@homeflare/alchemy 0.37.5 → 0.37.6

package/dist/openbao/index.js

@@ -3,6 +3,7 @@ import * as Effect2 from "effect/Effect";
 import * as FetchHttpClient2 from "effect/unstable/http/FetchHttpClient";
 
 // src/openbao/bao-http.ts
+import * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
@@ -95,11 +96,11 @@ var MAX_IN_FLIGHT = 8;
 var BaoGate = Context.Reference("homeflare/openbao/BaoGate", {
   defaultValue: () => Semaphore.makeUnsafe(MAX_IN_FLIGHT)
 });
-var TIMEOUT = "60 seconds";
+var BAO_TIMEOUT = "60 seconds";
 var retryTransport = (effect) => Effect.retry(effect, {
   schedule: Schedule.spaced("750 millis"),
   times: 2,
-  while: (error) => error.status === 0
+  while: (error) => error instanceof BaoError && error.status === 0 || Cause.isTimeoutError(error)
 });
 var redactingToken = (effect) => Effect.gen(function* () {
   const names = yield* Headers.CurrentRedactedNames;
@@ -124,7 +125,7 @@ var baoCall = (intent, method, path, body) => Effect.gen(function* () {
   const address = resolveAddress(env);
   const client = yield* HttpClient.HttpClient;
   const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(HttpClientRequest.setHeaders(headersFor(address, env)), body === undefined ? (self) => self : HttpClientRequest.bodyText(JSON.stringify(body), "application/json"));
-  const exchange = client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text2) => ({ status: response.status, text: text2 }))), Effect.timeout(TIMEOUT), Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])));
+  const exchange = client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text2) => ({ status: response.status, text: text2 }))), Effect.timeout(BAO_TIMEOUT), Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])));
   const gate = yield* BaoGate;
   const { status, text } = yield* retryTransport(exchange.pipe(overSocket(address.socket, method, path), redactingToken, Semaphore.withPermits(gate, 1)));
   const outcome = settle(intent, method, path, status, text);
@@ -827,7 +828,7 @@ var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect12.succee
 import { Resource as Resource2 } from "alchemy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect15 from "effect/Effect";
+import * as Effect17 from "effect/Effect";
 
 // src/openbao/auth-role-form.ts
 var policiesOf = (live) => {
@@ -862,20 +863,6 @@ var attributesOf3 = (props, live) => {
   return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
 };
 var readPath3 = (name) => `auth/approle/role/${name}`;
-var writeBody = (props) => {
-  const body = {
-    token_policies: props.tokenPolicies.join(","),
-    token_ttl: props.tokenTtl,
-    token_max_ttl: props.tokenMaxTtl,
-    secret_id_ttl: props.secretIdTtl
-  };
-  if (props.bindSecretId !== undefined)
-    body["bind_secret_id"] = String(props.bindSecretId);
-  if (props.secretIdNumUses !== undefined) {
-    body["secret_id_num_uses"] = String(props.secretIdNumUses);
-  }
-  return body;
-};
 var samePolicies = (want, have) => want.length === have.length && want.every((policy, index) => policy === have[index]);
 var sameTtl3 = (want, have) => {
   const wantSeconds = parseDuration(want);
@@ -887,12 +874,65 @@ var matches3 = (attributes, props) => {
   return samePolicies(wantPolicies, attributes.tokenPolicies) && sameTtl3(props.tokenTtl, attributes.tokenTtl) && sameTtl3(props.tokenMaxTtl, attributes.tokenMaxTtl) && sameTtl3(props.secretIdTtl, attributes.secretIdTtl) && (props.bindSecretId === undefined || attributes.bindSecretId === props.bindSecretId) && (props.secretIdNumUses === undefined || attributes.secretIdNumUses === props.secretIdNumUses);
 };
 
-// src/openbao/rename-identity.ts
+// src/openbao/auth-role-wire.ts
+import {
+  appRoleDeleteRole,
+  appRoleReadRole,
+  appRoleWriteRole
+} from "@distilled.cloud/openbao/approle";
 import * as Effect14 from "effect/Effect";
 
-// src/openbao/rename.ts
+// src/openbao/distilled.ts
+import { Credentials, normalizeBaseUrl } from "@distilled.cloud/openbao/Credentials";
+import * as Retry from "@distilled.cloud/openbao/Retry";
 import * as Effect13 from "effect/Effect";
-var exact = (identity) => identity;
+import * as Redacted from "effect/Redacted";
+import * as Semaphore2 from "effect/Semaphore";
+import { isHttpClientError } from "effect/unstable/http/HttpClientError";
+var runBao = (operation, timeout3 = BAO_TIMEOUT) => Effect13.gen(function* () {
+  const env = yield* BaoEnv;
+  const address = resolveAddress(env);
+  const token = readBaoVariable(env, "BAO_TOKEN");
+  const gate = yield* BaoGate;
+  return yield* operation.pipe(Effect13.provideService(Credentials, Effect13.succeed({
+    apiBaseUrl: normalizeBaseUrl(address.base),
+    ...address.namespace === undefined ? {} : { namespace: address.namespace },
+    ...token === "" ? {} : { token: Redacted.make(token) }
+  })), Retry.none, Effect13.mapError((cause) => isHttpClientError(cause) ? new BaoError(0, "SDK", "operation", [cause.message]) : cause), Effect13.timeout(timeout3), overSocket(address.socket, "SDK", "operation"), redactingToken, Semaphore2.withPermits(gate, 1));
+});
+var runBaoRead = (operation, timeout3 = BAO_TIMEOUT) => retryTransport(runBao(operation, timeout3));
+var runBaoWrite = (operation, timeout3 = BAO_TIMEOUT) => retryTransport(runBao(operation, timeout3));
+
+// src/openbao/auth-role-wire.ts
+var identity = (name) => ({ approle_mount_path: "approle", role_name: name });
+var seconds = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+var completeRole = (live) => live !== null && typeof live === "object" && typeof live.bind_secret_id === "boolean" && seconds(live.secret_id_num_uses) && seconds(live.secret_id_ttl) && seconds(live.token_ttl) && seconds(live.token_max_ttl) && Array.isArray(live.token_policies) && live.token_policies.every((policy) => typeof policy === "string");
+var readAuthRole = (name) => runBaoRead(appRoleReadRole(identity(name))).pipe(Effect14.flatMap((live) => completeRole(live) ? Effect14.succeed(live) : Effect14.fail(new BaoError(200, "GET", readPath3(name), ["incomplete role metadata"]))), Effect14.catchTag("NotFound", () => Effect14.succeed(undefined)));
+var authRoleExists = (name) => readAuthRole(name).pipe(Effect14.map((live) => live !== undefined));
+var authRoleRequest = (props) => Effect14.gen(function* () {
+  const tokenTtl = parseDuration(props.tokenTtl);
+  const tokenMaxTtl = parseDuration(props.tokenMaxTtl);
+  const secretIdTtl = parseDuration(props.secretIdTtl);
+  if (!seconds(tokenTtl) || !seconds(tokenMaxTtl) || !seconds(secretIdTtl)) {
+    return yield* Effect14.fail(new BaoError(0, "POST", readPath3(props.name), ["invalid role TTL duration"]));
+  }
+  const request = {
+    ...identity(props.name),
+    token_policies: [...props.tokenPolicies],
+    token_ttl: tokenTtl,
+    token_max_ttl: tokenMaxTtl,
+    secret_id_ttl: secretIdTtl,
+    ...props.bindSecretId === undefined ? {} : { bind_secret_id: props.bindSecretId },
+    ...props.secretIdNumUses === undefined ? {} : { secret_id_num_uses: props.secretIdNumUses }
+  };
+  return request;
+});
+var writeAuthRole = (props) => authRoleRequest(props).pipe(Effect14.flatMap((request) => runBaoWrite(appRoleWriteRole(request))));
+var deleteAuthRole = (name) => runBao(appRoleDeleteRole(identity(name))).pipe(Effect14.catchTag("NotFound", () => Effect14.void));
+
+// src/openbao/rename.ts
+import * as Effect15 from "effect/Effect";
+var exact = (identity2) => identity2;
 var declaredString = (news, key) => {
   if (typeof news !== "object" || news === null)
     return;
@@ -913,17 +953,19 @@ var declaredRolePath = (news, rolePath, defaultMount) => {
 };
 var policyKey = (name) => name.trim().toLowerCase();
 var isMoved = (stored, declared, key = exact) => declared === undefined ? undefined : key(stored) !== key(declared);
-var judgeMove = (family, tried, declared, pathOf, key = exact) => Effect13.gen(function* () {
+var judgeMove = (family, tried, declared, pathOf, key = exact) => judgeMoveWith(family, tried, declared, (identity2) => Effect15.map(baoRead(pathOf(identity2)), (value) => value !== undefined), key);
+var judgeMoveWith = (family, tried, declared, occupied, key = exact) => Effect15.gen(function* () {
   if (tried === undefined || declared === undefined || key(tried) === key(declared)) {
     return;
   }
-  if ((yield* baoRead(pathOf(declared))) === undefined)
+  if (!(yield* occupied(declared)))
     return { from: tried, to: declared };
-  return yield* Effect13.die(new Error(`${family}: ${tried} → ${declared} would land on an object that already exists at ` + `${declared}. Under RemovalPolicy.destroy() a resource moving off that name (a swap, a ` + "shift, or a reverted move that did not finish) deletes it after this one writes it. " + "Nothing was written. Move through a name nothing holds, in two deploys, or remove " + `${declared} by hand first.`));
+  return yield* Effect15.die(new Error(`${family}: ${tried} → ${declared} would land on an object that already exists at ` + `${declared}. Under RemovalPolicy.destroy() a resource moving off that name (a swap, a ` + "shift, or a reverted move that did not finish) deletes it after this one writes it. " + "Nothing was written. Move through a name nothing holds, in two deploys, or remove " + `${declared} by hand first.`));
 });
-var refuseMovedUpdate = (family, from, to) => Effect13.die(new Error(`${family}: planned as an update, but its identity moved from ${from} to ${to}. Writing ` + `${to} now would leave ${from} live with no state record. Nothing was written. Run the ` + "deploy again: once the value resolves at plan time it plans as a replace."));
+var refuseMovedUpdate = (family, from, to) => Effect15.die(new Error(`${family}: planned as an update, but its identity moved from ${from} to ${to}. Writing ` + `${to} now would leave ${from} live with no state record. Nothing was written. Run the ` + "deploy again: once the value resolves at plan time it plans as a replace."));
 
 // src/openbao/rename-identity.ts
+import * as Effect16 from "effect/Effect";
 var nameIdentity = (family, pathOf, key) => ({
   declared: (props) => declaredString(props, "name"),
   family,
@@ -938,35 +980,39 @@ var roleIdentity = (family, rolePath, defaultMount, key) => ({
   recorded: (output) => rolePath(output.mount, output.name)
 });
 var foldName = (path) => path.replace(/[^/]+$/, (name) => name.toLowerCase());
-var judgeRename = (identity, olds, news, output) => judgeMove(identity.family, output === undefined ? identity.declared(olds) : identity.recorded(output), identity.declared(news), identity.pathOf ?? ((path) => path), identity.key);
-var guardRename = (identity, news, output) => {
+var judgeRename = (identity2, olds, news, output) => judgeMove(identity2.family, output === undefined ? identity2.declared(olds) : identity2.recorded(output), identity2.declared(news), identity2.pathOf ?? ((path) => path), identity2.key);
+var guardRename = (identity2, news, output) => {
   if (output === undefined)
-    return Effect14.void;
-  const from = identity.recorded(output);
-  const to = identity.declared(news);
-  return to !== undefined && isMoved(from, to, identity.key) === true ? refuseMovedUpdate(identity.family, from, to) : Effect14.void;
+    return Effect16.void;
+  const from = identity2.recorded(output);
+  const to = identity2.declared(news);
+  return to !== undefined && isMoved(from, to, identity2.key) === true ? refuseMovedUpdate(identity2.family, from, to) : Effect16.void;
 };
 
+// src/openbao/auth-role-identity.ts
+var authRoleIdentity = nameIdentity("Bao.AuthRole", readPath3, foldName);
+var judgeAuthRoleRename = (olds, news, output) => judgeMoveWith("Bao.AuthRole", output === undefined ? declaredString(olds, "name") : output.name, declaredString(news, "name"), authRoleExists, foldName);
+
 // src/openbao/auth-role.ts
 var BaoAuthRole = Resource2("Bao.AuthRole", {
   defaultRemovalPolicy: "retain"
 });
-var IDENTITY = nameIdentity("Bao.AuthRole", readPath3, foldName);
-var readRole = (props) => Effect15.gen(function* () {
-  const live = yield* baoRead(readPath3(props.name));
+var IDENTITY = authRoleIdentity;
+var readRole = (props) => Effect17.gen(function* () {
+  const live = yield* readAuthRole(props.name);
   if (live === undefined)
     return;
-  return attributesOf3(props, live);
+  return attributesOf3(props, { ...live });
 });
-var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect15.succeed(BaoAuthRole.Provider.of({
-  list: () => Effect15.succeed([]),
-  read: Effect15.fn(function* ({ fqn, instanceId, olds, output }) {
+var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect17.succeed(BaoAuthRole.Provider.of({
+  list: () => Effect17.succeed([]),
+  read: Effect17.fn(function* ({ fqn, instanceId, olds, output }) {
     const found = yield* readRole(olds);
-    const ours = Effect15.sync(() => found !== undefined && matches3(found, olds));
+    const ours = Effect17.sync(() => found !== undefined && matches3(found, olds));
     return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect15.fn(function* ({ news, olds, output }) {
-    const move = yield* judgeRename(IDENTITY, olds, news, output);
+  diff: Effect17.fn(function* ({ news, olds, output }) {
+    const move = yield* judgeAuthRoleRename(olds, news, output);
     if (output === undefined)
       return;
     if (move !== undefined)
@@ -980,28 +1026,28 @@ var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect15.succeed(B
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect15.fn(function* ({ fqn, instanceId, news, output }) {
+  reconcile: Effect17.fn(function* ({ fqn, instanceId, news, output }) {
     yield* guardRename(IDENTITY, news, output);
     const live = yield* readRole(news);
     const path = readPath3(news.name);
     if (live !== undefined)
       yield* refuseTakeover({ fqn, instanceId, output }, `Bao.AuthRole ${path}`);
     if (live === undefined || !matches3(live, news)) {
-      yield* baoWrite("PUT", readPath3(news.name), writeBody(news));
+      yield* writeAuthRole(news);
     }
     const after = yield* readRole(news);
     if (after === undefined) {
-      return yield* Effect15.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
+      return yield* Effect17.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
     }
     return after;
   }),
-  delete: Effect15.fn(function* ({ output }) {
-    yield* baoDelete(readPath3(output.name));
+  delete: Effect17.fn(function* ({ output }) {
+    yield* deleteAuthRole(output.name);
     return;
   })
-})).pipe(Effect15.map(provingResumes)));
+})).pipe(Effect17.map(provingResumes)));
 // src/openbao/bao-identity.ts
-import * as Effect16 from "effect/Effect";
+import * as Effect18 from "effect/Effect";
 import * as FetchHttpClient3 from "effect/unstable/http/FetchHttpClient";
 
 // src/openbao/bao-namespace.ts
@@ -1049,42 +1095,42 @@ var checkHealth = (address, expectedCluster, body) => {
   }
   return { clusterId: text3(body["cluster_id"]), version: text3(body["version"]) };
 };
-var assertBaoIdentityEffect = (expected) => Effect16.gen(function* () {
+var assertBaoIdentityEffect = (expected) => Effect18.gen(function* () {
   const env = yield* BaoEnv;
   const address = addressOf(env);
   const clusterName = expected.clusterName.trim();
   if (clusterName === "") {
-    return yield* Effect16.fail(new BaoIdentityError("input", "clusterName is empty, so there is nothing to compare."));
+    return yield* Effect18.fail(new BaoIdentityError("input", "clusterName is empty, so there is nothing to compare."));
   }
   const namespace = canonicalNamespace(expected.namespace);
   const sent = envNamespace(env);
   if (sent !== namespace) {
-    return yield* Effect16.fail(new BaoIdentityError("mismatch", `BAO_NAMESPACE resolves to \`${namespaceLabel(sent)}\`, but this stack expects ` + `\`${namespaceLabel(namespace)}\`.`));
+    return yield* Effect18.fail(new BaoIdentityError("mismatch", `BAO_NAMESPACE resolves to \`${namespaceLabel(sent)}\`, but this stack expects ` + `\`${namespaceLabel(namespace)}\`.`));
   }
   const anonymous = { ...env, BAO_NAMESPACE: "", BAO_TOKEN: "" };
-  const body = yield* baoCall("read", "GET", HEALTH_PATH).pipe(Effect16.provideService(BaoEnv, anonymous), Effect16.mapError(unreachable(address, "sys/health")));
+  const body = yield* baoCall("read", "GET", HEALTH_PATH).pipe(Effect18.provideService(BaoEnv, anonymous), Effect18.mapError(unreachable(address, "sys/health")));
   const health = checkHealth(address, clusterName, body);
   if (health instanceof BaoIdentityError)
-    return yield* Effect16.fail(health);
+    return yield* Effect18.fail(health);
   if (namespace !== "") {
     const scoped = { ...env, BAO_NAMESPACE: namespace, BAO_TOKEN: "" };
-    const probe = yield* baoCall("read", "GET", NAMESPACE_PROBE_PATH).pipe(Effect16.provideService(BaoEnv, scoped), Effect16.mapError(unreachable(address, `the namespace probe for \`${namespace}\``)));
+    const probe = yield* baoCall("read", "GET", NAMESPACE_PROBE_PATH).pipe(Effect18.provideService(BaoEnv, scoped), Effect18.mapError(unreachable(address, `the namespace probe for \`${namespace}\``)));
     if (probe === undefined) {
-      return yield* Effect16.fail(new BaoIdentityError("mismatch", `cluster \`${clusterName}\` at ${address} has no namespace \`${namespace}\`.`));
+      return yield* Effect18.fail(new BaoIdentityError("mismatch", `cluster \`${clusterName}\` at ${address} has no namespace \`${namespace}\`.`));
     }
   }
   return { address, clusterName, namespace, ...health };
 });
 var assertBaoIdentity = (input) => {
   const effect3 = assertBaoIdentityEffect(input);
-  const scoped = input.env === undefined ? effect3 : Effect16.provideService(effect3, BaoEnv, input.env);
-  return Effect16.runPromise(scoped.pipe(Effect16.provide(FetchHttpClient3.layer)));
+  const scoped = input.env === undefined ? effect3 : Effect18.provideService(effect3, BaoEnv, input.env);
+  return Effect18.runPromise(scoped.pipe(Effect18.provide(FetchHttpClient3.layer)));
 };
 // src/openbao/cloudflare-role.ts
 import { Resource as Resource3 } from "alchemy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 import * as Provider3 from "alchemy/Provider";
-import * as Effect19 from "effect/Effect";
+import * as Effect21 from "effect/Effect";
 
 // src/openbao/cloudflare-group-scope.ts
 var zoneResource = (zoneId) => `com.cloudflare.api.account.zone.${zoneId}`;
@@ -1104,7 +1150,7 @@ var groupKey = (name, scope) => `${scope} ${name}`;
 
 // src/openbao/cloudflare-permission-groups.ts
 import * as Context2 from "effect/Context";
-import * as Effect18 from "effect/Effect";
+import * as Effect20 from "effect/Effect";
 
 // src/openbao/cloudflare-permission-groups-solve.ts
 var observationsOf = (declared, live) => declared.flatMap((role) => {
@@ -1274,18 +1320,18 @@ var samePolicies2 = (want, have) => want.length === have.length && want.every((w
 });
 
 // src/openbao/cloudflare-role-wire.ts
-import * as Effect17 from "effect/Effect";
+import * as Effect19 from "effect/Effect";
 
 // src/openbao/cloudflare-role-form.ts
 var rolePath = (mount, name) => `${mountPath(mount)}/roles/${name}`;
-var seconds = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
+var seconds2 = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
 var liveRoleOf = (data) => ({
   description: typeof data["description"] === "string" ? data["description"] : "",
-  maxTtl: seconds(data["max_ttl"]),
+  maxTtl: seconds2(data["max_ttl"]),
   name: typeof data["name"] === "string" ? data["name"] : "",
   policies: parseLivePolicies(data["policies"]),
   policiesText: typeof data["policies"] === "string" ? data["policies"] : "",
-  ttl: seconds(data["ttl"])
+  ttl: seconds2(data["ttl"])
 });
 var attributesOf4 = (props, live) => {
   const attrs = {
@@ -1311,7 +1357,7 @@ var refusalOf = (props) => {
     return "a policy with no groups";
   return;
 };
-var writeBody2 = (props, policies) => ({
+var writeBody = (props, policies) => ({
   description: props.description,
   max_ttl: props.maxTtl,
   policies: policiesJson(policies),
@@ -1339,7 +1385,7 @@ var differences = (props, policies, live) => {
 };
 
 // src/openbao/cloudflare-role-wire.ts
-var readCloudflareRole = (mount, name) => Effect17.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
+var readCloudflareRole = (mount, name) => Effect19.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
 var writeCloudflareRole = (mount, name, body) => baoWrite("PUT", rolePath(mount, name), body);
 var deleteCloudflareRole = (mount, name) => baoDelete(rolePath(mount, name));
 
@@ -1361,9 +1407,9 @@ var pick = (mount, groups, refs, hint) => {
   const unknown = refs.filter((ref) => !groups.has(groupKey(ref.name, ref.scope)));
   if (unknown.length > 0) {
     const problems = unknown.map((ref) => `unknown group ${JSON.stringify(ref.name)} at scope ${ref.scope} — ${hint}`);
-    return Effect18.fail(new CloudflareGroupsError(mount, problems));
+    return Effect20.fail(new CloudflareGroupsError(mount, problems));
   }
-  return Effect18.succeed(new Map(refs.flatMap((ref) => {
+  return Effect20.succeed(new Map(refs.flatMap((ref) => {
     const key = groupKey(ref.name, ref.scope);
     const id = groups.get(key);
     return id === undefined ? [] : [[key, id]];
@@ -1371,15 +1417,15 @@ var pick = (mount, groups, refs, hint) => {
 };
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var deniedHint = (mount) => `GET ${mountPath(mount)}/permission-groups answered 403 — this token's policy carries no ` + `\`path "${mountPath(mount)}/permission-groups" { capabilities = ["read"] }\` grant. ` + "It is declared in ../platform/secrets/vault/policies/homeflare-admin/" + "20-cloudflare-permission-groups.hcl and applies with `alchemy deploy` of this stack";
-var deniedNamed = (mount, read) => Effect18.catchIf(read, (error) => error.status === 403, () => Effect18.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
-var engineGroups = (mount) => Effect18.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
+var deniedNamed = (mount, read) => Effect20.catchIf(read, (error) => error.status === 403, () => Effect20.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
+var engineGroups = (mount) => Effect20.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
   const list = data?.["permission_groups"];
   if (data === undefined) {
     const why = "GET <mount>/permission-groups answered 404 — the endpoint is not deployed here";
-    return Effect18.fail(new CloudflareGroupsError(mount, [why]));
+    return Effect20.fail(new CloudflareGroupsError(mount, [why]));
   }
   if (!Array.isArray(list)) {
-    return Effect18.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
+    return Effect20.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
   }
   const scoped = new Map;
   const idsOf = new Map;
@@ -1406,24 +1452,24 @@ var engineGroups = (mount) => Effect18.flatMap(deniedNamed(mount, baoRead(`${mou
     const only = [...ids];
     return ids.size === 1 && only[0] !== undefined ? [[name, only[0]]] : [];
   }));
-  return problems.length > 0 ? Effect18.fail(new CloudflareGroupsError(mount, problems)) : Effect18.succeed(new Map([...atEveryScope(sole), ...scoped]));
+  return problems.length > 0 ? Effect20.fail(new CloudflareGroupsError(mount, problems)) : Effect20.succeed(new Map([...atEveryScope(sole), ...scoped]));
 });
-var permissionGroupsFromEngine = () => Effect18.sync(() => {
+var permissionGroupsFromEngine = () => Effect20.sync(() => {
   const cache = new Map;
-  const cachedFor = (mount) => Effect18.suspend(() => {
+  const cachedFor = (mount) => Effect20.suspend(() => {
     const hit = cache.get(mountPath(mount));
     if (hit !== undefined)
       return hit;
-    return Effect18.flatMap(Effect18.cached(engineGroups(mount)), (lookup) => {
+    return Effect20.flatMap(Effect20.cached(engineGroups(mount)), (lookup) => {
       cache.set(mountPath(mount), lookup);
       return lookup;
     });
   });
   return CloudflarePermissionGroups.of({
-    resolve: (mount, refs) => Effect18.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
+    resolve: (mount, refs) => Effect20.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
   });
 });
-var permissionGroupsFromLiveRoles = (declared) => Effect18.gen(function* () {
+var permissionGroupsFromLiveRoles = (declared) => Effect20.gen(function* () {
   const accountOf = new Map;
   const byAccount = new Map;
   for (const [mount, roles] of declared) {
@@ -1434,9 +1480,9 @@ var permissionGroupsFromLiveRoles = (declared) => Effect18.gen(function* () {
   }
   const solved = new Map;
   for (const [account, roles] of byAccount) {
-    const solve = Effect18.gen(function* () {
+    const solve = Effect20.gen(function* () {
       const live = new Map;
-      yield* Effect18.all(roles.map((role) => Effect18.map(readCloudflareRole(role.mount, role.name), (read) => {
+      yield* Effect20.all(roles.map((role) => Effect20.map(readCloudflareRole(role.mount, role.name), (read) => {
         if (read?.policies !== undefined) {
           live.set(`${role.mount}/${role.name}`, read.policies);
         }
@@ -1444,11 +1490,11 @@ var permissionGroupsFromLiveRoles = (declared) => Effect18.gen(function* () {
       const result = solveGroups(observationsOf(roles, live));
       const problems = describeProblems(result);
       if (problems.length > 0) {
-        return yield* Effect18.fail(new CloudflareGroupsError(`account ${account}`, problems));
+        return yield* Effect20.fail(new CloudflareGroupsError(`account ${account}`, problems));
       }
       return atEveryScope(result.groups);
     });
-    solved.set(account, yield* Effect18.cached(solve));
+    solved.set(account, yield* Effect20.cached(solve));
   }
   return CloudflarePermissionGroups.of({
     resolve: (mount, refs) => {
@@ -1456,10 +1502,10 @@ var permissionGroupsFromLiveRoles = (declared) => Effect18.gen(function* () {
       const lookup = account === undefined ? undefined : solved.get(account);
       if (account === undefined || lookup === undefined) {
         const why = "no declared role on this mount, so no live role can vouch for its groups";
-        return Effect18.fail(new CloudflareGroupsError(mount, [why]));
+        return Effect20.fail(new CloudflareGroupsError(mount, [why]));
       }
       const hint = `no live role on account ${account} carries it; a NEW group needs the engine endpoint`;
-      return Effect18.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
+      return Effect20.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
     }
   });
 });
@@ -1469,9 +1515,9 @@ var BaoCloudflareRole = Resource3("Bao.CloudflareRole", {
   defaultRemovalPolicy: "retain"
 });
 var IDENTITY2 = roleIdentity("Bao.CloudflareRole", rolePath);
-var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect19.gen(function* () {
+var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect21.gen(function* () {
   const groups = yield* CloudflarePermissionGroups;
-  const resolved = (props) => Effect19.gen(function* () {
+  const resolved = (props) => Effect21.gen(function* () {
     const refs = new Map;
     for (const policy of props.policies) {
       const scope = policy.scope ?? scopeOfResource(policy.resource);
@@ -1481,23 +1527,23 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
     const ids = yield* groups.resolve(props.mount, [...refs.values()]);
     const { missing, policies } = resolvePolicies(props.policies, ids);
     if (missing.length > 0) {
-      return yield* Effect19.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
+      return yield* Effect21.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
     }
     return policies;
   });
   return BaoCloudflareRole.Provider.of({
-    list: () => Effect19.succeed([]),
-    read: Effect19.fn(function* ({ fqn, instanceId, olds, output }) {
+    list: () => Effect21.succeed([]),
+    read: Effect21.fn(function* ({ fqn, instanceId, olds, output }) {
       const live = yield* readCloudflareRole(olds.mount, olds.name);
       const found = live === undefined ? undefined : attributesOf4(olds, live);
-      const ours = Effect19.gen(function* () {
+      const ours = Effect21.gen(function* () {
         if (live === undefined || refusalOf(olds) !== undefined)
           return false;
         return differences(olds, yield* resolved(olds), live).length === 0;
       });
       return yield* ownedRead({ fqn, instanceId, output }, found, ours);
     }),
-    diff: Effect19.fn(function* ({ news, olds, output }) {
+    diff: Effect21.fn(function* ({ news, olds, output }) {
       const move = yield* judgeRename(IDENTITY2, olds, news, output);
       if (output === undefined)
         return;
@@ -1513,12 +1559,12 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
         return { action: "update" };
       return differences(news, policies, live).length === 0 ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect19.fn(function* ({ fqn, instanceId, news, output }) {
+    reconcile: Effect21.fn(function* ({ fqn, instanceId, news, output }) {
       const path = rolePath(news.mount, news.name);
       yield* guardRename(IDENTITY2, news, output);
       const refusal2 = refusalOf(news);
       if (refusal2 !== undefined) {
-        return yield* Effect19.die(new Error(`Bao.CloudflareRole ${path}: ${refusal2}.`));
+        return yield* Effect21.die(new Error(`Bao.CloudflareRole ${path}: ${refusal2}.`));
       }
       const policies = yield* resolved(news);
       const live = yield* readCloudflareRole(news.mount, news.name);
@@ -1526,24 +1572,24 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
         yield* refuseTakeover({ fqn, instanceId, output }, `Bao.CloudflareRole ${path}`);
       }
       if (live === undefined || differences(news, policies, live).length > 0) {
-        yield* writeCloudflareRole(news.mount, news.name, writeBody2(news, policies));
+        yield* writeCloudflareRole(news.mount, news.name, writeBody(news, policies));
       }
       const after = yield* readCloudflareRole(news.mount, news.name);
       if (after === undefined) {
-        return yield* Effect19.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
+        return yield* Effect21.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
       }
       const left = differences(news, policies, after);
       if (left.length > 0) {
-        return yield* Effect19.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
+        return yield* Effect21.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
       }
       return attributesOf4(news, after);
     }),
-    delete: Effect19.fn(function* ({ output }) {
+    delete: Effect21.fn(function* ({ output }) {
       yield* deleteCloudflareRole(output.mount, output.name);
       return;
     })
   });
-}).pipe(Effect19.map(provingResumes)));
+}).pipe(Effect21.map(provingResumes)));
 // src/openbao/cloudflare-roles-expand.ts
 var slug = (name) => trimRuns(name.toLowerCase().replace(/[^a-z0-9]+/g, "-"), "-");
 var zoneSlug = (zone) => `${slug(zone.name)}${zone.internal ? "-internal" : ""}`;
@@ -1790,7 +1836,7 @@ var hostAppRoles = (input) => {
 import { Resource as Resource4 } from "alchemy";
 import { isResolved as isResolved4 } from "alchemy/Diff";
 import * as Provider4 from "alchemy/Provider";
-import * as Effect21 from "effect/Effect";
+import * as Effect23 from "effect/Effect";
 
 // src/openbao/jwt-config-form.ts
 var text5 = (value) => typeof value === "string" ? value.trim() : "";
@@ -1833,7 +1879,7 @@ var attributesOf5 = (props, live) => {
   return { ...form, digest: sha256(JSON.stringify(form)), mount: mountOf(props) };
 };
 var matches4 = (attributes, props) => attributes.digest === sha256(JSON.stringify(canonicalFromProps(props)));
-var writeBody3 = (props) => ({
+var writeBody2 = (props) => ({
   bound_issuer: props.boundIssuer ?? "",
   default_role: props.defaultRole ?? "",
   jwks_ca_pem: props.jwksCaPem ?? "",
@@ -1880,20 +1926,20 @@ var problems = (props) => {
 };
 
 // src/openbao/role-reconcile.ts
-import * as Effect20 from "effect/Effect";
-var readRoleAt = (spec) => Effect20.map(baoRead(spec.path), (live) => live === undefined ? undefined : { attributes: spec.attributesOf(live), live });
-var readOwnedRole = (ask, spec) => Effect20.flatMap(readRoleAt(spec), (found) => {
-  const ours = Effect20.sync(() => found !== undefined && spec.problems.length === 0 && spec.matches(found.attributes));
+import * as Effect22 from "effect/Effect";
+var readRoleAt = (spec) => Effect22.map(baoRead(spec.path), (live) => live === undefined ? undefined : { attributes: spec.attributesOf(live), live });
+var readOwnedRole = (ask, spec) => Effect22.flatMap(readRoleAt(spec), (found) => {
+  const ours = Effect22.sync(() => found !== undefined && spec.problems.length === 0 && spec.matches(found.attributes));
   return ownedRead(ask, found?.attributes, ours);
 });
-var planRole = (spec) => Effect20.gen(function* () {
+var planRole = (spec) => Effect22.gen(function* () {
   if (spec.problems.length > 0)
     return "update";
   const found = yield* readRoleAt(spec);
   return found !== undefined && spec.matches(found.attributes) ? "noop" : "update";
 });
-var refuse2 = (spec, message) => Effect20.die(new Error(`${spec.family} ${spec.path}: ${message}`));
-var reconcileRole = (spec, claim) => Effect20.gen(function* () {
+var refuse2 = (spec, message) => Effect22.die(new Error(`${spec.family} ${spec.path}: ${message}`));
+var reconcileRole = (spec, claim) => Effect22.gen(function* () {
   if (spec.problems.length > 0)
     return yield* refuse2(spec, spec.problems.join("; "));
   const found = yield* readRoleAt(spec);
@@ -1929,19 +1975,19 @@ var IDENTITY3 = {
 };
 var jwtConfigSpec = (props) => ({
   attributesOf: (live) => attributesOf5(props, live),
-  body: writeBody3(props),
+  body: writeBody2(props),
   family: "Bao.JwtAuthConfig",
   matches: (attributes) => matches4(attributes, props),
   path: configPath(props),
   problems: problems(props),
   wouldErase
 });
-var BaoJwtAuthConfigProvider = () => Provider4.effect(BaoJwtAuthConfig, Effect21.succeed(BaoJwtAuthConfig.Provider.of({
-  list: () => Effect21.succeed([]),
-  read: Effect21.fn(function* ({ fqn, instanceId, olds, output }) {
+var BaoJwtAuthConfigProvider = () => Provider4.effect(BaoJwtAuthConfig, Effect23.succeed(BaoJwtAuthConfig.Provider.of({
+  list: () => Effect23.succeed([]),
+  read: Effect23.fn(function* ({ fqn, instanceId, olds, output }) {
     return yield* readOwnedRole({ fqn, instanceId, output }, jwtConfigSpec(olds));
   }),
-  diff: Effect21.fn(function* ({ news, olds, output }) {
+  diff: Effect23.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY3, olds, news, output);
     if (output === undefined)
       return;
@@ -1951,23 +1997,23 @@ var BaoJwtAuthConfigProvider = () => Provider4.effect(BaoJwtAuthConfig, Effect21
       return;
     return { action: yield* planRole(jwtConfigSpec(news)) };
   }),
-  reconcile: Effect21.fn(function* ({ fqn, instanceId, news, output }) {
+  reconcile: Effect23.fn(function* ({ fqn, instanceId, news, output }) {
     yield* guardRename(IDENTITY3, news, output);
     return yield* reconcileRole(jwtConfigSpec(news), claimFor({ fqn, instanceId, output }));
   }),
-  delete: () => Effect21.void
-})).pipe(Effect21.map(provingResumes)));
+  delete: () => Effect23.void
+})).pipe(Effect23.map(provingResumes)));
 // src/openbao/jwt-role.ts
 import { Resource as Resource5 } from "alchemy";
 import { isResolved as isResolved5 } from "alchemy/Diff";
 import * as Provider5 from "alchemy/Provider";
-import * as Effect22 from "effect/Effect";
+import * as Effect24 from "effect/Effect";
 
 // src/openbao/auth-token-form.ts
 var sortedSet2 = (values) => [...new Set(values)].sort();
 var cidr = (value) => value.trim().replace(/\/(32|128)$/, "");
 var strings3 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-var seconds2 = (text6) => parseDuration(text6 ?? "0") ?? -1;
+var seconds3 = (text6) => parseDuration(text6 ?? "0") ?? -1;
 var tokenFields = (input) => ({
   tokenBoundCidrs: input.tokenBoundCidrs,
   tokenExplicitMaxTtlSeconds: input.tokenExplicitMaxTtlSeconds,
@@ -1992,13 +2038,13 @@ var tokenForm = (input) => ({
 });
 var tokenFormOfProps = (props) => tokenForm({
   tokenBoundCidrs: props.tokenBoundCidrs ?? [],
-  tokenExplicitMaxTtlSeconds: seconds2(props.tokenExplicitMaxTtl),
-  tokenMaxTtlSeconds: seconds2(props.tokenMaxTtl),
+  tokenExplicitMaxTtlSeconds: seconds3(props.tokenExplicitMaxTtl),
+  tokenMaxTtlSeconds: seconds3(props.tokenMaxTtl),
   tokenNoDefaultPolicy: props.tokenNoDefaultPolicy ?? false,
   tokenNumUses: props.tokenNumUses ?? 0,
-  tokenPeriodSeconds: seconds2(props.tokenPeriod),
+  tokenPeriodSeconds: seconds3(props.tokenPeriod),
   tokenPolicies: props.tokenPolicies,
-  tokenTtlSeconds: seconds2(props.tokenTtl),
+  tokenTtlSeconds: seconds3(props.tokenTtl),
   tokenType: props.tokenType ?? "default"
 });
 var tokenFormOfLive = (live) => tokenForm({
@@ -2032,14 +2078,14 @@ var tokenProblems = (props) => {
     tokenTtl: props.tokenTtl
   };
   for (const [field, text6] of Object.entries(durations)) {
-    if (seconds2(text6) < 0)
+    if (seconds3(text6) < 0)
       found.push(`${field}=${text6 ?? ""} is not a duration (0 or <n>s|m|h|d)`);
   }
-  const ttl = seconds2(props.tokenTtl);
-  const max = seconds2(props.tokenMaxTtl);
+  const ttl = seconds3(props.tokenTtl);
+  const max = seconds3(props.tokenMaxTtl);
   if (ttl > 0 && max > 0 && ttl > max)
     found.push("tokenTtl is longer than tokenMaxTtl");
-  if (props.tokenType === "batch" && (seconds2(props.tokenPeriod) > 0 || (props.tokenNumUses ?? 0) > 0)) {
+  if (props.tokenType === "batch" && (seconds3(props.tokenPeriod) > 0 || (props.tokenNumUses ?? 0) > 0)) {
     found.push("a batch token cannot be periodic or use-limited (tokenutil.go:234-241)");
   }
   return found;
@@ -2121,7 +2167,7 @@ var attributesOf6 = (props, live) => {
   return { ...form, digest: sha256(JSON.stringify(form)), mount: mountOf2(props), name: props.name };
 };
 var matches5 = (attributes, props) => attributes.digest === sha256(JSON.stringify(canonicalFromProps2(props)));
-var writeBody4 = (props) => ({
+var writeBody3 = (props) => ({
   allowed_redirect_uris: [...props.allowedRedirectUris ?? []],
   bound_audiences: [...props.boundAudiences ?? []],
   bound_claims: { ...props.boundClaims },
@@ -2166,18 +2212,18 @@ var BaoJwtRole = Resource5("Bao.JwtRole", {
 var IDENTITY4 = roleIdentity("Bao.JwtRole", (mount, name) => rolePath2({ mount, name }), "jwt", foldName);
 var jwtRoleSpec = (props) => ({
   attributesOf: (live) => attributesOf6(props, live),
-  body: writeBody4(props),
+  body: writeBody3(props),
   family: "Bao.JwtRole",
   matches: (attributes) => matches5(attributes, props),
   path: rolePath2(props),
   problems: problems2(props)
 });
-var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect22.succeed(BaoJwtRole.Provider.of({
-  list: () => Effect22.succeed([]),
-  read: Effect22.fn(function* ({ fqn, instanceId, olds, output }) {
+var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect24.succeed(BaoJwtRole.Provider.of({
+  list: () => Effect24.succeed([]),
+  read: Effect24.fn(function* ({ fqn, instanceId, olds, output }) {
     return yield* readOwnedRole({ fqn, instanceId, output }, jwtRoleSpec(olds));
   }),
-  diff: Effect22.fn(function* ({ news, olds, output }) {
+  diff: Effect24.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY4, olds, news, output);
     if (output === undefined)
       return;
@@ -2187,20 +2233,20 @@ var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect22.succeed(Bao
       return;
     return { action: yield* planRole(jwtRoleSpec(news)) };
   }),
-  reconcile: Effect22.fn(function* ({ fqn, instanceId, news, output }) {
+  reconcile: Effect24.fn(function* ({ fqn, instanceId, news, output }) {
     yield* guardRename(IDENTITY4, news, output);
     return yield* reconcileRole(jwtRoleSpec(news), claimFor({ fqn, instanceId, output }));
   }),
-  delete: Effect22.fn(function* ({ output }) {
+  delete: Effect24.fn(function* ({ output }) {
     yield* baoDelete(rolePath2(output));
     return;
   })
-})).pipe(Effect22.map(provingResumes)));
+})).pipe(Effect24.map(provingResumes)));
 // src/openbao/kubernetes-role.ts
 import { Resource as Resource6 } from "alchemy";
 import { isResolved as isResolved6 } from "alchemy/Diff";
 import * as Provider6 from "alchemy/Provider";
-import * as Effect23 from "effect/Effect";
+import * as Effect25 from "effect/Effect";
 
 // src/openbao/kubernetes-role-form.ts
 var sortedSet4 = (values) => [...new Set(values)].sort();
@@ -2237,7 +2283,7 @@ var attributesOf7 = (props, live) => {
   return { ...form, digest: sha256(JSON.stringify(form)), mount: mountOf3(props), name: props.name };
 };
 var matches6 = (attributes, props) => attributes.digest === sha256(JSON.stringify(canonicalFromProps3(props)));
-var writeBody5 = (props) => ({
+var writeBody4 = (props) => ({
   alias_name_source: props.aliasNameSource,
   audience: props.audience ?? "",
   bound_service_account_names: [...props.boundServiceAccountNames],
@@ -2272,18 +2318,18 @@ var BaoKubernetesRole = Resource6("Bao.KubernetesRole", {
 var IDENTITY5 = roleIdentity("Bao.KubernetesRole", (mount, name) => rolePath3({ mount, name }), "kubernetes", foldName);
 var kubernetesRoleSpec = (props) => ({
   attributesOf: (live) => attributesOf7(props, live),
-  body: writeBody5(props),
+  body: writeBody4(props),
   family: "Bao.KubernetesRole",
   matches: (attributes) => matches6(attributes, props),
   path: rolePath3(props),
   problems: problems3(props)
 });
-var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect23.succeed(BaoKubernetesRole.Provider.of({
-  list: () => Effect23.succeed([]),
-  read: Effect23.fn(function* ({ fqn, instanceId, olds, output }) {
+var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect25.succeed(BaoKubernetesRole.Provider.of({
+  list: () => Effect25.succeed([]),
+  read: Effect25.fn(function* ({ fqn, instanceId, olds, output }) {
     return yield* readOwnedRole({ fqn, instanceId, output }, kubernetesRoleSpec(olds));
   }),
-  diff: Effect23.fn(function* ({ news, olds, output }) {
+  diff: Effect25.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY5, olds, news, output);
     if (output === undefined)
       return;
@@ -2293,20 +2339,20 @@ var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect
       return;
     return { action: yield* planRole(kubernetesRoleSpec(news)) };
   }),
-  reconcile: Effect23.fn(function* ({ fqn, instanceId, news, output }) {
+  reconcile: Effect25.fn(function* ({ fqn, instanceId, news, output }) {
     yield* guardRename(IDENTITY5, news, output);
     return yield* reconcileRole(kubernetesRoleSpec(news), claimFor({ fqn, instanceId, output }));
   }),
-  delete: Effect23.fn(function* ({ output }) {
+  delete: Effect25.fn(function* ({ output }) {
     yield* baoDelete(rolePath3(output));
     return;
   })
-})).pipe(Effect23.map(provingResumes)));
+})).pipe(Effect25.map(provingResumes)));
 // src/openbao/mfa-enforcement.ts
 import { Resource as Resource7 } from "alchemy";
 import { isResolved as isResolved7 } from "alchemy/Diff";
 import * as Provider7 from "alchemy/Provider";
-import * as Effect25 from "effect/Effect";
+import * as Effect27 from "effect/Effect";
 
 // src/openbao/mfa-enforcement-form.ts
 var sortedSet5 = (values) => [...new Set(values.map((value) => value.trim()))].filter((value) => value !== "").sort();
@@ -2344,7 +2390,7 @@ var attributesOf8 = (name, live) => {
   };
 };
 var matches7 = (attributes, props, resolved) => attributes.digest === sha256(JSON.stringify(canonicalFromProps4(props, resolved)));
-var writeBody6 = (form) => ({
+var writeBody5 = (form) => ({
   auth_method_accessors: [...form.authMethodAccessors],
   auth_method_types: [...form.authMethodTypes],
   identity_entity_ids: [...form.identityEntityIds],
@@ -2374,16 +2420,16 @@ var problems4 = (props, missingPaths) => {
 };
 
 // src/openbao/mfa-wire.ts
-import * as Effect24 from "effect/Effect";
+import * as Effect26 from "effect/Effect";
 var TOTP_PATH = "identity/mfa/method/totp";
 var METHODS_PATH = "identity/mfa/method";
 var enforcementPath = (name) => `identity/mfa/login-enforcement/${name}`;
 var record4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
-var ownNamespacePath = Effect24.gen(function* () {
+var ownNamespacePath = Effect26.gen(function* () {
   const env = yield* BaoEnv;
   return namespacePath(envNamespace(env));
 });
-var findTotp = (name) => Effect24.gen(function* () {
+var findTotp = (name) => Effect26.gen(function* () {
   const listing = yield* baoRead(`${METHODS_PATH}?list=true`);
   const info = record4(listing?.["key_info"]) ?? {};
   const own = yield* ownNamespacePath;
@@ -2392,17 +2438,17 @@ var findTotp = (name) => Effect24.gen(function* () {
     if (live === undefined || live["name"] !== name || live["namespace_path"] !== own)
       continue;
     if (live["type"] !== "totp") {
-      return yield* Effect24.die(new Error(`Bao.MfaTotpMethod ${name}: that name belongs to a ${String(live["type"])} method ` + `(${id}) in this namespace, and a TOTP write would convert it. Pick another name.`));
+      return yield* Effect26.die(new Error(`Bao.MfaTotpMethod ${name}: that name belongs to a ${String(live["type"])} method ` + `(${id}) in this namespace, and a TOTP write would convert it. Pick another name.`));
     }
     return { id, live };
   }
   return;
 });
-var writeTotp = (body) => Effect24.asVoid(baoCall("write", "POST", TOTP_PATH, body));
+var writeTotp = (body) => Effect26.asVoid(baoCall("write", "POST", TOTP_PATH, body));
 var deleteTotp = (id) => baoDelete(`${TOTP_PATH}/${id}`);
 var readEnforcement = (name) => baoRead(enforcementPath(name));
-var writeEnforcement = (name, body) => Effect24.asVoid(baoCall("write", "POST", enforcementPath(name), body));
-var authAccessors = (paths) => Effect24.gen(function* () {
+var writeEnforcement = (name, body) => Effect26.asVoid(baoCall("write", "POST", enforcementPath(name), body));
+var authAccessors = (paths) => Effect26.gen(function* () {
   if (paths.length === 0)
     return { accessors: [], missing: [] };
   const table = (yield* baoRead("sys/auth")) ?? {};
@@ -2423,20 +2469,20 @@ var BaoMfaLoginEnforcement = Resource7("Bao.MfaLoginEnforcement", {
   defaultRemovalPolicy: "retain"
 });
 var IDENTITY6 = nameIdentity("Bao.MfaLoginEnforcement", enforcementPath);
-var refuse3 = (name, message) => Effect25.die(new Error(`Bao.MfaLoginEnforcement ${name}: ${message}`));
-var resolveTargets = (props) => Effect25.map(authAccessors(props.authMethodPaths ?? []), ({ accessors, missing }) => ({
+var refuse3 = (name, message) => Effect27.die(new Error(`Bao.MfaLoginEnforcement ${name}: ${message}`));
+var resolveTargets = (props) => Effect27.map(authAccessors(props.authMethodPaths ?? []), ({ accessors, missing }) => ({
   bad: problems4(props, missing),
   resolved: accessors
 }));
-var readLive = (name) => Effect25.map(readEnforcement(name), (live) => live === undefined ? undefined : attributesOf8(name, live));
-var planEnforcement = (props) => Effect25.gen(function* () {
+var readLive = (name) => Effect27.map(readEnforcement(name), (live) => live === undefined ? undefined : attributesOf8(name, live));
+var planEnforcement = (props) => Effect27.gen(function* () {
   const { bad, resolved } = yield* resolveTargets(props);
   if (bad.length > 0)
     return "update";
   const live = yield* readLive(props.name);
   return live !== undefined && matches7(live, props, resolved) ? "noop" : "update";
 });
-var reconcileEnforcement = (props, claim) => Effect25.gen(function* () {
+var reconcileEnforcement = (props, claim) => Effect27.gen(function* () {
   const { bad, resolved } = yield* resolveTargets(props);
   if (bad.length > 0)
     return yield* refuse3(props.name, bad.join("; "));
@@ -2445,7 +2491,7 @@ var reconcileEnforcement = (props, claim) => Effect25.gen(function* () {
     yield* claim(`Bao.MfaLoginEnforcement ${props.name}`);
   }
   if (live === undefined || !matches7(live, props, resolved)) {
-    yield* writeEnforcement(props.name, writeBody6(canonicalFromProps4(props, resolved)));
+    yield* writeEnforcement(props.name, writeBody5(canonicalFromProps4(props, resolved)));
   }
   const after = yield* readLive(props.name);
   if (after === undefined)
@@ -2455,14 +2501,14 @@ var reconcileEnforcement = (props, claim) => Effect25.gen(function* () {
   }
   return after;
 });
-var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforcement, Effect25.succeed(BaoMfaLoginEnforcement.Provider.of({
-  list: () => Effect25.succeed([]),
-  read: Effect25.fn(function* ({ fqn, instanceId, olds, output }) {
+var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforcement, Effect27.succeed(BaoMfaLoginEnforcement.Provider.of({
+  list: () => Effect27.succeed([]),
+  read: Effect27.fn(function* ({ fqn, instanceId, olds, output }) {
     const found = yield* readLive(olds.name);
-    const ours = Effect25.map(planEnforcement(olds), (plan) => plan === "noop");
+    const ours = Effect27.map(planEnforcement(olds), (plan) => plan === "noop");
     return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect25.fn(function* ({ news, olds, output }) {
+  diff: Effect27.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY6, olds, news, output);
     if (output === undefined)
       return;
@@ -2472,19 +2518,19 @@ var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforceme
       return;
     return { action: yield* planEnforcement(news) };
   }),
-  reconcile: Effect25.fn(function* ({ fqn, instanceId, news, output }) {
+  reconcile: Effect27.fn(function* ({ fqn, instanceId, news, output }) {
     yield* guardRename(IDENTITY6, news, output);
     return yield* reconcileEnforcement(news, claimFor({ fqn, instanceId, output }));
   }),
-  delete: Effect25.fn(function* ({ output }) {
+  delete: Effect27.fn(function* ({ output }) {
     return yield* refuse3(output.name, "REFUSING to delete: OpenBao 2.6.2 drops a login enforcement from memory only, and it " + "returns on the next unseal (openbao/openbao#4030). Set this resource back to " + "retain to drop it from state; remove it for good only once the server is fixed.");
   })
-})).pipe(Effect25.map(provingResumes)));
+})).pipe(Effect27.map(provingResumes)));
 // src/openbao/mfa-totp.ts
 import { Resource as Resource8 } from "alchemy";
 import { isResolved as isResolved8 } from "alchemy/Diff";
 import * as Provider8 from "alchemy/Provider";
-import * as Effect26 from "effect/Effect";
+import * as Effect28 from "effect/Effect";
 
 // src/openbao/mfa-totp-form.ts
 var canonical6 = (input) => ({
@@ -2530,7 +2576,7 @@ var attributesOf9 = (methodId, live) => {
   };
 };
 var matches8 = (attributes, props) => attributes.digest === sha256(JSON.stringify(canonicalFromProps5(props)));
-var writeBody7 = (props) => {
+var writeBody6 = (props) => {
   const form = canonicalFromProps5(props);
   return {
     algorithm: form.algorithm,
@@ -2565,15 +2611,15 @@ var problems5 = (props) => {
 var BaoMfaTotpMethod = Resource8("Bao.MfaTotpMethod", {
   defaultRemovalPolicy: "retain"
 });
-var refuse4 = (name, message) => Effect26.die(new Error(`Bao.MfaTotpMethod ${name}: ${message}`));
-var readTotp = (props) => Effect26.map(findTotp(props.name), (found) => found === undefined ? undefined : attributesOf9(found.id, found.live));
-var planTotp = (props) => Effect26.gen(function* () {
+var refuse4 = (name, message) => Effect28.die(new Error(`Bao.MfaTotpMethod ${name}: ${message}`));
+var readTotp = (props) => Effect28.map(findTotp(props.name), (found) => found === undefined ? undefined : attributesOf9(found.id, found.live));
+var planTotp = (props) => Effect28.gen(function* () {
   if (problems5(props).length > 0)
     return "update";
   const live = yield* readTotp(props);
   return live !== undefined && matches8(live, props) ? "noop" : "update";
 });
-var reconcileTotp = (props, claim) => Effect26.gen(function* () {
+var reconcileTotp = (props, claim) => Effect28.gen(function* () {
   const bad = problems5(props);
   if (bad.length > 0)
     return yield* refuse4(props.name, bad.join("; "));
@@ -2581,7 +2627,7 @@ var reconcileTotp = (props, claim) => Effect26.gen(function* () {
   if (live !== undefined && claim !== undefined)
     yield* claim(`Bao.MfaTotpMethod ${props.name}`);
   if (live === undefined || !matches8(live, props))
-    yield* writeTotp(writeBody7(props));
+    yield* writeTotp(writeBody6(props));
   const after = yield* readTotp(props);
   if (after === undefined)
     return yield* refuse4(props.name, "the write succeeded but no method has that name.");
@@ -2589,14 +2635,14 @@ var reconcileTotp = (props, claim) => Effect26.gen(function* () {
     return yield* refuse4(props.name, "the method read back different.");
   return after;
 });
-var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect26.succeed(BaoMfaTotpMethod.Provider.of({
-  list: () => Effect26.succeed([]),
-  read: Effect26.fn(function* ({ fqn, instanceId, olds, output }) {
+var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect28.succeed(BaoMfaTotpMethod.Provider.of({
+  list: () => Effect28.succeed([]),
+  read: Effect28.fn(function* ({ fqn, instanceId, olds, output }) {
     const found = yield* readTotp(olds);
-    const ours = Effect26.sync(() => found !== undefined && problems5(olds).length === 0 && matches8(found, olds));
+    const ours = Effect28.sync(() => found !== undefined && problems5(olds).length === 0 && matches8(found, olds));
     return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect26.fn(function* ({ news, output }) {
+  diff: Effect28.fn(function* ({ news, output }) {
     const name = declaredString(news, "name");
     if (output !== undefined && name !== undefined) {
       const rename = renameProblem(output.name, name);
@@ -2609,39 +2655,39 @@ var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect26
       return;
     return { action: yield* planTotp(news) };
   }),
-  reconcile: Effect26.fn(function* ({ fqn, instanceId, news, output }) {
+  reconcile: Effect28.fn(function* ({ fqn, instanceId, news, output }) {
     const rename = output === undefined ? undefined : renameProblem(output.name, news.name);
     if (rename !== undefined)
       return yield* refuse4(news.name, rename);
     return yield* reconcileTotp(news, claimFor({ fqn, instanceId, output }));
   }),
-  delete: Effect26.fn(function* ({ output }) {
+  delete: Effect28.fn(function* ({ output }) {
     yield* deleteTotp(output.methodId);
     return;
   })
-})).pipe(Effect26.map(provingResumes)));
+})).pipe(Effect28.map(provingResumes)));
 // src/openbao/mount.ts
 import { Resource as Resource9 } from "alchemy";
 import { isResolved as isResolved9 } from "alchemy/Diff";
 import * as Provider9 from "alchemy/Provider";
-import * as Effect29 from "effect/Effect";
+import * as Effect31 from "effect/Effect";
 
 // src/openbao/mount-reconcile.ts
-import * as Effect28 from "effect/Effect";
+import * as Effect30 from "effect/Effect";
 
 // src/openbao/mount-wire.ts
-import * as Effect27 from "effect/Effect";
-var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect27.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+import * as Effect29 from "effect/Effect";
+var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect29.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
   ...asked.errors,
   `sys/mounts could not confirm the mount is absent: ${listing.message}`
-])), Effect27.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect27.succeed(undefined) : Effect27.fail(asked)));
-var readMountData = (path) => baoRead(readPath(path)).pipe(Effect27.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
+])), Effect29.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect29.succeed(undefined) : Effect29.fail(asked)));
+var readMountData = (path) => baoRead(readPath(path)).pipe(Effect29.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
 var enableMount = (props) => baoWrite("POST", readPath(props.path), enableBody(props));
 var tuneMount = (props) => baoWrite("POST", tunePath(props.path), tuneBody(props));
 var disableMount = (path) => baoDelete(readPath(path));
 
 // src/openbao/mount-reconcile.ts
-var readMount = (props) => Effect28.gen(function* () {
+var readMount = (props) => Effect30.gen(function* () {
   const live = yield* readMountData(props.path);
   if (live === undefined)
     return;
@@ -2654,10 +2700,10 @@ var moveTarget2 = (props) => ({
   type: props.type,
   wire: mountPath
 });
-var reconcileMount = (news, stated, options, claim) => Effect28.gen(function* () {
+var reconcileMount = (news, stated, options, claim) => Effect30.gen(function* () {
   const move = planMove("Bao.Mount", stated, news.path, news.remountFrom);
   if (move.kind === "refuse")
-    return yield* Effect28.die(new Error(move.message));
+    return yield* Effect30.die(new Error(move.message));
   const first = stated === undefined ? claim : undefined;
   if (first !== undefined && move.kind === "move") {
     const source = yield* readMount({ ...news, path: move.from });
@@ -2673,7 +2719,7 @@ var reconcileMount = (news, stated, options, claim) => Effect28.gen(function* ()
       yield* tuneMount(news);
   } else {
     if (live.type !== news.type) {
-      return yield* Effect28.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
+      return yield* Effect30.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
     }
     if (first !== undefined)
       yield* first(`Bao.Mount ${mountPath(news.path)}`);
@@ -2682,7 +2728,7 @@ var reconcileMount = (news, stated, options, claim) => Effect28.gen(function* ()
   }
   live = yield* readMount(news);
   if (live === undefined) {
-    return yield* Effect28.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
+    return yield* Effect30.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
   }
   return live;
 });
@@ -2691,21 +2737,21 @@ var reconcileMount = (news, stated, options, claim) => Effect28.gen(function* ()
 var BaoMount = Resource9("Bao.Mount", {
   defaultRemovalPolicy: "retain"
 });
-var BaoMountProvider = () => Provider9.effect(BaoMount, Effect29.succeed(BaoMount.Provider.of({
-  list: () => Effect29.succeed([]),
-  read: Effect29.fn(function* ({ fqn, instanceId, olds, output }) {
+var BaoMountProvider = () => Provider9.effect(BaoMount, Effect31.succeed(BaoMount.Provider.of({
+  list: () => Effect31.succeed([]),
+  read: Effect31.fn(function* ({ fqn, instanceId, olds, output }) {
     const found = yield* readMount(olds);
-    const ours = Effect29.sync(() => found !== undefined && matches(found, olds));
+    const ours = Effect31.sync(() => found !== undefined && matches(found, olds));
     return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect29.fn(function* ({ news, output }) {
+  diff: Effect31.fn(function* ({ news, output }) {
     if (output === undefined)
       return;
     if (!isResolved9(news))
       return;
     const move = planMove("Bao.Mount", output.path, news.path, news.remountFrom);
     if (move.kind === "refuse")
-      return yield* Effect29.die(new Error(move.message));
+      return yield* Effect31.die(new Error(move.message));
     if (move.kind === "move")
       return { action: "update" };
     const live = yield* readMount(news);
@@ -2717,20 +2763,20 @@ var BaoMountProvider = () => Provider9.effect(BaoMount, Effect29.succeed(BaoMoun
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect29.fn(function* ({ fqn, instanceId, news, output }) {
+  reconcile: Effect31.fn(function* ({ fqn, instanceId, news, output }) {
     const claim = claimFor({ fqn, instanceId, output });
     return yield* reconcileMount(news, output?.path, undefined, claim);
   }),
-  delete: Effect29.fn(function* ({ output }) {
+  delete: Effect31.fn(function* ({ output }) {
     yield* disableMount(output.path);
     return;
   })
-})).pipe(Effect29.map(provingResumes)));
+})).pipe(Effect31.map(provingResumes)));
 // src/openbao/pki-role.ts
 import { Resource as Resource10 } from "alchemy";
 import { isResolved as isResolved10 } from "alchemy/Diff";
 import * as Provider10 from "alchemy/Provider";
-import * as Effect30 from "effect/Effect";
+import * as Effect32 from "effect/Effect";
 
 // src/openbao/pki-role-canonical.ts
 var DEFAULT_KEY_USAGE = [
@@ -2764,7 +2810,7 @@ var canonical7 = (input) => ({
   signatureBits: input.signatureBits,
   ttlSeconds: input.ttlSeconds
 });
-var seconds3 = (text10) => parseDuration(text10) ?? -1;
+var seconds4 = (text10) => parseDuration(text10) ?? -1;
 var canonicalFromProps6 = (props) => canonical7({
   allowBareDomains: props.allowBareDomains ?? false,
   allowGlobDomains: props.allowGlobDomains ?? false,
@@ -2782,12 +2828,12 @@ var canonicalFromProps6 = (props) => canonical7({
   keyBits: props.keyBits ?? 0,
   keyType: props.keyType ?? "rsa",
   keyUsage: props.keyUsage ?? DEFAULT_KEY_USAGE,
-  maxTtlSeconds: seconds3(props.maxTtl),
+  maxTtlSeconds: seconds4(props.maxTtl),
   noStore: props.noStore ?? false,
   requireCn: props.requireCn ?? true,
   serverFlag: props.serverFlag ?? true,
   signatureBits: props.signatureBits ?? 0,
-  ttlSeconds: seconds3(props.ttl)
+  ttlSeconds: seconds4(props.ttl)
 });
 var bool2 = (value, fallback) => typeof value === "boolean" ? value : fallback;
 var int2 = (value, fallback) => typeof value === "number" && Number.isFinite(value) ? value : fallback;
@@ -2843,7 +2889,7 @@ var attributesOf10 = (props, live) => {
     digest: digestOf(form)
   };
 };
-var writeBody8 = (props) => {
+var writeBody7 = (props) => {
   const form = canonicalFromProps6(props);
   const body = {
     allowed_domains: form.allowedDomains.join(","),
@@ -2897,20 +2943,20 @@ var BaoPkiRole = Resource10("Bao.PkiRole", {
   defaultRemovalPolicy: "retain"
 });
 var IDENTITY7 = roleIdentity("Bao.PkiRole", (mount, name) => rolePath4({ mount, name }), "pki");
-var readRole2 = (props) => Effect30.gen(function* () {
+var readRole2 = (props) => Effect32.gen(function* () {
   const live = yield* baoRead(rolePath4(props));
   if (live === undefined)
     return;
   return attributesOf10(props, live);
 });
-var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect30.succeed(BaoPkiRole.Provider.of({
-  list: () => Effect30.succeed([]),
-  read: Effect30.fn(function* ({ fqn, instanceId, olds, output }) {
+var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect32.succeed(BaoPkiRole.Provider.of({
+  list: () => Effect32.succeed([]),
+  read: Effect32.fn(function* ({ fqn, instanceId, olds, output }) {
     const found = yield* readRole2(olds);
-    const ours = Effect30.sync(() => found !== undefined && problems6(olds).length === 0 && matches9(found, olds));
+    const ours = Effect32.sync(() => found !== undefined && problems6(olds).length === 0 && matches9(found, olds));
     return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect30.fn(function* ({ news, olds, output }) {
+  diff: Effect32.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY7, olds, news, output);
     if (output === undefined)
       return;
@@ -2925,38 +2971,38 @@ var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect30.succeed(Ba
       return { action: "update" };
     return matches9(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect30.fn(function* ({ fqn, instanceId, news, output }) {
+  reconcile: Effect32.fn(function* ({ fqn, instanceId, news, output }) {
     const path = rolePath4(news);
     yield* guardRename(IDENTITY7, news, output);
     const bad = problems6(news);
     if (bad.length > 0) {
-      return yield* Effect30.die(new Error(`Bao.PkiRole ${path}: ${bad.join(" ")}`));
+      return yield* Effect32.die(new Error(`Bao.PkiRole ${path}: ${bad.join(" ")}`));
     }
     const live = yield* readRole2(news);
     if (live !== undefined)
       yield* refuseTakeover({ fqn, instanceId, output }, `Bao.PkiRole ${path}`);
     if (live === undefined || !matches9(live, news)) {
-      yield* baoWrite("PUT", path, writeBody8(news));
+      yield* baoWrite("PUT", path, writeBody7(news));
     }
     const after = yield* readRole2(news);
     if (after === undefined) {
-      return yield* Effect30.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
+      return yield* Effect32.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
     }
     if (!matches9(after, news)) {
-      return yield* Effect30.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
+      return yield* Effect32.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
     }
     return after;
   }),
-  delete: Effect30.fn(function* ({ output }) {
+  delete: Effect32.fn(function* ({ output }) {
     yield* baoDelete(rolePath4(output));
     return;
   })
-})).pipe(Effect30.map(provingResumes)));
+})).pipe(Effect32.map(provingResumes)));
 // src/openbao/plugin.ts
 import { Resource as Resource11 } from "alchemy";
 import { isResolved as isResolved11 } from "alchemy/Diff";
 import * as Provider11 from "alchemy/Provider";
-import * as Effect32 from "effect/Effect";
+import * as Effect34 from "effect/Effect";
 
 // src/openbao/plugin-form.ts
 var resolve = (props) => ({
@@ -3012,7 +3058,7 @@ var sameArgs = (want, have) => want.length === have.length && want.every((entry,
 var matches10 = (attributes, form) => !attributes.builtin && attributes.version === form.version && attributes.sha256 === form.sha256 && attributes.command === form.command && sameArgs(form.args, attributes.args);
 
 // src/openbao/plugin-reconcile.ts
-import * as Effect31 from "effect/Effect";
+import * as Effect33 from "effect/Effect";
 
 // src/openbao/plugin-wire.ts
 var readPluginData = (form) => baoRead(versionedPath(form.type, form.name, form.version));
@@ -3020,10 +3066,10 @@ var registerPlugin = (form) => baoWrite("PUT", catalogPath(form.type, form.name)
 var deregisterPlugin = (type, name, version) => baoDelete(versionedPath(type, name, version));
 
 // src/openbao/plugin-reconcile.ts
-var readEntry = (form) => Effect31.map(readPluginData(form), (live) => live === undefined ? undefined : { attributes: attributesOf11(form, live), live });
-var refuse5 = (form, message) => Effect31.die(new Error(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}: ${message}`));
+var readEntry = (form) => Effect33.map(readPluginData(form), (live) => live === undefined ? undefined : { attributes: attributesOf11(form, live), live });
+var refuse5 = (form, message) => Effect33.die(new Error(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}: ${message}`));
 var SELF_REPORTED = "the write succeeded but the read-back does not match. If the binary reports its own version, " + "OpenBao filed the registration under it (plugin_catalog.go setInternal) — declare `version` " + "as exactly the version the binary reports, and deploy once with --adopt: that adopts the " + "entry this write just made.";
-var reconcilePlugin = (props, claim) => Effect31.gen(function* () {
+var reconcilePlugin = (props, claim) => Effect33.gen(function* () {
   const form = resolve(props);
   const bad = problems7(form);
   if (bad.length > 0)
@@ -3065,15 +3111,15 @@ var IDENTITY8 = {
   family: "Bao.Plugin",
   recorded: (output) => versionedPath(output.type, output.name, output.version)
 };
-var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect32.succeed(BaoPlugin.Provider.of({
-  list: () => Effect32.succeed([]),
-  read: Effect32.fn(function* ({ fqn, instanceId, olds, output }) {
+var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect34.succeed(BaoPlugin.Provider.of({
+  list: () => Effect34.succeed([]),
+  read: Effect34.fn(function* ({ fqn, instanceId, olds, output }) {
     const form = resolve(olds);
     const found = yield* readEntry(form);
-    const ours = Effect32.sync(() => found !== undefined && problems7(form).length === 0 && matches10(found.attributes, form));
+    const ours = Effect34.sync(() => found !== undefined && problems7(form).length === 0 && matches10(found.attributes, form));
     return yield* ownedRead({ fqn, instanceId, output }, found?.attributes, ours);
   }),
-  diff: Effect32.fn(function* ({ news, olds, output }) {
+  diff: Effect34.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY8, olds, news, output);
     if (output === undefined)
       return;
@@ -3087,20 +3133,20 @@ var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect32.succeed(BaoP
       return { action: "update" };
     return matches10(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect32.fn(function* ({ fqn, instanceId, news, output }) {
+  reconcile: Effect34.fn(function* ({ fqn, instanceId, news, output }) {
     yield* guardRename(IDENTITY8, news, output);
     return yield* reconcilePlugin(news, claimFor({ fqn, instanceId, output }));
   }),
-  delete: Effect32.fn(function* ({ output }) {
+  delete: Effect34.fn(function* ({ output }) {
     yield* deregisterPlugin(output.type, output.name, output.version);
     return;
   })
-})).pipe(Effect32.map(provingResumes)));
+})).pipe(Effect34.map(provingResumes)));
 // src/openbao/policy.ts
 import { Resource as Resource12 } from "alchemy";
 import { isResolved as isResolved12 } from "alchemy/Diff";
 import * as Provider12 from "alchemy/Provider";
-import * as Effect34 from "effect/Effect";
+import * as Effect36 from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 
@@ -3108,22 +3154,29 @@ import * as Path from "effect/Path";
 var isEmptyAssembly = (parts, joined) => parts === 0 || !/^\s*path\s+"/m.test(joined);
 
 // src/openbao/policy-wire.ts
-import * as Effect33 from "effect/Effect";
+import {
+  policiesDeleteAclPolicy,
+  policiesReadAclPolicy,
+  policiesWriteAclPolicy
+} from "@distilled.cloud/openbao/policies";
+import * as Effect35 from "effect/Effect";
 var policyPath = (name) => `sys/policies/acl/${name}`;
-var readPolicy = (name) => Effect33.flatMap(baoRead(policyPath(name)), (data) => {
-  if (data === undefined)
-    return Effect33.succeed("");
+var readPolicy = (name) => runBaoRead(policiesReadAclPolicy({ name })).pipe(Effect35.flatMap((data) => {
   const text11 = data["policy"];
-  return typeof text11 === "string" ? Effect33.succeed(text11) : Effect33.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
-});
-var writePolicy = (name, hcl) => baoWrite("PUT", policyPath(name), { policy: hcl });
-var deletePolicy = (name) => baoDelete(policyPath(name));
+  return typeof text11 === "string" ? Effect35.succeed(text11) : Effect35.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
+}), Effect35.catchTag("PolicyNotFound", () => Effect35.succeed(undefined)));
+var policyExists = (name) => Effect35.map(readPolicy(name), (policy) => policy !== undefined);
+var writePolicy = (name, hcl) => runBaoWrite(policiesWriteAclPolicy({ name, policy: hcl })).pipe(Effect35.asVoid);
+var deletePolicy = (name) => runBao(policiesDeleteAclPolicy({ name })).pipe(Effect35.catchTag("NotFound", () => Effect35.void), Effect35.asVoid);
+
+// src/openbao/policy-identity.ts
+var policyIdentity = nameIdentity("Bao.Policy", policyPath, policyKey);
+var judgePolicyRename = (olds, news, output) => judgeMoveWith("Bao.Policy", output === undefined ? declaredString(olds, "name") : output.name, declaredString(news, "name"), policyExists, policyKey);
 
 // src/openbao/policy.ts
 var BaoPolicy = Resource12("Bao.Policy", {
   defaultRemovalPolicy: "retain"
 });
-var IDENTITY9 = nameIdentity("Bao.Policy", policyPath, policyKey);
 var grantsOf = (hcl) => (hcl.match(/^path /gm) ?? []).length;
 var attributesOf12 = (name, hcl, parts) => ({
   name,
@@ -3131,10 +3184,10 @@ var attributesOf12 = (name, hcl, parts) => ({
   grants: grantsOf(hcl),
   parts
 });
-var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect34.gen(function* () {
+var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect36.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const assemble = (dir) => Effect34.gen(function* () {
+  const assemble = (dir) => Effect36.gen(function* () {
     const entries2 = (yield* fs.readDirectory(dir)).filter((f) => f.endsWith(".hcl")).sort();
     let joined = "";
     for (const f of entries2)
@@ -3143,15 +3196,15 @@ var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect34.gen(function
     return { joined, parts: entries2.length };
   });
   return BaoPolicy.Provider.of({
-    list: () => Effect34.succeed([]),
-    read: Effect34.fn(function* ({ fqn, instanceId, olds, output }) {
+    list: () => Effect36.succeed([]),
+    read: Effect36.fn(function* ({ fqn, instanceId, olds, output }) {
       const live = yield* readPolicy(olds.name);
-      const found = live.length === 0 ? undefined : attributesOf12(olds.name, live, 0);
-      const ours = Effect34.map(assemble(olds.fragments), (a) => sha256(a.joined) === found?.digest);
+      const found = live === undefined ? undefined : attributesOf12(olds.name, live, 0);
+      const ours = Effect36.map(assemble(olds.fragments), (a) => sha256(a.joined) === found?.digest);
       return yield* ownedRead({ fqn, instanceId, output }, found, ours);
     }),
-    diff: Effect34.fn(function* ({ news, olds, output }) {
-      const move = yield* judgeRename(IDENTITY9, olds, news, output);
+    diff: Effect36.fn(function* ({ news, olds, output }) {
+      const move = yield* judgePolicyRename(olds, news, output);
       if (output === undefined)
         return;
       if (move !== undefined)
@@ -3160,47 +3213,47 @@ var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect34.gen(function
         return;
       const { joined } = yield* assemble(news.fragments);
       const live = yield* readPolicy(news.name);
-      return live.length > 0 && sha256(live) === sha256(joined) ? { action: "noop" } : { action: "update" };
+      return live !== undefined && sha256(live) === sha256(joined) ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect34.fn(function* ({ fqn, instanceId, news, output }) {
+    reconcile: Effect36.fn(function* ({ fqn, instanceId, news, output }) {
       const name = news.name;
-      yield* guardRename(IDENTITY9, news, output);
+      yield* guardRename(policyIdentity, news, output);
       const { joined, parts } = yield* assemble(news.fragments);
       if (isEmptyAssembly(parts, joined))
-        return yield* Effect34.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
+        return yield* Effect36.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
       const current = yield* readPolicy(name);
-      if (current.length > 0)
+      if (current !== undefined)
         yield* refuseTakeover({ fqn, instanceId, output }, `Bao.Policy ${name}`);
-      if (current.length > 0 && sha256(current) === sha256(joined)) {
+      if (current !== undefined && sha256(current) === sha256(joined)) {
         return attributesOf12(name, joined, parts);
       }
       yield* writePolicy(name, joined);
       return attributesOf12(name, joined, parts);
     }),
-    delete: Effect34.fn(function* ({ output }) {
+    delete: Effect36.fn(function* ({ output }) {
       yield* deletePolicy(output.name);
       return;
     })
   });
-}).pipe(Effect34.map(provingResumes)));
+}).pipe(Effect36.map(provingResumes)));
 // src/openbao/proxmox-role.ts
 import { Resource as Resource13 } from "alchemy";
 import { isResolved as isResolved13 } from "alchemy/Diff";
 import * as Provider13 from "alchemy/Provider";
-import * as Effect36 from "effect/Effect";
+import * as Effect38 from "effect/Effect";
 
 // src/openbao/proxmox-role-form.ts
 var text11 = (value) => typeof value === "string" ? value : "";
-var ttlText3 = (seconds4, fallback = "0") => {
-  if (seconds4 === undefined)
+var ttlText3 = (seconds5, fallback = "0") => {
+  if (seconds5 === undefined)
     return fallback;
-  if (seconds4 % 86400 === 0)
-    return `${String(seconds4 / 86400)}d`;
-  if (seconds4 % 3600 === 0)
-    return `${String(seconds4 / 3600)}h`;
-  if (seconds4 % 60 === 0)
-    return `${String(seconds4 / 60)}m`;
-  return `${String(seconds4)}s`;
+  if (seconds5 % 86400 === 0)
+    return `${String(seconds5 / 86400)}d`;
+  if (seconds5 % 3600 === 0)
+    return `${String(seconds5 / 3600)}h`;
+  if (seconds5 % 60 === 0)
+    return `${String(seconds5 / 60)}m`;
+  return `${String(seconds5)}s`;
 };
 var rolePath5 = (mount, name) => `${mountPath(mount)}/roles/${name}`;
 var attributesOf13 = (props, live) => {
@@ -3213,7 +3266,7 @@ var attributesOf13 = (props, live) => {
   };
   return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
 };
-var writeBody9 = (props) => {
+var writeBody8 = (props) => {
   const ttl = parseDuration(props.ttl);
   const maxTtl = parseDuration(props.maxTtl);
   const bad = [];
@@ -3237,8 +3290,8 @@ var rescopeRefusal = (before, mintUser, allowMintUserChange) => before === mintU
 var matches11 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl5(props.ttl, attributes.ttl) && sameTtl5(props.maxTtl, attributes.maxTtl);
 
 // src/openbao/proxmox-role-wire.ts
-import * as Effect35 from "effect/Effect";
-var readRole3 = (props) => Effect35.gen(function* () {
+import * as Effect37 from "effect/Effect";
+var readRole3 = (props) => Effect37.gen(function* () {
   const live = yield* baoRead(rolePath5(props.mount, props.name));
   if (live === undefined)
     return;
@@ -3249,16 +3302,16 @@ var readRole3 = (props) => Effect35.gen(function* () {
 var BaoProxmoxRole = Resource13("Bao.ProxmoxRole", {
   defaultRemovalPolicy: "retain"
 });
-var IDENTITY10 = roleIdentity("Bao.ProxmoxRole", rolePath5);
-var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect36.succeed(BaoProxmoxRole.Provider.of({
-  list: () => Effect36.succeed([]),
-  read: Effect36.fn(function* ({ fqn, instanceId, olds, output }) {
+var IDENTITY9 = roleIdentity("Bao.ProxmoxRole", rolePath5);
+var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect38.succeed(BaoProxmoxRole.Provider.of({
+  list: () => Effect38.succeed([]),
+  read: Effect38.fn(function* ({ fqn, instanceId, olds, output }) {
     const found = yield* readRole3(olds);
-    const ours = Effect36.sync(() => found !== undefined && matches11(found, olds));
+    const ours = Effect38.sync(() => found !== undefined && matches11(found, olds));
     return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect36.fn(function* ({ news, olds, output }) {
-    const move = yield* judgeRename(IDENTITY10, olds, news, output);
+  diff: Effect38.fn(function* ({ news, olds, output }) {
+    const move = yield* judgeRename(IDENTITY9, olds, news, output);
     if (output === undefined)
       return;
     if (move !== undefined) {
@@ -3270,7 +3323,7 @@ var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect36.su
       const refusal2 = rescopeRefusal(from, mintUser, allow);
       if (refusal2 === undefined)
         return { action: "replace" };
-      return yield* Effect36.die(new Error(`Bao.ProxmoxRole ${move.from} → ${move.to}: the rename ${refusal2}`));
+      return yield* Effect38.die(new Error(`Bao.ProxmoxRole ${move.from} → ${move.to}: the rename ${refusal2}`));
     }
     if (!isResolved13(news))
       return;
@@ -3281,39 +3334,39 @@ var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect36.su
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect36.fn(function* ({ fqn, instanceId, news, output }) {
+  reconcile: Effect38.fn(function* ({ fqn, instanceId, news, output }) {
     const path = rolePath5(news.mount, news.name);
-    yield* guardRename(IDENTITY10, news, output);
+    yield* guardRename(IDENTITY9, news, output);
     const live = yield* readRole3(news);
     if (live !== undefined)
       yield* refuseTakeover({ fqn, instanceId, output }, `Bao.ProxmoxRole ${path}`);
     const rescope = live === undefined ? undefined : rescopeRefusal(live.mintUser, news.mintUser, news.allowMintUserChange);
     if (rescope !== undefined) {
-      return yield* Effect36.die(new Error(`Bao.ProxmoxRole ${path}: ${rescope}`));
+      return yield* Effect38.die(new Error(`Bao.ProxmoxRole ${path}: ${rescope}`));
     }
     if (live === undefined || !matches11(live, news)) {
-      const write = writeBody9(news);
+      const write = writeBody8(news);
       if (!write.ok) {
-        return yield* Effect36.die(new Error(`Bao.ProxmoxRole ${path}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
+        return yield* Effect38.die(new Error(`Bao.ProxmoxRole ${path}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
       }
       yield* baoWrite("PUT", path, write.body);
     }
     const after = yield* readRole3(news);
     if (after === undefined) {
-      return yield* Effect36.die(new Error(`Bao.ProxmoxRole ${path}: write returned no error ` + "but the role is still absent."));
+      return yield* Effect38.die(new Error(`Bao.ProxmoxRole ${path}: write returned no error ` + "but the role is still absent."));
     }
     return after;
   }),
-  delete: Effect36.fn(function* ({ output }) {
+  delete: Effect38.fn(function* ({ output }) {
     yield* baoDelete(rolePath5(output.mount, output.name));
     return;
   })
-})).pipe(Effect36.map(provingResumes)));
+})).pipe(Effect38.map(provingResumes)));
 // src/openbao/ssh-role.ts
 import { Resource as Resource14 } from "alchemy";
 import { isResolved as isResolved14 } from "alchemy/Diff";
 import * as Provider14 from "alchemy/Provider";
-import * as Effect37 from "effect/Effect";
+import * as Effect39 from "effect/Effect";
 
 // src/openbao/ssh-role-form.ts
 var readPath4 = (mount, name) => `${sshMountOf(mount)}/roles/${name}`;
@@ -3374,8 +3427,8 @@ var attributesOf14 = (form, live) => {
   };
   return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
 };
-var mapValue = (map23) => extMap(map23);
-var writeBody10 = (form) => ({
+var mapValue = (map26) => extMap(map26);
+var writeBody9 = (form) => ({
   key_type: "ca",
   allowed_users: form.allowedUsers.join(","),
   default_user: form.defaultUser,
@@ -3427,23 +3480,23 @@ var wouldErase2 = (live) => {
 var BaoSshRole = Resource14("Bao.SshRole", {
   defaultRemovalPolicy: "retain"
 });
-var IDENTITY11 = roleIdentity("Bao.SshRole", readPath4, "ssh");
-var readRole4 = (form) => Effect37.gen(function* () {
+var IDENTITY10 = roleIdentity("Bao.SshRole", readPath4, "ssh");
+var readRole4 = (form) => Effect39.gen(function* () {
   const live = yield* baoRead(readPath4(form.mount, form.name));
   if (live === undefined)
     return;
   return { attributes: attributesOf14(form, live), live };
 });
-var refuse6 = (message) => Effect37.die(new Error(message));
-var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect37.succeed(BaoSshRole.Provider.of({
-  list: () => Effect37.succeed([]),
-  read: Effect37.fn(function* ({ fqn, instanceId, olds, output }) {
+var refuse6 = (message) => Effect39.die(new Error(message));
+var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect39.succeed(BaoSshRole.Provider.of({
+  list: () => Effect39.succeed([]),
+  read: Effect39.fn(function* ({ fqn, instanceId, olds, output }) {
     const found = yield* readRole4(resolve2(olds));
-    const ours = Effect37.sync(() => found !== undefined && matches12(found.attributes, resolve2(olds)));
+    const ours = Effect39.sync(() => found !== undefined && matches12(found.attributes, resolve2(olds)));
     return yield* ownedRead({ fqn, instanceId, output }, found?.attributes, ours);
   }),
-  diff: Effect37.fn(function* ({ news, olds, output }) {
-    const move = yield* judgeRename(IDENTITY11, olds, news, output);
+  diff: Effect39.fn(function* ({ news, olds, output }) {
+    const move = yield* judgeRename(IDENTITY10, olds, news, output);
     if (output === undefined)
       return;
     if (move !== undefined)
@@ -3456,10 +3509,10 @@ var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect37.succeed(Ba
       return { action: "update" };
     return matches12(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect37.fn(function* ({ fqn, instanceId, news, output }) {
+  reconcile: Effect39.fn(function* ({ fqn, instanceId, news, output }) {
     const form = resolve2(news);
     const path = readPath4(form.mount, form.name);
-    yield* guardRename(IDENTITY11, news, output);
+    yield* guardRename(IDENTITY10, news, output);
     const bad = badDurations(form);
     if (bad.length > 0) {
       return yield* refuse6(`Bao.SshRole ${path}: ${bad.join(", ")} is not a duration parseDuration understands ` + "(`0` or `<n>s|m|h|d`). It would write, then report update on every plan forever.");
@@ -3477,7 +3530,7 @@ var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect37.succeed(Ba
           return yield* refuse6(`Bao.SshRole ${path}: live role carries ${lost.join(", ")}, which this ` + "resource does not declare and the full-replace write would ERASE. " + "Fold those settings into the declaration, or clear them by hand first.");
         }
       }
-      yield* baoWrite("PUT", path, writeBody10(form));
+      yield* baoWrite("PUT", path, writeBody9(form));
     }
     const after = yield* readRole4(form);
     if (after === undefined) {
@@ -3485,11 +3538,11 @@ var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect37.succeed(Ba
     }
     return after.attributes;
   }),
-  delete: Effect37.fn(function* ({ output }) {
+  delete: Effect39.fn(function* ({ output }) {
     yield* baoDelete(readPath4(output.mount, output.name));
     return;
   })
-})).pipe(Effect37.map(provingResumes)));
+})).pipe(Effect39.map(provingResumes)));
 export {
   BaoAuthMethod,
   BaoAuthMethodProvider,
@@ -3539,5 +3592,5 @@ export {
   revokeSelfEffect
 };
 
-//# debugId=8A440F36637B89AF64756E2164756E21
+//# debugId=C687B72D0BAE7E8D64756E2164756E21
 //# sourceMappingURL=index.js.map