@homeflare/alchemy 0.4.1 → 0.6.0

package/dist/launchd/launchctl.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The four `launchctl` subcommands LaunchdJob uses — print, print-disabled, bootstrap, bootout —
+ * over a HostRunner, plus the parsers for the two read-only ones.
+ *
+ * ★ MEASURED 2026-09-21 ON macOS 27.2 (read-only `print` / `print-disabled` only; nothing was
+ *   bootstrapped or booted out to write this):
+ *   - `print system/<unknown>` exits **113** with "Could not find service … in domain for system"
+ *     on stderr. 113 is therefore "not loaded", not an error.
+ *   - `print` of a loaded job is a `<target> = {` block. Its own fields sit one tab deep
+ *     (`\tstate = running`, `\tpid = 1219`, `\tlast exit code = 0` or `(never exited)`); nested
+ *     blocks (`resource coalition`, `semaphores`) repeat names like `state` two tabs deep.
+ *   - `print-disabled <domain>` lists `"label" => enabled|disabled`.
+ *   - reading needs no root: a uid-501 shell printed system-domain jobs.
+ *   - `print gui/<uid>/<label>` for a uid with NO LOGIN SESSION exits **112** with "Could not find
+ *     domain for user gui: <uid>" (and so does `print-disabled gui/<uid>`); a malformed target is
+ *     64, a missing service in a live gui domain is 113. So 112 + that text is "the domain does
+ *     not exist", which means the job cannot be loaded — not an error for a read or a delete.
+ * ⚠️ REASONED, NOT MEASURED: bootstrap/bootout exit codes. nix-darwin's own activation script on the
+ *   same host notes "`bootout` on an already-absent job is a no-op that returns non-zero", which is
+ *   why bootout here is always preceded by a print and followed by a poll, never trusted alone.
+ * ⛔ NEVER PUT `print` STDOUT IN AN ERROR. It contains the job's whole environment.
+ */
+import type { HostRunner } from './runner.ts';
+export declare const LAUNCHCTL = "/bin/launchctl";
+/** `launchctl print` of an unknown service — measured, see above. */
+export declare const NOT_FOUND = 113;
+/** `launchctl print` into a gui domain with no login session — measured, see above. */
+export declare const NO_DOMAIN = 112;
+export declare class LaunchctlError extends Error {
+    constructor(command: string, exitCode: number, stderr: string);
+}
+export type ServiceStatus = {
+    readonly loaded: boolean;
+    /** The domain itself is absent (a gui/<uid> with no login session). Implies `loaded: false`. */
+    readonly domainMissing?: true;
+    readonly state?: string;
+    readonly pid?: number;
+    readonly lastExitCode?: number;
+};
+/**
+ * The job block's own `key = value` lines, ignoring nested blocks.
+ * ⚠️ A multi-line ProgramArguments entry is printed raw inside `arguments = {`, so a close is only
+ *   accepted when its indentation matches the open. An argument that itself contains a line of
+ *   exactly one tab and `}` would still desynchronise this; no real job has one.
+ */
+export declare const printFields: (stdout: string) => Map<string, string>;
+export declare const parsePrint: (stdout: string) => ServiceStatus;
+/** Labels `print-disabled` reports as disabled. Older releases printed `=> true` for disabled. */
+export declare const parseDisabled: (stdout: string) => Set<string>;
+export declare const printService: (runner: HostRunner, target: string) => Promise<ServiceStatus>;
+export declare const isDisabled: (runner: HostRunner, domain: string, label: string) => Promise<boolean>;
+export declare const bootstrap: (runner: HostRunner, domain: string, plistPath: string) => Promise<void>;
+/**
+ * Poll `print` until the service is gone. ⚠️ bootout can return before launchd lets go of it.
+ * ★ 30 s, because a job gets SIGTERM and then its ExitTimeOut before SIGKILL: launchd.plist(5)
+ *   documents a 20 s default (a macOS 27.2 `print` showed `exit timeout = 5` for a job that sets
+ *   none). Giving up sooner would fail a deploy over a job that was, correctly, still exiting.
+ */
+export declare const waitUnloaded: (runner: HostRunner, target: string, attempts?: number, intervalMs?: number) => Promise<void>;
+/** Boot a service out if it is loaded, and wait until launchd has let go. Idempotent. */
+export declare const bootoutIfLoaded: (runner: HostRunner, target: string) => Promise<void>;
+//# sourceMappingURL=launchctl.d.ts.map

package/dist/launchd/launchctl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchctl.d.ts","sourceRoot":"","sources":["../../src/launchd/launchctl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAC1C,qEAAqE;AACrE,eAAO,MAAM,SAAS,MAAM,CAAC;AAC7B,uFAAuF;AACvF,eAAO,MAAM,SAAS,MAAM,CAAC;AAG7B,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAG5D;CACF;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,gGAAgG;IAChG,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,WAAY,MAAM,KAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAuB9D,CAAC;AAOF,eAAO,MAAM,UAAU,WAAY,MAAM,KAAG,aAY3C,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,aAAa,WAAY,MAAM,KAAG,GAAG,CAAC,MAAM,CAQxD,CAAC;AAEF,eAAO,MAAM,YAAY,WAAkB,UAAU,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CAW5F,CAAC;AAEF,eAAO,MAAM,UAAU,WACb,UAAU,UACV,MAAM,SACP,MAAM,KACZ,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF,eAAO,MAAM,SAAS,WACZ,UAAU,UACV,MAAM,aACH,MAAM,KAChB,OAAO,CAAC,IAAI,CAKd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,WACf,UAAU,UACV,MAAM,6CAGb,OAAO,CAAC,IAAI,CAQd,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,eAAe,WAAkB,UAAU,UAAU,MAAM,KAAG,OAAO,CAAC,IAAI,CAqBtF,CAAC"}

package/dist/launchd/local-runner.d.ts

@@ -0,0 +1,7 @@
+import type { HostRunner } from './runner.ts';
+export type LocalRunnerOptions = {
+    /** Kill a spawned program after this long. @default 120_000 */
+    readonly execTimeoutMs?: number;
+};
+export declare const localRunner: (options?: LocalRunnerOptions) => HostRunner;
+//# sourceMappingURL=local-runner.d.ts.map

package/dist/launchd/local-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/local-runner.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAwB,UAAU,EAAgB,MAAM,aAAa,CAAC;AAElF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAyEF,eAAO,MAAM,WAAW,aAAa,kBAAkB,KAAQ,UAgD9D,CAAC"}

package/dist/launchd/plist.d.ts

@@ -0,0 +1,41 @@
+/**
+ * An XML property list serializer — the subset launchd.plist(5) reads, and nothing else.
+ *
+ * ★ WHY NOT AN npm LIBRARY. Nothing in this workspace depends on one (checked 2026-09-21: no
+ *   `plist`, `xmlbuilder` or `@xmldom/xmldom` anywhere under node_modules), and the common one pulls
+ *   an XML DOM in for PARSING, which a provider that only RENDERS never does. The subset a launchd
+ *   job needs is five node types, so this is ~100 lines plus exhaustive tests (plist.test.ts), which
+ *   also round-trip every case through Apple's own `plutil` when the tests run on macOS.
+ *
+ * ⛔ THE OUTPUT MUST BE DETERMINISTIC. LaunchdJob diffs by the SHA-256 of these bytes, so two
+ *   renders of one declaration must be byte-identical: dict keys are sorted, indentation is fixed,
+ *   and nothing depends on insertion order. A non-deterministic render is a forever-`update`.
+ * ⚠️ AND A CHANGE TO THIS FILE'S OUTPUT RESTARTS EVERY JOB. A new header, indent or escape changes
+ *   every digest, so the next deploy after the kit upgrade updates — restarts — every declared
+ *   job at once. Treat any byte change here as a breaking change and say so in its changeset.
+ *
+ * ⛔ REFUSE, NEVER COERCE. `undefined`, `null`, a fraction, NaN, a class instance or a character XML
+ *   1.0 cannot carry is a thrown PlistError naming the path, not a silently dropped key. A dropped
+ *   `KeepAlive` is a daemon that never restarts, and nothing downstream would say why.
+ */
+/** Every value launchd reads. ⚠️ No `<real>`, `<date>` or `<data>`: no launchd key needs one. */
+export type PlistValue = string | number | boolean | readonly PlistValue[] | {
+    readonly [key: string]: PlistValue;
+};
+export type PlistDict = {
+    readonly [key: string]: PlistValue;
+};
+export declare class PlistError extends Error {
+    readonly path: string;
+    constructor(path: string, detail: string);
+}
+/**
+ * Escape text content.
+ * ⚠️ CR IS A CHARACTER REFERENCE, NOT A LITERAL. An XML parser normalises a literal CR (and CRLF)
+ *   to LF before the application sees it (XML 1.0 §2.11), so `a\r\nb` would come back as `a\nb` and
+ *   the argument launchd passes would differ from the one declared. `&#13;` survives normalisation.
+ */
+export declare const escapeText: (text: string, path: string) => string;
+/** Render a top-level dict as a complete XML plist document, ending in a newline. */
+export declare const renderPlist: (dict: PlistDict) => string;
+//# sourceMappingURL=plist.d.ts.map

package/dist/launchd/plist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plist.d.ts","sourceRoot":"","sources":["../../src/launchd/plist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,iGAAiG;AACjG,MAAM,MAAM,UAAU,GAClB,MAAM,GACN,MAAM,GACN,OAAO,GACP,SAAS,UAAU,EAAE,GACrB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,CAAC;AAE/D,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,IAAI,EAAE,MAAM;IADvB,YACW,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EAIf;CACF;AAoBD;;;;;GAKG;AACH,eAAO,MAAM,UAAU,SAAU,MAAM,QAAQ,MAAM,KAAG,MAcvD,CAAC;AAoEF,qFAAqF;AACrF,eAAO,MAAM,WAAW,SAAU,SAAS,KAAG,MAO7C,CAAC"}

package/dist/launchd/providers.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Both launchd-subpath providers with one HostRunner, as a single layer for a host stack.
+ *
+ *     Layer.mergeAll(launchdProviders(), …the stack's other providers)
+ *
+ * ★ ONE RUNNER FOR BOTH, so a daemon's config file (HostFile) and the daemon (LaunchdJob) are
+ *   written by the same identity on the same host — a stack cannot write the file as one user and
+ *   bootstrap the job as another by accident.
+ * ⚠️ The default is localRunner(): this process, never elevated. A system-domain job therefore
+ *   needs the deploy itself started as root, or a runner passed here with `privileged: true`.
+ */
+import * as Layer from 'effect/Layer';
+import { type HostRunner } from './runner.ts';
+export declare const launchdProviders: (runner?: HostRunner) => Layer.Layer<import("alchemy").Provider<import("./host-file.ts").HostFile> | import("alchemy").Provider<import("./job.ts").LaunchdJob>, never, never>;
+//# sourceMappingURL=providers.d.ts.map

package/dist/launchd/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/launchd/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,aAAa,CAAC;AAE/D,eAAO,MAAM,gBAAgB,YAAY,UAAU,yJAGhD,CAAC"}

package/dist/launchd/runner.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The one seam between the launchd providers and the host: every file read, file write and
+ * `launchctl` call goes through a HostRunner, and nothing in this directory touches the host any
+ * other way.
+ *
+ * ★ WHY A SEAM AND NOT DIRECT node:fs CALLS. launchd has no SDK — the provider renders a plist and
+ *   drives `launchctl` — so the only way to test the lifecycle without a real launchd (and without
+ *   writing /Library) is to swap the host out. fake-runner.ts is an in-memory host with a scripted
+ *   launchd; local-runner.ts is the real one. The same seam is where a consumer plugs in a runner
+ *   that reaches a host some other way.
+ *
+ * ★ PROMISES, NOT EFFECTS, ON PURPOSE. A consumer writing their own runner implements plain async
+ *   functions; the providers lift them into Effect at the call site (host-effect.ts).
+ */
+import * as Context from 'effect/Context';
+import * as Layer from 'effect/Layer';
+/** One finished process. ⛔ `stdout` may carry anything the job's environment holds — never log it. */
+export type ExecResult = {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+};
+/**
+ * What `lstat` says about a path. ⚠️ lstat, not stat: a symlink is reported as a symlink, because
+ *   writing through one would change a file this resource never named.
+ */
+export type FileStat = {
+    readonly kind: 'file' | 'directory' | 'symlink' | 'other';
+    /** Permission bits only (`& 0o7777`), never the file-type bits. */
+    readonly mode: number;
+    readonly uid: number;
+    readonly gid: number;
+    readonly size: number;
+};
+export type WriteOptions = {
+    /** Permission bits for the final file, applied BEFORE it becomes visible at `path`. */
+    readonly mode: number;
+    /** Numeric owner; omitted means whoever the runner writes as. */
+    readonly uid?: number;
+    /** Numeric group; omitted means the directory's default. */
+    readonly gid?: number;
+};
+export type HostUser = {
+    readonly uid: number;
+    readonly gid: number;
+    readonly home: string;
+};
+export interface HostRunner {
+    /**
+     * ⛔ DECLARED, NEVER INFERRED. `true` only when every call this runner makes already runs with
+     *   root's authority — a runner that talks to a root helper, say. The providers refuse
+     *   system-domain writes unless `effectiveUid()` is 0 or this is `true`, so claiming it falsely
+     *   turns that refusal into an EACCES halfway through a deploy.
+     * ⛔ THE KIT NEVER ELEVATES. No runner here calls `sudo`: a deploy that prompts for a password
+     *   mid-plan, or silently uses a cached sudo ticket, is exactly the "no silent sudo" failure. A
+     *   consumer who wants elevation writes that runner deliberately and sets this flag.
+     */
+    readonly privileged: boolean;
+    /** The uid file writes and launchctl calls run as. */
+    effectiveUid(): number;
+    /** Run a program with an argv — ⛔ never through a shell. */
+    exec(argv: readonly string[]): Promise<ExecResult>;
+    /** File bytes, or `undefined` when nothing is at `path`. */
+    readFile(path: string): Promise<Uint8Array | undefined>;
+    /** lstat, or `undefined` when nothing is at `path`. */
+    stat(path: string): Promise<FileStat | undefined>;
+    /**
+     * Write `bytes` so that `path` holds either the old file or the new one, never a torn mix:
+     * a temporary file in the same directory, mode and owner set on it, then rename(2) over `path`.
+     * ⚠️ The parent directory must exist; creating it would invent an owner and mode nobody declared.
+     */
+    writeFileAtomic(path: string, bytes: Uint8Array, options: WriteOptions): Promise<void>;
+    /** Remove a file. Idempotent: nothing at `path` is success. */
+    removeFile(path: string): Promise<void>;
+    /** A user by name or numeric id, or `undefined` when the host has none. */
+    lookupUser(nameOrId: string): Promise<HostUser | undefined>;
+    /** A group's gid by name or numeric id, or `undefined` when the host has none. */
+    lookupGroup(nameOrId: string): Promise<number | undefined>;
+    /** Wait between launchctl polls. ★ Injected so a test never sleeps for real. */
+    sleep(ms: number): Promise<void>;
+}
+declare const HostRunnerService_base: Context.ServiceClass<HostRunnerService, "homeflare/launchd/HostRunner", HostRunner>;
+/** The Effect service every launchd provider reads its runner from. */
+export declare class HostRunnerService extends HostRunnerService_base {
+}
+/** Provide a runner to the providers: `Layer.provide(hostRunnerLayer(localRunner()))`. */
+export declare const hostRunnerLayer: (runner: HostRunner) => Layer.Layer<HostRunnerService>;
+/** True when this runner may write root-owned paths and drive the system domain. */
+export declare const canActAsRoot: (runner: HostRunner) => boolean;
+export {};
+//# sourceMappingURL=runner.d.ts.map

package/dist/launchd/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/launchd/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,sGAAsG;AACtG,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1D,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,UAAU;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,YAAY,IAAI,MAAM,CAAC;IACvB,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACxD,uDAAuD;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAClD;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,+DAA+D;IAC/D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,2EAA2E;IAC3E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC5D,kFAAkF;IAClF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3D,gFAAgF;IAChF,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;;AAED,uEAAuE;AACvE,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,eAAe,WAAY,UAAU,KAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;AAE3C,oFAAoF;AACpF,eAAO,MAAM,YAAY,WAAY,UAAU,KAAG,OACA,CAAC"}

package/dist/launchd/secret-tripwire.d.ts

@@ -0,0 +1,23 @@
+/**
+ * A tripwire for the obvious ways a secret ends up in Alchemy state through these providers.
+ *
+ * ⛔ WHY IT EXISTS. Alchemy persists every prop UNENCRYPTED in its state store — the same reason
+ *   the OpenBao families are metadata-only (openbao/policy.ts). A LaunchdJob's `environment` and
+ *   `programArguments`, and a HostFile's `content`, are props. A token declared there is a token
+ *   copied into the state store, into every plan diff, and into the plist or file on disk.
+ * ★ THE ALTERNATIVE, NAMED IN EVERY REFUSAL: let a secret renderer (openbao-agent, or any other)
+ *   write the secret to a root-owned file, and declare only its PATH — `FOO_TOKEN_FILE=/path`,
+ *   `--token-file /path`. The job reads the file at start; the state holds a path.
+ *
+ * ⚠️ A TRIPWIRE, NOT A SCANNER. It catches the names and shapes people actually type. A token in
+ *   an innocently named variable passes; nothing here can make a secret safe to declare.
+ */
+import type { PlistDict } from './plist.ts';
+/**
+ * Refusals for a job's environment, argv and extraKeys. Empty means nothing tripped.
+ * ★ extraKeys too: it is a prop like the others, so it lands in state just the same.
+ */
+export declare const jobSecretProblems: (environment: Readonly<Record<string, string>> | undefined, argv: readonly string[], extraKeys?: PlistDict) => string[];
+/** Refusals for a HostFile's content. */
+export declare const fileSecretProblems: (content: string) => string[];
+//# sourceMappingURL=secret-tripwire.d.ts.map

package/dist/launchd/secret-tripwire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-tripwire.d.ts","sourceRoot":"","sources":["../../src/launchd/secret-tripwire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AAgCxD;;;GAGG;AACH,eAAO,MAAM,iBAAiB,gBACf,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,QACnD,SAAS,MAAM,EAAE,cACX,SAAS,KACpB,MAAM,EAsBR,CAAC;AAEF,yCAAyC;AACzC,eAAO,MAAM,kBAAkB,YAAa,MAAM,KAAG,MAAM,EACuB,CAAC"}

package/dist/openbao/approle-login-form.d.ts

@@ -0,0 +1,72 @@
+/** Why a login or a revoke failed. */
+export type BaoLoginFailure = 
+/** Refused before any request was sent: an empty or padded value, or a mount that is not a path. */
+'input'
+/** OpenBao (or something at BAO_ADDR) answered with a non-2xx status. */
+ | 'refused'
+/** No answer at all — transport, timeout, or an address nothing listens on. */
+ | 'unreachable'
+/** A 2xx that is not a usable answer: not JSON, no auth block, or MFA still required. */
+ | 'response';
+/**
+ * The failure a transport-level BaoError stands for.
+ *
+ * ⚠️ A 2xx CAN FAIL TOO, AND IT IS NOT A REFUSAL. bao-status.ts settle fails a success whose body is
+ *   not a JSON object — the shape of a BAO_ADDR that points at some other web server. The first
+ *   version mapped every non-zero status to `refused`, so that read as `refused 200`: a server that
+ *   said yes, reported as one that said no.
+ */
+export declare const failureOf: (status: number) => BaoLoginFailure;
+/**
+ * A failed login or revoke.
+ *
+ * ⛔ IT NEVER CARRIES A CREDENTIAL. It is built from the operation name, a status and a list of
+ *   strings that have been through `redact` — never from the request, a header, or a `cause`, for
+ *   the reason bao-status.ts gives for BaoError.
+ */
+export declare class BaoLoginError extends Error {
+    readonly reason: BaoLoginFailure;
+    /** The HTTP status, or 0 when none applies (input, unreachable, an unusable auth block). */
+    readonly status: number;
+    readonly errors: readonly string[];
+    constructor(reason: BaoLoginFailure, 
+    /** The HTTP status, or 0 when none applies (input, unreachable, an unusable auth block). */
+    status: number, errors: readonly string[], operation: string);
+}
+/**
+ * Why a value cannot be sent, or undefined when it can.
+ *
+ * ⚠️ PADDING IS REFUSED, NOT TRIMMED. `await Bun.file(path).text()` keeps a secret_id file's trailing
+ *   newline, and OpenBao answers that with "invalid role or secret ID" — the same words it uses for
+ *   a revoked or expired credential, so the real cause is invisible from the error. Trimming quietly
+ *   would send a different value from the one the caller holds; refusing names the problem.
+ * ⚠️ `unknown`, NOT `string`: a plain script passes `process.env.X`, which is `undefined` when unset.
+ */
+export declare const refusal: (label: string, value: unknown) => string | undefined;
+/** The auth mount without slashes; `approle` when the caller did not say. */
+export declare const loginMount: (mount: string | undefined) => string;
+/**
+ * Why `mount` cannot name an auth mount, or undefined when it can.
+ *
+ * ⛔ THE MOUNT IS SPLICED INTO A URL, AND THE URL PARSER RESOLVES `..` AND ENDS THE PATH AT `?` OR
+ *   `#`. `new URL('…/v1/auth/../sys/x/login')` is `…/v1/sys/x/login` — the role_id and secret_id
+ *   would be sent to a path the caller never named. Refused rather than escaped, like padding.
+ */
+export declare const mountProblem: (mount: string | undefined) => string | undefined;
+/** `auth/<mount>/login` — what api/auth/approle/approle.go:145 writes. */
+export declare const loginPath: (mount: string | undefined) => string;
+/**
+ * Every string in `errors` with each credential replaced by `[redacted]`.
+ *
+ * ⛔ OPENBAO CAN ECHO THE SECRET_ID BACK, SO THIS IS NOT DEFENCE IN DEPTH — IT IS THE DEFENCE.
+ *   openbao v2.6.2 builtin/credential/approle/path_login.go:291 answers a limited-use secret_id
+ *   whose storage entry vanished between two reads with `invalid secret_id "<the secret_id>"`.
+ *   BaoError keeps OpenBao's `errors` verbatim (that is its job), so every string that leaves the
+ *   login or revoke passes through here first.
+ * ⚠️ THAT ECHO IS `%q`, SO THE RAW VALUE IS NOT ENOUGH. A custom secret_id holding `"` or `\` comes
+ *   back escaped (`\"`, `\\`) and would slip past a raw match; the Go-quoted form is redacted too.
+ * ⚠️ LONGEST FIRST. Were one value a substring of another, redacting the shorter first would break
+ *   the longer one's match and leave the rest of it in the message.
+ */
+export declare const redact: (errors: readonly string[], secrets: readonly string[]) => readonly string[];
+//# sourceMappingURL=approle-login-form.d.ts.map

package/dist/openbao/approle-login-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approle-login-form.d.ts","sourceRoot":"","sources":["../../src/openbao/approle-login-form.ts"],"names":[],"mappings":"AAcA,sCAAsC;AACtC,MAAM,MAAM,eAAe;AACzB,oGAAoG;AAClG,OAAO;AACT,yEAAyE;GACvE,SAAS;AACX,+EAA+E;GAC7E,aAAa;AACf,yFAAyF;GACvF,UAAU,CAAC;AAEf;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,WAAY,MAAM,KAAG,eAC4C,CAAC;AAExF;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAEpC,QAAQ,CAAC,MAAM,EAAE,eAAe;IAChC,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE;IAJpC,YACW,MAAM,EAAE,eAAe;IAChC,4FAA4F;IACnF,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,MAAM,EAAE,EAClC,SAAS,EAAE,MAAM,EAKlB;CACF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,UAAW,MAAM,SAAS,OAAO,KAAG,MAAM,GAAG,SAOhE,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,UAAU,UAAW,MAAM,GAAG,SAAS,KAAG,MAAyC,CAAC;AAEjG;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,UAAW,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAWjE,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,SAAS,UAAW,MAAM,GAAG,SAAS,KAAG,MAA2C,CAAC;AA8BlG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,MAAM,WACT,SAAS,MAAM,EAAE,WAChB,SAAS,MAAM,EAAE,KACzB,SAAS,MAAM,EAOjB,CAAC"}

package/dist/openbao/approle-login-result.d.ts

@@ -0,0 +1,39 @@
+/**
+ * What a successful AppRole login hands back, and how it is read out of a 2xx body. Split from
+ * approle-login-form.ts, which decides what goes IN; this decides what comes OUT and how the token
+ * stays out of every log line that prints the result.
+ *
+ * ★ READ FROM openbao v2.6.2 api/secret.go:304-318 SecretAuth — `client_token`, `accessor`,
+ *   `policies`, `lease_duration` and `mfa_requirement`. (api/*.go cited here diffed identical
+ *   between v2.6.0 and v2.6.2.)
+ */
+/** What a successful login hands back. */
+export interface AppRoleLogin {
+    /**
+     * The token. ⛔ A GETTER OVER A PRIVATE FIELD, NEVER AN OWN PROPERTY — see LoginResult below.
+     * `console.log(login)` prints `clientToken: [Getter]` at most, and `JSON.stringify(login)`,
+     * `{ ...login }` and `structuredClone(login)` carry no token at all. Read it by name.
+     */
+    readonly clientToken: string;
+    /** The token's accessor — safe to log, and what revoke-accessor and audit lines name. */
+    readonly accessor: string;
+    /** Every policy on the token: the role's token_policies plus identity policies. */
+    readonly policies: readonly string[];
+    /** The token TTL in seconds, from the role's `token_ttl`. */
+    readonly leaseDurationSeconds: number;
+}
+/**
+ * The login in a 2xx body, or the reason there is none.
+ *
+ * ⚠️ AN EMPTY `client_token` WITH A `mfa_requirement` IS AN UNFINISHED LOGIN, NOT A BROKEN ONE. The
+ *   auth block carries that field for a login that still owes an MFA step (api/secret.go:317). A
+ *   script cannot complete that step, so it is named rather than reported as a missing field.
+ *   REASONED FROM THE CLIENT TYPE — no MFA-enforced login was run.
+ * ⛔ THE BODY IS NEVER QUOTED. It holds the token on success and is not OpenBao's on a wrong address.
+ */
+export declare const loginOf: (body: Record<string, unknown> | undefined) => {
+    readonly login: AppRoleLogin;
+} | {
+    readonly problem: string;
+};
+//# sourceMappingURL=approle-login-result.d.ts.map

package/dist/openbao/approle-login-result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approle-login-result.d.ts","sourceRoot":"","sources":["../../src/openbao/approle-login-result.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,6DAA6D;IAC7D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAmCD;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,SACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KACxC;IAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAyB/D,CAAC"}

package/dist/openbao/approle-login.d.ts

@@ -0,0 +1,77 @@
+/**
+ * AppRole login and self-revoke for a plain Bun script — the one part of the openbao subpath that is
+ * not a Resource.
+ *
+ * ★ WHY IT LIVES HERE. Wrapper scripts log in with a per-host AppRole and revoke the token on exit.
+ *   Each one hand-rolling a `fetch` is how two of them end up disagreeing about BAO_ADDR versus
+ *   BAO_AGENT_ADDR, or dropping the namespace header. This rides the transport every Bao.* family
+ *   already uses: bao-address.ts resolution (BAO_ADDR, BAO_AGENT_ADDR, BAO_NAMESPACE, the VAULT_*
+ *   twins, unix sockets), bao-http.ts's in-flight gate, timeout, transport retry and token
+ *   redaction on spans, and bao-status.ts's status-first classification of the answer.
+ * ★ ONE IMPLEMENTATION, TWO SHAPES. `appRoleLoginEffect` and `revokeSelfEffect` are the
+ *   implementation; `appRoleLogin` and `revokeSelf` run them on the fetch client for a caller with
+ *   no Effect runtime. Both fail with BaoLoginError and nothing else.
+ *
+ * ⚠️ SHARING A secret_id ACROSS HOSTS THROUGH A CACHING PROXY SHARES THE TOKEN. Two hosts sending
+ *   the same AppRole login through a caching OpenBao Proxy get the SAME cached token back, so two
+ *   hosts become one identity in every audit line (recorded as a trap in the 2026-09-21 vault
+ *   consolidation plan; not re-measured here). Give each host its own secret_id.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoEnvironment } from './bao-address.ts';
+import { BaoLoginError } from './approle-login-form.ts';
+import { type AppRoleLogin } from './approle-login-result.ts';
+export type { BaoLoginFailure } from './approle-login-form.ts';
+export type { AppRoleLogin } from './approle-login-result.ts';
+export { BaoLoginError };
+export interface AppRoleLoginInput {
+    /** The role_id. Not a secret on its own, but half of one — it is redacted from errors too. */
+    readonly roleId: string;
+    /** ⛔ The secret_id. Never logged, never in an error — see `redact`. */
+    readonly secretId: string;
+    /** The AppRole auth mount, e.g. `approle` (the default) — no `.`/`..` segments, `?` or `#`. */
+    readonly mount?: string;
+}
+/**
+ * Log in with a role_id and secret_id, under BaoEnv (process.env unless a caller provides one).
+ *
+ * ⛔ THE LOGIN SENDS NO TOKEN, WHATEVER THE ENVIRONMENT HOLDS. BAO_TOKEN is overridden with a
+ *   PRESENT-BUT-EMPTY value for this one call, which bao-address.ts readBaoVariable treats as
+ *   winning over VAULT_TOKEN, so headersFor omits X-Vault-Token entirely. A script that already
+ *   had an operator token exported must not send it along with a machine login.
+ * ⚠️ A DROPPED TRANSPORT IS RETRIED TWICE (bao-http.ts retryTransport, status 0 only). If the first
+ *   request reached OpenBao and only the answer was lost, the retry is a second login: one extra
+ *   token that lives until its TTL, and — for a secret_id with `secret_id_num_uses` — one extra use.
+ *   A single-use secret_id can therefore come back "invalid" on a flaky path.
+ * ★ `PUT`, THE METHOD api/logical.go:325 WriteWithContext SENDS, which is what the official Go helper
+ *   calls (api/auth/approle/approle.go:146). The docs show POST; both are the update operation.
+ */
+export declare const appRoleLoginEffect: (input: AppRoleLoginInput) => Effect.Effect<AppRoleLogin, BaoLoginError, HttpClient.HttpClient>;
+/**
+ * Revoke `token` itself — what a wrapper runs on exit, so a login does not outlive its job.
+ *
+ * ★ `PUT auth/token/revoke-self`, READ FROM openbao v2.6.2 api/auth_token.go:318-330: the token
+ *   revoked is the one in X-Vault-Token, and the body is empty. `token` rides in that header for
+ *   this call only (BAO_TOKEN is overridden), whatever the environment holds.
+ * ⚠️ AN ALREADY-REVOKED OR EXPIRED TOKEN IS A FAILURE, NOT A NO-OP. OpenBao refuses a token it no
+ *   longer knows (permission denied — not measured here), and a refusal from the wrong server looks
+ *   the same; "I could not tell" stays an error. A wrapper that only wants best-effort cleanup on
+ *   exit can catch BaoLoginError with reason `refused`.
+ * ⚠️ NEVER THROUGH AN AGENT OR PROXY IN `use_auto_auth_token = "force"` MODE. Force overwrites the
+ *   request's token with the agent's own (bao-address.ts headersFor cites apiproxy.mdx), so this
+ *   would revoke the AGENT's token. The estate's LAN proxy runs with no auto-auth at all.
+ */
+export declare const revokeSelfEffect: (token: string) => Effect.Effect<void, BaoLoginError, HttpClient.HttpClient>;
+/**
+ * `appRoleLoginEffect` for a plain script. `env` defaults to `process.env`, read at call time.
+ *
+ *     const login = await appRoleLogin({ roleId, secretId });
+ *     try { … login.clientToken … } finally { await revokeSelf(login.clientToken); }
+ */
+export declare const appRoleLogin: (input: AppRoleLoginInput & {
+    readonly env?: BaoEnvironment;
+}) => Promise<AppRoleLogin>;
+/** `revokeSelfEffect` for a plain script. `env` defaults to `process.env`, read at call time. */
+export declare const revokeSelf: (token: string, env?: BaoEnvironment) => Promise<void>;
+//# sourceMappingURL=approle-login.d.ts.map

package/dist/openbao/approle-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approle-login.d.ts","sourceRoot":"","sources":["../../src/openbao/approle-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EACL,aAAa,EAMd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,YAAY,EAAW,MAAM,2BAA2B,CAAC;AAEvE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,MAAM,WAAW,iBAAiB;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAeD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,UACtB,iBAAiB,KACvB,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAsB/D,CAAC;AAEL;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,UACpB,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAWvD,CAAC;AAeL;;;;;GAKG;AACH,eAAO,MAAM,YAAY,UAChB,iBAAiB,GAAG;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,cAAc,CAAA;CAAE,KAC3D,OAAO,CAAC,YAAY,CAAkD,CAAC;AAE1E,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAW,MAAM,QAAQ,cAAc,KAAG,OAAO,CAAC,IAAI,CACtC,CAAC"}

package/dist/openbao/auth-method-form.d.ts

@@ -9,6 +9,13 @@ export interface BaoAuthMethodProps {
     defaultLeaseTtl?: string;
     /** Max lease TTL, e.g. `8760h`. */
     maxLeaseTtl?: string;
+    /**
+     * The path this method lives at NOW, when `path` is where it should move to — `sys/remount`
+     * from `auth/<remountFrom>`, keeping every role. Without it a changed `path` fails the plan
+     * (mount-move.ts). ⚠️ Every token issued through the method is revoked by the move, and login
+     * URLs, policies and MFA enforcements by accessor are not rewritten (the accessor is kept).
+     */
+    remountFrom?: string;
 }
 export interface BaoAuthMethodAttributes {
     path: string;

package/dist/openbao/auth-method-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-method-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method-form.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAoB,CAAC;AAiB1D,eAAO,MAAM,YAAY,UAChB,kBAAkB,QACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,uBAUF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAiC,CAAC;AAEvE;;;GAGG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,WAA6B,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,kBAAkB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAI3E,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,QAAQ,UAAW,kBAAkB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMzE,CAAC;AASF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,uBAAuB,SAAS,kBAAkB,YAIlC,CAAC;AAErD,eAAO,MAAM,SAAS,UAAW,kBAAkB,YAGlB,CAAC"}
+{"version":3,"file":"auth-method-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method-form.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAoB,CAAC;AAiB1D,eAAO,MAAM,YAAY,UAChB,kBAAkB,QACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,uBAUF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAiC,CAAC;AAEvE;;;GAGG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,WAA6B,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,kBAAkB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAI3E,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,QAAQ,UAAW,kBAAkB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMzE,CAAC;AASF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,uBAAuB,SAAS,kBAAkB,YAIlC,CAAC;AAErD,eAAO,MAAM,SAAS,UAAW,kBAAkB,YAGlB,CAAC"}

package/dist/openbao/auth-method-reconcile.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Bao.AuthMethod's read and reconcile as plain effects — split from auth-method.ts so the move runs
+ * against a fake server. Same shape as mount-reconcile.ts; the one difference that matters is the
+ * `auth/` prefix sys/remount needs (vault/logical_system.go:1295-1310 refuses to move an auth mount
+ * to a non-auth path, and `token/` cannot move at all).
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoAuthMethodAttributes, type BaoAuthMethodProps } from './auth-method-form.ts';
+import type { BaoError } from './bao-status.ts';
+import type { RemountError, RemountOptions } from './remount-wire.ts';
+export declare const readMethod: (props: BaoAuthMethodProps) => Effect.Effect<BaoAuthMethodAttributes | undefined, BaoError, HttpClient.HttpClient>;
+/** Converge one auth method. `stated` is the path in Alchemy's state, if any. */
+export declare const reconcileAuthMethod: (news: BaoAuthMethodProps, stated: string | undefined, options?: RemountOptions) => Effect.Effect<BaoAuthMethodAttributes, BaoError | RemountError, HttpClient.HttpClient>;
+//# sourceMappingURL=auth-method-reconcile.d.ts.map

package/dist/openbao/auth-method-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-method-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,UAAU,UACd,kBAAkB,KACxB,MAAM,CAAC,MAAM,CAAC,uBAAuB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAKjF,CAAC;AAUL,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,SACxB,kBAAkB,UAChB,MAAM,GAAG,SAAS,YAChB,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CA8BpF,CAAC"}

package/dist/openbao/auth-method.d.ts

@@ -7,6 +7,12 @@
  * ★ `defaultRemovalPolicy: 'retain'` — disabling a method destroys every role under it
  *   and revokes tokens minted through those roles. Opt in with
  *   `.pipe(RemovalPolicy.destroy())`.
+ *
+ * ★ REPLACE SEMANTICS (audited 2026-09-21, see REPLACE.md): `type` changed → plans `replace`, whose
+ *   create half dies on the still-occupied path before any write, so the apply fails and nothing is
+ *   disabled (auth-method-reconcile.ts); `path` changed → FAILS unless `remountFrom` names the old
+ *   path (then an in-place move). It used to plan `update` and enable an empty method at the new
+ *   path, exactly as Bao.Mount did.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/auth-method.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-method.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAQ/B,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,CAAC;AAE5D,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,aAAa,gDAExB,CAAC;AASH,eAAO,MAAM,qBAAqB,oGAmE/B,CAAC"}
+{"version":3,"file":"auth-method.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,uBAAuB,CAAC;AAK/B,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,CAAC;AAE5D,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,aAAa,gDAExB,CAAC;AAEH,eAAO,MAAM,qBAAqB,oGAqD/B,CAAC"}

package/dist/openbao/auth-role-form.d.ts

@@ -33,6 +33,15 @@ export declare const readPath: (name: string) => string;
  * ★ ALL STRINGS, EXACTLY THE `k=v` PAIRS `bao write` USED TO SEND — see `baoWrite` in bao-http.ts.
  */
 export declare const writeBody: (props: BaoAuthRoleProps) => Record<string, string>;
+/**
+ * Whether a changed `name` names a DIFFERENT role — the diff's `replace` question.
+ *
+ * ⚠️ CASE-INSENSITIVELY, BECAUSE THE SERVER IS. AppRole stores `role/<lowercased name>` (openbao
+ *   v2.6.2 builtin/credential/approle/path_role.go:1485, and roleEntry reads the same key, :1537),
+ *   so `Host` → `host` is the SAME role: a `replace` there would write it, then — under `destroy` —
+ *   delete the old generation, which is that same role.
+ */
+export declare const isRename: (from: string, to: string) => boolean;
 /** True when live already matches the declaration on every managed field. */
 export declare const matches: (attributes: BaoAuthRoleAttributes, props: BaoAuthRoleProps) => boolean;
 //# sourceMappingURL=auth-role-form.d.ts.map

package/dist/openbao/auth-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-form.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,eAAO,MAAM,YAAY,UAChB,gBAAgB,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,qBAWF,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAgC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,SAAS,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAYxE,CAAC;AAWF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAUjF,CAAC"}
+{"version":3,"file":"auth-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-form.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,eAAO,MAAM,YAAY,UAChB,gBAAgB,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,qBAWF,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAgC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,SAAS,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAYxE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,MAAM,MAAM,KAAG,OACX,CAAC;AAW1C,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAUjF,CAAC"}

package/dist/openbao/auth-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAKtB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AASH,eAAO,MAAM,mBAAmB,kGAsD7B,CAAC"}
+{"version":3,"file":"auth-role.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAMtB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AASH,eAAO,MAAM,mBAAmB,kGAiE7B,CAAC"}