@homeflare/alchemy 0.3.1 → 0.4.0

package/README.md

@@ -3,7 +3,7 @@
 Custom [Alchemy](https://alchemy.run) providers for gaps the vendor SDK leaves.
 
 ```sh
-bun add @homeflare/alchemy alchemy@2.0.0-beta.78 effect@4.0.0-rc.115 \
+bun add @homeflare/alchemy alchemy@2.0.0-beta.79 effect@4.0.0-rc.115 \
         @effect/platform-node@4.0.0-rc.115 cloudflare@4.5.0 mime@4.1.0
 ```
 
@@ -76,7 +76,7 @@ like a bad credential.
 ## Peers — and one override you need
 
 ```sh
-bun add @homeflare/alchemy alchemy@2.0.0-beta.78 effect@4.0.0-rc.115 \
+bun add @homeflare/alchemy alchemy@2.0.0-beta.79 effect@4.0.0-rc.115 \
         @effect/platform-node@4.0.0-rc.115 cloudflare@4.5.0 mime@4.1.0
 ```
 
@@ -116,10 +116,9 @@ stay there. The override is still the only thing that holds the set together.
 `Cloudflare/Workers/WorkerBridge → @effect/platform-node/NodeServices` even when you only
 import the Proxmox subpath.
 
-⚠️ So is `mime`. Alchemy 78's `@alchemy.run/cloudflare-runtime` imports it and does
-not declare it. `@effect/platform-node` has `mime` as its own dependency, but a clean
-consumer install (no hoist) cannot see that copy — measured 2026-09-17, every subpath
-threw `Cannot find package 'mime'` until it was installed next to the peers.
+⚠️ So is `mime`. Alchemy 78's `@alchemy.run/cloudflare-runtime` imported it without
+declaring it (measured 2026-09-17). 79 declares it; the peer stays so a consumer
+that followed the 78 README does not drop a required line.
 
 ⚠️ So is `cloudflare`. It was marked optional in 0.1.1, which claimed the `/cloudflare`
 subpath would degrade without it — measured 2026-09-16, the subpath does not load at all:

package/dist/openbao/auth-method-form.d.ts

@@ -0,0 +1,43 @@
+export interface BaoAuthMethodProps {
+    /** Auth path without trailing slash, as `sys/auth/<path>` takes it. */
+    path: string;
+    /** Auth method type, e.g. `approle`, `jwt`, `oidc`. */
+    type: string;
+    /** Human description — sent on enable and on tune, as configure-engines does. */
+    description?: string;
+    /** Default lease TTL, e.g. `768h`. */
+    defaultLeaseTtl?: string;
+    /** Max lease TTL, e.g. `8760h`. */
+    maxLeaseTtl?: string;
+}
+export interface BaoAuthMethodAttributes {
+    path: string;
+    type: string;
+    description: string;
+    defaultLeaseTtl: string;
+    maxLeaseTtl: string;
+    /** SHA-256 of the managed fields — safe to persist; see policy.ts. */
+    digest: string;
+}
+/** Auth path without a trailing slash — listing keys are `${path}/`. */
+export declare const authPath: (path: string) => string;
+export declare const attributesOf: (props: BaoAuthMethodProps, live: Record<string, unknown>) => BaoAuthMethodAttributes;
+/** `sys/auth/<path>` — read, enable and disable all address the method here. */
+export declare const readPath: (path: string) => string;
+/**
+ * ★ SAME TUNE ROUTE SHAPE AS SECRETS MOUNTS. `bao auth tune` hits
+ *   `sys/auth/<path>/tune` (openbao v2.6.2 api/sys_auth.go TuneAuth).
+ */
+export declare const tunePath: (path: string) => string;
+/**
+ * The enable body. configure-engines POSTed `{ type, description }` for approle.
+ *
+ * ⚠️ TTLs ARE NOT SENT HERE. reconcile tunes them after enable, same as Bao.Mount.
+ */
+export declare const enableBody: (props: BaoAuthMethodProps) => Record<string, string>;
+/** Tune body — only the fields the declaration names. An omitted field is left alone. */
+export declare const tuneBody: (props: BaoAuthMethodProps) => Record<string, string>;
+/** True when live already matches the declaration on every managed field. */
+export declare const matches: (attributes: BaoAuthMethodAttributes, props: BaoAuthMethodProps) => boolean;
+export declare const wantsTune: (props: BaoAuthMethodProps) => boolean;
+//# sourceMappingURL=auth-method-form.d.ts.map

package/dist/openbao/auth-method-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-method-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method-form.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAoB,CAAC;AAiB1D,eAAO,MAAM,YAAY,UAChB,kBAAkB,QACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,uBAUF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAiC,CAAC;AAEvE;;;GAGG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,WAA6B,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,kBAAkB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAI3E,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,QAAQ,UAAW,kBAAkB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMzE,CAAC;AASF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,uBAAuB,SAAS,kBAAkB,YAIlC,CAAC;AAErD,eAAO,MAAM,SAAS,UAAW,kBAAkB,YAGlB,CAAC"}

package/dist/openbao/auth-method-wire.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The OpenBao calls Bao.AuthMethod makes — read one method, enable, tune, disable.
+ *
+ * ★ ENDPOINTS, READ FROM openbao v2.6.2 api/sys_auth.go — the client configure-engines
+ *   used via curl:
+ *     read     GET    sys/auth/<path>
+ *     enable   POST   sys/auth/<path>        — `bao auth enable`
+ *     tune     POST   sys/auth/<path>/tune   — `bao auth tune`
+ *     disable  DELETE sys/auth/<path>        — `bao auth disable`
+ *     table    GET    sys/auth
+ */
+import * as Effect from 'effect/Effect';
+import { type BaoAuthMethodProps } from './auth-method-form.ts';
+import { BaoError } from './bao-status.ts';
+/** One method's config (`type`, `description`, `config.*_lease_ttl`), or undefined when absent. */
+export declare const readAuthMethodData: (path: string) => Effect.Effect<Record<string, unknown> | undefined, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const enableAuthMethod: (props: BaoAuthMethodProps) => Effect.Effect<void, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const tuneAuthMethod: (props: BaoAuthMethodProps) => Effect.Effect<void, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ⚠️ THERE IS NO FORCE. Disable is a plain DELETE, same as `bao auth disable`. */
+export declare const disableAuthMethod: (path: string) => Effect.Effect<void, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=auth-method-wire.d.ts.map

package/dist/openbao/auth-method-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-method-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,kBAAkB,EAMxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA4B3C,mGAAmG;AACnG,eAAO,MAAM,kBAAkB,SAAU,MAAM,uHAM5C,CAAC;AAEJ,eAAO,MAAM,gBAAgB,UAAW,kBAAkB,wFACC,CAAC;AAE5D,eAAO,MAAM,cAAc,UAAW,kBAAkB,wFACC,CAAC;AAE1D,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,SAAU,MAAM,wFAA8B,CAAC"}

package/dist/openbao/auth-method.d.ts

@@ -0,0 +1,20 @@
+/**
+ * An OpenBao auth method — path, type, description and lease TTLs.
+ *
+ * ⛔ NO SECRET IN PROPS OR ATTRIBUTES — see policy.ts. This enables `approle` (or jwt/oidc)
+ *   as a mount. Role ids, OIDC client secrets, and secret_ids are out of scope.
+ *
+ * ★ `defaultRemovalPolicy: 'retain'` — disabling a method destroys every role under it
+ *   and revokes tokens minted through those roles. Opt in with
+ *   `.pipe(RemovalPolicy.destroy())`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoAuthMethodAttributes, type BaoAuthMethodProps } from './auth-method-form.ts';
+export type { BaoAuthMethodAttributes, BaoAuthMethodProps };
+export interface BaoAuthMethod extends Resource<'Bao.AuthMethod', BaoAuthMethodProps, BaoAuthMethodAttributes, never, HttpClient.HttpClient> {
+}
+export declare const BaoAuthMethod: import("alchemy").ResourceClass<BaoAuthMethod>;
+export declare const BaoAuthMethodProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoAuthMethod>, never, HttpClient.HttpClient>;
+//# sourceMappingURL=auth-method.d.ts.map

package/dist/openbao/auth-method.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-method.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAQ/B,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,CAAC;AAE5D,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,aAAa,gDAExB,CAAC;AASH,eAAO,MAAM,qBAAqB,oGAmE/B,CAAC"}

package/dist/openbao/index.d.ts

@@ -8,6 +8,7 @@
  * ★ Anything unlisted is still reachable by path if you genuinely need it — that is a
  *   deliberate, visible act rather than an accident of barrelling.
  */
+export { BaoAuthMethod, BaoAuthMethodProvider } from './auth-method.ts';
 export { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
 export { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';
 export { CloudflarePermissionGroups, permissionGroupsFromEngine, permissionGroupsFromLiveRoles, } from './cloudflare-permission-groups.ts';

package/dist/openbao/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/openbao/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACnF,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/openbao/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACnF,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}