@homeflare/alchemy 0.5.0 → 0.6.0

package/dist/openbao/mount-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount-form.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-form.ts"],"names":[],"mappings":"AAEA,0FAA0F;AAC1F,eAAO,MAAM,SAAS,SAAU,MAAM,WAA6B,CAAC;AAIpE,qEAAqE;AACrE,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MAAM,GAAG,SAkBrD,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,UAAU,UAAW,OAAO,KAAG,MAAM,GAAG,SAIpD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAiBD,eAAO,MAAM,YAAY,UAChB,aAAa,QACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,kBAYF,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAoC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,WAA6B,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CACsB,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMpE,CAAC;AASF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,kBAAkB,SAAS,aAAa,YAIxB,CAAC;AAErD,eAAO,MAAM,SAAS,UAAW,aAAa,YAGb,CAAC"}
+{"version":3,"file":"mount-form.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-form.ts"],"names":[],"mappings":"AAGA,0FAA0F;AAC1F,eAAO,MAAM,SAAS,SAAU,MAAM,WAA8B,CAAC;AAIrE,qEAAqE;AACrE,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MAAM,GAAG,SAkBrD,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,UAAU,UAAW,OAAO,KAAG,MAAM,GAAG,SAIpD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAChB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAiBD,eAAO,MAAM,YAAY,UAChB,aAAa,QACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,kBAYF,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAoC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,WAA6B,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CACsB,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMpE,CAAC;AASF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,kBAAkB,SAAS,aAAa,YAIxB,CAAC;AAErD,eAAO,MAAM,SAAS,UAAW,aAAa,YAGb,CAAC"}

package/dist/openbao/mount-move.d.ts

@@ -0,0 +1,49 @@
+/**
+ * What a changed path means for Bao.Mount and Bao.AuthMethod — and the move, when one is declared.
+ *
+ * ⛔ A CHANGED PATH USED TO PLAN `update` AND ENABLE AN EMPTY MOUNT AT THE NEW PATH. diff read the
+ *   new path, found nothing, answered `update`, and reconcile ran `enable` there: a fresh, empty
+ *   `kv2/` beside the retained `kv/` that still held every secret, with Alchemy's state now naming
+ *   only the empty one. Nothing failed, so nothing said so (site-config plan, Guards).
+ * ★ NOW A CHANGED PATH FAILS AT PLAN TIME, unless the declaration says where it came from:
+ *   `remountFrom: '<old path>'` moves the mount with `sys/remount` (remount-wire.ts), which keeps
+ *   every secret. A genuinely new, empty mount is a new resource id, never an edited path.
+ * ★ THE MOVE IS DECIDED BY LIVE STATE, SO A RE-RUN CONVERGES. Source present and target absent is
+ *   a move; target present and source absent is a move that already happened; both present, or
+ *   neither, is a refusal — "neither" in particular is exactly the empty-mount failure above.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+import { type RemountError, type RemountOptions } from './remount-wire.ts';
+export type Move = {
+    readonly kind: 'stay';
+} | {
+    readonly kind: 'move';
+    readonly from: string;
+} | {
+    readonly kind: 'refuse';
+    readonly message: string;
+};
+/**
+ * @param family  `Bao.Mount` or `Bao.AuthMethod`, for the message.
+ * @param stated  the path Alchemy's state holds, or undefined on a first reconcile.
+ * @param path    the declared path.
+ * @param remountFrom the declared source, if any.
+ */
+export declare const planMove: (family: string, stated: string | undefined, path: string, remountFrom: string | undefined) => Move;
+export interface MoveTarget {
+    readonly family: string;
+    /** Declared path, bare. */
+    readonly path: string;
+    readonly type: string;
+    /** Read one path's live entry — undefined when absent. */
+    readonly read: (path: string) => Effect.Effect<{
+        readonly type: string;
+    } | undefined, BaoError, HttpClient.HttpClient>;
+    /** The path as sys/remount takes it: the bare path for secrets, `auth/<path>` for auth. */
+    readonly wire: (path: string) => string;
+}
+/** Perform a planned move, deciding by live state. Returns once the target is in place. */
+export declare const performMove: (target: MoveTarget, from: string, options?: RemountOptions) => Effect.Effect<void, BaoError | RemountError, HttpClient.HttpClient>;
+//# sourceMappingURL=mount-move.d.ts.map

package/dist/openbao/mount-move.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-move.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-move.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAkB,MAAM,mBAAmB,CAAC;AAE3F,MAAM,MAAM,IAAI,GACZ;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,WACX,MAAM,UACN,MAAM,GAAG,SAAS,QACpB,MAAM,eACC,MAAM,GAAG,SAAS,KAC9B,IAyBF,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,CACb,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC3F,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACzC;AAID,2FAA2F;AAC3F,eAAO,MAAM,WAAW,WACd,UAAU,QACZ,MAAM,YACF,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CA6BjE,CAAC"}

package/dist/openbao/mount-path.d.ts

@@ -1,10 +1,14 @@
 /**
- * Slash trimming for caller-supplied mount paths.
+ * Trimming runs of one character from caller-supplied paths and names.
  *
- * ★ LOOPS, NOT `/^\/+|\/+$/g` OR `/\/+$/`. A trailing `\/+$` backtracks polynomially on a long run
- *   of `/` followed by anything else (CodeQL js/polynomial-redos), and mount paths are caller input.
- *   Both loops are linear in the input length.
+ * ★ LOOPS, NOT `/^\/+|\/+$/g`, `/\/+$/` OR `/^-+|-+$/g`. A trailing `x+$` backtracks polynomially
+ *   on a long run of `x` followed by anything else (CodeQL js/polynomial-redos), and mount paths,
+ *   namespaces and slugs are caller input. Every loop here is linear in the input length.
  */
+/** `text` without a trailing run of `char` (one UTF-16 unit). */
+export declare const trimTrailing: (text: string, char: string) => string;
+/** `text` without a leading or trailing run of `char` (one UTF-16 unit). */
+export declare const trimRuns: (text: string, char: string) => string;
 /** `text` without trailing `/`. */
 export declare const trimTrailingSlashes: (text: string) => string;
 /** `text` without leading or trailing `/`. */

package/dist/openbao/mount-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount-path.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-path.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mCAAmC;AACnC,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAIlD,CAAC;AAEF,8CAA8C;AAC9C,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,MAI1C,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,UAAU,UAAW,MAAM,GAAG,SAAS,KAAG,MAClB,CAAC"}
+{"version":3,"file":"mount-path.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-path.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,iEAAiE;AACjE,eAAO,MAAM,YAAY,SAAU,MAAM,QAAQ,MAAM,KAAG,MAIzD,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,QAAQ,SAAU,MAAM,QAAQ,MAAM,KAAG,MAIrD,CAAC;AAEF,mCAAmC;AACnC,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAAiC,CAAC;AAErF,8CAA8C;AAC9C,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,MAA6B,CAAC;AAEzE,kFAAkF;AAClF,eAAO,MAAM,UAAU,UAAW,MAAM,GAAG,SAAS,KAAG,MAClB,CAAC"}

package/dist/openbao/mount-reconcile.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Bao.Mount's read and reconcile as plain effects — split from mount.ts so the move (and its
+ * refusals) run against a fake server, not only in a reviewer's head.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+import { type BaoMountAttributes, type BaoMountProps } from './mount-form.ts';
+import type { RemountError, RemountOptions } from './remount-wire.ts';
+export declare const readMount: (props: BaoMountProps) => Effect.Effect<BaoMountAttributes | undefined, BaoError, HttpClient.HttpClient>;
+/**
+ * Converge one mount. `stated` is the path in Alchemy's state (undefined on a first reconcile).
+ * Dies on a refusal; fails with OpenBao's own error on a refused call.
+ */
+export declare const reconcileMount: (news: BaoMountProps, stated: string | undefined, options?: RemountOptions) => Effect.Effect<BaoMountAttributes, BaoError | RemountError, HttpClient.HttpClient>;
+//# sourceMappingURL=mount-reconcile.d.ts.map

package/dist/openbao/mount-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-reconcile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAKnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,SAAS,UACb,aAAa,KACnB,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK5E,CAAC;AAUL;;;GAGG;AACH,eAAO,MAAM,cAAc,SACnB,aAAa,UACX,MAAM,GAAG,SAAS,YAChB,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CA8B/E,CAAC"}

package/dist/openbao/mount.d.ts

@@ -7,6 +7,15 @@
  *
  * ★ `defaultRemovalPolicy: 'retain'` — disabling a mount destroys every secret under it.
  *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *
+ * ★ REPLACE SEMANTICS (audited 2026-09-21, see src/openbao/REPLACE.md):
+ *   · `type` changed → plans `replace`, and the APPLY FAILS, destroying nothing: the new
+ *     generation's path is the old one's, still occupied, so its reconcile dies "type is
+ *     immutable" before any write (mount-reconcile.ts). Change a type by hand. ⛔ Not `deleteFirst`
+ *     on purpose — under `destroy` that would disable the mount, every secret with it, on a typo.
+ *   · `path` changed → FAILS the plan unless `remountFrom` names the old path, which is an
+ *     in-place `update` that moves the mount and its data (mount-move.ts). It used to be an
+ *     `update` that enabled an EMPTY mount at the new path.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../src/openbao/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAKnB,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAElD,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,QAAQ,2CAEnB,CAAC;AASH,eAAO,MAAM,gBAAgB,+FAqF1B,CAAC"}
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../src/openbao/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,aAAa,EAAW,MAAM,iBAAiB,CAAC;AAKvF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAElD,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,QAAQ,2CAEnB,CAAC;AAEH,eAAO,MAAM,gBAAgB,+FAuE1B,CAAC"}

package/dist/openbao/pki-role-canonical.d.ts

@@ -0,0 +1,46 @@
+import type { BaoPkiRoleProps } from './pki-role-form.ts';
+/**
+ * The managed field set, normalised so both sides of a diff are byte-comparable.
+ *
+ * ⚠️ KEY ORDER IS THE DIGEST. The props side and the live side are both built by the single
+ *   canonical() literal below, so `JSON.stringify` emits the same key order for each. Two
+ *   hand-written object literals would drift apart and produce a forever-diff nobody could
+ *   read from the plan output.
+ */
+export interface BaoPkiRoleCanonical {
+    allowBareDomains: boolean;
+    allowGlobDomains: boolean;
+    allowIpSans: boolean;
+    allowLocalhost: boolean;
+    allowSubdomains: boolean;
+    allowWildcardCertificates: boolean;
+    allowedDomains: readonly string[];
+    allowedDomainsTemplate: boolean;
+    clientFlag: boolean;
+    cnValidations: readonly string[];
+    enforceHostnames: boolean;
+    extKeyUsage: readonly string[];
+    generateLease: boolean;
+    keyBits: number;
+    keyType: string;
+    keyUsage: readonly string[];
+    /** ⚠️ `-1` means the duration prop did not parse — reconcile refuses rather than writing it. */
+    maxTtlSeconds: number;
+    noStore: boolean;
+    requireCn: boolean;
+    serverFlag: boolean;
+    signatureBits: number;
+    ttlSeconds: number;
+}
+/** ★ OpenBao's own `key_usage` default (path_roles.go:697-698) — what an omitted field becomes. */
+export declare const DEFAULT_KEY_USAGE: readonly string[];
+export declare const canonicalFromProps: (props: BaoPkiRoleProps) => BaoPkiRoleCanonical;
+/**
+ * ⚠️ AN ABSENT NEW FIELD READS AS ITS ZERO VALUE, NOT ITS SCHEMA DEFAULT. A role read always carries
+ *   the six new fields (ToResponseData, path_roles.go:1720-1780; `generate_lease` only when set,
+ *   and getRole upgrades a missing one to false at :1034), so the fallback only answers a body
+ *   that is not OpenBao's — and then "false"/"none" reads as drift rather than a false noop.
+ */
+export declare const canonicalFromLive: (live: Record<string, unknown>) => BaoPkiRoleCanonical;
+export declare const digestOf: (form: BaoPkiRoleCanonical) => string;
+//# sourceMappingURL=pki-role-canonical.d.ts.map

package/dist/openbao/pki-role-canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pki-role-canonical.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role-canonical.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,yBAAyB,EAAE,OAAO,CAAC;IACnC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sBAAsB,EAAE,OAAO,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,gGAAgG;IAChG,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,mGAAmG;AACnG,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAI9C,CAAC;AAqCF,eAAO,MAAM,kBAAkB,UAAW,eAAe,KAAG,mBAwBxD,CAAC;AAYL;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,mBAwB9D,CAAC;AAEL,eAAO,MAAM,QAAQ,SAAU,mBAAmB,KAAG,MAAsC,CAAC"}

package/dist/openbao/pki-role-form.d.ts

@@ -1,3 +1,5 @@
+import { type BaoPkiRoleCanonical } from './pki-role-canonical.ts';
+export type { BaoPkiRoleCanonical };
 /** ★ MEASURED: the OpenAPI enum for `key_type` is exactly these four, lowercase. */
 export type BaoPkiKeyType = 'any' | 'ec' | 'ed25519' | 'rsa';
 /** ★ MEASURED: live roles carry `["hostname"]` or the default `["email","hostname"]`. */
@@ -51,33 +53,29 @@ export interface BaoPkiRoleProps {
     cnValidations?: readonly BaoPkiCnValidation[];
     /** Signature hash bits; `0` auto-detects from key length. One live role pins 256. */
     signatureBits?: number;
-}
-/**
- * The managed field set, normalised so both sides of a diff are byte-comparable.
- *
- * ⚠️ KEY ORDER IS THE DIGEST. The props side and the live side are both built by the single
- *   canonical() literal below, so `JSON.stringify` emits the same key order for each. Two
- *   hand-written object literals would drift apart and produce a forever-diff nobody could
- *   read from the plan output.
- */
-export interface BaoPkiRoleCanonical {
-    allowBareDomains: boolean;
-    allowGlobDomains: boolean;
-    allowIpSans: boolean;
-    allowLocalhost: boolean;
-    allowSubdomains: boolean;
-    allowWildcardCertificates: boolean;
-    allowedDomains: readonly string[];
-    clientFlag: boolean;
-    cnValidations: readonly string[];
-    extKeyUsage: readonly string[];
-    keyBits: number;
-    keyType: string;
-    /** ⚠️ `-1` means the duration prop did not parse — reconcile refuses rather than writing it. */
-    maxTtlSeconds: number;
-    serverFlag: boolean;
-    signatureBits: number;
-    ttlSeconds: number;
+    /**
+     * ★ THE SIX BELOW (added 2026-09-21) default to OpenBao's OWN values, not closed ones — a role this
+     *   resource wrote before they were props carries exactly those, so it still plans `noop`. The
+     *   write already sent them implicitly; see the header of pki-role-canonical.ts.
+     */
+    /** A request must carry a common_name. Default true. */
+    requireCn?: boolean;
+    /** Only valid host names in the CN and DNS SANs. Default true. */
+    enforceHostnames?: boolean;
+    /**
+     * Key usages minus the `KeyUsage` prefix. Default `DigitalSignature, KeyAgreement,
+     * KeyEncipherment`. ⚠️ `[]` is a real value — it removes every key usage — and is sent as such.
+     */
+    keyUsage?: readonly string[];
+    /** Allowed domains may use identity templates (`{{identity.entity.name}}`). Default false. */
+    allowedDomainsTemplate?: boolean;
+    /**
+     * Do not store issued certificates. Default false. ⛔ They can then be neither listed nor
+     *   revoked. ⚠️ Implies `generateLease: false`; declaring both true is refused (see problems).
+     */
+    noStore?: boolean;
+    /** Attach an OpenBao lease to every issued certificate. Default false — leases slow startup. */
+    generateLease?: boolean;
 }
 export interface BaoPkiRoleAttributes extends BaoPkiRoleCanonical {
     name: string;
@@ -88,9 +86,6 @@ export interface BaoPkiRoleAttributes extends BaoPkiRoleCanonical {
     /** SHA-256 of the canonical form — safe to persist; see policy.ts. */
     digest: string;
 }
-export declare const canonicalFromProps: (props: BaoPkiRoleProps) => BaoPkiRoleCanonical;
-export declare const canonicalFromLive: (live: Record<string, unknown>) => BaoPkiRoleCanonical;
-export declare const digestOf: (form: BaoPkiRoleCanonical) => string;
 export declare const rolePath: (props: {
     name: string;
     mount?: string;
@@ -109,10 +104,23 @@ export declare const attributesOf: (props: BaoPkiRoleProps, live: Record<string,
  * ★ `ext_key_usage` is OMITTED when empty rather than sent as `ext_key_usage=`. The write
  *   replaces the whole role, so an absent field already lands on the `[]` default, and
  *   omitting sidesteps how an empty value would be encoded.
+ * ⚠️ `key_usage` CANNOT BE OMITTED THAT WAY — its default is NOT empty — so it is always sent, and
+ *   an empty declaration goes over as `""`. That encoding is now READ, not guessed: for a
+ *   comma-string-slice field, go-secure-stdlib parseutil.ParseCommaStringSlice (:389-392)
+ *   answers `""` with an empty list.
  *
  * ★ THE BODY FOR `PUT <mount>/roles/<name>`, ALL STRINGS — the same `k=v` pairs `bao write` sent.
  */
 export declare const writeBody: (props: BaoPkiRoleProps) => Record<string, string>;
 /** True when live already matches the declaration on every managed field. */
 export declare const matches: (attributes: BaoPkiRoleAttributes, props: BaoPkiRoleProps) => boolean;
+/**
+ * Declarations reconcile must refuse rather than write. diff routes any of these to `update` so the
+ * refusal is seen on the next deploy, never hidden behind a `noop`.
+ *
+ * ⚠️ `noStore` WITH `generateLease` IS NOT AN ERROR ON THE SERVER — pathRoleCreate stores
+ *   generate_lease false and adds a warning (path_roles.go:1250-1256) — so the role would read back
+ *   different from its declaration and plan `update` forever. Refused here instead.
+ */
+export declare const problems: (props: BaoPkiRoleProps) => readonly string[];
 //# sourceMappingURL=pki-role-form.d.ts.map

package/dist/openbao/pki-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pki-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role-form.ts"],"names":[],"mappings":"AAGA,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC;AAE7D,yFAAyF;AACzF,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC9B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oDAAoD;IACpD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oGAAoG;IACpG,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,gGAAgG;IAChG,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kFAAkF;IAClF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,8FAA8F;IAC9F,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC9C,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,yBAAyB,EAAE,OAAO,CAAC;IACnC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AA8BD,eAAO,MAAM,kBAAkB,UAAW,eAAe,KAAG,mBAkBxD,CAAC;AAYL,eAAO,MAAM,iBAAiB,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,mBAkB9D,CAAC;AAWL,eAAO,MAAM,QAAQ,SAAU,mBAAmB,WAAiC,CAAC;AAEpF,eAAO,MAAM,QAAQ,UAAW;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,WACN,CAAC;AAE3D,eAAO,MAAM,YAAY,UAChB,eAAe,QAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,oBAUF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,UAAW,eAAe,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAsBvE,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,oBAAoB,SAAS,eAAe,YACrB,CAAC"}
+{"version":3,"file":"pki-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role-form.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,mBAAmB,EAKzB,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC;AAE7D,yFAAyF;AACzF,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC9B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oDAAoD;IACpD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oGAAoG;IACpG,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,gGAAgG;IAChG,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kFAAkF;IAClF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,8FAA8F;IAC9F,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC9C,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,8FAA8F;IAC9F,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gGAAgG;IAChG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAWD,eAAO,MAAM,QAAQ,UAAW;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,WACN,CAAC;AAE3D,eAAO,MAAM,YAAY,UAChB,eAAe,QAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,oBAUF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,SAAS,UAAW,eAAe,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CA4BvE,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,oBAAoB,SAAS,eAAe,YACrB,CAAC;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,UAAW,eAAe,KAAG,SAAS,MAAM,EAuBhE,CAAC"}

package/dist/openbao/pki-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pki-role.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAKrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAeH,eAAO,MAAM,kBAAkB,iGAsH5B,CAAC"}
+{"version":3,"file":"pki-role.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAMrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AASH,eAAO,MAAM,kBAAkB,iGA4G5B,CAAC"}

package/dist/openbao/remount-wire.d.ts

@@ -0,0 +1,44 @@
+/**
+ * `sys/remount` — move a secrets engine or auth method to a new path WITH its data — and the status
+ * polling it needs, because the move finishes after the call returns.
+ *
+ * ★ READ FROM openbao v2.6.2, NOT RECALLED:
+ *   · api/sys_mounts.go:95-191 — the CLI's `bao secrets move` POSTs `{from, to}` to sys/remount,
+ *     takes `data.migration_id`, then GETs sys/remount/status/<id> once a second until
+ *     `migration_info.status` is `success` or `failure`. This is that loop, bounded.
+ *   · vault/logical_system.go:1257-1357 — the handler validates, records the migration and
+ *     answers AT ONCE; a goroutine does the move. So a 200 means "queued", never "moved".
+ *   · vault/mount.go:630-735 — the mount keeps its UUID, and storage lives under the UUID, so every
+ *     secret stays. ⛔ BUT EVERY LEASE UNDER THE SOURCE IS REVOKED (`RevokePrefix`, :684): a move of
+ *     a dynamic-secrets mount kills every credential it has issued. KV has no leases.
+ *   · vault/logical_system.go:67-69 — `remount` is a sudo path. The status path is not.
+ * ⚠️ THE STATUS TRACKER IS IN MEMORY (vault/mount.go:2303-2336, a sync.Map on the active node). A
+ *   restart or leader change mid-move loses it, and the status read then answers 404. That is not a
+ *   failure and not a success; `confirm` settles it from the mount tables, or the call fails.
+ * ⛔ POLICIES ARE NOT REWRITTEN. Every ACL path naming the old mount keeps naming it.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+/** A move OpenBao reported failed, or one this could not confirm. Never carries a token. */
+export declare class RemountError extends Error {
+    constructor(message: string);
+}
+export interface RemountOptions {
+    /** Milliseconds between status reads. Default 1000 — the CLI's own pace. */
+    readonly intervalMillis?: number;
+    /** Status reads before giving up. Default 120, so about two minutes. */
+    readonly attempts?: number;
+}
+/** POST sys/remount and return the migration id. `from`/`to` are full paths (`auth/x` for auth). */
+export declare const startRemount: (from: string, to: string) => Effect.Effect<string, BaoError | RemountError, HttpClient.HttpClient>;
+/** `in-progress`, `success`, `failure` — or undefined when the server no longer knows the id. */
+export declare const remountStatus: (id: string) => Effect.Effect<string | undefined, BaoError, HttpClient.HttpClient>;
+/**
+ * Move `from` to `to` and wait until OpenBao says it is done.
+ *
+ * @param confirm answers "does the mount table show the move finished?" — asked only when the
+ *   status tracker has forgotten the id. True is success; false fails.
+ */
+export declare const remountAndWait: (from: string, to: string, confirm: Effect.Effect<boolean, BaoError, HttpClient.HttpClient>, options?: RemountOptions) => Effect.Effect<void, BaoError | RemountError, HttpClient.HttpClient>;
+//# sourceMappingURL=remount-wire.d.ts.map

package/dist/openbao/remount-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remount-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/remount-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,4FAA4F;AAC5F,qBAAa,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAOD,oGAAoG;AACpG,eAAO,MAAM,YAAY,SACjB,MAAM,MACR,MAAM,KACT,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CAMnE,CAAC;AAEL,iGAAiG;AACjG,eAAO,MAAM,aAAa,OACpB,MAAM,KACT,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAKhE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SACnB,MAAM,MACR,MAAM,WACD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,YACvD,cAAc,KACtB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CAkCjE,CAAC"}

package/dist/openbao/role-reconcile.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The read / plan / reconcile loop the newer role families share (Bao.JwtRole, Bao.KubernetesRole,
+ * Bao.JwtAuthConfig): one path, one body, one comparison. Each family supplies its own form; this
+ * owns the order of operations, which is where the estate's providers have gone wrong before.
+ *
+ * ★ THE ORDER, AND WHY EACH STEP IS THERE:
+ *   1. Refuse a declaration the family knows is wrong, before any call (`problems`).
+ *   2. Read live. Write only when it differs — an identical write is still an audit line.
+ *   3. Before writing over a live object, refuse if the write would silently destroy something
+ *      this resource does not model (`wouldErase`, the ssh-role.ts pattern).
+ *   4. Re-read, and refuse unless live now MATCHES. A 2xx is not proof: the server can accept a
+ *      field and store something else (pki-role.ts has the history).
+ * ⛔ A DECLARATION reconcile WOULD REFUSE NEVER PLANS `noop` — `planRole` routes it to `update`,
+ *   so the refusal is seen at the next deploy instead of hiding behind a clean plan.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+export interface RoleSpec<A> {
+    /** `Bao.JwtRole` etc., for messages. */
+    readonly family: string;
+    /** The API path, e.g. `auth/jwt/role/humans`. */
+    readonly path: string;
+    readonly problems: readonly string[];
+    readonly attributesOf: (live: Record<string, unknown>) => A;
+    readonly matches: (attributes: A) => boolean;
+    readonly body: Readonly<Record<string, unknown>>;
+    /** Live fields a write would reset that the declaration does not model. */
+    readonly wouldErase?: (live: Record<string, unknown>) => readonly string[];
+}
+type Found<A> = {
+    readonly attributes: A;
+    readonly live: Record<string, unknown>;
+};
+export declare const readRoleAt: <A>(spec: RoleSpec<A>) => Effect.Effect<Found<A> | undefined, BaoError, HttpClient.HttpClient>;
+/** `update` or `noop` — the part of a diff after the identity checks. */
+export declare const planRole: <A>(spec: RoleSpec<A>) => Effect.Effect<'noop' | 'update', BaoError, HttpClient.HttpClient>;
+export declare const reconcileRole: <A>(spec: RoleSpec<A>) => Effect.Effect<A, BaoError, HttpClient.HttpClient>;
+export {};
+//# sourceMappingURL=role-reconcile.d.ts.map

package/dist/openbao/role-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/role-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,SAAS,MAAM,EAAE,CAAC;CAC5E;AAED,KAAK,KAAK,CAAC,CAAC,IAAI;IAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEnF,eAAO,MAAM,UAAU,GAAI,CAAC,QACpB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGnE,CAAC;AAEJ,yEAAyE;AACzE,eAAO,MAAM,QAAQ,GAAI,CAAC,QAClB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK/D,CAAC;AAKL,eAAO,MAAM,aAAa,GAAI,CAAC,QACvB,QAAQ,CAAC,CAAC,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CA0B/C,CAAC"}

package/docs/launchd.md

@@ -0,0 +1,167 @@
+# launchd — `@homeflare/alchemy/launchd`
+
+Declare a Mac host with Alchemy: its launchd jobs (`LaunchdJob`) and the config files they read
+(`HostFile`). launchd has no SDK, so the provider renders the plist itself and drives
+`launchctl`. Every file read, file write and `launchctl` call goes through one injectable
+`HostRunner`.
+
+```ts
+import * as Effect from 'effect/Effect';
+import { HostFile, LaunchdJob, launchdProviders } from '@homeflare/alchemy/launchd';
+
+export const exporter = Effect.gen(function* () {
+  const config = yield* HostFile('exporter-config', {
+    path: '/usr/local/etc/example-exporter.yml',
+    content: 'listen: 127.0.0.1:9100\n',
+    mode: 0o644,
+    owner: 'root',
+    group: 'wheel',
+  });
+  yield* LaunchdJob('exporter', {
+    label: 'com.example.exporter',
+    domain: 'system', // or 'gui/<uid>' for a LaunchAgent
+    // ★ config.path, not the literal: the Output orders the job after its file is written.
+    programArguments: ['/usr/local/bin/example-exporter', '--config', config.path],
+    environment: { TZ: 'UTC' }, // ⛔ non-secret values only
+    runAtLoad: true,
+    keepAlive: { successfulExit: false },
+    throttleInterval: 30,
+    standardOutPath: '/var/log/example-exporter.log',
+    standardErrorPath: '/var/log/example-exporter.log',
+  });
+});
+// Provide launchdProviders() alongside the stack's other provider layers.
+```
+
+## LaunchdJob
+
+| prop                          | plist key                        | notes                                                  |
+| ----------------------------- | -------------------------------- | ------------------------------------------------------ |
+| `label`                       | `Label`                          | also the file name; `[A-Za-z0-9._-]`, no `/`           |
+| `domain`                      | —                                | `system` (LaunchDaemons) or `gui/<uid>` (LaunchAgents) |
+| `programArguments`            | `ProgramArguments`               | first element must be an absolute path                 |
+| `environment`                 | `EnvironmentVariables`           | ⛔ non-secret only (see below)                         |
+| `runAtLoad`                   | `RunAtLoad`                      |                                                        |
+| `keepAlive`                   | `KeepAlive`                      | `true`/`false` or `{ successfulExit, crashed }`        |
+| `startInterval`               | `StartInterval`                  | seconds, > 0                                           |
+| `startCalendarInterval`       | `StartCalendarInterval`          | one entry or a list; fields are range-checked          |
+| `throttleInterval`            | `ThrottleInterval`               | seconds, ≥ 0                                           |
+| `standardOutPath` / `…Error…` | `StandardOutPath` / `…ErrorPath` | absolute                                               |
+| `workingDirectory`            | `WorkingDirectory`               | absolute                                               |
+| `userName` / `groupName`      | `UserName` / `GroupName`         | system domain only — launchd ignores them for agents   |
+| `extraKeys`                   | anything else, verbatim          | may not repeat a key a typed prop owns                 |
+
+The plist path is derived, never declared: `/Library/LaunchDaemons/<label>.plist` for `system`,
+`<home of uid>/Library/LaunchAgents/<label>.plist` for `gui/<uid>`.
+
+| step    | what happens                                                                                        |
+| ------- | --------------------------------------------------------------------------------------------------- |
+| create  | write the plist atomically (system: `root:wheel 0644`), then `launchctl bootstrap`                  |
+| update  | write, `bootout` the running job (and wait until launchd lets go), `bootstrap` — **a restart**      |
+| read    | `launchctl print` (loaded? state, pid, last exit) plus the SHA-256 of the plist on disk             |
+| diff    | the rendered plist's SHA-256 against the stored digest **and** the on-disk one, plus "is it loaded" |
+| replace | only when `label` or `domain` changes — **delete first**, so two copies never run at once           |
+| delete  | `bootout` if loaded, remove the plist; idempotent                                                   |
+
+- A converged job is not restarted: a retried deploy that finds the right plist loaded does nothing.
+- ⛔ **A rename is checked at plan time.** Alchemy deletes the old job before it creates the new
+  one, so everything the new one would be refused for (an invalid or reserved label, a domain you
+  may not write, a disabled label, a label another job already holds) fails the **plan**, with the
+  old job still running. A rename is seen even while other props are unresolved Outputs.
+- ⚠️ A failed `bootstrap` leaves the job **down**. On an update the new plist stays on disk, the
+  state keeps the old digest, and the next deploy retries. On a first create the plist is removed
+  again, so the next plan does not find its own file and call it someone else's.
+  There is no rollback to an older plist.
+- ⛔ A label disabled with `launchctl disable` is refused, not re-enabled: that was someone's
+  decision. The error names the `launchctl enable` command to run if it is stale.
+- ⚠️ A `gui/<uid>` job needs that user logged in: without a login session the domain does not
+  exist (`launchctl print` exits 112, "Could not find domain"; measured). Deploying refuses before
+  it writes anything. Deleting still removes the plist, which stops launchd loading it at login.
+- ⚠️ The digest covers the rendered bytes, so a kit upgrade that changes the renderer's output
+  restarts every declared job on the next deploy. Such a release says so in its changelog.
+
+## HostFile
+
+`path` (absolute, normalised), `content` (UTF-8 text), `mode` (default `0o644`), `owner` and
+`group` (names or ids). Written as a temp file in the same directory — mode and owner set before
+it becomes visible — then renamed over the path. Read back after every write. Diffed by SHA-256,
+mode and owner. A new `path` is a create-before-delete replace. Delete removes the file.
+
+- ⛔ A different file already at a new `path` is refused, not overwritten: the adoption probe
+  never looks at a replace's new path, so a typo there would otherwise overwrite a system file.
+
+- ⛔ A symlink or directory at the path is refused, never replaced: rename over a symlink replaces
+  the link, which takes the path from whatever tool owns it (nix-darwin's `/etc` entries point
+  into `/nix/store`).
+- ⚠️ The parent directory must exist. Creating it would invent an owner and mode nobody declared.
+
+## ⛔ No secrets in props
+
+Alchemy stores props and attributes **unencrypted** in its state store. A job's `environment`,
+`programArguments` and `extraKeys`, and a file's `content`, land there, in every plan diff, and on
+disk.
+
+**Keep secret files rendered by a secret renderer** — `openbao-agent` templates on a HomeFlare
+host — and declare only the path: `FOO_TOKEN_FILE=/path`, `--token-file /path`. A tripwire refuses
+the obvious mistakes (a `*_TOKEN`/`*_PASSWORD`-style variable, `--token=…`, a PEM private key); it
+is not a scanner, and passing it does not make a value safe to declare.
+
+## ⛔ No silent sudo
+
+The `system` domain, and another user's `gui/<uid>`, need root. The provider refuses up front
+unless the runner is root (`effectiveUid() === 0`) or was deliberately built with
+`privileged: true`. `localRunner()` — the default — is never privileged and never calls `sudo`, so:
+
+- **system daemons:** start the whole deploy as root; or pass `launchdProviders(yourRunner)` where
+  `yourRunner` is a `HostRunner` you wrote that already holds root (a root helper, say).
+- **your own agents** (`gui/<your uid>`): no root needed.
+
+Reading (`launchctl print`, `print-disabled`) needs no root. ⚠️ A `HostFile` whose mode hides it
+from the planning user (a root-owned `0600`, say) fails the plan with `EACCES`: plan as the user
+you deploy as.
+
+## Adoption: nothing is taken over silently
+
+`read` with no prior state reports anything it finds — a loaded label, a plist, a file — as
+`Unowned`, so Alchemy refuses to take it over without `--adopt`.
+
+Labels under `org.nixos.`, `com.apple.` and `homebrew.mxcl.` are **refused outright**. nix-darwin
+rewrites its plists on every activation and unloads any it no longer lists, macOS owns
+`com.apple.*`, and `brew services` owns `homebrew.mxcl.*`. Adopting one would give a file two
+owners. Move the job instead.
+
+## Cutover from nix-darwin
+
+Nix-managed `org.nixos.*` jobs are **not adopted**. The host stack declares a **new** label, and the
+Nix job is booted out first. Per job:
+
+1. **Declare** the replacement in the host stack under a new label (`com.example.<job>`), with its
+   config as `HostFile`s. ⚠️ Nothing it references may live in `/nix/store` — the next garbage
+   collection deletes it. Plan it: expect creates only.
+2. **Remove the job from the nix-darwin config and activate.** Activation unloads and deletes every
+   daemon it no longer lists — checked 2026-09-21 in a nix-darwin activation script: it prints
+   `removing service <label>`, runs `launchctl unload`, then removes the plist. Confirm with
+   `launchctl print system/org.nixos.<job>` → exit 113 ("Could not find service").
+3. **Deploy** the host stack. The new label bootstraps.
+4. **Verify** `launchctl print system/com.example.<job>` shows `state = running`, then check the
+   service itself (port, metrics, logs).
+
+- ★ **Why this order.** Both jobs usually bind the same port and write the same files; the old one
+  must be gone before the new one starts. Downtime is one deploy.
+- ⚠️ **`sudo launchctl bootout system/org.nixos.<job>` is not a cutover.** The plist stays in
+  `/Library/LaunchDaemons`, so launchd loads it again at the next boot; and activation (checked in
+  the same script) copies back and `load -w`s any Nix plist that is missing or differs from the
+  store. Either way two copies end up fighting over the port.
+- ⚠️ **Check the host's own activation for labels it removes.** An activation script can boot out,
+  `disable` and delete jobs by name on every run; a new label that collides with one is disabled
+  under you. `grep -n 'bootout\|disable' /run/current-system/activate` before choosing labels.
+- **Rolling back** is the same three steps reversed: destroy (or remove) the resource, restore the
+  job in the Nix config, activate.
+
+## The runner
+
+`HostRunner` (see `src/launchd/runner.ts`) is `exec(argv)` (never through a shell), `readFile`,
+`stat` (lstat), `writeFileAtomic`, `removeFile`, `lookupUser`, `lookupGroup`, `sleep`, plus
+`privileged` and `effectiveUid()`. `localRunner()` implements it with `node:fs` and
+`node:child_process`; tests use an in-memory fake, so nothing in the test suite runs `launchctl` or
+writes outside a temp directory.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.5.0",
-  "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo and Talos.",
+  "version": "0.6.0",
+  "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos and launchd.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",
   "license": "MIT",
@@ -13,6 +13,7 @@
   },
   "files": [
     "dist",
+    "docs",
     "src",
     "README.md",
     "LICENSE"
@@ -44,6 +45,10 @@
       "types": "./dist/proxmox/index.d.ts",
       "default": "./dist/proxmox/index.js"
     },
+    "./launchd": {
+      "types": "./dist/launchd/index.d.ts",
+      "default": "./dist/launchd/index.js"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {

package/src/index.ts

@@ -9,6 +9,7 @@
  *     import { BaoMount } from '@homeflare/alchemy/openbao';
  *     import { TalosCluster } from '@homeflare/alchemy/talos';
  *     import { ProxmoxAcl } from '@homeflare/alchemy/proxmox';
+ *     import { LaunchdJob } from '@homeflare/alchemy/launchd';
  *
  * ★ WHY THESE EXIST AT ALL. When Alchemy has no resource for something, the alternative
  *   is a runbook step a human runs once — and a plan can never show a missing runbook