@homeflare/alchemy 0.2.1 → 0.2.2

package/dist/openbao/bao-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bao-http.d.ts","sourceRoot":"","sources":["../../src/openbao/bao-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAU,MAAM,iBAAiB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,MAAM,iEAEjB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,aAAa,IAAI,CAAC;AAE/B,eAAO,MAAM,OAAO,wCAElB,CAAC;AAoDH,mGAAmG;AACnG,eAAO,MAAM,OAAO,WACV,SAAS,UACT,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,QACnC,MAAM,SACL,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,wFAkCtC,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SAAU,MAAM,wFAOhC,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,WACX,MAAM,GAAG,KAAK,QAChB,MAAM,QACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,yDACe,CAAC;AAEzD,kGAAkG;AAClG,eAAO,MAAM,SAAS,SAAU,MAAM,yDAAqD,CAAC"}
+{"version":3,"file":"bao-http.d.ts","sourceRoot":"","sources":["../../src/openbao/bao-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAU,MAAM,iBAAiB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,MAAM,iEAEjB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,aAAa,IAAI,CAAC;AAE/B,eAAO,MAAM,OAAO,wCAElB,CAAC;AAiEH,mGAAmG;AACnG,eAAO,MAAM,OAAO,WACV,SAAS,UACT,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,QACnC,MAAM,SACL,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,wFAoCtC,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SAAU,MAAM,wFAOhC,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,WACX,MAAM,GAAG,KAAK,QAChB,MAAM,QACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,yDACe,CAAC;AAEzD,kGAAkG;AAClG,eAAO,MAAM,SAAS,SAAU,MAAM,yDAAqD,CAAC"}

package/dist/openbao/index.d.ts

@@ -8,9 +8,14 @@
  * ★ Anything unlisted is still reachable by path if you genuinely need it — that is a
  *   deliberate, visible act rather than an accident of barrelling.
  */
-export { BaoAuthRoleProvider } from './auth-role.ts';
-export { BaoCloudflareRoleProvider } from './cloudflare-role.ts';
-export { BaoMountProvider } from './mount.ts';
+export { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
+export { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';
+export { CloudflarePermissionGroups, permissionGroupsFromEngine, permissionGroupsFromLiveRoles, } from './cloudflare-permission-groups.ts';
+export type { CloudflareZone, ExpandedRole } from './cloudflare-roles-expand.ts';
+export { expandAccount, expandAll, mountName } from './cloudflare-roles-expand.ts';
+export type { RolesConfig, SurfaceSpec } from './cloudflare-roles-config.ts';
+export { parseRolesConfig } from './cloudflare-roles-config.ts';
+export { BaoMount, BaoMountProvider } from './mount.ts';
 export { BaoPkiRoleProvider } from './pki-role.ts';
 export { BaoPolicy, BaoPolicyProvider } from './policy.ts';
 export { BaoProxmoxRole, BaoProxmoxRoleProvider } from './proxmox-role.ts';

package/dist/openbao/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/openbao/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/openbao/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACnF,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}

package/dist/openbao/index.js

@@ -150,6 +150,7 @@ var matches2 = (attributes, props) => {
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
+import * as Schedule from "effect/Schedule";
 import * as Semaphore from "effect/Semaphore";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as Headers from "effect/unstable/http/Headers";
@@ -239,6 +240,11 @@ var BaoGate = Context.Reference("homeflare/openbao/BaoGate", {
   defaultValue: () => Semaphore.makeUnsafe(MAX_IN_FLIGHT)
 });
 var TIMEOUT = "60 seconds";
+var retryTransport = (effect) => Effect.retry(effect, {
+  schedule: Schedule.spaced("750 millis"),
+  times: 2,
+  while: (error) => error.status === 0
+});
 var redactingToken = (effect) => Effect.gen(function* () {
   const names = yield* Headers.CurrentRedactedNames;
   return yield* Effect.provideService(effect, Headers.CurrentRedactedNames, [
@@ -264,7 +270,7 @@ var baoCall = (intent, method, path, body) => Effect.gen(function* () {
   const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(HttpClientRequest.setHeaders(headersFor(address, env)), body === undefined ? (self) => self : HttpClientRequest.bodyText(JSON.stringify(body), "application/json"));
   const exchange = client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text3) => ({ status: response.status, text: text3 }))), Effect.timeout(TIMEOUT), Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])));
   const gate = yield* BaoGate;
-  const { status, text: text2 } = yield* exchange.pipe(overSocket(address.socket, method, path), redactingToken, Semaphore.withPermits(gate, 1));
+  const { status, text: text2 } = yield* retryTransport(exchange.pipe(overSocket(address.socket, method, path), redactingToken, Semaphore.withPermits(gate, 1)));
   const outcome = settle(intent, method, path, status, text2);
   return "error" in outcome ? yield* Effect.fail(outcome.error) : outcome.body;
 });
@@ -325,11 +331,15 @@ import * as Provider2 from "alchemy/Provider";
 import * as Effect5 from "effect/Effect";
 
 // src/openbao/cloudflare-group-scope.ts
+var zoneResource = (zoneId) => `com.cloudflare.api.account.zone.${zoneId}`;
+var accountResource = (accountId) => `com.cloudflare.api.account.${accountId}`;
+var bucketResource = (accountId, jurisdiction, bucket) => `com.cloudflare.edge.r2.bucket.${accountId}_${jurisdiction}_${bucket}`;
 var GROUP_SCOPES = {
   account: "com.cloudflare.api.account",
   bucket: "com.cloudflare.edge.r2.bucket",
   zone: "com.cloudflare.api.account.zone"
 };
+var groupScopeNamed = (word) => Object.entries(GROUP_SCOPES).find(([name]) => name === word)?.[1];
 var scopeOfResource = (resource) => {
   const scopes = [GROUP_SCOPES.zone, GROUP_SCOPES.bucket, GROUP_SCOPES.account];
   return scopes.find((scope) => resource.startsWith(`${scope}.`)) ?? resource;
@@ -340,7 +350,100 @@ var groupKey = (name, scope) => `${scope} ${name}`;
 import * as Context2 from "effect/Context";
 import * as Effect4 from "effect/Effect";
 
+// src/openbao/cloudflare-permission-groups-solve.ts
+var observationsOf = (declared, live) => declared.flatMap((role) => {
+  const entries = live.get(`${role.mount}/${role.name}`);
+  if (entries === undefined)
+    return [];
+  return role.policies.flatMap((policy, i) => {
+    const twins = role.policies.filter((other) => other.resource === policy.resource);
+    const matching = entries.filter((entry) => Object.keys(entry.resources).length === 1 && (policy.resource in entry.resources));
+    const [only] = matching;
+    if (twins.length !== 1 || matching.length !== 1 || only === undefined)
+      return [];
+    return [
+      {
+        ids: only.groupIds,
+        names: policy.groups,
+        where: `${role.mount}/${role.name}[${String(i)}]`
+      }
+    ];
+  });
+});
+var unique = (items) => [...new Set(items)];
+var solveGroups = (observations) => {
+  const idsOf = new Map;
+  const namesOf = new Map;
+  const bind = (name, id) => {
+    const ids = idsOf.get(name) ?? new Set;
+    const fresh = !ids.has(id);
+    idsOf.set(name, ids.add(id));
+    namesOf.set(id, (namesOf.get(id) ?? new Set).add(name));
+    return fresh;
+  };
+  const known = (name) => {
+    const ids = idsOf.get(name);
+    const [id] = ids ?? [];
+    return ids?.size === 1 && id !== undefined && namesOf.get(id)?.size === 1 ? id : undefined;
+  };
+  const shaped = observations.map((o) => ({ ids: unique(o.ids), names: unique(o.names) }));
+  for (const { ids, names } of shaped) {
+    const [name] = names;
+    const [id] = ids;
+    if (names.length === 1 && ids.length === 1 && name !== undefined && id !== undefined) {
+      bind(name, id);
+    }
+  }
+  for (let changed = true;changed; ) {
+    changed = false;
+    for (const { ids, names } of shaped) {
+      if (names.length !== ids.length)
+        continue;
+      const knownIds = new Set(names.map(known));
+      const openNames = names.filter((name2) => known(name2) === undefined);
+      const openIds = ids.filter((id2) => !knownIds.has(id2));
+      const [name] = openNames;
+      const [id] = openIds;
+      if (openNames.length === 1 && openIds.length === 1 && name !== undefined && id !== undefined) {
+        changed = bind(name, id) || changed;
+      }
+    }
+  }
+  const contradicted = [];
+  for (const o of observations) {
+    for (const name of unique(o.names)) {
+      const id = known(name);
+      if (id !== undefined && !o.ids.includes(id))
+        contradicted.push({ id, name, where: o.where });
+    }
+  }
+  const groups = new Map;
+  const ambiguous = [];
+  const unresolved = [];
+  for (const name of unique(observations.flatMap((o) => o.names)).sort()) {
+    const ids = idsOf.get(name);
+    const id = known(name);
+    if (ids === undefined)
+      unresolved.push(name);
+    else if (ids.size > 1)
+      ambiguous.push({ bound: [...ids].sort(), kind: "name", value: name });
+    else if (id !== undefined)
+      groups.set(name, id);
+  }
+  for (const [id, names] of [...namesOf].sort(([a], [b]) => a < b ? -1 : 1)) {
+    if (names.size > 1)
+      ambiguous.push({ bound: [...names].sort(), kind: "id", value: id });
+  }
+  return { ambiguous, contradicted, groups, unresolved };
+};
+var describeProblems = (solved) => [
+  ...solved.ambiguous.map((c) => c.kind === "name" ? `ambiguous: name ${JSON.stringify(c.value)} is bound to ids ${c.bound.join(", ")}` : `ambiguous: id ${c.value} is bound to names ${c.bound.map((n) => JSON.stringify(n)).join(", ")}`),
+  ...solved.unresolved.map((name) => `unresolved: no live role isolates ${JSON.stringify(name)} to one id`),
+  ...solved.contradicted.map((c) => `contradicted: ${c.where} declares ${JSON.stringify(c.name)} but lacks its id ${c.id}`)
+];
+
 // src/openbao/cloudflare-policy.ts
+var atEveryScope = (byName) => new Map([...byName].flatMap(([name, id]) => Object.values(GROUP_SCOPES).map((scope) => [groupKey(name, scope), id])));
 var resolvePolicies = (declared, ids) => {
   const missing = new Set;
   const policies = declared.map((policy) => {
@@ -485,8 +588,125 @@ var writeCloudflareRole = (mount, name, body) => baoWrite("PUT", rolePath(mount,
 var deleteCloudflareRole = (mount, name) => baoDelete(rolePath(mount, name));
 
 // src/openbao/cloudflare-permission-groups.ts
+class CloudflareGroupsError extends Error {
+  scope;
+  problems;
+  constructor(scope, problems) {
+    super(`Cloudflare permission groups for ${scope}: ${problems.join("; ")}`);
+    this.scope = scope;
+    this.problems = problems;
+    this.name = "CloudflareGroupsError";
+  }
+}
+
 class CloudflarePermissionGroups extends Context2.Service()("homeflare/openbao/CloudflarePermissionGroups") {
 }
+var pick = (mount, groups, refs, hint) => {
+  const unknown = refs.filter((ref) => !groups.has(groupKey(ref.name, ref.scope)));
+  if (unknown.length > 0) {
+    const problems = unknown.map((ref) => `unknown group ${JSON.stringify(ref.name)} at scope ${ref.scope} — ${hint}`);
+    return Effect4.fail(new CloudflareGroupsError(mount, problems));
+  }
+  return Effect4.succeed(new Map(refs.flatMap((ref) => {
+    const key = groupKey(ref.name, ref.scope);
+    const id = groups.get(key);
+    return id === undefined ? [] : [[key, id]];
+  })));
+};
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var deniedHint = (mount) => `GET ${mountPath(mount)}/permission-groups answered 403 — this token's policy carries no ` + `\`path "${mountPath(mount)}/permission-groups" { capabilities = ["read"] }\` grant. ` + "It is declared in ../platform/secrets/vault/policies/homeflare-admin/" + "20-cloudflare-permission-groups.hcl and applies with `alchemy deploy` of this stack";
+var deniedNamed = (mount, read) => Effect4.catchIf(read, (error) => error.status === 403, () => Effect4.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
+var engineGroups = (mount) => Effect4.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
+  const list = data?.["permission_groups"];
+  if (data === undefined) {
+    const why = "GET <mount>/permission-groups answered 404 — the endpoint is not deployed here";
+    return Effect4.fail(new CloudflareGroupsError(mount, [why]));
+  }
+  if (!Array.isArray(list)) {
+    return Effect4.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
+  }
+  const scoped = new Map;
+  const idsOf = new Map;
+  const problems = [];
+  for (const item of list) {
+    const name = isRecord2(item) ? item["name"] : undefined;
+    const id = isRecord2(item) ? item["id"] : undefined;
+    const scopes = isRecord2(item) ? item["scopes"] : undefined;
+    if (typeof name !== "string" || typeof id !== "string" || !Array.isArray(scopes) || !scopes.every((scope) => typeof scope === "string")) {
+      problems.push("an entry without a string name, id and scopes");
+      continue;
+    }
+    idsOf.set(name, (idsOf.get(name) ?? new Set).add(id));
+    for (const scope of scopes) {
+      const key = groupKey(name, scope);
+      if (scoped.has(key) && scoped.get(key) !== id) {
+        problems.push(`ambiguous: ${JSON.stringify(name)} is listed with two ids at scope ${scope}`);
+      } else {
+        scoped.set(key, id);
+      }
+    }
+  }
+  const sole = new Map([...idsOf].flatMap(([name, ids]) => {
+    const only = [...ids];
+    return ids.size === 1 && only[0] !== undefined ? [[name, only[0]]] : [];
+  }));
+  return problems.length > 0 ? Effect4.fail(new CloudflareGroupsError(mount, problems)) : Effect4.succeed(new Map([...atEveryScope(sole), ...scoped]));
+});
+var permissionGroupsFromEngine = () => Effect4.sync(() => {
+  const cache = new Map;
+  const cachedFor = (mount) => Effect4.suspend(() => {
+    const hit = cache.get(mountPath(mount));
+    if (hit !== undefined)
+      return hit;
+    return Effect4.flatMap(Effect4.cached(engineGroups(mount)), (lookup) => {
+      cache.set(mountPath(mount), lookup);
+      return lookup;
+    });
+  });
+  return CloudflarePermissionGroups.of({
+    resolve: (mount, refs) => Effect4.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
+  });
+});
+var permissionGroupsFromLiveRoles = (declared) => Effect4.gen(function* () {
+  const accountOf = new Map;
+  const byAccount = new Map;
+  for (const [mount, roles] of declared) {
+    for (const role of roles) {
+      accountOf.set(mount, role.account);
+      byAccount.set(role.account, [...byAccount.get(role.account) ?? [], role]);
+    }
+  }
+  const solved = new Map;
+  for (const [account, roles] of byAccount) {
+    const solve = Effect4.gen(function* () {
+      const live = new Map;
+      yield* Effect4.all(roles.map((role) => Effect4.map(readCloudflareRole(role.mount, role.name), (read) => {
+        if (read?.policies !== undefined) {
+          live.set(`${role.mount}/${role.name}`, read.policies);
+        }
+      })), { concurrency: 8, discard: true });
+      const result = solveGroups(observationsOf(roles, live));
+      const problems = describeProblems(result);
+      if (problems.length > 0) {
+        return yield* Effect4.fail(new CloudflareGroupsError(`account ${account}`, problems));
+      }
+      return atEveryScope(result.groups);
+    });
+    solved.set(account, yield* Effect4.cached(solve));
+  }
+  return CloudflarePermissionGroups.of({
+    resolve: (mount, refs) => {
+      const account = accountOf.get(mountPath(mount));
+      const lookup = account === undefined ? undefined : solved.get(account);
+      if (account === undefined || lookup === undefined) {
+        const why = "no declared role on this mount, so no live role can vouch for its groups";
+        return Effect4.fail(new CloudflareGroupsError(mount, [why]));
+      }
+      const hint = `no live role on account ${account} carries it; a NEW group needs the engine endpoint`;
+      return Effect4.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
+    }
+  });
+});
 
 // src/openbao/cloudflare-role.ts
 var BaoCloudflareRole = Resource2("Bao.CloudflareRole", {
@@ -552,6 +772,190 @@ var BaoCloudflareRoleProvider = () => Provider2.effect(BaoCloudflareRole, Effect
     })
   });
 }));
+// src/openbao/cloudflare-roles-expand.ts
+var slug = (name) => name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+var zoneSlug = (zone) => `${slug(zone.name)}${zone.internal ? "-internal" : ""}`;
+var mountName = (account, surface) => `cloudflare-${account}-${surface}`;
+var policiesFor = (tpl, accountId, zone, accountGroups) => {
+  if (tpl.bucket !== undefined && zone !== null) {
+    throw new Error(`${tpl.name}: a zone role cannot be scoped to R2 bucket ${tpl.bucket}`);
+  }
+  const accountScoped = tpl.bucket === undefined ? accountResource(accountId) : bucketResource(accountId, tpl.bucketJurisdiction, tpl.bucket);
+  const resource = zone === null ? accountScoped : zoneResource(zone.id);
+  const first = {
+    effect: "allow",
+    groupOrder: "declared",
+    groups: tpl.groups,
+    resource,
+    ...tpl.groupsScope === undefined ? {} : { scope: tpl.groupsScope }
+  };
+  if (accountGroups.length === 0)
+    return [first];
+  const second = {
+    effect: "allow",
+    groupOrder: "by-id",
+    groups: accountGroups,
+    resource: accountResource(accountId)
+  };
+  return [first, second];
+};
+var build = (account, surface, tpl, zone, accountGroups) => ({
+  account: account.key,
+  accountId: account.id,
+  catalog: {
+    description: tpl.desc,
+    maxTtl: tpl.maxTtl,
+    permissions: [...tpl.groups, ...accountGroups],
+    ttl: tpl.ttl,
+    zone: zone === null ? null : zone.name
+  },
+  description: zone === null ? tpl.desc : `${tpl.desc} (zone: ${zone.name})`,
+  maxTtl: tpl.maxTtl,
+  mount: mountName(account.key, surface),
+  name: zone === null ? tpl.name : `${zoneSlug(zone)}-${tpl.name}`,
+  policies: policiesFor(tpl, account.id, zone, accountGroups),
+  surface,
+  ttl: tpl.ttl
+});
+var expandAccount = (config, account, zones) => {
+  const roles = [];
+  for (const surface of account.surfaces) {
+    const spec = config.surfaces[surface];
+    if (spec === undefined)
+      throw new Error(`surface ${surface} is not defined`);
+    for (const tpl of spec.zoneRoles) {
+      const only = tpl.zones;
+      const internalOk = tpl.zoneTypes.includes("internal");
+      for (const zone of zones) {
+        if (account.zones !== "all" && !account.zones.includes(zone.name))
+          continue;
+        if (only !== undefined && only.length > 0 && !only.includes(zone.name))
+          continue;
+        if (zone.internal && !internalOk)
+          continue;
+        roles.push(build(account, surface, tpl, zone, tpl.accountGroups));
+      }
+    }
+    for (const tpl of spec.accountRoles)
+      roles.push(build(account, surface, tpl, null, []));
+  }
+  return roles;
+};
+var expandAll = (config, zonesByAccount) => {
+  const byMount = new Map;
+  const seen = new Set;
+  for (const account of config.accounts) {
+    const zones = zonesByAccount[account.key];
+    if (zones === undefined)
+      throw new Error(`no zone inventory for account ${account.key}`);
+    for (const role of expandAccount(config, account, zones)) {
+      const key = `${role.mount}/roles/${role.name}`;
+      if (seen.has(key))
+        throw new Error(`roles.yaml expands ${key} twice`);
+      seen.add(key);
+      const mount = byMount.get(role.mount) ?? [];
+      mount.push(role);
+      byMount.set(role.mount, mount);
+    }
+  }
+  return byMount;
+};
+// src/openbao/cloudflare-roles-config.ts
+class RolesConfigError extends Error {
+  constructor(where, problem) {
+    super(`roles.yaml ${where}: ${problem}`);
+    this.name = "RolesConfigError";
+  }
+}
+var isRaw = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var record = (value, where) => {
+  if (!isRaw(value))
+    throw new RolesConfigError(where, "expected a mapping");
+  return value;
+};
+var text2 = (raw, key, where) => {
+  const value = raw[key];
+  if (typeof value === "string")
+    return value;
+  throw new RolesConfigError(`${where}.${key}`, `expected a string, got ${JSON.stringify(value)}`);
+};
+var texts = (raw, key, where) => {
+  const value = raw[key];
+  if (value === undefined || value === null)
+    return;
+  if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
+    return value;
+  }
+  throw new RolesConfigError(`${where}.${key}`, "expected a list of strings");
+};
+var entries = (raw, key, where) => {
+  const value = raw[key];
+  if (value === undefined || value === null)
+    return [];
+  if (!Array.isArray(value))
+    throw new RolesConfigError(`${where}.${key}`, "expected a list");
+  return value;
+};
+var template = (value, where) => {
+  const raw = record(value, where);
+  const groups = texts(raw, "groups", where);
+  if (groups === undefined)
+    throw new RolesConfigError(`${where}.groups`, "is required");
+  const bucket = raw["bucket"] === undefined ? undefined : text2(raw, "bucket", where);
+  if (bucket !== undefined && bucket.length === 0) {
+    throw new RolesConfigError(`${where}.bucket`, "is empty; omit it to stay account-wide");
+  }
+  const groupsScope = raw["groups_scope"] === undefined ? undefined : groupScopeNamed(text2(raw, "groups_scope", where));
+  if (raw["groups_scope"] !== undefined && groupsScope === undefined) {
+    throw new RolesConfigError(`${where}.groups_scope`, `expected one of ${Object.keys(GROUP_SCOPES).join(", ")}`);
+  }
+  return {
+    accountGroups: texts(raw, "account_groups", where) ?? [],
+    bucket,
+    bucketJurisdiction: raw["bucket_jurisdiction"] === undefined ? "default" : text2(raw, "bucket_jurisdiction", where),
+    desc: raw["desc"] === undefined ? "" : text2(raw, "desc", where),
+    groups,
+    groupsScope,
+    maxTtl: text2(raw, "max_ttl", where),
+    name: text2(raw, "name", where),
+    ttl: text2(raw, "ttl", where),
+    zoneTypes: texts(raw, "zone_types", where) ?? [],
+    zones: texts(raw, "zones", where)
+  };
+};
+var surface = (name, value) => {
+  const where = `surfaces.${name}`;
+  const raw = record(value, where);
+  return {
+    accountRoles: entries(raw, "account_roles", where).map((item, i) => template(item, `${where}.account_roles[${String(i)}]`)),
+    zoneRoles: entries(raw, "zone_roles", where).map((item, i) => template(item, `${where}.zone_roles[${String(i)}]`))
+  };
+};
+var account = (key, value, surfaces) => {
+  const where = `accounts.${key}`;
+  const raw = record(value, where);
+  const names = texts(raw, "surfaces", where) ?? [];
+  for (const name of names) {
+    if (surfaces[name] === undefined) {
+      throw new RolesConfigError(`${where}.surfaces`, `names ${name}, which surfaces: never defines`);
+    }
+  }
+  const zones = raw["zones"] === undefined || raw["zones"] === "all" ? "all" : texts(raw, "zones", where);
+  return { id: text2(raw, "id", where), key, surfaces: names, zones: zones ?? "all" };
+};
+var parseRolesConfig = (yaml) => {
+  const root = record(Bun.YAML.parse(yaml), "(document)");
+  const surfaces = {};
+  for (const [name, spec] of Object.entries(record(root["surfaces"], "surfaces"))) {
+    surfaces[name] = surface(name, spec);
+  }
+  const accounts = Object.entries(record(root["accounts"], "accounts")).map(([key, value]) => account(key, value, surfaces));
+  return {
+    accounts,
+    namespace: text2(record(root["defaults"], "defaults"), "namespace", "defaults"),
+    surfaces
+  };
+};
 // src/openbao/mount.ts
 import { Resource as Resource3 } from "alchemy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
@@ -646,7 +1050,7 @@ var canonical2 = (input) => ({
   signatureBits: input.signatureBits,
   ttlSeconds: input.ttlSeconds
 });
-var seconds2 = (text2) => parseDuration(text2) ?? -1;
+var seconds2 = (text3) => parseDuration(text3) ?? -1;
 var canonicalFromProps = (props) => canonical2({
   allowBareDomains: props.allowBareDomains ?? false,
   allowGlobDomains: props.allowGlobDomains ?? false,
@@ -747,7 +1151,7 @@ var readRole2 = (props) => Effect8.gen(function* () {
     return;
   return attributesOf4(props, live);
 });
-var badDurations = (props) => [["ttl", props.ttl], ["maxTtl", props.maxTtl]].filter(([, text2]) => parseDuration(text2) === undefined);
+var badDurations = (props) => [["ttl", props.ttl], ["maxTtl", props.maxTtl]].filter(([, text3]) => parseDuration(text3) === undefined);
 var BaoPkiRoleProvider = () => Provider4.effect(BaoPkiRole, Effect8.succeed(BaoPkiRole.Provider.of({
   list: () => Effect8.succeed([]),
   read: Effect8.fn(function* ({ olds }) {
@@ -810,8 +1214,8 @@ var policyPath = (name) => `sys/policies/acl/${name}`;
 var readPolicy = (name) => Effect9.flatMap(baoRead(policyPath(name)), (data) => {
   if (data === undefined)
     return Effect9.succeed("");
-  const text2 = data["policy"];
-  return typeof text2 === "string" ? Effect9.succeed(text2) : Effect9.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
+  const text3 = data["policy"];
+  return typeof text3 === "string" ? Effect9.succeed(text3) : Effect9.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
 });
 var writePolicy = (name, hcl) => baoWrite("PUT", policyPath(name), { policy: hcl });
 var deletePolicy = (name) => baoDelete(policyPath(name));
@@ -831,12 +1235,12 @@ var BaoPolicyProvider = () => Provider5.effect(BaoPolicy, Effect10.gen(function*
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const assemble = (dir) => Effect10.gen(function* () {
-    const entries = (yield* fs.readDirectory(dir)).filter((f) => f.endsWith(".hcl")).sort();
+    const entries2 = (yield* fs.readDirectory(dir)).filter((f) => f.endsWith(".hcl")).sort();
     let joined = "";
-    for (const f of entries)
+    for (const f of entries2)
       joined += `${yield* fs.readFileString(path.join(dir, f))}
 `;
-    return { joined, parts: entries.length };
+    return { joined, parts: entries2.length };
   });
   return BaoPolicy.Provider.of({
     list: () => Effect10.succeed([]),
@@ -876,7 +1280,7 @@ import * as Provider6 from "alchemy/Provider";
 import * as Effect11 from "effect/Effect";
 
 // src/openbao/proxmox-role-form.ts
-var text2 = (value) => typeof value === "string" ? value : "";
+var text3 = (value) => typeof value === "string" ? value : "";
 var ttlText3 = (seconds3, fallback = "0") => {
   if (seconds3 === undefined)
     return fallback;
@@ -892,8 +1296,8 @@ var rolePath3 = (mount, name) => `${mountPath(mount)}/roles/${name}`;
 var attributesOf6 = (props, live) => {
   const attrs = {
     mount: mountPath(props.mount),
-    name: text2(live["name"]) || props.name,
-    mintUser: text2(live["mint_user"]),
+    name: text3(live["name"]) || props.name,
+    mintUser: text3(live["mint_user"]),
     ttl: ttlText3(ttlSeconds(live["ttl"])),
     maxTtl: ttlText3(ttlSeconds(live["max_ttl"]))
   };
@@ -978,10 +1382,10 @@ import * as Effect12 from "effect/Effect";
 // src/openbao/ssh-role-form.ts
 var mountOf = (mount) => (mount ?? "ssh").replace(/\/+$/, "");
 var readPath3 = (mount, name) => `${mountOf(mount)}/roles/${name}`;
-var text3 = (value) => typeof value === "string" ? value : "";
+var text4 = (value) => typeof value === "string" ? value : "";
 var bool3 = (value, fallback) => typeof value === "boolean" ? value : fallback;
 var csvList = (value) => {
-  const parts = Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : text3(value).split(",");
+  const parts = Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : text4(value).split(",");
   return [
     ...new Set(parts.map((entry) => entry.trim()).filter((entry) => entry.length > 0))
   ].sort();
@@ -992,7 +1396,7 @@ var extMap = (value) => {
     return out;
   const source = value;
   for (const key of Object.keys(source).sort())
-    out[key] = text3(source[key]);
+    out[key] = text4(source[key]);
   return out;
 };
 var resolve = (props) => ({
@@ -1018,7 +1422,7 @@ var attributesOf7 = (form, live) => {
     name: form.name,
     mount: form.mount,
     allowedUsers: csvList(live["allowed_users"]),
-    defaultUser: text3(live["default_user"]),
+    defaultUser: text4(live["default_user"]),
     allowUserCertificates: bool3(live["allow_user_certificates"], false),
     allowHostCertificates: bool3(live["allow_host_certificates"], false),
     allowedDomains: csvList(live["allowed_domains"]),
@@ -1029,7 +1433,7 @@ var attributesOf7 = (form, live) => {
     allowedCriticalOptions: csvList(live["allowed_critical_options"]),
     defaultCriticalOptions: extMap(live["default_critical_options"]),
     allowEmptyPrincipals: bool3(live["allow_empty_principals"], false),
-    keyType: text3(live["key_type"]) || "ca",
+    keyType: text4(live["key_type"]) || "ca",
     ttlSeconds: ttlSeconds(live["ttl"]) ?? 0,
     maxTtlSeconds: ttlSeconds(live["max_ttl"]) ?? 0
   };
@@ -1143,16 +1547,26 @@ var BaoSshRoleProvider = () => Provider7.effect(BaoSshRole, Effect12.succeed(Bao
   })
 })));
 export {
+  BaoAuthRole,
   BaoAuthRoleProvider,
+  BaoCloudflareRole,
   BaoCloudflareRoleProvider,
+  BaoMount,
   BaoMountProvider,
   BaoPkiRoleProvider,
   BaoPolicy,
   BaoPolicyProvider,
   BaoProxmoxRole,
   BaoProxmoxRoleProvider,
-  BaoSshRoleProvider
+  BaoSshRoleProvider,
+  CloudflarePermissionGroups,
+  expandAccount,
+  expandAll,
+  mountName,
+  parseRolesConfig,
+  permissionGroupsFromEngine,
+  permissionGroupsFromLiveRoles
 };
 
-//# debugId=72D46173613CE4CB64756E2164756E21
+//# debugId=4D8C0F4073136EF664756E2164756E21
 //# sourceMappingURL=index.js.map