@homeflare/alchemy 0.37.4 → 0.37.6

package/dist/proxmox/node-network-wire.d.ts

@@ -54,14 +54,17 @@ export interface NodeNetworkAttributes {
  *   `{"errors":{"iface":"interface does not exist"},"data":null,"message":"Parameter verification
  *   failed.\n"}` at HTTP 400 — a THIRD shape, different from every other migrated family's
  *   measured 500. `@distilled.cloud/proxmox` types this as a genuine typed error,
- *   `ParameterVerificationFailed` (`errors.ts`), carrying the per-field `errors` object rather
- *   than collapsing it to an opaque `BadRequest` — PVE's OWN 400 is never one shape (it is
- *   whatever the endpoint's parameter verification rejected), so `errors.ts`'s own header spells
- *   out why this ONE typed error is global rather than per-operation.
- * ⛔ ONLY THIS EXACT SIGNAL MEANS ABSENT, EVEN WITH THE FOLD BELOW. A different 400 reason, a
- *   permission gap, a network blip, or ANY OTHER `ParameterVerificationFailed` reason is never
- *   read as "this interface is not there" — `diff` calls this directly and propagates every one
- *   of them loudly.
+ *   `NetworkInterfaceNotFound` (`nodes.ts`, generated from `patches/nodes/network-errors.json`),
+ *   attached ONLY to `getNodeNetwork`'s error union and matched by the SDK's own
+ *   `errorEnvelope`/`matchTypedError` against the EXACT sole-field body `errors.iface ===
+ *   "interface does not exist"` — the precision the code here used to check by hand
+ *   (`error.errors['iface'] === '…'`) is now the SDK's own matcher contract, not this file's.
+ *   Any 400 that fails that exact match (a different field, a different message, more than one
+ *   field) decodes as the generic `ParameterVerificationFailed` instead, never this tag.
+ * ⛔ ONLY THIS EXACT SIGNAL MEANS ABSENT, EVEN WITH THE FOLD BELOW. A different 400 reason
+ *   (`ParameterVerificationFailed`), a permission gap, a network blip, or any other failure is
+ *   never read as "this interface is not there" — `diff` calls this directly and propagates
+ *   every one of them loudly.
  */
 export declare const readInterfaceOrFail: (props: NodeNetworkProps) => Effect.Effect<typeof UNREADABLE | NodeNetworkAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
@@ -76,8 +79,9 @@ export declare const readInterfaceOrFail: (props: NodeNetworkProps) => Effect.Ef
  *   interrupted-create recovery, and Apply.ts's delete recovery, all call `read` with
  *   `output: undefined` and NO catch of their own (`Plan.ts` v2.0.0-beta.79 ~line 1308) — and
  *   Plan.ts fails the WHOLE PLAN, every other resource included, if that call throws. A malformed
- *   `iface` in ONE brand-new declaration (a DIFFERENT `ParameterVerificationFailed` than the
- *   absence one) would abort `bun run plan` for the entire stack under the precise-only design,
+ *   `iface` in ONE brand-new declaration (a `ParameterVerificationFailed`, DIFFERENT from the
+ *   `NetworkInterfaceNotFound` absence tag) would abort `bun run plan` for the entire stack under
+ *   the precise-only design,
  *   where every other migrated family instead defers that same malformed declaration to a scoped,
  *   loud refusal at apply. This restores that same fold for those three call sites.
  */

package/dist/proxmox/node-network-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-network-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network-wire.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,KAAK,gBAAgB,EAOtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,CAAC;AAEX;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AA4DD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,UAAW,gBAAgB,ylCAmBxD,CAAC;AAEJ;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,UAAW,gBAAgB,sIACmB,CAAC;AAEzE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,qBAAqB,GAAG,UAAU,GAAG,SAAS,sCAC3C,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAcnB,CAAC"}
+{"version":3,"file":"node-network-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network-wire.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,KAAK,gBAAgB,EAOtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,CAAC;AAEX;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AA4DD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,mBAAmB,UAAW,gBAAgB,ylCAaxD,CAAC;AAEJ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,aAAa,UAAW,gBAAgB,sIACmB,CAAC;AAEzE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,qBAAqB,GAAG,UAAU,GAAG,SAAS,sCAC3C,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAcnB,CAAC"}

package/docs/upstream-conformance.md

@@ -144,9 +144,11 @@ then tidiness.
    - 42 test files on `node:test` (S43);
    - `Bao.*` type strings, where the vendor name is `OpenBao` (H14).
 
-   No distilled SDK exists. OpenBao serves an OpenAPI document, so a generated SDK in
-   distilled's shape is the S23 path. **Decision:** maintainer, on whether the kit authors
-   a distilled package.
+   The generated SDK ships as `@homeflare/distilled-openbao` (interim alias for
+   `@distilled.cloud/openbao`). `Bao.Policy` and `Bao.AuthRole` use it for CRUD and rename collision
+   reads, sharing the existing eight-request gate, timeout and agent transport. Other
+   Bao families still use the raw client. Auth/login envelope decoding and house plugin
+   schemas remain separate SDK work before those families can migrate.
 
 ## Remaining family findings
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.37.4",
+  "version": "0.37.6",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",
@@ -122,9 +122,10 @@
     "@distilled.cloud/grafana": "npm:@homeflare/distilled-grafana@0.2.0",
     "@distilled.cloud/litellm": "npm:@homeflare/distilled-litellm@0.2.0",
     "@distilled.cloud/netbox": "npm:@homeflare/distilled-netbox@0.3.0",
+    "@distilled.cloud/openbao": "npm:@homeflare/distilled-openbao@0.2.2",
     "@distilled.cloud/opnsense": "npm:@homeflare/distilled-opnsense@0.2.0",
     "@distilled.cloud/paperless-ngx": "npm:@homeflare/distilled-paperless-ngx@0.3.0",
-    "@distilled.cloud/proxmox": "npm:@homeflare/distilled-proxmox@0.3.1",
+    "@distilled.cloud/proxmox": "npm:@homeflare/distilled-proxmox@0.3.2",
     "@distilled.cloud/proxmox-backup": "npm:@homeflare/distilled-proxmox-backup@0.3.1",
     "@distilled.cloud/unifi-network": "npm:@homeflare/distilled-unifi-network@0.2.0"
   },

package/src/linux/directory-read.ts

@@ -0,0 +1,24 @@
+/**
+ * The directory a read may stat.
+ *
+ * ⛔ A `creating` ROW CAN HAVE NO PATH. With `path: Output.interpolate`, Apply commits the row
+ *   while the path is still an Output, so the next plan's recovery read is asked with `path`
+ *   missing. `runner.stat` of that value throws `path must be a string` and the plan never
+ *   finishes — the same brick `binary-read.ts` already closes for `Release.Binary`. A recovery
+ *   (`recovering`) returns undefined and the create is re-driven. A probe with a missing path
+ *   still fails, as a message, before any host call.
+ */
+import type { HostRunner } from '../launchd/runner.ts';
+import { type HostDirectoryAttributes, readDirectory } from './directory-lifecycle.ts';
+
+export const readInterruptedDirectory = (
+  runner: HostRunner,
+  path: unknown,
+  recovering: boolean,
+): Promise<HostDirectoryAttributes | undefined> => {
+  if (typeof path !== 'string') {
+    if (recovering) return Promise.resolve(undefined);
+    return Promise.reject(new Error('Host.Directory path must be a string'));
+  }
+  return readDirectory(runner, path);
+};

package/src/linux/directory.test.ts

@@ -10,6 +10,7 @@ import {
   readDirectory,
   reconcileDirectory,
 } from './directory-lifecycle.ts';
+import { readInterruptedDirectory } from './directory-read.ts';
 import { fakeLinuxHost } from './fake-linux-host.ts';
 
 const host = () =>
@@ -154,3 +155,22 @@ describe('validation', () => {
     );
   });
 });
+
+describe('an interrupted create', () => {
+  test('a missing path is not stat-ed, and a probe still fails', async () => {
+    const fake = host();
+    let stats = 0;
+    const runner = {
+      ...fake.runner,
+      stat: async (path: string) => {
+        stats += 1;
+        return fake.runner.stat(path);
+      },
+    };
+    expect(await readInterruptedDirectory(runner, undefined, true)).toBeUndefined();
+    await expect(readInterruptedDirectory(runner, undefined, false)).rejects.toThrow(
+      'path must be a string',
+    );
+    expect(stats).toBe(0);
+  });
+});

package/src/linux/directory.ts

@@ -18,13 +18,10 @@ import { lift, resolvedString } from '../launchd/host-effect.ts';
 import { HostRunnerService } from '../launchd/runner.ts';
 import { adoptsAtApply } from '../ownership/adopt.ts';
 import { noteUnfinished } from '../ownership/resume.ts';
+import { recordedGeneration } from '../ownership/rows.ts';
 import type { HostDirectoryAttributes, HostDirectoryProps } from './directory-lifecycle.ts';
-import {
-  deleteDirectory,
-  diffDirectory,
-  readDirectory,
-  reconcileDirectory,
-} from './directory-lifecycle.ts';
+import { deleteDirectory, diffDirectory, reconcileDirectory } from './directory-lifecycle.ts';
+import { readInterruptedDirectory } from './directory-read.ts';
 
 export type { HostDirectoryAttributes, HostDirectoryProps } from './directory-lifecycle.ts';
 
@@ -44,11 +41,24 @@ export const HostDirectoryProvider = () =>
       return HostDirectory.Provider.of({
         list: () => Effect.succeed([]),
 
-        read: ({ olds, output }) =>
-          lift(async () => {
-            const found = await readDirectory(runner, olds.path);
-            if (found === undefined) return undefined;
-            return output === undefined ? Unowned(found) : found;
+        // ⛔ Recovery of a `creating` row whose path was still an Output never stats (directory-read.ts).
+        read: ({ fqn, instanceId, olds, output }) =>
+          Effect.gen(function* () {
+            const recovering =
+              typeof olds.path === 'string'
+                ? false
+                : (yield* recordedGeneration(fqn, instanceId)) !== undefined;
+            if (recovering) {
+              yield* Effect.logWarning(
+                `${fqn}: the interrupted create's row has no directory path; nothing is recovered, ` +
+                  'and the create is re-driven with the declaration as it is now',
+              );
+            }
+            return yield* lift(async () => {
+              const found = await readInterruptedDirectory(runner, olds.path, recovering);
+              if (found === undefined) return undefined;
+              return output === undefined ? Unowned(found) : found;
+            });
           }),
 
         diff: ({ instanceId, news, output }) => {

package/src/litellm/operations.ts

@@ -34,6 +34,7 @@ import type { LitellmOpContext } from '@distilled.cloud/litellm/Protocol';
 import type { ConfigError } from '@distilled.cloud/litellm/Errors';
 import * as Effect from 'effect/Effect';
 import * as Semaphore from 'effect/Semaphore';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
 
 export type { LitellmOpContext } from '@distilled.cloud/litellm/Protocol';
 export type LitellmRequirements = LitellmOpContext;
@@ -67,6 +68,18 @@ const semaphoreFor = (baseUrl: string): Effect.Effect<Semaphore.Semaphore> =>
  *   `Credentials`'s own type — so `E` (the wrapped operation's error) already contains it, and
  *   this widening is a genuine no-op for callers, not dead type-state left over from the revert.
  */
+/**
+ * ⛔ THE STACK'S AMBIENT `HttpClient` MAY BE CADDY'S. `caddyProviders()` provideMerges a client
+ *   that dials the admin listener and ignores the request host (`caddy-http-client.ts`). Measured
+ *   2026-09-25: that client answers `GET /config/pass_through_endpoint` with HTTP 200 `null`
+ *   (Caddy's empty-config body). The decoded value then has no `endpoints`, and `locate` throws
+ *   `rows.find` of undefined. FetchHttpClient uses the URL the LiteLLM protocol built. An outer
+ *   `Fetch` service still wins inside that client, which is how the fake proxy stays the test
+ *   transport.
+ */
+const throughFetch = <A, E, R>(io: Effect.Effect<A, E, R>) =>
+  io.pipe(Effect.provide(FetchHttpClient.layer));
+
 const mutate = <A, E>(
   io: Effect.Effect<A, E, LitellmOpContext>,
 ): Effect.Effect<A, E | ConfigError, LitellmOpContext> =>
@@ -74,18 +87,32 @@ const mutate = <A, E>(
     const resolve = yield* Credentials;
     const creds = yield* resolve;
     const semaphore = yield* semaphoreFor(creds.apiBaseUrl);
-    return yield* semaphore.withPermits(1)(io);
+    return yield* semaphore.withPermits(1)(throughFetch(io));
   });
 
+const endpointsOf = (
+  response: misc.PassThroughEndpointResponse,
+): Effect.Effect<readonly misc.PassThroughGenericEndpoint[]> => {
+  const rows = response.endpoints;
+  if (!Array.isArray(rows)) {
+    return Effect.die(
+      new Error(
+        'GET /config/pass_through_endpoint decoded no endpoints array. The call reached something other than the LiteLLM proxy.',
+      ),
+    );
+  }
+  return Effect.succeed(rows);
+};
+
 /** GET /config/pass_through_endpoint — every row, config-file and DB alike. Not under the semaphore: reads don't race the field. */
 export const listPassThroughEndpoints = (): Effect.Effect<
   readonly misc.PassThroughGenericEndpoint[],
   misc.GetPassThroughEndpointsConfigPassThroughEndpointGetError,
   LitellmOpContext
 > =>
-  misc
-    .getPassThroughEndpointsConfigPassThroughEndpointGet({})
-    .pipe(Effect.map((response) => response.endpoints));
+  throughFetch(misc.getPassThroughEndpointsConfigPassThroughEndpointGet({})).pipe(
+    Effect.flatMap(endpointsOf),
+  );
 
 /** POST /config/pass_through_endpoint. `body` carries `id` — see pass-through-form.ts. */
 export const createPassThroughEndpoint = (

package/src/litellm/pass-through-fetch-client.test.ts

@@ -0,0 +1,40 @@
+/**
+ * A stack that also provides Caddy's admin `HttpClient` must not send LiteLLM's list there.
+ *
+ * ⛔ MEASURED 2026-09-25. `caddyProviders()` provideMerges a client that dials `127.0.0.1:2019`
+ *   and ignores the request host. `GET /config/pass_through_endpoint` on that listener is HTTP
+ *   200 `null`. `listPassThroughEndpoints` then has no `endpoints` array and `locate` throws.
+ *   The call provides `FetchHttpClient`, which still reads an outer `Fetch` — this fake.
+ */
+import { describe, expect, test } from 'bun:test';
+import { credentials } from '@distilled.cloud/litellm/Credentials';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
+import { FAKE_BASE, startFakeLitellm } from './fake-litellm.ts';
+import { listPassThroughEndpoints } from './operations.ts';
+
+const MASTER_KEY = 'sk-test-master';
+
+describe('the proxy list', () => {
+  test('uses Fetch, not an ambient client that answers null', async () => {
+    const fake = startFakeLitellm({
+      masterKey: MASTER_KEY,
+      seed: [{ auth: true, id: 'live-1', path: '/bria', target: 'https://api.bria.ai' }],
+    });
+    const ambient = HttpClient.make(() => Effect.die(new Error('ambient client')));
+    const rows = await Effect.runPromise(
+      listPassThroughEndpoints().pipe(
+        Effect.provideService(HttpClient.HttpClient, ambient),
+        Effect.provide(Layer.succeed(FetchHttpClient.Fetch, fake.fetch)),
+        Effect.provide(credentials({ apiKey: MASTER_KEY, baseUrl: FAKE_BASE })),
+        Effect.provide(FetchHttpClient.layer),
+      ) as Effect.Effect<readonly { id?: string | null }[], unknown, never>,
+    );
+    expect(rows.map((row) => row.id)).toEqual(['live-1']);
+    expect(fake.requests().map((request) => request.path)).toEqual([
+      '/config/pass_through_endpoint',
+    ]);
+  });
+});

package/src/openbao/auth-role-form.test.ts

@@ -1,15 +1,17 @@
 /**
  * Bao.AuthRole's secret_id TTL at the 90-day length the per-host AppRoles use.
  *
- * ★ `2160h` IS WHAT GOES ON THE WIRE, AND OPENBAO ACCEPTS IT. MEASURED 2026-09-21 with a Go probe of
+ * ★ OPENBAO ACCEPTS `2160h`. MEASURED 2026-09-21 with a Go probe of
  *   sdk v2.6.2 framework.FieldData.Validate on the approle role fields (path_role.go:166-167,
  *   TypeDurationSecond): `secret_id_ttl: "2160h"` validates and parses to 7776000 seconds. A role
  *   read hands back that integer, which attributesOf renders as `90d` — the same role.
+ * The SDK now sends the equivalent seconds directly instead of the former CLI duration string.
  * (What the diff calls a rename is pinned in rename-families.test.ts, `foldName`.)
  */
-import assert from 'node:assert/strict';
-import { describe, it } from 'node:test';
-import { type BaoAuthRoleProps, attributesOf, matches, writeBody } from './auth-role-form.ts';
+import { describe, expect, it } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { type BaoAuthRoleProps, attributesOf, matches } from './auth-role-form.ts';
+import { authRoleRequest } from './auth-role-wire.ts';
 
 const PROPS: BaoAuthRoleProps = {
   bindSecretId: true,
@@ -22,8 +24,8 @@ const PROPS: BaoAuthRoleProps = {
 };
 
 describe('auth role secret_id TTL', () => {
-  it('writes 2160h as given', () => {
-    assert.equal(writeBody(PROPS)['secret_id_ttl'], '2160h');
+  it('writes 2160h as the equivalent SDK seconds', async () => {
+    expect((await Effect.runPromise(authRoleRequest(PROPS))).secret_id_ttl).toBe(7776000);
   });
 
   it('reads 7776000 seconds back as the same role', () => {
@@ -36,8 +38,8 @@ describe('auth role secret_id TTL', () => {
       token_ttl: 900,
     };
     const attributes = attributesOf(PROPS, live);
-    assert.equal(attributes.secretIdTtl, '90d');
-    assert.equal(matches(attributes, PROPS), true);
-    assert.equal(matches(attributesOf(PROPS, { ...live, secret_id_ttl: 0 }), PROPS), false);
+    expect(attributes.secretIdTtl).toBe('90d');
+    expect(matches(attributes, PROPS)).toBe(true);
+    expect(matches(attributesOf(PROPS, { ...live, secret_id_ttl: 0 }), PROPS)).toBe(false);
   });
 });

package/src/openbao/auth-role-form.ts

@@ -70,25 +70,6 @@ export const attributesOf = (
 
 export const readPath = (name: string) => `auth/approle/role/${name}`;
 
-/**
- * The body for `PUT auth/approle/role/<name>`.
- *
- * ★ ALL STRINGS, EXACTLY THE `k=v` PAIRS `bao write` USED TO SEND — see `baoWrite` in bao-http.ts.
- */
-export const writeBody = (props: BaoAuthRoleProps): Record<string, string> => {
-  const body: Record<string, string> = {
-    token_policies: props.tokenPolicies.join(','),
-    token_ttl: props.tokenTtl,
-    token_max_ttl: props.tokenMaxTtl,
-    secret_id_ttl: props.secretIdTtl,
-  };
-  if (props.bindSecretId !== undefined) body['bind_secret_id'] = String(props.bindSecretId);
-  if (props.secretIdNumUses !== undefined) {
-    body['secret_id_num_uses'] = String(props.secretIdNumUses);
-  }
-  return body;
-};
-
 const samePolicies = (want: readonly string[], have: readonly string[]) =>
   want.length === have.length && want.every((policy, index) => policy === have[index]);
 

package/src/openbao/auth-role-identity.ts

@@ -0,0 +1,24 @@
+import { readPath } from './auth-role-form.ts';
+import { authRoleExists } from './auth-role-wire.ts';
+import { declaredString, judgeMoveWith } from './rename.ts';
+import { foldName, nameIdentity } from './rename-identity.ts';
+
+export const authRoleIdentity = nameIdentity<{ readonly name: string }>(
+  'Bao.AuthRole',
+  readPath,
+  foldName,
+);
+
+/** All occupied-name reads share the SDK's typed absence and refusal behavior. */
+export const judgeAuthRoleRename = (
+  olds: unknown,
+  news: unknown,
+  output: { readonly name: string } | undefined,
+) =>
+  judgeMoveWith(
+    'Bao.AuthRole',
+    output === undefined ? declaredString(olds, 'name') : output.name,
+    declaredString(news, 'name'),
+    authRoleExists,
+    foldName,
+  );

package/src/openbao/auth-role-sdk.test.ts

@@ -0,0 +1,155 @@
+/** AppRole metadata through the real SDK and Alchemy's upstream test harness; no real vault. */
+import { afterAll, beforeEach, expect } from 'bun:test';
+import { adopt } from 'alchemy/AdoptPolicy';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Test from 'alchemy/Test/Bun';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
+import { BaoEnv } from './bao-http.ts';
+import { type Reply, fakeBao } from './fake-bao.ts';
+import { wireRoles } from './fake-engines-roles.ts';
+import { writesOf } from './fake-stack.ts';
+
+const store = wireRoles();
+let refused: Reply | undefined;
+const bao = fakeBao((seen) =>
+  seen.method === 'GET' && refused !== undefined ? refused : store(seen),
+);
+afterAll(() => bao.stop());
+beforeEach(() => {
+  store.live.clear();
+  bao.seen.length = 0;
+  refused = undefined;
+});
+const { test } = Test.make({
+  adopt: true,
+  dev: false,
+  sidecar: false,
+  stage: 'test',
+  providers: Layer.mergeAll(
+    BaoAuthRoleProvider(),
+    FetchHttpClient.layer,
+    Layer.succeed(BaoEnv, { BAO_ADDR: bao.address }),
+  ),
+});
+const props = {
+  name: 'host-cert',
+  tokenPolicies: ['host-cert'],
+  tokenTtl: '15m',
+  tokenMaxTtl: '1h',
+  secretIdTtl: '2160h',
+};
+const path = 'auth/approle/role/host-cert';
+const existing = () =>
+  store.live.set(path, {
+    bind_secret_id: false,
+    secret_id_num_uses: 7,
+    secret_id_ttl: 7776000,
+    token_max_ttl: 3600,
+    token_policies: ['host-cert'],
+    token_ttl: 900,
+    token_period: 1800,
+    secret_id_bound_cidrs: ['192.0.2.0/24'],
+  });
+const role = (tokenTtl = '15m') => BaoAuthRole('role', { ...props, tokenTtl });
+const actions = (plan: { resources: Record<string, { action: string }> }) =>
+  Object.values(plan.resources).map((row) => row.action);
+
+test.provider('existing metadata adopts without writes, then plans and deploys noop', (scratch) =>
+  Effect.gen(function* () {
+    existing();
+    yield* scratch.deploy(role());
+    expect(writesOf(bao.seen)).toEqual([]);
+    expect(actions(yield* scratch.plan(role()))).toEqual(['noop']);
+    yield* scratch.deploy(role());
+    expect(writesOf(bao.seen)).toEqual([]);
+  }),
+);
+
+test.provider('drift writes one SDK POST and preserves omitted and unmanaged settings', (scratch) =>
+  Effect.gen(function* () {
+    existing();
+    yield* scratch.deploy(role());
+    yield* scratch.deploy(role('30m'));
+    expect(writesOf(bao.seen)).toEqual(['POST /v1/auth/approle/role/host-cert']);
+    expect(store.live.get(path)).toMatchObject({
+      bind_secret_id: false,
+      secret_id_num_uses: 7,
+      token_period: 1800,
+      token_ttl: 1800,
+      secret_id_bound_cidrs: ['192.0.2.0/24'],
+    });
+    expect(actions(yield* scratch.plan(role('30m')))).toEqual(['noop']);
+  }),
+);
+
+test.provider(
+  'typed absence creates metadata with server defaults then settles to noop',
+  (scratch) =>
+    Effect.gen(function* () {
+      yield* scratch.deploy(role());
+      expect(writesOf(bao.seen)).toEqual(['POST /v1/auth/approle/role/host-cert']);
+      expect(store.live.get(path)).toMatchObject({ bind_secret_id: true, secret_id_num_uses: 0 });
+      expect(actions(yield* scratch.plan(role()))).toEqual(['noop']);
+    }),
+);
+
+test.provider('occupied case-folded rename refuses before writes or deletes', (scratch) =>
+  Effect.gen(function* () {
+    existing();
+    yield* scratch.deploy(role().pipe(RemovalPolicy.destroy()));
+    store.live.set('auth/approle/role/taken', { ...store.live.get(path) });
+    bao.seen.length = 0;
+    const result = yield* Effect.exit(
+      scratch.plan(BaoAuthRole('role', { ...props, name: 'TAKEN' })),
+    );
+    expect(result._tag).toBe('Failure');
+    expect(writesOf(bao.seen)).toEqual([]);
+  }),
+);
+
+test.provider('existing unowned role refuses without adoption', (scratch) =>
+  Effect.gen(function* () {
+    existing();
+    expect((yield* Effect.exit(scratch.plan(role().pipe(adopt(false)))))._tag).toBe('Failure');
+    expect(writesOf(bao.seen)).toEqual([]);
+  }),
+);
+
+test.provider('destroy deletes only the recorded role and an empty redeploy is inert', (scratch) =>
+  Effect.gen(function* () {
+    yield* scratch.deploy(role().pipe(RemovalPolicy.destroy()));
+    bao.seen.length = 0;
+    yield* scratch.deploy(Effect.void);
+    expect(writesOf(bao.seen)).toEqual(['DELETE /v1/auth/approle/role/host-cert']);
+    expect(store.live.has(path)).toBe(false);
+    bao.seen.length = 0;
+    yield* scratch.deploy(Effect.void);
+    expect(writesOf(bao.seen)).toEqual([]);
+  }),
+);
+
+test.provider('default retain leaves removed role metadata untouched', (scratch) =>
+  Effect.gen(function* () {
+    yield* scratch.deploy(role());
+    bao.seen.length = 0;
+    yield* scratch.deploy(Effect.void);
+    expect(writesOf(bao.seen)).toEqual([]);
+    expect(store.live.has(path)).toBe(true);
+  }),
+);
+
+for (const status of [200, 403]) {
+  test.provider(`a malformed or denied ${status} read never becomes create or noop`, (scratch) =>
+    Effect.gen(function* () {
+      existing();
+      yield* scratch.deploy(role());
+      refused = { status, json: { data: {}, errors: ['refused'] } };
+      expect((yield* Effect.exit(scratch.plan(role())))._tag).toBe('Failure');
+      expect(writesOf(bao.seen)).toEqual([]);
+      refused = undefined;
+    }),
+  );
+}