@homeflare/alchemy 0.1.0

package/dist/openbao/mount-form.d.ts

@@ -0,0 +1,60 @@
+/** Mount path without a trailing slash — props and `sys/mounts/<path>` use this shape. */
+export declare const mountPath: (path: string) => string;
+/** Parse a Vault duration string (`15m`, `768h`, `0`) to seconds. */
+export declare const parseDuration: (text: string) => number | undefined;
+/** Seconds from live JSON (`2764800`) or a duration prop (`768h`). */
+export declare const ttlSeconds: (value: unknown) => number | undefined;
+export interface BaoMountProps {
+    /** Mount path without trailing slash, as `sys/mounts/<path>` takes it. */
+    path: string;
+    /** Secrets engine type, e.g. `kv`, `pki`, `openbao-plugin-secrets-cloudflare`. */
+    type: string;
+    /** Human description — tuned via `sys/mounts/<path>/tune`, as apply-roles.py describe_mounts does. */
+    description?: string;
+    /** Default lease TTL, e.g. `768h`. */
+    defaultLeaseTtl?: string;
+    /** Max lease TTL, e.g. `8760h`. */
+    maxLeaseTtl?: string;
+    /** KV only — sent as `options.version` on enable, as `-version=2` was. Immutable after create. */
+    version?: 1 | 2;
+}
+export interface BaoMountAttributes {
+    path: string;
+    type: string;
+    description: string;
+    defaultLeaseTtl: string;
+    maxLeaseTtl: string;
+    /** SHA-256 of the managed fields — safe to persist; see policy.ts. */
+    digest: string;
+}
+export declare const attributesOf: (props: BaoMountProps, live: Record<string, unknown>) => BaoMountAttributes;
+/** `sys/mounts/<path>` — read, enable and disable all address the mount here. */
+export declare const readPath: (path: string) => string;
+/**
+ * ★ NO TRAILING SLASH NEEDED ON THE WIRE. `bao secrets tune` appended one itself; the server's
+ *   route `mounts/(?P<path>.+?)/tune$` captures the bare path and `sanitizePath` appends the slash
+ *   OpenBao stores in sys/mounts (openbao v2.6.2 vault/logical_system_paths.go:4248,
+ *   vault/logical_system.go:4825-4833).
+ */
+export declare const tunePath: (path: string) => string;
+/**
+ * The enable body. `-version=2` on the CLI became `options.version = "2"` (openbao v2.6.2
+ * command/secrets_enable.go:278 into api MountInput.Options), so that is what is sent.
+ *
+ * ⚠️ DESCRIPTION AND TTLs ARE NOT SENT HERE. reconcile tunes them straight after the enable,
+ *   exactly as the CLI path did, so a create and an update converge through the same call.
+ */
+export declare const enableBody: (props: BaoMountProps) => Record<string, unknown>;
+/**
+ * The tune body — only the fields the declaration names.
+ *
+ * ★ AN OMITTED FIELD IS LEFT ALONE. The server reads an absent TTL as "" and keeps the mount's
+ *   current value for "" (vault/logical_system.go:1614-1630), and applies `description` only when
+ *   present (:1725). The CLI sent unset TTL flags as "" and set description only when given
+ *   (command/secrets_tune.go Visit), so omitting them is the same request.
+ */
+export declare const tuneBody: (props: BaoMountProps) => Record<string, string>;
+/** True when live already matches the declaration on every managed field. */
+export declare const matches: (attributes: BaoMountAttributes, props: BaoMountProps) => boolean;
+export declare const wantsTune: (props: BaoMountProps) => boolean;
+//# sourceMappingURL=mount-form.d.ts.map

package/dist/openbao/mount-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-form.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-form.ts"],"names":[],"mappings":"AAEA,0FAA0F;AAC1F,eAAO,MAAM,SAAS,SAAU,MAAM,WAA6B,CAAC;AAIpE,qEAAqE;AACrE,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MAAM,GAAG,SAkBrD,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,UAAU,UAAW,OAAO,KAAG,MAAM,GAAG,SAIpD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAiBD,eAAO,MAAM,YAAY,UAChB,aAAa,QACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,kBAYF,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAoC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,WAA6B,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CACsB,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMpE,CAAC;AASF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,kBAAkB,SAAS,aAAa,YAIxB,CAAC;AAErD,eAAO,MAAM,SAAS,UAAW,aAAa,YAGb,CAAC"}

package/dist/openbao/mount-wire.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The OpenBao calls Bao.Mount makes — read one mount, enable, tune, disable. Split from mount.ts so
+ * the classification of a MISSING mount can be tested against a fake server.
+ *
+ * ★ ENDPOINTS, READ FROM openbao v2.6.2 api/sys_mounts.go — the client the CLI used:
+ *     read     GET    sys/mounts/<path>        (MountInfo, :254)  — what `bao read sys/mounts/<path>` hit
+ *     enable   POST   sys/mounts/<path>        (Mount, :57)       — `bao secrets enable`
+ *     tune     POST   sys/mounts/<path>/tune   (TuneMount, :201)  — `bao secrets tune`
+ *     disable  DELETE sys/mounts/<path>        (Unmount, :79)     — `bao secrets disable`
+ */
+import * as Effect from 'effect/Effect';
+import { BaoError } from './bao-status.ts';
+import { type BaoMountProps } from './mount-form.ts';
+/** One mount's config (`type`, `description`, `config.*_lease_ttl`), or undefined when absent. */
+export declare const readMountData: (path: string) => Effect.Effect<Record<string, unknown> | undefined, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const enableMount: (props: BaoMountProps) => Effect.Effect<void, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const tuneMount: (props: BaoMountProps) => Effect.Effect<void, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * ⚠️ THERE IS NO FORCE. The old delete ran `bao secrets disable -force`, and v2.6.2's
+ *   command/secrets_disable.go defines no `-force` flag, so that argv would have been refused at
+ *   flag parsing. `Unmount` is a plain DELETE (api/sys_mounts.go:79); nothing else was ever sent.
+ */
+export declare const disableMount: (path: string) => Effect.Effect<void, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=mount-wire.d.ts.map

package/dist/openbao/mount-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,iBAAiB,CAAC;AAsCzB,kGAAkG;AAClG,eAAO,MAAM,aAAa,SAAU,MAAM,uHAMvC,CAAC;AAEJ,eAAO,MAAM,WAAW,UAAW,aAAa,wFACW,CAAC;AAE5D,eAAO,MAAM,SAAS,UAAW,aAAa,wFACW,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,wFAA8B,CAAC"}

package/dist/openbao/mount.d.ts

@@ -0,0 +1,20 @@
+/**
+ * An OpenBao secrets engine mount — path, type, description and lease TTLs.
+ *
+ * ⛔ NO SECRET IN PROPS OR ATTRIBUTES — see policy.ts for why. This declares mount
+ *   SHAPE only: names, types, TTL strings and a digest. KV values and CA material live
+ *   in OpenBao, not Alchemy state.
+ *
+ * ★ `defaultRemovalPolicy: 'retain'` — disabling a mount destroys every secret under it.
+ *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoMountAttributes, type BaoMountProps } from './mount-form.ts';
+export type { BaoMountAttributes, BaoMountProps };
+export interface BaoMount extends Resource<'Bao.Mount', BaoMountProps, BaoMountAttributes, never, HttpClient.HttpClient> {
+}
+export declare const BaoMount: import("alchemy").ResourceClass<BaoMount>;
+export declare const BaoMountProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoMount>, never, HttpClient.HttpClient>;
+//# sourceMappingURL=mount.d.ts.map

package/dist/openbao/mount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../src/openbao/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAKnB,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAElD,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,QAAQ,2CAEnB,CAAC;AASH,eAAO,MAAM,gBAAgB,+FAqF1B,CAAC"}

package/dist/openbao/pki-role-form.d.ts

@@ -0,0 +1,118 @@
+/** ★ MEASURED: the OpenAPI enum for `key_type` is exactly these four, lowercase. */
+export type BaoPkiKeyType = 'any' | 'ec' | 'ed25519' | 'rsa';
+/** ★ MEASURED: live roles carry `["hostname"]` or the default `["email","hostname"]`. */
+export type BaoPkiCnValidation = 'disabled' | 'email' | 'hostname';
+export interface BaoPkiRoleProps {
+    /** Role name, as `pki/roles/{name}` takes it. */
+    name: string;
+    /** Mount holding the engine. Defaults to `pki` — the only PKI mount live today. */
+    mount?: string;
+    /**
+     * Domains this role may issue for.
+     *
+     * ⛔ AN EMPTY LIST IS REFUSED IN reconcile, NOT WRITTEN. With `allow_any_name` false — the
+     *   default, and what all eight live roles use — a role with no allowed domains can issue
+     *   nothing, so a mistyped or unresolved prop would quietly brick every renewal under it.
+     */
+    allowedDomains: readonly string[];
+    /** Permit `foo.<allowed domain>`. Default false. */
+    allowSubdomains?: boolean;
+    /** Permit the allowed domain itself as the CN. Default false. */
+    allowBareDomains?: boolean;
+    /** Treat `*` inside an allowed domain as a glob. Default false. */
+    allowGlobDomains?: boolean;
+    /**
+     * Default certificate lifetime, as a duration string (`720h`).
+     *
+     * ⚠️ WRITTEN AS A DURATION, READ BACK AS SECONDS — `ttl` and `max_ttl` both carry
+     *   `format: seconds` in the OpenAPI and come back as integers (`2592000`). The prop
+     *   string reaches `bao write` verbatim; the compare happens in seconds. See canonical().
+     */
+    ttl: string;
+    /** Ceiling on a requested lifetime, as a duration string (`8760h`). */
+    maxTtl: string;
+    /** Key algorithm. Default `rsa` — OpenBao's own default. */
+    keyType?: BaoPkiKeyType;
+    /** Key size; `0` means "engine default for keyType". rsa 2048/3072/4096, ec 224/256/384/521. */
+    keyBits?: number;
+    /** Flag certificates for TLS server auth. ⚠️ OpenBao defaults this TRUE. */
+    serverFlag?: boolean;
+    /** Flag certificates for TLS client auth. ⚠️ OpenBao defaults this TRUE. */
+    clientFlag?: boolean;
+    /** Extended key usages minus the `ExtKeyUsage` prefix (`ServerAuth`). Empty on all 8 live roles. */
+    extKeyUsage?: readonly string[];
+    /** Permit IP SANs. ⚠️ OpenBao defaults TRUE; this resource defaults FALSE — see pki-role.ts. */
+    allowIpSans?: boolean;
+    /** Permit `localhost`/`localdomain` CNs. ⚠️ OpenBao TRUE, this resource FALSE. */
+    allowLocalhost?: boolean;
+    /** Permit wildcard CNs. ⚠️ OpenBao TRUE, this resource FALSE. */
+    allowWildcardCertificates?: boolean;
+    /** CN validations to run. ⚠️ OpenBao `["email","hostname"]`, this resource `["hostname"]`. */
+    cnValidations?: readonly BaoPkiCnValidation[];
+    /** Signature hash bits; `0` auto-detects from key length. One live role pins 256. */
+    signatureBits?: number;
+}
+/**
+ * The managed field set, normalised so both sides of a diff are byte-comparable.
+ *
+ * ⚠️ KEY ORDER IS THE DIGEST. The props side and the live side are both built by the single
+ *   canonical() literal below, so `JSON.stringify` emits the same key order for each. Two
+ *   hand-written object literals would drift apart and produce a forever-diff nobody could
+ *   read from the plan output.
+ */
+export interface BaoPkiRoleCanonical {
+    allowBareDomains: boolean;
+    allowGlobDomains: boolean;
+    allowIpSans: boolean;
+    allowLocalhost: boolean;
+    allowSubdomains: boolean;
+    allowWildcardCertificates: boolean;
+    allowedDomains: readonly string[];
+    clientFlag: boolean;
+    cnValidations: readonly string[];
+    extKeyUsage: readonly string[];
+    keyBits: number;
+    keyType: string;
+    /** ⚠️ `-1` means the duration prop did not parse — reconcile refuses rather than writing it. */
+    maxTtlSeconds: number;
+    serverFlag: boolean;
+    signatureBits: number;
+    ttlSeconds: number;
+}
+export interface BaoPkiRoleAttributes extends BaoPkiRoleCanonical {
+    name: string;
+    mount: string;
+    /** Human rendering of ttlSeconds — the compare uses the seconds, this is for the plan. */
+    ttl: string;
+    maxTtl: string;
+    /** SHA-256 of the canonical form — safe to persist; see policy.ts. */
+    digest: string;
+}
+export declare const canonicalFromProps: (props: BaoPkiRoleProps) => BaoPkiRoleCanonical;
+export declare const canonicalFromLive: (live: Record<string, unknown>) => BaoPkiRoleCanonical;
+export declare const digestOf: (form: BaoPkiRoleCanonical) => string;
+export declare const rolePath: (props: {
+    name: string;
+    mount?: string;
+}) => string;
+export declare const attributesOf: (props: BaoPkiRoleProps, live: Record<string, unknown>) => BaoPkiRoleAttributes;
+/**
+ * ⚠️ ARRAYS GO OVER AS COMMA-JOINED STRINGS. `allowed_domains` and `ext_key_usage` are
+ *   documented as "a comma-separated string or list"; `cn_validations` is not, so its
+ *   splitting is REASONED, not measured. reconcile re-reads and re-compares after every
+ *   write, so a value that arrived unsplit fails loudly instead of landing wrong.
+ *
+ * ⚠️ TTLs GO OVER AS THE AUTHOR'S OWN DURATION STRING, never as a re-rendered one — so this
+ *   never has to know whether OpenBao's parser accepts the `d` suffix ttlText() produces for
+ *   display. Rendering is for humans; the wire only ever sees what was declared.
+ *
+ * ★ `ext_key_usage` is OMITTED when empty rather than sent as `ext_key_usage=`. The write
+ *   replaces the whole role, so an absent field already lands on the `[]` default, and
+ *   omitting sidesteps how an empty value would be encoded.
+ *
+ * ★ THE BODY FOR `PUT <mount>/roles/<name>`, ALL STRINGS — the same `k=v` pairs `bao write` sent.
+ */
+export declare const writeBody: (props: BaoPkiRoleProps) => Record<string, string>;
+/** True when live already matches the declaration on every managed field. */
+export declare const matches: (attributes: BaoPkiRoleAttributes, props: BaoPkiRoleProps) => boolean;
+//# sourceMappingURL=pki-role-form.d.ts.map

package/dist/openbao/pki-role-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pki-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role-form.ts"],"names":[],"mappings":"AAGA,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC;AAE7D,yFAAyF;AACzF,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC9B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oDAAoD;IACpD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oGAAoG;IACpG,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,gGAAgG;IAChG,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kFAAkF;IAClF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,8FAA8F;IAC9F,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC9C,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,yBAAyB,EAAE,OAAO,CAAC;IACnC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AA8BD,eAAO,MAAM,kBAAkB,UAAW,eAAe,KAAG,mBAkBxD,CAAC;AAYL,eAAO,MAAM,iBAAiB,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,mBAkB9D,CAAC;AAWL,eAAO,MAAM,QAAQ,SAAU,mBAAmB,WAAiC,CAAC;AAEpF,eAAO,MAAM,QAAQ,UAAW;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,WACN,CAAC;AAE3D,eAAO,MAAM,YAAY,UAChB,eAAe,QAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,oBAUF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,UAAW,eAAe,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAsBvE,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,oBAAoB,SAAS,eAAe,YACrB,CAAC"}

package/dist/openbao/pki-role.d.ts

@@ -0,0 +1,50 @@
+/**
+ * An OpenBao PKI role — the policy a future issuance is checked against, and nothing else.
+ *
+ * ⛔ THE ROLE IS THE POLICY, NEVER THE CERTIFICATE. Nothing here touches `pki/issue/*` (which
+ *   RETURNS a private key) or `pki/root/generate/*` (which CREATES one). Every value this
+ *   resource stores is a domain name, a flag, a bit count or a TTL — safe to sit in Alchemy's
+ *   UNENCRYPTED Postgres state. See policy.ts for why that line is load-bearing here.
+ *
+ * ⛔ `bao write pki/roles/<name>` REPLACES THE WHOLE ROLE — it is not a merge. OpenBao builds
+ *   a fresh role entry from the request, so every field left out reverts to its SCHEMA
+ *   DEFAULT. MEASURED 2026-09-13 against the live OpenBao 2.6.2, from its own
+ *   `sys/internal/specs/openapi` cross-read against all eight live `pki/roles/*`, four of
+ *   those defaults are WIDER than what this estate actually runs:
+ *
+ *     allow_ip_sans                default true                  — false on 5 of the 8 roles
+ *     allow_localhost              default true                  — false on 6 of the 8
+ *     allow_wildcard_certificates  default true                  — false on 6 of the 8
+ *     cn_validations               default ["email","hostname"]  — ["hostname"] on 5 of the 8
+ *
+ *   A resource that managed only the eleven fields the brief named would therefore, on any
+ *   unrelated TTL edit, silently re-open wildcards and localhost on six production roles.
+ *   That is why those four are props in pki-role-form.ts though they were not in the brief,
+ *   and why their default there is the CLOSED value rather than OpenBao's open one.
+ *
+ * ★ NARROWING IS THE FAIL-SAFE DIRECTION. A default tighter than OpenBao's can only refuse a
+ *   certificate that should have been issued — loud, and cured by declaring the field. A
+ *   default looser than OpenBao's issues one that should have been refused, in silence.
+ *
+ * ⚠️ WHAT WAS NOT MEASURED. Only reads were run against the live engine; no `bao write`
+ *   happened, so nothing below is a verified round-trip. Two consequences carried into the
+ *   form file: every live role has `ext_key_usage: []`, so the stored casing of a non-empty
+ *   list was never observed (the compare folds case because OpenBao matches these
+ *   case-insensitively at issuance); and every live role has exactly ONE allowed domain, so
+ *   whether OpenBao preserves list order was never observed either (the compare sorts,
+ *   because allowed_domains is a set). Both choices can only mask a cosmetic difference,
+ *   never a policy one — but neither is a measurement.
+ *
+ * ★ `defaultRemovalPolicy: 'retain'` — see the delete comment below. Opt in with
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoPkiRoleAttributes, type BaoPkiRoleProps } from './pki-role-form.ts';
+export type { BaoPkiRoleAttributes, BaoPkiRoleProps };
+export interface BaoPkiRole extends Resource<'Bao.PkiRole', BaoPkiRoleProps, BaoPkiRoleAttributes, never, HttpClient.HttpClient> {
+}
+export declare const BaoPkiRole: import("alchemy").ResourceClass<BaoPkiRole>;
+export declare const BaoPkiRoleProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoPkiRole>, never, HttpClient.HttpClient>;
+//# sourceMappingURL=pki-role.d.ts.map

package/dist/openbao/pki-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pki-role.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAKrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAeH,eAAO,MAAM,kBAAkB,iGAsH5B,CAAC"}

package/dist/openbao/policy-assembly.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Whether an assembled policy would carry NO GRANT — the one write `Bao.Policy` must refuse.
+ *
+ * ⛔ EMPTY MEANS NO `path` GRANT, NOT NO FILES. Writing `sys/policies/acl/<name>` with nothing in it
+ *   SILENTLY REVOKES every grant the policy carries, for every token bound to it. The first guard
+ *   only counted fragment files, so a directory whose one fragment was empty, whitespace or
+ *   comments — a truncated edit, a bad checkout — assembled to text with no grant in it, passed,
+ *   and would have replaced the live policy with nothing. Found by grok's review on 2026-09-14.
+ * ★ A GRANT IS A `path "…"` STANZA, the unit apply-agent-policy.sh counts and `grantsOf` in
+ *   policy.ts reports. Leading whitespace is allowed here, so an indented stanza still counts.
+ */
+export declare const isEmptyAssembly: (parts: number, joined: string) => boolean;
+//# sourceMappingURL=policy-assembly.d.ts.map

package/dist/openbao/policy-assembly.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-assembly.d.ts","sourceRoot":"","sources":["../../src/openbao/policy-assembly.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,UAAW,MAAM,UAAU,MAAM,KAAG,OAClB,CAAC"}

package/dist/openbao/policy-wire.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The three OpenBao calls Bao.Policy makes — read, write and delete of `sys/policies/acl/<name>`.
+ * Split from policy.ts so the trailing-newline round trip can be tested against a fake server.
+ */
+import * as Effect from 'effect/Effect';
+import { BaoError } from './bao-status.ts';
+/** The endpoint the CLI's policy commands used — openbao v2.6.2 api/sys_policy.go:60, :100, :122. */
+export declare const policyPath: (name: string) => string;
+/**
+ * The live policy text, or '' when the policy is genuinely absent. Anything else FAILS.
+ *
+ * 🔴 THE ABSENCE WORDING WAS THE POLICY COMMAND'S OWN, AND ASSUMING OTHERWISE MADE A NEW POLICY
+ *   UNCREATABLE. `No value found at` was measured for `bao read`; `bao policy read` never printed
+ *   it. Its API client turned a 404 into an empty string and the CLI reported that in its own
+ *   words — openbao v2.6.2 api/sys_policy.go:65-67 and command/policy_read.go:85-87:
+ *
+ *     No policy named: <name>          exit 2
+ *
+ *   So `read` on a policy that did not exist yet FAILED instead of answering absent, and
+ *   `reconcile` failed at its own pre-write read. Every policy declared so far already existed,
+ *   which is the only reason nothing broke. MEASURED 2026-09-14 under the admin lane —
+ *   `bao policy read zz-probe-absent-policy-4c1e` printed exactly that line and exited 2. (The
+ *   agent lane cannot measure it: it is refused `sys/policies/acl` with a 403 first.)
+ * ★ THE WORDING PROBLEM IS GONE WITH THE CLI. The line above was the CLI's rendering of the 404 that
+ *   the server returns for a missing policy (vault/logical_system.go handlePoliciesRead returns no
+ *   response, which RespondErrorCommon turns into 404). That status is now read directly, and a
+ *   refused read is a 403 — two codes, no text to confuse.
+ *
+ * ⚠️ `data.policy` IS THE TEXT, and a 200 without it is a failure, as it was in the CLI's client
+ *   ("no policy found in response", api/sys_policy.go:81-85).
+ */
+export declare const readPolicy: (name: string) => Effect.Effect<string, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * ★ THE HCL TRAVELS IN THE REQUEST BODY (`{"policy": …}`, api/sys_policy.go:96-101). The CLI path
+ *   needed a scoped temp file because passing HCL on argv would have put every grant in the process
+ *   list; a JSON body never reaches argv, so the temp file is gone with it.
+ */
+export declare const writePolicy: (name: string, hcl: string) => Effect.Effect<void, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** Deleting a policy that is already gone answers success (handlePoliciesDelete returns nothing). */
+export declare const deletePolicy: (name: string) => Effect.Effect<void, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=policy-wire.d.ts.map

package/dist/openbao/policy-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/policy-wire.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,qGAAqG;AACrG,eAAO,MAAM,UAAU,SAAU,MAAM,WAA+B,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,UAAU,SAAU,MAAM,0FAOnC,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,WAAW,SAAU,MAAM,OAAO,MAAM,wFACD,CAAC;AAErD,qGAAqG;AACrG,eAAO,MAAM,YAAY,SAAU,MAAM,wFAAgC,CAAC"}

package/dist/openbao/policy.d.ts

@@ -0,0 +1,83 @@
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as FileSystem from 'effect/FileSystem';
+import * as Path from 'effect/Path';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+/**
+ * An OpenBao ACL policy, assembled from the HCL fragments that declare it.
+ *
+ * ★ WHY THIS EXISTS. The estate already hand-rolled both halves of what Alchemy provides:
+ *   five `apply-*.sh`/`apply-*.py` scripts converge OpenBao, and separate `check-*.sh`
+ *   gates compare live to repo and refuse on drift. That is `reconcile` and `diff` written
+ *   twice, in two languages, with nothing recording what was applied — and one of those
+ *   gates blocked a deploy today because its own path had rotted.
+ *
+ * ⛔ THERE IS NO `Bao.Secret`, AND THERE MUST NEVER BE ONE. Alchemy persists attributes to
+ *   its state store and does NOT encrypt them: StateEncoding.ts unwraps `Redacted` to
+ *   plaintext under a marker key, and nothing under alchemy/src/State encrypts. This
+ *   estate's state store is the `alchemy` Postgres database, which pg-backup.sh dumps
+ *   nightly (it enumerates EVERY non-template database), copies to CT100, and PBS backs up
+ *   from there. A KV value here would exist in four places, none of them OpenBao.
+ *
+ *   So this declares the SHAPE AROUND secrets. Every attribute it stores is a name, a
+ *   count, or a hash.
+ *
+ * ⛔ EVERY PRIMITIVE IS ALCHEMY'S OR EFFECT'S, NOT NODE'S. An earlier cut of this file used
+ *   `node:child_process` + `promisify(execFile)` and `node:fs/promises`, which is
+ *   hand-rolling inside a bun + Effect codebase: it loses the Scope, the typed
+ *   PlatformError, and the Layer that makes the provider testable without a real vault.
+ *   ★ `CommandExecutor.run` was tried first and blocked read/diff: Alchemy passes a session
+ *   to reconcile/delete but NOT to read/diff (Provider.ts:258-289), so the fix was Alchemy's
+ *   OWN Docker pattern — `ChildProcessSpawner` + `ChildProcess.make`, which needs only a
+ *   Scope (Docker.ts:476-553). ★ SINCE 2026-09-14 THE CALLS ARE OpenBao's HTTP API through
+ *   Effect's `HttpClient` (bao-http.ts), which needs no session either, so read/diff still work.
+ *   FileSystem and Path come from `effect/*` directly — in Effect 4 they moved into core.
+ */
+export interface BaoPolicyProps {
+    /** Policy name, as `sys/policies/acl/<name>` takes it. */
+    name: string;
+    /**
+     * Directory of `*.hcl` fragments.
+     *
+     * ⚠️ CONCATENATED IN SORTED ORDER, EACH FOLLOWED BY A NEWLINE — byte-identical to
+     *   apply-agent-policy.sh, which is what wrote the live policy. Any other joining makes
+     *   the first plan report an update on a policy nobody changed.
+     */
+    fragments: string;
+}
+export interface BaoPolicyAttributes {
+    /** Policy name. */
+    name: string;
+    /** SHA-256 of the assembled HCL. The whole diff, and safe to persist. */
+    digest: string;
+    /** `path "..."` grants — the number apply-agent-policy.sh prints. */
+    grants: number;
+    /** Fragment files that produced it, so a plan reads like the directory. */
+    parts: number;
+}
+export interface BaoPolicy extends Resource<'Bao.Policy', BaoPolicyProps, BaoPolicyAttributes, never, HttpClient.HttpClient | FileSystem.FileSystem | Path.Path> {
+}
+/**
+ * ⛔ `retain` — DELETING A POLICY REVOKES EVERY GRANT IT CARRIES, and this is the ONLY family in
+ *   this package with live instances, so it is the only one where the default could ever fire.
+ *
+ * 🔴 IT WAS THE ONLY FAMILY WITHOUT IT. Every sibling passes `{ defaultRemovalPolicy: 'retain' }`
+ *   — auth-role.ts:37, mount.ts:40, pki-role.ts, proxmox-role.ts, ssh-role.ts — each with a ★
+ *   explaining what deletion destroys. This file has the same warning on its own `delete` handler
+ *   and did not carry the option, which is the worst possible combination: the danger is
+ *   documented and the guard is missing.
+ *   ⛔ WHAT THAT MEANT IN PRACTICE, on 2026-09-13: ten live policies are named in a `const` array
+ *     in alchemy.run.ts. Removing a name from that array orphans the resource, and without
+ *     `retain` the next deploy calls `bao policy delete` on it — including the 86-line policy that
+ *     decides what the agent working in this repo can reach. A one-word edit, no plan line saying
+ *     "revoke", and the grants are gone. The array grew from four names to ten that same day,
+ *     which multiplied the blast radius of a mistake nobody had guarded against.
+ *
+ * ⚠️ `retain` DOES NOT WEAKEN `delete`, WHICH STAYS FULLY IMPLEMENTED. The engine skips it for an
+ *   orphaned resource; a caller that means it opts in with `.pipe(RemovalPolicy.destroy())`. This
+ *   is Terraform's `prevent_destroy`, not a stubbed operation — a delete that silently did nothing
+ *   would lie to whoever read the plan.
+ */
+export declare const BaoPolicy: import("alchemy").ResourceClass<BaoPolicy>;
+export declare const BaoPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoPolicy>, never, FileSystem.FileSystem | HttpClient.HttpClient | Path.Path>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/openbao/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAYH,eAAO,MAAM,iBAAiB,oIAuG3B,CAAC"}

package/dist/openbao/proxmox-role-form.d.ts

@@ -0,0 +1,92 @@
+export interface BaoProxmoxRoleProps {
+    /** Mount path of the proxmox secrets engine, e.g. `proxmox-tb4`. A trailing slash is fine. */
+    mount: string;
+    /**
+     * Role name, as `<mount>/roles/<name>` takes it.
+     *
+     * ⚠️ The plugin's own schema says the name "Appears in the minted token's id, so keep it
+     *   short." Both live roles are one word (`read`, `provision`). A long name here becomes a
+     *   long PVE token id on every mint.
+     */
+    name: string;
+    /**
+     * ⛔ THE ENTIRE SECURITY BOUNDARY OF THIS RESOURCE. A minted token inherits this PVE user's
+     *   standing ACL and nothing else — the engine never grants ACLs, it only borrows one. Change
+     *   this string and every credential the role issues from then on carries a different
+     *   privilege set, with no other field in the declaration changing to hint at it. That is why
+     *   it is compared in `matches` below, and why reconcile refuses to move it without
+     *   `allowMintUserChange`.
+     */
+    mintUser: string;
+    /** Default lease TTL for minted tokens, e.g. `1h`. REQUIRED — see the ⛔ on writeBody. */
+    ttl: string;
+    /**
+     * Maximum lease TTL, e.g. `6h`. REQUIRED — see the ⛔ on writeBody.
+     *
+     * ⚠️ "Narrows the mount's; can never widen it." A role declaring `6h` under a mount whose
+     *   max_lease_ttl is `1h` still READS BACK as 21600, so this resource reports noop and the
+     *   plan is green — while every actual mint is capped at 3600 by the mount. The role is not
+     *   lying and neither is the plan; the ceiling simply lives one level up. If a consumer gets
+     *   a shorter lease than declared here, check `bao read sys/mounts/<mount>` before touching
+     *   the role.
+     */
+    maxTtl: string;
+    /**
+     * Permission to re-scope `mintUser` on an EXISTING role: set it to the CURRENT live mint_user
+     * that this change is allowed to replace.
+     *
+     * ★ IT IS A STRING AND NOT A BOOLEAN, AND THAT IS THE WHOLE POINT. A `true` left behind after
+     *   one legitimate rename would wave through every future re-scope of that role forever —
+     *   including one pasted in by whoever copies this block as a template. Naming the value being
+     *   replaced makes the permission SELF-EXPIRING: the moment the change lands, live equals
+     *   `mintUser`, the guard stops consulting it, and the next re-scope finds a stale string that
+     *   does not match live and is refused on its own merits.
+     *
+     * Not persisted, not in attributes, not in `matches` — it describes the operator's intent, not
+     * the server, so changing it alone is correctly a noop. See the ⛔ in proxmox-role.ts reconcile.
+     */
+    allowMintUserChange?: string;
+}
+export interface BaoProxmoxRoleAttributes {
+    /** Mount path, trailing slash stripped. */
+    mount: string;
+    /** Role name. */
+    name: string;
+    /** The PVE `user@realm` live tokens are minted under. A name, never a credential. */
+    mintUser: string;
+    /** Live default lease TTL, rendered back into the duration shape props use. */
+    ttl: string;
+    /** Live maximum lease TTL, same shape. */
+    maxTtl: string;
+    /** SHA-256 of the managed fields — safe to persist; see policy.ts. */
+    digest: string;
+}
+/** `proxmox-tb4/roles/read` — read, write and delete all address the role here. */
+export declare const rolePath: (mount: string, name: string) => string;
+export declare const attributesOf: (props: BaoProxmoxRoleProps, live: Record<string, unknown>) => BaoProxmoxRoleAttributes;
+/**
+ * The body for `PUT <mount>/roles/<name>` — all strings, the `k=v` pairs `bao write` sent — or
+ * the prop names whose duration would not parse.
+ *
+ * ⛔ A WRITE TO roles/{name} REPLACES THE ROLE, IT DOES NOT MERGE. An omitted `ttl` is written
+ *   as the field's zero value, so a resource that treated undeclared TTLs as "unmanaged" — the
+ *   Bao.Mount shape — would silently reset a lease ceiling every time it rewrote the role for an
+ *   unrelated reason. Both TTLs are therefore required props and EVERY write carries all three
+ *   fields. REASONED from the Vault secrets-framework write semantics plus this plugin's schema
+ *   marking only `mint_user` required; NOT measured, because this session was read-only and
+ *   proving it would have meant writing to the live engine.
+ *
+ * ⚠️ Seconds go on the wire as integers, not as `1h`. The schema declares both TTLs
+ *   `"format": "seconds"`, and an integer is accepted unambiguously by every path that reads
+ *   them back — which is what keeps the round-trip through `matches` stable.
+ */
+export declare const writeBody: (props: BaoProxmoxRoleProps) => {
+    ok: true;
+    body: Record<string, string>;
+} | {
+    ok: false;
+    bad: string[];
+};
+/** True when the live role already matches the declaration on every field the plugin stores. */
+export declare const matches: (attributes: BaoProxmoxRoleAttributes, props: BaoProxmoxRoleProps) => boolean;
+//# sourceMappingURL=proxmox-role-form.d.ts.map

package/dist/openbao/proxmox-role-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxmox-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role-form.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,mBAAmB;IAClC,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,mFAAmF;AACnF,eAAO,MAAM,QAAQ,UAAW,MAAM,QAAQ,MAAM,WAAwC,CAAC;AAE7F,eAAO,MAAM,YAAY,UAChB,mBAAmB,QACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,wBAYF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,UACb,mBAAmB,KACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAWzE,CAAC;AAaF,gGAAgG;AAChG,eAAO,MAAM,OAAO,eAAgB,wBAAwB,SAAS,mBAAmB,YAG9C,CAAC"}

package/dist/openbao/proxmox-role.d.ts

@@ -0,0 +1,47 @@
+/**
+ * A role on the estate's proxmox secrets plugin — the mapping from one consumer to one PVE
+ * mint user, plus the lease ceilings that consumer's tokens get. METADATA ONLY.
+ *
+ * ★ WHY THIS FAMILY MATTERS MORE THAN IT LOOKS. Declaring these roles is how the estate
+ *   replaces HAND-MADE PERMANENT PVE TOKENS with short-lived minted ones. On TB4, SEVEN tokens
+ *   carry expire=0 and privsep=0 — root@pam!proxbox-sync, mcp@pve!executor,
+ *   monitoring@pve!exporter, sablier@pve!sablier, tofu@pve!ro, tofu@pve!apply and
+ *   vaultmint@pve!engine. Six of those are one Bao.ProxmoxRole plus a scoped PVE user away from
+ *   being a 5-minute lease instead of a forever key.
+ *
+ *   The seventh cannot be. vaultmint@pve!engine is the credential the ENGINE ITSELF
+ *   authenticates with in order to mint anything at all: the thing that issues short-lived
+ *   tokens needs a standing one, and no role can resolve that chicken-and-egg. It stays
+ *   permanent, which makes it the single most valuable token on the cluster and the one whose
+ *   rotation must be a deliberate, hand-run procedure rather than a plan.
+ *
+ *   MEASURED here: `bao read proxmox-tb4/config` returns parent_token_id
+ *   `vaultmint@pve!engine`, parent_secret_set true, parent_secret_tail `…eb01` — the engine's
+ *   own key, present and, by the schema's own "Write-only: never returned by a read", not
+ *   retrievable. The seven-token inventory was handed to this change and NOT re-counted against
+ *   the PVE API in this session.
+ *
+ * ⛔ NO SECRET IN PROPS OR ATTRIBUTES — see policy.ts for the full reasoning. Every attribute
+ *   here is a mount path, a role name, a PVE username or a TTL. Nothing this resource stores
+ *   would help anyone authenticate to anything.
+ *
+ * ⛔ ISSUANCE IS NOT THIS RESOURCE, AND MUST NEVER BECOME ONE. `<mount>/creds/<name>` returns a
+ *   LIVE PVE TOKEN. Alchemy persists attributes unencrypted (StateEncoding.ts tags Redacted
+ *   values rather than encrypting them) into the `alchemy` Postgres, which pg-backup.sh dumps
+ *   nightly to CT100, from where PBS backs it up. A minted token declared as a resource would
+ *   outlive its own lease in at least four places, none of them OpenBao. This resource declares
+ *   the DOOR; walking through it is a runtime call, not a plan.
+ *
+ * ★ `defaultRemovalPolicy: 'retain'` — deleting a role breaks every consumer that mints from
+ *   it. Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoProxmoxRoleAttributes, type BaoProxmoxRoleProps } from './proxmox-role-form.ts';
+export type { BaoProxmoxRoleAttributes, BaoProxmoxRoleProps };
+export interface BaoProxmoxRole extends Resource<'Bao.ProxmoxRole', BaoProxmoxRoleProps, BaoProxmoxRoleAttributes, never, HttpClient.HttpClient> {
+}
+export declare const BaoProxmoxRole: import("alchemy").ResourceClass<BaoProxmoxRole>;
+export declare const BaoProxmoxRoleProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoProxmoxRole>, never, HttpClient.HttpClient>;
+//# sourceMappingURL=proxmox-role.d.ts.map

package/dist/openbao/proxmox-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxmox-role.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAE9D,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAiBH,eAAO,MAAM,sBAAsB,qGAoIhC,CAAC"}