@homeflare/alchemy 0.4.1 → 0.5.0

package/dist/openbao/mount-path.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Slash trimming for caller-supplied mount paths.
+ *
+ * ★ LOOPS, NOT `/^\/+|\/+$/g` OR `/\/+$/`. A trailing `\/+$` backtracks polynomially on a long run
+ *   of `/` followed by anything else (CodeQL js/polynomial-redos), and mount paths are caller input.
+ *   Both loops are linear in the input length.
+ */
+/** `text` without trailing `/`. */
+export declare const trimTrailingSlashes: (text: string) => string;
+/** `text` without leading or trailing `/`. */
+export declare const trimSlashes: (text: string) => string;
+/** SSH mount path without a trailing slash; `ssh` when the caller did not say. */
+export declare const sshMountOf: (mount: string | undefined) => string;
+//# sourceMappingURL=mount-path.d.ts.map

package/dist/openbao/mount-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-path.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-path.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mCAAmC;AACnC,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAIlD,CAAC;AAEF,8CAA8C;AAC9C,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,MAI1C,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,UAAU,UAAW,MAAM,GAAG,SAAS,KAAG,MAClB,CAAC"}

package/dist/openbao/plugin-form.d.ts

@@ -0,0 +1,60 @@
+export type BaoPluginType = 'auth' | 'database' | 'secret';
+export interface BaoPluginProps {
+    /** Catalog name — what a mount's `type` names, e.g. `openbao-plugin-secrets-cloudflare`. */
+    name: string;
+    /** Catalog type. `secret` for a secrets engine, `auth` for an auth method. */
+    type: BaoPluginType;
+    /** Hex SHA-256 of the binary already sitting in plugin_directory. Case is normalised. */
+    sha256: string;
+    /** The binary's file name inside plugin_directory — a bare name, no path, no arguments. */
+    command: string;
+    /**
+     * Canonical semver with its `v`, e.g. `v0.1.2`. ⚠️ When the binary reports its own version,
+     * declare EXACTLY that one: any other is refused at write ("plugin version mismatch",
+     * plugin_catalog.go setInternal), and none at all is filed under the reported one — see the ⚠️
+     * on SELF_REPORTED in plugin-reconcile.ts.
+     */
+    version?: string;
+    /** Arguments, in order. ⛔ Never a secret: they land in Alchemy state and in every catalog read. */
+    args?: readonly string[];
+}
+/** ⛔ NO SECRET HERE — names, a hash, a file name, arguments and a digest. */
+export interface BaoPluginAttributes {
+    name: string;
+    type: BaoPluginType;
+    /** The canonical version the catalog stored, `''` when unversioned. Delete needs it. */
+    version: string;
+    sha256: string;
+    command: string;
+    args: readonly string[];
+    /** True when the catalog answered with OpenBao's own builtin rather than a registration. */
+    builtin: boolean;
+    /** SHA-256 of the managed fields — safe to persist; see policy.ts. */
+    digest: string;
+}
+/** Every prop resolved to what the register call will store. */
+export type BaoPluginForm = Required<BaoPluginProps>;
+export declare const resolve: (props: BaoPluginProps) => BaoPluginForm;
+/** Everything wrong with the declaration, or `[]`. Checked before any request. */
+export declare const problems: (form: BaoPluginForm) => readonly string[];
+/** `sys/plugins/catalog/<type>/<name>` — register addresses the plugin here. */
+export declare const catalogPath: (type: BaoPluginType, name: string) => string;
+/** Read and delete address one VERSION of the plugin. */
+export declare const versionedPath: (type: BaoPluginType, name: string, version: string) => string;
+/**
+ * The register body — the fields RegisterPluginInput sends (api v2.6.0 sys_plugins.go:186-204),
+ * which is what `bao plugin register` sends.
+ *
+ * ★ `type` IS LEFT OUT OF THE BODY ON PURPOSE. The Go client puts it there as a NUMBER (PluginType
+ *   has no MarshalJSON), and the route's `type` capture is what the handler reads. The path says it.
+ * ⛔ NO `env`, EVER. The catalog read never returns env (handlePluginCatalogRead's data map has no
+ *   such key), so a declared env could not be diffed, and what env exists to carry into a plugin
+ *   process is exactly what must not sit in Alchemy's unencrypted state. ⚠️ The register call is a
+ *   FULL REPLACE (setInternal builds a fresh entry), so an env someone set by hand is dropped by
+ *   the next write — which only happens when a managed field has drifted.
+ */
+export declare const registerBody: (form: BaoPluginForm) => Record<string, unknown>;
+export declare const attributesOf: (form: BaoPluginForm, live: Record<string, unknown>) => BaoPluginAttributes;
+/** True when the catalog already holds exactly this registration. A builtin never matches. */
+export declare const matches: (attributes: BaoPluginAttributes, form: BaoPluginForm) => boolean;
+//# sourceMappingURL=plugin-form.d.ts.map

package/dist/openbao/plugin-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-form.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin-form.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,cAAc;IAC7B,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,IAAI,EAAE,aAAa,CAAC;IACpB,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,CAAC;IACpB,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,4FAA4F;IAC5F,OAAO,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gEAAgE;AAChE,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;AAErD,eAAO,MAAM,OAAO,UAAW,cAAc,KAAG,aAO9C,CAAC;AAWH,kFAAkF;AAClF,eAAO,MAAM,QAAQ,SAAU,aAAa,KAAG,SAAS,MAAM,EAuB7D,CAAC;AAMF,gFAAgF;AAChF,eAAO,MAAM,WAAW,SAAU,aAAa,QAAQ,MAAM,KAAG,MACzB,CAAC;AAExC,yDAAyD;AACzD,eAAO,MAAM,aAAa,SAAU,aAAa,QAAQ,MAAM,WAAW,MAAM,KAAG,MAC7B,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,SAAU,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAKvE,CAAC;AAQH,eAAO,MAAM,YAAY,SACjB,aAAa,QACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,mBAWF,CAAC;AAMF,8FAA8F;AAC9F,eAAO,MAAM,OAAO,eAAgB,mBAAmB,QAAQ,aAAa,KAAG,OAKzC,CAAC"}

package/dist/openbao/plugin-reconcile.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Bao.Plugin's read and reconcile, as plain effects — split from plugin.ts so the refusals below can
+ * be run against a fake server rather than only reasoned about.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+import { type BaoPluginAttributes, type BaoPluginForm, type BaoPluginProps } from './plugin-form.ts';
+type Entry = {
+    readonly attributes: BaoPluginAttributes;
+    readonly live: Record<string, unknown>;
+};
+/** Live entry, plus the raw body — reconcile needs the raw half for `oci` and `declarative`. */
+export declare const readEntry: (form: BaoPluginForm) => Effect.Effect<Entry | undefined, BaoError, HttpClient.HttpClient>;
+/** Register when the live entry differs, then prove it by reading back. Dies on a refusal. */
+export declare const reconcilePlugin: (props: BaoPluginProps) => Effect.Effect<BaoPluginAttributes, BaoError, HttpClient.HttpClient>;
+export {};
+//# sourceMappingURL=plugin-reconcile.d.ts.map

package/dist/openbao/plugin-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin-reconcile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,cAAc,EAMpB,MAAM,kBAAkB,CAAC;AAG1B,KAAK,KAAK,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAElG,gGAAgG;AAChG,eAAO,MAAM,SAAS,SACd,aAAa,KAClB,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGhE,CAAC;AAuBJ,8FAA8F;AAC9F,eAAO,MAAM,eAAe,UACnB,cAAc,KACpB,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAsCjE,CAAC"}

package/dist/openbao/plugin-wire.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The OpenBao calls Bao.Plugin makes — read one catalog entry, register, deregister. Split from
+ * plugin.ts so the calls can be pinned against a fake server, the way mount-wire.ts is.
+ *
+ * ★ ENDPOINTS, READ FROM openbao v2.6.2 api/sys_plugins.go (the client `bao plugin` uses) and the
+ *   handlers in vault/logical_system.go:
+ *     read        GET    sys/plugins/catalog/<type>/<name>[?version=]  (GetPlugin, :159-183)
+ *     register    PUT    sys/plugins/catalog/<type>/<name>             (RegisterPlugin, :212-228)
+ *     deregister  DELETE sys/plugins/catalog/<type>/<name>[?version=]  (DeregisterPlugin, :249-261)
+ *   (api/sys_plugins.go diffed identical between v2.6.0 and v2.6.2.)
+ * ⚠️ ALL THREE NEED `sudo` ON THE PATH, not just the verb (docs/api/system/plugins-catalog.mdx). A
+ *   token without it reads as 403, which is an error here, never "absent".
+ */
+import type * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+import { type BaoPluginForm, type BaoPluginType } from './plugin-form.ts';
+/**
+ * One catalog entry, or undefined when the catalog has none at that name, type and version.
+ *
+ * ★ UNLIKE A MOUNT, A MISSING PLUGIN REALLY IS A 404. handlePluginCatalogRead returns `nil, nil` when
+ *   the catalog lookup finds nothing (vault/logical_system.go:545-547), and RespondErrorCommon turns
+ *   a nil READ response into 404 (sdk v2.6.2 logical/response_util.go:23-26). No second question is
+ *   needed, unlike the mount-table check in mount-wire.ts.
+ * ⚠️ A BUILTIN ANSWERS TOO. With no external registration at an unversioned name, the catalog falls
+ *   through to OpenBao's own builtin of that name and type (plugin_catalog.go get, :1016-1036), which
+ *   reads back with `builtin: true` — present, but not a registration. plugin.ts decides what that
+ *   means.
+ */
+export declare const readPluginData: (form: BaoPluginForm) => Effect.Effect<Record<string, unknown> | undefined, BaoError, HttpClient.HttpClient>;
+export declare const registerPlugin: (form: BaoPluginForm) => Effect.Effect<void, BaoError, HttpClient.HttpClient>;
+/**
+ * ★ IDEMPOTENT ON THE SERVER. deleteInternal deletes the storage key whether or not it exists
+ *   (plugin_catalog.go:1272-1284) and the handler answers with no body, so a retried delete succeeds.
+ *   ⚠️ BUT A MISSING TYPED KEY FALLS BACK TO THE BARE NAME. When `<type>/<name>[/<version>]` is not
+ *     in storage, the same function deletes the key `<name>` instead — where registrations made
+ *     before plugin types existed live, whatever their type. A fresh 2.x vault has none; one
+ *     migrated from an old Vault may. REASONED FROM SOURCE, not run.
+ * ⛔ AND THAT IS THE DANGER: NOTHING CHECKS WHETHER A MOUNT STILL USES THE PLUGIN. The same function
+ *   has no mount lookup at all, so deregistering the plugin a live mount runs succeeds. The running
+ *   process is not killed by it; the mount breaks the next time OpenBao has to START the plugin — a
+ *   reload, a restart, an unseal — long after the plan that did it. REASONED FROM SOURCE, not run.
+ */
+export declare const deregisterPlugin: (type: BaoPluginType, name: string, version: string) => Effect.Effect<void, BaoError, HttpClient.HttpClient>;
+//# sourceMappingURL=plugin-wire.d.ts.map

package/dist/openbao/plugin-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAInB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,SACnB,aAAa,KAClB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CACzB,CAAC;AAE7D,eAAO,MAAM,cAAc,SACnB,aAAa,KAClB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CACkB,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,SACrB,aAAa,QACb,MAAM,WACH,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CACP,CAAC"}

package/dist/openbao/plugin.d.ts

@@ -0,0 +1,31 @@
+/**
+ * An OpenBao plugin catalog entry — `sys/plugins/catalog/<type>/<name>`: which binary in
+ * plugin_directory, at which SHA-256, may run as a plugin of that name. METADATA ONLY.
+ *
+ * ⛔ IT REGISTERS; IT DOES NOT DELIVER. The binary must already sit in plugin_directory. Copying it
+ *   there is a host step.
+ *   ⚠️ A MISSING FILE FAILS THE WRITE; A WRONG SHA-256 DOES NOT. setInternal (plugin_catalog.go
+ *     :1150-1230) resolves the path first, which fails loudly, but the run that would notice a
+ *     checksum mismatch is only the version probe, and that is best-effort: it logs a warning and
+ *     stores the entry anyway. The mismatch then surfaces when a mount first starts the plugin.
+ * ⛔ NO `env` PROP, AND THERE MUST NEVER BE ONE — see registerBody in plugin-form.ts. Alchemy keeps
+ *   props and attributes UNENCRYPTED in its state store (policy.ts has the reasoning).
+ * ⚠️ A NEW SHA-256 DOES NOT RESTART A RUNNING PLUGIN. setInternal writes the catalog entry and
+ *   reloads nothing, so mounts keep the old process until `sys/plugins/reload/backend` or a
+ *   restart. Reloading is an operator step, not this resource.
+ *
+ * ★ `defaultRemovalPolicy: 'retain'`. Deregistering does not check whether a mount still runs the
+ *   plugin (the ⛔ on deregisterPlugin in plugin-wire.ts), so a destroy would break that mount at its
+ *   next start. Retain also means a version bump — a REPLACE, below — leaves the old version
+ *   registered for mounts pinned to it; prune it by hand once nothing uses it.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoPluginAttributes, type BaoPluginProps } from './plugin-form.ts';
+export type { BaoPluginAttributes, BaoPluginProps, BaoPluginType } from './plugin-form.ts';
+export interface BaoPlugin extends Resource<'Bao.Plugin', BaoPluginProps, BaoPluginAttributes, never, HttpClient.HttpClient> {
+}
+export declare const BaoPlugin: import("alchemy").ResourceClass<BaoPlugin>;
+export declare const BaoPluginProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoPlugin>, never, HttpClient.HttpClient>;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/openbao/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/openbao/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,cAAc,EAAoB,MAAM,kBAAkB,CAAC;AAInG,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3F,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAEH,eAAO,MAAM,iBAAiB,gGAuD3B,CAAC"}

package/dist/openbao/ssh-role-form.d.ts

@@ -1,3 +1,4 @@
+import { sshMountOf as mountOf } from './mount-path.ts';
 export interface BaoSshRoleProps {
     /** Role name, as `<mount>/roles/{name}` takes it. */
     name: string;
@@ -57,8 +58,7 @@ export interface BaoSshRoleAttributes extends Omit<BaoSshRoleForm, 'maxTtl' | 't
     /** SHA-256 of the managed fields — safe to persist; see policy.ts. */
     digest: string;
 }
-/** Mount path without a trailing slash; `ssh` when the caller did not say. */
-export declare const mountOf: (mount: string | undefined) => string;
+export { mountOf };
 export declare const readPath: (mount: string | undefined, name: string) => string;
 /**
  * ⚠️ SETS, NOT SEQUENCES. OpenBao stores these as one comma-separated string and promises
@@ -77,10 +77,11 @@ export declare const attributesOf: (form: BaoSshRoleForm, live: Record<string, u
 /**
  * ⛔ EVERY MANAGED FIELD IS SENT ON EVERY WRITE, INCLUDING THE FALSE ONES. The role write is
  *   a full replace (see ssh-role.ts), so an omitted field is not "left alone" — it is reset.
- *   Sending the resolved form makes the body and the declaration the same statement. All
- *   strings, exactly the `k=v` pairs `bao write` sent, for `PUT <mount>/roles/<name>`.
+ *   Sending the resolved form makes the body and the declaration the same statement. Strings,
+ *   exactly the `k=v` pairs `bao write` sent, for `PUT <mount>/roles/<name>` — except the two
+ *   maps, which must be objects (the ⛔ on mapValue).
  */
-export declare const writeBody: (form: BaoSshRoleForm) => Record<string, string>;
+export declare const writeBody: (form: BaoSshRoleForm) => Record<string, unknown>;
 /**
  * ⛔ AN UNPARSEABLE TTL IS A PLAN THAT NEVER GOES GREEN. parseDuration understands `0` and
  *   `<n>[smhd]` and nothing else. A prop like `4h30m` writes fine, reads back as 16200,

package/dist/openbao/ssh-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role-form.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,sEAAsE;IACtE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,qFAAqF;IACrF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,oFAAoF;IACpF,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,0FAA0F;IAC1F,sBAAsB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;AAEvD,sFAAsF;AACtF,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,KAAK,CAAC;IAClF;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,eAAO,MAAM,OAAO,UAAW,MAAM,GAAG,SAAS,WAAyC,CAAC;AAE3F,eAAO,MAAM,QAAQ,UAAW,MAAM,GAAG,SAAS,QAAQ,MAAM,WAC7B,CAAC;AAMpC;;;;GAIG;AACH,eAAO,MAAM,OAAO,UAAW,OAAO,KAAG,SAAS,MAAM,EAOvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,MAAM,UAAW,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAM5D,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,OAAO,UAAW,eAAe,KAAG,cAiB/C,CAAC;AAEH,eAAO,MAAM,YAAY,SACjB,cAAc,QACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,oBAqBF,CAAC;AAgBF;;;;;GAKG;AACH,eAAO,MAAM,SAAS,SAAU,cAAc,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAgBpE,CAAC;AAoBH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,cAAc,KAAG,SAAS,MAAM,EACuB,CAAC;AAE3F;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,eAAgB,oBAAoB,QAAQ,cAAc,YAe9B,CAAC"}
+{"version":3,"file":"ssh-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role-form.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,sEAAsE;IACtE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,qFAAqF;IACrF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,oFAAoF;IACpF,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,0FAA0F;IAC1F,sBAAsB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;AAEvD,sFAAsF;AACtF,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,KAAK,CAAC;IAClF;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,OAAO,EAAE,OAAO,EAAE,CAAC;AAEnB,eAAO,MAAM,QAAQ,UAAW,MAAM,GAAG,SAAS,QAAQ,MAAM,WAC7B,CAAC;AAMpC;;;;GAIG;AACH,eAAO,MAAM,OAAO,UAAW,OAAO,KAAG,SAAS,MAAM,EAOvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,MAAM,UAAW,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAM5D,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,OAAO,UAAW,eAAe,KAAG,cAiB/C,CAAC;AAEH,eAAO,MAAM,YAAY,SACjB,cAAc,QACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,oBAqBF,CAAC;AAiBF;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,SAAU,cAAc,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAgBrE,CAAC;AAoBH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,cAAc,KAAG,SAAS,MAAM,EACuB,CAAC;AAE3F;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,eAAgB,oBAAoB,QAAQ,cAAc,YAe9B,CAAC"}

package/dist/openbao/ssh-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-role.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,eAAe,EAQrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAyDH,eAAO,MAAM,kBAAkB,iGAsH5B,CAAC"}
+{"version":3,"file":"ssh-role.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,eAAe,EAQrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAyDH,eAAO,MAAM,kBAAkB,iGAqH5B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo and Talos.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/openbao/approle-login-form.test.ts

@@ -0,0 +1,64 @@
+/**
+ * The pure decisions behind appRoleLogin: which failure a status is, which mounts may be spliced
+ * into a URL, and what redaction removes. No server — approle-login.test.ts drives the fake.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { failureOf, loginPath, mountProblem, redact } from './approle-login-form.ts';
+
+describe('failureOf', () => {
+  it('reads 0 as unreachable, 2xx as a bad response, anything else as refused', () => {
+    assert.equal(failureOf(0), 'unreachable');
+    assert.equal(failureOf(200), 'response');
+    assert.equal(failureOf(204), 'response');
+    assert.equal(failureOf(400), 'refused');
+    assert.equal(failureOf(503), 'refused');
+  });
+});
+
+describe('mountProblem', () => {
+  it('accepts plain and nested mounts, trimming outer slashes', () => {
+    for (const mount of [undefined, 'approle', '/approle-hosts/', 'team/approle']) {
+      assert.equal(mountProblem(mount), undefined, String(mount));
+    }
+    assert.equal(loginPath('/team/approle/'), 'auth/team/approle/login');
+  });
+
+  it('refuses anything the URL parser would move or cut short', () => {
+    for (const mount of ['', '/', '..', 'a/../b', './a', 'a//b', 'a?b', 'a#b', 'a%2e', 'a b']) {
+      assert.notEqual(mountProblem(mount), undefined, mount);
+    }
+  });
+
+  it('trims long runs of slashes in linear time (no polynomial regex on caller input)', () => {
+    const run = '/'.repeat(200_000);
+    const started = performance.now();
+    assert.equal(loginPath(`${run}approle${run}`), 'auth/approle/login');
+    assert.notEqual(mountProblem(`${run}a${run}x`), undefined);
+    assert.ok(performance.now() - started < 1_000, 'slash trimming took over a second');
+  });
+});
+
+describe('redact', () => {
+  it('removes the raw value wherever it appears', () => {
+    assert.deepEqual(redact(['x secret-1 y secret-1'], ['secret-1']), [
+      'x [redacted] y [redacted]',
+    ]);
+  });
+
+  it('removes the %q form OpenBao echoes (path_login.go:291), escapes and all', () => {
+    const secret = 'a"b\\c';
+    const echoed = `invalid secret_id "a\\"b\\\\c"`;
+    assert.deepEqual(redact([echoed], [secret]), ['invalid secret_id "[redacted]"']);
+  });
+
+  it('redacts the longer value first, so a shorter one cannot split it', () => {
+    const [text] = redact(['role abc and secret abcdef'], ['abc', 'abcdef']);
+    assert.equal(text, 'role [redacted] and secret [redacted]');
+    assert.ok(!text?.includes('def'));
+  });
+
+  it('ignores an empty value rather than redacting every gap', () => {
+    assert.deepEqual(redact(['kept'], ['']), ['kept']);
+  });
+});

package/src/openbao/approle-login-form.ts

@@ -0,0 +1,153 @@
+/**
+ * The pure half of an AppRole login's INPUT and FAILURE: what counts as a usable input, and how a
+ * failure is described without the credential in it. Split from approle-login.ts so each decision
+ * is testable without a server; what a success hands back is approle-login-result.ts.
+ *
+ * ★ READ FROM openbao v2.6.2, NOT RECALLED:
+ *   · docs/api/auth/approle.mdx "Login with AppRole" — `role_id` and `secret_id` in, an `auth` block
+ *     out.
+ *   · api/auth/approle/approle.go:145-146 — the official Go helper writes `auth/<mount>/login`, and
+ *     the mount is `approle` unless the caller says otherwise. (api/*.go cited here diffed identical
+ *     between v2.6.0 and v2.6.2.)
+ */
+import { trimSlashes } from './mount-path.ts';
+
+/** Why a login or a revoke failed. */
+export type BaoLoginFailure =
+  /** Refused before any request was sent: an empty or padded value, or a mount that is not a path. */
+  | 'input'
+  /** OpenBao (or something at BAO_ADDR) answered with a non-2xx status. */
+  | 'refused'
+  /** No answer at all — transport, timeout, or an address nothing listens on. */
+  | 'unreachable'
+  /** A 2xx that is not a usable answer: not JSON, no auth block, or MFA still required. */
+  | 'response';
+
+/**
+ * The failure a transport-level BaoError stands for.
+ *
+ * ⚠️ A 2xx CAN FAIL TOO, AND IT IS NOT A REFUSAL. bao-status.ts settle fails a success whose body is
+ *   not a JSON object — the shape of a BAO_ADDR that points at some other web server. The first
+ *   version mapped every non-zero status to `refused`, so that read as `refused 200`: a server that
+ *   said yes, reported as one that said no.
+ */
+export const failureOf = (status: number): BaoLoginFailure =>
+  status === 0 ? 'unreachable' : status >= 200 && status < 300 ? 'response' : 'refused';
+
+/**
+ * A failed login or revoke.
+ *
+ * ⛔ IT NEVER CARRIES A CREDENTIAL. It is built from the operation name, a status and a list of
+ *   strings that have been through `redact` — never from the request, a header, or a `cause`, for
+ *   the reason bao-status.ts gives for BaoError.
+ */
+export class BaoLoginError extends Error {
+  constructor(
+    readonly reason: BaoLoginFailure,
+    /** The HTTP status, or 0 when none applies (input, unreachable, an unusable auth block). */
+    readonly status: number,
+    readonly errors: readonly string[],
+    operation: string,
+  ) {
+    const code = status === 0 ? reason : `${reason} ${String(status)}`;
+    super(`${operation}: ${code}: ${errors.join('; ') || '(no errors given)'}`);
+    this.name = 'BaoLoginError';
+  }
+}
+
+/**
+ * Why a value cannot be sent, or undefined when it can.
+ *
+ * ⚠️ PADDING IS REFUSED, NOT TRIMMED. `await Bun.file(path).text()` keeps a secret_id file's trailing
+ *   newline, and OpenBao answers that with "invalid role or secret ID" — the same words it uses for
+ *   a revoked or expired credential, so the real cause is invisible from the error. Trimming quietly
+ *   would send a different value from the one the caller holds; refusing names the problem.
+ * ⚠️ `unknown`, NOT `string`: a plain script passes `process.env.X`, which is `undefined` when unset.
+ */
+export const refusal = (label: string, value: unknown): string | undefined => {
+  if (typeof value !== 'string' || value === '') return `${label} is empty`;
+  if (value.trim() === '') return `${label} is only whitespace`;
+  if (value.trim() !== value) {
+    return `${label} has leading or trailing whitespace (a file read keeps its newline; trim it)`;
+  }
+  return undefined;
+};
+
+/** The auth mount without slashes; `approle` when the caller did not say. */
+export const loginMount = (mount: string | undefined): string => trimSlashes(mount ?? 'approle');
+
+/**
+ * Why `mount` cannot name an auth mount, or undefined when it can.
+ *
+ * ⛔ THE MOUNT IS SPLICED INTO A URL, AND THE URL PARSER RESOLVES `..` AND ENDS THE PATH AT `?` OR
+ *   `#`. `new URL('…/v1/auth/../sys/x/login')` is `…/v1/sys/x/login` — the role_id and secret_id
+ *   would be sent to a path the caller never named. Refused rather than escaped, like padding.
+ */
+export const mountProblem = (mount: string | undefined): string | undefined => {
+  const path = loginMount(mount);
+  if (path === '') return 'mount is empty';
+  const segments = path.split('/');
+  if (
+    /[\s?#%\\]/.test(path) ||
+    segments.some((part) => part === '' || part === '.' || part === '..')
+  ) {
+    return `mount ${JSON.stringify(path)} is not a plain mount path`;
+  }
+  return undefined;
+};
+
+/** `auth/<mount>/login` — what api/auth/approle/approle.go:145 writes. */
+export const loginPath = (mount: string | undefined): string => `auth/${loginMount(mount)}/login`;
+
+/** strconv.Quote's single-letter escapes, by code point. */
+const GO_ESCAPES: Readonly<Record<number, string>> = {
+  7: 'a',
+  8: 'b',
+  9: 't',
+  10: 'n',
+  11: 'v',
+  12: 'f',
+  13: 'r',
+};
+
+/**
+ * `value` as it appears between the quotes of Go's `%q` (strconv.Quote) — ASCII escapes only.
+ * ⚠️ Non-ASCII passes through as-is, which is what strconv.Quote does for PRINTABLE runes; a
+ *   non-printable non-ASCII rune in a secret would escape differently and is not covered.
+ */
+const goQuoted = (value: string): string =>
+  [...value]
+    .map((char) => {
+      const code = char.codePointAt(0) ?? 0;
+      const named = GO_ESCAPES[code];
+      if (char === '"' || char === '\\') return `\\${char}`;
+      if (named !== undefined) return `\\${named}`;
+      if (code < 0x20 || code === 0x7f) return `\\x${code.toString(16).padStart(2, '0')}`;
+      return char;
+    })
+    .join('');
+
+/**
+ * Every string in `errors` with each credential replaced by `[redacted]`.
+ *
+ * ⛔ OPENBAO CAN ECHO THE SECRET_ID BACK, SO THIS IS NOT DEFENCE IN DEPTH — IT IS THE DEFENCE.
+ *   openbao v2.6.2 builtin/credential/approle/path_login.go:291 answers a limited-use secret_id
+ *   whose storage entry vanished between two reads with `invalid secret_id "<the secret_id>"`.
+ *   BaoError keeps OpenBao's `errors` verbatim (that is its job), so every string that leaves the
+ *   login or revoke passes through here first.
+ * ⚠️ THAT ECHO IS `%q`, SO THE RAW VALUE IS NOT ENOUGH. A custom secret_id holding `"` or `\` comes
+ *   back escaped (`\"`, `\\`) and would slip past a raw match; the Go-quoted form is redacted too.
+ * ⚠️ LONGEST FIRST. Were one value a substring of another, redacting the shorter first would break
+ *   the longer one's match and leave the rest of it in the message.
+ */
+export const redact = (
+  errors: readonly string[],
+  secrets: readonly string[],
+): readonly string[] => {
+  const forms = [...new Set(secrets.flatMap((secret) => [secret, goQuoted(secret)]))]
+    .filter((form) => form !== '')
+    .sort((a, b) => b.length - a.length);
+  return errors.map((entry) =>
+    forms.reduce((text, form) => text.split(form).join('[redacted]'), entry),
+  );
+};

package/src/openbao/approle-login-result.ts

@@ -0,0 +1,96 @@
+/**
+ * What a successful AppRole login hands back, and how it is read out of a 2xx body. Split from
+ * approle-login-form.ts, which decides what goes IN; this decides what comes OUT and how the token
+ * stays out of every log line that prints the result.
+ *
+ * ★ READ FROM openbao v2.6.2 api/secret.go:304-318 SecretAuth — `client_token`, `accessor`,
+ *   `policies`, `lease_duration` and `mfa_requirement`. (api/*.go cited here diffed identical
+ *   between v2.6.0 and v2.6.2.)
+ */
+
+/** What a successful login hands back. */
+export interface AppRoleLogin {
+  /**
+   * The token. ⛔ A GETTER OVER A PRIVATE FIELD, NEVER AN OWN PROPERTY — see LoginResult below.
+   * `console.log(login)` prints `clientToken: [Getter]` at most, and `JSON.stringify(login)`,
+   * `{ ...login }` and `structuredClone(login)` carry no token at all. Read it by name.
+   */
+  readonly clientToken: string;
+  /** The token's accessor — safe to log, and what revoke-accessor and audit lines name. */
+  readonly accessor: string;
+  /** Every policy on the token: the role's token_policies plus identity policies. */
+  readonly policies: readonly string[];
+  /** The token TTL in seconds, from the role's `token_ttl`. */
+  readonly leaseDurationSeconds: number;
+}
+
+/**
+ * ⛔ A PRIVATE FIELD BEHIND A PROTOTYPE GETTER, BECAUSE A NON-ENUMERABLE PROPERTY DID NOT HIDE THE
+ *   TOKEN UNDER BUN. MEASURED 2026-09-21 on bun 1.4.0: `console.log` of an object whose token was a
+ *   non-enumerable OWN property printed `clientToken: "<the token>"` in full — node's util.inspect
+ *   hid it, bun's formatter did not — and this helper exists for Bun scripts. The first version
+ *   shipped exactly that shape, with a test that checked JSON and Object.keys but never a print.
+ *   This shape prints `clientToken: [Getter]` under bun's console.log and Bun.inspect, and nothing
+ *   at all under node's default inspect.
+ * ⚠️ `util.inspect(login, { getters: true })` DOES evaluate the getter. That is an explicit request
+ *   for the value, not an accident of logging the result.
+ */
+class LoginResult implements AppRoleLogin {
+  readonly #token: string;
+  readonly accessor: string;
+  readonly policies: readonly string[];
+  readonly leaseDurationSeconds: number;
+
+  constructor(token: string, accessor: string, policies: readonly string[], lease: number) {
+    this.#token = token;
+    this.accessor = accessor;
+    this.policies = Object.freeze([...policies]);
+    this.leaseDurationSeconds = lease;
+    Object.freeze(this);
+  }
+
+  get clientToken(): string {
+    return this.#token;
+  }
+}
+
+const strings = (value: unknown): readonly string[] =>
+  Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string') : [];
+
+/**
+ * The login in a 2xx body, or the reason there is none.
+ *
+ * ⚠️ AN EMPTY `client_token` WITH A `mfa_requirement` IS AN UNFINISHED LOGIN, NOT A BROKEN ONE. The
+ *   auth block carries that field for a login that still owes an MFA step (api/secret.go:317). A
+ *   script cannot complete that step, so it is named rather than reported as a missing field.
+ *   REASONED FROM THE CLIENT TYPE — no MFA-enforced login was run.
+ * ⛔ THE BODY IS NEVER QUOTED. It holds the token on success and is not OpenBao's on a wrong address.
+ */
+export const loginOf = (
+  body: Record<string, unknown> | undefined,
+): { readonly login: AppRoleLogin } | { readonly problem: string } => {
+  const auth = body?.['auth'];
+  if (typeof auth !== 'object' || auth === null || Array.isArray(auth)) {
+    return { problem: 'the answer carried no auth block' };
+  }
+  const fields = auth as Record<string, unknown>;
+  const token = fields['client_token'];
+  if (typeof token !== 'string' || token === '') {
+    const mfa = fields['mfa_requirement'];
+    return {
+      problem:
+        mfa !== undefined && mfa !== null
+          ? 'the login requires MFA, which this helper does not complete'
+          : 'the auth block carried no client_token',
+    };
+  }
+  const lease = fields['lease_duration'];
+  return {
+    login: new LoginResult(
+      token,
+      typeof fields['accessor'] === 'string' ? fields['accessor'] : '',
+      strings(fields['policies']),
+      typeof lease === 'number' && Number.isFinite(lease) ? lease : 0,
+    ),
+  };
+};