@homeflare/alchemy 0.37.5 → 0.37.7

package/dist/openbao/auth-role-form.d.ts

@@ -27,12 +27,6 @@ export interface BaoAuthRoleAttributes {
 }
 export declare const attributesOf: (props: BaoAuthRoleProps, live: Record<string, unknown>) => BaoAuthRoleAttributes;
 export declare const readPath: (name: string) => string;
-/**
- * The body for `PUT auth/approle/role/<name>`.
- *
- * ★ ALL STRINGS, EXACTLY THE `k=v` PAIRS `bao write` USED TO SEND — see `baoWrite` in bao-http.ts.
- */
-export declare const writeBody: (props: BaoAuthRoleProps) => Record<string, string>;
 /** True when live already matches the declaration on every managed field. */
 export declare const matches: (attributes: BaoAuthRoleAttributes, props: BaoAuthRoleProps) => boolean;
 //# sourceMappingURL=auth-role-form.d.ts.map

package/dist/openbao/auth-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-form.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,eAAO,MAAM,YAAY,UAChB,gBAAgB,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,qBAWF,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAgC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,SAAS,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAYxE,CAAC;AAWF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAUjF,CAAC"}
+{"version":3,"file":"auth-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-form.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,eAAO,MAAM,YAAY,UAChB,gBAAgB,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,qBAWF,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAgC,CAAC;AAWtE,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAUjF,CAAC"}

package/dist/openbao/auth-role-identity.d.ts

@@ -0,0 +1,11 @@
+export declare const authRoleIdentity: import("./rename-identity.ts").Identity<{
+    readonly name: string;
+}>;
+/** All occupied-name reads share the SDK's typed absence and refusal behavior. */
+export declare const judgeAuthRoleRename: (olds: unknown, news: unknown, output: {
+    readonly name: string;
+} | undefined) => import("effect/Effect").Effect<{
+    from: string;
+    to: string;
+} | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("./bao-status.ts").BaoError | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/caddy").UnprocessableEntity | import("@distilled.cloud/openbao/Errors").ClientErrors, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=auth-role-identity.d.ts.map

package/dist/openbao/auth-role-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-role-identity.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-identity.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,gBAAgB;mBAAiC,MAAM;EAInE,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,SACxB,OAAO,QACP,OAAO,UACL;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS;;;+0BAQ5C,CAAC"}

package/dist/openbao/auth-role-wire.d.ts

@@ -0,0 +1,23 @@
+/**
+ * AppRole METADATA through the named SDK operations (OpenBao 2.6.2 generated schema).
+ * ★ pathRoleRead returns nil for absence; logical.RespondErrorCommon turns that read into
+ * 404. pathRoleDelete returns nil for an already absent role (204). Reasoned from v2.6.2
+ * builtin/credential/approle/path_role.go:1758-1904 and sdk/logical/response_util.go:21-26.
+ * ⛔ No role-id, secret-id or login request belongs in this configuration lifecycle.
+ */
+import { type AppRoleReadRoleResponse, type AppRoleWriteRoleRequest } from '@distilled.cloud/openbao/approle';
+import * as Effect from 'effect/Effect';
+import { type BaoAuthRoleProps } from './auth-role-form.ts';
+import { BaoError } from './bao-status.ts';
+export declare const readAuthRole: (name: string) => Effect.Effect<AppRoleReadRoleResponse | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | BaoError | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/caddy").UnprocessableEntity | import("@distilled.cloud/openbao/Errors").ClientErrors, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const authRoleExists: (name: string) => Effect.Effect<boolean, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | BaoError | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/caddy").UnprocessableEntity | import("@distilled.cloud/openbao/Errors").ClientErrors, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const authRoleRequest: (props: BaoAuthRoleProps) => Effect.Effect<AppRoleWriteRoleRequest, BaoError, never>;
+/**
+ * ★ A FULL-REPLACE WRITE, like the policy write: every managed field travels in the request
+ * every time (only genuinely omitted knobs stay omitted), so a transport failure is safe to
+ * retry through `runBaoWrite` — the replay sends the identical desired state.
+ */
+export declare const writeAuthRole: (props: BaoAuthRoleProps) => Effect.Effect<import("@distilled.cloud/openbao/approle").AppRoleWriteRoleResponse, BaoError | import("effect/Cause").TimeoutError | import("@distilled.cloud/openbao/Protocol").OpenBaoOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** Other typed SDK failures, including denied deletes, propagate unchanged. */
+export declare const deleteAuthRole: (name: string) => Effect.Effect<void | import("@distilled.cloud/openbao/approle").AppRoleDeleteRoleResponse, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | BaoError | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/caddy").UnprocessableEntity | import("@distilled.cloud/openbao/Errors").ClientErrors, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=auth-role-wire.d.ts.map

package/dist/openbao/auth-role-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-role-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-wire.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAI7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,gBAAgB,EAAY,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAwB3C,eAAO,MAAM,YAAY,SAAU,MAAM,81BAQtC,CAAC;AAEJ,eAAO,MAAM,cAAc,SAAU,MAAM,k0BACwB,CAAC;AAEpE,eAAO,MAAM,eAAe,UAAW,gBAAgB,4DAuBnD,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,aAAa,UAAW,gBAAgB,0PAC6C,CAAC;AAEnG,+EAA+E;AAC/E,eAAO,MAAM,cAAc,SAAU,MAAM,s4BACqD,CAAC"}

package/dist/openbao/auth-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAKtB,MAAM,qBAAqB,CAAC;AAI7B,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAiBH,eAAO,MAAM,mBAAmB,kGAoF7B,CAAC"}
+{"version":3,"file":"auth-role.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAInE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAItB,MAAM,qBAAqB,CAAC;AAK7B,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAiBH,eAAO,MAAM,mBAAmB,kGAoF7B,CAAC"}

package/dist/openbao/bao-http.d.ts

@@ -1,16 +1,3 @@
-/**
- * One call to OpenBao's HTTP API through Effect's `HttpClient` — the transport every Bao.* family
- * uses since it stopped shelling out to `bao`.
- *
- * ★ `HttpClient`, THE SAME PATTERN <estate>/proxmox and <estate>/forgejo USE AGAINST THEIR APIs, decided
- *   2026-09-14. It buys a typed error channel, interruption when a plan is cancelled, the runtime's
- *   tracing, and a client a test can point at a fake server — and it needs no Alchemy session, so
- *   every call here works from all four operations. (`CommandExecutor.run` was tried on Bao.Policy
- *   first and blocked read/diff: Alchemy passes a session to reconcile/delete but NOT to read/diff,
- *   Provider.ts:258-289. The ChildProcessSpawner that fixed that is gone with the CLI.)
- * ⚠️ THE STACK MUST PROVIDE `FetchHttpClient.layer`. alchemy.run.ts does, the way
- *   <estate>/proxmox/alchemy.run.ts does.
- */
 import * as Context from 'effect/Context';
 import * as Effect from 'effect/Effect';
 import * as Semaphore from 'effect/Semaphore';
@@ -47,6 +34,40 @@ export declare const BaoEnv: Context.Reference<Readonly<Record<string, string |
  */
 export declare const MAX_IN_FLIGHT = 8;
 export declare const BaoGate: Context.Reference<Semaphore.Semaphore>;
+/**
+ * ⚠️ THE CLI's DEFAULT CLIENT TIMEOUT (openbao v2.6.2 api/client.go:324). A hung agent or a server
+ *   that accepts and never answers would otherwise hang the plan with no line saying why.
+ */
+export declare const BAO_TIMEOUT = "60 seconds";
+/**
+ * Mesh in front of a remote OpenBao drops connections under Alchemy's unbounded
+ * fan-out. Status 0 is transport, not an OpenBao 4xx — retry twice. Measured
+ * 2026-09-16 against bao.example.internal: a 585-role plan died mid-diff with
+ * `no response: (no errors given)` while the vault stayed unsealed.
+ */
+export declare const retryTransport: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+/**
+ * ⛔ EFFECT RECORDS EVERY REQUEST HEADER ON THE CLIENT SPAN and redacts only the names in
+ *   `Headers.CurrentRedactedNames` — by default authorization, cookie, set-cookie and x-api-key
+ *   (effect Headers.ts:753-762; HttpClient.ts:842-849, with `TracerHeaderFilter` defaulting to
+ *   true). `X-Vault-Token` is not on that list, so under any tracer the token would be exported as
+ *   a span attribute. It is added for every call made here.
+ */
+export declare const redactingToken: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, Exclude<R, never>>;
+/**
+ * Route the exchange over a unix socket when the address is one.
+ *
+ * ★ BUN's `fetch` TAKES A `unix` OPTION (bun-types globals.d.ts BunFetchRequestInit.unix), AND
+ *   `FetchHttpClient.RequestInit` IS EFFECT'S DOCUMENTED WAY TO PASS FETCH OPTIONS. The fetch client
+ *   spreads that service into every call (effect FetchHttpClient.ts:59-72), reading it from the
+ *   CALLING fiber's context — and `layerMergedContext` merges the caller's context over the layer's
+ *   (HttpClient.ts:2065-2076), so providing it around one call routes that call alone. Any defaults
+ *   already provided are kept.
+ * ⛔ IT ONLY WORKS ON BUN, SO ANYWHERE ELSE IT REFUSES. Node's fetch ignores `unix` and would send
+ *   the request to http://localhost:80 — a silent wrong server, which is the one outcome this
+ *   package exists to prevent. It also assumes the provided `HttpClient` is the fetch one.
+ */
+export declare const overSocket: (socket: string | undefined, method: string, path: string) => <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | BaoError, R>;
 /** One exchange, classified. The body is the parsed JSON object, or undefined for absent / 204. */
 export declare const baoCall: (intent: BaoIntent, method: 'DELETE' | 'GET' | 'POST' | 'PUT', path: string, body?: Readonly<Record<string, unknown>>) => Effect.Effect<Record<string, unknown> | undefined, BaoError, HttpClient.HttpClient>;
 /**

package/dist/openbao/bao-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bao-http.d.ts","sourceRoot":"","sources":["../../src/openbao/bao-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAU,MAAM,iBAAiB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,MAAM,iEAEjB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,aAAa,IAAI,CAAC;AAE/B,eAAO,MAAM,OAAO,wCAElB,CAAC;AAiEH,mGAAmG;AACnG,eAAO,MAAM,OAAO,WACV,SAAS,UACT,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,QACnC,MAAM,SACL,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,wFAoCtC,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SAAU,MAAM,wFAOhC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,WACX,MAAM,GAAG,KAAK,QAChB,MAAM,QACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,yDACe,CAAC;AAEzD,kGAAkG;AAClG,eAAO,MAAM,SAAS,SAAU,MAAM,yDAAqD,CAAC"}
+{"version":3,"file":"bao-http.d.ts","sourceRoot":"","sources":["../../src/openbao/bao-http.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAU,MAAM,iBAAiB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,MAAM,iEAEjB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,aAAa,IAAI,CAAC;AAE/B,eAAO,MAAM,OAAO,wCAElB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,WAAW,eAAe,CAAC;AAExC;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,2BAMlE,CAAC;AAEL;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,2CAOlE,CAAC;AAEL;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,WACZ,MAAM,GAAG,SAAS,UAAU,MAAM,QAAQ,MAAM,MACxD,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,CAW1E,CAAC;AAEJ,mGAAmG;AACnG,eAAO,MAAM,OAAO,WACV,SAAS,UACT,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,QACnC,MAAM,SACL,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,wFAoCtC,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SAAU,MAAM,wFAOhC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,WACX,MAAM,GAAG,KAAK,QAChB,MAAM,QACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,yDACe,CAAC;AAEzD,kGAAkG;AAClG,eAAO,MAAM,SAAS,SAAU,MAAM,yDAAqD,CAAC"}

package/dist/openbao/distilled.d.ts

@@ -0,0 +1,25 @@
+import type { OpenBaoOpContext } from '@distilled.cloud/openbao/Protocol';
+import type * as Cause from 'effect/Cause';
+import type * as Duration from 'effect/Duration';
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { BaoError } from './bao-status.ts';
+export declare const runBao: <A, E>(operation: Effect.Effect<A, E, OpenBaoOpContext>, timeout?: Duration.Input) => Effect.Effect<A, E | BaoError | Cause.TimeoutError, HttpClient.HttpClient>;
+/**
+ * Reads use the existing two transport retries (750 ms between attempts). Each attempt
+ * reacquires the shared permit and its own bounded timeout. Typed SDK status and decoding
+ * failures still propagate immediately; a read is always safe to replay because it never
+ * changes vault state.
+ */
+export declare const runBaoRead: <A, E>(operation: Effect.Effect<A, E, OpenBaoOpContext>, timeout?: Duration.Input) => Effect.Effect<A, E | BaoError | Cause.TimeoutError, HttpClient.HttpClient>;
+/**
+ * The pre-PR `baoCall()` retried every call, writes included; that bound was lost when the
+ * distilled SDK path landed with `Retry.none` on `runBao`. Restore it for the writes where
+ * replaying is safe: a FULL-REPLACE, idempotent write (an OpenBao policy PUT, an AppRole
+ * write) sends the complete desired state every time, so retrying an uncertain transport
+ * failure converges on the same result rather than compounding a partial change. A create
+ * that mints a new identifier, or any operation whose second attempt could do something the
+ * first did not, must keep calling `runBao` directly and make one attempt.
+ */
+export declare const runBaoWrite: <A, E>(operation: Effect.Effect<A, E, OpenBaoOpContext>, timeout?: Duration.Input) => Effect.Effect<A, E | BaoError | Cause.TimeoutError, HttpClient.HttpClient>;
+//# sourceMappingURL=distilled.d.ts.map

package/dist/openbao/distilled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distilled.d.ts","sourceRoot":"","sources":["../../src/openbao/distilled.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAWnE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,CAAC,aACd,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,YACvC,QAAQ,CAAC,KAAK,KACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,UAAU,CA4BxE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,aAClB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,YACvC,QAAQ,CAAC,KAAK,KACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,UAAU,CAChC,CAAC;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAAE,CAAC,aACnB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,YACvC,QAAQ,CAAC,KAAK,KACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,UAAU,CAChC,CAAC"}

package/dist/openbao/fake-engines-roles.d.ts

@@ -9,7 +9,11 @@
  */
 import type { Reply, Seen } from './fake-bao.ts';
 import { type Store } from './fake-engines.ts';
-/** Every role engine, JWT auth config and MFA login enforcement. A write replaces the object. */
+/**
+ * Every role engine, JWT auth config and MFA login enforcement.
+ * ★ AppRole preserves omitted knobs and supplies defaults on create (OpenBao 2.6.2
+ * path_role.go:1688-1721); this fixture must not turn a correct omitted SDK field into drift.
+ */
 export declare const wireRoles: () => Store;
 /**
  * `sys/plugins/catalog/<type>/<name>`. A register names its version in the body; a read or a delete

package/dist/openbao/fake-engines-roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-engines-roles.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-engines-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAU,KAAK,KAAK,EAAmC,MAAM,mBAAmB,CAAC;AAwCxF,iGAAiG;AACjG,eAAO,MAAM,SAAS,QAAO,KAI1B,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,aAAa,QAAO,KAO9B,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,KAuB9B,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,UAAU,gBAIC,IAAI,KAAG,KAAK;;;;CAMnC,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}
+{"version":3,"file":"fake-engines-roles.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-engines-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAU,KAAK,KAAK,EAAmC,MAAM,mBAAmB,CAAC;AAwCxF;;;;GAIG;AACH,eAAO,MAAM,SAAS,QAAO,KAO1B,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,aAAa,QAAO,KAO9B,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,KAuB9B,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,UAAU,gBAIC,IAAI,KAAG,KAAK;;;;CAMnC,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}