@homeflare/alchemy 0.4.0 → 0.5.0

package/dist/openbao/index.js

@@ -1,8 +1,301 @@
+// src/openbao/approle-login.ts
+import * as Effect2 from "effect/Effect";
+import * as FetchHttpClient2 from "effect/unstable/http/FetchHttpClient";
+
+// src/openbao/bao-http.ts
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schedule from "effect/Schedule";
+import * as Semaphore from "effect/Semaphore";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Headers from "effect/unstable/http/Headers";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+
+// src/openbao/bao-address.ts
+var DEFAULT_ADDRESS = "https://127.0.0.1:8200";
+var UNIX = "unix://";
+var readBaoVariable = (env, name) => env[name] ?? env[`VAULT_${name.slice("BAO_".length)}`] ?? "";
+var resolveAddress = (env) => {
+  const agent = readBaoVariable(env, "BAO_AGENT_ADDR");
+  const direct = readBaoVariable(env, "BAO_ADDR");
+  const raw = agent !== "" ? agent : direct !== "" ? direct : DEFAULT_ADDRESS;
+  const namespace = readBaoVariable(env, "BAO_NAMESPACE");
+  const socket = raw.startsWith(UNIX) ? raw.slice(UNIX.length) : undefined;
+  return {
+    base: socket === undefined ? raw.replace(/\/+$/, "") : "http://localhost",
+    namespace: namespace === "" ? undefined : namespace,
+    socket
+  };
+};
+var headersFor = (address, env) => {
+  const headers = { "X-Vault-Request": "true" };
+  if (address.namespace !== undefined)
+    headers["X-Vault-Namespace"] = address.namespace;
+  const token = readBaoVariable(env, "BAO_TOKEN");
+  if (token !== "")
+    headers["X-Vault-Token"] = token;
+  return headers;
+};
+
+// src/openbao/bao-status.ts
+class BaoError extends Error {
+  status;
+  method;
+  path;
+  errors;
+  constructor(status, method, path, errors) {
+    const code = status === 0 ? "no response" : String(status);
+    super(`OpenBao ${method} /v1/${path} -> ${code}: ${errors.join("; ") || "(no errors given)"}`);
+    this.status = status;
+    this.method = method;
+    this.path = path;
+    this.errors = errors;
+    this.name = "BaoError";
+  }
+}
+var objectOf = (text) => {
+  try {
+    const parsed = JSON.parse(text);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : undefined;
+  } catch {
+    return;
+  }
+};
+var errorsOf = (text) => {
+  const raw = objectOf(text)?.["errors"];
+  return Array.isArray(raw) && raw.every((entry) => typeof entry === "string") ? raw : undefined;
+};
+var settle = (intent, method, path, status, text) => {
+  const fail = (errors) => ({
+    error: new BaoError(status, method, path, errors)
+  });
+  if (status < 200 || status >= 300) {
+    const errors = errorsOf(text);
+    if (errors === undefined) {
+      return fail([`not an OpenBao error body (${String(text.length)} bytes)`]);
+    }
+    if (status === 404 && intent !== "write")
+      return { body: undefined };
+    return fail(errors);
+  }
+  if (text.trim() === "") {
+    return intent === "read" ? fail(["a successful read with an empty body"]) : { body: undefined };
+  }
+  const body = objectOf(text);
+  return body === undefined ? fail(["a success body that is not a JSON object"]) : { body };
+};
+
+// src/openbao/bao-http.ts
+var BaoEnv = Context.Reference("homeflare/openbao/BaoEnv", {
+  defaultValue: () => process.env
+});
+var MAX_IN_FLIGHT = 8;
+var BaoGate = Context.Reference("homeflare/openbao/BaoGate", {
+  defaultValue: () => Semaphore.makeUnsafe(MAX_IN_FLIGHT)
+});
+var TIMEOUT = "60 seconds";
+var retryTransport = (effect) => Effect.retry(effect, {
+  schedule: Schedule.spaced("750 millis"),
+  times: 2,
+  while: (error) => error.status === 0
+});
+var redactingToken = (effect) => Effect.gen(function* () {
+  const names = yield* Headers.CurrentRedactedNames;
+  return yield* Effect.provideService(effect, Headers.CurrentRedactedNames, [
+    ...names,
+    "x-vault-token"
+  ]);
+});
+var overSocket = (socket, method, path) => (effect) => {
+  if (socket === undefined)
+    return effect;
+  if (typeof Bun === "undefined") {
+    return Effect.fail(new BaoError(0, method, path, ["a unix:// address needs Bun fetch; this is not Bun"]));
+  }
+  return Effect.flatMap(Effect.serviceOption(FetchHttpClient.RequestInit), (defaults) => {
+    const init = { ...Option.getOrElse(defaults, () => ({})), unix: socket };
+    return Effect.provideService(effect, FetchHttpClient.RequestInit, init);
+  });
+};
+var baoCall = (intent, method, path, body) => Effect.gen(function* () {
+  const env = yield* BaoEnv;
+  const address = resolveAddress(env);
+  const client = yield* HttpClient.HttpClient;
+  const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(HttpClientRequest.setHeaders(headersFor(address, env)), body === undefined ? (self) => self : HttpClientRequest.bodyText(JSON.stringify(body), "application/json"));
+  const exchange = client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text2) => ({ status: response.status, text: text2 }))), Effect.timeout(TIMEOUT), Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])));
+  const gate = yield* BaoGate;
+  const { status, text } = yield* retryTransport(exchange.pipe(overSocket(address.socket, method, path), redactingToken, Semaphore.withPermits(gate, 1)));
+  const outcome = settle(intent, method, path, status, text);
+  return "error" in outcome ? yield* Effect.fail(outcome.error) : outcome.body;
+});
+var baoRead = (path) => Effect.map(baoCall("read", "GET", path), (body) => {
+  if (body === undefined)
+    return;
+  const data = body["data"];
+  return typeof data === "object" && data !== null ? data : body;
+});
+var baoWrite = (method, path, body) => Effect.asVoid(baoCall("write", method, path, body));
+var baoDelete = (path) => Effect.asVoid(baoCall("delete", "DELETE", path));
+
+// src/openbao/mount-path.ts
+var trimTrailingSlashes = (text) => {
+  let end = text.length;
+  while (end > 0 && text[end - 1] === "/")
+    end -= 1;
+  return text.slice(0, end);
+};
+var trimSlashes = (text) => {
+  let start = 0;
+  while (start < text.length && text[start] === "/")
+    start += 1;
+  return trimTrailingSlashes(text.slice(start));
+};
+var sshMountOf = (mount) => trimTrailingSlashes(mount ?? "ssh");
+
+// src/openbao/approle-login-form.ts
+var failureOf = (status) => status === 0 ? "unreachable" : status >= 200 && status < 300 ? "response" : "refused";
+
+class BaoLoginError extends Error {
+  reason;
+  status;
+  errors;
+  constructor(reason, status, errors, operation) {
+    const code = status === 0 ? reason : `${reason} ${String(status)}`;
+    super(`${operation}: ${code}: ${errors.join("; ") || "(no errors given)"}`);
+    this.reason = reason;
+    this.status = status;
+    this.errors = errors;
+    this.name = "BaoLoginError";
+  }
+}
+var refusal = (label, value) => {
+  if (typeof value !== "string" || value === "")
+    return `${label} is empty`;
+  if (value.trim() === "")
+    return `${label} is only whitespace`;
+  if (value.trim() !== value) {
+    return `${label} has leading or trailing whitespace (a file read keeps its newline; trim it)`;
+  }
+  return;
+};
+var loginMount = (mount) => trimSlashes(mount ?? "approle");
+var mountProblem = (mount) => {
+  const path = loginMount(mount);
+  if (path === "")
+    return "mount is empty";
+  const segments = path.split("/");
+  if (/[\s?#%\\]/.test(path) || segments.some((part) => part === "" || part === "." || part === "..")) {
+    return `mount ${JSON.stringify(path)} is not a plain mount path`;
+  }
+  return;
+};
+var loginPath = (mount) => `auth/${loginMount(mount)}/login`;
+var GO_ESCAPES = {
+  7: "a",
+  8: "b",
+  9: "t",
+  10: "n",
+  11: "v",
+  12: "f",
+  13: "r"
+};
+var goQuoted = (value) => [...value].map((char) => {
+  const code = char.codePointAt(0) ?? 0;
+  const named = GO_ESCAPES[code];
+  if (char === '"' || char === "\\")
+    return `\\${char}`;
+  if (named !== undefined)
+    return `\\${named}`;
+  if (code < 32 || code === 127)
+    return `\\x${code.toString(16).padStart(2, "0")}`;
+  return char;
+}).join("");
+var redact = (errors, secrets) => {
+  const forms = [...new Set(secrets.flatMap((secret) => [secret, goQuoted(secret)]))].filter((form) => form !== "").sort((a, b) => b.length - a.length);
+  return errors.map((entry) => forms.reduce((text, form) => text.split(form).join("[redacted]"), entry));
+};
+
+// src/openbao/approle-login-result.ts
+class LoginResult {
+  #token;
+  accessor;
+  policies;
+  leaseDurationSeconds;
+  constructor(token, accessor, policies, lease) {
+    this.#token = token;
+    this.accessor = accessor;
+    this.policies = Object.freeze([...policies]);
+    this.leaseDurationSeconds = lease;
+    Object.freeze(this);
+  }
+  get clientToken() {
+    return this.#token;
+  }
+}
+var strings = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var loginOf = (body) => {
+  const auth = body?.["auth"];
+  if (typeof auth !== "object" || auth === null || Array.isArray(auth)) {
+    return { problem: "the answer carried no auth block" };
+  }
+  const fields = auth;
+  const token = fields["client_token"];
+  if (typeof token !== "string" || token === "") {
+    const mfa = fields["mfa_requirement"];
+    return {
+      problem: mfa !== undefined && mfa !== null ? "the login requires MFA, which this helper does not complete" : "the auth block carried no client_token"
+    };
+  }
+  const lease = fields["lease_duration"];
+  return {
+    login: new LoginResult(token, typeof fields["accessor"] === "string" ? fields["accessor"] : "", strings(fields["policies"]), typeof lease === "number" && Number.isFinite(lease) ? lease : 0)
+  };
+};
+
+// src/openbao/approle-login.ts
+var LOGIN = "OpenBao AppRole login";
+var REVOKE = "OpenBao revoke-self";
+var failed = (operation, secrets) => (error) => new BaoLoginError(failureOf(error.status), error.status, redact(error.errors, secrets), operation);
+var appRoleLoginEffect = (input) => Effect2.gen(function* () {
+  const problems = [
+    refusal("roleId", input.roleId),
+    refusal("secretId", input.secretId),
+    mountProblem(input.mount)
+  ].filter((problem) => problem !== undefined);
+  if (problems.length > 0)
+    return yield* Effect2.fail(new BaoLoginError("input", 0, problems, LOGIN));
+  const env = yield* BaoEnv;
+  const body = yield* baoCall("write", "PUT", loginPath(input.mount), {
+    role_id: input.roleId,
+    secret_id: input.secretId
+  }).pipe(Effect2.provideService(BaoEnv, { ...env, BAO_TOKEN: "" }), Effect2.mapError(failed(LOGIN, [input.roleId, input.secretId])));
+  const read = loginOf(body);
+  if ("problem" in read) {
+    return yield* Effect2.fail(new BaoLoginError("response", 0, [read.problem], LOGIN));
+  }
+  return read.login;
+});
+var revokeSelfEffect = (token) => Effect2.gen(function* () {
+  const problem = refusal("token", token);
+  if (problem !== undefined) {
+    return yield* Effect2.fail(new BaoLoginError("input", 0, [problem], REVOKE));
+  }
+  const env = yield* BaoEnv;
+  yield* baoCall("write", "PUT", "auth/token/revoke-self").pipe(Effect2.provideService(BaoEnv, { ...env, BAO_TOKEN: token }), Effect2.mapError(failed(REVOKE, [token])));
+});
+var runWith = (env, effect) => {
+  const scoped = env === undefined ? effect : Effect2.provideService(effect, BaoEnv, env);
+  return Effect2.runPromise(scoped.pipe(Effect2.provide(FetchHttpClient2.layer)));
+};
+var appRoleLogin = (input) => runWith(input.env, appRoleLoginEffect(input));
+var revokeSelf = (token, env) => runWith(env, revokeSelfEffect(token));
 // src/openbao/auth-method.ts
 import { Resource } from "alchemy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
-import * as Effect3 from "effect/Effect";
+import * as Effect4 from "effect/Effect";
 
 // src/openbao/digest.ts
 var canonical = (text) => text.trimEnd();
@@ -143,151 +436,12 @@ var matches2 = (attributes, props) => attributes.type === props.type && (props.d
 var wantsTune2 = (props) => props.description !== undefined || props.defaultLeaseTtl !== undefined || props.maxLeaseTtl !== undefined;
 
 // src/openbao/auth-method-wire.ts
-import * as Effect2 from "effect/Effect";
-
-// src/openbao/bao-http.ts
-import * as Context from "effect/Context";
-import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
-import * as Schedule from "effect/Schedule";
-import * as Semaphore from "effect/Semaphore";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Headers from "effect/unstable/http/Headers";
-import * as HttpClient from "effect/unstable/http/HttpClient";
-import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
-
-// src/openbao/bao-address.ts
-var DEFAULT_ADDRESS = "https://127.0.0.1:8200";
-var UNIX = "unix://";
-var readBaoVariable = (env, name) => env[name] ?? env[`VAULT_${name.slice("BAO_".length)}`] ?? "";
-var resolveAddress = (env) => {
-  const agent = readBaoVariable(env, "BAO_AGENT_ADDR");
-  const direct = readBaoVariable(env, "BAO_ADDR");
-  const raw = agent !== "" ? agent : direct !== "" ? direct : DEFAULT_ADDRESS;
-  const namespace = readBaoVariable(env, "BAO_NAMESPACE");
-  const socket = raw.startsWith(UNIX) ? raw.slice(UNIX.length) : undefined;
-  return {
-    base: socket === undefined ? raw.replace(/\/+$/, "") : "http://localhost",
-    namespace: namespace === "" ? undefined : namespace,
-    socket
-  };
-};
-var headersFor = (address, env) => {
-  const headers = { "X-Vault-Request": "true" };
-  if (address.namespace !== undefined)
-    headers["X-Vault-Namespace"] = address.namespace;
-  const token = readBaoVariable(env, "BAO_TOKEN");
-  if (token !== "")
-    headers["X-Vault-Token"] = token;
-  return headers;
-};
-
-// src/openbao/bao-status.ts
-class BaoError extends Error {
-  status;
-  method;
-  path;
-  errors;
-  constructor(status, method, path, errors) {
-    const code = status === 0 ? "no response" : String(status);
-    super(`OpenBao ${method} /v1/${path} -> ${code}: ${errors.join("; ") || "(no errors given)"}`);
-    this.status = status;
-    this.method = method;
-    this.path = path;
-    this.errors = errors;
-    this.name = "BaoError";
-  }
-}
-var objectOf = (text3) => {
-  try {
-    const parsed = JSON.parse(text3);
-    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : undefined;
-  } catch {
-    return;
-  }
-};
-var errorsOf = (text3) => {
-  const raw = objectOf(text3)?.["errors"];
-  return Array.isArray(raw) && raw.every((entry) => typeof entry === "string") ? raw : undefined;
-};
-var settle = (intent, method, path, status, text3) => {
-  const fail = (errors) => ({
-    error: new BaoError(status, method, path, errors)
-  });
-  if (status < 200 || status >= 300) {
-    const errors = errorsOf(text3);
-    if (errors === undefined) {
-      return fail([`not an OpenBao error body (${String(text3.length)} bytes)`]);
-    }
-    if (status === 404 && intent !== "write")
-      return { body: undefined };
-    return fail(errors);
-  }
-  if (text3.trim() === "") {
-    return intent === "read" ? fail(["a successful read with an empty body"]) : { body: undefined };
-  }
-  const body = objectOf(text3);
-  return body === undefined ? fail(["a success body that is not a JSON object"]) : { body };
-};
-
-// src/openbao/bao-http.ts
-var BaoEnv = Context.Reference("homeflare/openbao/BaoEnv", {
-  defaultValue: () => process.env
-});
-var MAX_IN_FLIGHT = 8;
-var BaoGate = Context.Reference("homeflare/openbao/BaoGate", {
-  defaultValue: () => Semaphore.makeUnsafe(MAX_IN_FLIGHT)
-});
-var TIMEOUT = "60 seconds";
-var retryTransport = (effect) => Effect.retry(effect, {
-  schedule: Schedule.spaced("750 millis"),
-  times: 2,
-  while: (error) => error.status === 0
-});
-var redactingToken = (effect) => Effect.gen(function* () {
-  const names = yield* Headers.CurrentRedactedNames;
-  return yield* Effect.provideService(effect, Headers.CurrentRedactedNames, [
-    ...names,
-    "x-vault-token"
-  ]);
-});
-var overSocket = (socket, method, path) => (effect) => {
-  if (socket === undefined)
-    return effect;
-  if (typeof Bun === "undefined") {
-    return Effect.fail(new BaoError(0, method, path, ["a unix:// address needs Bun fetch; this is not Bun"]));
-  }
-  return Effect.flatMap(Effect.serviceOption(FetchHttpClient.RequestInit), (defaults) => {
-    const init = { ...Option.getOrElse(defaults, () => ({})), unix: socket };
-    return Effect.provideService(effect, FetchHttpClient.RequestInit, init);
-  });
-};
-var baoCall = (intent, method, path, body) => Effect.gen(function* () {
-  const env = yield* BaoEnv;
-  const address = resolveAddress(env);
-  const client = yield* HttpClient.HttpClient;
-  const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(HttpClientRequest.setHeaders(headersFor(address, env)), body === undefined ? (self) => self : HttpClientRequest.bodyText(JSON.stringify(body), "application/json"));
-  const exchange = client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text4) => ({ status: response.status, text: text4 }))), Effect.timeout(TIMEOUT), Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])));
-  const gate = yield* BaoGate;
-  const { status, text: text3 } = yield* retryTransport(exchange.pipe(overSocket(address.socket, method, path), redactingToken, Semaphore.withPermits(gate, 1)));
-  const outcome = settle(intent, method, path, status, text3);
-  return "error" in outcome ? yield* Effect.fail(outcome.error) : outcome.body;
-});
-var baoRead = (path) => Effect.map(baoCall("read", "GET", path), (body) => {
-  if (body === undefined)
-    return;
-  const data = body["data"];
-  return typeof data === "object" && data !== null ? data : body;
-});
-var baoWrite = (method, path, body) => Effect.asVoid(baoCall("write", method, path, body));
-var baoDelete = (path) => Effect.asVoid(baoCall("delete", "DELETE", path));
-
-// src/openbao/auth-method-wire.ts
-var absentFromTable = (path, asked) => baoRead("sys/auth").pipe(Effect2.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+import * as Effect3 from "effect/Effect";
+var absentFromTable = (path, asked) => baoRead("sys/auth").pipe(Effect3.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
   ...asked.errors,
   `sys/auth could not confirm the method is absent: ${listing.message}`
-])), Effect2.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${authPath(path)}/`) ? Effect2.succeed(undefined) : Effect2.fail(asked)));
-var readAuthMethodData = (path) => baoRead(readPath2(path)).pipe(Effect2.catchIf((error) => error.status === 400, (error) => absentFromTable(path, error)));
+])), Effect3.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${authPath(path)}/`) ? Effect3.succeed(undefined) : Effect3.fail(asked)));
+var readAuthMethodData = (path) => baoRead(readPath2(path)).pipe(Effect3.catchIf((error) => error.status === 400, (error) => absentFromTable(path, error)));
 var enableAuthMethod = (props) => baoWrite("POST", readPath2(props.path), enableBody2(props));
 var tuneAuthMethod = (props) => baoWrite("POST", tunePath2(props.path), tuneBody2(props));
 var disableAuthMethod = (path) => baoDelete(readPath2(path));
@@ -296,18 +450,18 @@ var disableAuthMethod = (path) => baoDelete(readPath2(path));
 var BaoAuthMethod = Resource("Bao.AuthMethod", {
   defaultRemovalPolicy: "retain"
 });
-var readMethod = (props) => Effect3.gen(function* () {
+var readMethod = (props) => Effect4.gen(function* () {
   const live = yield* readAuthMethodData(props.path);
   if (live === undefined)
     return;
   return attributesOf2(props, live);
 });
-var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect3.succeed(BaoAuthMethod.Provider.of({
-  list: () => Effect3.succeed([]),
-  read: Effect3.fn(function* ({ olds }) {
+var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect4.succeed(BaoAuthMethod.Provider.of({
+  list: () => Effect4.succeed([]),
+  read: Effect4.fn(function* ({ olds }) {
     return yield* readMethod(olds);
   }),
-  diff: Effect3.fn(function* ({ news, output }) {
+  diff: Effect4.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved(news))
       return;
     const live = yield* readMethod(news);
@@ -319,7 +473,7 @@ var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect3.succeed
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect3.fn(function* ({ news }) {
+  reconcile: Effect4.fn(function* ({ news }) {
     let live = yield* readMethod(news);
     if (live === undefined) {
       yield* enableAuthMethod(news);
@@ -327,17 +481,17 @@ var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect3.succeed
         yield* tuneAuthMethod(news);
     } else if (!matches2(live, news)) {
       if (live.type !== news.type) {
-        return yield* Effect3.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Auth method type is immutable — replace manually."));
+        return yield* Effect4.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Auth method type is immutable — replace manually."));
       }
       yield* tuneAuthMethod(news);
     }
     live = yield* readMethod(news);
     if (live === undefined) {
-      return yield* Effect3.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: write returned no error but the method is still absent.`));
+      return yield* Effect4.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: write returned no error but the method is still absent.`));
     }
     return live;
   }),
-  delete: Effect3.fn(function* ({ output }) {
+  delete: Effect4.fn(function* ({ output }) {
     yield* disableAuthMethod(output.path);
     return;
   })
@@ -346,7 +500,7 @@ var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect3.succeed
 import { Resource as Resource2 } from "alchemy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect4 from "effect/Effect";
+import * as Effect5 from "effect/Effect";
 
 // src/openbao/auth-role-form.ts
 var policiesOf = (live) => {
@@ -410,18 +564,18 @@ var matches3 = (attributes, props) => {
 var BaoAuthRole = Resource2("Bao.AuthRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole = (props) => Effect4.gen(function* () {
+var readRole = (props) => Effect5.gen(function* () {
   const live = yield* baoRead(readPath3(props.name));
   if (live === undefined)
     return;
   return attributesOf3(props, live);
 });
-var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect4.succeed(BaoAuthRole.Provider.of({
-  list: () => Effect4.succeed([]),
-  read: Effect4.fn(function* ({ olds }) {
+var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect5.succeed(BaoAuthRole.Provider.of({
+  list: () => Effect5.succeed([]),
+  read: Effect5.fn(function* ({ olds }) {
     return yield* readRole(olds);
   }),
-  diff: Effect4.fn(function* ({ news, output }) {
+  diff: Effect5.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved2(news))
       return;
     const live = yield* readRole(news);
@@ -431,18 +585,18 @@ var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect4.succeed(Ba
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect4.fn(function* ({ news }) {
+  reconcile: Effect5.fn(function* ({ news }) {
     const live = yield* readRole(news);
     if (live === undefined || !matches3(live, news)) {
       yield* baoWrite("PUT", readPath3(news.name), writeBody(news));
     }
     const after = yield* readRole(news);
     if (after === undefined) {
-      return yield* Effect4.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
+      return yield* Effect5.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
     }
     return after;
   }),
-  delete: Effect4.fn(function* ({ output }) {
+  delete: Effect5.fn(function* ({ output }) {
     yield* baoDelete(readPath3(output.name));
     return;
   })
@@ -451,7 +605,7 @@ var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect4.succeed(Ba
 import { Resource as Resource3 } from "alchemy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 import * as Provider3 from "alchemy/Provider";
-import * as Effect7 from "effect/Effect";
+import * as Effect8 from "effect/Effect";
 
 // src/openbao/cloudflare-group-scope.ts
 var zoneResource = (zoneId) => `com.cloudflare.api.account.zone.${zoneId}`;
@@ -471,7 +625,7 @@ var groupKey = (name, scope) => `${scope} ${name}`;
 
 // src/openbao/cloudflare-permission-groups.ts
 import * as Context2 from "effect/Context";
-import * as Effect6 from "effect/Effect";
+import * as Effect7 from "effect/Effect";
 
 // src/openbao/cloudflare-permission-groups-solve.ts
 var observationsOf = (declared, live) => declared.flatMap((role) => {
@@ -641,7 +795,7 @@ var samePolicies2 = (want, have) => want.length === have.length && want.every((w
 });
 
 // src/openbao/cloudflare-role-wire.ts
-import * as Effect5 from "effect/Effect";
+import * as Effect6 from "effect/Effect";
 
 // src/openbao/cloudflare-role-form.ts
 var rolePath = (mount, name) => `${mountPath(mount)}/roles/${name}`;
@@ -706,7 +860,7 @@ var differences = (props, policies, live) => {
 };
 
 // src/openbao/cloudflare-role-wire.ts
-var readCloudflareRole = (mount, name) => Effect5.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
+var readCloudflareRole = (mount, name) => Effect6.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
 var writeCloudflareRole = (mount, name, body) => baoWrite("PUT", rolePath(mount, name), body);
 var deleteCloudflareRole = (mount, name) => baoDelete(rolePath(mount, name));
 
@@ -728,9 +882,9 @@ var pick = (mount, groups, refs, hint) => {
   const unknown = refs.filter((ref) => !groups.has(groupKey(ref.name, ref.scope)));
   if (unknown.length > 0) {
     const problems = unknown.map((ref) => `unknown group ${JSON.stringify(ref.name)} at scope ${ref.scope} — ${hint}`);
-    return Effect6.fail(new CloudflareGroupsError(mount, problems));
+    return Effect7.fail(new CloudflareGroupsError(mount, problems));
   }
-  return Effect6.succeed(new Map(refs.flatMap((ref) => {
+  return Effect7.succeed(new Map(refs.flatMap((ref) => {
     const key = groupKey(ref.name, ref.scope);
     const id = groups.get(key);
     return id === undefined ? [] : [[key, id]];
@@ -738,15 +892,15 @@ var pick = (mount, groups, refs, hint) => {
 };
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var deniedHint = (mount) => `GET ${mountPath(mount)}/permission-groups answered 403 — this token's policy carries no ` + `\`path "${mountPath(mount)}/permission-groups" { capabilities = ["read"] }\` grant. ` + "It is declared in ../platform/secrets/vault/policies/homeflare-admin/" + "20-cloudflare-permission-groups.hcl and applies with `alchemy deploy` of this stack";
-var deniedNamed = (mount, read) => Effect6.catchIf(read, (error) => error.status === 403, () => Effect6.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
-var engineGroups = (mount) => Effect6.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
+var deniedNamed = (mount, read) => Effect7.catchIf(read, (error) => error.status === 403, () => Effect7.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
+var engineGroups = (mount) => Effect7.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
   const list = data?.["permission_groups"];
   if (data === undefined) {
     const why = "GET <mount>/permission-groups answered 404 — the endpoint is not deployed here";
-    return Effect6.fail(new CloudflareGroupsError(mount, [why]));
+    return Effect7.fail(new CloudflareGroupsError(mount, [why]));
   }
   if (!Array.isArray(list)) {
-    return Effect6.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
+    return Effect7.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
   }
   const scoped = new Map;
   const idsOf = new Map;
@@ -773,24 +927,24 @@ var engineGroups = (mount) => Effect6.flatMap(deniedNamed(mount, baoRead(`${moun
     const only = [...ids];
     return ids.size === 1 && only[0] !== undefined ? [[name, only[0]]] : [];
   }));
-  return problems.length > 0 ? Effect6.fail(new CloudflareGroupsError(mount, problems)) : Effect6.succeed(new Map([...atEveryScope(sole), ...scoped]));
+  return problems.length > 0 ? Effect7.fail(new CloudflareGroupsError(mount, problems)) : Effect7.succeed(new Map([...atEveryScope(sole), ...scoped]));
 });
-var permissionGroupsFromEngine = () => Effect6.sync(() => {
+var permissionGroupsFromEngine = () => Effect7.sync(() => {
   const cache = new Map;
-  const cachedFor = (mount) => Effect6.suspend(() => {
+  const cachedFor = (mount) => Effect7.suspend(() => {
     const hit = cache.get(mountPath(mount));
     if (hit !== undefined)
       return hit;
-    return Effect6.flatMap(Effect6.cached(engineGroups(mount)), (lookup) => {
+    return Effect7.flatMap(Effect7.cached(engineGroups(mount)), (lookup) => {
       cache.set(mountPath(mount), lookup);
       return lookup;
     });
   });
   return CloudflarePermissionGroups.of({
-    resolve: (mount, refs) => Effect6.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
+    resolve: (mount, refs) => Effect7.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
   });
 });
-var permissionGroupsFromLiveRoles = (declared) => Effect6.gen(function* () {
+var permissionGroupsFromLiveRoles = (declared) => Effect7.gen(function* () {
   const accountOf = new Map;
   const byAccount = new Map;
   for (const [mount, roles] of declared) {
@@ -801,9 +955,9 @@ var permissionGroupsFromLiveRoles = (declared) => Effect6.gen(function* () {
   }
   const solved = new Map;
   for (const [account, roles] of byAccount) {
-    const solve = Effect6.gen(function* () {
+    const solve = Effect7.gen(function* () {
       const live = new Map;
-      yield* Effect6.all(roles.map((role) => Effect6.map(readCloudflareRole(role.mount, role.name), (read) => {
+      yield* Effect7.all(roles.map((role) => Effect7.map(readCloudflareRole(role.mount, role.name), (read) => {
         if (read?.policies !== undefined) {
           live.set(`${role.mount}/${role.name}`, read.policies);
         }
@@ -811,11 +965,11 @@ var permissionGroupsFromLiveRoles = (declared) => Effect6.gen(function* () {
       const result = solveGroups(observationsOf(roles, live));
       const problems = describeProblems(result);
       if (problems.length > 0) {
-        return yield* Effect6.fail(new CloudflareGroupsError(`account ${account}`, problems));
+        return yield* Effect7.fail(new CloudflareGroupsError(`account ${account}`, problems));
       }
       return atEveryScope(result.groups);
     });
-    solved.set(account, yield* Effect6.cached(solve));
+    solved.set(account, yield* Effect7.cached(solve));
   }
   return CloudflarePermissionGroups.of({
     resolve: (mount, refs) => {
@@ -823,10 +977,10 @@ var permissionGroupsFromLiveRoles = (declared) => Effect6.gen(function* () {
       const lookup = account === undefined ? undefined : solved.get(account);
       if (account === undefined || lookup === undefined) {
         const why = "no declared role on this mount, so no live role can vouch for its groups";
-        return Effect6.fail(new CloudflareGroupsError(mount, [why]));
+        return Effect7.fail(new CloudflareGroupsError(mount, [why]));
       }
       const hint = `no live role on account ${account} carries it; a NEW group needs the engine endpoint`;
-      return Effect6.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
+      return Effect7.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
     }
   });
 });
@@ -835,9 +989,9 @@ var permissionGroupsFromLiveRoles = (declared) => Effect6.gen(function* () {
 var BaoCloudflareRole = Resource3("Bao.CloudflareRole", {
   defaultRemovalPolicy: "retain"
 });
-var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect7.gen(function* () {
+var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect8.gen(function* () {
   const groups = yield* CloudflarePermissionGroups;
-  const resolved = (props) => Effect7.gen(function* () {
+  const resolved = (props) => Effect8.gen(function* () {
     const refs = new Map;
     for (const policy of props.policies) {
       const scope = policy.scope ?? scopeOfResource(policy.resource);
@@ -847,17 +1001,17 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
     const ids = yield* groups.resolve(props.mount, [...refs.values()]);
     const { missing, policies } = resolvePolicies(props.policies, ids);
     if (missing.length > 0) {
-      return yield* Effect7.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
+      return yield* Effect8.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
     }
     return policies;
   });
   return BaoCloudflareRole.Provider.of({
-    list: () => Effect7.succeed([]),
-    read: Effect7.fn(function* ({ olds }) {
+    list: () => Effect8.succeed([]),
+    read: Effect8.fn(function* ({ olds }) {
       const live = yield* readCloudflareRole(olds.mount, olds.name);
       return live === undefined ? undefined : attributesOf4(olds, live);
     }),
-    diff: Effect7.fn(function* ({ news, output }) {
+    diff: Effect8.fn(function* ({ news, output }) {
       if (output === undefined || !isResolved3(news))
         return;
       if (refusalOf(news) !== undefined)
@@ -868,11 +1022,11 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
         return { action: "update" };
       return differences(news, policies, live).length === 0 ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect7.fn(function* ({ news }) {
+    reconcile: Effect8.fn(function* ({ news }) {
       const path = rolePath(news.mount, news.name);
-      const refusal = refusalOf(news);
-      if (refusal !== undefined) {
-        return yield* Effect7.die(new Error(`Bao.CloudflareRole ${path}: ${refusal}.`));
+      const refusal2 = refusalOf(news);
+      if (refusal2 !== undefined) {
+        return yield* Effect8.die(new Error(`Bao.CloudflareRole ${path}: ${refusal2}.`));
       }
       const policies = yield* resolved(news);
       const live = yield* readCloudflareRole(news.mount, news.name);
@@ -881,15 +1035,15 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
       }
       const after = yield* readCloudflareRole(news.mount, news.name);
       if (after === undefined) {
-        return yield* Effect7.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
+        return yield* Effect8.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
       }
       const left = differences(news, policies, after);
       if (left.length > 0) {
-        return yield* Effect7.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
+        return yield* Effect8.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
       }
       return attributesOf4(news, after);
     }),
-    delete: Effect7.fn(function* ({ output }) {
+    delete: Effect8.fn(function* ({ output }) {
       yield* deleteCloudflareRole(output.mount, output.name);
       return;
     })
@@ -1083,15 +1237,15 @@ var parseRolesConfig = (yaml) => {
 import { Resource as Resource4 } from "alchemy";
 import { isResolved as isResolved4 } from "alchemy/Diff";
 import * as Provider4 from "alchemy/Provider";
-import * as Effect9 from "effect/Effect";
+import * as Effect10 from "effect/Effect";
 
 // src/openbao/mount-wire.ts
-import * as Effect8 from "effect/Effect";
-var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect8.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+import * as Effect9 from "effect/Effect";
+var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect9.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
   ...asked.errors,
   `sys/mounts could not confirm the mount is absent: ${listing.message}`
-])), Effect8.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect8.succeed(undefined) : Effect8.fail(asked)));
-var readMountData = (path) => baoRead(readPath(path)).pipe(Effect8.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
+])), Effect9.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect9.succeed(undefined) : Effect9.fail(asked)));
+var readMountData = (path) => baoRead(readPath(path)).pipe(Effect9.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
 var enableMount = (props) => baoWrite("POST", readPath(props.path), enableBody(props));
 var tuneMount = (props) => baoWrite("POST", tunePath(props.path), tuneBody(props));
 var disableMount = (path) => baoDelete(readPath(path));
@@ -1100,18 +1254,18 @@ var disableMount = (path) => baoDelete(readPath(path));
 var BaoMount = Resource4("Bao.Mount", {
   defaultRemovalPolicy: "retain"
 });
-var readMount = (props) => Effect9.gen(function* () {
+var readMount = (props) => Effect10.gen(function* () {
   const live = yield* readMountData(props.path);
   if (live === undefined)
     return;
   return attributesOf(props, live);
 });
-var BaoMountProvider = () => Provider4.effect(BaoMount, Effect9.succeed(BaoMount.Provider.of({
-  list: () => Effect9.succeed([]),
-  read: Effect9.fn(function* ({ olds }) {
+var BaoMountProvider = () => Provider4.effect(BaoMount, Effect10.succeed(BaoMount.Provider.of({
+  list: () => Effect10.succeed([]),
+  read: Effect10.fn(function* ({ olds }) {
     return yield* readMount(olds);
   }),
-  diff: Effect9.fn(function* ({ news, output }) {
+  diff: Effect10.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved4(news))
       return;
     const live = yield* readMount(news);
@@ -1123,7 +1277,7 @@ var BaoMountProvider = () => Provider4.effect(BaoMount, Effect9.succeed(BaoMount
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect9.fn(function* ({ news }) {
+  reconcile: Effect10.fn(function* ({ news }) {
     let live = yield* readMount(news);
     if (live === undefined) {
       yield* enableMount(news);
@@ -1131,17 +1285,17 @@ var BaoMountProvider = () => Provider4.effect(BaoMount, Effect9.succeed(BaoMount
         yield* tuneMount(news);
     } else if (!matches(live, news)) {
       if (live.type !== news.type) {
-        return yield* Effect9.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
+        return yield* Effect10.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
       }
       yield* tuneMount(news);
     }
     live = yield* readMount(news);
     if (live === undefined) {
-      return yield* Effect9.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
+      return yield* Effect10.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
     }
     return live;
   }),
-  delete: Effect9.fn(function* ({ output }) {
+  delete: Effect10.fn(function* ({ output }) {
     yield* disableMount(output.path);
     return;
   })
@@ -1150,7 +1304,7 @@ var BaoMountProvider = () => Provider4.effect(BaoMount, Effect9.succeed(BaoMount
 import { Resource as Resource5 } from "alchemy";
 import { isResolved as isResolved5 } from "alchemy/Diff";
 import * as Provider5 from "alchemy/Provider";
-import * as Effect10 from "effect/Effect";
+import * as Effect11 from "effect/Effect";
 
 // src/openbao/pki-role-form.ts
 var sorted = (values) => [...values].sort();
@@ -1268,19 +1422,19 @@ var matches4 = (attributes, props) => attributes.digest === digestOf(canonicalFr
 var BaoPkiRole = Resource5("Bao.PkiRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole2 = (props) => Effect10.gen(function* () {
+var readRole2 = (props) => Effect11.gen(function* () {
   const live = yield* baoRead(rolePath2(props));
   if (live === undefined)
     return;
   return attributesOf5(props, live);
 });
 var badDurations = (props) => [["ttl", props.ttl], ["maxTtl", props.maxTtl]].filter(([, text4]) => parseDuration(text4) === undefined);
-var BaoPkiRoleProvider = () => Provider5.effect(BaoPkiRole, Effect10.succeed(BaoPkiRole.Provider.of({
-  list: () => Effect10.succeed([]),
-  read: Effect10.fn(function* ({ olds }) {
+var BaoPkiRoleProvider = () => Provider5.effect(BaoPkiRole, Effect11.succeed(BaoPkiRole.Provider.of({
+  list: () => Effect11.succeed([]),
+  read: Effect11.fn(function* ({ olds }) {
     return yield* readRole2(olds);
   }),
-  diff: Effect10.fn(function* ({ news, output }) {
+  diff: Effect11.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved5(news))
       return;
     if (mountPath(news.mount ?? "pki") !== output.mount)
@@ -1293,14 +1447,14 @@ var BaoPkiRoleProvider = () => Provider5.effect(BaoPkiRole, Effect10.succeed(Bao
       return { action: "update" };
     return matches4(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect10.fn(function* ({ news }) {
+  reconcile: Effect11.fn(function* ({ news }) {
     const path = rolePath2(news);
     if (news.allowedDomains.length === 0) {
-      return yield* Effect10.die(new Error(`Bao.PkiRole ${path}: allowedDomains is empty. With allow_any_name false ` + "that role can issue no certificate at all."));
+      return yield* Effect11.die(new Error(`Bao.PkiRole ${path}: allowedDomains is empty. With allow_any_name false ` + "that role can issue no certificate at all."));
     }
     const bad = badDurations(news);
     if (bad.length > 0) {
-      return yield* Effect10.die(new Error(`Bao.PkiRole ${path}: ${bad.map(([k, v]) => `${k}=${v}`).join(", ")} ` + "is not a duration OpenBao parses (expect 30m, 720h, 8760h or 0)."));
+      return yield* Effect11.die(new Error(`Bao.PkiRole ${path}: ${bad.map(([k, v]) => `${k}=${v}`).join(", ")} ` + "is not a duration OpenBao parses (expect 30m, 720h, 8760h or 0)."));
     }
     const live = yield* readRole2(news);
     if (live === undefined || !matches4(live, news)) {
@@ -1308,23 +1462,147 @@ var BaoPkiRoleProvider = () => Provider5.effect(BaoPkiRole, Effect10.succeed(Bao
     }
     const after = yield* readRole2(news);
     if (after === undefined) {
-      return yield* Effect10.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
+      return yield* Effect11.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
     }
     if (!matches4(after, news)) {
-      return yield* Effect10.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
+      return yield* Effect11.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
     }
     return after;
   }),
-  delete: Effect10.fn(function* ({ output }) {
+  delete: Effect11.fn(function* ({ output }) {
     yield* baoDelete(rolePath2(output));
     return;
   })
 })));
-// src/openbao/policy.ts
+// src/openbao/plugin.ts
 import { Resource as Resource6 } from "alchemy";
 import { isResolved as isResolved6 } from "alchemy/Diff";
 import * as Provider6 from "alchemy/Provider";
+import * as Effect13 from "effect/Effect";
+
+// src/openbao/plugin-form.ts
+var resolve = (props) => ({
+  args: props.args ?? [],
+  command: props.command,
+  name: props.name,
+  sha256: props.sha256.toLowerCase(),
+  type: props.type,
+  version: props.version ?? ""
+});
+var CANONICAL_VERSION = /^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$/;
+var problems = (form) => {
+  const found = [];
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(form.name) || form.name.includes("..")) {
+    found.push(`name ${JSON.stringify(form.name)} is not a plain catalog name`);
+  }
+  if (!/^[0-9a-f]{64}$/.test(form.sha256))
+    found.push("sha256 is not 64 hex characters");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(form.command) || form.command.includes("..")) {
+    found.push(`command ${JSON.stringify(form.command)} is not a bare file name`);
+  }
+  if (form.version !== "" && !CANONICAL_VERSION.test(form.version)) {
+    found.push(`version ${JSON.stringify(form.version)} is not canonical semver like v1.2.0`);
+  }
+  if (/\+builtin/.test(form.version))
+    found.push("version metadata `builtin` is reserved");
+  return found;
+};
+var versionQuery = (version) => version === "" ? "" : `?version=${encodeURIComponent(version)}`;
+var catalogPath = (type, name) => `sys/plugins/catalog/${type}/${name}`;
+var versionedPath = (type, name, version) => `${catalogPath(type, name)}${versionQuery(version)}`;
+var registerBody = (form) => ({
+  command: form.command,
+  sha256: form.sha256,
+  ...form.args.length > 0 ? { args: form.args } : {},
+  ...form.version === "" ? {} : { version: form.version }
+});
+var text4 = (value) => typeof value === "string" ? value : "";
+var list2 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var attributesOf6 = (form, live) => {
+  const attrs = {
+    name: form.name,
+    type: form.type,
+    version: text4(live["version"]),
+    sha256: text4(live["sha256"]).toLowerCase(),
+    command: text4(live["command"]),
+    args: list2(live["args"]),
+    builtin: live["builtin"] === true
+  };
+  return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
+};
+var sameArgs = (want, have) => want.length === have.length && want.every((entry, index) => entry === have[index]);
+var matches5 = (attributes, form) => !attributes.builtin && attributes.version === form.version && attributes.sha256 === form.sha256 && attributes.command === form.command && sameArgs(form.args, attributes.args);
+
+// src/openbao/plugin-reconcile.ts
 import * as Effect12 from "effect/Effect";
+
+// src/openbao/plugin-wire.ts
+var readPluginData = (form) => baoRead(versionedPath(form.type, form.name, form.version));
+var registerPlugin = (form) => baoWrite("PUT", catalogPath(form.type, form.name), registerBody(form));
+var deregisterPlugin = (type, name, version) => baoDelete(versionedPath(type, name, version));
+
+// src/openbao/plugin-reconcile.ts
+var readEntry = (form) => Effect12.map(readPluginData(form), (live) => live === undefined ? undefined : { attributes: attributesOf6(form, live), live });
+var refuse = (form, message) => Effect12.die(new Error(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}: ${message}`));
+var SELF_REPORTED = "the write succeeded but the read-back does not match. If the binary reports its own version, " + "OpenBao filed the registration under it (plugin_catalog.go setInternal) — declare `version` " + "as exactly the version the binary reports; that adopts the entry this write just made.";
+var reconcilePlugin = (props) => Effect12.gen(function* () {
+  const form = resolve(props);
+  const bad = problems(form);
+  if (bad.length > 0)
+    return yield* refuse(form, bad.join("; "));
+  const found = yield* readEntry(form);
+  if (found !== undefined && !matches5(found.attributes, form)) {
+    if (found.live["declarative"] === true || found.live["oci"] === true) {
+      return yield* refuse(form, "the live entry is declarative/OCI; manage it in server config.");
+    }
+    if (found.attributes.builtin) {
+      return yield* refuse(form, "this name is a builtin; an unversioned write would shadow it.");
+    }
+  }
+  if (found === undefined || !matches5(found.attributes, form))
+    yield* registerPlugin(form);
+  const after = yield* readEntry(form);
+  if (after === undefined || !matches5(after.attributes, form)) {
+    return yield* refuse(form, SELF_REPORTED);
+  }
+  return after.attributes;
+});
+
+// src/openbao/plugin.ts
+var BaoPlugin = Resource6("Bao.Plugin", {
+  defaultRemovalPolicy: "retain"
+});
+var BaoPluginProvider = () => Provider6.effect(BaoPlugin, Effect13.succeed(BaoPlugin.Provider.of({
+  list: () => Effect13.succeed([]),
+  read: Effect13.fn(function* ({ olds }) {
+    const found = yield* readEntry(resolve(olds));
+    return found?.attributes;
+  }),
+  diff: Effect13.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved6(news))
+      return;
+    const form = resolve(news);
+    if (output.name !== form.name || output.type !== form.type || output.version !== form.version) {
+      return { action: "replace" };
+    }
+    const found = yield* readEntry(form);
+    if (found === undefined)
+      return { action: "update" };
+    return matches5(found.attributes, form) ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: Effect13.fn(function* ({ news }) {
+    return yield* reconcilePlugin(news);
+  }),
+  delete: Effect13.fn(function* ({ output }) {
+    yield* deregisterPlugin(output.type, output.name, output.version);
+    return;
+  })
+})));
+// src/openbao/policy.ts
+import { Resource as Resource7 } from "alchemy";
+import { isResolved as isResolved7 } from "alchemy/Diff";
+import * as Provider7 from "alchemy/Provider";
+import * as Effect15 from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 
@@ -1332,32 +1610,32 @@ import * as Path from "effect/Path";
 var isEmptyAssembly = (parts, joined) => parts === 0 || !/^\s*path\s+"/m.test(joined);
 
 // src/openbao/policy-wire.ts
-import * as Effect11 from "effect/Effect";
+import * as Effect14 from "effect/Effect";
 var policyPath = (name) => `sys/policies/acl/${name}`;
-var readPolicy = (name) => Effect11.flatMap(baoRead(policyPath(name)), (data) => {
+var readPolicy = (name) => Effect14.flatMap(baoRead(policyPath(name)), (data) => {
   if (data === undefined)
-    return Effect11.succeed("");
-  const text4 = data["policy"];
-  return typeof text4 === "string" ? Effect11.succeed(text4) : Effect11.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
+    return Effect14.succeed("");
+  const text5 = data["policy"];
+  return typeof text5 === "string" ? Effect14.succeed(text5) : Effect14.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
 });
 var writePolicy = (name, hcl) => baoWrite("PUT", policyPath(name), { policy: hcl });
 var deletePolicy = (name) => baoDelete(policyPath(name));
 
 // src/openbao/policy.ts
-var BaoPolicy = Resource6("Bao.Policy", {
+var BaoPolicy = Resource7("Bao.Policy", {
   defaultRemovalPolicy: "retain"
 });
 var grantsOf = (hcl) => (hcl.match(/^path /gm) ?? []).length;
-var attributesOf6 = (name, hcl, parts) => ({
+var attributesOf7 = (name, hcl, parts) => ({
   name,
   digest: sha256(hcl),
   grants: grantsOf(hcl),
   parts
 });
-var BaoPolicyProvider = () => Provider6.effect(BaoPolicy, Effect12.gen(function* () {
+var BaoPolicyProvider = () => Provider7.effect(BaoPolicy, Effect15.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const assemble = (dir) => Effect12.gen(function* () {
+  const assemble = (dir) => Effect15.gen(function* () {
     const entries2 = (yield* fs.readDirectory(dir)).filter((f) => f.endsWith(".hcl")).sort();
     let joined = "";
     for (const f of entries2)
@@ -1366,44 +1644,44 @@ var BaoPolicyProvider = () => Provider6.effect(BaoPolicy, Effect12.gen(function*
     return { joined, parts: entries2.length };
   });
   return BaoPolicy.Provider.of({
-    list: () => Effect12.succeed([]),
-    read: Effect12.fn(function* ({ olds }) {
+    list: () => Effect15.succeed([]),
+    read: Effect15.fn(function* ({ olds }) {
       const live = yield* readPolicy(olds.name);
-      return live.length === 0 ? undefined : attributesOf6(olds.name, live, 0);
+      return live.length === 0 ? undefined : attributesOf7(olds.name, live, 0);
     }),
-    diff: Effect12.fn(function* ({ news, output }) {
-      if (output === undefined || !isResolved6(news))
+    diff: Effect15.fn(function* ({ news, output }) {
+      if (output === undefined || !isResolved7(news))
         return;
       const { joined } = yield* assemble(news.fragments);
       const live = yield* readPolicy(news.name);
       return live.length > 0 && sha256(live) === sha256(joined) ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect12.fn(function* ({ news }) {
+    reconcile: Effect15.fn(function* ({ news }) {
       const name = news.name;
       const { joined, parts } = yield* assemble(news.fragments);
       if (isEmptyAssembly(parts, joined))
-        return yield* Effect12.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
+        return yield* Effect15.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
       const current = yield* readPolicy(name);
       if (current.length > 0 && sha256(current) === sha256(joined)) {
-        return attributesOf6(name, joined, parts);
+        return attributesOf7(name, joined, parts);
       }
       yield* writePolicy(name, joined);
-      return attributesOf6(name, joined, parts);
+      return attributesOf7(name, joined, parts);
     }),
-    delete: Effect12.fn(function* ({ output }) {
+    delete: Effect15.fn(function* ({ output }) {
       yield* deletePolicy(output.name);
       return;
     })
   });
 }));
 // src/openbao/proxmox-role.ts
-import { Resource as Resource7 } from "alchemy";
-import { isResolved as isResolved7 } from "alchemy/Diff";
-import * as Provider7 from "alchemy/Provider";
-import * as Effect13 from "effect/Effect";
+import { Resource as Resource8 } from "alchemy";
+import { isResolved as isResolved8 } from "alchemy/Diff";
+import * as Provider8 from "alchemy/Provider";
+import * as Effect16 from "effect/Effect";
 
 // src/openbao/proxmox-role-form.ts
-var text4 = (value) => typeof value === "string" ? value : "";
+var text5 = (value) => typeof value === "string" ? value : "";
 var ttlText3 = (seconds3, fallback = "0") => {
   if (seconds3 === undefined)
     return fallback;
@@ -1416,11 +1694,11 @@ var ttlText3 = (seconds3, fallback = "0") => {
   return `${String(seconds3)}s`;
 };
 var rolePath3 = (mount, name) => `${mountPath(mount)}/roles/${name}`;
-var attributesOf7 = (props, live) => {
+var attributesOf8 = (props, live) => {
   const attrs = {
     mount: mountPath(props.mount),
-    name: text4(live["name"]) || props.name,
-    mintUser: text4(live["mint_user"]),
+    name: text5(live["name"]) || props.name,
+    mintUser: text5(live["mint_user"]),
     ttl: ttlText3(ttlSeconds(live["ttl"])),
     maxTtl: ttlText3(ttlSeconds(live["max_ttl"]))
   };
@@ -1446,69 +1724,68 @@ var sameTtl5 = (want, have) => {
   const haveSeconds = ttlSeconds(have);
   return wantSeconds !== undefined && wantSeconds === haveSeconds;
 };
-var matches5 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl5(props.ttl, attributes.ttl) && sameTtl5(props.maxTtl, attributes.maxTtl);
+var matches6 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl5(props.ttl, attributes.ttl) && sameTtl5(props.maxTtl, attributes.maxTtl);
 
 // src/openbao/proxmox-role.ts
-var BaoProxmoxRole = Resource7("Bao.ProxmoxRole", {
+var BaoProxmoxRole = Resource8("Bao.ProxmoxRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole3 = (props) => Effect13.gen(function* () {
+var readRole3 = (props) => Effect16.gen(function* () {
   const live = yield* baoRead(rolePath3(props.mount, props.name));
   if (live === undefined)
     return;
-  return attributesOf7(props, live);
+  return attributesOf8(props, live);
 });
-var BaoProxmoxRoleProvider = () => Provider7.effect(BaoProxmoxRole, Effect13.succeed(BaoProxmoxRole.Provider.of({
-  list: () => Effect13.succeed([]),
-  read: Effect13.fn(function* ({ olds }) {
+var BaoProxmoxRoleProvider = () => Provider8.effect(BaoProxmoxRole, Effect16.succeed(BaoProxmoxRole.Provider.of({
+  list: () => Effect16.succeed([]),
+  read: Effect16.fn(function* ({ olds }) {
     return yield* readRole3(olds);
   }),
-  diff: Effect13.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved7(news))
+  diff: Effect16.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved8(news))
       return;
     const live = yield* readRole3(news);
     if (live === undefined)
       return { action: "update" };
-    if (matches5(live, news))
+    if (matches6(live, news))
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect13.fn(function* ({ news }) {
+  reconcile: Effect16.fn(function* ({ news }) {
     const live = yield* readRole3(news);
     if (live !== undefined && live.mintUser !== news.mintUser && news.allowMintUserChange !== live.mintUser) {
-      return yield* Effect13.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: live mint_user ` + `${live.mintUser} != declared ${news.mintUser}. Every token this role mints ` + "inherits the ACL of that PVE user. To re-scope deliberately, declare " + `allowMintUserChange: '${live.mintUser}'.`));
+      return yield* Effect16.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: live mint_user ` + `${live.mintUser} != declared ${news.mintUser}. Every token this role mints ` + "inherits the ACL of that PVE user. To re-scope deliberately, declare " + `allowMintUserChange: '${live.mintUser}'.`));
     }
-    if (live === undefined || !matches5(live, news)) {
+    if (live === undefined || !matches6(live, news)) {
       const write = writeBody4(news);
       if (!write.ok) {
-        return yield* Effect13.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
+        return yield* Effect16.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
       }
       yield* baoWrite("PUT", rolePath3(news.mount, news.name), write.body);
     }
     const after = yield* readRole3(news);
     if (after === undefined) {
-      return yield* Effect13.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: write returned no error ` + "but the role is still absent."));
+      return yield* Effect16.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: write returned no error ` + "but the role is still absent."));
     }
     return after;
   }),
-  delete: Effect13.fn(function* ({ output }) {
+  delete: Effect16.fn(function* ({ output }) {
     yield* baoDelete(rolePath3(output.mount, output.name));
     return;
   })
 })));
 // src/openbao/ssh-role.ts
-import { Resource as Resource8 } from "alchemy";
-import { isResolved as isResolved8 } from "alchemy/Diff";
-import * as Provider8 from "alchemy/Provider";
-import * as Effect14 from "effect/Effect";
+import { Resource as Resource9 } from "alchemy";
+import { isResolved as isResolved9 } from "alchemy/Diff";
+import * as Provider9 from "alchemy/Provider";
+import * as Effect17 from "effect/Effect";
 
 // src/openbao/ssh-role-form.ts
-var mountOf = (mount) => (mount ?? "ssh").replace(/\/+$/, "");
-var readPath4 = (mount, name) => `${mountOf(mount)}/roles/${name}`;
-var text5 = (value) => typeof value === "string" ? value : "";
+var readPath4 = (mount, name) => `${sshMountOf(mount)}/roles/${name}`;
+var text6 = (value) => typeof value === "string" ? value : "";
 var bool3 = (value, fallback) => typeof value === "boolean" ? value : fallback;
 var csvList = (value) => {
-  const parts = Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : text5(value).split(",");
+  const parts = Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : text6(value).split(",");
   return [
     ...new Set(parts.map((entry) => entry.trim()).filter((entry) => entry.length > 0))
   ].sort();
@@ -1519,12 +1796,12 @@ var extMap = (value) => {
     return out;
   const source = value;
   for (const key of Object.keys(source).sort())
-    out[key] = text5(source[key]);
+    out[key] = text6(source[key]);
   return out;
 };
-var resolve = (props) => ({
+var resolve2 = (props) => ({
   name: props.name,
-  mount: mountOf(props.mount),
+  mount: sshMountOf(props.mount),
   allowedUsers: csvList(props.allowedUsers),
   defaultUser: props.defaultUser ?? "",
   allowUserCertificates: props.allowUserCertificates ?? false,
@@ -1540,12 +1817,12 @@ var resolve = (props) => ({
   ttl: props.ttl,
   maxTtl: props.maxTtl
 });
-var attributesOf8 = (form, live) => {
+var attributesOf9 = (form, live) => {
   const attrs = {
     name: form.name,
     mount: form.mount,
     allowedUsers: csvList(live["allowed_users"]),
-    defaultUser: text5(live["default_user"]),
+    defaultUser: text6(live["default_user"]),
     allowUserCertificates: bool3(live["allow_user_certificates"], false),
     allowHostCertificates: bool3(live["allow_host_certificates"], false),
     allowedDomains: csvList(live["allowed_domains"]),
@@ -1556,13 +1833,13 @@ var attributesOf8 = (form, live) => {
     allowedCriticalOptions: csvList(live["allowed_critical_options"]),
     defaultCriticalOptions: extMap(live["default_critical_options"]),
     allowEmptyPrincipals: bool3(live["allow_empty_principals"], false),
-    keyType: text5(live["key_type"]) || "ca",
+    keyType: text6(live["key_type"]) || "ca",
     ttlSeconds: ttlSeconds(live["ttl"]) ?? 0,
     maxTtlSeconds: ttlSeconds(live["max_ttl"]) ?? 0
   };
   return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
 };
-var mapValue = (map4) => JSON.stringify(extMap(map4));
+var mapValue = (map5) => extMap(map5);
 var writeBody5 = (form) => ({
   key_type: "ca",
   allowed_users: form.allowedUsers.join(","),
@@ -1587,17 +1864,17 @@ var sameMap = (want, have) => {
 };
 var sameTtl6 = (want, have) => parseDuration(want) === have;
 var badDurations2 = (form) => ["ttl", "maxTtl"].filter((field) => parseDuration(form[field]) === undefined);
-var matches6 = (attributes, form) => attributes.keyType === "ca" && sameList2(form.allowedUsers, attributes.allowedUsers) && attributes.defaultUser === form.defaultUser && attributes.allowUserCertificates === form.allowUserCertificates && attributes.allowHostCertificates === form.allowHostCertificates && sameList2(form.allowedDomains, attributes.allowedDomains) && attributes.allowSubdomains === form.allowSubdomains && attributes.allowBareDomains === form.allowBareDomains && sameList2(form.allowedExtensions, attributes.allowedExtensions) && sameMap(form.defaultExtensions, attributes.defaultExtensions) && sameList2(form.allowedCriticalOptions, attributes.allowedCriticalOptions) && sameMap(form.defaultCriticalOptions, attributes.defaultCriticalOptions) && attributes.allowEmptyPrincipals === form.allowEmptyPrincipals && sameTtl6(form.ttl, attributes.ttlSeconds) && sameTtl6(form.maxTtl, attributes.maxTtlSeconds);
+var matches7 = (attributes, form) => attributes.keyType === "ca" && sameList2(form.allowedUsers, attributes.allowedUsers) && attributes.defaultUser === form.defaultUser && attributes.allowUserCertificates === form.allowUserCertificates && attributes.allowHostCertificates === form.allowHostCertificates && sameList2(form.allowedDomains, attributes.allowedDomains) && attributes.allowSubdomains === form.allowSubdomains && attributes.allowBareDomains === form.allowBareDomains && sameList2(form.allowedExtensions, attributes.allowedExtensions) && sameMap(form.defaultExtensions, attributes.defaultExtensions) && sameList2(form.allowedCriticalOptions, attributes.allowedCriticalOptions) && sameMap(form.defaultCriticalOptions, attributes.defaultCriticalOptions) && attributes.allowEmptyPrincipals === form.allowEmptyPrincipals && sameTtl6(form.ttl, attributes.ttlSeconds) && sameTtl6(form.maxTtl, attributes.maxTtlSeconds);
 
 // src/openbao/ssh-role.ts
-var BaoSshRole = Resource8("Bao.SshRole", {
+var BaoSshRole = Resource9("Bao.SshRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole4 = (form) => Effect14.gen(function* () {
+var readRole4 = (form) => Effect17.gen(function* () {
   const live = yield* baoRead(readPath4(form.mount, form.name));
   if (live === undefined)
     return;
-  return { attributes: attributesOf8(form, live), live };
+  return { attributes: attributesOf9(form, live), live };
 });
 var UNMANAGED_DEFAULTS = {
   algorithm_signer: "default",
@@ -1619,52 +1896,52 @@ var wouldErase = (live) => {
   }
   return lost.sort();
 };
-var refuse = (message) => Effect14.die(new Error(message));
-var BaoSshRoleProvider = () => Provider8.effect(BaoSshRole, Effect14.succeed(BaoSshRole.Provider.of({
-  list: () => Effect14.succeed([]),
-  read: Effect14.fn(function* ({ olds }) {
-    const found = yield* readRole4(resolve(olds));
+var refuse2 = (message) => Effect17.die(new Error(message));
+var BaoSshRoleProvider = () => Provider9.effect(BaoSshRole, Effect17.succeed(BaoSshRole.Provider.of({
+  list: () => Effect17.succeed([]),
+  read: Effect17.fn(function* ({ olds }) {
+    const found = yield* readRole4(resolve2(olds));
     return found?.attributes;
   }),
-  diff: Effect14.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved8(news))
+  diff: Effect17.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved9(news))
       return;
-    const form = resolve(news);
+    const form = resolve2(news);
     if (output.mount !== form.mount || output.name !== form.name) {
       return { action: "replace" };
     }
     const found = yield* readRole4(form);
     if (found === undefined)
       return { action: "update" };
-    return matches6(found.attributes, form) ? { action: "noop" } : { action: "update" };
+    return matches7(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect14.fn(function* ({ news }) {
-    const form = resolve(news);
+  reconcile: Effect17.fn(function* ({ news }) {
+    const form = resolve2(news);
     const path = readPath4(form.mount, form.name);
     const bad = badDurations2(form);
     if (bad.length > 0) {
-      return yield* refuse(`Bao.SshRole ${path}: ${bad.join(", ")} is not a duration parseDuration understands ` + "(`0` or `<n>s|m|h|d`). It would write, then report update on every plan forever.");
+      return yield* refuse2(`Bao.SshRole ${path}: ${bad.join(", ")} is not a duration parseDuration understands ` + "(`0` or `<n>s|m|h|d`). It would write, then report update on every plan forever.");
     }
     if (form.allowUserCertificates && form.allowedUsers.length === 0 && !form.allowEmptyPrincipals) {
-      return yield* refuse(`Bao.SshRole ${path}: allowUserCertificates with an empty allowedUsers and ` + "allowEmptyPrincipals false. Every sign request against it would be rejected.");
+      return yield* refuse2(`Bao.SshRole ${path}: allowUserCertificates with an empty allowedUsers and ` + "allowEmptyPrincipals false. Every sign request against it would be rejected.");
     }
     const found = yield* readRole4(form);
-    if (found === undefined || !matches6(found.attributes, form)) {
+    if (found === undefined || !matches7(found.attributes, form)) {
       if (found !== undefined) {
         const lost = wouldErase(found.live);
         if (lost.length > 0) {
-          return yield* refuse(`Bao.SshRole ${path}: live role carries ${lost.join(", ")}, which this ` + "resource does not declare and the full-replace write would ERASE. " + "Fold those settings into the declaration, or clear them by hand first.");
+          return yield* refuse2(`Bao.SshRole ${path}: live role carries ${lost.join(", ")}, which this ` + "resource does not declare and the full-replace write would ERASE. " + "Fold those settings into the declaration, or clear them by hand first.");
         }
       }
       yield* baoWrite("PUT", path, writeBody5(form));
     }
     const after = yield* readRole4(form);
     if (after === undefined) {
-      return yield* refuse(`Bao.SshRole ${path}: write returned no error but the role is still absent.`);
+      return yield* refuse2(`Bao.SshRole ${path}: write returned no error but the role is still absent.`);
     }
     return after.attributes;
   }),
-  delete: Effect14.fn(function* ({ output }) {
+  delete: Effect17.fn(function* ({ output }) {
     yield* baoDelete(readPath4(output.mount, output.name));
     return;
   })
@@ -1676,10 +1953,13 @@ export {
   BaoAuthRoleProvider,
   BaoCloudflareRole,
   BaoCloudflareRoleProvider,
+  BaoLoginError,
   BaoMount,
   BaoMountProvider,
   BaoPkiRole,
   BaoPkiRoleProvider,
+  BaoPlugin,
+  BaoPluginProvider,
   BaoPolicy,
   BaoPolicyProvider,
   BaoProxmoxRole,
@@ -1687,13 +1967,17 @@ export {
   BaoSshRole,
   BaoSshRoleProvider,
   CloudflarePermissionGroups,
+  appRoleLogin,
+  appRoleLoginEffect,
   expandAccount,
   expandAll,
   mountName,
   parseRolesConfig,
   permissionGroupsFromEngine,
-  permissionGroupsFromLiveRoles
+  permissionGroupsFromLiveRoles,
+  revokeSelf,
+  revokeSelfEffect
 };
 
-//# debugId=8FBBE010DA02328C64756E2164756E21
+//# debugId=1C57EE110DEE3DA764756E2164756E21
 //# sourceMappingURL=index.js.map