@homeflare/alchemy 0.4.0 → 0.5.0

package/README.md

@@ -64,6 +64,63 @@ from `rules` is a rule deleted. That is the same shape as the Cloudflare API its
 ⛔ **Deletion is refused by design.** Removing a lock is removing a retention floor, which
 is the one operation this resource exists to make hard. It retains on destroy.
 
+## OpenBao — `@homeflare/alchemy/openbao`
+
+Vault objects as resources — `BaoMount`, `BaoAuthMethod`, `BaoPolicy`, `BaoAuthRole`,
+`BaoPkiRole`, `BaoSshRole`, `BaoCloudflareRole`, `BaoProxmoxRole`, `BaoPlugin` — plus an AppRole
+login for scripts. Every call resolves `BAO_ADDR` / `BAO_AGENT_ADDR` / `BAO_NAMESPACE` /
+`BAO_TOKEN` (or the `VAULT_*` twins) the way the `bao` CLI does. A stack provides each
+`Bao*Provider()` it uses, plus `FetchHttpClient.layer`.
+
+⛔ **Metadata only.** Alchemy stores props and attributes unencrypted, so no secret, CA key or
+plugin `env` is declarable. Every family defaults to `retain` on destroy.
+
+### appRoleLogin / revokeSelf
+
+```ts
+import { BaoLoginError, appRoleLogin, revokeSelf } from '@homeflare/alchemy/openbao';
+
+const login = await appRoleLogin({ roleId, secretId }); // mount defaults to `approle`
+try {
+  use(login.clientToken, login.accessor, login.policies, login.leaseDurationSeconds);
+} finally {
+  await revokeSelf(login.clientToken);
+}
+```
+
+- ⛔ The login never sends `BAO_TOKEN`, and a `BaoLoginError` never contains the credential.
+  OpenBao can echo a secret_id back in an error, so every error string is redacted.
+- ⚠️ `clientToken` is a getter over a private field: `console.log(login)` prints `[Getter]` at
+  most (Bun) or nothing (Node), and JSON, a spread and `structuredClone` carry no token.
+- ⚠️ A value with leading or trailing whitespace is refused, not trimmed. `Bun.file().text()`
+  keeps a file's trailing newline.
+- `reason` is `input`, `refused`, `unreachable` or `response`. Pass `env` to use something other
+  than `process.env`. `appRoleLoginEffect` / `revokeSelfEffect` are the same calls as Effects.
+
+### BaoPlugin
+
+```ts
+import { BaoPlugin } from '@homeflare/alchemy/openbao';
+import * as Effect from 'effect/Effect';
+
+export const plugins = Effect.gen(function* () {
+  yield* BaoPlugin('plugin-example', {
+    name: 'openbao-plugin-secrets-example',
+    type: 'secret', // 'secret' | 'auth' | 'database'
+    command: 'openbao-plugin-secrets-example', // a bare file name in plugin_directory
+    sha256: '<hex sha256 of that file>',
+    version: 'v0.1.2', // canonical semver
+  });
+});
+```
+
+- ⛔ It registers a binary that is already in `plugin_directory`. It does not copy the binary.
+- ⚠️ **If the binary reports its own version, declare exactly that one.** OpenBao refuses any
+  other ("plugin version mismatch"), and files an unversioned registration under the reported
+  one, so reconcile then refuses because the read-back finds nothing.
+- ⚠️ A new `sha256` does not restart running mounts. Reload with `sys/plugins/reload/backend`.
+- The deploying token needs `sudo` on `sys/plugins/catalog/*`.
+
 ## Credentials
 
 `CLOUDFLARE_API_TOKEN` is read from the environment at call time, never at module scope.

package/dist/openbao/approle-login-form.d.ts

@@ -0,0 +1,72 @@
+/** Why a login or a revoke failed. */
+export type BaoLoginFailure = 
+/** Refused before any request was sent: an empty or padded value, or a mount that is not a path. */
+'input'
+/** OpenBao (or something at BAO_ADDR) answered with a non-2xx status. */
+ | 'refused'
+/** No answer at all — transport, timeout, or an address nothing listens on. */
+ | 'unreachable'
+/** A 2xx that is not a usable answer: not JSON, no auth block, or MFA still required. */
+ | 'response';
+/**
+ * The failure a transport-level BaoError stands for.
+ *
+ * ⚠️ A 2xx CAN FAIL TOO, AND IT IS NOT A REFUSAL. bao-status.ts settle fails a success whose body is
+ *   not a JSON object — the shape of a BAO_ADDR that points at some other web server. The first
+ *   version mapped every non-zero status to `refused`, so that read as `refused 200`: a server that
+ *   said yes, reported as one that said no.
+ */
+export declare const failureOf: (status: number) => BaoLoginFailure;
+/**
+ * A failed login or revoke.
+ *
+ * ⛔ IT NEVER CARRIES A CREDENTIAL. It is built from the operation name, a status and a list of
+ *   strings that have been through `redact` — never from the request, a header, or a `cause`, for
+ *   the reason bao-status.ts gives for BaoError.
+ */
+export declare class BaoLoginError extends Error {
+    readonly reason: BaoLoginFailure;
+    /** The HTTP status, or 0 when none applies (input, unreachable, an unusable auth block). */
+    readonly status: number;
+    readonly errors: readonly string[];
+    constructor(reason: BaoLoginFailure, 
+    /** The HTTP status, or 0 when none applies (input, unreachable, an unusable auth block). */
+    status: number, errors: readonly string[], operation: string);
+}
+/**
+ * Why a value cannot be sent, or undefined when it can.
+ *
+ * ⚠️ PADDING IS REFUSED, NOT TRIMMED. `await Bun.file(path).text()` keeps a secret_id file's trailing
+ *   newline, and OpenBao answers that with "invalid role or secret ID" — the same words it uses for
+ *   a revoked or expired credential, so the real cause is invisible from the error. Trimming quietly
+ *   would send a different value from the one the caller holds; refusing names the problem.
+ * ⚠️ `unknown`, NOT `string`: a plain script passes `process.env.X`, which is `undefined` when unset.
+ */
+export declare const refusal: (label: string, value: unknown) => string | undefined;
+/** The auth mount without slashes; `approle` when the caller did not say. */
+export declare const loginMount: (mount: string | undefined) => string;
+/**
+ * Why `mount` cannot name an auth mount, or undefined when it can.
+ *
+ * ⛔ THE MOUNT IS SPLICED INTO A URL, AND THE URL PARSER RESOLVES `..` AND ENDS THE PATH AT `?` OR
+ *   `#`. `new URL('…/v1/auth/../sys/x/login')` is `…/v1/sys/x/login` — the role_id and secret_id
+ *   would be sent to a path the caller never named. Refused rather than escaped, like padding.
+ */
+export declare const mountProblem: (mount: string | undefined) => string | undefined;
+/** `auth/<mount>/login` — what api/auth/approle/approle.go:145 writes. */
+export declare const loginPath: (mount: string | undefined) => string;
+/**
+ * Every string in `errors` with each credential replaced by `[redacted]`.
+ *
+ * ⛔ OPENBAO CAN ECHO THE SECRET_ID BACK, SO THIS IS NOT DEFENCE IN DEPTH — IT IS THE DEFENCE.
+ *   openbao v2.6.2 builtin/credential/approle/path_login.go:291 answers a limited-use secret_id
+ *   whose storage entry vanished between two reads with `invalid secret_id "<the secret_id>"`.
+ *   BaoError keeps OpenBao's `errors` verbatim (that is its job), so every string that leaves the
+ *   login or revoke passes through here first.
+ * ⚠️ THAT ECHO IS `%q`, SO THE RAW VALUE IS NOT ENOUGH. A custom secret_id holding `"` or `\` comes
+ *   back escaped (`\"`, `\\`) and would slip past a raw match; the Go-quoted form is redacted too.
+ * ⚠️ LONGEST FIRST. Were one value a substring of another, redacting the shorter first would break
+ *   the longer one's match and leave the rest of it in the message.
+ */
+export declare const redact: (errors: readonly string[], secrets: readonly string[]) => readonly string[];
+//# sourceMappingURL=approle-login-form.d.ts.map

package/dist/openbao/approle-login-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approle-login-form.d.ts","sourceRoot":"","sources":["../../src/openbao/approle-login-form.ts"],"names":[],"mappings":"AAcA,sCAAsC;AACtC,MAAM,MAAM,eAAe;AACzB,oGAAoG;AAClG,OAAO;AACT,yEAAyE;GACvE,SAAS;AACX,+EAA+E;GAC7E,aAAa;AACf,yFAAyF;GACvF,UAAU,CAAC;AAEf;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,WAAY,MAAM,KAAG,eAC4C,CAAC;AAExF;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAEpC,QAAQ,CAAC,MAAM,EAAE,eAAe;IAChC,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE;IAJpC,YACW,MAAM,EAAE,eAAe;IAChC,4FAA4F;IACnF,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,MAAM,EAAE,EAClC,SAAS,EAAE,MAAM,EAKlB;CACF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,UAAW,MAAM,SAAS,OAAO,KAAG,MAAM,GAAG,SAOhE,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,UAAU,UAAW,MAAM,GAAG,SAAS,KAAG,MAAyC,CAAC;AAEjG;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,UAAW,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAWjE,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,SAAS,UAAW,MAAM,GAAG,SAAS,KAAG,MAA2C,CAAC;AA8BlG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,MAAM,WACT,SAAS,MAAM,EAAE,WAChB,SAAS,MAAM,EAAE,KACzB,SAAS,MAAM,EAOjB,CAAC"}

package/dist/openbao/approle-login-result.d.ts

@@ -0,0 +1,39 @@
+/**
+ * What a successful AppRole login hands back, and how it is read out of a 2xx body. Split from
+ * approle-login-form.ts, which decides what goes IN; this decides what comes OUT and how the token
+ * stays out of every log line that prints the result.
+ *
+ * ★ READ FROM openbao v2.6.2 api/secret.go:304-318 SecretAuth — `client_token`, `accessor`,
+ *   `policies`, `lease_duration` and `mfa_requirement`. (api/*.go cited here diffed identical
+ *   between v2.6.0 and v2.6.2.)
+ */
+/** What a successful login hands back. */
+export interface AppRoleLogin {
+    /**
+     * The token. ⛔ A GETTER OVER A PRIVATE FIELD, NEVER AN OWN PROPERTY — see LoginResult below.
+     * `console.log(login)` prints `clientToken: [Getter]` at most, and `JSON.stringify(login)`,
+     * `{ ...login }` and `structuredClone(login)` carry no token at all. Read it by name.
+     */
+    readonly clientToken: string;
+    /** The token's accessor — safe to log, and what revoke-accessor and audit lines name. */
+    readonly accessor: string;
+    /** Every policy on the token: the role's token_policies plus identity policies. */
+    readonly policies: readonly string[];
+    /** The token TTL in seconds, from the role's `token_ttl`. */
+    readonly leaseDurationSeconds: number;
+}
+/**
+ * The login in a 2xx body, or the reason there is none.
+ *
+ * ⚠️ AN EMPTY `client_token` WITH A `mfa_requirement` IS AN UNFINISHED LOGIN, NOT A BROKEN ONE. The
+ *   auth block carries that field for a login that still owes an MFA step (api/secret.go:317). A
+ *   script cannot complete that step, so it is named rather than reported as a missing field.
+ *   REASONED FROM THE CLIENT TYPE — no MFA-enforced login was run.
+ * ⛔ THE BODY IS NEVER QUOTED. It holds the token on success and is not OpenBao's on a wrong address.
+ */
+export declare const loginOf: (body: Record<string, unknown> | undefined) => {
+    readonly login: AppRoleLogin;
+} | {
+    readonly problem: string;
+};
+//# sourceMappingURL=approle-login-result.d.ts.map

package/dist/openbao/approle-login-result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approle-login-result.d.ts","sourceRoot":"","sources":["../../src/openbao/approle-login-result.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,6DAA6D;IAC7D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAmCD;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,SACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KACxC;IAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAyB/D,CAAC"}

package/dist/openbao/approle-login.d.ts

@@ -0,0 +1,77 @@
+/**
+ * AppRole login and self-revoke for a plain Bun script — the one part of the openbao subpath that is
+ * not a Resource.
+ *
+ * ★ WHY IT LIVES HERE. Wrapper scripts log in with a per-host AppRole and revoke the token on exit.
+ *   Each one hand-rolling a `fetch` is how two of them end up disagreeing about BAO_ADDR versus
+ *   BAO_AGENT_ADDR, or dropping the namespace header. This rides the transport every Bao.* family
+ *   already uses: bao-address.ts resolution (BAO_ADDR, BAO_AGENT_ADDR, BAO_NAMESPACE, the VAULT_*
+ *   twins, unix sockets), bao-http.ts's in-flight gate, timeout, transport retry and token
+ *   redaction on spans, and bao-status.ts's status-first classification of the answer.
+ * ★ ONE IMPLEMENTATION, TWO SHAPES. `appRoleLoginEffect` and `revokeSelfEffect` are the
+ *   implementation; `appRoleLogin` and `revokeSelf` run them on the fetch client for a caller with
+ *   no Effect runtime. Both fail with BaoLoginError and nothing else.
+ *
+ * ⚠️ SHARING A secret_id ACROSS HOSTS THROUGH A CACHING PROXY SHARES THE TOKEN. Two hosts sending
+ *   the same AppRole login through a caching OpenBao Proxy get the SAME cached token back, so two
+ *   hosts become one identity in every audit line (recorded as a trap in the 2026-09-21 vault
+ *   consolidation plan; not re-measured here). Give each host its own secret_id.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoEnvironment } from './bao-address.ts';
+import { BaoLoginError } from './approle-login-form.ts';
+import { type AppRoleLogin } from './approle-login-result.ts';
+export type { BaoLoginFailure } from './approle-login-form.ts';
+export type { AppRoleLogin } from './approle-login-result.ts';
+export { BaoLoginError };
+export interface AppRoleLoginInput {
+    /** The role_id. Not a secret on its own, but half of one — it is redacted from errors too. */
+    readonly roleId: string;
+    /** ⛔ The secret_id. Never logged, never in an error — see `redact`. */
+    readonly secretId: string;
+    /** The AppRole auth mount, e.g. `approle` (the default) — no `.`/`..` segments, `?` or `#`. */
+    readonly mount?: string;
+}
+/**
+ * Log in with a role_id and secret_id, under BaoEnv (process.env unless a caller provides one).
+ *
+ * ⛔ THE LOGIN SENDS NO TOKEN, WHATEVER THE ENVIRONMENT HOLDS. BAO_TOKEN is overridden with a
+ *   PRESENT-BUT-EMPTY value for this one call, which bao-address.ts readBaoVariable treats as
+ *   winning over VAULT_TOKEN, so headersFor omits X-Vault-Token entirely. A script that already
+ *   had an operator token exported must not send it along with a machine login.
+ * ⚠️ A DROPPED TRANSPORT IS RETRIED TWICE (bao-http.ts retryTransport, status 0 only). If the first
+ *   request reached OpenBao and only the answer was lost, the retry is a second login: one extra
+ *   token that lives until its TTL, and — for a secret_id with `secret_id_num_uses` — one extra use.
+ *   A single-use secret_id can therefore come back "invalid" on a flaky path.
+ * ★ `PUT`, THE METHOD api/logical.go:325 WriteWithContext SENDS, which is what the official Go helper
+ *   calls (api/auth/approle/approle.go:146). The docs show POST; both are the update operation.
+ */
+export declare const appRoleLoginEffect: (input: AppRoleLoginInput) => Effect.Effect<AppRoleLogin, BaoLoginError, HttpClient.HttpClient>;
+/**
+ * Revoke `token` itself — what a wrapper runs on exit, so a login does not outlive its job.
+ *
+ * ★ `PUT auth/token/revoke-self`, READ FROM openbao v2.6.2 api/auth_token.go:318-330: the token
+ *   revoked is the one in X-Vault-Token, and the body is empty. `token` rides in that header for
+ *   this call only (BAO_TOKEN is overridden), whatever the environment holds.
+ * ⚠️ AN ALREADY-REVOKED OR EXPIRED TOKEN IS A FAILURE, NOT A NO-OP. OpenBao refuses a token it no
+ *   longer knows (permission denied — not measured here), and a refusal from the wrong server looks
+ *   the same; "I could not tell" stays an error. A wrapper that only wants best-effort cleanup on
+ *   exit can catch BaoLoginError with reason `refused`.
+ * ⚠️ NEVER THROUGH AN AGENT OR PROXY IN `use_auto_auth_token = "force"` MODE. Force overwrites the
+ *   request's token with the agent's own (bao-address.ts headersFor cites apiproxy.mdx), so this
+ *   would revoke the AGENT's token. The estate's LAN proxy runs with no auto-auth at all.
+ */
+export declare const revokeSelfEffect: (token: string) => Effect.Effect<void, BaoLoginError, HttpClient.HttpClient>;
+/**
+ * `appRoleLoginEffect` for a plain script. `env` defaults to `process.env`, read at call time.
+ *
+ *     const login = await appRoleLogin({ roleId, secretId });
+ *     try { … login.clientToken … } finally { await revokeSelf(login.clientToken); }
+ */
+export declare const appRoleLogin: (input: AppRoleLoginInput & {
+    readonly env?: BaoEnvironment;
+}) => Promise<AppRoleLogin>;
+/** `revokeSelfEffect` for a plain script. `env` defaults to `process.env`, read at call time. */
+export declare const revokeSelf: (token: string, env?: BaoEnvironment) => Promise<void>;
+//# sourceMappingURL=approle-login.d.ts.map

package/dist/openbao/approle-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approle-login.d.ts","sourceRoot":"","sources":["../../src/openbao/approle-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EACL,aAAa,EAMd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,YAAY,EAAW,MAAM,2BAA2B,CAAC;AAEvE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,MAAM,WAAW,iBAAiB;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAeD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,UACtB,iBAAiB,KACvB,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAsB/D,CAAC;AAEL;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,UACpB,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAWvD,CAAC;AAeL;;;;;GAKG;AACH,eAAO,MAAM,YAAY,UAChB,iBAAiB,GAAG;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,cAAc,CAAA;CAAE,KAC3D,OAAO,CAAC,YAAY,CAAkD,CAAC;AAE1E,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAW,MAAM,QAAQ,cAAc,KAAG,OAAO,CAAC,IAAI,CACtC,CAAC"}

package/dist/openbao/bao-http.d.ts

@@ -64,6 +64,8 @@ export declare const baoRead: (path: string) => Effect.Effect<Record<string, unk
  * ⚠️ ROLE BODIES STAY ALL-STRING ON PURPOSE. `bao write k=v` put every value in the JSON body as a
  *   string — MEASURED with `-output-curl-string`, see ssh-role-form.ts — and the form files still
  *   build exactly that body, so the server parses the same request it was always sent.
+ *   ⛔ EXCEPT A MAP FIELD: sdk v2.6.2 refuses a string for a TypeMap with a 400, so Bao.SshRole
+ *   sends its two maps as objects (the ⛔ on mapValue in ssh-role-form.ts, measured 2026-09-21).
  */
 export declare const baoWrite: (method: 'POST' | 'PUT', path: string, body: Readonly<Record<string, unknown>>) => Effect.Effect<void, BaoError, HttpClient.HttpClient>;
 /** A delete: idempotent — already gone (404) is success — and refused (403, 5xx) is a failure. */

package/dist/openbao/bao-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bao-http.d.ts","sourceRoot":"","sources":["../../src/openbao/bao-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAU,MAAM,iBAAiB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,MAAM,iEAEjB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,aAAa,IAAI,CAAC;AAE/B,eAAO,MAAM,OAAO,wCAElB,CAAC;AAiEH,mGAAmG;AACnG,eAAO,MAAM,OAAO,WACV,SAAS,UACT,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,QACnC,MAAM,SACL,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,wFAoCtC,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SAAU,MAAM,wFAOhC,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,WACX,MAAM,GAAG,KAAK,QAChB,MAAM,QACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,yDACe,CAAC;AAEzD,kGAAkG;AAClG,eAAO,MAAM,SAAS,SAAU,MAAM,yDAAqD,CAAC"}
+{"version":3,"file":"bao-http.d.ts","sourceRoot":"","sources":["../../src/openbao/bao-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAU,MAAM,iBAAiB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,MAAM,iEAEjB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,aAAa,IAAI,CAAC;AAE/B,eAAO,MAAM,OAAO,wCAElB,CAAC;AAiEH,mGAAmG;AACnG,eAAO,MAAM,OAAO,WACV,SAAS,UACT,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,QACnC,MAAM,SACL,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,wFAoCtC,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SAAU,MAAM,wFAOhC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,WACX,MAAM,GAAG,KAAK,QAChB,MAAM,QACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,yDACe,CAAC;AAEzD,kGAAkG;AAClG,eAAO,MAAM,SAAS,SAAU,MAAM,yDAAqD,CAAC"}

package/dist/openbao/index.d.ts

@@ -7,7 +7,12 @@
  *   every helper as API and make the next refactor a breaking change.
  * ★ Anything unlisted is still reachable by path if you genuinely need it — that is a
  *   deliberate, visible act rather than an accident of barrelling.
+ * ★ THE APPROLE LOGIN IS HERE FOR SCRIPTS, NOT STACKS (approle-login.ts). A wrapper that logs in
+ *   and revokes on exit needs it, and giving it the families' own transport is what keeps a script
+ *   and a stack from disagreeing about which server BAO_ADDR means.
  */
+export type { AppRoleLogin, AppRoleLoginInput, BaoLoginFailure } from './approle-login.ts';
+export { BaoLoginError, appRoleLogin, appRoleLoginEffect, revokeSelf, revokeSelfEffect, } from './approle-login.ts';
 export { BaoAuthMethod, BaoAuthMethodProvider } from './auth-method.ts';
 export { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
 export { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';
@@ -18,6 +23,8 @@ export type { RolesConfig, SurfaceSpec } from './cloudflare-roles-config.ts';
 export { parseRolesConfig } from './cloudflare-roles-config.ts';
 export { BaoMount, BaoMountProvider } from './mount.ts';
 export { BaoPkiRole, BaoPkiRoleProvider } from './pki-role.ts';
+export type { BaoPluginProps, BaoPluginType } from './plugin.ts';
+export { BaoPlugin, BaoPluginProvider } from './plugin.ts';
 export { BaoPolicy, BaoPolicyProvider } from './policy.ts';
 export { BaoProxmoxRole, BaoProxmoxRoleProvider } from './proxmox-role.ts';
 export { BaoSshRole, BaoSshRoleProvider } from './ssh-role.ts';

package/dist/openbao/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/openbao/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACnF,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/openbao/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EACL,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACnF,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/D,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}