write` with two unknown IDs, and neither group appears alone on that mount. The dns and
+ *   security mounts of the same account isolate them. apply-roles.py's map was per account too
+ *   (apply-roles.py:117).
+ */
+export declare const permissionGroupsFromLiveRoles: (declared: ReadonlyMap<string, readonly ExpandedRole[]>) => Effect.Effect<{
+    /** The ID of every ref, keyed by `groupKey` — or a failure naming what did not resolve. */
+    readonly resolve: (mount: string, refs: readonly GroupRef[]) => Effect.Effect<Groups, BaoError | CloudflareGroupsError, HttpClient.HttpClient>;
+}, never, never>;
+export {};
+//# sourceMappingURL=cloudflare-permission-groups.d.ts.map

package/dist/openbao/cloudflare-permission-groups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-permission-groups.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-permission-groups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAShD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAGjE,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE;IAFtC,YACW,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,SAAS,MAAM,EAAE,EAIrC;CACF;AAED,qFAAqF;AACrF,KAAK,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAG1C,0FAA0F;AAC1F,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;;IAKG,2FAA2F;sBACzE,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,QAAQ,EAAE,KACtB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,qBAAqB,EAAE,UAAU,CAAC,UAAU,CAAC;;AAPvF,qBAAa,0BAA2B,SAAQ,+BASG;CAAG;AA4HtD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;IAxInC,2FAA2F;sBACzE,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,QAAQ,EAAE,KACtB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,qBAAqB,EAAE,UAAU,CAAC,UAAU,CAAC;gBAsJnF,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,aAC9B,WAAW,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IA7KpD,2FAA2F;sBACzE,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,QAAQ,EAAE,KACtB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,qBAAqB,EAAE,UAAU,CAAC,UAAU,CAAC;gBA+NnF,CAAC"}

package/dist/openbao/cloudflare-policy.d.ts

@@ -0,0 +1,65 @@
+import type { DeclaredPolicy } from './cloudflare-roles-expand.ts';
+export interface WirePolicy {
+    readonly effect: string;
+    readonly resources: Readonly<Record<string, string>>;
+    readonly groupIds: readonly string[];
+}
+/** A declared entry with its IDs, still carrying how its group order is to be compared. */
+export interface ResolvedPolicy extends WirePolicy {
+    readonly groupOrder: DeclaredPolicy['groupOrder'];
+}
+/**
+ * One name at every scope — what a source that cannot see scopes can honestly offer.
+ *
+ * ⚠️ IT IS A WIDENING, AND IT IS THE ASYMMETRY BETWEEN THE TWO SOURCES. The live-roles bootstrap
+ *   and cloudflare-permission-groups-solve.ts recover `name → id` from roles that carry ids and no
+ *   scopes, so they cannot tell the seven two-id names apart; the id they learned is offered for
+ *   whatever scope an entry asks. The engine source keys by (name, scope) and never does this.
+ */
+export declare const atEveryScope: (byName: ReadonlyMap<string, string>) => ReadonlyMap<string, string>;
+/**
+ * Declared names to IDs, or the names `ids` lacks.
+ *
+ * ⛔ AN ENTRY LOOKS ITS GROUPS UP AT ITS OWN SCOPE (`groupKey`), not by name: a zone entry and an
+ *   account entry of the same role can name one group and mean two different ids.
+ * ★ THE ACCOUNT ENTRY IS SORTED BY ID, EXACTLY AS cfhf.py:180 DID. ⚠️ Plain `sort()`, never
+ *   `localeCompare`: Python's `sorted()` on str is codepoint order, and JavaScript's default sort
+ *   is UTF-16 code-unit order, which agree on the lowercase hex these IDs are made of.
+ */
+export declare const resolvePolicies: (declared: readonly DeclaredPolicy[], ids: ReadonlyMap<string, string>) => {
+    readonly policies: ResolvedPolicy[];
+    readonly missing: string[];
+};
+/**
+ * The live `policies` string parsed, or undefined when it is not a policy document.
+ *
+ * ⚠️ UNDEFINED IS NOT ABSENCE. It means the role exists and its policies could not be read, which
+ *   compares unequal to every declaration — so it plans `update`, and reconcile's re-read refuses
+ *   to call a write that still reads back like that a success.
+ */
+export declare const parseLivePolicies: (raw: unknown) => WirePolicy[] | undefined;
+/**
+ * The `policies` field for a write — the array cfhf.py:174-180 built, serialized.
+ *
+ * ⚠️ NOT BYTE-IDENTICAL TO WHAT PYTHON SENT, AND IT NEED NOT BE. `json.dumps` put a space after
+ *   every `:` and `,`; this emits none. The engine unmarshals the string into structs
+ *   (path_roles.go:161-166) and stores those, never the text, so the stored role and the read
+ *   that diff compares are the same either way.
+ */
+export declare const policiesJson: (policies: readonly WirePolicy[]) => string;
+/**
+ * ⛔ THE POLICY EQUALITY.
+ *
+ *   • Entry count and entry ORDER must match: cfhf.py always wrote the scope entry first and the
+ *     account entry second (cfhf.py:174-180).
+ *   • Within an entry: effect, the resource map, and the group IDs — IN ORDER for a `declared`
+ *     entry, because cfhf.py:175 kept yaml order; AS A SORTED LIST for a `by-id` entry, because
+ *     cfhf.py:180 sorted it, so its order never carried meaning.
+ *
+ * ⚠️ NOT ORDER-INSENSITIVE EVERYWHERE, ON PURPOSE. Cloudflare treats a group list as a set, so a
+ *   reordered `declared` entry mints an identical token — and still plans `update` here. The
+ *   Python would have rewritten it as well, and an adoption that is noop only up to reordering
+ *   would not prove the port exact.
+ */
+export declare const samePolicies: (want: readonly ResolvedPolicy[], have: readonly WirePolicy[]) => boolean;
+//# sourceMappingURL=cloudflare-policy.d.ts.map

package/dist/openbao/cloudflare-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-policy.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-policy.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,2FAA2F;AAC3F,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,WAAY,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAK1F,CAAC;AAEJ;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,aAChB,SAAS,cAAc,EAAE,OAC9B,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAC/B;IAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAwBnE,CAAC;AA4BF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAS,OAAO,KAAG,UAAU,EAAE,GAAG,SAa/D,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,aAAc,SAAS,UAAU,EAAE,WAOzD,CAAC;AAaJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,SAAU,SAAS,cAAc,EAAE,QAAQ,SAAS,UAAU,EAAE,YAUrF,CAAC"}

package/dist/openbao/cloudflare-role-form.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Props, attributes and field comparison for Bao.CloudflareRole — the resource is
+ * cloudflare-role.ts, the policy document rules are cloudflare-policy.ts.
+ *
+ * MEASURED from the engine (house/platform/secrets/vault/plugin/cloudflare/path_roles.go) and the
+ * 2026-09-14 snapshot of all 586 live roles:
+ *   • A role is name, description, policies, ttl and max_ttl AND NOTHING ELSE (path_roles.go:14-20
+ *     stores those; :204-210 returns them). Every snapshot read carries exactly those five keys, so
+ *     `differences` below covers the whole server-side object — no unmanaged field can drift
+ *     behind a green plan.
+ *   • ttl and max_ttl are TypeDurationSecond (:73-80) and read back as integer seconds.
+ *   • ⚠️ A WRITE MERGES, IT DOES NOT REPLACE (:117-146). The handler loads the stored role and
+ *     overwrites only the fields present — the opposite of the proxmox engine, where an omitted
+ *     field is zeroed. writeBody sends all four anyway, so a write always lands the whole
+ *     declaration and can never leave an old description behind a new policy.
+ *
+ * ⛔ NO SECRET IN PROPS OR ATTRIBUTES, AND THERE IS NONE TO LEAK. A role is permission-group IDs, a
+ *   zone or account resource, a sentence and two TTLs. The parent token lives at `<mount>/config`
+ *   and a minted token at `<mount>/creds/<name>`; nothing in this family reads either path. Keep
+ *   it that way — Alchemy persists attributes unencrypted (see policy.ts).
+ */
+import { type ResolvedPolicy, type WirePolicy } from './cloudflare-policy.ts';
+import type { DeclaredPolicy } from './cloudflare-roles-expand.ts';
+export interface BaoCloudflareRoleProps {
+    /** Mount of the Cloudflare secrets engine, e.g. `cloudflare-<account>-dns`. */
+    mount: string;
+    /** Role name. ⛔ Consumers mint by it — see cloudflare-roles-expand.ts before changing one. */
+    name: string;
+    /** The description as written: a zone role's carries its ` (zone: <name>)` suffix. */
+    description: string;
+    /** Default lease TTL, e.g. `5m`. */
+    ttl: string;
+    /** Maximum lease TTL, e.g. `1h`. */
+    maxTtl: string;
+    /**
+     * Policy entries, groups by NAME. The provider resolves them through CloudflarePermissionGroups
+     * at diff and reconcile time; an ID is never a prop, so a plan can never persist a guessed one.
+     */
+    policies: DeclaredPolicy[];
+}
+export interface BaoCloudflareRoleAttributes {
+    mount: string;
+    name: string;
+    description: string;
+    /** Live ttl in seconds, as the engine stores it. */
+    ttl: number;
+    /** Live max_ttl in seconds. */
+    maxTtl: number;
+    /** Live `policies` JSON — group IDs and a resource, never a credential. */
+    policies: string;
+    /** SHA-256 of the fields above — safe to persist; see policy.ts. */
+    digest: string;
+}
+/** One live role, as a read returns it. */
+export interface LiveCloudflareRole {
+    readonly name: string;
+    readonly description: string;
+    readonly ttl: number | undefined;
+    readonly maxTtl: number | undefined;
+    readonly policiesText: string;
+    /** Undefined when `policies` is not a policy document — see parseLivePolicies. */
+    readonly policies: readonly WirePolicy[] | undefined;
+}
+export interface RoleDifference {
+    readonly field: 'description' | 'max_ttl' | 'policies' | 'ttl';
+    readonly want: string;
+    readonly have: string;
+}
+/** `cloudflare-<account>-dns/roles/homeflare-dev-dns-read` — read, write and delete use it. */
+export declare const rolePath: (mount: string, name: string) => string;
+/** A read's `data`, shaped. Lenient on purpose: a malformed field compares unequal, loudly. */
+export declare const liveRoleOf: (data: Readonly<Record<string, unknown>>) => LiveCloudflareRole;
+/**
+ * ⚠️ Every value is taken from `live`, the prop only standing in for a missing `name` — the same
+ *   split the sibling families use, so a read never launders the declaration back as "current".
+ */
+export declare const attributesOf: (props: Pick<BaoCloudflareRoleProps, 'mount' | 'name'>, live: LiveCloudflareRole) => BaoCloudflareRoleAttributes;
+/**
+ * Why reconcile must refuse this declaration, or undefined.
+ *
+ * ⛔ AN UNPARSEABLE TTL IS A REFUSAL, NOT A ZERO: it can never equal the live seconds, so it would
+ *   plan `update` forever. ⛔ AN EMPTY POLICY LIST OR AN ENTRY WITH NO GROUPS IS A REFUSAL TOO — the
+ *   engine rejects both (path_roles.go:147-149, :175-180), and saying so before the write names the
+ *   declaration instead of quoting the server.
+ */
+export declare const refusalOf: (props: BaoCloudflareRoleProps) => string | undefined;
+/**
+ * The body for `PUT <mount>/roles/<name>` — the four `k=v` pairs apply-roles.py:157-162 sent.
+ *
+ * ★ THE TTLs GO AS THE DECLARED TEXT (`5m`), which is what `bao write ttl=5m` put in the JSON body,
+ *   and TypeDurationSecond parses it server-side. `policies` is a string because the field is a
+ *   string (path_roles.go:67-68), not because the engine wants the whole body stringly-typed.
+ */
+export declare const writeBody: (props: BaoCloudflareRoleProps, policies: readonly WirePolicy[]) => {
+    description: string;
+    max_ttl: string;
+    policies: string;
+    ttl: string;
+};
+/**
+ * Every field where live differs from the resolved declaration. Empty means noop.
+ *
+ * ⛔ apply-roles.py --verify COMPARED NONE OF THESE. It lists `<mount>/roles` and reports names
+ *   only: MISSING when roles.yaml has a role the vault lacks, UNTRACKED for the reverse
+ *   (apply-roles.py:136-141, :167-173, :179-185). It never read a role. So this equality is new: the
+ *   four fields --apply WRITES (apply-roles.py:157-162), compared the way the engine reads them back
+ *   — durations as seconds, description exactly, policies by the rules in samePolicies.
+ */
+export declare const differences: (props: Pick<BaoCloudflareRoleProps, 'description' | 'maxTtl' | 'ttl'>, policies: readonly ResolvedPolicy[], live: LiveCloudflareRole) => RoleDifference[];
+//# sourceMappingURL=cloudflare-role-form.d.ts.map

package/dist/openbao/cloudflare-role-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,UAAU,EAIhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAInE,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,+FAA+F;AAC/F,eAAO,MAAM,QAAQ,UAAW,MAAM,QAAQ,MAAM,WAAwC,CAAC;AAK7F,+FAA+F;AAC/F,eAAO,MAAM,UAAU,SAAU,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAG,kBAOnE,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,YAAY,UAChB,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,MAAM,CAAC,QAC/C,kBAAkB,KACvB,2BAUF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,UAAW,sBAAsB,KAAG,MAAM,GAAG,SASlE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,UAAW,sBAAsB,YAAY,SAAS,UAAU,EAAE;IACtF,WAAW;IACX,OAAO;IACP,QAAQ;IACR,GAAG;CACH,CAAC;AAOH;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,UACf,IAAI,CAAC,sBAAsB,EAAE,aAAa,GAAG,QAAQ,GAAG,KAAK,CAAC,YAC3D,SAAS,cAAc,EAAE,QAC7B,kBAAkB,KACvB,cAAc,EAehB,CAAC"}

package/dist/openbao/cloudflare-role-wire.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The OpenBao calls Bao.CloudflareRole and the live-roles bootstrap make — read, write and delete
+ * of `<mount>/roles/<name>`. Split out so each can be tested against fake-bao.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+import { type LiveCloudflareRole } from './cloudflare-role-form.ts';
+/**
+ * The live role, or undefined when the engine answers 404.
+ *
+ * ⚠️ A MISSING MOUNT AND A MISSING ROLE BOTH READ AS UNDEFINED — both are a 404 from OpenBao, the
+ *   first as "no handler for route". That is proxmox-role.ts's ⚠️ in full: the WRITE is what tells
+ *   them apart, and it lets OpenBao's own `errors` through. A 403 or 503 is never absence
+ *   (bao-status.ts).
+ */
+export declare const readCloudflareRole: (mount: string, name: string) => Effect.Effect<LiveCloudflareRole | undefined, BaoError, HttpClient.HttpClient>;
+/** ★ `PUT`, which is what `bao write` sent (bao-http.ts). A 404 here fails — see readCloudflareRole. */
+export declare const writeCloudflareRole: (mount: string, name: string, body: Readonly<Record<string, string>>) => Effect.Effect<void, BaoError, HttpClient.HttpClient>;
+/**
+ * Idempotent as Alchemy requires — already gone (404) is success, a refusal is not.
+ *
+ * ⚠️ THE ENGINE'S DELETE IS ONE STORAGE DELETE (path_roles.go:214-216). Tokens the role already
+ *   minted are leases, and they live to their own expiry.
+ */
+export declare const deleteCloudflareRole: (mount: string, name: string) => Effect.Effect<void, BaoError, HttpClient.HttpClient>;
+//# sourceMappingURL=cloudflare-role-wire.d.ts.map

package/dist/openbao/cloudflare-role-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-role-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role-wire.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,KAAK,kBAAkB,EAAwB,MAAM,2BAA2B,CAAC;AAE1F;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,UACtB,MAAM,QACP,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAG7E,CAAC;AAEJ,wGAAwG;AACxG,eAAO,MAAM,mBAAmB,UACvB,MAAM,QACP,MAAM,QACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,yDACS,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,UAAW,MAAM,QAAQ,MAAM,yDAC9B,CAAC"}

package/dist/openbao/cloudflare-role.d.ts

@@ -0,0 +1,35 @@
+/**
+ * A role on one of the six Cloudflare secrets-engine mounts — what one consumer may mint: the
+ * Cloudflare policy its tokens carry and the lease bounds they get. METADATA ONLY.
+ *
+ * ★ THE PORT OF apply-roles.py's WRITE. roles.yaml expands to these (cloudflare-roles-expand.ts),
+ *   and what used to be `bao write <mount>/roles/<name> ttl= max_ttl= description= policies=` is
+ *   reconcile below. The props name permission groups; CloudflarePermissionGroups turns them into
+ *   IDs at diff and reconcile time.
+ *
+ * ⛔ NO SECRET IN PROPS OR ATTRIBUTES — see cloudflare-role-form.ts. ⛔ AND ISSUANCE IS NOT THIS
+ *   RESOURCE: `<mount>/creds/<name>` returns a LIVE Cloudflare token, and a token declared as a
+ *   resource would outlive its lease in Alchemy's unencrypted state (proxmox-role.ts has the four
+ *   places it would land). This declares the door; minting is a runtime call.
+ *
+ * ★ `defaultRemovalPolicy: 'retain'` — deleting a role breaks every consumer that mints from it,
+ *   and apply-roles.py never deleted one either: an unexplained role was reported UNTRACKED and
+ *   left alone (apply-roles.py:190-196). Opt in with `.pipe(RemovalPolicy.destroy())`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { CloudflarePermissionGroups } from './cloudflare-permission-groups.ts';
+import { type BaoCloudflareRoleAttributes, type BaoCloudflareRoleProps } from './cloudflare-role-form.ts';
+export type { BaoCloudflareRoleAttributes, BaoCloudflareRoleProps };
+/**
+ * ⚠️ CloudflarePermissionGroups IS NOT A REQUIREMENT OF THE RESOURCE. The provider takes it once, when
+ *   it is built (`yield* CloudflarePermissionGroups` below), and alchemy.run.ts supplies it to the
+ *   provider layer with `Layer.provide`. Listing it here as well made it a requirement of the STACK
+ *   body, which Alchemy only lets name its own provider and stack services — tsc refused the wiring.
+ */
+export interface BaoCloudflareRole extends Resource<'Bao.CloudflareRole', BaoCloudflareRoleProps, BaoCloudflareRoleAttributes, never, HttpClient.HttpClient> {
+}
+export declare const BaoCloudflareRole: import("alchemy").ResourceClass<BaoCloudflareRole>;
+export declare const BaoCloudflareRoleProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoCloudflareRole>, never, CloudflarePermissionGroups | HttpClient.HttpClient>;
+//# sourceMappingURL=cloudflare-role.d.ts.map

package/dist/openbao/cloudflare-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-role.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,0BAA0B,EAAiB,MAAM,mCAAmC,CAAC;AAE9F,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAOnC,YAAY,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,yBAAyB,qIA+HnC,CAAC"}

package/dist/openbao/cloudflare-roles-config.d.ts

@@ -0,0 +1,67 @@
+/** One `zone_roles` or `account_roles` entry. */
+export interface RoleTemplate {
+    readonly name: string;
+    readonly groups: readonly string[];
+    /** Duration text exactly as written (`5m`), which is what apply-roles.py sent. */
+    readonly ttl: string;
+    readonly maxTtl: string;
+    readonly desc: string;
+    /** `zones:` narrowing. Undefined or empty narrows nothing — `if only and …` (cfroles.py:78). */
+    readonly zones: readonly string[] | undefined;
+    readonly zoneTypes: readonly string[];
+    /** Account-scoped groups on a ZONE role. Ignored on account roles, as cfroles.py:101 ignores it. */
+    readonly accountGroups: readonly string[];
+    /**
+     * One R2 bucket NAME, narrowing an account role's resource to that bucket alone.
+     *
+     * ⛔ BUCKET IS THE FINEST GRAIN R2 HAS — A PREFIX CANNOT BE SCOPED. So one repository per
+     *   instance in its own bucket is the only least-privilege shape for a backup credential, and
+     *   this field is what expresses it. Undefined leaves the role account-wide, which is what every
+     *   role declared before 2026-09-15 is.
+     * ⚠️ IT ONLY MEANS ANYTHING WITH THE `Bucket Item` GROUPS. `Workers R2 Storage Write` is gated at
+     *   the ACCOUNT scope, so pairing it with a bucket resource is a token Cloudflare will mint and
+     *   that will then be refused on every call. roles.yaml says which pair goes with which.
+     */
+    readonly bucket: string | undefined;
+    /**
+     * The bucket's jurisdiction, which is part of its resource id and not cosmetic — a bucket
+     * created in `default` is a different resource from the same name under `eu`. Defaults to
+     * `default`, which is what every bucket in this estate is (measured: `r2_bucket_get` reports
+     * `jurisdiction default` on all 34).
+     */
+    readonly bucketJurisdiction: string;
+    /**
+     * roles.yaml `groups_scope:` — the scope this template's `groups:` NAMES resolve at, as a
+     * GROUP_SCOPES value. Undefined means the entry's own resource namespace, which is every
+     * template written before 2026-09-15.
+     *
+     * ⛔ IT SAYS WHICH ID, NOT WHICH RESOURCE. `groups_scope: zone` on an ACCOUNT role keeps the
+     *   account resource and takes the zone-scoped id of each name — Cloudflare's "all zones from
+     *   this account" (cf-mint-analytics-tokens.py:155-158). It is meaningful only for the seven
+     *   names the engine lists at two scopes; anywhere else the name has one id and answers alike.
+     */
+    readonly groupsScope: string | undefined;
+}
+export interface SurfaceSpec {
+    readonly zoneRoles: readonly RoleTemplate[];
+    readonly accountRoles: readonly RoleTemplate[];
+}
+export interface AccountSpec {
+    /** The key under `accounts:` — the `<account>` in `cloudflare-<account>-<surface>`. */
+    readonly key: string;
+    readonly id: string;
+    readonly zones: 'all' | readonly string[];
+    readonly surfaces: readonly string[];
+}
+export interface RolesConfig {
+    readonly namespace: string;
+    readonly surfaces: Readonly<Record<string, SurfaceSpec>>;
+    /** In file order, which is the order apply-roles.py walked them (apply-roles.py:111). */
+    readonly accounts: readonly AccountSpec[];
+}
+export declare class RolesConfigError extends Error {
+    constructor(where: string, problem: string);
+}
+/** Parse and check roles.yaml. Throws RolesConfigError naming the first bad field. */
+export declare const parseRolesConfig: (yaml: string) => RolesConfig;
+//# sourceMappingURL=cloudflare-roles-config.d.ts.map

package/dist/openbao/cloudflare-roles-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-roles-config.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-roles-config.ts"],"names":[],"mappings":"AAuBA,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,oGAAoG;IACpG,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,YAAY,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACzD,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;CAC3C;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGzC;CACF;AAyHD,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,WAc/C,CAAC"}

package/dist/openbao/cloudflare-roles-expand.d.ts

@@ -0,0 +1,76 @@
+import type { AccountSpec, RolesConfig } from './cloudflare-roles-config.ts';
+/** A zone as the expansion needs it — what cfhf.py load_account listed (cfhf.py:134-146). */
+export interface CloudflareZone {
+    readonly name: string;
+    readonly id: string;
+    /** From the `type=internal` listing. ⚠️ Shares its NAME with the public zone, never its id. */
+    readonly internal: boolean;
+}
+/**
+ * One policy entry, groups by name.
+ *
+ * ★ `groupOrder` CARRIES A PYTHON RULE THAT ONLY EXISTS AFTER RESOLUTION. cfhf.py:180 sorts the
+ *   account entry's group IDS — not its names — so that order cannot be computed here, only
+ *   promised. A `declared` entry keeps roles.yaml order, exactly as cfhf.py:175 emitted it.
+ */
+export interface DeclaredPolicy {
+    readonly effect: 'allow';
+    readonly resource: string;
+    readonly groups: readonly string[];
+    readonly groupOrder: 'declared' | 'by-id';
+    /**
+     * The scope these NAMES resolve at, when it is not this entry's own resource namespace —
+     * roles.yaml `groups_scope:`, already a GROUP_SCOPES value. Undefined on every entry that does
+     * not say otherwise, which is 639 of the estate's 643 group references.
+     *
+     * ⛔ IT MOVES THE LOOKUP, NEVER THE RESOURCE. The entry still binds the groups to the resource
+     *   above; only the id chosen for each name changes. That is the shape Cloudflare calls "all
+     *   zones from an account" — the ACCOUNT resource carrying ZONE-scoped groups
+     *   (house/nix/homeflare-config/scripts/cf-mint-analytics-tokens.py:155-158, beside a working
+     *   token). Without this field the resource is the only witness, and it says `account`.
+     */
+    readonly scope?: string;
+}
+/** What apply-roles.py wrote to the KV catalog for one role (apply-roles.py:58-62). */
+export interface CatalogView {
+    readonly description: string;
+    readonly zone: string | null;
+    readonly ttl: string;
+    readonly maxTtl: string;
+    readonly permissions: readonly string[];
+}
+export interface ExpandedRole {
+    readonly account: string;
+    readonly accountId: string;
+    readonly mount: string;
+    readonly surface: string;
+    readonly name: string;
+    /** Exactly what apply-roles.py:160-161 wrote — the zone suffix included. */
+    readonly description: string;
+    readonly ttl: string;
+    readonly maxTtl: string;
+    readonly policies: readonly DeclaredPolicy[];
+    readonly catalog: CatalogView;
+}
+/** cfroles.py:18-20 — `example.com` → `homeflare-dev`. */
+export declare const slug: (name: string) => string;
+/**
+ * cfroles.py:23-38. ⛔ THE `-internal` SUFFIX IS WHAT KEEPS TWO ZONES OF ONE NAME APART. Slugging
+ *   both example.com zones alike would leave two roles fighting for one name, and whichever
+ *   wrote last would silently own it.
+ */
+export declare const zoneSlug: (zone: CloudflareZone) => string;
+/** cfroles.py:46-47 — one mount, and so one parent token, per (account, surface). */
+export declare const mountName: (account: string, surface: string) => string;
+/** cfroles.py:50-104 for one account, in the Python's order: per surface, zone roles first. */
+export declare const expandAccount: (config: RolesConfig, account: AccountSpec, zones: readonly CloudflareZone[]) => ExpandedRole[];
+/**
+ * Every account's roles, grouped by mount.
+ *
+ * ⛔ A DUPLICATE ROLE ON ONE MOUNT IS AN ERROR HERE. apply-roles.py wrote both and the last write
+ *   won in silence (apply-roles.py:157-162); declared, they are two resources fighting over one
+ *   object. ⚠️ A MISSING ZONE INVENTORY IS AN ERROR TOO — an empty one is not, because an account
+ *   with no zones is real, and the Python expanded it to account roles only.
+ */
+export declare const expandAll: (config: RolesConfig, zonesByAccount: Readonly<Record<string, readonly CloudflareZone[]>>) => ReadonlyMap<string, readonly ExpandedRole[]>;
+//# sourceMappingURL=cloudflare-roles-expand.d.ts.map

package/dist/openbao/cloudflare-roles-expand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-roles-expand.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-roles-expand.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAgB,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE3F,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;CAC/B;AAED,0DAA0D;AAC1D,eAAO,MAAM,IAAI,SAAU,MAAM,WAIL,CAAC;AAE7B;;;;GAIG;AACH,eAAO,MAAM,QAAQ,SAAU,cAAc,WACY,CAAC;AAE1D,qFAAqF;AACrF,eAAO,MAAM,SAAS,YAAa,MAAM,WAAW,MAAM,WAAuC,CAAC;AAkFlG,+FAA+F;AAC/F,eAAO,MAAM,aAAa,WAChB,WAAW,WACV,WAAW,SACb,SAAS,cAAc,EAAE,KAC/B,YAAY,EAwBd,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,WACZ,WAAW,kBACH,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,KAClE,WAAW,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAgB7C,CAAC"}

package/dist/openbao/digest.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The digest every Bao.* family persists instead of a value — moved here from the retired
+ * bao-shell.ts, unchanged, when the package stopped shelling out to `bao`.
+ */
+/** ⚠️ Bun's hasher, not node:crypto — this runs under `bun --bun alchemy`. */
+/**
+ * The only form a policy body may be hashed or compared in.
+ *
+ * ⛔ OPENBAO STRIPS THE TRAILING NEWLINE AND THAT ALONE WAS A FOREVER-DIFF. MEASURED on the live
+ *   server: the assembler emits each fragment followed by a newline, so `homeflare-llm` goes in as
+ *   41 lines and `bao policy read` hands back 40 — identical text, one `\n` apart, two different
+ *   digests. Every plan therefore reported `update`, every deploy rewrote the same policy, and the
+ *   stack could never settle. It was invisible until the stack planned for the first time today.
+ *   ★ THE HTTP API HANDS BACK THE SAME STRIPPED TEXT. `bao policy read` printed `data.policy` of
+ *     `GET /v1/sys/policies/acl/<name>` (openbao v2.6.2 api/sys_policy.go:60-81), which is what
+ *     policy-wire.ts now reads directly — so the canonicalisation is still load-bearing.
+ *
+ * ⚠️ `trimEnd` ONLY. Leading and interior whitespace are part of the HCL and must not be touched —
+ *   a policy that differs by an indent really is a different document, and quietly folding that
+ *   away would hide an edit rather than a formatting artifact.
+ */
+export declare const canonical: (text: string) => string;
+export declare const sha256: (text: string) => string;
+//# sourceMappingURL=digest.d.ts.map

package/dist/openbao/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/openbao/digest.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,SAAU,MAAM,WAAmB,CAAC;AAE1D,eAAO,MAAM,MAAM,SAAU,MAAM,WACmC,CAAC"}

package/dist/openbao/fake-bao.d.ts

@@ -0,0 +1,40 @@
+/**
+ * A fake OpenBao for the tests beside it — `Bun.serve` on an ephemeral 127.0.0.1 port, or on a unix
+ * socket the way an agent listener can be.
+ *
+ * ⛔ TEST-ONLY, AND NEVER A REAL VAULT. No provider imports this file, it forwards nowhere, and every
+ *   helper below runs with an EXPLICIT environment rather than `process.env`, so a BAO_ADDR or
+ *   BAO_TOKEN in the shell running the tests can never be read or contacted.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoEnvironment } from './bao-address.ts';
+/** One request the fake received. */
+export type Seen = {
+    readonly method: string;
+    readonly path: string;
+    readonly headers: Headers;
+    readonly body: string;
+};
+/** What the fake answers: a status and a JSON value, or raw text for a body that is not JSON. */
+export type Reply = {
+    readonly status: number;
+    readonly json?: unknown;
+    readonly text?: string;
+};
+export type Fake = {
+    readonly address: string;
+    readonly seen: Seen[];
+    stop(): void;
+};
+/** ★ An answer may be async, so a test can HOLD requests open and count how many overlap. */
+type Answer = (seen: Seen) => Reply | Promise<Reply>;
+export declare const fakeBao: (answer: Answer, unix?: string) => Fake;
+/** Run `body` against a fresh fake, and stop it whatever happens. */
+export declare const withFake: (answer: Answer, body: (bao: Fake) => Promise<void>, unix?: string) => Promise<void>;
+/** The effect's success, through the real FetchHttpClient, under `env` only. */
+export declare const run: <A, E>(env: BaoEnvironment, effect: Effect.Effect<A, E, HttpClient.HttpClient>) => Promise<A>;
+/** The effect's failure — rejects if it succeeded. */
+export declare const runFailure: <A, E>(env: BaoEnvironment, effect: Effect.Effect<A, E, HttpClient.HttpClient>) => Promise<E>;
+export {};
+//# sourceMappingURL=fake-bao.d.ts.map

package/dist/openbao/fake-bao.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-bao.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-bao.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,qCAAqC;AACrC,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,KAAK,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAAC,IAAI,IAAI,IAAI,CAAA;CAAE,CAAC;AAErF,6FAA6F;AAC7F,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAErD,eAAO,MAAM,OAAO,WAAY,MAAM,SAAS,MAAM,KAAG,IAwBvD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,QAAQ,WACX,MAAM,QACR,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,SAC3B,MAAM,kBAQd,CAAC;AAKF,gFAAgF;AAChF,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,OACjB,cAAc,UACX,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,eACP,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,OACxB,cAAc,UACX,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,eACM,CAAC"}