@homeflare/alchemy 0.4.1 → 0.6.0

package/dist/openbao/auth-token-form.d.ts

@@ -0,0 +1,48 @@
+export type BaoTokenType = 'batch' | 'default' | 'service';
+export interface BaoTokenProps {
+    /** Policies on tokens this role issues. Names only. */
+    tokenPolicies: readonly string[];
+    /** Token TTL (`15m`). Default `0` — the mount's default. */
+    tokenTtl?: string;
+    /** Token max TTL (`1h`). Default `0` — the mount's max. */
+    tokenMaxTtl?: string;
+    /** Hard ceiling that renewal cannot pass. Default `0` (none). */
+    tokenExplicitMaxTtl?: string;
+    /** Periodic tokens renew forever within this period. Default `0` (not periodic). */
+    tokenPeriod?: string;
+    /** Leave the `default` policy off. Default false. */
+    tokenNoDefaultPolicy?: boolean;
+    /** CIDRs a token may be USED from. Default none. */
+    tokenBoundCidrs?: readonly string[];
+    /** Uses before the token dies; `0` is unlimited. Default 0. */
+    tokenNumUses?: number;
+    /** Default `default` — the mount decides, which means service tokens unless it says otherwise. */
+    tokenType?: BaoTokenType;
+}
+/** The token fields as seconds and sorted sets — both sides of a diff are built by `tokenForm`. */
+export interface BaoTokenForm {
+    tokenBoundCidrs: readonly string[];
+    tokenExplicitMaxTtlSeconds: number;
+    tokenMaxTtlSeconds: number;
+    tokenNoDefaultPolicy: boolean;
+    tokenNumUses: number;
+    tokenPeriodSeconds: number;
+    tokenPolicies: readonly string[];
+    tokenTtlSeconds: number;
+    tokenType: string;
+}
+/**
+ * The token fields of an already-normalised form, in one fixed key order — what a role family's own
+ * canonical literal spreads, so its digest cannot depend on how the object was assembled.
+ */
+export declare const tokenFields: (input: BaoTokenForm) => BaoTokenForm;
+export declare const tokenFormOfProps: (props: BaoTokenProps) => BaoTokenForm;
+export declare const tokenFormOfLive: (live: Record<string, unknown>) => BaoTokenForm;
+/**
+ * The token half of a role write — every field, defaults included (the merge ⚠️ above). Durations
+ * go over as the author's own strings; lists as JSON arrays, which a comma-string-slice accepts.
+ */
+export declare const tokenBody: (props: BaoTokenProps) => Record<string, unknown>;
+/** Refusals the token half can know without a server. */
+export declare const tokenProblems: (props: BaoTokenProps) => readonly string[];
+//# sourceMappingURL=auth-token-form.d.ts.map

package/dist/openbao/auth-token-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-token-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-token-form.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,oDAAoD;IACpD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,mGAAmG;AACnG,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,0BAA0B,EAAE,MAAM,CAAC;IACnC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAgBD;;;GAGG;AACH,eAAO,MAAM,WAAW,UAAW,YAAY,KAAG,YAUhD,CAAC;AAeH,eAAO,MAAM,gBAAgB,UAAW,aAAa,KAAG,YAWpD,CAAC;AAEL,eAAO,MAAM,eAAe,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAW5D,CAAC;AAEL;;;GAGG;AACH,eAAO,MAAM,SAAS,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAUrE,CAAC;AAEH,yDAAyD;AACzD,eAAO,MAAM,aAAa,UAAW,aAAa,KAAG,SAAS,MAAM,EAqBnE,CAAC"}

package/dist/openbao/bao-http.d.ts

@@ -64,6 +64,8 @@ export declare const baoRead: (path: string) => Effect.Effect<Record<string, unk
  * ⚠️ ROLE BODIES STAY ALL-STRING ON PURPOSE. `bao write k=v` put every value in the JSON body as a
  *   string — MEASURED with `-output-curl-string`, see ssh-role-form.ts — and the form files still
  *   build exactly that body, so the server parses the same request it was always sent.
+ *   ⛔ EXCEPT A MAP FIELD: sdk v2.6.2 refuses a string for a TypeMap with a 400, so Bao.SshRole
+ *   sends its two maps as objects (the ⛔ on mapValue in ssh-role-form.ts, measured 2026-09-21).
  */
 export declare const baoWrite: (method: 'POST' | 'PUT', path: string, body: Readonly<Record<string, unknown>>) => Effect.Effect<void, BaoError, HttpClient.HttpClient>;
 /** A delete: idempotent — already gone (404) is success — and refused (403, 5xx) is a failure. */

package/dist/openbao/bao-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bao-http.d.ts","sourceRoot":"","sources":["../../src/openbao/bao-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAU,MAAM,iBAAiB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,MAAM,iEAEjB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,aAAa,IAAI,CAAC;AAE/B,eAAO,MAAM,OAAO,wCAElB,CAAC;AAiEH,mGAAmG;AACnG,eAAO,MAAM,OAAO,WACV,SAAS,UACT,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,QACnC,MAAM,SACL,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,wFAoCtC,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SAAU,MAAM,wFAOhC,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,WACX,MAAM,GAAG,KAAK,QAChB,MAAM,QACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,yDACe,CAAC;AAEzD,kGAAkG;AAClG,eAAO,MAAM,SAAS,SAAU,MAAM,yDAAqD,CAAC"}
+{"version":3,"file":"bao-http.d.ts","sourceRoot":"","sources":["../../src/openbao/bao-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAU,MAAM,iBAAiB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,MAAM,iEAEjB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,aAAa,IAAI,CAAC;AAE/B,eAAO,MAAM,OAAO,wCAElB,CAAC;AAiEH,mGAAmG;AACnG,eAAO,MAAM,OAAO,WACV,SAAS,UACT,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,QACnC,MAAM,SACL,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,wFAoCtC,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SAAU,MAAM,wFAOhC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,WACX,MAAM,GAAG,KAAK,QAChB,MAAM,QACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,yDACe,CAAC;AAEzD,kGAAkG;AAClG,eAAO,MAAM,SAAS,SAAU,MAAM,yDAAqD,CAAC"}

package/dist/openbao/bao-identity.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Refuse to plan against the wrong vault: assert the `cluster_name` and namespace a stack expects
+ * BEFORE any Bao.* resource reads or writes.
+ *
+ * ⛔ WHY IT EXISTS. A `BAO_ADDR` left exported for one vault (or a `BAO_AGENT_ADDR`, which wins)
+ *   would otherwise apply a stack written for another vault to it, and every family here would
+ *   plan CREATEs against the wrong server with a clean conscience (the estate's site-config plan,
+ *   "Identity checks on every live plan").
+ *   A missing `BAO_NAMESPACE` does the same thing one level down: the stack lands in root.
+ *
+ * ★ `sys/health`, UNAUTHENTICATED, WITH NO TOKEN AND NO NAMESPACE HEADER. READ FROM openbao v2.6.2:
+ *   · http/sys_health.go:143-165 — `cluster_name` and `cluster_id` are filled ONLY while unsealed,
+ *     and the body is top-level JSON, not wrapped in `data`.
+ *   · http/handler.go:108-124, :405-411 — `health` is a root-only API: a request carrying
+ *     `X-Vault-Namespace` is answered 400 "operation unavailable in namespaces". So the header is
+ *     stripped for this one call, whatever BAO_NAMESPACE says.
+ *   · The query asks for 200 when sealed, uninitialised or standby (`sealedcode`, `uninitcode`,
+ *     `standbyok`, :78-110), so the body is always there to read and the refusal can say WHICH.
+ *   ⛔ NO TOKEN IS SENT. Until this check passes, the server has not even claimed to be ours, and a
+ *     token sent to the wrong server is a token handed over.
+ * ⚠️ IT CATCHES A MISTARGET, NOT AN IMPOSTOR (review 2026-09-21). `cluster_name` is answered to
+ *   anyone, unauthenticated, so a hostile server can echo the expected one; passing proves the
+ *   address is configured right, never who answers. TLS to a trusted certificate is what
+ *   authenticates the server — keep an https BAO_ADDR on anything that is not loopback or a socket.
+ * ★ THE NAMESPACE IS CHECKED TWICE. Locally first: the namespace every later call will send (the
+ *   same bao-address.ts resolution) must BE the expected one. Then remotely: unauthenticated
+ *   `sys/internal/ui/mounts` with that namespace header answers 200 when the namespace exists and
+ *   404 "namespace not found" when it does not (vault/request_handling.go:607-612; the path is in
+ *   the system backend's Unauthenticated list, vault/logical_system.go:95). Only the status is read.
+ *   REASONED FROM SOURCE, not measured against a live server.
+ * ⚠️ IT PROVES THE CLUSTER, NOT THE NODE. A standby answers with the cluster's name, which is the
+ *   point: a standby forwards to the same vault.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoEnvironment } from './bao-address.ts';
+/** `input` a blank expectation · `mismatch` the wrong vault · `unconfirmed` could not tell · `unreachable` no answer. */
+export type BaoIdentityFailure = 'input' | 'mismatch' | 'unconfirmed' | 'unreachable';
+/** ⛔ Every message starts `REFUSING:`, and none carries a token — only the address and names. */
+export declare class BaoIdentityError extends Error {
+    readonly reason: BaoIdentityFailure;
+    constructor(reason: BaoIdentityFailure, detail: string);
+}
+export interface BaoIdentityExpected {
+    /** The vault's `cluster_name` (server config `cluster_name`, or the one generated at init). */
+    readonly clusterName: string;
+    /** The namespace the stack targets: `team-a`, or `''` / `root` for the root namespace. */
+    readonly namespace: string;
+}
+/** What the vault said about itself once every check passed. */
+export interface BaoIdentity {
+    /** The resolved address, without any token. */
+    readonly address: string;
+    readonly clusterName: string;
+    readonly clusterId: string;
+    readonly version: string;
+    /** Canonical: `''` is root. */
+    readonly namespace: string;
+}
+export declare const HEALTH_PATH = "sys/health?standbyok=true&sealedcode=200&uninitcode=200";
+export declare const NAMESPACE_PROBE_PATH = "sys/internal/ui/mounts";
+/** Read a health body into the one question asked of it. Pure, for the tests. */
+export declare const checkHealth: (address: string, expectedCluster: string, body: Record<string, unknown> | undefined) => {
+    readonly clusterId: string;
+    readonly version: string;
+} | BaoIdentityError;
+/**
+ * The check, as an Effect under BaoEnv (process.env unless provided). Fails with BaoIdentityError
+ * and nothing else.
+ */
+export declare const assertBaoIdentityEffect: (expected: BaoIdentityExpected) => Effect.Effect<BaoIdentity, BaoIdentityError, HttpClient.HttpClient>;
+/**
+ * `assertBaoIdentityEffect` for a plain script. `env` defaults to `process.env`, read at call time.
+ * ★ Rejects with the BaoIdentityError itself (Effect.runPromise, as in approle-login.ts).
+ *
+ *     await assertBaoIdentity({ clusterName: 'vault-example', namespace: 'team-a' });
+ */
+export declare const assertBaoIdentity: (input: BaoIdentityExpected & {
+    readonly env?: BaoEnvironment;
+}) => Promise<BaoIdentity>;
+//# sourceMappingURL=bao-identity.d.ts.map

package/dist/openbao/bao-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bao-identity.d.ts","sourceRoot":"","sources":["../../src/openbao/bao-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,kBAAkB,CAAC;AAKvE,yHAAyH;AACzH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,UAAU,GAAG,aAAa,GAAG,aAAa,CAAC;AAEtF,iGAAiG;AACjG,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,MAAM,EAAE,kBAAkB;IADrC,YACW,MAAM,EAAE,kBAAkB,EACnC,MAAM,EAAE,MAAM,EAIf;CACF;AAED,MAAM,WAAW,mBAAmB;IAClC,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+BAA+B;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,WAAW,4DAA4D,CAAC;AACrF,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAc7D,iFAAiF;AACjF,eAAO,MAAM,WAAW,YACb,MAAM,mBACE,MAAM,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KACxC;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,gBAyB7D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,aACxB,mBAAmB,KAC5B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,UAAU,CAAC,UAAU,CA8CjE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,UACrB,mBAAmB,GAAG;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,cAAc,CAAA;CAAE,KAC7D,OAAO,CAAC,WAAW,CAKrB,CAAC"}

package/dist/openbao/bao-namespace.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Namespace spellings, made comparable. `homeflare`, `/homeflare/` and `homeflare/` are one
+ * namespace to OpenBao, and `root` (or nothing) is the root namespace.
+ *
+ * ★ READ FROM openbao v2.6.2: namespace.Canonicalize trims the leading slash and appends a trailing
+ *   one, and ResolveNamespaceFromRequest (vault/namespace_store.go:1573-1598) re-routes a header
+ *   that is literally `root/` to the root namespace. A namespace's own `namespace_path` in an API
+ *   answer is that canonical form: `''` for root, `a/b/` below it (vault/login_mfa.go
+ *   mfaConfigToMap and mfaLoginEnforcementConfigToMap).
+ */
+import { type BaoEnvironment } from './bao-address.ts';
+/** The bare name: no leading or trailing slash, and `''` for the root namespace. */
+export declare const canonicalNamespace: (namespace: string | undefined) => string;
+/** OpenBao's `namespace_path` rendering of the same namespace: `''` or `a/b/`. */
+export declare const namespacePath: (namespace: string | undefined) => string;
+/** The namespace every call under `env` targets, canonical. */
+export declare const envNamespace: (env: BaoEnvironment) => string;
+/** How a namespace reads in a message: `root` rather than an empty pair of backticks. */
+export declare const namespaceLabel: (namespace: string) => string;
+//# sourceMappingURL=bao-namespace.d.ts.map

package/dist/openbao/bao-namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bao-namespace.d.ts","sourceRoot":"","sources":["../../src/openbao/bao-namespace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,kBAAkB,CAAC;AAGvE,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,cAAe,MAAM,GAAG,SAAS,KAAG,MAGlE,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,aAAa,cAAe,MAAM,GAAG,SAAS,KAAG,MAG7D,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,YAAY,QAAS,cAAc,KAAG,MACA,CAAC;AAEpD,yFAAyF;AACzF,eAAO,MAAM,cAAc,cAAe,MAAM,KAAG,MACZ,CAAC"}

package/dist/openbao/cloudflare-roles-expand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-roles-expand.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-roles-expand.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAgB,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE3F,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;CAC/B;AAED,0DAA0D;AAC1D,eAAO,MAAM,IAAI,SAAU,MAAM,WAIL,CAAC;AAE7B;;;;GAIG;AACH,eAAO,MAAM,QAAQ,SAAU,cAAc,WACY,CAAC;AAE1D,qFAAqF;AACrF,eAAO,MAAM,SAAS,YAAa,MAAM,WAAW,MAAM,WAAuC,CAAC;AAkFlG,+FAA+F;AAC/F,eAAO,MAAM,aAAa,WAChB,WAAW,WACV,WAAW,SACb,SAAS,cAAc,EAAE,KAC/B,YAAY,EAwBd,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,WACZ,WAAW,kBACH,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,KAClE,WAAW,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAgB7C,CAAC"}
+{"version":3,"file":"cloudflare-roles-expand.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-roles-expand.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAgB,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG3F,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;CAC/B;AAED,0DAA0D;AAC1D,eAAO,MAAM,IAAI,SAAU,MAAM,WAAkE,CAAC;AAEpG;;;;GAIG;AACH,eAAO,MAAM,QAAQ,SAAU,cAAc,WACY,CAAC;AAE1D,qFAAqF;AACrF,eAAO,MAAM,SAAS,YAAa,MAAM,WAAW,MAAM,WAAuC,CAAC;AAkFlG,+FAA+F;AAC/F,eAAO,MAAM,aAAa,WAChB,WAAW,WACV,WAAW,SACb,SAAS,cAAc,EAAE,KAC/B,YAAY,EAwBd,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,WACZ,WAAW,kBACH,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,KAClE,WAAW,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAgB7C,CAAC"}

package/dist/openbao/host-approles.d.ts

@@ -0,0 +1,62 @@
+/**
+ * One AppRole role per host, generated from a host list and a few class definitions — pure, so a
+ * scaffold test can render every role from one site config and assert on it without a vault.
+ *
+ * ★ WHY PER HOST, NOT PER CLASS. OpenBao sets an AppRole login's entity alias to the role_id, so
+ *   every host sharing a class role is ONE identity: one entity in every audit line, and one cached
+ *   token when two hosts send the same login through a caching proxy (vault consolidation plan,
+ *   decision 8 as amended 2026-09-21; not re-measured here). The CLASS carries the policies and
+ *   TTLs; the ROLE carries the host.
+ *
+ * ★ THE NAMING RULE: `<class>--<host>`, e.g. `pve-node--node-a`.
+ *   · Class and host names are lowercase letters, digits and SINGLE hyphens, so `--` can only ever
+ *     be the separator and a name splits back into exactly one (class, host) pair.
+ *   · Class first, so one class's roles share a prefix a reader (or a policy path glob,
+ *     `auth/approle/role/pve-node--*`) can select — and no hand-made role (`deploy`,
+ *     `approle-rotator`) can match it, because none of them contains `--`.
+ *   · Lowercase because AppRole stores role names lowercased (builtin/credential/approle stores
+ *     `role/<lowercased name>`); a mixed-case name would read back as a different string.
+ *
+ * ⛔ NO ROLE WITHOUT AN EXPIRING SECRET_ID. `secretIdTtl` must parse to MORE than zero: `0` is a
+ *   secret_id that never expires, which is the `deploy` credential the plan is retiring. The plan's
+ *   class default is 90 days (`2160h`, which auth-role-form.test.ts shows OpenBao accepts).
+ * ⛔ `bindSecretId` IS ALWAYS TRUE. A role that logs in on role_id alone makes the role_id — which
+ *   is not treated as a secret — the whole credential.
+ * ⚠️ A RENAMED HOST OR CLASS IS A NEW ROLE: a new role_id, and a new secret_id to push to the host
+ *   in the same change. What Alchemy calls it depends on the logical id. Keyed by the role name (as
+ *   the README does), the old id VANISHES from the stack, so it is an orphan delete, not a
+ *   `replace`. Keyed by something stable, Bao.AuthRole plans a `replace`. Either way the default
+ *   `retain` leaves the old role LIVE, its secret_ids still logging in (alchemy Plan.ts:2040 and
+ *   Apply.ts:2152-2173 honour retain on both paths) — see the ⚠️ in auth-role.ts before renaming.
+ */
+import type { BaoAuthRoleProps } from './auth-role-form.ts';
+/** What every host of one class gets. */
+export interface HostRoleClass {
+    /** Policy names. ⛔ Never empty, never `root`. */
+    readonly policies: readonly string[];
+    readonly tokenTtl: string;
+    readonly tokenMaxTtl: string;
+    /** ⛔ Must be more than zero — e.g. `2160h` (90 days). */
+    readonly secretIdTtl: string;
+    /** `0` (the default) means unlimited uses, which a host that logs in repeatedly needs. */
+    readonly secretIdNumUses?: number;
+}
+export interface HostRoleHost {
+    /** Short host name, e.g. `node-a`. */
+    readonly name: string;
+    /** Key into `classes`. */
+    readonly class: string;
+}
+export interface HostAppRolesInput {
+    readonly hosts: readonly HostRoleHost[];
+    readonly classes: Readonly<Record<string, HostRoleClass>>;
+}
+export declare const HOST_ROLE_SEPARATOR = "--";
+/** The naming rule, in one place: `<class>--<host>`. */
+export declare const hostRoleName: (className: string, host: string) => string;
+/**
+ * Every host's role props, sorted by role name. Throws, naming every problem at once, on a class or
+ * host that breaks a rule above — this runs when a stack is defined, so a throw stops the plan.
+ */
+export declare const hostAppRoles: (input: HostAppRolesInput) => readonly BaoAuthRoleProps[];
+//# sourceMappingURL=host-approles.d.ts.map

package/dist/openbao/host-approles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-approles.d.ts","sourceRoot":"","sources":["../../src/openbao/host-approles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;CAC3D;AAKD,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,wDAAwD;AACxD,eAAO,MAAM,YAAY,cAAe,MAAM,QAAQ,MAAM,KAAG,MAClB,CAAC;AAyB9C;;;GAGG;AACH,eAAO,MAAM,YAAY,UAAW,iBAAiB,KAAG,SAAS,gBAAgB,EA+BhF,CAAC"}

package/dist/openbao/index.d.ts

@@ -7,17 +7,43 @@
  *   every helper as API and make the next refactor a breaking change.
  * ★ Anything unlisted is still reachable by path if you genuinely need it — that is a
  *   deliberate, visible act rather than an accident of barrelling.
+ * ★ THE APPROLE LOGIN IS HERE FOR SCRIPTS, NOT STACKS (approle-login.ts). A wrapper that logs in
+ *   and revokes on exit needs it, and giving it the families' own transport is what keeps a script
+ *   and a stack from disagreeing about which server BAO_ADDR means.
+ * ★ SO IS THE IDENTITY GUARD (bao-identity.ts), for the opposite reason: a stack calls it FIRST, so
+ *   no family plans against a vault that is not the one the stack was written for.
+ * ★ hostAppRoles IS PURE — no provider, no call — so a scaffold test can render every per-host
+ *   AppRole from one site config.
  */
+export type { AppRoleLogin, AppRoleLoginInput, BaoLoginFailure } from './approle-login.ts';
+export { BaoLoginError, appRoleLogin, appRoleLoginEffect, revokeSelf, revokeSelfEffect, } from './approle-login.ts';
 export { BaoAuthMethod, BaoAuthMethodProvider } from './auth-method.ts';
+export type { BaoAuthRoleProps } from './auth-role.ts';
 export { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
+export type { BaoIdentity, BaoIdentityExpected, BaoIdentityFailure } from './bao-identity.ts';
+export { BaoIdentityError, assertBaoIdentity, assertBaoIdentityEffect } from './bao-identity.ts';
 export { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';
 export { CloudflarePermissionGroups, permissionGroupsFromEngine, permissionGroupsFromLiveRoles, } from './cloudflare-permission-groups.ts';
 export type { CloudflareZone, ExpandedRole } from './cloudflare-roles-expand.ts';
 export { expandAccount, expandAll, mountName } from './cloudflare-roles-expand.ts';
 export type { RolesConfig, SurfaceSpec } from './cloudflare-roles-config.ts';
 export { parseRolesConfig } from './cloudflare-roles-config.ts';
+export type { HostAppRolesInput, HostRoleClass, HostRoleHost } from './host-approles.ts';
+export { HOST_ROLE_SEPARATOR, hostAppRoles, hostRoleName } from './host-approles.ts';
+export type { BaoJwtAuthConfigProps } from './jwt-config.ts';
+export { BaoJwtAuthConfig, BaoJwtAuthConfigProvider } from './jwt-config.ts';
+export type { BaoJwtRoleProps, BaoJwtRoleType } from './jwt-role.ts';
+export { BaoJwtRole, BaoJwtRoleProvider } from './jwt-role.ts';
+export type { BaoKubernetesAliasSource, BaoKubernetesRoleProps } from './kubernetes-role.ts';
+export { BaoKubernetesRole, BaoKubernetesRoleProvider } from './kubernetes-role.ts';
+export type { BaoMfaLoginEnforcementProps } from './mfa-enforcement.ts';
+export { BaoMfaLoginEnforcement, BaoMfaLoginEnforcementProvider } from './mfa-enforcement.ts';
+export type { BaoMfaTotpMethodProps, BaoTotpAlgorithm } from './mfa-totp.ts';
+export { BaoMfaTotpMethod, BaoMfaTotpMethodProvider } from './mfa-totp.ts';
 export { BaoMount, BaoMountProvider } from './mount.ts';
 export { BaoPkiRole, BaoPkiRoleProvider } from './pki-role.ts';
+export type { BaoPluginProps, BaoPluginType } from './plugin.ts';
+export { BaoPlugin, BaoPluginProvider } from './plugin.ts';
 export { BaoPolicy, BaoPolicyProvider } from './policy.ts';
 export { BaoProxmoxRole, BaoProxmoxRoleProvider } from './proxmox-role.ts';
 export { BaoSshRole, BaoSshRoleProvider } from './ssh-role.ts';

package/dist/openbao/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/openbao/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACnF,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/openbao/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EACL,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACxE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACnF,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrF,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/D,YAAY,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpF,YAAY,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAC9F,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/D,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}