@homeflare/alchemy 0.42.0 → 0.44.0

package/dist/openbao/auth-role-form.d.ts

@@ -13,6 +13,14 @@ export interface BaoAuthRoleProps {
     bindSecretId?: boolean;
     /** `0` means unlimited uses — the shape reconcile.sh writes for headless roles. */
     secretIdNumUses?: number;
+    /**
+     * Token period, e.g. `24h` — set only for a periodic (forever-renewable) role, where
+     * `tokenTtl`/`tokenMaxTtl` are conventionally `'0'`. Omitted means this declaration does not
+     * manage the field: a live role's `token_period` (however it got set) is left untouched, the
+     * same way an omitted `bindSecretId` is. See house `openbao/approles.ts` for the role this
+     * unblocks — a periodic agent token that was inexpressible with these props.
+     */
+    tokenPeriod?: string;
 }
 export interface BaoAuthRoleAttributes {
     name: string;
@@ -22,6 +30,7 @@ export interface BaoAuthRoleAttributes {
     secretIdTtl: string;
     bindSecretId: boolean;
     secretIdNumUses: number;
+    tokenPeriod: string;
     /** SHA-256 of the managed fields — safe to persist; see policy.ts. */
     digest: string;
 }

package/dist/openbao/auth-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-form.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,eAAO,MAAM,YAAY,UAChB,gBAAgB,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,qBAWF,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAgC,CAAC;AAWtE,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAUjF,CAAC"}
+{"version":3,"file":"auth-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-form.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,eAAO,MAAM,YAAY,UAChB,gBAAgB,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,qBAYF,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAgC,CAAC;AAWtE,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAWjF,CAAC"}

package/dist/openbao/auth-role-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-wire.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAI7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,gBAAgB,EAAY,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAwB3C,eAAO,MAAM,YAAY,SAAU,MAAM,81BAQtC,CAAC;AAEJ,eAAO,MAAM,cAAc,SAAU,MAAM,k0BACwB,CAAC;AAEpE,eAAO,MAAM,eAAe,UAAW,gBAAgB,4DAuBnD,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,aAAa,UAAW,gBAAgB,0PAC6C,CAAC;AAEnG,+EAA+E;AAC/E,eAAO,MAAM,cAAc,SAAU,MAAM,s4BACqD,CAAC"}
+{"version":3,"file":"auth-role-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-wire.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAI7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,gBAAgB,EAAY,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAyB3C,eAAO,MAAM,YAAY,SAAU,MAAM,81BAQtC,CAAC;AAEJ,eAAO,MAAM,cAAc,SAAU,MAAM,k0BACwB,CAAC;AAEpE,eAAO,MAAM,eAAe,UAAW,gBAAgB,4DAkCnD,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,aAAa,UAAW,gBAAgB,0PAC6C,CAAC;AAEnG,+EAA+E;AAC/E,eAAO,MAAM,cAAc,SAAU,MAAM,s4BACqD,CAAC"}

package/dist/openbao/fake-engines-roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-engines-roles.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-engines-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAU,KAAK,KAAK,EAAmC,MAAM,mBAAmB,CAAC;AAwCxF;;;;GAIG;AACH,eAAO,MAAM,SAAS,QAAO,KAO1B,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,aAAa,QAAO,KAO9B,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,KAuB9B,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,UAAU,gBAIC,IAAI,KAAG,KAAK;;;;CAMnC,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}
+{"version":3,"file":"fake-engines-roles.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-engines-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAU,KAAK,KAAK,EAAmC,MAAM,mBAAmB,CAAC;AAwCxF;;;;GAIG;AACH,eAAO,MAAM,SAAS,QAAO,KAa1B,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,aAAa,QAAO,KAO9B,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,KAuB9B,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,UAAU,gBAIC,IAAI,KAAG,KAAK;;;;CAMnC,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}

package/dist/openbao/index.js

@@ -429,6 +429,40 @@ var recordedInstance = (fqn, instanceId) => Effect5.gen(function* () {
   return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
 });
 var isCreate = (fqn, instanceId) => Effect5.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var idOf = (attr) => {
+  if (typeof attr !== "object" || attr === null)
+    return;
+  const id = attr.id;
+  return typeof id === "string" && id !== "" ? id : undefined;
+};
+var olderGenerationIds = (fqn, instanceId) => Effect5.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return [];
+  const ids = [];
+  for (const at of [fqn, ...found.resources[fqn]?.FormerFqns ?? []]) {
+    collectOlder(yield* rowAt(found.store, found.where, at), instanceId, ids);
+  }
+  return ids;
+});
+var collectOlder = (row, instanceId, ids) => {
+  let at = row;
+  let seen = false;
+  while (typeof at === "object" && at !== null && !isActionState(at)) {
+    const generation = at;
+    if (!seen) {
+      seen = generation.instanceId === instanceId;
+      at = generation.old;
+      continue;
+    }
+    if (generation.instanceId !== instanceId) {
+      const id = idOf(generation.attr);
+      if (id !== undefined)
+        ids.push(id);
+    }
+    at = generation.old;
+  }
+};
 var forgetRefusedCreate = (fqn, instanceId) => Effect5.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
@@ -858,7 +892,8 @@ var attributesOf3 = (props, live) => {
     tokenMaxTtl: ttlText(ttlSeconds(live["token_max_ttl"])),
     secretIdTtl: ttlText(ttlSeconds(live["secret_id_ttl"]), "0"),
     bindSecretId: bool(live["bind_secret_id"], true),
-    secretIdNumUses: int(live["secret_id_num_uses"], 0)
+    secretIdNumUses: int(live["secret_id_num_uses"], 0),
+    tokenPeriod: ttlText(ttlSeconds(live["token_period"]), "0")
   };
   return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
 };
@@ -871,7 +906,7 @@ var sameTtl3 = (want, have) => {
 };
 var matches3 = (attributes, props) => {
   const wantPolicies = props.tokenPolicies.slice().sort();
-  return samePolicies(wantPolicies, attributes.tokenPolicies) && sameTtl3(props.tokenTtl, attributes.tokenTtl) && sameTtl3(props.tokenMaxTtl, attributes.tokenMaxTtl) && sameTtl3(props.secretIdTtl, attributes.secretIdTtl) && (props.bindSecretId === undefined || attributes.bindSecretId === props.bindSecretId) && (props.secretIdNumUses === undefined || attributes.secretIdNumUses === props.secretIdNumUses);
+  return samePolicies(wantPolicies, attributes.tokenPolicies) && sameTtl3(props.tokenTtl, attributes.tokenTtl) && sameTtl3(props.tokenMaxTtl, attributes.tokenMaxTtl) && sameTtl3(props.secretIdTtl, attributes.secretIdTtl) && (props.bindSecretId === undefined || attributes.bindSecretId === props.bindSecretId) && (props.secretIdNumUses === undefined || attributes.secretIdNumUses === props.secretIdNumUses) && (props.tokenPeriod === undefined || sameTtl3(props.tokenPeriod, attributes.tokenPeriod));
 };
 
 // src/openbao/auth-role-wire.ts
@@ -906,14 +941,15 @@ var runBaoWrite = (operation, timeout3 = BAO_TIMEOUT) => retryTransport(runBao(o
 // src/openbao/auth-role-wire.ts
 var identity = (name) => ({ approle_mount_path: "approle", role_name: name });
 var seconds = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-var completeRole = (live) => live !== null && typeof live === "object" && typeof live.bind_secret_id === "boolean" && seconds(live.secret_id_num_uses) && seconds(live.secret_id_ttl) && seconds(live.token_ttl) && seconds(live.token_max_ttl) && Array.isArray(live.token_policies) && live.token_policies.every((policy) => typeof policy === "string");
+var completeRole = (live) => live !== null && typeof live === "object" && typeof live.bind_secret_id === "boolean" && seconds(live.secret_id_num_uses) && seconds(live.secret_id_ttl) && seconds(live.token_ttl) && seconds(live.token_max_ttl) && seconds(live.token_period) && Array.isArray(live.token_policies) && live.token_policies.every((policy) => typeof policy === "string");
 var readAuthRole = (name) => runBaoRead(appRoleReadRole(identity(name))).pipe(Effect14.flatMap((live) => completeRole(live) ? Effect14.succeed(live) : Effect14.fail(new BaoError(200, "GET", readPath3(name), ["incomplete role metadata"]))), Effect14.catchTag("NotFound", () => Effect14.succeed(undefined)));
 var authRoleExists = (name) => readAuthRole(name).pipe(Effect14.map((live) => live !== undefined));
 var authRoleRequest = (props) => Effect14.gen(function* () {
   const tokenTtl = parseDuration(props.tokenTtl);
   const tokenMaxTtl = parseDuration(props.tokenMaxTtl);
   const secretIdTtl = parseDuration(props.secretIdTtl);
-  if (!seconds(tokenTtl) || !seconds(tokenMaxTtl) || !seconds(secretIdTtl)) {
+  const tokenPeriod = props.tokenPeriod === undefined ? undefined : parseDuration(props.tokenPeriod);
+  if (!seconds(tokenTtl) || !seconds(tokenMaxTtl) || !seconds(secretIdTtl) || props.tokenPeriod !== undefined && !seconds(tokenPeriod)) {
     return yield* Effect14.fail(new BaoError(0, "POST", readPath3(props.name), ["invalid role TTL duration"]));
   }
   const request = {
@@ -923,7 +959,8 @@ var authRoleRequest = (props) => Effect14.gen(function* () {
     token_max_ttl: tokenMaxTtl,
     secret_id_ttl: secretIdTtl,
     ...props.bindSecretId === undefined ? {} : { bind_secret_id: props.bindSecretId },
-    ...props.secretIdNumUses === undefined ? {} : { secret_id_num_uses: props.secretIdNumUses }
+    ...props.secretIdNumUses === undefined ? {} : { secret_id_num_uses: props.secretIdNumUses },
+    ...tokenPeriod === undefined ? {} : { token_period: tokenPeriod }
   };
   return request;
 });
@@ -3592,5 +3629,5 @@ export {
   revokeSelfEffect
 };
 
-//# debugId=C687B72D0BAE7E8D64756E2164756E21
+//# debugId=3866B2DE62460BDF64756E2164756E21
 //# sourceMappingURL=index.js.map