@homeflare/alchemy 0.3.2 → 0.4.1

package/dist/openbao/index.js

@@ -1,8 +1,8 @@
-// src/openbao/auth-role.ts
+// src/openbao/auth-method.ts
 import { Resource } from "alchemy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
-import * as Effect2 from "effect/Effect";
+import * as Effect3 from "effect/Effect";
 
 // src/openbao/digest.ts
 var canonical = (text) => text.trimEnd();
@@ -88,16 +88,11 @@ var sameTtl = (want, have) => {
 var matches = (attributes, props) => attributes.type === props.type && (props.description === undefined || attributes.description === props.description) && sameTtl(props.defaultLeaseTtl, attributes.defaultLeaseTtl) && sameTtl(props.maxLeaseTtl, attributes.maxLeaseTtl);
 var wantsTune = (props) => props.description !== undefined || props.defaultLeaseTtl !== undefined || props.maxLeaseTtl !== undefined;
 
-// src/openbao/auth-role-form.ts
-var policiesOf = (live) => {
-  const raw = live["token_policies"];
-  if (!Array.isArray(raw))
-    return [];
-  return raw.filter((entry) => typeof entry === "string").slice().sort();
-};
-var bool = (value, fallback) => typeof value === "boolean" ? value : fallback;
-var int = (value, fallback) => typeof value === "number" && Number.isFinite(value) ? value : fallback;
-var ttlText = (seconds, fallback = "") => {
+// src/openbao/auth-method-form.ts
+var authPath = (path) => mountPath(path);
+var configOf2 = (live) => typeof live["config"] === "object" && live["config"] !== null ? live["config"] : {};
+var text2 = (value) => typeof value === "string" ? value : "";
+var ttlProp2 = (seconds, fallback = "") => {
   if (seconds === undefined)
     return fallback;
   if (seconds % 86400 === 0)
@@ -109,42 +104,46 @@ var ttlText = (seconds, fallback = "") => {
   return `${String(seconds)}s`;
 };
 var attributesOf2 = (props, live) => {
+  const config = configOf2(live);
   const attrs = {
-    name: props.name,
-    tokenPolicies: policiesOf(live),
-    tokenTtl: ttlText(ttlSeconds(live["token_ttl"])),
-    tokenMaxTtl: ttlText(ttlSeconds(live["token_max_ttl"])),
-    secretIdTtl: ttlText(ttlSeconds(live["secret_id_ttl"]), "0"),
-    bindSecretId: bool(live["bind_secret_id"], true),
-    secretIdNumUses: int(live["secret_id_num_uses"], 0)
+    path: authPath(props.path),
+    type: text2(live["type"]) || props.type,
+    description: text2(live["description"]),
+    defaultLeaseTtl: ttlProp2(ttlSeconds(config["default_lease_ttl"])),
+    maxLeaseTtl: ttlProp2(ttlSeconds(config["max_lease_ttl"]))
   };
   return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
 };
-var readPath2 = (name) => `auth/approle/role/${name}`;
-var writeBody = (props) => {
-  const body = {
-    token_policies: props.tokenPolicies.join(","),
-    token_ttl: props.tokenTtl,
-    token_max_ttl: props.tokenMaxTtl,
-    secret_id_ttl: props.secretIdTtl
-  };
-  if (props.bindSecretId !== undefined)
-    body["bind_secret_id"] = String(props.bindSecretId);
-  if (props.secretIdNumUses !== undefined) {
-    body["secret_id_num_uses"] = String(props.secretIdNumUses);
-  }
+var readPath2 = (path) => `sys/auth/${authPath(path)}`;
+var tunePath2 = (path) => `${readPath2(path)}/tune`;
+var enableBody2 = (props) => {
+  const body = { type: props.type };
+  if (props.description !== undefined)
+    body["description"] = props.description;
+  return body;
+};
+var tuneBody2 = (props) => {
+  const body = {};
+  if (props.description !== undefined)
+    body["description"] = props.description;
+  if (props.defaultLeaseTtl !== undefined)
+    body["default_lease_ttl"] = props.defaultLeaseTtl;
+  if (props.maxLeaseTtl !== undefined)
+    body["max_lease_ttl"] = props.maxLeaseTtl;
   return body;
 };
-var samePolicies = (want, have) => want.length === have.length && want.every((policy, index) => policy === have[index]);
 var sameTtl2 = (want, have) => {
-  const wantSeconds = parseDuration(want);
+  if (want === undefined)
+    return true;
+  const wantSeconds = ttlSeconds(want);
   const haveSeconds = ttlSeconds(have);
   return wantSeconds !== undefined && wantSeconds === haveSeconds;
 };
-var matches2 = (attributes, props) => {
-  const wantPolicies = props.tokenPolicies.slice().sort();
-  return samePolicies(wantPolicies, attributes.tokenPolicies) && sameTtl2(props.tokenTtl, attributes.tokenTtl) && sameTtl2(props.tokenMaxTtl, attributes.tokenMaxTtl) && sameTtl2(props.secretIdTtl, attributes.secretIdTtl) && (props.bindSecretId === undefined || attributes.bindSecretId === props.bindSecretId) && (props.secretIdNumUses === undefined || attributes.secretIdNumUses === props.secretIdNumUses);
-};
+var matches2 = (attributes, props) => attributes.type === props.type && (props.description === undefined || attributes.description === props.description) && sameTtl2(props.defaultLeaseTtl, attributes.defaultLeaseTtl) && sameTtl2(props.maxLeaseTtl, attributes.maxLeaseTtl);
+var wantsTune2 = (props) => props.description !== undefined || props.defaultLeaseTtl !== undefined || props.maxLeaseTtl !== undefined;
+
+// src/openbao/auth-method-wire.ts
+import * as Effect2 from "effect/Effect";
 
 // src/openbao/bao-http.ts
 import * as Context from "effect/Context";
@@ -199,35 +198,35 @@ class BaoError extends Error {
     this.name = "BaoError";
   }
 }
-var objectOf = (text2) => {
+var objectOf = (text3) => {
   try {
-    const parsed = JSON.parse(text2);
+    const parsed = JSON.parse(text3);
     return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : undefined;
   } catch {
     return;
   }
 };
-var errorsOf = (text2) => {
-  const raw = objectOf(text2)?.["errors"];
+var errorsOf = (text3) => {
+  const raw = objectOf(text3)?.["errors"];
   return Array.isArray(raw) && raw.every((entry) => typeof entry === "string") ? raw : undefined;
 };
-var settle = (intent, method, path, status, text2) => {
+var settle = (intent, method, path, status, text3) => {
   const fail = (errors) => ({
     error: new BaoError(status, method, path, errors)
   });
   if (status < 200 || status >= 300) {
-    const errors = errorsOf(text2);
+    const errors = errorsOf(text3);
     if (errors === undefined) {
-      return fail([`not an OpenBao error body (${String(text2.length)} bytes)`]);
+      return fail([`not an OpenBao error body (${String(text3.length)} bytes)`]);
     }
     if (status === 404 && intent !== "write")
       return { body: undefined };
     return fail(errors);
   }
-  if (text2.trim() === "") {
+  if (text3.trim() === "") {
     return intent === "read" ? fail(["a successful read with an empty body"]) : { body: undefined };
   }
-  const body = objectOf(text2);
+  const body = objectOf(text3);
   return body === undefined ? fail(["a success body that is not a JSON object"]) : { body };
 };
 
@@ -268,10 +267,10 @@ var baoCall = (intent, method, path, body) => Effect.gen(function* () {
   const address = resolveAddress(env);
   const client = yield* HttpClient.HttpClient;
   const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(HttpClientRequest.setHeaders(headersFor(address, env)), body === undefined ? (self) => self : HttpClientRequest.bodyText(JSON.stringify(body), "application/json"));
-  const exchange = client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text3) => ({ status: response.status, text: text3 }))), Effect.timeout(TIMEOUT), Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])));
+  const exchange = client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text4) => ({ status: response.status, text: text4 }))), Effect.timeout(TIMEOUT), Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])));
   const gate = yield* BaoGate;
-  const { status, text: text2 } = yield* retryTransport(exchange.pipe(overSocket(address.socket, method, path), redactingToken, Semaphore.withPermits(gate, 1)));
-  const outcome = settle(intent, method, path, status, text2);
+  const { status, text: text3 } = yield* retryTransport(exchange.pipe(overSocket(address.socket, method, path), redactingToken, Semaphore.withPermits(gate, 1)));
+  const outcome = settle(intent, method, path, status, text3);
   return "error" in outcome ? yield* Effect.fail(outcome.error) : outcome.body;
 });
 var baoRead = (path) => Effect.map(baoCall("read", "GET", path), (body) => {
@@ -283,52 +282,176 @@ var baoRead = (path) => Effect.map(baoCall("read", "GET", path), (body) => {
 var baoWrite = (method, path, body) => Effect.asVoid(baoCall("write", method, path, body));
 var baoDelete = (path) => Effect.asVoid(baoCall("delete", "DELETE", path));
 
-// src/openbao/auth-role.ts
-var BaoAuthRole = Resource("Bao.AuthRole", {
+// src/openbao/auth-method-wire.ts
+var absentFromTable = (path, asked) => baoRead("sys/auth").pipe(Effect2.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+  ...asked.errors,
+  `sys/auth could not confirm the method is absent: ${listing.message}`
+])), Effect2.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${authPath(path)}/`) ? Effect2.succeed(undefined) : Effect2.fail(asked)));
+var readAuthMethodData = (path) => baoRead(readPath2(path)).pipe(Effect2.catchIf((error) => error.status === 400, (error) => absentFromTable(path, error)));
+var enableAuthMethod = (props) => baoWrite("POST", readPath2(props.path), enableBody2(props));
+var tuneAuthMethod = (props) => baoWrite("POST", tunePath2(props.path), tuneBody2(props));
+var disableAuthMethod = (path) => baoDelete(readPath2(path));
+
+// src/openbao/auth-method.ts
+var BaoAuthMethod = Resource("Bao.AuthMethod", {
   defaultRemovalPolicy: "retain"
 });
-var readRole = (props) => Effect2.gen(function* () {
-  const live = yield* baoRead(readPath2(props.name));
+var readMethod = (props) => Effect3.gen(function* () {
+  const live = yield* readAuthMethodData(props.path);
   if (live === undefined)
     return;
   return attributesOf2(props, live);
 });
-var BaoAuthRoleProvider = () => Provider.effect(BaoAuthRole, Effect2.succeed(BaoAuthRole.Provider.of({
-  list: () => Effect2.succeed([]),
-  read: Effect2.fn(function* ({ olds }) {
-    return yield* readRole(olds);
+var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect3.succeed(BaoAuthMethod.Provider.of({
+  list: () => Effect3.succeed([]),
+  read: Effect3.fn(function* ({ olds }) {
+    return yield* readMethod(olds);
   }),
-  diff: Effect2.fn(function* ({ news, output }) {
+  diff: Effect3.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved(news))
       return;
-    const live = yield* readRole(news);
+    const live = yield* readMethod(news);
     if (live === undefined)
       return { action: "update" };
+    if (live.type !== news.type)
+      return { action: "replace" };
     if (matches2(live, news))
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect2.fn(function* ({ news }) {
+  reconcile: Effect3.fn(function* ({ news }) {
+    let live = yield* readMethod(news);
+    if (live === undefined) {
+      yield* enableAuthMethod(news);
+      if (wantsTune2(news))
+        yield* tuneAuthMethod(news);
+    } else if (!matches2(live, news)) {
+      if (live.type !== news.type) {
+        return yield* Effect3.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Auth method type is immutable — replace manually."));
+      }
+      yield* tuneAuthMethod(news);
+    }
+    live = yield* readMethod(news);
+    if (live === undefined) {
+      return yield* Effect3.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: write returned no error but the method is still absent.`));
+    }
+    return live;
+  }),
+  delete: Effect3.fn(function* ({ output }) {
+    yield* disableAuthMethod(output.path);
+    return;
+  })
+})));
+// src/openbao/auth-role.ts
+import { Resource as Resource2 } from "alchemy";
+import { isResolved as isResolved2 } from "alchemy/Diff";
+import * as Provider2 from "alchemy/Provider";
+import * as Effect4 from "effect/Effect";
+
+// src/openbao/auth-role-form.ts
+var policiesOf = (live) => {
+  const raw = live["token_policies"];
+  if (!Array.isArray(raw))
+    return [];
+  return raw.filter((entry) => typeof entry === "string").slice().sort();
+};
+var bool = (value, fallback) => typeof value === "boolean" ? value : fallback;
+var int = (value, fallback) => typeof value === "number" && Number.isFinite(value) ? value : fallback;
+var ttlText = (seconds, fallback = "") => {
+  if (seconds === undefined)
+    return fallback;
+  if (seconds % 86400 === 0)
+    return `${String(seconds / 86400)}d`;
+  if (seconds % 3600 === 0)
+    return `${String(seconds / 3600)}h`;
+  if (seconds % 60 === 0)
+    return `${String(seconds / 60)}m`;
+  return `${String(seconds)}s`;
+};
+var attributesOf3 = (props, live) => {
+  const attrs = {
+    name: props.name,
+    tokenPolicies: policiesOf(live),
+    tokenTtl: ttlText(ttlSeconds(live["token_ttl"])),
+    tokenMaxTtl: ttlText(ttlSeconds(live["token_max_ttl"])),
+    secretIdTtl: ttlText(ttlSeconds(live["secret_id_ttl"]), "0"),
+    bindSecretId: bool(live["bind_secret_id"], true),
+    secretIdNumUses: int(live["secret_id_num_uses"], 0)
+  };
+  return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
+};
+var readPath3 = (name) => `auth/approle/role/${name}`;
+var writeBody = (props) => {
+  const body = {
+    token_policies: props.tokenPolicies.join(","),
+    token_ttl: props.tokenTtl,
+    token_max_ttl: props.tokenMaxTtl,
+    secret_id_ttl: props.secretIdTtl
+  };
+  if (props.bindSecretId !== undefined)
+    body["bind_secret_id"] = String(props.bindSecretId);
+  if (props.secretIdNumUses !== undefined) {
+    body["secret_id_num_uses"] = String(props.secretIdNumUses);
+  }
+  return body;
+};
+var samePolicies = (want, have) => want.length === have.length && want.every((policy, index) => policy === have[index]);
+var sameTtl3 = (want, have) => {
+  const wantSeconds = parseDuration(want);
+  const haveSeconds = ttlSeconds(have);
+  return wantSeconds !== undefined && wantSeconds === haveSeconds;
+};
+var matches3 = (attributes, props) => {
+  const wantPolicies = props.tokenPolicies.slice().sort();
+  return samePolicies(wantPolicies, attributes.tokenPolicies) && sameTtl3(props.tokenTtl, attributes.tokenTtl) && sameTtl3(props.tokenMaxTtl, attributes.tokenMaxTtl) && sameTtl3(props.secretIdTtl, attributes.secretIdTtl) && (props.bindSecretId === undefined || attributes.bindSecretId === props.bindSecretId) && (props.secretIdNumUses === undefined || attributes.secretIdNumUses === props.secretIdNumUses);
+};
+
+// src/openbao/auth-role.ts
+var BaoAuthRole = Resource2("Bao.AuthRole", {
+  defaultRemovalPolicy: "retain"
+});
+var readRole = (props) => Effect4.gen(function* () {
+  const live = yield* baoRead(readPath3(props.name));
+  if (live === undefined)
+    return;
+  return attributesOf3(props, live);
+});
+var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect4.succeed(BaoAuthRole.Provider.of({
+  list: () => Effect4.succeed([]),
+  read: Effect4.fn(function* ({ olds }) {
+    return yield* readRole(olds);
+  }),
+  diff: Effect4.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved2(news))
+      return;
     const live = yield* readRole(news);
-    if (live === undefined || !matches2(live, news)) {
-      yield* baoWrite("PUT", readPath2(news.name), writeBody(news));
+    if (live === undefined)
+      return { action: "update" };
+    if (matches3(live, news))
+      return { action: "noop" };
+    return { action: "update" };
+  }),
+  reconcile: Effect4.fn(function* ({ news }) {
+    const live = yield* readRole(news);
+    if (live === undefined || !matches3(live, news)) {
+      yield* baoWrite("PUT", readPath3(news.name), writeBody(news));
     }
     const after = yield* readRole(news);
     if (after === undefined) {
-      return yield* Effect2.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
+      return yield* Effect4.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
     }
     return after;
   }),
-  delete: Effect2.fn(function* ({ output }) {
-    yield* baoDelete(readPath2(output.name));
+  delete: Effect4.fn(function* ({ output }) {
+    yield* baoDelete(readPath3(output.name));
     return;
   })
 })));
 // src/openbao/cloudflare-role.ts
-import { Resource as Resource2 } from "alchemy";
-import { isResolved as isResolved2 } from "alchemy/Diff";
-import * as Provider2 from "alchemy/Provider";
-import * as Effect5 from "effect/Effect";
+import { Resource as Resource3 } from "alchemy";
+import { isResolved as isResolved3 } from "alchemy/Diff";
+import * as Provider3 from "alchemy/Provider";
+import * as Effect7 from "effect/Effect";
 
 // src/openbao/cloudflare-group-scope.ts
 var zoneResource = (zoneId) => `com.cloudflare.api.account.zone.${zoneId}`;
@@ -348,7 +471,7 @@ var groupKey = (name, scope) => `${scope} ${name}`;
 
 // src/openbao/cloudflare-permission-groups.ts
 import * as Context2 from "effect/Context";
-import * as Effect4 from "effect/Effect";
+import * as Effect6 from "effect/Effect";
 
 // src/openbao/cloudflare-permission-groups-solve.ts
 var observationsOf = (declared, live) => declared.flatMap((role) => {
@@ -518,7 +641,7 @@ var samePolicies2 = (want, have) => want.length === have.length && want.every((w
 });
 
 // src/openbao/cloudflare-role-wire.ts
-import * as Effect3 from "effect/Effect";
+import * as Effect5 from "effect/Effect";
 
 // src/openbao/cloudflare-role-form.ts
 var rolePath = (mount, name) => `${mountPath(mount)}/roles/${name}`;
@@ -531,7 +654,7 @@ var liveRoleOf = (data) => ({
   policiesText: typeof data["policies"] === "string" ? data["policies"] : "",
   ttl: seconds(data["ttl"])
 });
-var attributesOf3 = (props, live) => {
+var attributesOf4 = (props, live) => {
   const attrs = {
     description: live.description,
     maxTtl: live.maxTtl ?? 0,
@@ -561,7 +684,7 @@ var writeBody2 = (props, policies) => ({
   policies: policiesJson(policies),
   ttl: props.ttl
 });
-var sameTtl3 = (want, have) => {
+var sameTtl4 = (want, have) => {
   const wantSeconds = parseDuration(want);
   return wantSeconds !== undefined && wantSeconds === have;
 };
@@ -570,10 +693,10 @@ var differences = (props, policies, live) => {
   if (props.description !== live.description) {
     out.push({ field: "description", have: live.description, want: props.description });
   }
-  if (!sameTtl3(props.ttl, live.ttl)) {
+  if (!sameTtl4(props.ttl, live.ttl)) {
     out.push({ field: "ttl", have: String(live.ttl), want: props.ttl });
   }
-  if (!sameTtl3(props.maxTtl, live.maxTtl)) {
+  if (!sameTtl4(props.maxTtl, live.maxTtl)) {
     out.push({ field: "max_ttl", have: String(live.maxTtl), want: props.maxTtl });
   }
   if (live.policies === undefined || !samePolicies2(policies, live.policies)) {
@@ -583,7 +706,7 @@ var differences = (props, policies, live) => {
 };
 
 // src/openbao/cloudflare-role-wire.ts
-var readCloudflareRole = (mount, name) => Effect3.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
+var readCloudflareRole = (mount, name) => Effect5.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
 var writeCloudflareRole = (mount, name, body) => baoWrite("PUT", rolePath(mount, name), body);
 var deleteCloudflareRole = (mount, name) => baoDelete(rolePath(mount, name));
 
@@ -605,9 +728,9 @@ var pick = (mount, groups, refs, hint) => {
   const unknown = refs.filter((ref) => !groups.has(groupKey(ref.name, ref.scope)));
   if (unknown.length > 0) {
     const problems = unknown.map((ref) => `unknown group ${JSON.stringify(ref.name)} at scope ${ref.scope} — ${hint}`);
-    return Effect4.fail(new CloudflareGroupsError(mount, problems));
+    return Effect6.fail(new CloudflareGroupsError(mount, problems));
   }
-  return Effect4.succeed(new Map(refs.flatMap((ref) => {
+  return Effect6.succeed(new Map(refs.flatMap((ref) => {
     const key = groupKey(ref.name, ref.scope);
     const id = groups.get(key);
     return id === undefined ? [] : [[key, id]];
@@ -615,15 +738,15 @@ var pick = (mount, groups, refs, hint) => {
 };
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var deniedHint = (mount) => `GET ${mountPath(mount)}/permission-groups answered 403 — this token's policy carries no ` + `\`path "${mountPath(mount)}/permission-groups" { capabilities = ["read"] }\` grant. ` + "It is declared in ../platform/secrets/vault/policies/homeflare-admin/" + "20-cloudflare-permission-groups.hcl and applies with `alchemy deploy` of this stack";
-var deniedNamed = (mount, read) => Effect4.catchIf(read, (error) => error.status === 403, () => Effect4.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
-var engineGroups = (mount) => Effect4.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
+var deniedNamed = (mount, read) => Effect6.catchIf(read, (error) => error.status === 403, () => Effect6.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
+var engineGroups = (mount) => Effect6.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
   const list = data?.["permission_groups"];
   if (data === undefined) {
     const why = "GET <mount>/permission-groups answered 404 — the endpoint is not deployed here";
-    return Effect4.fail(new CloudflareGroupsError(mount, [why]));
+    return Effect6.fail(new CloudflareGroupsError(mount, [why]));
   }
   if (!Array.isArray(list)) {
-    return Effect4.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
+    return Effect6.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
   }
   const scoped = new Map;
   const idsOf = new Map;
@@ -650,24 +773,24 @@ var engineGroups = (mount) => Effect4.flatMap(deniedNamed(mount, baoRead(`${moun
     const only = [...ids];
     return ids.size === 1 && only[0] !== undefined ? [[name, only[0]]] : [];
   }));
-  return problems.length > 0 ? Effect4.fail(new CloudflareGroupsError(mount, problems)) : Effect4.succeed(new Map([...atEveryScope(sole), ...scoped]));
+  return problems.length > 0 ? Effect6.fail(new CloudflareGroupsError(mount, problems)) : Effect6.succeed(new Map([...atEveryScope(sole), ...scoped]));
 });
-var permissionGroupsFromEngine = () => Effect4.sync(() => {
+var permissionGroupsFromEngine = () => Effect6.sync(() => {
   const cache = new Map;
-  const cachedFor = (mount) => Effect4.suspend(() => {
+  const cachedFor = (mount) => Effect6.suspend(() => {
     const hit = cache.get(mountPath(mount));
     if (hit !== undefined)
       return hit;
-    return Effect4.flatMap(Effect4.cached(engineGroups(mount)), (lookup) => {
+    return Effect6.flatMap(Effect6.cached(engineGroups(mount)), (lookup) => {
       cache.set(mountPath(mount), lookup);
       return lookup;
     });
   });
   return CloudflarePermissionGroups.of({
-    resolve: (mount, refs) => Effect4.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
+    resolve: (mount, refs) => Effect6.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
   });
 });
-var permissionGroupsFromLiveRoles = (declared) => Effect4.gen(function* () {
+var permissionGroupsFromLiveRoles = (declared) => Effect6.gen(function* () {
   const accountOf = new Map;
   const byAccount = new Map;
   for (const [mount, roles] of declared) {
@@ -678,9 +801,9 @@ var permissionGroupsFromLiveRoles = (declared) => Effect4.gen(function* () {
   }
   const solved = new Map;
   for (const [account, roles] of byAccount) {
-    const solve = Effect4.gen(function* () {
+    const solve = Effect6.gen(function* () {
       const live = new Map;
-      yield* Effect4.all(roles.map((role) => Effect4.map(readCloudflareRole(role.mount, role.name), (read) => {
+      yield* Effect6.all(roles.map((role) => Effect6.map(readCloudflareRole(role.mount, role.name), (read) => {
         if (read?.policies !== undefined) {
           live.set(`${role.mount}/${role.name}`, read.policies);
         }
@@ -688,11 +811,11 @@ var permissionGroupsFromLiveRoles = (declared) => Effect4.gen(function* () {
       const result = solveGroups(observationsOf(roles, live));
       const problems = describeProblems(result);
       if (problems.length > 0) {
-        return yield* Effect4.fail(new CloudflareGroupsError(`account ${account}`, problems));
+        return yield* Effect6.fail(new CloudflareGroupsError(`account ${account}`, problems));
       }
       return atEveryScope(result.groups);
     });
-    solved.set(account, yield* Effect4.cached(solve));
+    solved.set(account, yield* Effect6.cached(solve));
   }
   return CloudflarePermissionGroups.of({
     resolve: (mount, refs) => {
@@ -700,21 +823,21 @@ var permissionGroupsFromLiveRoles = (declared) => Effect4.gen(function* () {
       const lookup = account === undefined ? undefined : solved.get(account);
       if (account === undefined || lookup === undefined) {
         const why = "no declared role on this mount, so no live role can vouch for its groups";
-        return Effect4.fail(new CloudflareGroupsError(mount, [why]));
+        return Effect6.fail(new CloudflareGroupsError(mount, [why]));
       }
       const hint = `no live role on account ${account} carries it; a NEW group needs the engine endpoint`;
-      return Effect4.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
+      return Effect6.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
     }
   });
 });
 
 // src/openbao/cloudflare-role.ts
-var BaoCloudflareRole = Resource2("Bao.CloudflareRole", {
+var BaoCloudflareRole = Resource3("Bao.CloudflareRole", {
   defaultRemovalPolicy: "retain"
 });
-var BaoCloudflareRoleProvider = () => Provider2.effect(BaoCloudflareRole, Effect5.gen(function* () {
+var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect7.gen(function* () {
   const groups = yield* CloudflarePermissionGroups;
-  const resolved = (props) => Effect5.gen(function* () {
+  const resolved = (props) => Effect7.gen(function* () {
     const refs = new Map;
     for (const policy of props.policies) {
       const scope = policy.scope ?? scopeOfResource(policy.resource);
@@ -724,18 +847,18 @@ var BaoCloudflareRoleProvider = () => Provider2.effect(BaoCloudflareRole, Effect
     const ids = yield* groups.resolve(props.mount, [...refs.values()]);
     const { missing, policies } = resolvePolicies(props.policies, ids);
     if (missing.length > 0) {
-      return yield* Effect5.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
+      return yield* Effect7.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
     }
     return policies;
   });
   return BaoCloudflareRole.Provider.of({
-    list: () => Effect5.succeed([]),
-    read: Effect5.fn(function* ({ olds }) {
+    list: () => Effect7.succeed([]),
+    read: Effect7.fn(function* ({ olds }) {
       const live = yield* readCloudflareRole(olds.mount, olds.name);
-      return live === undefined ? undefined : attributesOf3(olds, live);
+      return live === undefined ? undefined : attributesOf4(olds, live);
     }),
-    diff: Effect5.fn(function* ({ news, output }) {
-      if (output === undefined || !isResolved2(news))
+    diff: Effect7.fn(function* ({ news, output }) {
+      if (output === undefined || !isResolved3(news))
         return;
       if (refusalOf(news) !== undefined)
         return { action: "update" };
@@ -745,11 +868,11 @@ var BaoCloudflareRoleProvider = () => Provider2.effect(BaoCloudflareRole, Effect
         return { action: "update" };
       return differences(news, policies, live).length === 0 ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect5.fn(function* ({ news }) {
+    reconcile: Effect7.fn(function* ({ news }) {
       const path = rolePath(news.mount, news.name);
       const refusal = refusalOf(news);
       if (refusal !== undefined) {
-        return yield* Effect5.die(new Error(`Bao.CloudflareRole ${path}: ${refusal}.`));
+        return yield* Effect7.die(new Error(`Bao.CloudflareRole ${path}: ${refusal}.`));
       }
       const policies = yield* resolved(news);
       const live = yield* readCloudflareRole(news.mount, news.name);
@@ -758,15 +881,15 @@ var BaoCloudflareRoleProvider = () => Provider2.effect(BaoCloudflareRole, Effect
       }
       const after = yield* readCloudflareRole(news.mount, news.name);
       if (after === undefined) {
-        return yield* Effect5.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
+        return yield* Effect7.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
       }
       const left = differences(news, policies, after);
       if (left.length > 0) {
-        return yield* Effect5.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
+        return yield* Effect7.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
       }
-      return attributesOf3(news, after);
+      return attributesOf4(news, after);
     }),
-    delete: Effect5.fn(function* ({ output }) {
+    delete: Effect7.fn(function* ({ output }) {
       yield* deleteCloudflareRole(output.mount, output.name);
       return;
     })
@@ -873,7 +996,7 @@ var record = (value, where) => {
     throw new RolesConfigError(where, "expected a mapping");
   return value;
 };
-var text2 = (raw, key, where) => {
+var text3 = (raw, key, where) => {
   const value = raw[key];
   if (typeof value === "string")
     return value;
@@ -901,24 +1024,24 @@ var template = (value, where) => {
   const groups = texts(raw, "groups", where);
   if (groups === undefined)
     throw new RolesConfigError(`${where}.groups`, "is required");
-  const bucket = raw["bucket"] === undefined ? undefined : text2(raw, "bucket", where);
+  const bucket = raw["bucket"] === undefined ? undefined : text3(raw, "bucket", where);
   if (bucket !== undefined && bucket.length === 0) {
     throw new RolesConfigError(`${where}.bucket`, "is empty; omit it to stay account-wide");
   }
-  const groupsScope = raw["groups_scope"] === undefined ? undefined : groupScopeNamed(text2(raw, "groups_scope", where));
+  const groupsScope = raw["groups_scope"] === undefined ? undefined : groupScopeNamed(text3(raw, "groups_scope", where));
   if (raw["groups_scope"] !== undefined && groupsScope === undefined) {
     throw new RolesConfigError(`${where}.groups_scope`, `expected one of ${Object.keys(GROUP_SCOPES).join(", ")}`);
   }
   return {
     accountGroups: texts(raw, "account_groups", where) ?? [],
     bucket,
-    bucketJurisdiction: raw["bucket_jurisdiction"] === undefined ? "default" : text2(raw, "bucket_jurisdiction", where),
-    desc: raw["desc"] === undefined ? "" : text2(raw, "desc", where),
+    bucketJurisdiction: raw["bucket_jurisdiction"] === undefined ? "default" : text3(raw, "bucket_jurisdiction", where),
+    desc: raw["desc"] === undefined ? "" : text3(raw, "desc", where),
     groups,
     groupsScope,
-    maxTtl: text2(raw, "max_ttl", where),
-    name: text2(raw, "name", where),
-    ttl: text2(raw, "ttl", where),
+    maxTtl: text3(raw, "max_ttl", where),
+    name: text3(raw, "name", where),
+    ttl: text3(raw, "ttl", where),
     zoneTypes: texts(raw, "zone_types", where) ?? [],
     zones: texts(raw, "zones", where)
   };
@@ -941,7 +1064,7 @@ var account = (key, value, surfaces) => {
     }
   }
   const zones = raw["zones"] === undefined || raw["zones"] === "all" ? "all" : texts(raw, "zones", where);
-  return { id: text2(raw, "id", where), key, surfaces: names, zones: zones ?? "all" };
+  return { id: text3(raw, "id", where), key, surfaces: names, zones: zones ?? "all" };
 };
 var parseRolesConfig = (yaml) => {
   const root = record(Bun.YAML.parse(yaml), "(document)");
@@ -952,44 +1075,44 @@ var parseRolesConfig = (yaml) => {
   const accounts = Object.entries(record(root["accounts"], "accounts")).map(([key, value]) => account(key, value, surfaces));
   return {
     accounts,
-    namespace: text2(record(root["defaults"], "defaults"), "namespace", "defaults"),
+    namespace: text3(record(root["defaults"], "defaults"), "namespace", "defaults"),
     surfaces
   };
 };
 // src/openbao/mount.ts
-import { Resource as Resource3 } from "alchemy";
-import { isResolved as isResolved3 } from "alchemy/Diff";
-import * as Provider3 from "alchemy/Provider";
-import * as Effect7 from "effect/Effect";
+import { Resource as Resource4 } from "alchemy";
+import { isResolved as isResolved4 } from "alchemy/Diff";
+import * as Provider4 from "alchemy/Provider";
+import * as Effect9 from "effect/Effect";
 
 // src/openbao/mount-wire.ts
-import * as Effect6 from "effect/Effect";
-var absentFromTable = (path, asked) => baoRead("sys/mounts").pipe(Effect6.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+import * as Effect8 from "effect/Effect";
+var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect8.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
   ...asked.errors,
   `sys/mounts could not confirm the mount is absent: ${listing.message}`
-])), Effect6.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect6.succeed(undefined) : Effect6.fail(asked)));
-var readMountData = (path) => baoRead(readPath(path)).pipe(Effect6.catchIf((error) => error.status === 400, (error) => absentFromTable(path, error)));
+])), Effect8.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect8.succeed(undefined) : Effect8.fail(asked)));
+var readMountData = (path) => baoRead(readPath(path)).pipe(Effect8.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
 var enableMount = (props) => baoWrite("POST", readPath(props.path), enableBody(props));
 var tuneMount = (props) => baoWrite("POST", tunePath(props.path), tuneBody(props));
 var disableMount = (path) => baoDelete(readPath(path));
 
 // src/openbao/mount.ts
-var BaoMount = Resource3("Bao.Mount", {
+var BaoMount = Resource4("Bao.Mount", {
   defaultRemovalPolicy: "retain"
 });
-var readMount = (props) => Effect7.gen(function* () {
+var readMount = (props) => Effect9.gen(function* () {
   const live = yield* readMountData(props.path);
   if (live === undefined)
     return;
   return attributesOf(props, live);
 });
-var BaoMountProvider = () => Provider3.effect(BaoMount, Effect7.succeed(BaoMount.Provider.of({
-  list: () => Effect7.succeed([]),
-  read: Effect7.fn(function* ({ olds }) {
+var BaoMountProvider = () => Provider4.effect(BaoMount, Effect9.succeed(BaoMount.Provider.of({
+  list: () => Effect9.succeed([]),
+  read: Effect9.fn(function* ({ olds }) {
     return yield* readMount(olds);
   }),
-  diff: Effect7.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved3(news))
+  diff: Effect9.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved4(news))
       return;
     const live = yield* readMount(news);
     if (live === undefined)
@@ -1000,7 +1123,7 @@ var BaoMountProvider = () => Provider3.effect(BaoMount, Effect7.succeed(BaoMount
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect7.fn(function* ({ news }) {
+  reconcile: Effect9.fn(function* ({ news }) {
     let live = yield* readMount(news);
     if (live === undefined) {
       yield* enableMount(news);
@@ -1008,26 +1131,26 @@ var BaoMountProvider = () => Provider3.effect(BaoMount, Effect7.succeed(BaoMount
         yield* tuneMount(news);
     } else if (!matches(live, news)) {
       if (live.type !== news.type) {
-        return yield* Effect7.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
+        return yield* Effect9.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
       }
       yield* tuneMount(news);
     }
     live = yield* readMount(news);
     if (live === undefined) {
-      return yield* Effect7.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
+      return yield* Effect9.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
     }
     return live;
   }),
-  delete: Effect7.fn(function* ({ output }) {
+  delete: Effect9.fn(function* ({ output }) {
     yield* disableMount(output.path);
     return;
   })
 })));
 // src/openbao/pki-role.ts
-import { Resource as Resource4 } from "alchemy";
-import { isResolved as isResolved4 } from "alchemy/Diff";
-import * as Provider4 from "alchemy/Provider";
-import * as Effect8 from "effect/Effect";
+import { Resource as Resource5 } from "alchemy";
+import { isResolved as isResolved5 } from "alchemy/Diff";
+import * as Provider5 from "alchemy/Provider";
+import * as Effect10 from "effect/Effect";
 
 // src/openbao/pki-role-form.ts
 var sorted = (values) => [...values].sort();
@@ -1050,7 +1173,7 @@ var canonical2 = (input) => ({
   signatureBits: input.signatureBits,
   ttlSeconds: input.ttlSeconds
 });
-var seconds2 = (text3) => parseDuration(text3) ?? -1;
+var seconds2 = (text4) => parseDuration(text4) ?? -1;
 var canonicalFromProps = (props) => canonical2({
   allowBareDomains: props.allowBareDomains ?? false,
   allowGlobDomains: props.allowGlobDomains ?? false,
@@ -1104,7 +1227,7 @@ var ttlText2 = (value) => {
 };
 var digestOf = (form) => sha256(JSON.stringify(form));
 var rolePath2 = (props) => `${mountPath(props.mount ?? "pki")}/roles/${props.name}`;
-var attributesOf4 = (props, live) => {
+var attributesOf5 = (props, live) => {
   const form = canonicalFromLive(live);
   return {
     ...form,
@@ -1139,26 +1262,26 @@ var writeBody3 = (props) => {
     body["ext_key_usage"] = usages.join(",");
   return body;
 };
-var matches3 = (attributes, props) => attributes.digest === digestOf(canonicalFromProps(props));
+var matches4 = (attributes, props) => attributes.digest === digestOf(canonicalFromProps(props));
 
 // src/openbao/pki-role.ts
-var BaoPkiRole = Resource4("Bao.PkiRole", {
+var BaoPkiRole = Resource5("Bao.PkiRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole2 = (props) => Effect8.gen(function* () {
+var readRole2 = (props) => Effect10.gen(function* () {
   const live = yield* baoRead(rolePath2(props));
   if (live === undefined)
     return;
-  return attributesOf4(props, live);
+  return attributesOf5(props, live);
 });
-var badDurations = (props) => [["ttl", props.ttl], ["maxTtl", props.maxTtl]].filter(([, text3]) => parseDuration(text3) === undefined);
-var BaoPkiRoleProvider = () => Provider4.effect(BaoPkiRole, Effect8.succeed(BaoPkiRole.Provider.of({
-  list: () => Effect8.succeed([]),
-  read: Effect8.fn(function* ({ olds }) {
+var badDurations = (props) => [["ttl", props.ttl], ["maxTtl", props.maxTtl]].filter(([, text4]) => parseDuration(text4) === undefined);
+var BaoPkiRoleProvider = () => Provider5.effect(BaoPkiRole, Effect10.succeed(BaoPkiRole.Provider.of({
+  list: () => Effect10.succeed([]),
+  read: Effect10.fn(function* ({ olds }) {
     return yield* readRole2(olds);
   }),
-  diff: Effect8.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved4(news))
+  diff: Effect10.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved5(news))
       return;
     if (mountPath(news.mount ?? "pki") !== output.mount)
       return { action: "replace" };
@@ -1168,40 +1291,40 @@ var BaoPkiRoleProvider = () => Provider4.effect(BaoPkiRole, Effect8.succeed(BaoP
     const live = yield* readRole2(news);
     if (live === undefined)
       return { action: "update" };
-    return matches3(live, news) ? { action: "noop" } : { action: "update" };
+    return matches4(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect8.fn(function* ({ news }) {
+  reconcile: Effect10.fn(function* ({ news }) {
     const path = rolePath2(news);
     if (news.allowedDomains.length === 0) {
-      return yield* Effect8.die(new Error(`Bao.PkiRole ${path}: allowedDomains is empty. With allow_any_name false ` + "that role can issue no certificate at all."));
+      return yield* Effect10.die(new Error(`Bao.PkiRole ${path}: allowedDomains is empty. With allow_any_name false ` + "that role can issue no certificate at all."));
     }
     const bad = badDurations(news);
     if (bad.length > 0) {
-      return yield* Effect8.die(new Error(`Bao.PkiRole ${path}: ${bad.map(([k, v]) => `${k}=${v}`).join(", ")} ` + "is not a duration OpenBao parses (expect 30m, 720h, 8760h or 0)."));
+      return yield* Effect10.die(new Error(`Bao.PkiRole ${path}: ${bad.map(([k, v]) => `${k}=${v}`).join(", ")} ` + "is not a duration OpenBao parses (expect 30m, 720h, 8760h or 0)."));
     }
     const live = yield* readRole2(news);
-    if (live === undefined || !matches3(live, news)) {
+    if (live === undefined || !matches4(live, news)) {
       yield* baoWrite("PUT", path, writeBody3(news));
     }
     const after = yield* readRole2(news);
     if (after === undefined) {
-      return yield* Effect8.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
+      return yield* Effect10.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
     }
-    if (!matches3(after, news)) {
-      return yield* Effect8.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
+    if (!matches4(after, news)) {
+      return yield* Effect10.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
     }
     return after;
   }),
-  delete: Effect8.fn(function* ({ output }) {
+  delete: Effect10.fn(function* ({ output }) {
     yield* baoDelete(rolePath2(output));
     return;
   })
 })));
 // src/openbao/policy.ts
-import { Resource as Resource5 } from "alchemy";
-import { isResolved as isResolved5 } from "alchemy/Diff";
-import * as Provider5 from "alchemy/Provider";
-import * as Effect10 from "effect/Effect";
+import { Resource as Resource6 } from "alchemy";
+import { isResolved as isResolved6 } from "alchemy/Diff";
+import * as Provider6 from "alchemy/Provider";
+import * as Effect12 from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 
@@ -1209,32 +1332,32 @@ import * as Path from "effect/Path";
 var isEmptyAssembly = (parts, joined) => parts === 0 || !/^\s*path\s+"/m.test(joined);
 
 // src/openbao/policy-wire.ts
-import * as Effect9 from "effect/Effect";
+import * as Effect11 from "effect/Effect";
 var policyPath = (name) => `sys/policies/acl/${name}`;
-var readPolicy = (name) => Effect9.flatMap(baoRead(policyPath(name)), (data) => {
+var readPolicy = (name) => Effect11.flatMap(baoRead(policyPath(name)), (data) => {
   if (data === undefined)
-    return Effect9.succeed("");
-  const text3 = data["policy"];
-  return typeof text3 === "string" ? Effect9.succeed(text3) : Effect9.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
+    return Effect11.succeed("");
+  const text4 = data["policy"];
+  return typeof text4 === "string" ? Effect11.succeed(text4) : Effect11.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
 });
 var writePolicy = (name, hcl) => baoWrite("PUT", policyPath(name), { policy: hcl });
 var deletePolicy = (name) => baoDelete(policyPath(name));
 
 // src/openbao/policy.ts
-var BaoPolicy = Resource5("Bao.Policy", {
+var BaoPolicy = Resource6("Bao.Policy", {
   defaultRemovalPolicy: "retain"
 });
 var grantsOf = (hcl) => (hcl.match(/^path /gm) ?? []).length;
-var attributesOf5 = (name, hcl, parts) => ({
+var attributesOf6 = (name, hcl, parts) => ({
   name,
   digest: sha256(hcl),
   grants: grantsOf(hcl),
   parts
 });
-var BaoPolicyProvider = () => Provider5.effect(BaoPolicy, Effect10.gen(function* () {
+var BaoPolicyProvider = () => Provider6.effect(BaoPolicy, Effect12.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const assemble = (dir) => Effect10.gen(function* () {
+  const assemble = (dir) => Effect12.gen(function* () {
     const entries2 = (yield* fs.readDirectory(dir)).filter((f) => f.endsWith(".hcl")).sort();
     let joined = "";
     for (const f of entries2)
@@ -1243,44 +1366,44 @@ var BaoPolicyProvider = () => Provider5.effect(BaoPolicy, Effect10.gen(function*
     return { joined, parts: entries2.length };
   });
   return BaoPolicy.Provider.of({
-    list: () => Effect10.succeed([]),
-    read: Effect10.fn(function* ({ olds }) {
+    list: () => Effect12.succeed([]),
+    read: Effect12.fn(function* ({ olds }) {
       const live = yield* readPolicy(olds.name);
-      return live.length === 0 ? undefined : attributesOf5(olds.name, live, 0);
+      return live.length === 0 ? undefined : attributesOf6(olds.name, live, 0);
     }),
-    diff: Effect10.fn(function* ({ news, output }) {
-      if (output === undefined || !isResolved5(news))
+    diff: Effect12.fn(function* ({ news, output }) {
+      if (output === undefined || !isResolved6(news))
         return;
       const { joined } = yield* assemble(news.fragments);
       const live = yield* readPolicy(news.name);
       return live.length > 0 && sha256(live) === sha256(joined) ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect10.fn(function* ({ news }) {
+    reconcile: Effect12.fn(function* ({ news }) {
       const name = news.name;
       const { joined, parts } = yield* assemble(news.fragments);
       if (isEmptyAssembly(parts, joined))
-        return yield* Effect10.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
+        return yield* Effect12.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
       const current = yield* readPolicy(name);
       if (current.length > 0 && sha256(current) === sha256(joined)) {
-        return attributesOf5(name, joined, parts);
+        return attributesOf6(name, joined, parts);
       }
       yield* writePolicy(name, joined);
-      return attributesOf5(name, joined, parts);
+      return attributesOf6(name, joined, parts);
     }),
-    delete: Effect10.fn(function* ({ output }) {
+    delete: Effect12.fn(function* ({ output }) {
       yield* deletePolicy(output.name);
       return;
     })
   });
 }));
 // src/openbao/proxmox-role.ts
-import { Resource as Resource6 } from "alchemy";
-import { isResolved as isResolved6 } from "alchemy/Diff";
-import * as Provider6 from "alchemy/Provider";
-import * as Effect11 from "effect/Effect";
+import { Resource as Resource7 } from "alchemy";
+import { isResolved as isResolved7 } from "alchemy/Diff";
+import * as Provider7 from "alchemy/Provider";
+import * as Effect13 from "effect/Effect";
 
 // src/openbao/proxmox-role-form.ts
-var text3 = (value) => typeof value === "string" ? value : "";
+var text4 = (value) => typeof value === "string" ? value : "";
 var ttlText3 = (seconds3, fallback = "0") => {
   if (seconds3 === undefined)
     return fallback;
@@ -1293,11 +1416,11 @@ var ttlText3 = (seconds3, fallback = "0") => {
   return `${String(seconds3)}s`;
 };
 var rolePath3 = (mount, name) => `${mountPath(mount)}/roles/${name}`;
-var attributesOf6 = (props, live) => {
+var attributesOf7 = (props, live) => {
   const attrs = {
     mount: mountPath(props.mount),
-    name: text3(live["name"]) || props.name,
-    mintUser: text3(live["mint_user"]),
+    name: text4(live["name"]) || props.name,
+    mintUser: text4(live["mint_user"]),
     ttl: ttlText3(ttlSeconds(live["ttl"])),
     maxTtl: ttlText3(ttlSeconds(live["max_ttl"]))
   };
@@ -1318,74 +1441,74 @@ var writeBody4 = (props) => {
     body: { mint_user: props.mintUser, ttl: String(ttl), max_ttl: String(maxTtl) }
   };
 };
-var sameTtl4 = (want, have) => {
+var sameTtl5 = (want, have) => {
   const wantSeconds = parseDuration(want);
   const haveSeconds = ttlSeconds(have);
   return wantSeconds !== undefined && wantSeconds === haveSeconds;
 };
-var matches4 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl4(props.ttl, attributes.ttl) && sameTtl4(props.maxTtl, attributes.maxTtl);
+var matches5 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl5(props.ttl, attributes.ttl) && sameTtl5(props.maxTtl, attributes.maxTtl);
 
 // src/openbao/proxmox-role.ts
-var BaoProxmoxRole = Resource6("Bao.ProxmoxRole", {
+var BaoProxmoxRole = Resource7("Bao.ProxmoxRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole3 = (props) => Effect11.gen(function* () {
+var readRole3 = (props) => Effect13.gen(function* () {
   const live = yield* baoRead(rolePath3(props.mount, props.name));
   if (live === undefined)
     return;
-  return attributesOf6(props, live);
+  return attributesOf7(props, live);
 });
-var BaoProxmoxRoleProvider = () => Provider6.effect(BaoProxmoxRole, Effect11.succeed(BaoProxmoxRole.Provider.of({
-  list: () => Effect11.succeed([]),
-  read: Effect11.fn(function* ({ olds }) {
+var BaoProxmoxRoleProvider = () => Provider7.effect(BaoProxmoxRole, Effect13.succeed(BaoProxmoxRole.Provider.of({
+  list: () => Effect13.succeed([]),
+  read: Effect13.fn(function* ({ olds }) {
     return yield* readRole3(olds);
   }),
-  diff: Effect11.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved6(news))
+  diff: Effect13.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved7(news))
       return;
     const live = yield* readRole3(news);
     if (live === undefined)
       return { action: "update" };
-    if (matches4(live, news))
+    if (matches5(live, news))
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect11.fn(function* ({ news }) {
+  reconcile: Effect13.fn(function* ({ news }) {
     const live = yield* readRole3(news);
     if (live !== undefined && live.mintUser !== news.mintUser && news.allowMintUserChange !== live.mintUser) {
-      return yield* Effect11.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: live mint_user ` + `${live.mintUser} != declared ${news.mintUser}. Every token this role mints ` + "inherits the ACL of that PVE user. To re-scope deliberately, declare " + `allowMintUserChange: '${live.mintUser}'.`));
+      return yield* Effect13.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: live mint_user ` + `${live.mintUser} != declared ${news.mintUser}. Every token this role mints ` + "inherits the ACL of that PVE user. To re-scope deliberately, declare " + `allowMintUserChange: '${live.mintUser}'.`));
     }
-    if (live === undefined || !matches4(live, news)) {
+    if (live === undefined || !matches5(live, news)) {
       const write = writeBody4(news);
       if (!write.ok) {
-        return yield* Effect11.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
+        return yield* Effect13.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
       }
       yield* baoWrite("PUT", rolePath3(news.mount, news.name), write.body);
     }
     const after = yield* readRole3(news);
     if (after === undefined) {
-      return yield* Effect11.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: write returned no error ` + "but the role is still absent."));
+      return yield* Effect13.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: write returned no error ` + "but the role is still absent."));
     }
     return after;
   }),
-  delete: Effect11.fn(function* ({ output }) {
+  delete: Effect13.fn(function* ({ output }) {
     yield* baoDelete(rolePath3(output.mount, output.name));
     return;
   })
 })));
 // src/openbao/ssh-role.ts
-import { Resource as Resource7 } from "alchemy";
-import { isResolved as isResolved7 } from "alchemy/Diff";
-import * as Provider7 from "alchemy/Provider";
-import * as Effect12 from "effect/Effect";
+import { Resource as Resource8 } from "alchemy";
+import { isResolved as isResolved8 } from "alchemy/Diff";
+import * as Provider8 from "alchemy/Provider";
+import * as Effect14 from "effect/Effect";
 
 // src/openbao/ssh-role-form.ts
 var mountOf = (mount) => (mount ?? "ssh").replace(/\/+$/, "");
-var readPath3 = (mount, name) => `${mountOf(mount)}/roles/${name}`;
-var text4 = (value) => typeof value === "string" ? value : "";
+var readPath4 = (mount, name) => `${mountOf(mount)}/roles/${name}`;
+var text5 = (value) => typeof value === "string" ? value : "";
 var bool3 = (value, fallback) => typeof value === "boolean" ? value : fallback;
 var csvList = (value) => {
-  const parts = Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : text4(value).split(",");
+  const parts = Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : text5(value).split(",");
   return [
     ...new Set(parts.map((entry) => entry.trim()).filter((entry) => entry.length > 0))
   ].sort();
@@ -1396,7 +1519,7 @@ var extMap = (value) => {
     return out;
   const source = value;
   for (const key of Object.keys(source).sort())
-    out[key] = text4(source[key]);
+    out[key] = text5(source[key]);
   return out;
 };
 var resolve = (props) => ({
@@ -1417,12 +1540,12 @@ var resolve = (props) => ({
   ttl: props.ttl,
   maxTtl: props.maxTtl
 });
-var attributesOf7 = (form, live) => {
+var attributesOf8 = (form, live) => {
   const attrs = {
     name: form.name,
     mount: form.mount,
     allowedUsers: csvList(live["allowed_users"]),
-    defaultUser: text4(live["default_user"]),
+    defaultUser: text5(live["default_user"]),
     allowUserCertificates: bool3(live["allow_user_certificates"], false),
     allowHostCertificates: bool3(live["allow_host_certificates"], false),
     allowedDomains: csvList(live["allowed_domains"]),
@@ -1433,7 +1556,7 @@ var attributesOf7 = (form, live) => {
     allowedCriticalOptions: csvList(live["allowed_critical_options"]),
     defaultCriticalOptions: extMap(live["default_critical_options"]),
     allowEmptyPrincipals: bool3(live["allow_empty_principals"], false),
-    keyType: text4(live["key_type"]) || "ca",
+    keyType: text5(live["key_type"]) || "ca",
     ttlSeconds: ttlSeconds(live["ttl"]) ?? 0,
     maxTtlSeconds: ttlSeconds(live["max_ttl"]) ?? 0
   };
@@ -1462,19 +1585,19 @@ var sameMap = (want, have) => {
   const keys = Object.keys(want);
   return keys.length === Object.keys(have).length && keys.every((key) => have[key] === want[key]);
 };
-var sameTtl5 = (want, have) => parseDuration(want) === have;
+var sameTtl6 = (want, have) => parseDuration(want) === have;
 var badDurations2 = (form) => ["ttl", "maxTtl"].filter((field) => parseDuration(form[field]) === undefined);
-var matches5 = (attributes, form) => attributes.keyType === "ca" && sameList2(form.allowedUsers, attributes.allowedUsers) && attributes.defaultUser === form.defaultUser && attributes.allowUserCertificates === form.allowUserCertificates && attributes.allowHostCertificates === form.allowHostCertificates && sameList2(form.allowedDomains, attributes.allowedDomains) && attributes.allowSubdomains === form.allowSubdomains && attributes.allowBareDomains === form.allowBareDomains && sameList2(form.allowedExtensions, attributes.allowedExtensions) && sameMap(form.defaultExtensions, attributes.defaultExtensions) && sameList2(form.allowedCriticalOptions, attributes.allowedCriticalOptions) && sameMap(form.defaultCriticalOptions, attributes.defaultCriticalOptions) && attributes.allowEmptyPrincipals === form.allowEmptyPrincipals && sameTtl5(form.ttl, attributes.ttlSeconds) && sameTtl5(form.maxTtl, attributes.maxTtlSeconds);
+var matches6 = (attributes, form) => attributes.keyType === "ca" && sameList2(form.allowedUsers, attributes.allowedUsers) && attributes.defaultUser === form.defaultUser && attributes.allowUserCertificates === form.allowUserCertificates && attributes.allowHostCertificates === form.allowHostCertificates && sameList2(form.allowedDomains, attributes.allowedDomains) && attributes.allowSubdomains === form.allowSubdomains && attributes.allowBareDomains === form.allowBareDomains && sameList2(form.allowedExtensions, attributes.allowedExtensions) && sameMap(form.defaultExtensions, attributes.defaultExtensions) && sameList2(form.allowedCriticalOptions, attributes.allowedCriticalOptions) && sameMap(form.defaultCriticalOptions, attributes.defaultCriticalOptions) && attributes.allowEmptyPrincipals === form.allowEmptyPrincipals && sameTtl6(form.ttl, attributes.ttlSeconds) && sameTtl6(form.maxTtl, attributes.maxTtlSeconds);
 
 // src/openbao/ssh-role.ts
-var BaoSshRole = Resource7("Bao.SshRole", {
+var BaoSshRole = Resource8("Bao.SshRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole4 = (form) => Effect12.gen(function* () {
-  const live = yield* baoRead(readPath3(form.mount, form.name));
+var readRole4 = (form) => Effect14.gen(function* () {
+  const live = yield* baoRead(readPath4(form.mount, form.name));
   if (live === undefined)
     return;
-  return { attributes: attributesOf7(form, live), live };
+  return { attributes: attributesOf8(form, live), live };
 });
 var UNMANAGED_DEFAULTS = {
   algorithm_signer: "default",
@@ -1496,15 +1619,15 @@ var wouldErase = (live) => {
   }
   return lost.sort();
 };
-var refuse = (message) => Effect12.die(new Error(message));
-var BaoSshRoleProvider = () => Provider7.effect(BaoSshRole, Effect12.succeed(BaoSshRole.Provider.of({
-  list: () => Effect12.succeed([]),
-  read: Effect12.fn(function* ({ olds }) {
+var refuse = (message) => Effect14.die(new Error(message));
+var BaoSshRoleProvider = () => Provider8.effect(BaoSshRole, Effect14.succeed(BaoSshRole.Provider.of({
+  list: () => Effect14.succeed([]),
+  read: Effect14.fn(function* ({ olds }) {
     const found = yield* readRole4(resolve(olds));
     return found?.attributes;
   }),
-  diff: Effect12.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved7(news))
+  diff: Effect14.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved8(news))
       return;
     const form = resolve(news);
     if (output.mount !== form.mount || output.name !== form.name) {
@@ -1513,11 +1636,11 @@ var BaoSshRoleProvider = () => Provider7.effect(BaoSshRole, Effect12.succeed(Bao
     const found = yield* readRole4(form);
     if (found === undefined)
       return { action: "update" };
-    return matches5(found.attributes, form) ? { action: "noop" } : { action: "update" };
+    return matches6(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect12.fn(function* ({ news }) {
+  reconcile: Effect14.fn(function* ({ news }) {
     const form = resolve(news);
-    const path = readPath3(form.mount, form.name);
+    const path = readPath4(form.mount, form.name);
     const bad = badDurations2(form);
     if (bad.length > 0) {
       return yield* refuse(`Bao.SshRole ${path}: ${bad.join(", ")} is not a duration parseDuration understands ` + "(`0` or `<n>s|m|h|d`). It would write, then report update on every plan forever.");
@@ -1526,7 +1649,7 @@ var BaoSshRoleProvider = () => Provider7.effect(BaoSshRole, Effect12.succeed(Bao
       return yield* refuse(`Bao.SshRole ${path}: allowUserCertificates with an empty allowedUsers and ` + "allowEmptyPrincipals false. Every sign request against it would be rejected.");
     }
     const found = yield* readRole4(form);
-    if (found === undefined || !matches5(found.attributes, form)) {
+    if (found === undefined || !matches6(found.attributes, form)) {
       if (found !== undefined) {
         const lost = wouldErase(found.live);
         if (lost.length > 0) {
@@ -1541,12 +1664,14 @@ var BaoSshRoleProvider = () => Provider7.effect(BaoSshRole, Effect12.succeed(Bao
     }
     return after.attributes;
   }),
-  delete: Effect12.fn(function* ({ output }) {
-    yield* baoDelete(readPath3(output.mount, output.name));
+  delete: Effect14.fn(function* ({ output }) {
+    yield* baoDelete(readPath4(output.mount, output.name));
     return;
   })
 })));
 export {
+  BaoAuthMethod,
+  BaoAuthMethodProvider,
   BaoAuthRole,
   BaoAuthRoleProvider,
   BaoCloudflareRole,
@@ -1570,5 +1695,5 @@ export {
   permissionGroupsFromLiveRoles
 };
 
-//# debugId=63DBD5E0F5E3F35664756E2164756E21
+//# debugId=8FBBE010DA02328C64756E2164756E21
 //# sourceMappingURL=index.js.map