@homeflare/alchemy 0.4.1 → 0.6.0

package/dist/openbao/index.js

@@ -1,15 +1,310 @@
+// src/openbao/approle-login.ts
+import * as Effect2 from "effect/Effect";
+import * as FetchHttpClient2 from "effect/unstable/http/FetchHttpClient";
+
+// src/openbao/bao-http.ts
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schedule from "effect/Schedule";
+import * as Semaphore from "effect/Semaphore";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Headers from "effect/unstable/http/Headers";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+
+// src/openbao/bao-address.ts
+var DEFAULT_ADDRESS = "https://127.0.0.1:8200";
+var UNIX = "unix://";
+var readBaoVariable = (env, name) => env[name] ?? env[`VAULT_${name.slice("BAO_".length)}`] ?? "";
+var resolveAddress = (env) => {
+  const agent = readBaoVariable(env, "BAO_AGENT_ADDR");
+  const direct = readBaoVariable(env, "BAO_ADDR");
+  const raw = agent !== "" ? agent : direct !== "" ? direct : DEFAULT_ADDRESS;
+  const namespace = readBaoVariable(env, "BAO_NAMESPACE");
+  const socket = raw.startsWith(UNIX) ? raw.slice(UNIX.length) : undefined;
+  return {
+    base: socket === undefined ? raw.replace(/\/+$/, "") : "http://localhost",
+    namespace: namespace === "" ? undefined : namespace,
+    socket
+  };
+};
+var headersFor = (address, env) => {
+  const headers = { "X-Vault-Request": "true" };
+  if (address.namespace !== undefined)
+    headers["X-Vault-Namespace"] = address.namespace;
+  const token = readBaoVariable(env, "BAO_TOKEN");
+  if (token !== "")
+    headers["X-Vault-Token"] = token;
+  return headers;
+};
+
+// src/openbao/bao-status.ts
+class BaoError extends Error {
+  status;
+  method;
+  path;
+  errors;
+  constructor(status, method, path, errors) {
+    const code = status === 0 ? "no response" : String(status);
+    super(`OpenBao ${method} /v1/${path} -> ${code}: ${errors.join("; ") || "(no errors given)"}`);
+    this.status = status;
+    this.method = method;
+    this.path = path;
+    this.errors = errors;
+    this.name = "BaoError";
+  }
+}
+var objectOf = (text) => {
+  try {
+    const parsed = JSON.parse(text);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : undefined;
+  } catch {
+    return;
+  }
+};
+var errorsOf = (text) => {
+  const raw = objectOf(text)?.["errors"];
+  return Array.isArray(raw) && raw.every((entry) => typeof entry === "string") ? raw : undefined;
+};
+var settle = (intent, method, path, status, text) => {
+  const fail = (errors) => ({
+    error: new BaoError(status, method, path, errors)
+  });
+  if (status < 200 || status >= 300) {
+    const errors = errorsOf(text);
+    if (errors === undefined) {
+      return fail([`not an OpenBao error body (${String(text.length)} bytes)`]);
+    }
+    if (status === 404 && intent !== "write")
+      return { body: undefined };
+    return fail(errors);
+  }
+  if (text.trim() === "") {
+    return intent === "read" ? fail(["a successful read with an empty body"]) : { body: undefined };
+  }
+  const body = objectOf(text);
+  return body === undefined ? fail(["a success body that is not a JSON object"]) : { body };
+};
+
+// src/openbao/bao-http.ts
+var BaoEnv = Context.Reference("homeflare/openbao/BaoEnv", {
+  defaultValue: () => process.env
+});
+var MAX_IN_FLIGHT = 8;
+var BaoGate = Context.Reference("homeflare/openbao/BaoGate", {
+  defaultValue: () => Semaphore.makeUnsafe(MAX_IN_FLIGHT)
+});
+var TIMEOUT = "60 seconds";
+var retryTransport = (effect) => Effect.retry(effect, {
+  schedule: Schedule.spaced("750 millis"),
+  times: 2,
+  while: (error) => error.status === 0
+});
+var redactingToken = (effect) => Effect.gen(function* () {
+  const names = yield* Headers.CurrentRedactedNames;
+  return yield* Effect.provideService(effect, Headers.CurrentRedactedNames, [
+    ...names,
+    "x-vault-token"
+  ]);
+});
+var overSocket = (socket, method, path) => (effect) => {
+  if (socket === undefined)
+    return effect;
+  if (typeof Bun === "undefined") {
+    return Effect.fail(new BaoError(0, method, path, ["a unix:// address needs Bun fetch; this is not Bun"]));
+  }
+  return Effect.flatMap(Effect.serviceOption(FetchHttpClient.RequestInit), (defaults) => {
+    const init = { ...Option.getOrElse(defaults, () => ({})), unix: socket };
+    return Effect.provideService(effect, FetchHttpClient.RequestInit, init);
+  });
+};
+var baoCall = (intent, method, path, body) => Effect.gen(function* () {
+  const env = yield* BaoEnv;
+  const address = resolveAddress(env);
+  const client = yield* HttpClient.HttpClient;
+  const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(HttpClientRequest.setHeaders(headersFor(address, env)), body === undefined ? (self) => self : HttpClientRequest.bodyText(JSON.stringify(body), "application/json"));
+  const exchange = client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text2) => ({ status: response.status, text: text2 }))), Effect.timeout(TIMEOUT), Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])));
+  const gate = yield* BaoGate;
+  const { status, text } = yield* retryTransport(exchange.pipe(overSocket(address.socket, method, path), redactingToken, Semaphore.withPermits(gate, 1)));
+  const outcome = settle(intent, method, path, status, text);
+  return "error" in outcome ? yield* Effect.fail(outcome.error) : outcome.body;
+});
+var baoRead = (path) => Effect.map(baoCall("read", "GET", path), (body) => {
+  if (body === undefined)
+    return;
+  const data = body["data"];
+  return typeof data === "object" && data !== null ? data : body;
+});
+var baoWrite = (method, path, body) => Effect.asVoid(baoCall("write", method, path, body));
+var baoDelete = (path) => Effect.asVoid(baoCall("delete", "DELETE", path));
+
+// src/openbao/mount-path.ts
+var trimTrailing = (text, char) => {
+  let end = text.length;
+  while (end > 0 && text[end - 1] === char)
+    end -= 1;
+  return text.slice(0, end);
+};
+var trimRuns = (text, char) => {
+  let start = 0;
+  while (start < text.length && text[start] === char)
+    start += 1;
+  return trimTrailing(text.slice(start), char);
+};
+var trimTrailingSlashes = (text) => trimTrailing(text, "/");
+var trimSlashes = (text) => trimRuns(text, "/");
+var sshMountOf = (mount) => trimTrailingSlashes(mount ?? "ssh");
+
+// src/openbao/approle-login-form.ts
+var failureOf = (status) => status === 0 ? "unreachable" : status >= 200 && status < 300 ? "response" : "refused";
+
+class BaoLoginError extends Error {
+  reason;
+  status;
+  errors;
+  constructor(reason, status, errors, operation) {
+    const code = status === 0 ? reason : `${reason} ${String(status)}`;
+    super(`${operation}: ${code}: ${errors.join("; ") || "(no errors given)"}`);
+    this.reason = reason;
+    this.status = status;
+    this.errors = errors;
+    this.name = "BaoLoginError";
+  }
+}
+var refusal = (label, value) => {
+  if (typeof value !== "string" || value === "")
+    return `${label} is empty`;
+  if (value.trim() === "")
+    return `${label} is only whitespace`;
+  if (value.trim() !== value) {
+    return `${label} has leading or trailing whitespace (a file read keeps its newline; trim it)`;
+  }
+  return;
+};
+var loginMount = (mount) => trimSlashes(mount ?? "approle");
+var mountProblem = (mount) => {
+  const path = loginMount(mount);
+  if (path === "")
+    return "mount is empty";
+  const segments = path.split("/");
+  if (/[\s?#%\\]/.test(path) || segments.some((part) => part === "" || part === "." || part === "..")) {
+    return `mount ${JSON.stringify(path)} is not a plain mount path`;
+  }
+  return;
+};
+var loginPath = (mount) => `auth/${loginMount(mount)}/login`;
+var GO_ESCAPES = {
+  7: "a",
+  8: "b",
+  9: "t",
+  10: "n",
+  11: "v",
+  12: "f",
+  13: "r"
+};
+var goQuoted = (value) => [...value].map((char) => {
+  const code = char.codePointAt(0) ?? 0;
+  const named = GO_ESCAPES[code];
+  if (char === '"' || char === "\\")
+    return `\\${char}`;
+  if (named !== undefined)
+    return `\\${named}`;
+  if (code < 32 || code === 127)
+    return `\\x${code.toString(16).padStart(2, "0")}`;
+  return char;
+}).join("");
+var redact = (errors, secrets) => {
+  const forms = [...new Set(secrets.flatMap((secret) => [secret, goQuoted(secret)]))].filter((form) => form !== "").sort((a, b) => b.length - a.length);
+  return errors.map((entry) => forms.reduce((text, form) => text.split(form).join("[redacted]"), entry));
+};
+
+// src/openbao/approle-login-result.ts
+class LoginResult {
+  #token;
+  accessor;
+  policies;
+  leaseDurationSeconds;
+  constructor(token, accessor, policies, lease) {
+    this.#token = token;
+    this.accessor = accessor;
+    this.policies = Object.freeze([...policies]);
+    this.leaseDurationSeconds = lease;
+    Object.freeze(this);
+  }
+  get clientToken() {
+    return this.#token;
+  }
+}
+var strings = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var loginOf = (body) => {
+  const auth = body?.["auth"];
+  if (typeof auth !== "object" || auth === null || Array.isArray(auth)) {
+    return { problem: "the answer carried no auth block" };
+  }
+  const fields = auth;
+  const token = fields["client_token"];
+  if (typeof token !== "string" || token === "") {
+    const mfa = fields["mfa_requirement"];
+    return {
+      problem: mfa !== undefined && mfa !== null ? "the login requires MFA, which this helper does not complete" : "the auth block carried no client_token"
+    };
+  }
+  const lease = fields["lease_duration"];
+  return {
+    login: new LoginResult(token, typeof fields["accessor"] === "string" ? fields["accessor"] : "", strings(fields["policies"]), typeof lease === "number" && Number.isFinite(lease) ? lease : 0)
+  };
+};
+
+// src/openbao/approle-login.ts
+var LOGIN = "OpenBao AppRole login";
+var REVOKE = "OpenBao revoke-self";
+var failed = (operation, secrets) => (error) => new BaoLoginError(failureOf(error.status), error.status, redact(error.errors, secrets), operation);
+var appRoleLoginEffect = (input) => Effect2.gen(function* () {
+  const problems = [
+    refusal("roleId", input.roleId),
+    refusal("secretId", input.secretId),
+    mountProblem(input.mount)
+  ].filter((problem) => problem !== undefined);
+  if (problems.length > 0)
+    return yield* Effect2.fail(new BaoLoginError("input", 0, problems, LOGIN));
+  const env = yield* BaoEnv;
+  const body = yield* baoCall("write", "PUT", loginPath(input.mount), {
+    role_id: input.roleId,
+    secret_id: input.secretId
+  }).pipe(Effect2.provideService(BaoEnv, { ...env, BAO_TOKEN: "" }), Effect2.mapError(failed(LOGIN, [input.roleId, input.secretId])));
+  const read = loginOf(body);
+  if ("problem" in read) {
+    return yield* Effect2.fail(new BaoLoginError("response", 0, [read.problem], LOGIN));
+  }
+  return read.login;
+});
+var revokeSelfEffect = (token) => Effect2.gen(function* () {
+  const problem = refusal("token", token);
+  if (problem !== undefined) {
+    return yield* Effect2.fail(new BaoLoginError("input", 0, [problem], REVOKE));
+  }
+  const env = yield* BaoEnv;
+  yield* baoCall("write", "PUT", "auth/token/revoke-self").pipe(Effect2.provideService(BaoEnv, { ...env, BAO_TOKEN: token }), Effect2.mapError(failed(REVOKE, [token])));
+});
+var runWith = (env, effect) => {
+  const scoped = env === undefined ? effect : Effect2.provideService(effect, BaoEnv, env);
+  return Effect2.runPromise(scoped.pipe(Effect2.provide(FetchHttpClient2.layer)));
+};
+var appRoleLogin = (input) => runWith(input.env, appRoleLoginEffect(input));
+var revokeSelf = (token, env) => runWith(env, revokeSelfEffect(token));
 // src/openbao/auth-method.ts
 import { Resource } from "alchemy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
-import * as Effect3 from "effect/Effect";
+import * as Effect7 from "effect/Effect";
 
 // src/openbao/digest.ts
 var canonical = (text) => text.trimEnd();
 var sha256 = (text) => new Bun.CryptoHasher("sha256").update(canonical(text)).digest("hex");
 
 // src/openbao/mount-form.ts
-var mountPath = (path) => path.replace(/\/+$/, "");
+var mountPath = (path) => trimTrailingSlashes(path);
 var DURATION = /^(\d+)([smhd])$/;
 var parseDuration = (text) => {
   const trimmed = text.trim();
@@ -142,174 +437,164 @@ var sameTtl2 = (want, have) => {
 var matches2 = (attributes, props) => attributes.type === props.type && (props.description === undefined || attributes.description === props.description) && sameTtl2(props.defaultLeaseTtl, attributes.defaultLeaseTtl) && sameTtl2(props.maxLeaseTtl, attributes.maxLeaseTtl);
 var wantsTune2 = (props) => props.description !== undefined || props.defaultLeaseTtl !== undefined || props.maxLeaseTtl !== undefined;
 
+// src/openbao/auth-method-reconcile.ts
+import * as Effect6 from "effect/Effect";
+
 // src/openbao/auth-method-wire.ts
-import * as Effect2 from "effect/Effect";
-
-// src/openbao/bao-http.ts
-import * as Context from "effect/Context";
-import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
-import * as Schedule from "effect/Schedule";
-import * as Semaphore from "effect/Semaphore";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Headers from "effect/unstable/http/Headers";
-import * as HttpClient from "effect/unstable/http/HttpClient";
-import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
-
-// src/openbao/bao-address.ts
-var DEFAULT_ADDRESS = "https://127.0.0.1:8200";
-var UNIX = "unix://";
-var readBaoVariable = (env, name) => env[name] ?? env[`VAULT_${name.slice("BAO_".length)}`] ?? "";
-var resolveAddress = (env) => {
-  const agent = readBaoVariable(env, "BAO_AGENT_ADDR");
-  const direct = readBaoVariable(env, "BAO_ADDR");
-  const raw = agent !== "" ? agent : direct !== "" ? direct : DEFAULT_ADDRESS;
-  const namespace = readBaoVariable(env, "BAO_NAMESPACE");
-  const socket = raw.startsWith(UNIX) ? raw.slice(UNIX.length) : undefined;
-  return {
-    base: socket === undefined ? raw.replace(/\/+$/, "") : "http://localhost",
-    namespace: namespace === "" ? undefined : namespace,
-    socket
-  };
-};
-var headersFor = (address, env) => {
-  const headers = { "X-Vault-Request": "true" };
-  if (address.namespace !== undefined)
-    headers["X-Vault-Namespace"] = address.namespace;
-  const token = readBaoVariable(env, "BAO_TOKEN");
-  if (token !== "")
-    headers["X-Vault-Token"] = token;
-  return headers;
-};
-
-// src/openbao/bao-status.ts
-class BaoError extends Error {
-  status;
-  method;
-  path;
-  errors;
-  constructor(status, method, path, errors) {
-    const code = status === 0 ? "no response" : String(status);
-    super(`OpenBao ${method} /v1/${path} -> ${code}: ${errors.join("; ") || "(no errors given)"}`);
-    this.status = status;
-    this.method = method;
-    this.path = path;
-    this.errors = errors;
-    this.name = "BaoError";
-  }
-}
-var objectOf = (text3) => {
-  try {
-    const parsed = JSON.parse(text3);
-    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : undefined;
-  } catch {
-    return;
-  }
-};
-var errorsOf = (text3) => {
-  const raw = objectOf(text3)?.["errors"];
-  return Array.isArray(raw) && raw.every((entry) => typeof entry === "string") ? raw : undefined;
-};
-var settle = (intent, method, path, status, text3) => {
-  const fail = (errors) => ({
-    error: new BaoError(status, method, path, errors)
-  });
-  if (status < 200 || status >= 300) {
-    const errors = errorsOf(text3);
-    if (errors === undefined) {
-      return fail([`not an OpenBao error body (${String(text3.length)} bytes)`]);
-    }
-    if (status === 404 && intent !== "write")
-      return { body: undefined };
-    return fail(errors);
-  }
-  if (text3.trim() === "") {
-    return intent === "read" ? fail(["a successful read with an empty body"]) : { body: undefined };
-  }
-  const body = objectOf(text3);
-  return body === undefined ? fail(["a success body that is not a JSON object"]) : { body };
-};
-
-// src/openbao/bao-http.ts
-var BaoEnv = Context.Reference("homeflare/openbao/BaoEnv", {
-  defaultValue: () => process.env
-});
-var MAX_IN_FLIGHT = 8;
-var BaoGate = Context.Reference("homeflare/openbao/BaoGate", {
-  defaultValue: () => Semaphore.makeUnsafe(MAX_IN_FLIGHT)
-});
-var TIMEOUT = "60 seconds";
-var retryTransport = (effect) => Effect.retry(effect, {
-  schedule: Schedule.spaced("750 millis"),
-  times: 2,
-  while: (error) => error.status === 0
-});
-var redactingToken = (effect) => Effect.gen(function* () {
-  const names = yield* Headers.CurrentRedactedNames;
-  return yield* Effect.provideService(effect, Headers.CurrentRedactedNames, [
-    ...names,
-    "x-vault-token"
-  ]);
-});
-var overSocket = (socket, method, path) => (effect) => {
-  if (socket === undefined)
-    return effect;
-  if (typeof Bun === "undefined") {
-    return Effect.fail(new BaoError(0, method, path, ["a unix:// address needs Bun fetch; this is not Bun"]));
-  }
-  return Effect.flatMap(Effect.serviceOption(FetchHttpClient.RequestInit), (defaults) => {
-    const init = { ...Option.getOrElse(defaults, () => ({})), unix: socket };
-    return Effect.provideService(effect, FetchHttpClient.RequestInit, init);
-  });
-};
-var baoCall = (intent, method, path, body) => Effect.gen(function* () {
-  const env = yield* BaoEnv;
-  const address = resolveAddress(env);
-  const client = yield* HttpClient.HttpClient;
-  const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(HttpClientRequest.setHeaders(headersFor(address, env)), body === undefined ? (self) => self : HttpClientRequest.bodyText(JSON.stringify(body), "application/json"));
-  const exchange = client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text4) => ({ status: response.status, text: text4 }))), Effect.timeout(TIMEOUT), Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])));
-  const gate = yield* BaoGate;
-  const { status, text: text3 } = yield* retryTransport(exchange.pipe(overSocket(address.socket, method, path), redactingToken, Semaphore.withPermits(gate, 1)));
-  const outcome = settle(intent, method, path, status, text3);
-  return "error" in outcome ? yield* Effect.fail(outcome.error) : outcome.body;
-});
-var baoRead = (path) => Effect.map(baoCall("read", "GET", path), (body) => {
-  if (body === undefined)
-    return;
-  const data = body["data"];
-  return typeof data === "object" && data !== null ? data : body;
-});
-var baoWrite = (method, path, body) => Effect.asVoid(baoCall("write", method, path, body));
-var baoDelete = (path) => Effect.asVoid(baoCall("delete", "DELETE", path));
-
-// src/openbao/auth-method-wire.ts
-var absentFromTable = (path, asked) => baoRead("sys/auth").pipe(Effect2.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+import * as Effect3 from "effect/Effect";
+var absentFromTable = (path, asked) => baoRead("sys/auth").pipe(Effect3.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
   ...asked.errors,
   `sys/auth could not confirm the method is absent: ${listing.message}`
-])), Effect2.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${authPath(path)}/`) ? Effect2.succeed(undefined) : Effect2.fail(asked)));
-var readAuthMethodData = (path) => baoRead(readPath2(path)).pipe(Effect2.catchIf((error) => error.status === 400, (error) => absentFromTable(path, error)));
+])), Effect3.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${authPath(path)}/`) ? Effect3.succeed(undefined) : Effect3.fail(asked)));
+var readAuthMethodData = (path) => baoRead(readPath2(path)).pipe(Effect3.catchIf((error) => error.status === 400, (error) => absentFromTable(path, error)));
 var enableAuthMethod = (props) => baoWrite("POST", readPath2(props.path), enableBody2(props));
 var tuneAuthMethod = (props) => baoWrite("POST", tunePath2(props.path), tuneBody2(props));
 var disableAuthMethod = (path) => baoDelete(readPath2(path));
 
-// src/openbao/auth-method.ts
-var BaoAuthMethod = Resource("Bao.AuthMethod", {
-  defaultRemovalPolicy: "retain"
+// src/openbao/mount-move.ts
+import * as Effect5 from "effect/Effect";
+
+// src/openbao/remount-wire.ts
+import * as Effect4 from "effect/Effect";
+class RemountError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RemountError";
+  }
+}
+var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+var startRemount = (from, to) => Effect4.flatMap(baoCall("write", "POST", "sys/remount", { from, to }), (body) => {
+  const id = record(body?.["data"])?.["migration_id"];
+  return typeof id === "string" && id !== "" ? Effect4.succeed(id) : Effect4.fail(new RemountError(`sys/remount ${from} -> ${to} answered no migration_id.`));
+});
+var remountStatus = (id) => Effect4.map(baoRead(`sys/remount/status/${encodeURIComponent(id)}`), (data) => {
+  if (data === undefined)
+    return;
+  const status = record(data["migration_info"])?.["status"];
+  return typeof status === "string" ? status : "unknown";
+});
+var remountAndWait = (from, to, confirm, options = {}) => Effect4.gen(function* () {
+  const interval = options.intervalMillis ?? 1000;
+  const attempts = Math.max(1, options.attempts ?? 120);
+  const id = yield* startRemount(from, to);
+  const named = `sys/remount ${from} -> ${to} (migration ${id})`;
+  for (let attempt = 1;attempt <= attempts; attempt += 1) {
+    const status = yield* remountStatus(id);
+    if (status === "success")
+      return;
+    if (status === "failure") {
+      return yield* Effect4.fail(new RemountError(`${named} FAILED. The server log carries the reason, tagged with that migration_id. ` + "Read sys/mounts (or sys/auth) before retrying: the source may be tainted."));
+    }
+    if (status === undefined) {
+      if (yield* confirm)
+        return;
+      return yield* Effect4.fail(new RemountError(`${named}: the server no longer knows the migration (its tracker is in memory, lost ` + "on a restart or leader change), and the mount table does not show the move done."));
+    }
+    if (attempt < attempts)
+      yield* Effect4.sleep(interval);
+  }
+  return yield* Effect4.fail(new RemountError(`${named} is still in progress after ${String(attempts)} status reads. Do not re-run ` + `until sys/remount/status/${id} settles.`));
+});
+
+// src/openbao/mount-move.ts
+var planMove = (family, stated, path, remountFrom) => {
+  const to = mountPath(path);
+  const from = remountFrom === undefined ? undefined : mountPath(remountFrom);
+  if (stated === undefined) {
+    return from === undefined || from === to ? { kind: "stay" } : { kind: "move", from };
+  }
+  const was = mountPath(stated);
+  if (was === to)
+    return { kind: "stay" };
+  if (from === undefined) {
+    return {
+      kind: "refuse",
+      message: `${family}: path changed from ${was} to ${to}. That would enable an EMPTY mount at ${to} ` + `and strand everything under ${was}. To move it with its data, declare ` + `\`remountFrom: '${was}'\` (leases under it are revoked; policies are not rewritten). ` + "For a new, empty mount, give it a new resource id instead."
+    };
+  }
+  if (from !== was) {
+    return {
+      kind: "refuse",
+      message: `${family}: remountFrom is ${from}, but the mount in state is ${was}.`
+    };
+  }
+  return { kind: "move", from };
+};
+var refuse = (message) => Effect5.die(new Error(message));
+var performMove = (target, from, options) => Effect5.gen(function* () {
+  const to = mountPath(target.path);
+  const source = yield* target.read(from);
+  const landed = yield* target.read(to);
+  if (source !== undefined && landed !== undefined) {
+    return yield* refuse(`${target.family}: both ${from} and ${to} exist, so remountFrom cannot move one onto the ` + "other. Decide which holds the data, and retire the other by hand.");
+  }
+  if (source === undefined && landed === undefined) {
+    return yield* refuse(`${target.family}: remountFrom ${from} names no mount, and ${to} does not exist either. ` + "Refusing to enable an empty mount where data was expected.");
+  }
+  if (source === undefined)
+    return;
+  if (source.type !== target.type) {
+    return yield* refuse(`${target.family}: ${from} is type ${source.type}, not ${target.type}. A remount keeps the ` + "type; fix the declaration first.");
+  }
+  const confirm = Effect5.map(Effect5.all([target.read(from), target.read(to)]), ([gone, there]) => gone === undefined && there !== undefined);
+  yield* remountAndWait(target.wire(from), target.wire(to), confirm, options);
 });
-var readMethod = (props) => Effect3.gen(function* () {
+
+// src/openbao/auth-method-reconcile.ts
+var readMethod = (props) => Effect6.gen(function* () {
   const live = yield* readAuthMethodData(props.path);
   if (live === undefined)
     return;
   return attributesOf2(props, live);
 });
-var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect3.succeed(BaoAuthMethod.Provider.of({
-  list: () => Effect3.succeed([]),
-  read: Effect3.fn(function* ({ olds }) {
+var moveTarget = (props) => ({
+  family: "Bao.AuthMethod",
+  path: props.path,
+  read: (path) => readMethod({ ...props, path }),
+  type: props.type,
+  wire: (path) => `auth/${authPath(path)}`
+});
+var reconcileAuthMethod = (news, stated, options) => Effect6.gen(function* () {
+  const move = planMove("Bao.AuthMethod", stated, news.path, news.remountFrom);
+  if (move.kind === "refuse")
+    return yield* Effect6.die(new Error(move.message));
+  if (move.kind === "move")
+    yield* performMove(moveTarget(news), move.from, options);
+  let live = yield* readMethod(news);
+  if (live === undefined) {
+    yield* enableAuthMethod(news);
+    if (wantsTune2(news))
+      yield* tuneAuthMethod(news);
+  } else if (!matches2(live, news)) {
+    if (live.type !== news.type) {
+      return yield* Effect6.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Auth method type is immutable — replace manually."));
+    }
+    yield* tuneAuthMethod(news);
+  }
+  live = yield* readMethod(news);
+  if (live === undefined) {
+    return yield* Effect6.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: write returned no error but the method is still absent.`));
+  }
+  return live;
+});
+
+// src/openbao/auth-method.ts
+var BaoAuthMethod = Resource("Bao.AuthMethod", {
+  defaultRemovalPolicy: "retain"
+});
+var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect7.succeed(BaoAuthMethod.Provider.of({
+  list: () => Effect7.succeed([]),
+  read: Effect7.fn(function* ({ olds }) {
     return yield* readMethod(olds);
   }),
-  diff: Effect3.fn(function* ({ news, output }) {
+  diff: Effect7.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved(news))
       return;
+    const move = planMove("Bao.AuthMethod", output.path, news.path, news.remountFrom);
+    if (move.kind === "refuse")
+      return yield* Effect7.die(new Error(move.message));
+    if (move.kind === "move")
+      return { action: "update" };
     const live = yield* readMethod(news);
     if (live === undefined)
       return { action: "update" };
@@ -319,25 +604,10 @@ var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect3.succeed
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect3.fn(function* ({ news }) {
-    let live = yield* readMethod(news);
-    if (live === undefined) {
-      yield* enableAuthMethod(news);
-      if (wantsTune2(news))
-        yield* tuneAuthMethod(news);
-    } else if (!matches2(live, news)) {
-      if (live.type !== news.type) {
-        return yield* Effect3.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Auth method type is immutable — replace manually."));
-      }
-      yield* tuneAuthMethod(news);
-    }
-    live = yield* readMethod(news);
-    if (live === undefined) {
-      return yield* Effect3.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: write returned no error but the method is still absent.`));
-    }
-    return live;
+  reconcile: Effect7.fn(function* ({ news, output }) {
+    return yield* reconcileAuthMethod(news, output?.path);
   }),
-  delete: Effect3.fn(function* ({ output }) {
+  delete: Effect7.fn(function* ({ output }) {
     yield* disableAuthMethod(output.path);
     return;
   })
@@ -346,7 +616,7 @@ var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect3.succeed
 import { Resource as Resource2 } from "alchemy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect4 from "effect/Effect";
+import * as Effect8 from "effect/Effect";
 
 // src/openbao/auth-role-form.ts
 var policiesOf = (live) => {
@@ -395,6 +665,7 @@ var writeBody = (props) => {
   }
   return body;
 };
+var isRename = (from, to) => from.toLowerCase() !== to.toLowerCase();
 var samePolicies = (want, have) => want.length === have.length && want.every((policy, index) => policy === have[index]);
 var sameTtl3 = (want, have) => {
   const wantSeconds = parseDuration(want);
@@ -410,20 +681,22 @@ var matches3 = (attributes, props) => {
 var BaoAuthRole = Resource2("Bao.AuthRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole = (props) => Effect4.gen(function* () {
+var readRole = (props) => Effect8.gen(function* () {
   const live = yield* baoRead(readPath3(props.name));
   if (live === undefined)
     return;
   return attributesOf3(props, live);
 });
-var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect4.succeed(BaoAuthRole.Provider.of({
-  list: () => Effect4.succeed([]),
-  read: Effect4.fn(function* ({ olds }) {
+var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect8.succeed(BaoAuthRole.Provider.of({
+  list: () => Effect8.succeed([]),
+  read: Effect8.fn(function* ({ olds }) {
     return yield* readRole(olds);
   }),
-  diff: Effect4.fn(function* ({ news, output }) {
+  diff: Effect8.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved2(news))
       return;
+    if (isRename(output.name, news.name))
+      return { action: "replace" };
     const live = yield* readRole(news);
     if (live === undefined)
       return { action: "update" };
@@ -431,27 +704,107 @@ var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect4.succeed(Ba
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect4.fn(function* ({ news }) {
+  reconcile: Effect8.fn(function* ({ news }) {
     const live = yield* readRole(news);
     if (live === undefined || !matches3(live, news)) {
       yield* baoWrite("PUT", readPath3(news.name), writeBody(news));
     }
     const after = yield* readRole(news);
     if (after === undefined) {
-      return yield* Effect4.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
+      return yield* Effect8.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
     }
     return after;
   }),
-  delete: Effect4.fn(function* ({ output }) {
+  delete: Effect8.fn(function* ({ output }) {
     yield* baoDelete(readPath3(output.name));
     return;
   })
 })));
+// src/openbao/bao-identity.ts
+import * as Effect9 from "effect/Effect";
+import * as FetchHttpClient3 from "effect/unstable/http/FetchHttpClient";
+
+// src/openbao/bao-namespace.ts
+var canonicalNamespace = (namespace) => {
+  const bare = trimSlashes((namespace ?? "").trim());
+  return bare === "root" ? "" : bare;
+};
+var namespacePath = (namespace) => {
+  const bare = canonicalNamespace(namespace);
+  return bare === "" ? "" : `${bare}/`;
+};
+var envNamespace = (env) => canonicalNamespace(resolveAddress(env).namespace);
+var namespaceLabel = (namespace) => namespace === "" ? "root" : namespace;
+
+// src/openbao/bao-identity.ts
+class BaoIdentityError extends Error {
+  reason;
+  constructor(reason, detail) {
+    super(`REFUSING: ${detail}`);
+    this.reason = reason;
+    this.name = "BaoIdentityError";
+  }
+}
+var HEALTH_PATH = "sys/health?standbyok=true&sealedcode=200&uninitcode=200";
+var NAMESPACE_PROBE_PATH = "sys/internal/ui/mounts";
+var addressOf = (env) => {
+  const address = resolveAddress(env);
+  return address.socket === undefined ? address.base : `unix://${address.socket}`;
+};
+var unreachable = (address, what) => (error) => new BaoIdentityError("unreachable", `${address} did not answer ${what}: ${error.message}`);
+var text3 = (value) => typeof value === "string" ? value : "";
+var checkHealth = (address, expectedCluster, body) => {
+  if (body === undefined || typeof body["sealed"] !== "boolean") {
+    return new BaoIdentityError("unconfirmed", `${address} answered sys/health, but not as OpenBao.`);
+  }
+  if (body["initialized"] === false) {
+    return new BaoIdentityError("unconfirmed", `${address} is not initialised.`);
+  }
+  if (body["sealed"] === true) {
+    return new BaoIdentityError("unconfirmed", `${address} is sealed, and a sealed vault does not report its cluster_name.`);
+  }
+  const clusterName = text3(body["cluster_name"]);
+  if (clusterName !== expectedCluster) {
+    return new BaoIdentityError("mismatch", `${address} answers as cluster \`${clusterName || "(none)"}\`, but this stack expects ` + `\`${expectedCluster}\`. Check BAO_ADDR and BAO_AGENT_ADDR (the agent address wins).`);
+  }
+  return { clusterId: text3(body["cluster_id"]), version: text3(body["version"]) };
+};
+var assertBaoIdentityEffect = (expected) => Effect9.gen(function* () {
+  const env = yield* BaoEnv;
+  const address = addressOf(env);
+  const clusterName = expected.clusterName.trim();
+  if (clusterName === "") {
+    return yield* Effect9.fail(new BaoIdentityError("input", "clusterName is empty, so there is nothing to compare."));
+  }
+  const namespace = canonicalNamespace(expected.namespace);
+  const sent = envNamespace(env);
+  if (sent !== namespace) {
+    return yield* Effect9.fail(new BaoIdentityError("mismatch", `BAO_NAMESPACE resolves to \`${namespaceLabel(sent)}\`, but this stack expects ` + `\`${namespaceLabel(namespace)}\`.`));
+  }
+  const anonymous = { ...env, BAO_NAMESPACE: "", BAO_TOKEN: "" };
+  const body = yield* baoCall("read", "GET", HEALTH_PATH).pipe(Effect9.provideService(BaoEnv, anonymous), Effect9.mapError(unreachable(address, "sys/health")));
+  const health = checkHealth(address, clusterName, body);
+  if (health instanceof BaoIdentityError)
+    return yield* Effect9.fail(health);
+  if (namespace !== "") {
+    const scoped = { ...env, BAO_NAMESPACE: namespace, BAO_TOKEN: "" };
+    const probe = yield* baoCall("read", "GET", NAMESPACE_PROBE_PATH).pipe(Effect9.provideService(BaoEnv, scoped), Effect9.mapError(unreachable(address, `the namespace probe for \`${namespace}\``)));
+    if (probe === undefined) {
+      return yield* Effect9.fail(new BaoIdentityError("mismatch", `cluster \`${clusterName}\` at ${address} has no namespace \`${namespace}\`.`));
+    }
+  }
+  return { address, clusterName, namespace, ...health };
+});
+var assertBaoIdentity = (input) => {
+  const effect3 = assertBaoIdentityEffect(input);
+  const scoped = input.env === undefined ? effect3 : Effect9.provideService(effect3, BaoEnv, input.env);
+  return Effect9.runPromise(scoped.pipe(Effect9.provide(FetchHttpClient3.layer)));
+};
 // src/openbao/cloudflare-role.ts
 import { Resource as Resource3 } from "alchemy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 import * as Provider3 from "alchemy/Provider";
-import * as Effect7 from "effect/Effect";
+import * as Effect12 from "effect/Effect";
 
 // src/openbao/cloudflare-group-scope.ts
 var zoneResource = (zoneId) => `com.cloudflare.api.account.zone.${zoneId}`;
@@ -471,7 +824,7 @@ var groupKey = (name, scope) => `${scope} ${name}`;
 
 // src/openbao/cloudflare-permission-groups.ts
 import * as Context2 from "effect/Context";
-import * as Effect6 from "effect/Effect";
+import * as Effect11 from "effect/Effect";
 
 // src/openbao/cloudflare-permission-groups-solve.ts
 var observationsOf = (declared, live) => declared.flatMap((role) => {
@@ -641,7 +994,7 @@ var samePolicies2 = (want, have) => want.length === have.length && want.every((w
 });
 
 // src/openbao/cloudflare-role-wire.ts
-import * as Effect5 from "effect/Effect";
+import * as Effect10 from "effect/Effect";
 
 // src/openbao/cloudflare-role-form.ts
 var rolePath = (mount, name) => `${mountPath(mount)}/roles/${name}`;
@@ -706,7 +1059,7 @@ var differences = (props, policies, live) => {
 };
 
 // src/openbao/cloudflare-role-wire.ts
-var readCloudflareRole = (mount, name) => Effect5.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
+var readCloudflareRole = (mount, name) => Effect10.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
 var writeCloudflareRole = (mount, name, body) => baoWrite("PUT", rolePath(mount, name), body);
 var deleteCloudflareRole = (mount, name) => baoDelete(rolePath(mount, name));
 
@@ -728,9 +1081,9 @@ var pick = (mount, groups, refs, hint) => {
   const unknown = refs.filter((ref) => !groups.has(groupKey(ref.name, ref.scope)));
   if (unknown.length > 0) {
     const problems = unknown.map((ref) => `unknown group ${JSON.stringify(ref.name)} at scope ${ref.scope} — ${hint}`);
-    return Effect6.fail(new CloudflareGroupsError(mount, problems));
+    return Effect11.fail(new CloudflareGroupsError(mount, problems));
   }
-  return Effect6.succeed(new Map(refs.flatMap((ref) => {
+  return Effect11.succeed(new Map(refs.flatMap((ref) => {
     const key = groupKey(ref.name, ref.scope);
     const id = groups.get(key);
     return id === undefined ? [] : [[key, id]];
@@ -738,15 +1091,15 @@ var pick = (mount, groups, refs, hint) => {
 };
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var deniedHint = (mount) => `GET ${mountPath(mount)}/permission-groups answered 403 — this token's policy carries no ` + `\`path "${mountPath(mount)}/permission-groups" { capabilities = ["read"] }\` grant. ` + "It is declared in ../platform/secrets/vault/policies/homeflare-admin/" + "20-cloudflare-permission-groups.hcl and applies with `alchemy deploy` of this stack";
-var deniedNamed = (mount, read) => Effect6.catchIf(read, (error) => error.status === 403, () => Effect6.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
-var engineGroups = (mount) => Effect6.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
+var deniedNamed = (mount, read) => Effect11.catchIf(read, (error) => error.status === 403, () => Effect11.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
+var engineGroups = (mount) => Effect11.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
   const list = data?.["permission_groups"];
   if (data === undefined) {
     const why = "GET <mount>/permission-groups answered 404 — the endpoint is not deployed here";
-    return Effect6.fail(new CloudflareGroupsError(mount, [why]));
+    return Effect11.fail(new CloudflareGroupsError(mount, [why]));
   }
   if (!Array.isArray(list)) {
-    return Effect6.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
+    return Effect11.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
   }
   const scoped = new Map;
   const idsOf = new Map;
@@ -773,24 +1126,24 @@ var engineGroups = (mount) => Effect6.flatMap(deniedNamed(mount, baoRead(`${moun
     const only = [...ids];
     return ids.size === 1 && only[0] !== undefined ? [[name, only[0]]] : [];
   }));
-  return problems.length > 0 ? Effect6.fail(new CloudflareGroupsError(mount, problems)) : Effect6.succeed(new Map([...atEveryScope(sole), ...scoped]));
+  return problems.length > 0 ? Effect11.fail(new CloudflareGroupsError(mount, problems)) : Effect11.succeed(new Map([...atEveryScope(sole), ...scoped]));
 });
-var permissionGroupsFromEngine = () => Effect6.sync(() => {
+var permissionGroupsFromEngine = () => Effect11.sync(() => {
   const cache = new Map;
-  const cachedFor = (mount) => Effect6.suspend(() => {
+  const cachedFor = (mount) => Effect11.suspend(() => {
     const hit = cache.get(mountPath(mount));
     if (hit !== undefined)
       return hit;
-    return Effect6.flatMap(Effect6.cached(engineGroups(mount)), (lookup) => {
+    return Effect11.flatMap(Effect11.cached(engineGroups(mount)), (lookup) => {
       cache.set(mountPath(mount), lookup);
       return lookup;
     });
   });
   return CloudflarePermissionGroups.of({
-    resolve: (mount, refs) => Effect6.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
+    resolve: (mount, refs) => Effect11.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
   });
 });
-var permissionGroupsFromLiveRoles = (declared) => Effect6.gen(function* () {
+var permissionGroupsFromLiveRoles = (declared) => Effect11.gen(function* () {
   const accountOf = new Map;
   const byAccount = new Map;
   for (const [mount, roles] of declared) {
@@ -801,9 +1154,9 @@ var permissionGroupsFromLiveRoles = (declared) => Effect6.gen(function* () {
   }
   const solved = new Map;
   for (const [account, roles] of byAccount) {
-    const solve = Effect6.gen(function* () {
+    const solve = Effect11.gen(function* () {
       const live = new Map;
-      yield* Effect6.all(roles.map((role) => Effect6.map(readCloudflareRole(role.mount, role.name), (read) => {
+      yield* Effect11.all(roles.map((role) => Effect11.map(readCloudflareRole(role.mount, role.name), (read) => {
         if (read?.policies !== undefined) {
           live.set(`${role.mount}/${role.name}`, read.policies);
         }
@@ -811,11 +1164,11 @@ var permissionGroupsFromLiveRoles = (declared) => Effect6.gen(function* () {
       const result = solveGroups(observationsOf(roles, live));
       const problems = describeProblems(result);
       if (problems.length > 0) {
-        return yield* Effect6.fail(new CloudflareGroupsError(`account ${account}`, problems));
+        return yield* Effect11.fail(new CloudflareGroupsError(`account ${account}`, problems));
       }
       return atEveryScope(result.groups);
     });
-    solved.set(account, yield* Effect6.cached(solve));
+    solved.set(account, yield* Effect11.cached(solve));
   }
   return CloudflarePermissionGroups.of({
     resolve: (mount, refs) => {
@@ -823,10 +1176,10 @@ var permissionGroupsFromLiveRoles = (declared) => Effect6.gen(function* () {
       const lookup = account === undefined ? undefined : solved.get(account);
       if (account === undefined || lookup === undefined) {
         const why = "no declared role on this mount, so no live role can vouch for its groups";
-        return Effect6.fail(new CloudflareGroupsError(mount, [why]));
+        return Effect11.fail(new CloudflareGroupsError(mount, [why]));
       }
       const hint = `no live role on account ${account} carries it; a NEW group needs the engine endpoint`;
-      return Effect6.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
+      return Effect11.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
     }
   });
 });
@@ -835,9 +1188,9 @@ var permissionGroupsFromLiveRoles = (declared) => Effect6.gen(function* () {
 var BaoCloudflareRole = Resource3("Bao.CloudflareRole", {
   defaultRemovalPolicy: "retain"
 });
-var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect7.gen(function* () {
+var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect12.gen(function* () {
   const groups = yield* CloudflarePermissionGroups;
-  const resolved = (props) => Effect7.gen(function* () {
+  const resolved = (props) => Effect12.gen(function* () {
     const refs = new Map;
     for (const policy of props.policies) {
       const scope = policy.scope ?? scopeOfResource(policy.resource);
@@ -847,17 +1200,17 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
     const ids = yield* groups.resolve(props.mount, [...refs.values()]);
     const { missing, policies } = resolvePolicies(props.policies, ids);
     if (missing.length > 0) {
-      return yield* Effect7.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
+      return yield* Effect12.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
     }
     return policies;
   });
   return BaoCloudflareRole.Provider.of({
-    list: () => Effect7.succeed([]),
-    read: Effect7.fn(function* ({ olds }) {
+    list: () => Effect12.succeed([]),
+    read: Effect12.fn(function* ({ olds }) {
       const live = yield* readCloudflareRole(olds.mount, olds.name);
       return live === undefined ? undefined : attributesOf4(olds, live);
     }),
-    diff: Effect7.fn(function* ({ news, output }) {
+    diff: Effect12.fn(function* ({ news, output }) {
       if (output === undefined || !isResolved3(news))
         return;
       if (refusalOf(news) !== undefined)
@@ -868,11 +1221,11 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
         return { action: "update" };
       return differences(news, policies, live).length === 0 ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect7.fn(function* ({ news }) {
+    reconcile: Effect12.fn(function* ({ news }) {
       const path = rolePath(news.mount, news.name);
-      const refusal = refusalOf(news);
-      if (refusal !== undefined) {
-        return yield* Effect7.die(new Error(`Bao.CloudflareRole ${path}: ${refusal}.`));
+      const refusal2 = refusalOf(news);
+      if (refusal2 !== undefined) {
+        return yield* Effect12.die(new Error(`Bao.CloudflareRole ${path}: ${refusal2}.`));
       }
       const policies = yield* resolved(news);
       const live = yield* readCloudflareRole(news.mount, news.name);
@@ -881,22 +1234,22 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
       }
       const after = yield* readCloudflareRole(news.mount, news.name);
       if (after === undefined) {
-        return yield* Effect7.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
+        return yield* Effect12.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
       }
       const left = differences(news, policies, after);
       if (left.length > 0) {
-        return yield* Effect7.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
+        return yield* Effect12.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
       }
       return attributesOf4(news, after);
     }),
-    delete: Effect7.fn(function* ({ output }) {
+    delete: Effect12.fn(function* ({ output }) {
       yield* deleteCloudflareRole(output.mount, output.name);
       return;
     })
   });
 }));
 // src/openbao/cloudflare-roles-expand.ts
-var slug = (name) => name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+var slug = (name) => trimRuns(name.toLowerCase().replace(/[^a-z0-9]+/g, "-"), "-");
 var zoneSlug = (zone) => `${slug(zone.name)}${zone.internal ? "-internal" : ""}`;
 var mountName = (account, surface) => `cloudflare-${account}-${surface}`;
 var policiesFor = (tpl, accountId, zone, accountGroups) => {
@@ -991,129 +1344,1014 @@ class RolesConfigError extends Error {
   }
 }
 var isRaw = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var record = (value, where) => {
+var record2 = (value, where) => {
   if (!isRaw(value))
     throw new RolesConfigError(where, "expected a mapping");
   return value;
 };
-var text3 = (raw, key, where) => {
-  const value = raw[key];
-  if (typeof value === "string")
-    return value;
-  throw new RolesConfigError(`${where}.${key}`, `expected a string, got ${JSON.stringify(value)}`);
+var text4 = (raw, key, where) => {
+  const value = raw[key];
+  if (typeof value === "string")
+    return value;
+  throw new RolesConfigError(`${where}.${key}`, `expected a string, got ${JSON.stringify(value)}`);
+};
+var texts = (raw, key, where) => {
+  const value = raw[key];
+  if (value === undefined || value === null)
+    return;
+  if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
+    return value;
+  }
+  throw new RolesConfigError(`${where}.${key}`, "expected a list of strings");
+};
+var entries = (raw, key, where) => {
+  const value = raw[key];
+  if (value === undefined || value === null)
+    return [];
+  if (!Array.isArray(value))
+    throw new RolesConfigError(`${where}.${key}`, "expected a list");
+  return value;
+};
+var template = (value, where) => {
+  const raw = record2(value, where);
+  const groups = texts(raw, "groups", where);
+  if (groups === undefined)
+    throw new RolesConfigError(`${where}.groups`, "is required");
+  const bucket = raw["bucket"] === undefined ? undefined : text4(raw, "bucket", where);
+  if (bucket !== undefined && bucket.length === 0) {
+    throw new RolesConfigError(`${where}.bucket`, "is empty; omit it to stay account-wide");
+  }
+  const groupsScope = raw["groups_scope"] === undefined ? undefined : groupScopeNamed(text4(raw, "groups_scope", where));
+  if (raw["groups_scope"] !== undefined && groupsScope === undefined) {
+    throw new RolesConfigError(`${where}.groups_scope`, `expected one of ${Object.keys(GROUP_SCOPES).join(", ")}`);
+  }
+  return {
+    accountGroups: texts(raw, "account_groups", where) ?? [],
+    bucket,
+    bucketJurisdiction: raw["bucket_jurisdiction"] === undefined ? "default" : text4(raw, "bucket_jurisdiction", where),
+    desc: raw["desc"] === undefined ? "" : text4(raw, "desc", where),
+    groups,
+    groupsScope,
+    maxTtl: text4(raw, "max_ttl", where),
+    name: text4(raw, "name", where),
+    ttl: text4(raw, "ttl", where),
+    zoneTypes: texts(raw, "zone_types", where) ?? [],
+    zones: texts(raw, "zones", where)
+  };
+};
+var surface = (name, value) => {
+  const where = `surfaces.${name}`;
+  const raw = record2(value, where);
+  return {
+    accountRoles: entries(raw, "account_roles", where).map((item, i) => template(item, `${where}.account_roles[${String(i)}]`)),
+    zoneRoles: entries(raw, "zone_roles", where).map((item, i) => template(item, `${where}.zone_roles[${String(i)}]`))
+  };
+};
+var account = (key, value, surfaces) => {
+  const where = `accounts.${key}`;
+  const raw = record2(value, where);
+  const names = texts(raw, "surfaces", where) ?? [];
+  for (const name of names) {
+    if (surfaces[name] === undefined) {
+      throw new RolesConfigError(`${where}.surfaces`, `names ${name}, which surfaces: never defines`);
+    }
+  }
+  const zones = raw["zones"] === undefined || raw["zones"] === "all" ? "all" : texts(raw, "zones", where);
+  return { id: text4(raw, "id", where), key, surfaces: names, zones: zones ?? "all" };
+};
+var parseRolesConfig = (yaml) => {
+  const root = record2(Bun.YAML.parse(yaml), "(document)");
+  const surfaces = {};
+  for (const [name, spec] of Object.entries(record2(root["surfaces"], "surfaces"))) {
+    surfaces[name] = surface(name, spec);
+  }
+  const accounts = Object.entries(record2(root["accounts"], "accounts")).map(([key, value]) => account(key, value, surfaces));
+  return {
+    accounts,
+    namespace: text4(record2(root["defaults"], "defaults"), "namespace", "defaults"),
+    surfaces
+  };
+};
+// src/openbao/host-approles.ts
+var NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var HOST_ROLE_SEPARATOR = "--";
+var hostRoleName = (className, host) => `${className}${HOST_ROLE_SEPARATOR}${host}`;
+var classProblems = (name, spec) => {
+  const found = [];
+  if (!NAME.test(name))
+    found.push(`class \`${name}\` is not lowercase letters, digits, single hyphens`);
+  if (spec.policies.length === 0)
+    found.push(`class \`${name}\` has no policies`);
+  if (spec.policies.includes("root"))
+    found.push(`class \`${name}\` grants \`root\``);
+  const secretId = parseDuration(spec.secretIdTtl);
+  if (secretId === undefined || secretId <= 0) {
+    found.push(`class \`${name}\` secretIdTtl \`${spec.secretIdTtl}\` must be a duration above zero ` + "(0 never expires)");
+  }
+  const ttl = parseDuration(spec.tokenTtl);
+  const max = parseDuration(spec.tokenMaxTtl);
+  if (ttl === undefined || max === undefined) {
+    found.push(`class \`${name}\` token TTLs must be durations like 15m or 1h`);
+  } else if (max > 0 && ttl > max) {
+    found.push(`class \`${name}\` tokenTtl is longer than tokenMaxTtl`);
+  }
+  return found;
+};
+var hostAppRoles = (input) => {
+  const problems = Object.entries(input.classes).flatMap(([name, spec]) => classProblems(name, spec));
+  const seen = new Set;
+  const roles = [];
+  for (const host of input.hosts) {
+    if (!NAME.test(host.name)) {
+      problems.push(`host \`${host.name}\` is not lowercase letters, digits, single hyphens`);
+    }
+    if (seen.has(host.name))
+      problems.push(`host \`${host.name}\` is listed twice`);
+    seen.add(host.name);
+    const spec = input.classes[host.class];
+    if (spec === undefined) {
+      problems.push(`host \`${host.name}\` names unknown class \`${host.class}\``);
+      continue;
+    }
+    roles.push({
+      bindSecretId: true,
+      name: hostRoleName(host.class, host.name),
+      secretIdNumUses: spec.secretIdNumUses ?? 0,
+      secretIdTtl: spec.secretIdTtl,
+      tokenMaxTtl: spec.tokenMaxTtl,
+      tokenPolicies: [...new Set(spec.policies)].sort(),
+      tokenTtl: spec.tokenTtl
+    });
+  }
+  if (problems.length > 0) {
+    throw new Error(`hostAppRoles refused the input: ${problems.join("; ")}.`);
+  }
+  return roles.sort((a, b) => a.name.localeCompare(b.name));
+};
+// src/openbao/jwt-config.ts
+import { Resource as Resource4 } from "alchemy";
+import { isResolved as isResolved4 } from "alchemy/Diff";
+import * as Provider4 from "alchemy/Provider";
+import * as Effect14 from "effect/Effect";
+
+// src/openbao/jwt-config-form.ts
+var text5 = (value) => typeof value === "string" ? value.trim() : "";
+var strings2 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var sortedSet = (values) => [...new Set(values.map((value) => value.trim()))].sort();
+var canonical2 = (input) => ({
+  boundIssuer: input.boundIssuer.trim(),
+  defaultRole: input.defaultRole.trim(),
+  jwksCaPem: input.jwksCaPem.trim(),
+  jwksUrl: input.jwksUrl.trim(),
+  jwtSupportedAlgs: sortedSet(input.jwtSupportedAlgs),
+  jwtValidationPubkeys: sortedSet(input.jwtValidationPubkeys),
+  oidcDiscoveryCaPem: input.oidcDiscoveryCaPem.trim(),
+  oidcDiscoveryUrl: input.oidcDiscoveryUrl.trim()
+});
+var canonicalFromProps = (props) => canonical2({
+  boundIssuer: props.boundIssuer ?? "",
+  defaultRole: props.defaultRole ?? "",
+  jwksCaPem: props.jwksCaPem ?? "",
+  jwksUrl: props.jwksUrl ?? "",
+  jwtSupportedAlgs: props.jwtSupportedAlgs ?? [],
+  jwtValidationPubkeys: props.jwtValidationPubkeys ?? [],
+  oidcDiscoveryCaPem: props.oidcDiscoveryCaPem ?? "",
+  oidcDiscoveryUrl: props.oidcDiscoveryUrl ?? ""
+});
+var canonicalFromLive = (live) => canonical2({
+  boundIssuer: text5(live["bound_issuer"]),
+  defaultRole: text5(live["default_role"]),
+  jwksCaPem: text5(live["jwks_ca_pem"]),
+  jwksUrl: text5(live["jwks_url"]),
+  jwtSupportedAlgs: strings2(live["jwt_supported_algs"]),
+  jwtValidationPubkeys: strings2(live["jwt_validation_pubkeys"]),
+  oidcDiscoveryCaPem: text5(live["oidc_discovery_ca_pem"]),
+  oidcDiscoveryUrl: text5(live["oidc_discovery_url"])
+});
+var mountOf = (props) => mountPath(props.mount ?? "jwt");
+var configPath = (props) => `auth/${mountOf(props)}/config`;
+var attributesOf5 = (props, live) => {
+  const form = canonicalFromLive(live);
+  return { ...form, digest: sha256(JSON.stringify(form)), mount: mountOf(props) };
+};
+var matches4 = (attributes, props) => attributes.digest === sha256(JSON.stringify(canonicalFromProps(props)));
+var writeBody3 = (props) => ({
+  bound_issuer: props.boundIssuer ?? "",
+  default_role: props.defaultRole ?? "",
+  jwks_ca_pem: props.jwksCaPem ?? "",
+  jwks_url: props.jwksUrl ?? "",
+  jwt_supported_algs: [...props.jwtSupportedAlgs ?? []],
+  jwt_validation_pubkeys: [...props.jwtValidationPubkeys ?? []],
+  oidc_discovery_ca_pem: props.oidcDiscoveryCaPem ?? "",
+  oidc_discovery_url: props.oidcDiscoveryUrl ?? ""
+});
+var wouldErase = (live) => {
+  const lost = [];
+  if (text5(live["oidc_client_id"]) !== "")
+    lost.push("oidc_client_id (and its unreadable secret)");
+  const provider = live["provider_config"];
+  if (typeof provider === "object" && provider !== null && Object.keys(provider).length > 0) {
+    lost.push("provider_config");
+  }
+  if (text5(live["oidc_response_mode"]) !== "")
+    lost.push("oidc_response_mode");
+  if (strings2(live["oidc_response_types"]).length > 0)
+    lost.push("oidc_response_types");
+  if (strings2(live["override_allowed_server_names"]).length > 0) {
+    lost.push("override_allowed_server_names");
+  }
+  return lost;
+};
+var problems = (props) => {
+  const found = [];
+  const sources = [
+    (props.oidcDiscoveryUrl ?? "") !== "",
+    (props.jwksUrl ?? "") !== "",
+    (props.jwtValidationPubkeys?.length ?? 0) > 0
+  ].filter(Boolean).length;
+  if (sources !== 1) {
+    found.push("exactly one of oidcDiscoveryUrl, jwksUrl or jwtValidationPubkeys must be set");
+  }
+  if ((props.oidcDiscoveryUrl ?? "").includes(".well-known")) {
+    found.push("oidcDiscoveryUrl must be the issuer, without /.well-known/openid-configuration");
+  }
+  const role = props.defaultRole ?? "";
+  if (role !== role.toLowerCase())
+    found.push(`defaultRole \`${role}\` must be lower case`);
+  return found;
+};
+
+// src/openbao/role-reconcile.ts
+import * as Effect13 from "effect/Effect";
+var readRoleAt = (spec) => Effect13.map(baoRead(spec.path), (live) => live === undefined ? undefined : { attributes: spec.attributesOf(live), live });
+var planRole = (spec) => Effect13.gen(function* () {
+  if (spec.problems.length > 0)
+    return "update";
+  const found = yield* readRoleAt(spec);
+  return found !== undefined && spec.matches(found.attributes) ? "noop" : "update";
+});
+var refuse2 = (spec, message) => Effect13.die(new Error(`${spec.family} ${spec.path}: ${message}`));
+var reconcileRole = (spec) => Effect13.gen(function* () {
+  if (spec.problems.length > 0)
+    return yield* refuse2(spec, spec.problems.join("; "));
+  const found = yield* readRoleAt(spec);
+  if (found === undefined || !spec.matches(found.attributes)) {
+    const lost = found === undefined ? [] : spec.wouldErase?.(found.live) ?? [];
+    if (lost.length > 0) {
+      return yield* refuse2(spec, `live carries ${lost.join(", ")}, which this resource does not declare and the write ` + "would reset. Fold it into the declaration, or clear it by hand first.");
+    }
+    yield* baoWrite("PUT", spec.path, spec.body);
+  }
+  const after = yield* readRoleAt(spec);
+  if (after === undefined)
+    return yield* refuse2(spec, "write reported success but it is absent.");
+  if (!spec.matches(after.attributes)) {
+    return yield* refuse2(spec, "wrote cleanly but read back different — OpenBao stored something other than what was " + "declared. Read it by hand before retrying.");
+  }
+  return after.attributes;
+});
+
+// src/openbao/jwt-config.ts
+var BaoJwtAuthConfig = Resource4("Bao.JwtAuthConfig", {
+  defaultRemovalPolicy: "retain"
+});
+var jwtConfigSpec = (props) => ({
+  attributesOf: (live) => attributesOf5(props, live),
+  body: writeBody3(props),
+  family: "Bao.JwtAuthConfig",
+  matches: (attributes) => matches4(attributes, props),
+  path: configPath(props),
+  problems: problems(props),
+  wouldErase
+});
+var BaoJwtAuthConfigProvider = () => Provider4.effect(BaoJwtAuthConfig, Effect14.succeed(BaoJwtAuthConfig.Provider.of({
+  list: () => Effect14.succeed([]),
+  read: Effect14.fn(function* ({ olds }) {
+    const found = yield* readRoleAt(jwtConfigSpec(olds));
+    return found?.attributes;
+  }),
+  diff: Effect14.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved4(news))
+      return;
+    if (mountOf(news) !== output.mount)
+      return { action: "replace" };
+    return { action: yield* planRole(jwtConfigSpec(news)) };
+  }),
+  reconcile: Effect14.fn(function* ({ news }) {
+    return yield* reconcileRole(jwtConfigSpec(news));
+  }),
+  delete: () => Effect14.void
+})));
+// src/openbao/jwt-role.ts
+import { Resource as Resource5 } from "alchemy";
+import { isResolved as isResolved5 } from "alchemy/Diff";
+import * as Provider5 from "alchemy/Provider";
+import * as Effect15 from "effect/Effect";
+
+// src/openbao/auth-token-form.ts
+var sortedSet2 = (values) => [...new Set(values)].sort();
+var cidr = (value) => value.trim().replace(/\/(32|128)$/, "");
+var strings3 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var seconds2 = (text6) => parseDuration(text6 ?? "0") ?? -1;
+var tokenFields = (input) => ({
+  tokenBoundCidrs: input.tokenBoundCidrs,
+  tokenExplicitMaxTtlSeconds: input.tokenExplicitMaxTtlSeconds,
+  tokenMaxTtlSeconds: input.tokenMaxTtlSeconds,
+  tokenNoDefaultPolicy: input.tokenNoDefaultPolicy,
+  tokenNumUses: input.tokenNumUses,
+  tokenPeriodSeconds: input.tokenPeriodSeconds,
+  tokenPolicies: input.tokenPolicies,
+  tokenTtlSeconds: input.tokenTtlSeconds,
+  tokenType: input.tokenType
+});
+var tokenForm = (input) => ({
+  tokenBoundCidrs: sortedSet2(input.tokenBoundCidrs.map(cidr)),
+  tokenExplicitMaxTtlSeconds: input.tokenExplicitMaxTtlSeconds,
+  tokenMaxTtlSeconds: input.tokenMaxTtlSeconds,
+  tokenNoDefaultPolicy: input.tokenNoDefaultPolicy,
+  tokenNumUses: input.tokenNumUses,
+  tokenPeriodSeconds: input.tokenPeriodSeconds,
+  tokenPolicies: sortedSet2(input.tokenPolicies),
+  tokenTtlSeconds: input.tokenTtlSeconds,
+  tokenType: input.tokenType
+});
+var tokenFormOfProps = (props) => tokenForm({
+  tokenBoundCidrs: props.tokenBoundCidrs ?? [],
+  tokenExplicitMaxTtlSeconds: seconds2(props.tokenExplicitMaxTtl),
+  tokenMaxTtlSeconds: seconds2(props.tokenMaxTtl),
+  tokenNoDefaultPolicy: props.tokenNoDefaultPolicy ?? false,
+  tokenNumUses: props.tokenNumUses ?? 0,
+  tokenPeriodSeconds: seconds2(props.tokenPeriod),
+  tokenPolicies: props.tokenPolicies,
+  tokenTtlSeconds: seconds2(props.tokenTtl),
+  tokenType: props.tokenType ?? "default"
+});
+var tokenFormOfLive = (live) => tokenForm({
+  tokenBoundCidrs: strings3(live["token_bound_cidrs"]),
+  tokenExplicitMaxTtlSeconds: ttlSeconds(live["token_explicit_max_ttl"]) ?? -1,
+  tokenMaxTtlSeconds: ttlSeconds(live["token_max_ttl"]) ?? -1,
+  tokenNoDefaultPolicy: live["token_no_default_policy"] === true,
+  tokenNumUses: typeof live["token_num_uses"] === "number" ? live["token_num_uses"] : -1,
+  tokenPeriodSeconds: ttlSeconds(live["token_period"]) ?? -1,
+  tokenPolicies: strings3(live["token_policies"]),
+  tokenTtlSeconds: ttlSeconds(live["token_ttl"]) ?? -1,
+  tokenType: typeof live["token_type"] === "string" ? live["token_type"] : ""
+});
+var tokenBody = (props) => ({
+  token_bound_cidrs: [...props.tokenBoundCidrs ?? []],
+  token_explicit_max_ttl: props.tokenExplicitMaxTtl ?? "0",
+  token_max_ttl: props.tokenMaxTtl ?? "0",
+  token_no_default_policy: props.tokenNoDefaultPolicy ?? false,
+  token_num_uses: props.tokenNumUses ?? 0,
+  token_period: props.tokenPeriod ?? "0",
+  token_policies: [...props.tokenPolicies],
+  token_ttl: props.tokenTtl ?? "0",
+  token_type: props.tokenType ?? "default"
+});
+var tokenProblems = (props) => {
+  const found = [];
+  const durations = {
+    tokenExplicitMaxTtl: props.tokenExplicitMaxTtl,
+    tokenMaxTtl: props.tokenMaxTtl,
+    tokenPeriod: props.tokenPeriod,
+    tokenTtl: props.tokenTtl
+  };
+  for (const [field, text6] of Object.entries(durations)) {
+    if (seconds2(text6) < 0)
+      found.push(`${field}=${text6 ?? ""} is not a duration (0 or <n>s|m|h|d)`);
+  }
+  const ttl = seconds2(props.tokenTtl);
+  const max = seconds2(props.tokenMaxTtl);
+  if (ttl > 0 && max > 0 && ttl > max)
+    found.push("tokenTtl is longer than tokenMaxTtl");
+  if (props.tokenType === "batch" && (seconds2(props.tokenPeriod) > 0 || (props.tokenNumUses ?? 0) > 0)) {
+    found.push("a batch token cannot be periodic or use-limited (tokenutil.go:234-241)");
+  }
+  return found;
+};
+
+// src/openbao/jwt-role-form.ts
+var sortedSet3 = (values) => [...new Set(values)].sort();
+var text6 = (value) => typeof value === "string" ? value : "";
+var strings4 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var record3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+var claimsOf = (value) => {
+  const source = record3(value);
+  const out = {};
+  for (const key of Object.keys(source).sort()) {
+    const raw = source[key];
+    out[key] = sortedSet3(typeof raw === "string" ? [raw] : strings4(raw));
+  }
+  return out;
+};
+var mappingsOf = (value) => {
+  const source = record3(value);
+  const out = {};
+  for (const key of Object.keys(source).sort())
+    out[key] = text6(source[key]);
+  return out;
+};
+var canonical3 = (input) => ({
+  allowedRedirectUris: sortedSet3(input.allowedRedirectUris),
+  boundAudiences: sortedSet3(input.boundAudiences),
+  boundClaims: claimsOf(input.boundClaims),
+  boundClaimsType: input.boundClaimsType,
+  boundSubject: input.boundSubject,
+  callbackMode: input.callbackMode,
+  claimMappings: mappingsOf(input.claimMappings),
+  groupsClaim: input.groupsClaim,
+  oidcDisableConfirmation: input.oidcDisableConfirmation,
+  oidcScopes: sortedSet3(input.oidcScopes),
+  roleType: input.roleType,
+  userClaim: input.userClaim,
+  verboseOidcLogging: input.verboseOidcLogging,
+  ...tokenFields(input)
+});
+var canonicalFromProps2 = (props) => canonical3({
+  ...tokenFormOfProps(props),
+  allowedRedirectUris: props.allowedRedirectUris ?? [],
+  boundAudiences: props.boundAudiences ?? [],
+  boundClaims: claimsOf(props.boundClaims ?? {}),
+  boundClaimsType: props.boundClaimsType ?? "string",
+  boundSubject: props.boundSubject ?? "",
+  callbackMode: props.callbackMode ?? "client",
+  claimMappings: props.claimMappings ?? {},
+  groupsClaim: props.groupsClaim ?? "",
+  oidcDisableConfirmation: false,
+  oidcScopes: props.oidcScopes ?? [],
+  roleType: props.roleType,
+  userClaim: props.userClaim,
+  verboseOidcLogging: false
+});
+var canonicalFromLive2 = (live) => canonical3({
+  ...tokenFormOfLive(live),
+  allowedRedirectUris: strings4(live["allowed_redirect_uris"]),
+  boundAudiences: strings4(live["bound_audiences"]),
+  boundClaims: claimsOf(live["bound_claims"]),
+  boundClaimsType: text6(live["bound_claims_type"]),
+  boundSubject: text6(live["bound_subject"]),
+  callbackMode: text6(live["callback_mode"]),
+  claimMappings: mappingsOf(live["claim_mappings"]),
+  groupsClaim: text6(live["groups_claim"]),
+  oidcDisableConfirmation: live["oidc_disable_confirmation"] === true,
+  oidcScopes: strings4(live["oidc_scopes"]),
+  roleType: text6(live["role_type"]),
+  userClaim: text6(live["user_claim"]),
+  verboseOidcLogging: live["verbose_oidc_logging"] === true
+});
+var mountOf2 = (props) => mountPath(props.mount ?? "jwt");
+var rolePath2 = (props) => `auth/${mountOf2(props)}/role/${props.name}`;
+var attributesOf6 = (props, live) => {
+  const form = canonicalFromLive2(live);
+  return { ...form, digest: sha256(JSON.stringify(form)), mount: mountOf2(props), name: props.name };
+};
+var matches5 = (attributes, props) => attributes.digest === sha256(JSON.stringify(canonicalFromProps2(props)));
+var writeBody4 = (props) => ({
+  allowed_redirect_uris: [...props.allowedRedirectUris ?? []],
+  bound_audiences: [...props.boundAudiences ?? []],
+  bound_claims: { ...props.boundClaims },
+  bound_claims_type: props.boundClaimsType ?? "string",
+  bound_subject: props.boundSubject ?? "",
+  callback_mode: props.callbackMode ?? "client",
+  claim_mappings: { ...props.claimMappings },
+  groups_claim: props.groupsClaim ?? "",
+  oidc_disable_confirmation: false,
+  oidc_scopes: [...props.oidcScopes ?? []],
+  role_type: props.roleType,
+  user_claim: props.userClaim,
+  verbose_oidc_logging: false,
+  ...tokenBody(props)
+});
+var NAME2 = /^[a-z0-9_](?:[a-z0-9_.-]*[a-z0-9_])?$/;
+var problems2 = (props) => {
+  const found = [...tokenProblems(props)];
+  if (!NAME2.test(props.name))
+    found.push(`name \`${props.name}\` must be lower case (the server folds it)`);
+  if (props.userClaim.trim() === "")
+    found.push("userClaim is empty; the server requires one");
+  const bound = (props.boundAudiences?.length ?? 0) > 0 || (props.boundSubject ?? "") !== "" || Object.keys(props.boundClaims ?? {}).length > 0 || (props.tokenBoundCidrs?.length ?? 0) > 0;
+  if (props.roleType === "jwt" && !bound) {
+    found.push("a jwt role needs a bound constraint: boundAudiences, boundSubject, boundClaims or tokenBoundCidrs");
+  }
+  if (props.roleType === "oidc" && (props.allowedRedirectUris?.length ?? 0) === 0) {
+    found.push("an oidc role needs allowedRedirectUris");
+  }
+  const targets = Object.values(props.claimMappings ?? {});
+  if (targets.includes("role"))
+    found.push("claimMappings may not map to the reserved key `role`");
+  if (new Set(targets).size !== targets.length)
+    found.push("claimMappings maps two claims to one key");
+  return found;
+};
+
+// src/openbao/jwt-role.ts
+var BaoJwtRole = Resource5("Bao.JwtRole", {
+  defaultRemovalPolicy: "retain"
+});
+var jwtRoleSpec = (props) => ({
+  attributesOf: (live) => attributesOf6(props, live),
+  body: writeBody4(props),
+  family: "Bao.JwtRole",
+  matches: (attributes) => matches5(attributes, props),
+  path: rolePath2(props),
+  problems: problems2(props)
+});
+var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect15.succeed(BaoJwtRole.Provider.of({
+  list: () => Effect15.succeed([]),
+  read: Effect15.fn(function* ({ olds }) {
+    const found = yield* readRoleAt(jwtRoleSpec(olds));
+    return found?.attributes;
+  }),
+  diff: Effect15.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved5(news))
+      return;
+    if (mountOf2(news) !== output.mount || news.name !== output.name) {
+      return { action: "replace" };
+    }
+    return { action: yield* planRole(jwtRoleSpec(news)) };
+  }),
+  reconcile: Effect15.fn(function* ({ news }) {
+    return yield* reconcileRole(jwtRoleSpec(news));
+  }),
+  delete: Effect15.fn(function* ({ output }) {
+    yield* baoDelete(rolePath2(output));
+    return;
+  })
+})));
+// src/openbao/kubernetes-role.ts
+import { Resource as Resource6 } from "alchemy";
+import { isResolved as isResolved6 } from "alchemy/Diff";
+import * as Provider6 from "alchemy/Provider";
+import * as Effect16 from "effect/Effect";
+
+// src/openbao/kubernetes-role-form.ts
+var sortedSet4 = (values) => [...new Set(values)].sort();
+var text7 = (value) => typeof value === "string" ? value : "";
+var strings5 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var canonical4 = (input) => ({
+  aliasNameSource: input.aliasNameSource,
+  audience: input.audience,
+  boundServiceAccountNames: sortedSet4(input.boundServiceAccountNames),
+  boundServiceAccountNamespaceSelector: input.boundServiceAccountNamespaceSelector.trim(),
+  boundServiceAccountNamespaces: sortedSet4(input.boundServiceAccountNamespaces),
+  ...tokenFields(input)
+});
+var canonicalFromProps3 = (props) => canonical4({
+  ...tokenFormOfProps(props),
+  aliasNameSource: props.aliasNameSource,
+  audience: props.audience ?? "",
+  boundServiceAccountNames: props.boundServiceAccountNames,
+  boundServiceAccountNamespaceSelector: props.boundServiceAccountNamespaceSelector ?? "",
+  boundServiceAccountNamespaces: props.boundServiceAccountNamespaces ?? []
+});
+var canonicalFromLive3 = (live) => canonical4({
+  ...tokenFormOfLive(live),
+  aliasNameSource: text7(live["alias_name_source"]),
+  audience: text7(live["audience"]),
+  boundServiceAccountNames: strings5(live["bound_service_account_names"]),
+  boundServiceAccountNamespaceSelector: text7(live["bound_service_account_namespace_selector"]),
+  boundServiceAccountNamespaces: strings5(live["bound_service_account_namespaces"])
+});
+var mountOf3 = (props) => mountPath(props.mount ?? "kubernetes");
+var rolePath3 = (props) => `auth/${mountOf3(props)}/role/${props.name}`;
+var attributesOf7 = (props, live) => {
+  const form = canonicalFromLive3(live);
+  return { ...form, digest: sha256(JSON.stringify(form)), mount: mountOf3(props), name: props.name };
+};
+var matches6 = (attributes, props) => attributes.digest === sha256(JSON.stringify(canonicalFromProps3(props)));
+var writeBody5 = (props) => ({
+  alias_name_source: props.aliasNameSource,
+  audience: props.audience ?? "",
+  bound_service_account_names: [...props.boundServiceAccountNames],
+  bound_service_account_namespace_selector: props.boundServiceAccountNamespaceSelector ?? "",
+  bound_service_account_namespaces: [...props.boundServiceAccountNamespaces ?? []],
+  ...tokenBody(props)
+});
+var NAME3 = /^[a-z0-9_](?:[a-z0-9_.-]*[a-z0-9_])?$/;
+var starMixed = (values) => values.length > 1 && values.includes("*");
+var problems3 = (props) => {
+  const found = [...tokenProblems(props)];
+  const namespaces = props.boundServiceAccountNamespaces ?? [];
+  const selector = (props.boundServiceAccountNamespaceSelector ?? "").trim();
+  if (!NAME3.test(props.name))
+    found.push(`name \`${props.name}\` must be lower case (stored folded)`);
+  if (props.boundServiceAccountNames.length === 0)
+    found.push("boundServiceAccountNames is empty");
+  if (starMixed(props.boundServiceAccountNames))
+    found.push("`*` mixed with other account names");
+  if (namespaces.length === 0 && selector === "") {
+    found.push("boundServiceAccountNamespaces is empty and no namespace selector is set");
+  }
+  if (starMixed(namespaces))
+    found.push("`*` mixed with other namespaces");
+  return found;
 };
-var texts = (raw, key, where) => {
-  const value = raw[key];
-  if (value === undefined || value === null)
+
+// src/openbao/kubernetes-role.ts
+var BaoKubernetesRole = Resource6("Bao.KubernetesRole", {
+  defaultRemovalPolicy: "retain"
+});
+var kubernetesRoleSpec = (props) => ({
+  attributesOf: (live) => attributesOf7(props, live),
+  body: writeBody5(props),
+  family: "Bao.KubernetesRole",
+  matches: (attributes) => matches6(attributes, props),
+  path: rolePath3(props),
+  problems: problems3(props)
+});
+var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect16.succeed(BaoKubernetesRole.Provider.of({
+  list: () => Effect16.succeed([]),
+  read: Effect16.fn(function* ({ olds }) {
+    const found = yield* readRoleAt(kubernetesRoleSpec(olds));
+    return found?.attributes;
+  }),
+  diff: Effect16.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved6(news))
+      return;
+    if (mountOf3(news) !== output.mount || news.name !== output.name) {
+      return { action: "replace" };
+    }
+    return { action: yield* planRole(kubernetesRoleSpec(news)) };
+  }),
+  reconcile: Effect16.fn(function* ({ news }) {
+    return yield* reconcileRole(kubernetesRoleSpec(news));
+  }),
+  delete: Effect16.fn(function* ({ output }) {
+    yield* baoDelete(rolePath3(output));
     return;
-  if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
-    return value;
-  }
-  throw new RolesConfigError(`${where}.${key}`, "expected a list of strings");
+  })
+})));
+// src/openbao/mfa-enforcement.ts
+import { Resource as Resource7 } from "alchemy";
+import { isResolved as isResolved7 } from "alchemy/Diff";
+import * as Provider7 from "alchemy/Provider";
+import * as Effect18 from "effect/Effect";
+
+// src/openbao/mfa-enforcement-form.ts
+var sortedSet5 = (values) => [...new Set(values.map((value) => value.trim()))].filter((value) => value !== "").sort();
+var strings6 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var text8 = (value) => typeof value === "string" ? value : "";
+var canonical5 = (input) => ({
+  authMethodAccessors: sortedSet5(input.authMethodAccessors),
+  authMethodTypes: sortedSet5(input.authMethodTypes),
+  identityEntityIds: sortedSet5(input.identityEntityIds),
+  identityGroupIds: sortedSet5(input.identityGroupIds),
+  mfaMethodIds: sortedSet5(input.mfaMethodIds)
+});
+var canonicalFromProps4 = (props, resolved) => canonical5({
+  authMethodAccessors: [...props.authMethodAccessors ?? [], ...resolved],
+  authMethodTypes: props.authMethodTypes ?? [],
+  identityEntityIds: props.identityEntityIds ?? [],
+  identityGroupIds: props.identityGroupIds ?? [],
+  mfaMethodIds: props.mfaMethodIds
+});
+var canonicalFromLive4 = (live) => canonical5({
+  authMethodAccessors: strings6(live["auth_method_accessors"]),
+  authMethodTypes: strings6(live["auth_method_types"]),
+  identityEntityIds: strings6(live["identity_entity_ids"]),
+  identityGroupIds: strings6(live["identity_group_ids"]),
+  mfaMethodIds: strings6(live["mfa_method_ids"])
+});
+var attributesOf8 = (name, live) => {
+  const form = canonicalFromLive4(live);
+  return {
+    ...form,
+    digest: sha256(JSON.stringify(form)),
+    enforcementId: text8(live["id"]),
+    name,
+    namespacePath: text8(live["namespace_path"])
+  };
 };
-var entries = (raw, key, where) => {
-  const value = raw[key];
-  if (value === undefined || value === null)
-    return [];
-  if (!Array.isArray(value))
-    throw new RolesConfigError(`${where}.${key}`, "expected a list");
-  return value;
+var matches7 = (attributes, props, resolved) => attributes.digest === sha256(JSON.stringify(canonicalFromProps4(props, resolved)));
+var writeBody6 = (form) => ({
+  auth_method_accessors: [...form.authMethodAccessors],
+  auth_method_types: [...form.authMethodTypes],
+  identity_entity_ids: [...form.identityEntityIds],
+  identity_group_ids: [...form.identityGroupIds],
+  mfa_method_ids: [...form.mfaMethodIds]
+});
+var NAME4 = /^\w(?:[\w.-]*\w)?$/;
+var problems4 = (props, missingPaths) => {
+  const found = [];
+  if (!NAME4.test(props.name))
+    found.push(`name \`${props.name}\` is not a valid enforcement name`);
+  if (sortedSet5(props.mfaMethodIds).length === 0)
+    found.push("mfaMethodIds is empty");
+  const targets = [
+    props.authMethodPaths,
+    props.authMethodAccessors,
+    props.authMethodTypes,
+    props.identityGroupIds,
+    props.identityEntityIds
+  ].some((list) => sortedSet5(list ?? []).length > 0);
+  if (!targets)
+    found.push("no target: an enforcement with none is accepted and enforces NOTHING");
+  if (missingPaths.length > 0) {
+    found.push(`no auth mount at ${missingPaths.map((path) => mountPath(path)).join(", ")}`);
+  }
+  return found;
 };
-var template = (value, where) => {
-  const raw = record(value, where);
-  const groups = texts(raw, "groups", where);
-  if (groups === undefined)
-    throw new RolesConfigError(`${where}.groups`, "is required");
-  const bucket = raw["bucket"] === undefined ? undefined : text3(raw, "bucket", where);
-  if (bucket !== undefined && bucket.length === 0) {
-    throw new RolesConfigError(`${where}.bucket`, "is empty; omit it to stay account-wide");
+
+// src/openbao/mfa-wire.ts
+import * as Effect17 from "effect/Effect";
+var TOTP_PATH = "identity/mfa/method/totp";
+var METHODS_PATH = "identity/mfa/method";
+var enforcementPath = (name) => `identity/mfa/login-enforcement/${name}`;
+var record4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+var ownNamespacePath = Effect17.gen(function* () {
+  const env = yield* BaoEnv;
+  return namespacePath(envNamespace(env));
+});
+var findTotp = (name) => Effect17.gen(function* () {
+  const listing = yield* baoRead(`${METHODS_PATH}?list=true`);
+  const info = record4(listing?.["key_info"]) ?? {};
+  const own = yield* ownNamespacePath;
+  for (const [id, raw] of Object.entries(info)) {
+    const live = record4(raw);
+    if (live === undefined || live["name"] !== name || live["namespace_path"] !== own)
+      continue;
+    if (live["type"] !== "totp") {
+      return yield* Effect17.die(new Error(`Bao.MfaTotpMethod ${name}: that name belongs to a ${String(live["type"])} method ` + `(${id}) in this namespace, and a TOTP write would convert it. Pick another name.`));
+    }
+    return { id, live };
   }
-  const groupsScope = raw["groups_scope"] === undefined ? undefined : groupScopeNamed(text3(raw, "groups_scope", where));
-  if (raw["groups_scope"] !== undefined && groupsScope === undefined) {
-    throw new RolesConfigError(`${where}.groups_scope`, `expected one of ${Object.keys(GROUP_SCOPES).join(", ")}`);
+  return;
+});
+var writeTotp = (body) => Effect17.asVoid(baoCall("write", "POST", TOTP_PATH, body));
+var deleteTotp = (id) => baoDelete(`${TOTP_PATH}/${id}`);
+var readEnforcement = (name) => baoRead(enforcementPath(name));
+var writeEnforcement = (name, body) => Effect17.asVoid(baoCall("write", "POST", enforcementPath(name), body));
+var authAccessors = (paths) => Effect17.gen(function* () {
+  if (paths.length === 0)
+    return { accessors: [], missing: [] };
+  const table = (yield* baoRead("sys/auth")) ?? {};
+  const accessors = [];
+  const missing = [];
+  for (const path of paths) {
+    const accessor = record4(table[`${mountPath(path)}/`])?.["accessor"];
+    if (typeof accessor === "string" && accessor !== "")
+      accessors.push(accessor);
+    else
+      missing.push(mountPath(path));
+  }
+  return { accessors, missing };
+});
+
+// src/openbao/mfa-enforcement.ts
+var BaoMfaLoginEnforcement = Resource7("Bao.MfaLoginEnforcement", {
+  defaultRemovalPolicy: "retain"
+});
+var refuse3 = (name, message) => Effect18.die(new Error(`Bao.MfaLoginEnforcement ${name}: ${message}`));
+var resolveTargets = (props) => Effect18.map(authAccessors(props.authMethodPaths ?? []), ({ accessors, missing }) => ({
+  bad: problems4(props, missing),
+  resolved: accessors
+}));
+var readLive = (name) => Effect18.map(readEnforcement(name), (live) => live === undefined ? undefined : attributesOf8(name, live));
+var planEnforcement = (props) => Effect18.gen(function* () {
+  const { bad, resolved } = yield* resolveTargets(props);
+  if (bad.length > 0)
+    return "update";
+  const live = yield* readLive(props.name);
+  return live !== undefined && matches7(live, props, resolved) ? "noop" : "update";
+});
+var reconcileEnforcement = (props) => Effect18.gen(function* () {
+  const { bad, resolved } = yield* resolveTargets(props);
+  if (bad.length > 0)
+    return yield* refuse3(props.name, bad.join("; "));
+  const live = yield* readLive(props.name);
+  if (live === undefined || !matches7(live, props, resolved)) {
+    yield* writeEnforcement(props.name, writeBody6(canonicalFromProps4(props, resolved)));
   }
+  const after = yield* readLive(props.name);
+  if (after === undefined)
+    return yield* refuse3(props.name, "the write succeeded but it is absent.");
+  if (!matches7(after, props, resolved)) {
+    return yield* refuse3(props.name, "the enforcement read back different.");
+  }
+  return after;
+});
+var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforcement, Effect18.succeed(BaoMfaLoginEnforcement.Provider.of({
+  list: () => Effect18.succeed([]),
+  read: Effect18.fn(function* ({ olds }) {
+    return yield* readLive(olds.name);
+  }),
+  diff: Effect18.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved7(news))
+      return;
+    if (news.name !== output.name)
+      return { action: "replace" };
+    return { action: yield* planEnforcement(news) };
+  }),
+  reconcile: Effect18.fn(function* ({ news }) {
+    return yield* reconcileEnforcement(news);
+  }),
+  delete: Effect18.fn(function* ({ output }) {
+    return yield* refuse3(output.name, "REFUSING to delete: OpenBao 2.6.2 drops a login enforcement from memory only, and it " + "returns on the next unseal (openbao/openbao#4030). Set this resource back to " + "retain to drop it from state; remove it for good only once the server is fixed.");
+  })
+})));
+// src/openbao/mfa-totp.ts
+import { Resource as Resource8 } from "alchemy";
+import { isResolved as isResolved8 } from "alchemy/Diff";
+import * as Provider8 from "alchemy/Provider";
+import * as Effect19 from "effect/Effect";
+
+// src/openbao/mfa-totp-form.ts
+var canonical6 = (input) => ({
+  algorithm: input.algorithm,
+  digits: input.digits,
+  issuer: input.issuer,
+  keySize: input.keySize,
+  maxValidationAttempts: input.maxValidationAttempts,
+  periodSeconds: input.periodSeconds,
+  qrSize: input.qrSize,
+  skew: input.skew
+});
+var canonicalFromProps5 = (props) => canonical6({
+  algorithm: props.algorithm ?? "SHA1",
+  digits: props.digits ?? 6,
+  issuer: props.issuer,
+  keySize: props.keySize ?? 20,
+  maxValidationAttempts: props.maxValidationAttempts ?? 5,
+  periodSeconds: parseDuration(props.period ?? "30s") ?? -1,
+  qrSize: props.qrSize ?? 200,
+  skew: props.skew ?? 1
+});
+var num = (value) => typeof value === "number" && Number.isFinite(value) ? value : -1;
+var text9 = (value) => typeof value === "string" ? value : "";
+var canonicalFromLive5 = (live) => canonical6({
+  algorithm: text9(live["algorithm"]),
+  digits: num(live["digits"]),
+  issuer: text9(live["issuer"]),
+  keySize: num(live["key_size"]),
+  maxValidationAttempts: num(live["max_validation_attempts"]),
+  periodSeconds: ttlSeconds(live["period"]) ?? -1,
+  qrSize: num(live["qr_size"]),
+  skew: num(live["skew"])
+});
+var attributesOf9 = (methodId, live) => {
+  const form = canonicalFromLive5(live);
   return {
-    accountGroups: texts(raw, "account_groups", where) ?? [],
-    bucket,
-    bucketJurisdiction: raw["bucket_jurisdiction"] === undefined ? "default" : text3(raw, "bucket_jurisdiction", where),
-    desc: raw["desc"] === undefined ? "" : text3(raw, "desc", where),
-    groups,
-    groupsScope,
-    maxTtl: text3(raw, "max_ttl", where),
-    name: text3(raw, "name", where),
-    ttl: text3(raw, "ttl", where),
-    zoneTypes: texts(raw, "zone_types", where) ?? [],
-    zones: texts(raw, "zones", where)
+    ...form,
+    digest: sha256(JSON.stringify(form)),
+    methodId,
+    name: text9(live["name"]),
+    namespacePath: text9(live["namespace_path"])
   };
 };
-var surface = (name, value) => {
-  const where = `surfaces.${name}`;
-  const raw = record(value, where);
+var matches8 = (attributes, props) => attributes.digest === sha256(JSON.stringify(canonicalFromProps5(props)));
+var writeBody7 = (props) => {
+  const form = canonicalFromProps5(props);
   return {
-    accountRoles: entries(raw, "account_roles", where).map((item, i) => template(item, `${where}.account_roles[${String(i)}]`)),
-    zoneRoles: entries(raw, "zone_roles", where).map((item, i) => template(item, `${where}.zone_roles[${String(i)}]`))
+    algorithm: form.algorithm,
+    digits: form.digits,
+    issuer: form.issuer,
+    key_size: form.keySize,
+    max_validation_attempts: form.maxValidationAttempts,
+    method_name: props.name,
+    period: props.period ?? "30s",
+    qr_size: form.qrSize,
+    skew: form.skew
   };
 };
-var account = (key, value, surfaces) => {
-  const where = `accounts.${key}`;
-  const raw = record(value, where);
-  const names = texts(raw, "surfaces", where) ?? [];
-  for (const name of names) {
-    if (surfaces[name] === undefined) {
-      throw new RolesConfigError(`${where}.surfaces`, `names ${name}, which surfaces: never defines`);
-    }
-  }
-  const zones = raw["zones"] === undefined || raw["zones"] === "all" ? "all" : texts(raw, "zones", where);
-  return { id: text3(raw, "id", where), key, surfaces: names, zones: zones ?? "all" };
-};
-var parseRolesConfig = (yaml) => {
-  const root = record(Bun.YAML.parse(yaml), "(document)");
-  const surfaces = {};
-  for (const [name, spec] of Object.entries(record(root["surfaces"], "surfaces"))) {
-    surfaces[name] = surface(name, spec);
-  }
-  const accounts = Object.entries(record(root["accounts"], "accounts")).map(([key, value]) => account(key, value, surfaces));
-  return {
-    accounts,
-    namespace: text3(record(root["defaults"], "defaults"), "namespace", "defaults"),
-    surfaces
-  };
+var renameProblem = (from, to) => from === to ? undefined : `renaming from \`${from}\` would strand every enrolled secret. Declare the new method as a ` + "second resource, list both ids on the enforcement, enrol, then remove the old one " + "(mfa-totp.ts).";
+var problems5 = (props) => {
+  const found = [];
+  const form = canonicalFromProps5(props);
+  if (props.name.trim() === "")
+    found.push("name is empty; it is the only key a declaration has");
+  if (props.issuer.trim() === "")
+    found.push("issuer is empty; the server requires one");
+  if (form.periodSeconds <= 0)
+    found.push(`period \`${props.period ?? ""}\` must be a duration above zero`);
+  if (form.keySize <= 0)
+    found.push("keySize must be above zero");
+  if (form.maxValidationAttempts < 1)
+    found.push("maxValidationAttempts must be at least 1 (0 reads back as 5)");
+  return found;
 };
+
+// src/openbao/mfa-totp.ts
+var BaoMfaTotpMethod = Resource8("Bao.MfaTotpMethod", {
+  defaultRemovalPolicy: "retain"
+});
+var refuse4 = (props, message) => Effect19.die(new Error(`Bao.MfaTotpMethod ${props.name}: ${message}`));
+var readTotp = (props) => Effect19.map(findTotp(props.name), (found) => found === undefined ? undefined : attributesOf9(found.id, found.live));
+var planTotp = (props) => Effect19.gen(function* () {
+  if (problems5(props).length > 0)
+    return "update";
+  const live = yield* readTotp(props);
+  return live !== undefined && matches8(live, props) ? "noop" : "update";
+});
+var reconcileTotp = (props) => Effect19.gen(function* () {
+  const bad = problems5(props);
+  if (bad.length > 0)
+    return yield* refuse4(props, bad.join("; "));
+  const live = yield* readTotp(props);
+  if (live === undefined || !matches8(live, props))
+    yield* writeTotp(writeBody7(props));
+  const after = yield* readTotp(props);
+  if (after === undefined)
+    return yield* refuse4(props, "the write succeeded but no method has that name.");
+  if (!matches8(after, props))
+    return yield* refuse4(props, "the method read back different.");
+  return after;
+});
+var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect19.succeed(BaoMfaTotpMethod.Provider.of({
+  list: () => Effect19.succeed([]),
+  read: Effect19.fn(function* ({ olds }) {
+    return yield* readTotp(olds);
+  }),
+  diff: Effect19.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved8(news))
+      return;
+    const rename = renameProblem(output.name, news.name);
+    if (rename !== undefined)
+      return yield* refuse4(news, rename);
+    return { action: yield* planTotp(news) };
+  }),
+  reconcile: Effect19.fn(function* ({ news }) {
+    return yield* reconcileTotp(news);
+  }),
+  delete: Effect19.fn(function* ({ output }) {
+    yield* deleteTotp(output.methodId);
+    return;
+  })
+})));
 // src/openbao/mount.ts
-import { Resource as Resource4 } from "alchemy";
-import { isResolved as isResolved4 } from "alchemy/Diff";
-import * as Provider4 from "alchemy/Provider";
-import * as Effect9 from "effect/Effect";
+import { Resource as Resource9 } from "alchemy";
+import { isResolved as isResolved9 } from "alchemy/Diff";
+import * as Provider9 from "alchemy/Provider";
+import * as Effect22 from "effect/Effect";
+
+// src/openbao/mount-reconcile.ts
+import * as Effect21 from "effect/Effect";
 
 // src/openbao/mount-wire.ts
-import * as Effect8 from "effect/Effect";
-var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect8.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+import * as Effect20 from "effect/Effect";
+var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect20.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
   ...asked.errors,
   `sys/mounts could not confirm the mount is absent: ${listing.message}`
-])), Effect8.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect8.succeed(undefined) : Effect8.fail(asked)));
-var readMountData = (path) => baoRead(readPath(path)).pipe(Effect8.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
+])), Effect20.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect20.succeed(undefined) : Effect20.fail(asked)));
+var readMountData = (path) => baoRead(readPath(path)).pipe(Effect20.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
 var enableMount = (props) => baoWrite("POST", readPath(props.path), enableBody(props));
 var tuneMount = (props) => baoWrite("POST", tunePath(props.path), tuneBody(props));
 var disableMount = (path) => baoDelete(readPath(path));
 
-// src/openbao/mount.ts
-var BaoMount = Resource4("Bao.Mount", {
-  defaultRemovalPolicy: "retain"
-});
-var readMount = (props) => Effect9.gen(function* () {
+// src/openbao/mount-reconcile.ts
+var readMount = (props) => Effect21.gen(function* () {
   const live = yield* readMountData(props.path);
   if (live === undefined)
     return;
   return attributesOf(props, live);
 });
-var BaoMountProvider = () => Provider4.effect(BaoMount, Effect9.succeed(BaoMount.Provider.of({
-  list: () => Effect9.succeed([]),
-  read: Effect9.fn(function* ({ olds }) {
+var moveTarget2 = (props) => ({
+  family: "Bao.Mount",
+  path: props.path,
+  read: (path) => readMount({ ...props, path }),
+  type: props.type,
+  wire: mountPath
+});
+var reconcileMount = (news, stated, options) => Effect21.gen(function* () {
+  const move = planMove("Bao.Mount", stated, news.path, news.remountFrom);
+  if (move.kind === "refuse")
+    return yield* Effect21.die(new Error(move.message));
+  if (move.kind === "move")
+    yield* performMove(moveTarget2(news), move.from, options);
+  let live = yield* readMount(news);
+  if (live === undefined) {
+    yield* enableMount(news);
+    if (wantsTune(news))
+      yield* tuneMount(news);
+  } else if (!matches(live, news)) {
+    if (live.type !== news.type) {
+      return yield* Effect21.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
+    }
+    yield* tuneMount(news);
+  }
+  live = yield* readMount(news);
+  if (live === undefined) {
+    return yield* Effect21.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
+  }
+  return live;
+});
+
+// src/openbao/mount.ts
+var BaoMount = Resource9("Bao.Mount", {
+  defaultRemovalPolicy: "retain"
+});
+var BaoMountProvider = () => Provider9.effect(BaoMount, Effect22.succeed(BaoMount.Provider.of({
+  list: () => Effect22.succeed([]),
+  read: Effect22.fn(function* ({ olds }) {
     return yield* readMount(olds);
   }),
-  diff: Effect9.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved4(news))
+  diff: Effect22.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved9(news))
       return;
+    const move = planMove("Bao.Mount", output.path, news.path, news.remountFrom);
+    if (move.kind === "refuse")
+      return yield* Effect22.die(new Error(move.message));
+    if (move.kind === "move")
+      return { action: "update" };
     const live = yield* readMount(news);
     if (live === undefined)
       return { action: "update" };
@@ -1123,39 +2361,29 @@ var BaoMountProvider = () => Provider4.effect(BaoMount, Effect9.succeed(BaoMount
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect9.fn(function* ({ news }) {
-    let live = yield* readMount(news);
-    if (live === undefined) {
-      yield* enableMount(news);
-      if (wantsTune(news))
-        yield* tuneMount(news);
-    } else if (!matches(live, news)) {
-      if (live.type !== news.type) {
-        return yield* Effect9.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
-      }
-      yield* tuneMount(news);
-    }
-    live = yield* readMount(news);
-    if (live === undefined) {
-      return yield* Effect9.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
-    }
-    return live;
+  reconcile: Effect22.fn(function* ({ news, output }) {
+    return yield* reconcileMount(news, output?.path);
   }),
-  delete: Effect9.fn(function* ({ output }) {
+  delete: Effect22.fn(function* ({ output }) {
     yield* disableMount(output.path);
     return;
   })
 })));
 // src/openbao/pki-role.ts
-import { Resource as Resource5 } from "alchemy";
-import { isResolved as isResolved5 } from "alchemy/Diff";
-import * as Provider5 from "alchemy/Provider";
-import * as Effect10 from "effect/Effect";
+import { Resource as Resource10 } from "alchemy";
+import { isResolved as isResolved10 } from "alchemy/Diff";
+import * as Provider10 from "alchemy/Provider";
+import * as Effect23 from "effect/Effect";
 
-// src/openbao/pki-role-form.ts
+// src/openbao/pki-role-canonical.ts
+var DEFAULT_KEY_USAGE = [
+  "DigitalSignature",
+  "KeyAgreement",
+  "KeyEncipherment"
+];
 var sorted = (values) => [...values].sort();
 var foldedUsages = (values) => sorted(values.map((v) => v.toLowerCase()));
-var canonical2 = (input) => ({
+var canonical7 = (input) => ({
   allowBareDomains: input.allowBareDomains,
   allowGlobDomains: input.allowGlobDomains,
   allowIpSans: input.allowIpSans,
@@ -1163,18 +2391,24 @@ var canonical2 = (input) => ({
   allowSubdomains: input.allowSubdomains,
   allowWildcardCertificates: input.allowWildcardCertificates,
   allowedDomains: sorted(input.allowedDomains),
+  allowedDomainsTemplate: input.allowedDomainsTemplate,
   clientFlag: input.clientFlag,
   cnValidations: sorted(input.cnValidations),
+  enforceHostnames: input.enforceHostnames,
   extKeyUsage: foldedUsages(input.extKeyUsage),
+  generateLease: input.generateLease,
   keyBits: input.keyBits,
   keyType: input.keyType,
+  keyUsage: foldedUsages(input.keyUsage),
   maxTtlSeconds: input.maxTtlSeconds,
+  noStore: input.noStore,
+  requireCn: input.requireCn,
   serverFlag: input.serverFlag,
   signatureBits: input.signatureBits,
   ttlSeconds: input.ttlSeconds
 });
-var seconds2 = (text4) => parseDuration(text4) ?? -1;
-var canonicalFromProps = (props) => canonical2({
+var seconds3 = (text10) => parseDuration(text10) ?? -1;
+var canonicalFromProps6 = (props) => canonical7({
   allowBareDomains: props.allowBareDomains ?? false,
   allowGlobDomains: props.allowGlobDomains ?? false,
   allowIpSans: props.allowIpSans ?? false,
@@ -1182,21 +2416,27 @@ var canonicalFromProps = (props) => canonical2({
   allowSubdomains: props.allowSubdomains ?? false,
   allowWildcardCertificates: props.allowWildcardCertificates ?? false,
   allowedDomains: props.allowedDomains,
+  allowedDomainsTemplate: props.allowedDomainsTemplate ?? false,
   clientFlag: props.clientFlag ?? true,
   cnValidations: props.cnValidations ?? ["hostname"],
+  enforceHostnames: props.enforceHostnames ?? true,
   extKeyUsage: props.extKeyUsage ?? [],
+  generateLease: props.generateLease ?? false,
   keyBits: props.keyBits ?? 0,
   keyType: props.keyType ?? "rsa",
-  maxTtlSeconds: seconds2(props.maxTtl),
+  keyUsage: props.keyUsage ?? DEFAULT_KEY_USAGE,
+  maxTtlSeconds: seconds3(props.maxTtl),
+  noStore: props.noStore ?? false,
+  requireCn: props.requireCn ?? true,
   serverFlag: props.serverFlag ?? true,
   signatureBits: props.signatureBits ?? 0,
-  ttlSeconds: seconds2(props.ttl)
+  ttlSeconds: seconds3(props.ttl)
 });
 var bool2 = (value, fallback) => typeof value === "boolean" ? value : fallback;
 var int2 = (value, fallback) => typeof value === "number" && Number.isFinite(value) ? value : fallback;
 var list = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
 var str = (value, fallback) => typeof value === "string" ? value : fallback;
-var canonicalFromLive = (live) => canonical2({
+var canonicalFromLive6 = (live) => canonical7({
   allowBareDomains: bool2(live["allow_bare_domains"], false),
   allowGlobDomains: bool2(live["allow_glob_domains"], false),
   allowIpSans: bool2(live["allow_ip_sans"], false),
@@ -1204,16 +2444,25 @@ var canonicalFromLive = (live) => canonical2({
   allowSubdomains: bool2(live["allow_subdomains"], false),
   allowWildcardCertificates: bool2(live["allow_wildcard_certificates"], false),
   allowedDomains: list(live["allowed_domains"]),
+  allowedDomainsTemplate: bool2(live["allowed_domains_template"], false),
   clientFlag: bool2(live["client_flag"], true),
   cnValidations: list(live["cn_validations"]),
+  enforceHostnames: bool2(live["enforce_hostnames"], false),
   extKeyUsage: list(live["ext_key_usage"]),
+  generateLease: bool2(live["generate_lease"], false),
   keyBits: int2(live["key_bits"], 0),
   keyType: str(live["key_type"], "rsa"),
+  keyUsage: list(live["key_usage"]),
   maxTtlSeconds: ttlSeconds(live["max_ttl"]) ?? -1,
+  noStore: bool2(live["no_store"], false),
+  requireCn: bool2(live["require_cn"], false),
   serverFlag: bool2(live["server_flag"], true),
   signatureBits: int2(live["signature_bits"], 0),
   ttlSeconds: ttlSeconds(live["ttl"]) ?? -1
 });
+var digestOf = (form) => sha256(JSON.stringify(form));
+
+// src/openbao/pki-role-form.ts
 var ttlText2 = (value) => {
   if (value < 0)
     return "";
@@ -1225,10 +2474,9 @@ var ttlText2 = (value) => {
     return `${String(value / 60)}m`;
   return `${String(value)}s`;
 };
-var digestOf = (form) => sha256(JSON.stringify(form));
-var rolePath2 = (props) => `${mountPath(props.mount ?? "pki")}/roles/${props.name}`;
-var attributesOf5 = (props, live) => {
-  const form = canonicalFromLive(live);
+var rolePath4 = (props) => `${mountPath(props.mount ?? "pki")}/roles/${props.name}`;
+var attributesOf10 = (props, live) => {
+  const form = canonicalFromLive6(live);
   return {
     ...form,
     name: props.name,
@@ -1238,8 +2486,8 @@ var attributesOf5 = (props, live) => {
     digest: digestOf(form)
   };
 };
-var writeBody3 = (props) => {
-  const form = canonicalFromProps(props);
+var writeBody8 = (props) => {
+  const form = canonicalFromProps6(props);
   const body = {
     allowed_domains: form.allowedDomains.join(","),
     allow_bare_domains: String(form.allowBareDomains),
@@ -1255,76 +2503,218 @@ var writeBody3 = (props) => {
     key_bits: String(form.keyBits),
     signature_bits: String(form.signatureBits),
     ttl: props.ttl,
-    max_ttl: props.maxTtl
+    max_ttl: props.maxTtl,
+    require_cn: String(form.requireCn),
+    enforce_hostnames: String(form.enforceHostnames),
+    key_usage: (props.keyUsage ?? DEFAULT_KEY_USAGE).join(","),
+    allowed_domains_template: String(form.allowedDomainsTemplate),
+    no_store: String(form.noStore),
+    generate_lease: String(form.generateLease)
   };
   const usages = props.extKeyUsage ?? [];
   if (usages.length > 0)
     body["ext_key_usage"] = usages.join(",");
   return body;
 };
-var matches4 = (attributes, props) => attributes.digest === digestOf(canonicalFromProps(props));
+var matches9 = (attributes, props) => attributes.digest === digestOf(canonicalFromProps6(props));
+var problems6 = (props) => {
+  const found = [];
+  if (props.allowedDomains.length === 0) {
+    found.push("allowedDomains is empty. With allow_any_name false that role can issue no certificate at all.");
+  }
+  const bad = [
+    ["ttl", props.ttl],
+    ["maxTtl", props.maxTtl]
+  ].filter(([, text10]) => parseDuration(text10 ?? "") === undefined);
+  if (bad.length > 0) {
+    found.push(`${bad.map(([k, v]) => `${k ?? ""}=${v ?? ""}`).join(", ")} is not a duration OpenBao ` + "parses (expect 30m, 720h, 8760h or 0).");
+  }
+  if (props.noStore === true && props.generateLease === true) {
+    found.push("noStore and generateLease are both true; OpenBao keeps no_store and drops the lease.");
+  }
+  return found;
+};
 
 // src/openbao/pki-role.ts
-var BaoPkiRole = Resource5("Bao.PkiRole", {
+var BaoPkiRole = Resource10("Bao.PkiRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole2 = (props) => Effect10.gen(function* () {
-  const live = yield* baoRead(rolePath2(props));
+var readRole2 = (props) => Effect23.gen(function* () {
+  const live = yield* baoRead(rolePath4(props));
   if (live === undefined)
     return;
-  return attributesOf5(props, live);
+  return attributesOf10(props, live);
 });
-var badDurations = (props) => [["ttl", props.ttl], ["maxTtl", props.maxTtl]].filter(([, text4]) => parseDuration(text4) === undefined);
-var BaoPkiRoleProvider = () => Provider5.effect(BaoPkiRole, Effect10.succeed(BaoPkiRole.Provider.of({
-  list: () => Effect10.succeed([]),
-  read: Effect10.fn(function* ({ olds }) {
+var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect23.succeed(BaoPkiRole.Provider.of({
+  list: () => Effect23.succeed([]),
+  read: Effect23.fn(function* ({ olds }) {
     return yield* readRole2(olds);
   }),
-  diff: Effect10.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved5(news))
+  diff: Effect23.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved10(news))
       return;
-    if (mountPath(news.mount ?? "pki") !== output.mount)
+    if (mountPath(news.mount ?? "pki") !== output.mount || news.name !== output.name)
       return { action: "replace" };
-    if (news.allowedDomains.length === 0 || badDurations(news).length > 0) {
+    if (problems6(news).length > 0)
       return { action: "update" };
-    }
     const live = yield* readRole2(news);
     if (live === undefined)
       return { action: "update" };
-    return matches4(live, news) ? { action: "noop" } : { action: "update" };
+    return matches9(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect10.fn(function* ({ news }) {
-    const path = rolePath2(news);
-    if (news.allowedDomains.length === 0) {
-      return yield* Effect10.die(new Error(`Bao.PkiRole ${path}: allowedDomains is empty. With allow_any_name false ` + "that role can issue no certificate at all."));
-    }
-    const bad = badDurations(news);
+  reconcile: Effect23.fn(function* ({ news }) {
+    const path = rolePath4(news);
+    const bad = problems6(news);
     if (bad.length > 0) {
-      return yield* Effect10.die(new Error(`Bao.PkiRole ${path}: ${bad.map(([k, v]) => `${k}=${v}`).join(", ")} ` + "is not a duration OpenBao parses (expect 30m, 720h, 8760h or 0)."));
+      return yield* Effect23.die(new Error(`Bao.PkiRole ${path}: ${bad.join(" ")}`));
     }
     const live = yield* readRole2(news);
-    if (live === undefined || !matches4(live, news)) {
-      yield* baoWrite("PUT", path, writeBody3(news));
+    if (live === undefined || !matches9(live, news)) {
+      yield* baoWrite("PUT", path, writeBody8(news));
     }
     const after = yield* readRole2(news);
     if (after === undefined) {
-      return yield* Effect10.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
+      return yield* Effect23.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
     }
-    if (!matches4(after, news)) {
-      return yield* Effect10.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
+    if (!matches9(after, news)) {
+      return yield* Effect23.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
     }
     return after;
   }),
-  delete: Effect10.fn(function* ({ output }) {
-    yield* baoDelete(rolePath2(output));
+  delete: Effect23.fn(function* ({ output }) {
+    yield* baoDelete(rolePath4(output));
+    return;
+  })
+})));
+// src/openbao/plugin.ts
+import { Resource as Resource11 } from "alchemy";
+import { isResolved as isResolved11 } from "alchemy/Diff";
+import * as Provider11 from "alchemy/Provider";
+import * as Effect25 from "effect/Effect";
+
+// src/openbao/plugin-form.ts
+var resolve = (props) => ({
+  args: props.args ?? [],
+  command: props.command,
+  name: props.name,
+  sha256: props.sha256.toLowerCase(),
+  type: props.type,
+  version: props.version ?? ""
+});
+var CANONICAL_VERSION = /^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$/;
+var problems7 = (form) => {
+  const found = [];
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(form.name) || form.name.includes("..")) {
+    found.push(`name ${JSON.stringify(form.name)} is not a plain catalog name`);
+  }
+  if (!/^[0-9a-f]{64}$/.test(form.sha256))
+    found.push("sha256 is not 64 hex characters");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(form.command) || form.command.includes("..")) {
+    found.push(`command ${JSON.stringify(form.command)} is not a bare file name`);
+  }
+  if (form.version !== "" && !CANONICAL_VERSION.test(form.version)) {
+    found.push(`version ${JSON.stringify(form.version)} is not canonical semver like v1.2.0`);
+  }
+  if (/\+builtin/.test(form.version))
+    found.push("version metadata `builtin` is reserved");
+  return found;
+};
+var versionQuery = (version) => version === "" ? "" : `?version=${encodeURIComponent(version)}`;
+var catalogPath = (type, name) => `sys/plugins/catalog/${type}/${name}`;
+var versionedPath = (type, name, version) => `${catalogPath(type, name)}${versionQuery(version)}`;
+var registerBody = (form) => ({
+  command: form.command,
+  sha256: form.sha256,
+  ...form.args.length > 0 ? { args: form.args } : {},
+  ...form.version === "" ? {} : { version: form.version }
+});
+var text10 = (value) => typeof value === "string" ? value : "";
+var list2 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var attributesOf11 = (form, live) => {
+  const attrs = {
+    name: form.name,
+    type: form.type,
+    version: text10(live["version"]),
+    sha256: text10(live["sha256"]).toLowerCase(),
+    command: text10(live["command"]),
+    args: list2(live["args"]),
+    builtin: live["builtin"] === true
+  };
+  return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
+};
+var sameArgs = (want, have) => want.length === have.length && want.every((entry, index) => entry === have[index]);
+var matches10 = (attributes, form) => !attributes.builtin && attributes.version === form.version && attributes.sha256 === form.sha256 && attributes.command === form.command && sameArgs(form.args, attributes.args);
+
+// src/openbao/plugin-reconcile.ts
+import * as Effect24 from "effect/Effect";
+
+// src/openbao/plugin-wire.ts
+var readPluginData = (form) => baoRead(versionedPath(form.type, form.name, form.version));
+var registerPlugin = (form) => baoWrite("PUT", catalogPath(form.type, form.name), registerBody(form));
+var deregisterPlugin = (type, name, version) => baoDelete(versionedPath(type, name, version));
+
+// src/openbao/plugin-reconcile.ts
+var readEntry = (form) => Effect24.map(readPluginData(form), (live) => live === undefined ? undefined : { attributes: attributesOf11(form, live), live });
+var refuse5 = (form, message) => Effect24.die(new Error(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}: ${message}`));
+var SELF_REPORTED = "the write succeeded but the read-back does not match. If the binary reports its own version, " + "OpenBao filed the registration under it (plugin_catalog.go setInternal) — declare `version` " + "as exactly the version the binary reports; that adopts the entry this write just made.";
+var reconcilePlugin = (props) => Effect24.gen(function* () {
+  const form = resolve(props);
+  const bad = problems7(form);
+  if (bad.length > 0)
+    return yield* refuse5(form, bad.join("; "));
+  const found = yield* readEntry(form);
+  if (found !== undefined && !matches10(found.attributes, form)) {
+    if (found.live["declarative"] === true || found.live["oci"] === true) {
+      return yield* refuse5(form, "the live entry is declarative/OCI; manage it in server config.");
+    }
+    if (found.attributes.builtin) {
+      return yield* refuse5(form, "this name is a builtin; an unversioned write would shadow it.");
+    }
+  }
+  if (found === undefined || !matches10(found.attributes, form))
+    yield* registerPlugin(form);
+  const after = yield* readEntry(form);
+  if (after === undefined || !matches10(after.attributes, form)) {
+    return yield* refuse5(form, SELF_REPORTED);
+  }
+  return after.attributes;
+});
+
+// src/openbao/plugin.ts
+var BaoPlugin = Resource11("Bao.Plugin", {
+  defaultRemovalPolicy: "retain"
+});
+var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect25.succeed(BaoPlugin.Provider.of({
+  list: () => Effect25.succeed([]),
+  read: Effect25.fn(function* ({ olds }) {
+    const found = yield* readEntry(resolve(olds));
+    return found?.attributes;
+  }),
+  diff: Effect25.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved11(news))
+      return;
+    const form = resolve(news);
+    if (output.name !== form.name || output.type !== form.type || output.version !== form.version) {
+      return { action: "replace" };
+    }
+    const found = yield* readEntry(form);
+    if (found === undefined)
+      return { action: "update" };
+    return matches10(found.attributes, form) ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: Effect25.fn(function* ({ news }) {
+    return yield* reconcilePlugin(news);
+  }),
+  delete: Effect25.fn(function* ({ output }) {
+    yield* deregisterPlugin(output.type, output.name, output.version);
     return;
   })
 })));
 // src/openbao/policy.ts
-import { Resource as Resource6 } from "alchemy";
-import { isResolved as isResolved6 } from "alchemy/Diff";
-import * as Provider6 from "alchemy/Provider";
-import * as Effect12 from "effect/Effect";
+import { Resource as Resource12 } from "alchemy";
+import { isResolved as isResolved12 } from "alchemy/Diff";
+import * as Provider12 from "alchemy/Provider";
+import * as Effect27 from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 
@@ -1332,32 +2722,32 @@ import * as Path from "effect/Path";
 var isEmptyAssembly = (parts, joined) => parts === 0 || !/^\s*path\s+"/m.test(joined);
 
 // src/openbao/policy-wire.ts
-import * as Effect11 from "effect/Effect";
+import * as Effect26 from "effect/Effect";
 var policyPath = (name) => `sys/policies/acl/${name}`;
-var readPolicy = (name) => Effect11.flatMap(baoRead(policyPath(name)), (data) => {
+var readPolicy = (name) => Effect26.flatMap(baoRead(policyPath(name)), (data) => {
   if (data === undefined)
-    return Effect11.succeed("");
-  const text4 = data["policy"];
-  return typeof text4 === "string" ? Effect11.succeed(text4) : Effect11.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
+    return Effect26.succeed("");
+  const text11 = data["policy"];
+  return typeof text11 === "string" ? Effect26.succeed(text11) : Effect26.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
 });
 var writePolicy = (name, hcl) => baoWrite("PUT", policyPath(name), { policy: hcl });
 var deletePolicy = (name) => baoDelete(policyPath(name));
 
 // src/openbao/policy.ts
-var BaoPolicy = Resource6("Bao.Policy", {
+var BaoPolicy = Resource12("Bao.Policy", {
   defaultRemovalPolicy: "retain"
 });
 var grantsOf = (hcl) => (hcl.match(/^path /gm) ?? []).length;
-var attributesOf6 = (name, hcl, parts) => ({
+var attributesOf12 = (name, hcl, parts) => ({
   name,
   digest: sha256(hcl),
   grants: grantsOf(hcl),
   parts
 });
-var BaoPolicyProvider = () => Provider6.effect(BaoPolicy, Effect12.gen(function* () {
+var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect27.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const assemble = (dir) => Effect12.gen(function* () {
+  const assemble = (dir) => Effect27.gen(function* () {
     const entries2 = (yield* fs.readDirectory(dir)).filter((f) => f.endsWith(".hcl")).sort();
     let joined = "";
     for (const f of entries2)
@@ -1366,67 +2756,67 @@ var BaoPolicyProvider = () => Provider6.effect(BaoPolicy, Effect12.gen(function*
     return { joined, parts: entries2.length };
   });
   return BaoPolicy.Provider.of({
-    list: () => Effect12.succeed([]),
-    read: Effect12.fn(function* ({ olds }) {
+    list: () => Effect27.succeed([]),
+    read: Effect27.fn(function* ({ olds }) {
       const live = yield* readPolicy(olds.name);
-      return live.length === 0 ? undefined : attributesOf6(olds.name, live, 0);
+      return live.length === 0 ? undefined : attributesOf12(olds.name, live, 0);
     }),
-    diff: Effect12.fn(function* ({ news, output }) {
-      if (output === undefined || !isResolved6(news))
+    diff: Effect27.fn(function* ({ news, output }) {
+      if (output === undefined || !isResolved12(news))
         return;
       const { joined } = yield* assemble(news.fragments);
       const live = yield* readPolicy(news.name);
       return live.length > 0 && sha256(live) === sha256(joined) ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect12.fn(function* ({ news }) {
+    reconcile: Effect27.fn(function* ({ news }) {
       const name = news.name;
       const { joined, parts } = yield* assemble(news.fragments);
       if (isEmptyAssembly(parts, joined))
-        return yield* Effect12.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
+        return yield* Effect27.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
       const current = yield* readPolicy(name);
       if (current.length > 0 && sha256(current) === sha256(joined)) {
-        return attributesOf6(name, joined, parts);
+        return attributesOf12(name, joined, parts);
       }
       yield* writePolicy(name, joined);
-      return attributesOf6(name, joined, parts);
+      return attributesOf12(name, joined, parts);
     }),
-    delete: Effect12.fn(function* ({ output }) {
+    delete: Effect27.fn(function* ({ output }) {
       yield* deletePolicy(output.name);
       return;
     })
   });
 }));
 // src/openbao/proxmox-role.ts
-import { Resource as Resource7 } from "alchemy";
-import { isResolved as isResolved7 } from "alchemy/Diff";
-import * as Provider7 from "alchemy/Provider";
-import * as Effect13 from "effect/Effect";
+import { Resource as Resource13 } from "alchemy";
+import { isResolved as isResolved13 } from "alchemy/Diff";
+import * as Provider13 from "alchemy/Provider";
+import * as Effect28 from "effect/Effect";
 
 // src/openbao/proxmox-role-form.ts
-var text4 = (value) => typeof value === "string" ? value : "";
-var ttlText3 = (seconds3, fallback = "0") => {
-  if (seconds3 === undefined)
+var text11 = (value) => typeof value === "string" ? value : "";
+var ttlText3 = (seconds4, fallback = "0") => {
+  if (seconds4 === undefined)
     return fallback;
-  if (seconds3 % 86400 === 0)
-    return `${String(seconds3 / 86400)}d`;
-  if (seconds3 % 3600 === 0)
-    return `${String(seconds3 / 3600)}h`;
-  if (seconds3 % 60 === 0)
-    return `${String(seconds3 / 60)}m`;
-  return `${String(seconds3)}s`;
-};
-var rolePath3 = (mount, name) => `${mountPath(mount)}/roles/${name}`;
-var attributesOf7 = (props, live) => {
+  if (seconds4 % 86400 === 0)
+    return `${String(seconds4 / 86400)}d`;
+  if (seconds4 % 3600 === 0)
+    return `${String(seconds4 / 3600)}h`;
+  if (seconds4 % 60 === 0)
+    return `${String(seconds4 / 60)}m`;
+  return `${String(seconds4)}s`;
+};
+var rolePath5 = (mount, name) => `${mountPath(mount)}/roles/${name}`;
+var attributesOf13 = (props, live) => {
   const attrs = {
     mount: mountPath(props.mount),
-    name: text4(live["name"]) || props.name,
-    mintUser: text4(live["mint_user"]),
+    name: text11(live["name"]) || props.name,
+    mintUser: text11(live["mint_user"]),
     ttl: ttlText3(ttlSeconds(live["ttl"])),
     maxTtl: ttlText3(ttlSeconds(live["max_ttl"]))
   };
   return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
 };
-var writeBody4 = (props) => {
+var writeBody9 = (props) => {
   const ttl = parseDuration(props.ttl);
   const maxTtl = parseDuration(props.maxTtl);
   const bad = [];
@@ -1446,69 +2836,68 @@ var sameTtl5 = (want, have) => {
   const haveSeconds = ttlSeconds(have);
   return wantSeconds !== undefined && wantSeconds === haveSeconds;
 };
-var matches5 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl5(props.ttl, attributes.ttl) && sameTtl5(props.maxTtl, attributes.maxTtl);
+var matches11 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl5(props.ttl, attributes.ttl) && sameTtl5(props.maxTtl, attributes.maxTtl);
 
 // src/openbao/proxmox-role.ts
-var BaoProxmoxRole = Resource7("Bao.ProxmoxRole", {
+var BaoProxmoxRole = Resource13("Bao.ProxmoxRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole3 = (props) => Effect13.gen(function* () {
-  const live = yield* baoRead(rolePath3(props.mount, props.name));
+var readRole3 = (props) => Effect28.gen(function* () {
+  const live = yield* baoRead(rolePath5(props.mount, props.name));
   if (live === undefined)
     return;
-  return attributesOf7(props, live);
+  return attributesOf13(props, live);
 });
-var BaoProxmoxRoleProvider = () => Provider7.effect(BaoProxmoxRole, Effect13.succeed(BaoProxmoxRole.Provider.of({
-  list: () => Effect13.succeed([]),
-  read: Effect13.fn(function* ({ olds }) {
+var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect28.succeed(BaoProxmoxRole.Provider.of({
+  list: () => Effect28.succeed([]),
+  read: Effect28.fn(function* ({ olds }) {
     return yield* readRole3(olds);
   }),
-  diff: Effect13.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved7(news))
+  diff: Effect28.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved13(news))
       return;
     const live = yield* readRole3(news);
     if (live === undefined)
       return { action: "update" };
-    if (matches5(live, news))
+    if (matches11(live, news))
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect13.fn(function* ({ news }) {
+  reconcile: Effect28.fn(function* ({ news }) {
     const live = yield* readRole3(news);
     if (live !== undefined && live.mintUser !== news.mintUser && news.allowMintUserChange !== live.mintUser) {
-      return yield* Effect13.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: live mint_user ` + `${live.mintUser} != declared ${news.mintUser}. Every token this role mints ` + "inherits the ACL of that PVE user. To re-scope deliberately, declare " + `allowMintUserChange: '${live.mintUser}'.`));
+      return yield* Effect28.die(new Error(`Bao.ProxmoxRole ${rolePath5(news.mount, news.name)}: live mint_user ` + `${live.mintUser} != declared ${news.mintUser}. Every token this role mints ` + "inherits the ACL of that PVE user. To re-scope deliberately, declare " + `allowMintUserChange: '${live.mintUser}'.`));
     }
-    if (live === undefined || !matches5(live, news)) {
-      const write = writeBody4(news);
+    if (live === undefined || !matches11(live, news)) {
+      const write = writeBody9(news);
       if (!write.ok) {
-        return yield* Effect13.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
+        return yield* Effect28.die(new Error(`Bao.ProxmoxRole ${rolePath5(news.mount, news.name)}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
       }
-      yield* baoWrite("PUT", rolePath3(news.mount, news.name), write.body);
+      yield* baoWrite("PUT", rolePath5(news.mount, news.name), write.body);
     }
     const after = yield* readRole3(news);
     if (after === undefined) {
-      return yield* Effect13.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: write returned no error ` + "but the role is still absent."));
+      return yield* Effect28.die(new Error(`Bao.ProxmoxRole ${rolePath5(news.mount, news.name)}: write returned no error ` + "but the role is still absent."));
     }
     return after;
   }),
-  delete: Effect13.fn(function* ({ output }) {
-    yield* baoDelete(rolePath3(output.mount, output.name));
+  delete: Effect28.fn(function* ({ output }) {
+    yield* baoDelete(rolePath5(output.mount, output.name));
     return;
   })
 })));
 // src/openbao/ssh-role.ts
-import { Resource as Resource8 } from "alchemy";
-import { isResolved as isResolved8 } from "alchemy/Diff";
-import * as Provider8 from "alchemy/Provider";
-import * as Effect14 from "effect/Effect";
+import { Resource as Resource14 } from "alchemy";
+import { isResolved as isResolved14 } from "alchemy/Diff";
+import * as Provider14 from "alchemy/Provider";
+import * as Effect29 from "effect/Effect";
 
 // src/openbao/ssh-role-form.ts
-var mountOf = (mount) => (mount ?? "ssh").replace(/\/+$/, "");
-var readPath4 = (mount, name) => `${mountOf(mount)}/roles/${name}`;
-var text5 = (value) => typeof value === "string" ? value : "";
+var readPath4 = (mount, name) => `${sshMountOf(mount)}/roles/${name}`;
+var text12 = (value) => typeof value === "string" ? value : "";
 var bool3 = (value, fallback) => typeof value === "boolean" ? value : fallback;
 var csvList = (value) => {
-  const parts = Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : text5(value).split(",");
+  const parts = Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : text12(value).split(",");
   return [
     ...new Set(parts.map((entry) => entry.trim()).filter((entry) => entry.length > 0))
   ].sort();
@@ -1519,12 +2908,12 @@ var extMap = (value) => {
     return out;
   const source = value;
   for (const key of Object.keys(source).sort())
-    out[key] = text5(source[key]);
+    out[key] = text12(source[key]);
   return out;
 };
-var resolve = (props) => ({
+var resolve2 = (props) => ({
   name: props.name,
-  mount: mountOf(props.mount),
+  mount: sshMountOf(props.mount),
   allowedUsers: csvList(props.allowedUsers),
   defaultUser: props.defaultUser ?? "",
   allowUserCertificates: props.allowUserCertificates ?? false,
@@ -1540,12 +2929,12 @@ var resolve = (props) => ({
   ttl: props.ttl,
   maxTtl: props.maxTtl
 });
-var attributesOf8 = (form, live) => {
+var attributesOf14 = (form, live) => {
   const attrs = {
     name: form.name,
     mount: form.mount,
     allowedUsers: csvList(live["allowed_users"]),
-    defaultUser: text5(live["default_user"]),
+    defaultUser: text12(live["default_user"]),
     allowUserCertificates: bool3(live["allow_user_certificates"], false),
     allowHostCertificates: bool3(live["allow_host_certificates"], false),
     allowedDomains: csvList(live["allowed_domains"]),
@@ -1556,14 +2945,14 @@ var attributesOf8 = (form, live) => {
     allowedCriticalOptions: csvList(live["allowed_critical_options"]),
     defaultCriticalOptions: extMap(live["default_critical_options"]),
     allowEmptyPrincipals: bool3(live["allow_empty_principals"], false),
-    keyType: text5(live["key_type"]) || "ca",
+    keyType: text12(live["key_type"]) || "ca",
     ttlSeconds: ttlSeconds(live["ttl"]) ?? 0,
     maxTtlSeconds: ttlSeconds(live["max_ttl"]) ?? 0
   };
   return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
 };
-var mapValue = (map4) => JSON.stringify(extMap(map4));
-var writeBody5 = (form) => ({
+var mapValue = (map10) => extMap(map10);
+var writeBody10 = (form) => ({
   key_type: "ca",
   allowed_users: form.allowedUsers.join(","),
   default_user: form.defaultUser,
@@ -1586,18 +2975,18 @@ var sameMap = (want, have) => {
   return keys.length === Object.keys(have).length && keys.every((key) => have[key] === want[key]);
 };
 var sameTtl6 = (want, have) => parseDuration(want) === have;
-var badDurations2 = (form) => ["ttl", "maxTtl"].filter((field) => parseDuration(form[field]) === undefined);
-var matches6 = (attributes, form) => attributes.keyType === "ca" && sameList2(form.allowedUsers, attributes.allowedUsers) && attributes.defaultUser === form.defaultUser && attributes.allowUserCertificates === form.allowUserCertificates && attributes.allowHostCertificates === form.allowHostCertificates && sameList2(form.allowedDomains, attributes.allowedDomains) && attributes.allowSubdomains === form.allowSubdomains && attributes.allowBareDomains === form.allowBareDomains && sameList2(form.allowedExtensions, attributes.allowedExtensions) && sameMap(form.defaultExtensions, attributes.defaultExtensions) && sameList2(form.allowedCriticalOptions, attributes.allowedCriticalOptions) && sameMap(form.defaultCriticalOptions, attributes.defaultCriticalOptions) && attributes.allowEmptyPrincipals === form.allowEmptyPrincipals && sameTtl6(form.ttl, attributes.ttlSeconds) && sameTtl6(form.maxTtl, attributes.maxTtlSeconds);
+var badDurations = (form) => ["ttl", "maxTtl"].filter((field) => parseDuration(form[field]) === undefined);
+var matches12 = (attributes, form) => attributes.keyType === "ca" && sameList2(form.allowedUsers, attributes.allowedUsers) && attributes.defaultUser === form.defaultUser && attributes.allowUserCertificates === form.allowUserCertificates && attributes.allowHostCertificates === form.allowHostCertificates && sameList2(form.allowedDomains, attributes.allowedDomains) && attributes.allowSubdomains === form.allowSubdomains && attributes.allowBareDomains === form.allowBareDomains && sameList2(form.allowedExtensions, attributes.allowedExtensions) && sameMap(form.defaultExtensions, attributes.defaultExtensions) && sameList2(form.allowedCriticalOptions, attributes.allowedCriticalOptions) && sameMap(form.defaultCriticalOptions, attributes.defaultCriticalOptions) && attributes.allowEmptyPrincipals === form.allowEmptyPrincipals && sameTtl6(form.ttl, attributes.ttlSeconds) && sameTtl6(form.maxTtl, attributes.maxTtlSeconds);
 
 // src/openbao/ssh-role.ts
-var BaoSshRole = Resource8("Bao.SshRole", {
+var BaoSshRole = Resource14("Bao.SshRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole4 = (form) => Effect14.gen(function* () {
+var readRole4 = (form) => Effect29.gen(function* () {
   const live = yield* baoRead(readPath4(form.mount, form.name));
   if (live === undefined)
     return;
-  return { attributes: attributesOf8(form, live), live };
+  return { attributes: attributesOf14(form, live), live };
 });
 var UNMANAGED_DEFAULTS = {
   algorithm_signer: "default",
@@ -1612,59 +3001,59 @@ var UNMANAGED_DEFAULTS = {
   not_before_duration: 30
 };
 var isDefault = (live, field) => live[field] === undefined || live[field] === "" || live[field] === UNMANAGED_DEFAULTS[field];
-var wouldErase = (live) => {
+var wouldErase2 = (live) => {
   const lost = Object.keys(UNMANAGED_DEFAULTS).filter((field) => !isDefault(live, field));
   if (Object.keys(extMap(live["allowed_user_key_lengths"])).length > 0) {
     lost.push("allowed_user_key_lengths");
   }
   return lost.sort();
 };
-var refuse = (message) => Effect14.die(new Error(message));
-var BaoSshRoleProvider = () => Provider8.effect(BaoSshRole, Effect14.succeed(BaoSshRole.Provider.of({
-  list: () => Effect14.succeed([]),
-  read: Effect14.fn(function* ({ olds }) {
-    const found = yield* readRole4(resolve(olds));
+var refuse6 = (message) => Effect29.die(new Error(message));
+var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect29.succeed(BaoSshRole.Provider.of({
+  list: () => Effect29.succeed([]),
+  read: Effect29.fn(function* ({ olds }) {
+    const found = yield* readRole4(resolve2(olds));
     return found?.attributes;
   }),
-  diff: Effect14.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved8(news))
+  diff: Effect29.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved14(news))
       return;
-    const form = resolve(news);
+    const form = resolve2(news);
     if (output.mount !== form.mount || output.name !== form.name) {
       return { action: "replace" };
     }
     const found = yield* readRole4(form);
     if (found === undefined)
       return { action: "update" };
-    return matches6(found.attributes, form) ? { action: "noop" } : { action: "update" };
+    return matches12(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect14.fn(function* ({ news }) {
-    const form = resolve(news);
+  reconcile: Effect29.fn(function* ({ news }) {
+    const form = resolve2(news);
     const path = readPath4(form.mount, form.name);
-    const bad = badDurations2(form);
+    const bad = badDurations(form);
     if (bad.length > 0) {
-      return yield* refuse(`Bao.SshRole ${path}: ${bad.join(", ")} is not a duration parseDuration understands ` + "(`0` or `<n>s|m|h|d`). It would write, then report update on every plan forever.");
+      return yield* refuse6(`Bao.SshRole ${path}: ${bad.join(", ")} is not a duration parseDuration understands ` + "(`0` or `<n>s|m|h|d`). It would write, then report update on every plan forever.");
     }
     if (form.allowUserCertificates && form.allowedUsers.length === 0 && !form.allowEmptyPrincipals) {
-      return yield* refuse(`Bao.SshRole ${path}: allowUserCertificates with an empty allowedUsers and ` + "allowEmptyPrincipals false. Every sign request against it would be rejected.");
+      return yield* refuse6(`Bao.SshRole ${path}: allowUserCertificates with an empty allowedUsers and ` + "allowEmptyPrincipals false. Every sign request against it would be rejected.");
     }
     const found = yield* readRole4(form);
-    if (found === undefined || !matches6(found.attributes, form)) {
+    if (found === undefined || !matches12(found.attributes, form)) {
       if (found !== undefined) {
-        const lost = wouldErase(found.live);
+        const lost = wouldErase2(found.live);
         if (lost.length > 0) {
-          return yield* refuse(`Bao.SshRole ${path}: live role carries ${lost.join(", ")}, which this ` + "resource does not declare and the full-replace write would ERASE. " + "Fold those settings into the declaration, or clear them by hand first.");
+          return yield* refuse6(`Bao.SshRole ${path}: live role carries ${lost.join(", ")}, which this ` + "resource does not declare and the full-replace write would ERASE. " + "Fold those settings into the declaration, or clear them by hand first.");
         }
       }
-      yield* baoWrite("PUT", path, writeBody5(form));
+      yield* baoWrite("PUT", path, writeBody10(form));
     }
     const after = yield* readRole4(form);
     if (after === undefined) {
-      return yield* refuse(`Bao.SshRole ${path}: write returned no error but the role is still absent.`);
+      return yield* refuse6(`Bao.SshRole ${path}: write returned no error but the role is still absent.`);
     }
     return after.attributes;
   }),
-  delete: Effect14.fn(function* ({ output }) {
+  delete: Effect29.fn(function* ({ output }) {
     yield* baoDelete(readPath4(output.mount, output.name));
     return;
   })
@@ -1676,10 +3065,24 @@ export {
   BaoAuthRoleProvider,
   BaoCloudflareRole,
   BaoCloudflareRoleProvider,
+  BaoIdentityError,
+  BaoJwtAuthConfig,
+  BaoJwtAuthConfigProvider,
+  BaoJwtRole,
+  BaoJwtRoleProvider,
+  BaoKubernetesRole,
+  BaoKubernetesRoleProvider,
+  BaoLoginError,
+  BaoMfaLoginEnforcement,
+  BaoMfaLoginEnforcementProvider,
+  BaoMfaTotpMethod,
+  BaoMfaTotpMethodProvider,
   BaoMount,
   BaoMountProvider,
   BaoPkiRole,
   BaoPkiRoleProvider,
+  BaoPlugin,
+  BaoPluginProvider,
   BaoPolicy,
   BaoPolicyProvider,
   BaoProxmoxRole,
@@ -1687,13 +3090,22 @@ export {
   BaoSshRole,
   BaoSshRoleProvider,
   CloudflarePermissionGroups,
+  HOST_ROLE_SEPARATOR,
+  appRoleLogin,
+  appRoleLoginEffect,
+  assertBaoIdentity,
+  assertBaoIdentityEffect,
   expandAccount,
   expandAll,
+  hostAppRoles,
+  hostRoleName,
   mountName,
   parseRolesConfig,
   permissionGroupsFromEngine,
-  permissionGroupsFromLiveRoles
+  permissionGroupsFromLiveRoles,
+  revokeSelf,
+  revokeSelfEffect
 };
 
-//# debugId=8FBBE010DA02328C64756E2164756E21
+//# debugId=7E1DFE85CC398C5464756E2164756E21
 //# sourceMappingURL=index.js.map