@homeflare/alchemy 0.1.0

package/dist/openbao/index.js

@@ -0,0 +1,1158 @@
+// src/openbao/auth-role.ts
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect2 from "effect/Effect";
+
+// src/openbao/digest.ts
+var canonical = (text) => text.trimEnd();
+var sha256 = (text) => new Bun.CryptoHasher("sha256").update(canonical(text)).digest("hex");
+
+// src/openbao/mount-form.ts
+var mountPath = (path) => path.replace(/\/+$/, "");
+var DURATION = /^(\d+)([smhd])$/;
+var parseDuration = (text) => {
+  const trimmed = text.trim();
+  if (trimmed === "0")
+    return 0;
+  const match = DURATION.exec(trimmed);
+  if (match === null)
+    return;
+  const amount = Number(match[1]);
+  switch (match[2]) {
+    case "s":
+      return amount;
+    case "m":
+      return amount * 60;
+    case "h":
+      return amount * 3600;
+    case "d":
+      return amount * 86400;
+    default:
+      return;
+  }
+};
+var ttlSeconds = (value) => {
+  if (typeof value === "number" && Number.isFinite(value))
+    return value;
+  if (typeof value === "string")
+    return parseDuration(value);
+  return;
+};
+var configOf = (live) => typeof live["config"] === "object" && live["config"] !== null ? live["config"] : {};
+var text = (value) => typeof value === "string" ? value : "";
+var ttlProp = (seconds, fallback = "") => {
+  if (seconds === undefined)
+    return fallback;
+  if (seconds % 86400 === 0)
+    return `${String(seconds / 86400)}d`;
+  if (seconds % 3600 === 0)
+    return `${String(seconds / 3600)}h`;
+  if (seconds % 60 === 0)
+    return `${String(seconds / 60)}m`;
+  return `${String(seconds)}s`;
+};
+var attributesOf = (props, live) => {
+  const config = configOf(live);
+  const defaultLeaseTtl = ttlProp(ttlSeconds(config["default_lease_ttl"]));
+  const maxLeaseTtl = ttlProp(ttlSeconds(config["max_lease_ttl"]));
+  const attrs = {
+    path: mountPath(props.path),
+    type: text(live["type"]) || props.type,
+    description: text(live["description"]),
+    defaultLeaseTtl,
+    maxLeaseTtl
+  };
+  return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
+};
+var readPath = (path) => `sys/mounts/${mountPath(path)}`;
+var tunePath = (path) => `${readPath(path)}/tune`;
+var enableBody = (props) => props.version === 2 ? { options: { version: "2" }, type: props.type } : { type: props.type };
+var tuneBody = (props) => {
+  const body = {};
+  if (props.description !== undefined)
+    body["description"] = props.description;
+  if (props.defaultLeaseTtl !== undefined)
+    body["default_lease_ttl"] = props.defaultLeaseTtl;
+  if (props.maxLeaseTtl !== undefined)
+    body["max_lease_ttl"] = props.maxLeaseTtl;
+  return body;
+};
+var sameTtl = (want, have) => {
+  if (want === undefined)
+    return true;
+  const wantSeconds = ttlSeconds(want);
+  const haveSeconds = ttlSeconds(have);
+  return wantSeconds !== undefined && wantSeconds === haveSeconds;
+};
+var matches = (attributes, props) => attributes.type === props.type && (props.description === undefined || attributes.description === props.description) && sameTtl(props.defaultLeaseTtl, attributes.defaultLeaseTtl) && sameTtl(props.maxLeaseTtl, attributes.maxLeaseTtl);
+var wantsTune = (props) => props.description !== undefined || props.defaultLeaseTtl !== undefined || props.maxLeaseTtl !== undefined;
+
+// src/openbao/auth-role-form.ts
+var policiesOf = (live) => {
+  const raw = live["token_policies"];
+  if (!Array.isArray(raw))
+    return [];
+  return raw.filter((entry) => typeof entry === "string").slice().sort();
+};
+var bool = (value, fallback) => typeof value === "boolean" ? value : fallback;
+var int = (value, fallback) => typeof value === "number" && Number.isFinite(value) ? value : fallback;
+var ttlText = (seconds, fallback = "") => {
+  if (seconds === undefined)
+    return fallback;
+  if (seconds % 86400 === 0)
+    return `${String(seconds / 86400)}d`;
+  if (seconds % 3600 === 0)
+    return `${String(seconds / 3600)}h`;
+  if (seconds % 60 === 0)
+    return `${String(seconds / 60)}m`;
+  return `${String(seconds)}s`;
+};
+var attributesOf2 = (props, live) => {
+  const attrs = {
+    name: props.name,
+    tokenPolicies: policiesOf(live),
+    tokenTtl: ttlText(ttlSeconds(live["token_ttl"])),
+    tokenMaxTtl: ttlText(ttlSeconds(live["token_max_ttl"])),
+    secretIdTtl: ttlText(ttlSeconds(live["secret_id_ttl"]), "0"),
+    bindSecretId: bool(live["bind_secret_id"], true),
+    secretIdNumUses: int(live["secret_id_num_uses"], 0)
+  };
+  return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
+};
+var readPath2 = (name) => `auth/approle/role/${name}`;
+var writeBody = (props) => {
+  const body = {
+    token_policies: props.tokenPolicies.join(","),
+    token_ttl: props.tokenTtl,
+    token_max_ttl: props.tokenMaxTtl,
+    secret_id_ttl: props.secretIdTtl
+  };
+  if (props.bindSecretId !== undefined)
+    body["bind_secret_id"] = String(props.bindSecretId);
+  if (props.secretIdNumUses !== undefined) {
+    body["secret_id_num_uses"] = String(props.secretIdNumUses);
+  }
+  return body;
+};
+var samePolicies = (want, have) => want.length === have.length && want.every((policy, index) => policy === have[index]);
+var sameTtl2 = (want, have) => {
+  const wantSeconds = parseDuration(want);
+  const haveSeconds = ttlSeconds(have);
+  return wantSeconds !== undefined && wantSeconds === haveSeconds;
+};
+var matches2 = (attributes, props) => {
+  const wantPolicies = props.tokenPolicies.slice().sort();
+  return samePolicies(wantPolicies, attributes.tokenPolicies) && sameTtl2(props.tokenTtl, attributes.tokenTtl) && sameTtl2(props.tokenMaxTtl, attributes.tokenMaxTtl) && sameTtl2(props.secretIdTtl, attributes.secretIdTtl) && (props.bindSecretId === undefined || attributes.bindSecretId === props.bindSecretId) && (props.secretIdNumUses === undefined || attributes.secretIdNumUses === props.secretIdNumUses);
+};
+
+// src/openbao/bao-http.ts
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Semaphore from "effect/Semaphore";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Headers from "effect/unstable/http/Headers";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+
+// src/openbao/bao-address.ts
+var DEFAULT_ADDRESS = "https://127.0.0.1:8200";
+var UNIX = "unix://";
+var readBaoVariable = (env, name) => env[name] ?? env[`VAULT_${name.slice("BAO_".length)}`] ?? "";
+var resolveAddress = (env) => {
+  const agent = readBaoVariable(env, "BAO_AGENT_ADDR");
+  const direct = readBaoVariable(env, "BAO_ADDR");
+  const raw = agent !== "" ? agent : direct !== "" ? direct : DEFAULT_ADDRESS;
+  const namespace = readBaoVariable(env, "BAO_NAMESPACE");
+  const socket = raw.startsWith(UNIX) ? raw.slice(UNIX.length) : undefined;
+  return {
+    base: socket === undefined ? raw.replace(/\/+$/, "") : "http://localhost",
+    namespace: namespace === "" ? undefined : namespace,
+    socket
+  };
+};
+var headersFor = (address, env) => {
+  const headers = { "X-Vault-Request": "true" };
+  if (address.namespace !== undefined)
+    headers["X-Vault-Namespace"] = address.namespace;
+  const token = readBaoVariable(env, "BAO_TOKEN");
+  if (token !== "")
+    headers["X-Vault-Token"] = token;
+  return headers;
+};
+
+// src/openbao/bao-status.ts
+class BaoError extends Error {
+  status;
+  method;
+  path;
+  errors;
+  constructor(status, method, path, errors) {
+    const code = status === 0 ? "no response" : String(status);
+    super(`OpenBao ${method} /v1/${path} -> ${code}: ${errors.join("; ") || "(no errors given)"}`);
+    this.status = status;
+    this.method = method;
+    this.path = path;
+    this.errors = errors;
+    this.name = "BaoError";
+  }
+}
+var objectOf = (text2) => {
+  try {
+    const parsed = JSON.parse(text2);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : undefined;
+  } catch {
+    return;
+  }
+};
+var errorsOf = (text2) => {
+  const raw = objectOf(text2)?.["errors"];
+  return Array.isArray(raw) && raw.every((entry) => typeof entry === "string") ? raw : undefined;
+};
+var settle = (intent, method, path, status, text2) => {
+  const fail = (errors) => ({
+    error: new BaoError(status, method, path, errors)
+  });
+  if (status < 200 || status >= 300) {
+    const errors = errorsOf(text2);
+    if (errors === undefined) {
+      return fail([`not an OpenBao error body (${String(text2.length)} bytes)`]);
+    }
+    if (status === 404 && intent !== "write")
+      return { body: undefined };
+    return fail(errors);
+  }
+  if (text2.trim() === "") {
+    return intent === "read" ? fail(["a successful read with an empty body"]) : { body: undefined };
+  }
+  const body = objectOf(text2);
+  return body === undefined ? fail(["a success body that is not a JSON object"]) : { body };
+};
+
+// src/openbao/bao-http.ts
+var BaoEnv = Context.Reference("homeflare/openbao/BaoEnv", {
+  defaultValue: () => process.env
+});
+var MAX_IN_FLIGHT = 8;
+var BaoGate = Context.Reference("homeflare/openbao/BaoGate", {
+  defaultValue: () => Semaphore.makeUnsafe(MAX_IN_FLIGHT)
+});
+var TIMEOUT = "60 seconds";
+var redactingToken = (effect) => Effect.gen(function* () {
+  const names = yield* Headers.CurrentRedactedNames;
+  return yield* Effect.provideService(effect, Headers.CurrentRedactedNames, [
+    ...names,
+    "x-vault-token"
+  ]);
+});
+var overSocket = (socket, method, path) => (effect) => {
+  if (socket === undefined)
+    return effect;
+  if (typeof Bun === "undefined") {
+    return Effect.fail(new BaoError(0, method, path, ["a unix:// address needs Bun fetch; this is not Bun"]));
+  }
+  return Effect.flatMap(Effect.serviceOption(FetchHttpClient.RequestInit), (defaults) => {
+    const init = { ...Option.getOrElse(defaults, () => ({})), unix: socket };
+    return Effect.provideService(effect, FetchHttpClient.RequestInit, init);
+  });
+};
+var baoCall = (intent, method, path, body) => Effect.gen(function* () {
+  const env = yield* BaoEnv;
+  const address = resolveAddress(env);
+  const client = yield* HttpClient.HttpClient;
+  const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(HttpClientRequest.setHeaders(headersFor(address, env)), body === undefined ? (self) => self : HttpClientRequest.bodyText(JSON.stringify(body), "application/json"));
+  const exchange = client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text3) => ({ status: response.status, text: text3 }))), Effect.timeout(TIMEOUT), Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])));
+  const gate = yield* BaoGate;
+  const { status, text: text2 } = yield* exchange.pipe(overSocket(address.socket, method, path), redactingToken, Semaphore.withPermits(gate, 1));
+  const outcome = settle(intent, method, path, status, text2);
+  return "error" in outcome ? yield* Effect.fail(outcome.error) : outcome.body;
+});
+var baoRead = (path) => Effect.map(baoCall("read", "GET", path), (body) => {
+  if (body === undefined)
+    return;
+  const data = body["data"];
+  return typeof data === "object" && data !== null ? data : body;
+});
+var baoWrite = (method, path, body) => Effect.asVoid(baoCall("write", method, path, body));
+var baoDelete = (path) => Effect.asVoid(baoCall("delete", "DELETE", path));
+
+// src/openbao/auth-role.ts
+var BaoAuthRole = Resource("Bao.AuthRole", {
+  defaultRemovalPolicy: "retain"
+});
+var readRole = (props) => Effect2.gen(function* () {
+  const live = yield* baoRead(readPath2(props.name));
+  if (live === undefined)
+    return;
+  return attributesOf2(props, live);
+});
+var BaoAuthRoleProvider = () => Provider.effect(BaoAuthRole, Effect2.succeed(BaoAuthRole.Provider.of({
+  list: () => Effect2.succeed([]),
+  read: Effect2.fn(function* ({ olds }) {
+    return yield* readRole(olds);
+  }),
+  diff: Effect2.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved(news))
+      return;
+    const live = yield* readRole(news);
+    if (live === undefined)
+      return { action: "update" };
+    if (matches2(live, news))
+      return { action: "noop" };
+    return { action: "update" };
+  }),
+  reconcile: Effect2.fn(function* ({ news }) {
+    const live = yield* readRole(news);
+    if (live === undefined || !matches2(live, news)) {
+      yield* baoWrite("PUT", readPath2(news.name), writeBody(news));
+    }
+    const after = yield* readRole(news);
+    if (after === undefined) {
+      return yield* Effect2.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
+    }
+    return after;
+  }),
+  delete: Effect2.fn(function* ({ output }) {
+    yield* baoDelete(readPath2(output.name));
+    return;
+  })
+})));
+// src/openbao/cloudflare-role.ts
+import { Resource as Resource2 } from "alchemy";
+import { isResolved as isResolved2 } from "alchemy/Diff";
+import * as Provider2 from "alchemy/Provider";
+import * as Effect5 from "effect/Effect";
+
+// src/openbao/cloudflare-group-scope.ts
+var GROUP_SCOPES = {
+  account: "com.cloudflare.api.account",
+  bucket: "com.cloudflare.edge.r2.bucket",
+  zone: "com.cloudflare.api.account.zone"
+};
+var scopeOfResource = (resource) => {
+  const scopes = [GROUP_SCOPES.zone, GROUP_SCOPES.bucket, GROUP_SCOPES.account];
+  return scopes.find((scope) => resource.startsWith(`${scope}.`)) ?? resource;
+};
+var groupKey = (name, scope) => `${scope} ${name}`;
+
+// src/openbao/cloudflare-permission-groups.ts
+import * as Context2 from "effect/Context";
+import * as Effect4 from "effect/Effect";
+
+// src/openbao/cloudflare-policy.ts
+var resolvePolicies = (declared, ids) => {
+  const missing = new Set;
+  const policies = declared.map((policy) => {
+    const scope = policy.scope ?? scopeOfResource(policy.resource);
+    const groupIds = policy.groups.flatMap((name) => {
+      const id = ids.get(groupKey(name, scope));
+      if (id === undefined)
+        missing.add(name);
+      return id === undefined ? [] : [id];
+    });
+    return {
+      effect: policy.effect,
+      groupIds: policy.groupOrder === "by-id" ? [...groupIds].sort() : groupIds,
+      groupOrder: policy.groupOrder,
+      resources: { [policy.resource]: "*" }
+    };
+  });
+  return { missing: [...missing].sort(), policies };
+};
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var stringMap = (value) => {
+  if (!isRecord(value))
+    return;
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (typeof item !== "string")
+      return;
+    out[key] = item;
+  }
+  return out;
+};
+var entryOf = (entry) => {
+  if (!isRecord(entry) || typeof entry["effect"] !== "string")
+    return;
+  const resources = stringMap(entry["resources"]);
+  const groups = entry["permission_groups"];
+  if (resources === undefined || !Array.isArray(groups))
+    return;
+  const groupIds = groups.flatMap((group) => isRecord(group) && typeof group["id"] === "string" ? [group["id"]] : []);
+  return groupIds.length === groups.length ? { effect: entry["effect"], groupIds, resources } : undefined;
+};
+var parseLivePolicies = (raw) => {
+  if (typeof raw !== "string")
+    return;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  if (!Array.isArray(parsed))
+    return;
+  const policies = parsed.map(entryOf);
+  return policies.every((policy) => policy !== undefined) ? policies : undefined;
+};
+var policiesJson = (policies) => JSON.stringify(policies.map((policy) => ({
+  effect: policy.effect,
+  resources: policy.resources,
+  permission_groups: policy.groupIds.map((id) => ({ id }))
+})));
+var sameList = (a, b) => a.length === b.length && a.every((item, i) => item === b[i]);
+var sameResources = (a, b) => {
+  const keys = Object.keys(a);
+  return keys.length === Object.keys(b).length && keys.every((key) => a[key] === b[key]);
+};
+var samePolicies2 = (want, have) => want.length === have.length && want.every((w, i) => {
+  const h = have[i];
+  if (h === undefined || w.effect !== h.effect || !sameResources(w.resources, h.resources)) {
+    return false;
+  }
+  return w.groupOrder === "by-id" ? sameList([...w.groupIds].sort(), [...h.groupIds].sort()) : sameList(w.groupIds, h.groupIds);
+});
+
+// src/openbao/cloudflare-role-wire.ts
+import * as Effect3 from "effect/Effect";
+
+// src/openbao/cloudflare-role-form.ts
+var rolePath = (mount, name) => `${mountPath(mount)}/roles/${name}`;
+var seconds = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
+var liveRoleOf = (data) => ({
+  description: typeof data["description"] === "string" ? data["description"] : "",
+  maxTtl: seconds(data["max_ttl"]),
+  name: typeof data["name"] === "string" ? data["name"] : "",
+  policies: parseLivePolicies(data["policies"]),
+  policiesText: typeof data["policies"] === "string" ? data["policies"] : "",
+  ttl: seconds(data["ttl"])
+});
+var attributesOf3 = (props, live) => {
+  const attrs = {
+    description: live.description,
+    maxTtl: live.maxTtl ?? 0,
+    mount: mountPath(props.mount),
+    name: live.name || props.name,
+    policies: live.policiesText,
+    ttl: live.ttl ?? 0
+  };
+  return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
+};
+var refusalOf = (props) => {
+  const bad = [
+    ...parseDuration(props.ttl) === undefined ? [`ttl=${props.ttl}`] : [],
+    ...parseDuration(props.maxTtl) === undefined ? [`maxTtl=${props.maxTtl}`] : []
+  ];
+  if (bad.length > 0)
+    return `unparseable duration ${bad.join(", ")} (use 30s / 5m / 1h / 1d)`;
+  if (props.policies.length === 0)
+    return "no policy entries";
+  if (props.policies.some((policy) => policy.groups.length === 0))
+    return "a policy with no groups";
+  return;
+};
+var writeBody2 = (props, policies) => ({
+  description: props.description,
+  max_ttl: props.maxTtl,
+  policies: policiesJson(policies),
+  ttl: props.ttl
+});
+var sameTtl3 = (want, have) => {
+  const wantSeconds = parseDuration(want);
+  return wantSeconds !== undefined && wantSeconds === have;
+};
+var differences = (props, policies, live) => {
+  const out = [];
+  if (props.description !== live.description) {
+    out.push({ field: "description", have: live.description, want: props.description });
+  }
+  if (!sameTtl3(props.ttl, live.ttl)) {
+    out.push({ field: "ttl", have: String(live.ttl), want: props.ttl });
+  }
+  if (!sameTtl3(props.maxTtl, live.maxTtl)) {
+    out.push({ field: "max_ttl", have: String(live.maxTtl), want: props.maxTtl });
+  }
+  if (live.policies === undefined || !samePolicies2(policies, live.policies)) {
+    out.push({ field: "policies", have: live.policiesText, want: policiesJson(policies) });
+  }
+  return out;
+};
+
+// src/openbao/cloudflare-role-wire.ts
+var readCloudflareRole = (mount, name) => Effect3.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
+var writeCloudflareRole = (mount, name, body) => baoWrite("PUT", rolePath(mount, name), body);
+var deleteCloudflareRole = (mount, name) => baoDelete(rolePath(mount, name));
+
+// src/openbao/cloudflare-permission-groups.ts
+class CloudflarePermissionGroups extends Context2.Service()("homeflare/openbao/CloudflarePermissionGroups") {
+}
+
+// src/openbao/cloudflare-role.ts
+var BaoCloudflareRole = Resource2("Bao.CloudflareRole", {
+  defaultRemovalPolicy: "retain"
+});
+var BaoCloudflareRoleProvider = () => Provider2.effect(BaoCloudflareRole, Effect5.gen(function* () {
+  const groups = yield* CloudflarePermissionGroups;
+  const resolved = (props) => Effect5.gen(function* () {
+    const refs = new Map;
+    for (const policy of props.policies) {
+      const scope = policy.scope ?? scopeOfResource(policy.resource);
+      for (const name of policy.groups)
+        refs.set(groupKey(name, scope), { name, scope });
+    }
+    const ids = yield* groups.resolve(props.mount, [...refs.values()]);
+    const { missing, policies } = resolvePolicies(props.policies, ids);
+    if (missing.length > 0) {
+      return yield* Effect5.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
+    }
+    return policies;
+  });
+  return BaoCloudflareRole.Provider.of({
+    list: () => Effect5.succeed([]),
+    read: Effect5.fn(function* ({ olds }) {
+      const live = yield* readCloudflareRole(olds.mount, olds.name);
+      return live === undefined ? undefined : attributesOf3(olds, live);
+    }),
+    diff: Effect5.fn(function* ({ news, output }) {
+      if (output === undefined || !isResolved2(news))
+        return;
+      if (refusalOf(news) !== undefined)
+        return { action: "update" };
+      const policies = yield* resolved(news);
+      const live = yield* readCloudflareRole(news.mount, news.name);
+      if (live === undefined)
+        return { action: "update" };
+      return differences(news, policies, live).length === 0 ? { action: "noop" } : { action: "update" };
+    }),
+    reconcile: Effect5.fn(function* ({ news }) {
+      const path = rolePath(news.mount, news.name);
+      const refusal = refusalOf(news);
+      if (refusal !== undefined) {
+        return yield* Effect5.die(new Error(`Bao.CloudflareRole ${path}: ${refusal}.`));
+      }
+      const policies = yield* resolved(news);
+      const live = yield* readCloudflareRole(news.mount, news.name);
+      if (live === undefined || differences(news, policies, live).length > 0) {
+        yield* writeCloudflareRole(news.mount, news.name, writeBody2(news, policies));
+      }
+      const after = yield* readCloudflareRole(news.mount, news.name);
+      if (after === undefined) {
+        return yield* Effect5.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
+      }
+      const left = differences(news, policies, after);
+      if (left.length > 0) {
+        return yield* Effect5.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
+      }
+      return attributesOf3(news, after);
+    }),
+    delete: Effect5.fn(function* ({ output }) {
+      yield* deleteCloudflareRole(output.mount, output.name);
+      return;
+    })
+  });
+}));
+// src/openbao/mount.ts
+import { Resource as Resource3 } from "alchemy";
+import { isResolved as isResolved3 } from "alchemy/Diff";
+import * as Provider3 from "alchemy/Provider";
+import * as Effect7 from "effect/Effect";
+
+// src/openbao/mount-wire.ts
+import * as Effect6 from "effect/Effect";
+var absentFromTable = (path, asked) => baoRead("sys/mounts").pipe(Effect6.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+  ...asked.errors,
+  `sys/mounts could not confirm the mount is absent: ${listing.message}`
+])), Effect6.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect6.succeed(undefined) : Effect6.fail(asked)));
+var readMountData = (path) => baoRead(readPath(path)).pipe(Effect6.catchIf((error) => error.status === 400, (error) => absentFromTable(path, error)));
+var enableMount = (props) => baoWrite("POST", readPath(props.path), enableBody(props));
+var tuneMount = (props) => baoWrite("POST", tunePath(props.path), tuneBody(props));
+var disableMount = (path) => baoDelete(readPath(path));
+
+// src/openbao/mount.ts
+var BaoMount = Resource3("Bao.Mount", {
+  defaultRemovalPolicy: "retain"
+});
+var readMount = (props) => Effect7.gen(function* () {
+  const live = yield* readMountData(props.path);
+  if (live === undefined)
+    return;
+  return attributesOf(props, live);
+});
+var BaoMountProvider = () => Provider3.effect(BaoMount, Effect7.succeed(BaoMount.Provider.of({
+  list: () => Effect7.succeed([]),
+  read: Effect7.fn(function* ({ olds }) {
+    return yield* readMount(olds);
+  }),
+  diff: Effect7.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved3(news))
+      return;
+    const live = yield* readMount(news);
+    if (live === undefined)
+      return { action: "update" };
+    if (live.type !== news.type)
+      return { action: "replace" };
+    if (matches(live, news))
+      return { action: "noop" };
+    return { action: "update" };
+  }),
+  reconcile: Effect7.fn(function* ({ news }) {
+    let live = yield* readMount(news);
+    if (live === undefined) {
+      yield* enableMount(news);
+      if (wantsTune(news))
+        yield* tuneMount(news);
+    } else if (!matches(live, news)) {
+      if (live.type !== news.type) {
+        return yield* Effect7.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
+      }
+      yield* tuneMount(news);
+    }
+    live = yield* readMount(news);
+    if (live === undefined) {
+      return yield* Effect7.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
+    }
+    return live;
+  }),
+  delete: Effect7.fn(function* ({ output }) {
+    yield* disableMount(output.path);
+    return;
+  })
+})));
+// src/openbao/pki-role.ts
+import { Resource as Resource4 } from "alchemy";
+import { isResolved as isResolved4 } from "alchemy/Diff";
+import * as Provider4 from "alchemy/Provider";
+import * as Effect8 from "effect/Effect";
+
+// src/openbao/pki-role-form.ts
+var sorted = (values) => [...values].sort();
+var foldedUsages = (values) => sorted(values.map((v) => v.toLowerCase()));
+var canonical2 = (input) => ({
+  allowBareDomains: input.allowBareDomains,
+  allowGlobDomains: input.allowGlobDomains,
+  allowIpSans: input.allowIpSans,
+  allowLocalhost: input.allowLocalhost,
+  allowSubdomains: input.allowSubdomains,
+  allowWildcardCertificates: input.allowWildcardCertificates,
+  allowedDomains: sorted(input.allowedDomains),
+  clientFlag: input.clientFlag,
+  cnValidations: sorted(input.cnValidations),
+  extKeyUsage: foldedUsages(input.extKeyUsage),
+  keyBits: input.keyBits,
+  keyType: input.keyType,
+  maxTtlSeconds: input.maxTtlSeconds,
+  serverFlag: input.serverFlag,
+  signatureBits: input.signatureBits,
+  ttlSeconds: input.ttlSeconds
+});
+var seconds2 = (text2) => parseDuration(text2) ?? -1;
+var canonicalFromProps = (props) => canonical2({
+  allowBareDomains: props.allowBareDomains ?? false,
+  allowGlobDomains: props.allowGlobDomains ?? false,
+  allowIpSans: props.allowIpSans ?? false,
+  allowLocalhost: props.allowLocalhost ?? false,
+  allowSubdomains: props.allowSubdomains ?? false,
+  allowWildcardCertificates: props.allowWildcardCertificates ?? false,
+  allowedDomains: props.allowedDomains,
+  clientFlag: props.clientFlag ?? true,
+  cnValidations: props.cnValidations ?? ["hostname"],
+  extKeyUsage: props.extKeyUsage ?? [],
+  keyBits: props.keyBits ?? 0,
+  keyType: props.keyType ?? "rsa",
+  maxTtlSeconds: seconds2(props.maxTtl),
+  serverFlag: props.serverFlag ?? true,
+  signatureBits: props.signatureBits ?? 0,
+  ttlSeconds: seconds2(props.ttl)
+});
+var bool2 = (value, fallback) => typeof value === "boolean" ? value : fallback;
+var int2 = (value, fallback) => typeof value === "number" && Number.isFinite(value) ? value : fallback;
+var list = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var str = (value, fallback) => typeof value === "string" ? value : fallback;
+var canonicalFromLive = (live) => canonical2({
+  allowBareDomains: bool2(live["allow_bare_domains"], false),
+  allowGlobDomains: bool2(live["allow_glob_domains"], false),
+  allowIpSans: bool2(live["allow_ip_sans"], false),
+  allowLocalhost: bool2(live["allow_localhost"], false),
+  allowSubdomains: bool2(live["allow_subdomains"], false),
+  allowWildcardCertificates: bool2(live["allow_wildcard_certificates"], false),
+  allowedDomains: list(live["allowed_domains"]),
+  clientFlag: bool2(live["client_flag"], true),
+  cnValidations: list(live["cn_validations"]),
+  extKeyUsage: list(live["ext_key_usage"]),
+  keyBits: int2(live["key_bits"], 0),
+  keyType: str(live["key_type"], "rsa"),
+  maxTtlSeconds: ttlSeconds(live["max_ttl"]) ?? -1,
+  serverFlag: bool2(live["server_flag"], true),
+  signatureBits: int2(live["signature_bits"], 0),
+  ttlSeconds: ttlSeconds(live["ttl"]) ?? -1
+});
+var ttlText2 = (value) => {
+  if (value < 0)
+    return "";
+  if (value !== 0 && value % 86400 === 0)
+    return `${String(value / 86400)}d`;
+  if (value !== 0 && value % 3600 === 0)
+    return `${String(value / 3600)}h`;
+  if (value !== 0 && value % 60 === 0)
+    return `${String(value / 60)}m`;
+  return `${String(value)}s`;
+};
+var digestOf = (form) => sha256(JSON.stringify(form));
+var rolePath2 = (props) => `${mountPath(props.mount ?? "pki")}/roles/${props.name}`;
+var attributesOf4 = (props, live) => {
+  const form = canonicalFromLive(live);
+  return {
+    ...form,
+    name: props.name,
+    mount: mountPath(props.mount ?? "pki"),
+    ttl: ttlText2(form.ttlSeconds),
+    maxTtl: ttlText2(form.maxTtlSeconds),
+    digest: digestOf(form)
+  };
+};
+var writeBody3 = (props) => {
+  const form = canonicalFromProps(props);
+  const body = {
+    allowed_domains: form.allowedDomains.join(","),
+    allow_bare_domains: String(form.allowBareDomains),
+    allow_glob_domains: String(form.allowGlobDomains),
+    allow_subdomains: String(form.allowSubdomains),
+    allow_ip_sans: String(form.allowIpSans),
+    allow_localhost: String(form.allowLocalhost),
+    allow_wildcard_certificates: String(form.allowWildcardCertificates),
+    cn_validations: form.cnValidations.join(","),
+    client_flag: String(form.clientFlag),
+    server_flag: String(form.serverFlag),
+    key_type: form.keyType,
+    key_bits: String(form.keyBits),
+    signature_bits: String(form.signatureBits),
+    ttl: props.ttl,
+    max_ttl: props.maxTtl
+  };
+  const usages = props.extKeyUsage ?? [];
+  if (usages.length > 0)
+    body["ext_key_usage"] = usages.join(",");
+  return body;
+};
+var matches3 = (attributes, props) => attributes.digest === digestOf(canonicalFromProps(props));
+
+// src/openbao/pki-role.ts
+var BaoPkiRole = Resource4("Bao.PkiRole", {
+  defaultRemovalPolicy: "retain"
+});
+var readRole2 = (props) => Effect8.gen(function* () {
+  const live = yield* baoRead(rolePath2(props));
+  if (live === undefined)
+    return;
+  return attributesOf4(props, live);
+});
+var badDurations = (props) => [["ttl", props.ttl], ["maxTtl", props.maxTtl]].filter(([, text2]) => parseDuration(text2) === undefined);
+var BaoPkiRoleProvider = () => Provider4.effect(BaoPkiRole, Effect8.succeed(BaoPkiRole.Provider.of({
+  list: () => Effect8.succeed([]),
+  read: Effect8.fn(function* ({ olds }) {
+    return yield* readRole2(olds);
+  }),
+  diff: Effect8.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved4(news))
+      return;
+    if (mountPath(news.mount ?? "pki") !== output.mount)
+      return { action: "replace" };
+    if (news.allowedDomains.length === 0 || badDurations(news).length > 0) {
+      return { action: "update" };
+    }
+    const live = yield* readRole2(news);
+    if (live === undefined)
+      return { action: "update" };
+    return matches3(live, news) ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: Effect8.fn(function* ({ news }) {
+    const path = rolePath2(news);
+    if (news.allowedDomains.length === 0) {
+      return yield* Effect8.die(new Error(`Bao.PkiRole ${path}: allowedDomains is empty. With allow_any_name false ` + "that role can issue no certificate at all."));
+    }
+    const bad = badDurations(news);
+    if (bad.length > 0) {
+      return yield* Effect8.die(new Error(`Bao.PkiRole ${path}: ${bad.map(([k, v]) => `${k}=${v}`).join(", ")} ` + "is not a duration OpenBao parses (expect 30m, 720h, 8760h or 0)."));
+    }
+    const live = yield* readRole2(news);
+    if (live === undefined || !matches3(live, news)) {
+      yield* baoWrite("PUT", path, writeBody3(news));
+    }
+    const after = yield* readRole2(news);
+    if (after === undefined) {
+      return yield* Effect8.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
+    }
+    if (!matches3(after, news)) {
+      return yield* Effect8.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
+    }
+    return after;
+  }),
+  delete: Effect8.fn(function* ({ output }) {
+    yield* baoDelete(rolePath2(output));
+    return;
+  })
+})));
+// src/openbao/policy.ts
+import { Resource as Resource5 } from "alchemy";
+import { isResolved as isResolved5 } from "alchemy/Diff";
+import * as Provider5 from "alchemy/Provider";
+import * as Effect10 from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+
+// src/openbao/policy-assembly.ts
+var isEmptyAssembly = (parts, joined) => parts === 0 || !/^\s*path\s+"/m.test(joined);
+
+// src/openbao/policy-wire.ts
+import * as Effect9 from "effect/Effect";
+var policyPath = (name) => `sys/policies/acl/${name}`;
+var readPolicy = (name) => Effect9.flatMap(baoRead(policyPath(name)), (data) => {
+  if (data === undefined)
+    return Effect9.succeed("");
+  const text2 = data["policy"];
+  return typeof text2 === "string" ? Effect9.succeed(text2) : Effect9.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
+});
+var writePolicy = (name, hcl) => baoWrite("PUT", policyPath(name), { policy: hcl });
+var deletePolicy = (name) => baoDelete(policyPath(name));
+
+// src/openbao/policy.ts
+var BaoPolicy = Resource5("Bao.Policy", {
+  defaultRemovalPolicy: "retain"
+});
+var grantsOf = (hcl) => (hcl.match(/^path /gm) ?? []).length;
+var attributesOf5 = (name, hcl, parts) => ({
+  name,
+  digest: sha256(hcl),
+  grants: grantsOf(hcl),
+  parts
+});
+var BaoPolicyProvider = () => Provider5.effect(BaoPolicy, Effect10.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const assemble = (dir) => Effect10.gen(function* () {
+    const entries = (yield* fs.readDirectory(dir)).filter((f) => f.endsWith(".hcl")).sort();
+    let joined = "";
+    for (const f of entries)
+      joined += `${yield* fs.readFileString(path.join(dir, f))}
+`;
+    return { joined, parts: entries.length };
+  });
+  return BaoPolicy.Provider.of({
+    list: () => Effect10.succeed([]),
+    read: Effect10.fn(function* ({ olds }) {
+      const live = yield* readPolicy(olds.name);
+      return live.length === 0 ? undefined : attributesOf5(olds.name, live, 0);
+    }),
+    diff: Effect10.fn(function* ({ news, output }) {
+      if (output === undefined || !isResolved5(news))
+        return;
+      const { joined } = yield* assemble(news.fragments);
+      const live = yield* readPolicy(news.name);
+      return live.length > 0 && sha256(live) === sha256(joined) ? { action: "noop" } : { action: "update" };
+    }),
+    reconcile: Effect10.fn(function* ({ news }) {
+      const name = news.name;
+      const { joined, parts } = yield* assemble(news.fragments);
+      if (isEmptyAssembly(parts, joined))
+        return yield* Effect10.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
+      const current = yield* readPolicy(name);
+      if (current.length > 0 && sha256(current) === sha256(joined)) {
+        return attributesOf5(name, joined, parts);
+      }
+      yield* writePolicy(name, joined);
+      return attributesOf5(name, joined, parts);
+    }),
+    delete: Effect10.fn(function* ({ output }) {
+      yield* deletePolicy(output.name);
+      return;
+    })
+  });
+}));
+// src/openbao/proxmox-role.ts
+import { Resource as Resource6 } from "alchemy";
+import { isResolved as isResolved6 } from "alchemy/Diff";
+import * as Provider6 from "alchemy/Provider";
+import * as Effect11 from "effect/Effect";
+
+// src/openbao/proxmox-role-form.ts
+var text2 = (value) => typeof value === "string" ? value : "";
+var ttlText3 = (seconds3, fallback = "0") => {
+  if (seconds3 === undefined)
+    return fallback;
+  if (seconds3 % 86400 === 0)
+    return `${String(seconds3 / 86400)}d`;
+  if (seconds3 % 3600 === 0)
+    return `${String(seconds3 / 3600)}h`;
+  if (seconds3 % 60 === 0)
+    return `${String(seconds3 / 60)}m`;
+  return `${String(seconds3)}s`;
+};
+var rolePath3 = (mount, name) => `${mountPath(mount)}/roles/${name}`;
+var attributesOf6 = (props, live) => {
+  const attrs = {
+    mount: mountPath(props.mount),
+    name: text2(live["name"]) || props.name,
+    mintUser: text2(live["mint_user"]),
+    ttl: ttlText3(ttlSeconds(live["ttl"])),
+    maxTtl: ttlText3(ttlSeconds(live["max_ttl"]))
+  };
+  return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
+};
+var writeBody4 = (props) => {
+  const ttl = parseDuration(props.ttl);
+  const maxTtl = parseDuration(props.maxTtl);
+  const bad = [];
+  if (ttl === undefined)
+    bad.push(`ttl=${props.ttl}`);
+  if (maxTtl === undefined)
+    bad.push(`maxTtl=${props.maxTtl}`);
+  if (ttl === undefined || maxTtl === undefined)
+    return { ok: false, bad };
+  return {
+    ok: true,
+    body: { mint_user: props.mintUser, ttl: String(ttl), max_ttl: String(maxTtl) }
+  };
+};
+var sameTtl4 = (want, have) => {
+  const wantSeconds = parseDuration(want);
+  const haveSeconds = ttlSeconds(have);
+  return wantSeconds !== undefined && wantSeconds === haveSeconds;
+};
+var matches4 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl4(props.ttl, attributes.ttl) && sameTtl4(props.maxTtl, attributes.maxTtl);
+
+// src/openbao/proxmox-role.ts
+var BaoProxmoxRole = Resource6("Bao.ProxmoxRole", {
+  defaultRemovalPolicy: "retain"
+});
+var readRole3 = (props) => Effect11.gen(function* () {
+  const live = yield* baoRead(rolePath3(props.mount, props.name));
+  if (live === undefined)
+    return;
+  return attributesOf6(props, live);
+});
+var BaoProxmoxRoleProvider = () => Provider6.effect(BaoProxmoxRole, Effect11.succeed(BaoProxmoxRole.Provider.of({
+  list: () => Effect11.succeed([]),
+  read: Effect11.fn(function* ({ olds }) {
+    return yield* readRole3(olds);
+  }),
+  diff: Effect11.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved6(news))
+      return;
+    const live = yield* readRole3(news);
+    if (live === undefined)
+      return { action: "update" };
+    if (matches4(live, news))
+      return { action: "noop" };
+    return { action: "update" };
+  }),
+  reconcile: Effect11.fn(function* ({ news }) {
+    const live = yield* readRole3(news);
+    if (live !== undefined && live.mintUser !== news.mintUser && news.allowMintUserChange !== live.mintUser) {
+      return yield* Effect11.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: live mint_user ` + `${live.mintUser} != declared ${news.mintUser}. Every token this role mints ` + "inherits the ACL of that PVE user. To re-scope deliberately, declare " + `allowMintUserChange: '${live.mintUser}'.`));
+    }
+    if (live === undefined || !matches4(live, news)) {
+      const write = writeBody4(news);
+      if (!write.ok) {
+        return yield* Effect11.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
+      }
+      yield* baoWrite("PUT", rolePath3(news.mount, news.name), write.body);
+    }
+    const after = yield* readRole3(news);
+    if (after === undefined) {
+      return yield* Effect11.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: write returned no error ` + "but the role is still absent."));
+    }
+    return after;
+  }),
+  delete: Effect11.fn(function* ({ output }) {
+    yield* baoDelete(rolePath3(output.mount, output.name));
+    return;
+  })
+})));
+// src/openbao/ssh-role.ts
+import { Resource as Resource7 } from "alchemy";
+import { isResolved as isResolved7 } from "alchemy/Diff";
+import * as Provider7 from "alchemy/Provider";
+import * as Effect12 from "effect/Effect";
+
+// src/openbao/ssh-role-form.ts
+var mountOf = (mount) => (mount ?? "ssh").replace(/\/+$/, "");
+var readPath3 = (mount, name) => `${mountOf(mount)}/roles/${name}`;
+var text3 = (value) => typeof value === "string" ? value : "";
+var bool3 = (value, fallback) => typeof value === "boolean" ? value : fallback;
+var csvList = (value) => {
+  const parts = Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : text3(value).split(",");
+  return [
+    ...new Set(parts.map((entry) => entry.trim()).filter((entry) => entry.length > 0))
+  ].sort();
+};
+var extMap = (value) => {
+  const out = {};
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return out;
+  const source = value;
+  for (const key of Object.keys(source).sort())
+    out[key] = text3(source[key]);
+  return out;
+};
+var resolve = (props) => ({
+  name: props.name,
+  mount: mountOf(props.mount),
+  allowedUsers: csvList(props.allowedUsers),
+  defaultUser: props.defaultUser ?? "",
+  allowUserCertificates: props.allowUserCertificates ?? false,
+  allowHostCertificates: props.allowHostCertificates ?? false,
+  allowedDomains: csvList(props.allowedDomains),
+  allowSubdomains: props.allowSubdomains ?? false,
+  allowBareDomains: props.allowBareDomains ?? false,
+  allowedExtensions: csvList(props.allowedExtensions),
+  defaultExtensions: extMap(props.defaultExtensions ?? {}),
+  allowedCriticalOptions: csvList(props.allowedCriticalOptions),
+  defaultCriticalOptions: extMap(props.defaultCriticalOptions ?? {}),
+  allowEmptyPrincipals: props.allowEmptyPrincipals ?? false,
+  ttl: props.ttl,
+  maxTtl: props.maxTtl
+});
+var attributesOf7 = (form, live) => {
+  const attrs = {
+    name: form.name,
+    mount: form.mount,
+    allowedUsers: csvList(live["allowed_users"]),
+    defaultUser: text3(live["default_user"]),
+    allowUserCertificates: bool3(live["allow_user_certificates"], false),
+    allowHostCertificates: bool3(live["allow_host_certificates"], false),
+    allowedDomains: csvList(live["allowed_domains"]),
+    allowSubdomains: bool3(live["allow_subdomains"], false),
+    allowBareDomains: bool3(live["allow_bare_domains"], false),
+    allowedExtensions: csvList(live["allowed_extensions"]),
+    defaultExtensions: extMap(live["default_extensions"]),
+    allowedCriticalOptions: csvList(live["allowed_critical_options"]),
+    defaultCriticalOptions: extMap(live["default_critical_options"]),
+    allowEmptyPrincipals: bool3(live["allow_empty_principals"], false),
+    keyType: text3(live["key_type"]) || "ca",
+    ttlSeconds: ttlSeconds(live["ttl"]) ?? 0,
+    maxTtlSeconds: ttlSeconds(live["max_ttl"]) ?? 0
+  };
+  return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
+};
+var mapValue = (map4) => JSON.stringify(extMap(map4));
+var writeBody5 = (form) => ({
+  key_type: "ca",
+  allowed_users: form.allowedUsers.join(","),
+  default_user: form.defaultUser,
+  allow_user_certificates: String(form.allowUserCertificates),
+  allow_host_certificates: String(form.allowHostCertificates),
+  allowed_domains: form.allowedDomains.join(","),
+  allow_subdomains: String(form.allowSubdomains),
+  allow_bare_domains: String(form.allowBareDomains),
+  allowed_extensions: form.allowedExtensions.join(","),
+  default_extensions: mapValue(form.defaultExtensions),
+  allowed_critical_options: form.allowedCriticalOptions.join(","),
+  default_critical_options: mapValue(form.defaultCriticalOptions),
+  allow_empty_principals: String(form.allowEmptyPrincipals),
+  ttl: form.ttl,
+  max_ttl: form.maxTtl
+});
+var sameList2 = (want, have) => want.length === have.length && want.every((entry, index) => entry === have[index]);
+var sameMap = (want, have) => {
+  const keys = Object.keys(want);
+  return keys.length === Object.keys(have).length && keys.every((key) => have[key] === want[key]);
+};
+var sameTtl5 = (want, have) => parseDuration(want) === have;
+var badDurations2 = (form) => ["ttl", "maxTtl"].filter((field) => parseDuration(form[field]) === undefined);
+var matches5 = (attributes, form) => attributes.keyType === "ca" && sameList2(form.allowedUsers, attributes.allowedUsers) && attributes.defaultUser === form.defaultUser && attributes.allowUserCertificates === form.allowUserCertificates && attributes.allowHostCertificates === form.allowHostCertificates && sameList2(form.allowedDomains, attributes.allowedDomains) && attributes.allowSubdomains === form.allowSubdomains && attributes.allowBareDomains === form.allowBareDomains && sameList2(form.allowedExtensions, attributes.allowedExtensions) && sameMap(form.defaultExtensions, attributes.defaultExtensions) && sameList2(form.allowedCriticalOptions, attributes.allowedCriticalOptions) && sameMap(form.defaultCriticalOptions, attributes.defaultCriticalOptions) && attributes.allowEmptyPrincipals === form.allowEmptyPrincipals && sameTtl5(form.ttl, attributes.ttlSeconds) && sameTtl5(form.maxTtl, attributes.maxTtlSeconds);
+
+// src/openbao/ssh-role.ts
+var BaoSshRole = Resource7("Bao.SshRole", {
+  defaultRemovalPolicy: "retain"
+});
+var readRole4 = (form) => Effect12.gen(function* () {
+  const live = yield* baoRead(readPath3(form.mount, form.name));
+  if (live === undefined)
+    return;
+  return { attributes: attributesOf7(form, live), live };
+});
+var UNMANAGED_DEFAULTS = {
+  algorithm_signer: "default",
+  allow_commas_in_identity_templates: false,
+  allow_user_key_ids: false,
+  allowed_domains_template: false,
+  allowed_users_template: false,
+  default_extensions_template: false,
+  default_user_template: false,
+  issuer_ref: "default",
+  key_id_format: "",
+  not_before_duration: 30
+};
+var isDefault = (live, field) => live[field] === undefined || live[field] === "" || live[field] === UNMANAGED_DEFAULTS[field];
+var wouldErase = (live) => {
+  const lost = Object.keys(UNMANAGED_DEFAULTS).filter((field) => !isDefault(live, field));
+  if (Object.keys(extMap(live["allowed_user_key_lengths"])).length > 0) {
+    lost.push("allowed_user_key_lengths");
+  }
+  return lost.sort();
+};
+var refuse = (message) => Effect12.die(new Error(message));
+var BaoSshRoleProvider = () => Provider7.effect(BaoSshRole, Effect12.succeed(BaoSshRole.Provider.of({
+  list: () => Effect12.succeed([]),
+  read: Effect12.fn(function* ({ olds }) {
+    const found = yield* readRole4(resolve(olds));
+    return found?.attributes;
+  }),
+  diff: Effect12.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved7(news))
+      return;
+    const form = resolve(news);
+    if (output.mount !== form.mount || output.name !== form.name) {
+      return { action: "replace" };
+    }
+    const found = yield* readRole4(form);
+    if (found === undefined)
+      return { action: "update" };
+    return matches5(found.attributes, form) ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: Effect12.fn(function* ({ news }) {
+    const form = resolve(news);
+    const path = readPath3(form.mount, form.name);
+    const bad = badDurations2(form);
+    if (bad.length > 0) {
+      return yield* refuse(`Bao.SshRole ${path}: ${bad.join(", ")} is not a duration parseDuration understands ` + "(`0` or `<n>s|m|h|d`). It would write, then report update on every plan forever.");
+    }
+    if (form.allowUserCertificates && form.allowedUsers.length === 0 && !form.allowEmptyPrincipals) {
+      return yield* refuse(`Bao.SshRole ${path}: allowUserCertificates with an empty allowedUsers and ` + "allowEmptyPrincipals false. Every sign request against it would be rejected.");
+    }
+    const found = yield* readRole4(form);
+    if (found === undefined || !matches5(found.attributes, form)) {
+      if (found !== undefined) {
+        const lost = wouldErase(found.live);
+        if (lost.length > 0) {
+          return yield* refuse(`Bao.SshRole ${path}: live role carries ${lost.join(", ")}, which this ` + "resource does not declare and the full-replace write would ERASE. " + "Fold those settings into the declaration, or clear them by hand first.");
+        }
+      }
+      yield* baoWrite("PUT", path, writeBody5(form));
+    }
+    const after = yield* readRole4(form);
+    if (after === undefined) {
+      return yield* refuse(`Bao.SshRole ${path}: write returned no error but the role is still absent.`);
+    }
+    return after.attributes;
+  }),
+  delete: Effect12.fn(function* ({ output }) {
+    yield* baoDelete(readPath3(output.mount, output.name));
+    return;
+  })
+})));
+export {
+  BaoAuthRoleProvider,
+  BaoCloudflareRoleProvider,
+  BaoMountProvider,
+  BaoPkiRoleProvider,
+  BaoPolicy,
+  BaoPolicyProvider,
+  BaoProxmoxRole,
+  BaoProxmoxRoleProvider,
+  BaoSshRoleProvider
+};
+
+//# debugId=72D46173613CE4CB64756E2164756E21
+//# sourceMappingURL=index.js.map