@homeflare/alchemy 0.5.0 → 0.7.0

package/dist/openbao/index.js

@@ -140,18 +140,20 @@ var baoWrite = (method, path, body) => Effect.asVoid(baoCall("write", method, pa
 var baoDelete = (path) => Effect.asVoid(baoCall("delete", "DELETE", path));
 
 // src/openbao/mount-path.ts
-var trimTrailingSlashes = (text) => {
+var trimTrailing = (text, char) => {
   let end = text.length;
-  while (end > 0 && text[end - 1] === "/")
+  while (end > 0 && text[end - 1] === char)
     end -= 1;
   return text.slice(0, end);
 };
-var trimSlashes = (text) => {
+var trimRuns = (text, char) => {
   let start = 0;
-  while (start < text.length && text[start] === "/")
+  while (start < text.length && text[start] === char)
     start += 1;
-  return trimTrailingSlashes(text.slice(start));
+  return trimTrailing(text.slice(start), char);
 };
+var trimTrailingSlashes = (text) => trimTrailing(text, "/");
+var trimSlashes = (text) => trimRuns(text, "/");
 var sshMountOf = (mount) => trimTrailingSlashes(mount ?? "ssh");
 
 // src/openbao/approle-login-form.ts
@@ -295,14 +297,14 @@ var revokeSelf = (token, env) => runWith(env, revokeSelfEffect(token));
 import { Resource } from "alchemy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
-import * as Effect4 from "effect/Effect";
+import * as Effect7 from "effect/Effect";
 
 // src/openbao/digest.ts
 var canonical = (text) => text.trimEnd();
 var sha256 = (text) => new Bun.CryptoHasher("sha256").update(canonical(text)).digest("hex");
 
 // src/openbao/mount-form.ts
-var mountPath = (path) => path.replace(/\/+$/, "");
+var mountPath = (path) => trimTrailingSlashes(path);
 var DURATION = /^(\d+)([smhd])$/;
 var parseDuration = (text) => {
   const trimmed = text.trim();
@@ -435,6 +437,9 @@ var sameTtl2 = (want, have) => {
 var matches2 = (attributes, props) => attributes.type === props.type && (props.description === undefined || attributes.description === props.description) && sameTtl2(props.defaultLeaseTtl, attributes.defaultLeaseTtl) && sameTtl2(props.maxLeaseTtl, attributes.maxLeaseTtl);
 var wantsTune2 = (props) => props.description !== undefined || props.defaultLeaseTtl !== undefined || props.maxLeaseTtl !== undefined;
 
+// src/openbao/auth-method-reconcile.ts
+import * as Effect6 from "effect/Effect";
+
 // src/openbao/auth-method-wire.ts
 import * as Effect3 from "effect/Effect";
 var absentFromTable = (path, asked) => baoRead("sys/auth").pipe(Effect3.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
@@ -446,24 +451,150 @@ var enableAuthMethod = (props) => baoWrite("POST", readPath2(props.path), enable
 var tuneAuthMethod = (props) => baoWrite("POST", tunePath2(props.path), tuneBody2(props));
 var disableAuthMethod = (path) => baoDelete(readPath2(path));
 
-// src/openbao/auth-method.ts
-var BaoAuthMethod = Resource("Bao.AuthMethod", {
-  defaultRemovalPolicy: "retain"
+// src/openbao/mount-move.ts
+import * as Effect5 from "effect/Effect";
+
+// src/openbao/remount-wire.ts
+import * as Effect4 from "effect/Effect";
+class RemountError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RemountError";
+  }
+}
+var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+var startRemount = (from, to) => Effect4.flatMap(baoCall("write", "POST", "sys/remount", { from, to }), (body) => {
+  const id = record(body?.["data"])?.["migration_id"];
+  return typeof id === "string" && id !== "" ? Effect4.succeed(id) : Effect4.fail(new RemountError(`sys/remount ${from} -> ${to} answered no migration_id.`));
+});
+var remountStatus = (id) => Effect4.map(baoRead(`sys/remount/status/${encodeURIComponent(id)}`), (data) => {
+  if (data === undefined)
+    return;
+  const status = record(data["migration_info"])?.["status"];
+  return typeof status === "string" ? status : "unknown";
+});
+var remountAndWait = (from, to, confirm, options = {}) => Effect4.gen(function* () {
+  const interval = options.intervalMillis ?? 1000;
+  const attempts = Math.max(1, options.attempts ?? 120);
+  const id = yield* startRemount(from, to);
+  const named = `sys/remount ${from} -> ${to} (migration ${id})`;
+  for (let attempt = 1;attempt <= attempts; attempt += 1) {
+    const status = yield* remountStatus(id);
+    if (status === "success")
+      return;
+    if (status === "failure") {
+      return yield* Effect4.fail(new RemountError(`${named} FAILED. The server log carries the reason, tagged with that migration_id. ` + "Read sys/mounts (or sys/auth) before retrying: the source may be tainted."));
+    }
+    if (status === undefined) {
+      if (yield* confirm)
+        return;
+      return yield* Effect4.fail(new RemountError(`${named}: the server no longer knows the migration (its tracker is in memory, lost ` + "on a restart or leader change), and the mount table does not show the move done."));
+    }
+    if (attempt < attempts)
+      yield* Effect4.sleep(interval);
+  }
+  return yield* Effect4.fail(new RemountError(`${named} is still in progress after ${String(attempts)} status reads. Do not re-run ` + `until sys/remount/status/${id} settles.`));
+});
+
+// src/openbao/mount-move.ts
+var planMove = (family, stated, path, remountFrom) => {
+  const to = mountPath(path);
+  const from = remountFrom === undefined ? undefined : mountPath(remountFrom);
+  if (stated === undefined) {
+    return from === undefined || from === to ? { kind: "stay" } : { kind: "move", from };
+  }
+  const was = mountPath(stated);
+  if (was === to)
+    return { kind: "stay" };
+  if (from === undefined) {
+    return {
+      kind: "refuse",
+      message: `${family}: path changed from ${was} to ${to}. That would enable an EMPTY mount at ${to} ` + `and strand everything under ${was}. To move it with its data, declare ` + `\`remountFrom: '${was}'\` (leases under it are revoked; policies are not rewritten). ` + "For a new, empty mount, give it a new resource id instead."
+    };
+  }
+  if (from !== was) {
+    return {
+      kind: "refuse",
+      message: `${family}: remountFrom is ${from}, but the mount in state is ${was}.`
+    };
+  }
+  return { kind: "move", from };
+};
+var refuse = (message) => Effect5.die(new Error(message));
+var performMove = (target, from, options) => Effect5.gen(function* () {
+  const to = mountPath(target.path);
+  const source = yield* target.read(from);
+  const landed = yield* target.read(to);
+  if (source !== undefined && landed !== undefined) {
+    return yield* refuse(`${target.family}: both ${from} and ${to} exist, so remountFrom cannot move one onto the ` + "other. Decide which holds the data, and retire the other by hand.");
+  }
+  if (source === undefined && landed === undefined) {
+    return yield* refuse(`${target.family}: remountFrom ${from} names no mount, and ${to} does not exist either. ` + "Refusing to enable an empty mount where data was expected.");
+  }
+  if (source === undefined)
+    return;
+  if (source.type !== target.type) {
+    return yield* refuse(`${target.family}: ${from} is type ${source.type}, not ${target.type}. A remount keeps the ` + "type; fix the declaration first.");
+  }
+  const confirm = Effect5.map(Effect5.all([target.read(from), target.read(to)]), ([gone, there]) => gone === undefined && there !== undefined);
+  yield* remountAndWait(target.wire(from), target.wire(to), confirm, options);
 });
-var readMethod = (props) => Effect4.gen(function* () {
+
+// src/openbao/auth-method-reconcile.ts
+var readMethod = (props) => Effect6.gen(function* () {
   const live = yield* readAuthMethodData(props.path);
   if (live === undefined)
     return;
   return attributesOf2(props, live);
 });
-var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect4.succeed(BaoAuthMethod.Provider.of({
-  list: () => Effect4.succeed([]),
-  read: Effect4.fn(function* ({ olds }) {
+var moveTarget = (props) => ({
+  family: "Bao.AuthMethod",
+  path: props.path,
+  read: (path) => readMethod({ ...props, path }),
+  type: props.type,
+  wire: (path) => `auth/${authPath(path)}`
+});
+var reconcileAuthMethod = (news, stated, options) => Effect6.gen(function* () {
+  const move = planMove("Bao.AuthMethod", stated, news.path, news.remountFrom);
+  if (move.kind === "refuse")
+    return yield* Effect6.die(new Error(move.message));
+  if (move.kind === "move")
+    yield* performMove(moveTarget(news), move.from, options);
+  let live = yield* readMethod(news);
+  if (live === undefined) {
+    yield* enableAuthMethod(news);
+    if (wantsTune2(news))
+      yield* tuneAuthMethod(news);
+  } else if (!matches2(live, news)) {
+    if (live.type !== news.type) {
+      return yield* Effect6.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Auth method type is immutable — replace manually."));
+    }
+    yield* tuneAuthMethod(news);
+  }
+  live = yield* readMethod(news);
+  if (live === undefined) {
+    return yield* Effect6.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: write returned no error but the method is still absent.`));
+  }
+  return live;
+});
+
+// src/openbao/auth-method.ts
+var BaoAuthMethod = Resource("Bao.AuthMethod", {
+  defaultRemovalPolicy: "retain"
+});
+var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect7.succeed(BaoAuthMethod.Provider.of({
+  list: () => Effect7.succeed([]),
+  read: Effect7.fn(function* ({ olds }) {
     return yield* readMethod(olds);
   }),
-  diff: Effect4.fn(function* ({ news, output }) {
+  diff: Effect7.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved(news))
       return;
+    const move = planMove("Bao.AuthMethod", output.path, news.path, news.remountFrom);
+    if (move.kind === "refuse")
+      return yield* Effect7.die(new Error(move.message));
+    if (move.kind === "move")
+      return { action: "update" };
     const live = yield* readMethod(news);
     if (live === undefined)
       return { action: "update" };
@@ -473,25 +604,10 @@ var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect4.succeed
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect4.fn(function* ({ news }) {
-    let live = yield* readMethod(news);
-    if (live === undefined) {
-      yield* enableAuthMethod(news);
-      if (wantsTune2(news))
-        yield* tuneAuthMethod(news);
-    } else if (!matches2(live, news)) {
-      if (live.type !== news.type) {
-        return yield* Effect4.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Auth method type is immutable — replace manually."));
-      }
-      yield* tuneAuthMethod(news);
-    }
-    live = yield* readMethod(news);
-    if (live === undefined) {
-      return yield* Effect4.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: write returned no error but the method is still absent.`));
-    }
-    return live;
+  reconcile: Effect7.fn(function* ({ news, output }) {
+    return yield* reconcileAuthMethod(news, output?.path);
   }),
-  delete: Effect4.fn(function* ({ output }) {
+  delete: Effect7.fn(function* ({ output }) {
     yield* disableAuthMethod(output.path);
     return;
   })
@@ -500,7 +616,7 @@ var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect4.succeed
 import { Resource as Resource2 } from "alchemy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect5 from "effect/Effect";
+import * as Effect8 from "effect/Effect";
 
 // src/openbao/auth-role-form.ts
 var policiesOf = (live) => {
@@ -549,6 +665,7 @@ var writeBody = (props) => {
   }
   return body;
 };
+var isRename = (from, to) => from.toLowerCase() !== to.toLowerCase();
 var samePolicies = (want, have) => want.length === have.length && want.every((policy, index) => policy === have[index]);
 var sameTtl3 = (want, have) => {
   const wantSeconds = parseDuration(want);
@@ -564,20 +681,22 @@ var matches3 = (attributes, props) => {
 var BaoAuthRole = Resource2("Bao.AuthRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole = (props) => Effect5.gen(function* () {
+var readRole = (props) => Effect8.gen(function* () {
   const live = yield* baoRead(readPath3(props.name));
   if (live === undefined)
     return;
   return attributesOf3(props, live);
 });
-var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect5.succeed(BaoAuthRole.Provider.of({
-  list: () => Effect5.succeed([]),
-  read: Effect5.fn(function* ({ olds }) {
+var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect8.succeed(BaoAuthRole.Provider.of({
+  list: () => Effect8.succeed([]),
+  read: Effect8.fn(function* ({ olds }) {
     return yield* readRole(olds);
   }),
-  diff: Effect5.fn(function* ({ news, output }) {
+  diff: Effect8.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved2(news))
       return;
+    if (isRename(output.name, news.name))
+      return { action: "replace" };
     const live = yield* readRole(news);
     if (live === undefined)
       return { action: "update" };
@@ -585,27 +704,107 @@ var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect5.succeed(Ba
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect5.fn(function* ({ news }) {
+  reconcile: Effect8.fn(function* ({ news }) {
     const live = yield* readRole(news);
     if (live === undefined || !matches3(live, news)) {
       yield* baoWrite("PUT", readPath3(news.name), writeBody(news));
     }
     const after = yield* readRole(news);
     if (after === undefined) {
-      return yield* Effect5.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
+      return yield* Effect8.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
     }
     return after;
   }),
-  delete: Effect5.fn(function* ({ output }) {
+  delete: Effect8.fn(function* ({ output }) {
     yield* baoDelete(readPath3(output.name));
     return;
   })
 })));
+// src/openbao/bao-identity.ts
+import * as Effect9 from "effect/Effect";
+import * as FetchHttpClient3 from "effect/unstable/http/FetchHttpClient";
+
+// src/openbao/bao-namespace.ts
+var canonicalNamespace = (namespace) => {
+  const bare = trimSlashes((namespace ?? "").trim());
+  return bare === "root" ? "" : bare;
+};
+var namespacePath = (namespace) => {
+  const bare = canonicalNamespace(namespace);
+  return bare === "" ? "" : `${bare}/`;
+};
+var envNamespace = (env) => canonicalNamespace(resolveAddress(env).namespace);
+var namespaceLabel = (namespace) => namespace === "" ? "root" : namespace;
+
+// src/openbao/bao-identity.ts
+class BaoIdentityError extends Error {
+  reason;
+  constructor(reason, detail) {
+    super(`REFUSING: ${detail}`);
+    this.reason = reason;
+    this.name = "BaoIdentityError";
+  }
+}
+var HEALTH_PATH = "sys/health?standbyok=true&sealedcode=200&uninitcode=200";
+var NAMESPACE_PROBE_PATH = "sys/internal/ui/mounts";
+var addressOf = (env) => {
+  const address = resolveAddress(env);
+  return address.socket === undefined ? address.base : `unix://${address.socket}`;
+};
+var unreachable = (address, what) => (error) => new BaoIdentityError("unreachable", `${address} did not answer ${what}: ${error.message}`);
+var text3 = (value) => typeof value === "string" ? value : "";
+var checkHealth = (address, expectedCluster, body) => {
+  if (body === undefined || typeof body["sealed"] !== "boolean") {
+    return new BaoIdentityError("unconfirmed", `${address} answered sys/health, but not as OpenBao.`);
+  }
+  if (body["initialized"] === false) {
+    return new BaoIdentityError("unconfirmed", `${address} is not initialised.`);
+  }
+  if (body["sealed"] === true) {
+    return new BaoIdentityError("unconfirmed", `${address} is sealed, and a sealed vault does not report its cluster_name.`);
+  }
+  const clusterName = text3(body["cluster_name"]);
+  if (clusterName !== expectedCluster) {
+    return new BaoIdentityError("mismatch", `${address} answers as cluster \`${clusterName || "(none)"}\`, but this stack expects ` + `\`${expectedCluster}\`. Check BAO_ADDR and BAO_AGENT_ADDR (the agent address wins).`);
+  }
+  return { clusterId: text3(body["cluster_id"]), version: text3(body["version"]) };
+};
+var assertBaoIdentityEffect = (expected) => Effect9.gen(function* () {
+  const env = yield* BaoEnv;
+  const address = addressOf(env);
+  const clusterName = expected.clusterName.trim();
+  if (clusterName === "") {
+    return yield* Effect9.fail(new BaoIdentityError("input", "clusterName is empty, so there is nothing to compare."));
+  }
+  const namespace = canonicalNamespace(expected.namespace);
+  const sent = envNamespace(env);
+  if (sent !== namespace) {
+    return yield* Effect9.fail(new BaoIdentityError("mismatch", `BAO_NAMESPACE resolves to \`${namespaceLabel(sent)}\`, but this stack expects ` + `\`${namespaceLabel(namespace)}\`.`));
+  }
+  const anonymous = { ...env, BAO_NAMESPACE: "", BAO_TOKEN: "" };
+  const body = yield* baoCall("read", "GET", HEALTH_PATH).pipe(Effect9.provideService(BaoEnv, anonymous), Effect9.mapError(unreachable(address, "sys/health")));
+  const health = checkHealth(address, clusterName, body);
+  if (health instanceof BaoIdentityError)
+    return yield* Effect9.fail(health);
+  if (namespace !== "") {
+    const scoped = { ...env, BAO_NAMESPACE: namespace, BAO_TOKEN: "" };
+    const probe = yield* baoCall("read", "GET", NAMESPACE_PROBE_PATH).pipe(Effect9.provideService(BaoEnv, scoped), Effect9.mapError(unreachable(address, `the namespace probe for \`${namespace}\``)));
+    if (probe === undefined) {
+      return yield* Effect9.fail(new BaoIdentityError("mismatch", `cluster \`${clusterName}\` at ${address} has no namespace \`${namespace}\`.`));
+    }
+  }
+  return { address, clusterName, namespace, ...health };
+});
+var assertBaoIdentity = (input) => {
+  const effect3 = assertBaoIdentityEffect(input);
+  const scoped = input.env === undefined ? effect3 : Effect9.provideService(effect3, BaoEnv, input.env);
+  return Effect9.runPromise(scoped.pipe(Effect9.provide(FetchHttpClient3.layer)));
+};
 // src/openbao/cloudflare-role.ts
 import { Resource as Resource3 } from "alchemy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 import * as Provider3 from "alchemy/Provider";
-import * as Effect8 from "effect/Effect";
+import * as Effect13 from "effect/Effect";
 
 // src/openbao/cloudflare-group-scope.ts
 var zoneResource = (zoneId) => `com.cloudflare.api.account.zone.${zoneId}`;
@@ -625,7 +824,7 @@ var groupKey = (name, scope) => `${scope} ${name}`;
 
 // src/openbao/cloudflare-permission-groups.ts
 import * as Context2 from "effect/Context";
-import * as Effect7 from "effect/Effect";
+import * as Effect11 from "effect/Effect";
 
 // src/openbao/cloudflare-permission-groups-solve.ts
 var observationsOf = (declared, live) => declared.flatMap((role) => {
@@ -795,7 +994,7 @@ var samePolicies2 = (want, have) => want.length === have.length && want.every((w
 });
 
 // src/openbao/cloudflare-role-wire.ts
-import * as Effect6 from "effect/Effect";
+import * as Effect10 from "effect/Effect";
 
 // src/openbao/cloudflare-role-form.ts
 var rolePath = (mount, name) => `${mountPath(mount)}/roles/${name}`;
@@ -860,7 +1059,7 @@ var differences = (props, policies, live) => {
 };
 
 // src/openbao/cloudflare-role-wire.ts
-var readCloudflareRole = (mount, name) => Effect6.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
+var readCloudflareRole = (mount, name) => Effect10.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
 var writeCloudflareRole = (mount, name, body) => baoWrite("PUT", rolePath(mount, name), body);
 var deleteCloudflareRole = (mount, name) => baoDelete(rolePath(mount, name));
 
@@ -882,9 +1081,9 @@ var pick = (mount, groups, refs, hint) => {
   const unknown = refs.filter((ref) => !groups.has(groupKey(ref.name, ref.scope)));
   if (unknown.length > 0) {
     const problems = unknown.map((ref) => `unknown group ${JSON.stringify(ref.name)} at scope ${ref.scope} — ${hint}`);
-    return Effect7.fail(new CloudflareGroupsError(mount, problems));
+    return Effect11.fail(new CloudflareGroupsError(mount, problems));
   }
-  return Effect7.succeed(new Map(refs.flatMap((ref) => {
+  return Effect11.succeed(new Map(refs.flatMap((ref) => {
     const key = groupKey(ref.name, ref.scope);
     const id = groups.get(key);
     return id === undefined ? [] : [[key, id]];
@@ -892,15 +1091,15 @@ var pick = (mount, groups, refs, hint) => {
 };
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var deniedHint = (mount) => `GET ${mountPath(mount)}/permission-groups answered 403 — this token's policy carries no ` + `\`path "${mountPath(mount)}/permission-groups" { capabilities = ["read"] }\` grant. ` + "It is declared in ../platform/secrets/vault/policies/homeflare-admin/" + "20-cloudflare-permission-groups.hcl and applies with `alchemy deploy` of this stack";
-var deniedNamed = (mount, read) => Effect7.catchIf(read, (error) => error.status === 403, () => Effect7.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
-var engineGroups = (mount) => Effect7.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
+var deniedNamed = (mount, read) => Effect11.catchIf(read, (error) => error.status === 403, () => Effect11.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
+var engineGroups = (mount) => Effect11.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
   const list = data?.["permission_groups"];
   if (data === undefined) {
     const why = "GET <mount>/permission-groups answered 404 — the endpoint is not deployed here";
-    return Effect7.fail(new CloudflareGroupsError(mount, [why]));
+    return Effect11.fail(new CloudflareGroupsError(mount, [why]));
   }
   if (!Array.isArray(list)) {
-    return Effect7.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
+    return Effect11.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
   }
   const scoped = new Map;
   const idsOf = new Map;
@@ -927,24 +1126,24 @@ var engineGroups = (mount) => Effect7.flatMap(deniedNamed(mount, baoRead(`${moun
     const only = [...ids];
     return ids.size === 1 && only[0] !== undefined ? [[name, only[0]]] : [];
   }));
-  return problems.length > 0 ? Effect7.fail(new CloudflareGroupsError(mount, problems)) : Effect7.succeed(new Map([...atEveryScope(sole), ...scoped]));
+  return problems.length > 0 ? Effect11.fail(new CloudflareGroupsError(mount, problems)) : Effect11.succeed(new Map([...atEveryScope(sole), ...scoped]));
 });
-var permissionGroupsFromEngine = () => Effect7.sync(() => {
+var permissionGroupsFromEngine = () => Effect11.sync(() => {
   const cache = new Map;
-  const cachedFor = (mount) => Effect7.suspend(() => {
+  const cachedFor = (mount) => Effect11.suspend(() => {
     const hit = cache.get(mountPath(mount));
     if (hit !== undefined)
       return hit;
-    return Effect7.flatMap(Effect7.cached(engineGroups(mount)), (lookup) => {
+    return Effect11.flatMap(Effect11.cached(engineGroups(mount)), (lookup) => {
       cache.set(mountPath(mount), lookup);
       return lookup;
     });
   });
   return CloudflarePermissionGroups.of({
-    resolve: (mount, refs) => Effect7.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
+    resolve: (mount, refs) => Effect11.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
   });
 });
-var permissionGroupsFromLiveRoles = (declared) => Effect7.gen(function* () {
+var permissionGroupsFromLiveRoles = (declared) => Effect11.gen(function* () {
   const accountOf = new Map;
   const byAccount = new Map;
   for (const [mount, roles] of declared) {
@@ -955,9 +1154,9 @@ var permissionGroupsFromLiveRoles = (declared) => Effect7.gen(function* () {
   }
   const solved = new Map;
   for (const [account, roles] of byAccount) {
-    const solve = Effect7.gen(function* () {
+    const solve = Effect11.gen(function* () {
       const live = new Map;
-      yield* Effect7.all(roles.map((role) => Effect7.map(readCloudflareRole(role.mount, role.name), (read) => {
+      yield* Effect11.all(roles.map((role) => Effect11.map(readCloudflareRole(role.mount, role.name), (read) => {
         if (read?.policies !== undefined) {
           live.set(`${role.mount}/${role.name}`, read.policies);
         }
@@ -965,11 +1164,11 @@ var permissionGroupsFromLiveRoles = (declared) => Effect7.gen(function* () {
       const result = solveGroups(observationsOf(roles, live));
       const problems = describeProblems(result);
       if (problems.length > 0) {
-        return yield* Effect7.fail(new CloudflareGroupsError(`account ${account}`, problems));
+        return yield* Effect11.fail(new CloudflareGroupsError(`account ${account}`, problems));
       }
       return atEveryScope(result.groups);
     });
-    solved.set(account, yield* Effect7.cached(solve));
+    solved.set(account, yield* Effect11.cached(solve));
   }
   return CloudflarePermissionGroups.of({
     resolve: (mount, refs) => {
@@ -977,21 +1176,54 @@ var permissionGroupsFromLiveRoles = (declared) => Effect7.gen(function* () {
       const lookup = account === undefined ? undefined : solved.get(account);
       if (account === undefined || lookup === undefined) {
         const why = "no declared role on this mount, so no live role can vouch for its groups";
-        return Effect7.fail(new CloudflareGroupsError(mount, [why]));
+        return Effect11.fail(new CloudflareGroupsError(mount, [why]));
       }
       const hint = `no live role on account ${account} carries it; a NEW group needs the engine endpoint`;
-      return Effect7.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
+      return Effect11.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
     }
   });
 });
 
+// src/openbao/rename.ts
+import * as Effect12 from "effect/Effect";
+var exact = (identity) => identity;
+var declaredString = (news, key) => {
+  if (typeof news !== "object" || news === null)
+    return;
+  const value = news[key];
+  return typeof value === "string" ? value : undefined;
+};
+var isPendingProp = (news, key) => {
+  if (typeof news !== "object" || news === null)
+    return false;
+  const value = news[key];
+  return value !== undefined && typeof value !== "string";
+};
+var declaredRolePath = (news, rolePath2) => {
+  const mount = declaredString(news, "mount");
+  const name = declaredString(news, "name");
+  return mount === undefined || name === undefined ? undefined : rolePath2(mount, name);
+};
+var policyKey = (name) => name.trim().toLowerCase();
+var isMoved = (stored, declared, key = exact) => declared === undefined ? undefined : key(stored) !== key(declared);
+var triedRolePath = (output, olds, rolePath2) => output === undefined ? declaredRolePath(olds, rolePath2) : rolePath2(output.mount, output.name);
+var judgeMove = (family, tried, declared, pathOf, key = exact) => Effect12.gen(function* () {
+  if (tried === undefined || declared === undefined || key(tried) === key(declared)) {
+    return;
+  }
+  if ((yield* baoRead(pathOf(declared))) === undefined)
+    return { from: tried, to: declared };
+  return yield* Effect12.die(new Error(`${family}: ${tried} → ${declared} would land on an object that already exists at ` + `${declared}. Under RemovalPolicy.destroy() a resource moving off that name (a swap, a ` + "shift, or a reverted move that did not finish) deletes it after this one writes it. " + "Nothing was written. Move through a name nothing holds, in two deploys, or remove " + `${declared} by hand first.`));
+});
+var refuseMovedUpdate = (family, from, to) => Effect12.die(new Error(`${family}: planned as an update, but its identity moved from ${from} to ${to}. Writing ` + `${to} now would leave ${from} live with no state record. Nothing was written. Run the ` + "deploy again: once the value resolves at plan time it plans as a replace."));
+
 // src/openbao/cloudflare-role.ts
 var BaoCloudflareRole = Resource3("Bao.CloudflareRole", {
   defaultRemovalPolicy: "retain"
 });
-var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect8.gen(function* () {
+var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect13.gen(function* () {
   const groups = yield* CloudflarePermissionGroups;
-  const resolved = (props) => Effect8.gen(function* () {
+  const resolved = (props) => Effect13.gen(function* () {
     const refs = new Map;
     for (const policy of props.policies) {
       const scope = policy.scope ?? scopeOfResource(policy.resource);
@@ -1001,18 +1233,25 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
     const ids = yield* groups.resolve(props.mount, [...refs.values()]);
     const { missing, policies } = resolvePolicies(props.policies, ids);
     if (missing.length > 0) {
-      return yield* Effect8.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
+      return yield* Effect13.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
     }
     return policies;
   });
   return BaoCloudflareRole.Provider.of({
-    list: () => Effect8.succeed([]),
-    read: Effect8.fn(function* ({ olds }) {
+    list: () => Effect13.succeed([]),
+    read: Effect13.fn(function* ({ olds }) {
       const live = yield* readCloudflareRole(olds.mount, olds.name);
       return live === undefined ? undefined : attributesOf4(olds, live);
     }),
-    diff: Effect8.fn(function* ({ news, output }) {
-      if (output === undefined || !isResolved3(news))
+    diff: Effect13.fn(function* ({ news, olds, output }) {
+      const tried = triedRolePath(output, olds, rolePath);
+      const declared = declaredRolePath(news, rolePath);
+      const move = yield* judgeMove("Bao.CloudflareRole", tried, declared, (path) => path);
+      if (output === undefined)
+        return;
+      if (move !== undefined)
+        return { action: "replace" };
+      if (!isResolved3(news))
         return;
       if (refusalOf(news) !== undefined)
         return { action: "update" };
@@ -1022,11 +1261,15 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
         return { action: "update" };
       return differences(news, policies, live).length === 0 ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect8.fn(function* ({ news }) {
+    reconcile: Effect13.fn(function* ({ news, output }) {
       const path = rolePath(news.mount, news.name);
+      const before = output === undefined ? path : rolePath(output.mount, output.name);
+      if (isMoved(before, path) === true) {
+        return yield* refuseMovedUpdate("Bao.CloudflareRole", before, path);
+      }
       const refusal2 = refusalOf(news);
       if (refusal2 !== undefined) {
-        return yield* Effect8.die(new Error(`Bao.CloudflareRole ${path}: ${refusal2}.`));
+        return yield* Effect13.die(new Error(`Bao.CloudflareRole ${path}: ${refusal2}.`));
       }
       const policies = yield* resolved(news);
       const live = yield* readCloudflareRole(news.mount, news.name);
@@ -1035,22 +1278,22 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
       }
       const after = yield* readCloudflareRole(news.mount, news.name);
       if (after === undefined) {
-        return yield* Effect8.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
+        return yield* Effect13.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
       }
       const left = differences(news, policies, after);
       if (left.length > 0) {
-        return yield* Effect8.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
+        return yield* Effect13.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
       }
       return attributesOf4(news, after);
     }),
-    delete: Effect8.fn(function* ({ output }) {
+    delete: Effect13.fn(function* ({ output }) {
       yield* deleteCloudflareRole(output.mount, output.name);
       return;
     })
   });
 }));
 // src/openbao/cloudflare-roles-expand.ts
-var slug = (name) => name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+var slug = (name) => trimRuns(name.toLowerCase().replace(/[^a-z0-9]+/g, "-"), "-");
 var zoneSlug = (zone) => `${slug(zone.name)}${zone.internal ? "-internal" : ""}`;
 var mountName = (account, surface) => `cloudflare-${account}-${surface}`;
 var policiesFor = (tpl, accountId, zone, accountGroups) => {
@@ -1145,12 +1388,12 @@ class RolesConfigError extends Error {
   }
 }
 var isRaw = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var record = (value, where) => {
+var record2 = (value, where) => {
   if (!isRaw(value))
     throw new RolesConfigError(where, "expected a mapping");
   return value;
 };
-var text3 = (raw, key, where) => {
+var text4 = (raw, key, where) => {
   const value = raw[key];
   if (typeof value === "string")
     return value;
@@ -1174,35 +1417,35 @@ var entries = (raw, key, where) => {
   return value;
 };
 var template = (value, where) => {
-  const raw = record(value, where);
+  const raw = record2(value, where);
   const groups = texts(raw, "groups", where);
   if (groups === undefined)
     throw new RolesConfigError(`${where}.groups`, "is required");
-  const bucket = raw["bucket"] === undefined ? undefined : text3(raw, "bucket", where);
+  const bucket = raw["bucket"] === undefined ? undefined : text4(raw, "bucket", where);
   if (bucket !== undefined && bucket.length === 0) {
     throw new RolesConfigError(`${where}.bucket`, "is empty; omit it to stay account-wide");
   }
-  const groupsScope = raw["groups_scope"] === undefined ? undefined : groupScopeNamed(text3(raw, "groups_scope", where));
+  const groupsScope = raw["groups_scope"] === undefined ? undefined : groupScopeNamed(text4(raw, "groups_scope", where));
   if (raw["groups_scope"] !== undefined && groupsScope === undefined) {
     throw new RolesConfigError(`${where}.groups_scope`, `expected one of ${Object.keys(GROUP_SCOPES).join(", ")}`);
   }
   return {
     accountGroups: texts(raw, "account_groups", where) ?? [],
     bucket,
-    bucketJurisdiction: raw["bucket_jurisdiction"] === undefined ? "default" : text3(raw, "bucket_jurisdiction", where),
-    desc: raw["desc"] === undefined ? "" : text3(raw, "desc", where),
+    bucketJurisdiction: raw["bucket_jurisdiction"] === undefined ? "default" : text4(raw, "bucket_jurisdiction", where),
+    desc: raw["desc"] === undefined ? "" : text4(raw, "desc", where),
     groups,
     groupsScope,
-    maxTtl: text3(raw, "max_ttl", where),
-    name: text3(raw, "name", where),
-    ttl: text3(raw, "ttl", where),
+    maxTtl: text4(raw, "max_ttl", where),
+    name: text4(raw, "name", where),
+    ttl: text4(raw, "ttl", where),
     zoneTypes: texts(raw, "zone_types", where) ?? [],
     zones: texts(raw, "zones", where)
   };
 };
 var surface = (name, value) => {
   const where = `surfaces.${name}`;
-  const raw = record(value, where);
+  const raw = record2(value, where);
   return {
     accountRoles: entries(raw, "account_roles", where).map((item, i) => template(item, `${where}.account_roles[${String(i)}]`)),
     zoneRoles: entries(raw, "zone_roles", where).map((item, i) => template(item, `${where}.zone_roles[${String(i)}]`))
@@ -1210,7 +1453,7 @@ var surface = (name, value) => {
 };
 var account = (key, value, surfaces) => {
   const where = `accounts.${key}`;
-  const raw = record(value, where);
+  const raw = record2(value, where);
   const names = texts(raw, "surfaces", where) ?? [];
   for (const name of names) {
     if (surfaces[name] === undefined) {
@@ -1218,56 +1461,941 @@ var account = (key, value, surfaces) => {
     }
   }
   const zones = raw["zones"] === undefined || raw["zones"] === "all" ? "all" : texts(raw, "zones", where);
-  return { id: text3(raw, "id", where), key, surfaces: names, zones: zones ?? "all" };
+  return { id: text4(raw, "id", where), key, surfaces: names, zones: zones ?? "all" };
 };
 var parseRolesConfig = (yaml) => {
-  const root = record(Bun.YAML.parse(yaml), "(document)");
+  const root = record2(Bun.YAML.parse(yaml), "(document)");
   const surfaces = {};
-  for (const [name, spec] of Object.entries(record(root["surfaces"], "surfaces"))) {
+  for (const [name, spec] of Object.entries(record2(root["surfaces"], "surfaces"))) {
     surfaces[name] = surface(name, spec);
   }
-  const accounts = Object.entries(record(root["accounts"], "accounts")).map(([key, value]) => account(key, value, surfaces));
+  const accounts = Object.entries(record2(root["accounts"], "accounts")).map(([key, value]) => account(key, value, surfaces));
   return {
     accounts,
-    namespace: text3(record(root["defaults"], "defaults"), "namespace", "defaults"),
+    namespace: text4(record2(root["defaults"], "defaults"), "namespace", "defaults"),
     surfaces
   };
 };
-// src/openbao/mount.ts
+// src/openbao/host-approles.ts
+var NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var HOST_ROLE_SEPARATOR = "--";
+var hostRoleName = (className, host) => `${className}${HOST_ROLE_SEPARATOR}${host}`;
+var classProblems = (name, spec) => {
+  const found = [];
+  if (!NAME.test(name))
+    found.push(`class \`${name}\` is not lowercase letters, digits, single hyphens`);
+  if (spec.policies.length === 0)
+    found.push(`class \`${name}\` has no policies`);
+  if (spec.policies.includes("root"))
+    found.push(`class \`${name}\` grants \`root\``);
+  const secretId = parseDuration(spec.secretIdTtl);
+  if (secretId === undefined || secretId <= 0) {
+    found.push(`class \`${name}\` secretIdTtl \`${spec.secretIdTtl}\` must be a duration above zero ` + "(0 never expires)");
+  }
+  const ttl = parseDuration(spec.tokenTtl);
+  const max = parseDuration(spec.tokenMaxTtl);
+  if (ttl === undefined || max === undefined) {
+    found.push(`class \`${name}\` token TTLs must be durations like 15m or 1h`);
+  } else if (max > 0 && ttl > max) {
+    found.push(`class \`${name}\` tokenTtl is longer than tokenMaxTtl`);
+  }
+  return found;
+};
+var hostAppRoles = (input) => {
+  const problems = Object.entries(input.classes).flatMap(([name, spec]) => classProblems(name, spec));
+  const seen = new Set;
+  const roles = [];
+  for (const host of input.hosts) {
+    if (!NAME.test(host.name)) {
+      problems.push(`host \`${host.name}\` is not lowercase letters, digits, single hyphens`);
+    }
+    if (seen.has(host.name))
+      problems.push(`host \`${host.name}\` is listed twice`);
+    seen.add(host.name);
+    const spec = input.classes[host.class];
+    if (spec === undefined) {
+      problems.push(`host \`${host.name}\` names unknown class \`${host.class}\``);
+      continue;
+    }
+    roles.push({
+      bindSecretId: true,
+      name: hostRoleName(host.class, host.name),
+      secretIdNumUses: spec.secretIdNumUses ?? 0,
+      secretIdTtl: spec.secretIdTtl,
+      tokenMaxTtl: spec.tokenMaxTtl,
+      tokenPolicies: [...new Set(spec.policies)].sort(),
+      tokenTtl: spec.tokenTtl
+    });
+  }
+  if (problems.length > 0) {
+    throw new Error(`hostAppRoles refused the input: ${problems.join("; ")}.`);
+  }
+  return roles.sort((a, b) => a.name.localeCompare(b.name));
+};
+// src/openbao/jwt-config.ts
 import { Resource as Resource4 } from "alchemy";
 import { isResolved as isResolved4 } from "alchemy/Diff";
 import * as Provider4 from "alchemy/Provider";
-import * as Effect10 from "effect/Effect";
+import * as Effect15 from "effect/Effect";
+
+// src/openbao/jwt-config-form.ts
+var text5 = (value) => typeof value === "string" ? value.trim() : "";
+var strings2 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var sortedSet = (values) => [...new Set(values.map((value) => value.trim()))].sort();
+var canonical2 = (input) => ({
+  boundIssuer: input.boundIssuer.trim(),
+  defaultRole: input.defaultRole.trim(),
+  jwksCaPem: input.jwksCaPem.trim(),
+  jwksUrl: input.jwksUrl.trim(),
+  jwtSupportedAlgs: sortedSet(input.jwtSupportedAlgs),
+  jwtValidationPubkeys: sortedSet(input.jwtValidationPubkeys),
+  oidcDiscoveryCaPem: input.oidcDiscoveryCaPem.trim(),
+  oidcDiscoveryUrl: input.oidcDiscoveryUrl.trim()
+});
+var canonicalFromProps = (props) => canonical2({
+  boundIssuer: props.boundIssuer ?? "",
+  defaultRole: props.defaultRole ?? "",
+  jwksCaPem: props.jwksCaPem ?? "",
+  jwksUrl: props.jwksUrl ?? "",
+  jwtSupportedAlgs: props.jwtSupportedAlgs ?? [],
+  jwtValidationPubkeys: props.jwtValidationPubkeys ?? [],
+  oidcDiscoveryCaPem: props.oidcDiscoveryCaPem ?? "",
+  oidcDiscoveryUrl: props.oidcDiscoveryUrl ?? ""
+});
+var canonicalFromLive = (live) => canonical2({
+  boundIssuer: text5(live["bound_issuer"]),
+  defaultRole: text5(live["default_role"]),
+  jwksCaPem: text5(live["jwks_ca_pem"]),
+  jwksUrl: text5(live["jwks_url"]),
+  jwtSupportedAlgs: strings2(live["jwt_supported_algs"]),
+  jwtValidationPubkeys: strings2(live["jwt_validation_pubkeys"]),
+  oidcDiscoveryCaPem: text5(live["oidc_discovery_ca_pem"]),
+  oidcDiscoveryUrl: text5(live["oidc_discovery_url"])
+});
+var mountOf = (props) => mountPath(props.mount ?? "jwt");
+var configPath = (props) => `auth/${mountOf(props)}/config`;
+var attributesOf5 = (props, live) => {
+  const form = canonicalFromLive(live);
+  return { ...form, digest: sha256(JSON.stringify(form)), mount: mountOf(props) };
+};
+var matches4 = (attributes, props) => attributes.digest === sha256(JSON.stringify(canonicalFromProps(props)));
+var writeBody3 = (props) => ({
+  bound_issuer: props.boundIssuer ?? "",
+  default_role: props.defaultRole ?? "",
+  jwks_ca_pem: props.jwksCaPem ?? "",
+  jwks_url: props.jwksUrl ?? "",
+  jwt_supported_algs: [...props.jwtSupportedAlgs ?? []],
+  jwt_validation_pubkeys: [...props.jwtValidationPubkeys ?? []],
+  oidc_discovery_ca_pem: props.oidcDiscoveryCaPem ?? "",
+  oidc_discovery_url: props.oidcDiscoveryUrl ?? ""
+});
+var wouldErase = (live) => {
+  const lost = [];
+  if (text5(live["oidc_client_id"]) !== "")
+    lost.push("oidc_client_id (and its unreadable secret)");
+  const provider = live["provider_config"];
+  if (typeof provider === "object" && provider !== null && Object.keys(provider).length > 0) {
+    lost.push("provider_config");
+  }
+  if (text5(live["oidc_response_mode"]) !== "")
+    lost.push("oidc_response_mode");
+  if (strings2(live["oidc_response_types"]).length > 0)
+    lost.push("oidc_response_types");
+  if (strings2(live["override_allowed_server_names"]).length > 0) {
+    lost.push("override_allowed_server_names");
+  }
+  return lost;
+};
+var problems = (props) => {
+  const found = [];
+  const sources = [
+    (props.oidcDiscoveryUrl ?? "") !== "",
+    (props.jwksUrl ?? "") !== "",
+    (props.jwtValidationPubkeys?.length ?? 0) > 0
+  ].filter(Boolean).length;
+  if (sources !== 1) {
+    found.push("exactly one of oidcDiscoveryUrl, jwksUrl or jwtValidationPubkeys must be set");
+  }
+  if ((props.oidcDiscoveryUrl ?? "").includes(".well-known")) {
+    found.push("oidcDiscoveryUrl must be the issuer, without /.well-known/openid-configuration");
+  }
+  const role = props.defaultRole ?? "";
+  if (role !== role.toLowerCase())
+    found.push(`defaultRole \`${role}\` must be lower case`);
+  return found;
+};
+
+// src/openbao/role-reconcile.ts
+import * as Effect14 from "effect/Effect";
+var readRoleAt = (spec) => Effect14.map(baoRead(spec.path), (live) => live === undefined ? undefined : { attributes: spec.attributesOf(live), live });
+var planRole = (spec) => Effect14.gen(function* () {
+  if (spec.problems.length > 0)
+    return "update";
+  const found = yield* readRoleAt(spec);
+  return found !== undefined && spec.matches(found.attributes) ? "noop" : "update";
+});
+var refuse2 = (spec, message) => Effect14.die(new Error(`${spec.family} ${spec.path}: ${message}`));
+var reconcileRole = (spec) => Effect14.gen(function* () {
+  if (spec.problems.length > 0)
+    return yield* refuse2(spec, spec.problems.join("; "));
+  const found = yield* readRoleAt(spec);
+  if (found === undefined || !spec.matches(found.attributes)) {
+    const lost = found === undefined ? [] : spec.wouldErase?.(found.live) ?? [];
+    if (lost.length > 0) {
+      return yield* refuse2(spec, `live carries ${lost.join(", ")}, which this resource does not declare and the write ` + "would reset. Fold it into the declaration, or clear it by hand first.");
+    }
+    yield* baoWrite("PUT", spec.path, spec.body);
+  }
+  const after = yield* readRoleAt(spec);
+  if (after === undefined)
+    return yield* refuse2(spec, "write reported success but it is absent.");
+  if (!spec.matches(after.attributes)) {
+    return yield* refuse2(spec, "wrote cleanly but read back different — OpenBao stored something other than what was " + "declared. Read it by hand before retrying.");
+  }
+  return after.attributes;
+});
+
+// src/openbao/jwt-config.ts
+var BaoJwtAuthConfig = Resource4("Bao.JwtAuthConfig", {
+  defaultRemovalPolicy: "retain"
+});
+var jwtConfigSpec = (props) => ({
+  attributesOf: (live) => attributesOf5(props, live),
+  body: writeBody3(props),
+  family: "Bao.JwtAuthConfig",
+  matches: (attributes) => matches4(attributes, props),
+  path: configPath(props),
+  problems: problems(props),
+  wouldErase
+});
+var BaoJwtAuthConfigProvider = () => Provider4.effect(BaoJwtAuthConfig, Effect15.succeed(BaoJwtAuthConfig.Provider.of({
+  list: () => Effect15.succeed([]),
+  read: Effect15.fn(function* ({ olds }) {
+    const found = yield* readRoleAt(jwtConfigSpec(olds));
+    return found?.attributes;
+  }),
+  diff: Effect15.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved4(news))
+      return;
+    if (mountOf(news) !== output.mount)
+      return { action: "replace" };
+    return { action: yield* planRole(jwtConfigSpec(news)) };
+  }),
+  reconcile: Effect15.fn(function* ({ news }) {
+    return yield* reconcileRole(jwtConfigSpec(news));
+  }),
+  delete: () => Effect15.void
+})));
+// src/openbao/jwt-role.ts
+import { Resource as Resource5 } from "alchemy";
+import { isResolved as isResolved5 } from "alchemy/Diff";
+import * as Provider5 from "alchemy/Provider";
+import * as Effect16 from "effect/Effect";
+
+// src/openbao/auth-token-form.ts
+var sortedSet2 = (values) => [...new Set(values)].sort();
+var cidr = (value) => value.trim().replace(/\/(32|128)$/, "");
+var strings3 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var seconds2 = (text6) => parseDuration(text6 ?? "0") ?? -1;
+var tokenFields = (input) => ({
+  tokenBoundCidrs: input.tokenBoundCidrs,
+  tokenExplicitMaxTtlSeconds: input.tokenExplicitMaxTtlSeconds,
+  tokenMaxTtlSeconds: input.tokenMaxTtlSeconds,
+  tokenNoDefaultPolicy: input.tokenNoDefaultPolicy,
+  tokenNumUses: input.tokenNumUses,
+  tokenPeriodSeconds: input.tokenPeriodSeconds,
+  tokenPolicies: input.tokenPolicies,
+  tokenTtlSeconds: input.tokenTtlSeconds,
+  tokenType: input.tokenType
+});
+var tokenForm = (input) => ({
+  tokenBoundCidrs: sortedSet2(input.tokenBoundCidrs.map(cidr)),
+  tokenExplicitMaxTtlSeconds: input.tokenExplicitMaxTtlSeconds,
+  tokenMaxTtlSeconds: input.tokenMaxTtlSeconds,
+  tokenNoDefaultPolicy: input.tokenNoDefaultPolicy,
+  tokenNumUses: input.tokenNumUses,
+  tokenPeriodSeconds: input.tokenPeriodSeconds,
+  tokenPolicies: sortedSet2(input.tokenPolicies),
+  tokenTtlSeconds: input.tokenTtlSeconds,
+  tokenType: input.tokenType
+});
+var tokenFormOfProps = (props) => tokenForm({
+  tokenBoundCidrs: props.tokenBoundCidrs ?? [],
+  tokenExplicitMaxTtlSeconds: seconds2(props.tokenExplicitMaxTtl),
+  tokenMaxTtlSeconds: seconds2(props.tokenMaxTtl),
+  tokenNoDefaultPolicy: props.tokenNoDefaultPolicy ?? false,
+  tokenNumUses: props.tokenNumUses ?? 0,
+  tokenPeriodSeconds: seconds2(props.tokenPeriod),
+  tokenPolicies: props.tokenPolicies,
+  tokenTtlSeconds: seconds2(props.tokenTtl),
+  tokenType: props.tokenType ?? "default"
+});
+var tokenFormOfLive = (live) => tokenForm({
+  tokenBoundCidrs: strings3(live["token_bound_cidrs"]),
+  tokenExplicitMaxTtlSeconds: ttlSeconds(live["token_explicit_max_ttl"]) ?? -1,
+  tokenMaxTtlSeconds: ttlSeconds(live["token_max_ttl"]) ?? -1,
+  tokenNoDefaultPolicy: live["token_no_default_policy"] === true,
+  tokenNumUses: typeof live["token_num_uses"] === "number" ? live["token_num_uses"] : -1,
+  tokenPeriodSeconds: ttlSeconds(live["token_period"]) ?? -1,
+  tokenPolicies: strings3(live["token_policies"]),
+  tokenTtlSeconds: ttlSeconds(live["token_ttl"]) ?? -1,
+  tokenType: typeof live["token_type"] === "string" ? live["token_type"] : ""
+});
+var tokenBody = (props) => ({
+  token_bound_cidrs: [...props.tokenBoundCidrs ?? []],
+  token_explicit_max_ttl: props.tokenExplicitMaxTtl ?? "0",
+  token_max_ttl: props.tokenMaxTtl ?? "0",
+  token_no_default_policy: props.tokenNoDefaultPolicy ?? false,
+  token_num_uses: props.tokenNumUses ?? 0,
+  token_period: props.tokenPeriod ?? "0",
+  token_policies: [...props.tokenPolicies],
+  token_ttl: props.tokenTtl ?? "0",
+  token_type: props.tokenType ?? "default"
+});
+var tokenProblems = (props) => {
+  const found = [];
+  const durations = {
+    tokenExplicitMaxTtl: props.tokenExplicitMaxTtl,
+    tokenMaxTtl: props.tokenMaxTtl,
+    tokenPeriod: props.tokenPeriod,
+    tokenTtl: props.tokenTtl
+  };
+  for (const [field, text6] of Object.entries(durations)) {
+    if (seconds2(text6) < 0)
+      found.push(`${field}=${text6 ?? ""} is not a duration (0 or <n>s|m|h|d)`);
+  }
+  const ttl = seconds2(props.tokenTtl);
+  const max = seconds2(props.tokenMaxTtl);
+  if (ttl > 0 && max > 0 && ttl > max)
+    found.push("tokenTtl is longer than tokenMaxTtl");
+  if (props.tokenType === "batch" && (seconds2(props.tokenPeriod) > 0 || (props.tokenNumUses ?? 0) > 0)) {
+    found.push("a batch token cannot be periodic or use-limited (tokenutil.go:234-241)");
+  }
+  return found;
+};
+
+// src/openbao/jwt-role-form.ts
+var sortedSet3 = (values) => [...new Set(values)].sort();
+var text6 = (value) => typeof value === "string" ? value : "";
+var strings4 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var record3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+var claimsOf = (value) => {
+  const source = record3(value);
+  const out = {};
+  for (const key of Object.keys(source).sort()) {
+    const raw = source[key];
+    out[key] = sortedSet3(typeof raw === "string" ? [raw] : strings4(raw));
+  }
+  return out;
+};
+var mappingsOf = (value) => {
+  const source = record3(value);
+  const out = {};
+  for (const key of Object.keys(source).sort())
+    out[key] = text6(source[key]);
+  return out;
+};
+var canonical3 = (input) => ({
+  allowedRedirectUris: sortedSet3(input.allowedRedirectUris),
+  boundAudiences: sortedSet3(input.boundAudiences),
+  boundClaims: claimsOf(input.boundClaims),
+  boundClaimsType: input.boundClaimsType,
+  boundSubject: input.boundSubject,
+  callbackMode: input.callbackMode,
+  claimMappings: mappingsOf(input.claimMappings),
+  groupsClaim: input.groupsClaim,
+  oidcDisableConfirmation: input.oidcDisableConfirmation,
+  oidcScopes: sortedSet3(input.oidcScopes),
+  roleType: input.roleType,
+  userClaim: input.userClaim,
+  verboseOidcLogging: input.verboseOidcLogging,
+  ...tokenFields(input)
+});
+var canonicalFromProps2 = (props) => canonical3({
+  ...tokenFormOfProps(props),
+  allowedRedirectUris: props.allowedRedirectUris ?? [],
+  boundAudiences: props.boundAudiences ?? [],
+  boundClaims: claimsOf(props.boundClaims ?? {}),
+  boundClaimsType: props.boundClaimsType ?? "string",
+  boundSubject: props.boundSubject ?? "",
+  callbackMode: props.callbackMode ?? "client",
+  claimMappings: props.claimMappings ?? {},
+  groupsClaim: props.groupsClaim ?? "",
+  oidcDisableConfirmation: false,
+  oidcScopes: props.oidcScopes ?? [],
+  roleType: props.roleType,
+  userClaim: props.userClaim,
+  verboseOidcLogging: false
+});
+var canonicalFromLive2 = (live) => canonical3({
+  ...tokenFormOfLive(live),
+  allowedRedirectUris: strings4(live["allowed_redirect_uris"]),
+  boundAudiences: strings4(live["bound_audiences"]),
+  boundClaims: claimsOf(live["bound_claims"]),
+  boundClaimsType: text6(live["bound_claims_type"]),
+  boundSubject: text6(live["bound_subject"]),
+  callbackMode: text6(live["callback_mode"]),
+  claimMappings: mappingsOf(live["claim_mappings"]),
+  groupsClaim: text6(live["groups_claim"]),
+  oidcDisableConfirmation: live["oidc_disable_confirmation"] === true,
+  oidcScopes: strings4(live["oidc_scopes"]),
+  roleType: text6(live["role_type"]),
+  userClaim: text6(live["user_claim"]),
+  verboseOidcLogging: live["verbose_oidc_logging"] === true
+});
+var mountOf2 = (props) => mountPath(props.mount ?? "jwt");
+var rolePath2 = (props) => `auth/${mountOf2(props)}/role/${props.name}`;
+var attributesOf6 = (props, live) => {
+  const form = canonicalFromLive2(live);
+  return { ...form, digest: sha256(JSON.stringify(form)), mount: mountOf2(props), name: props.name };
+};
+var matches5 = (attributes, props) => attributes.digest === sha256(JSON.stringify(canonicalFromProps2(props)));
+var writeBody4 = (props) => ({
+  allowed_redirect_uris: [...props.allowedRedirectUris ?? []],
+  bound_audiences: [...props.boundAudiences ?? []],
+  bound_claims: { ...props.boundClaims },
+  bound_claims_type: props.boundClaimsType ?? "string",
+  bound_subject: props.boundSubject ?? "",
+  callback_mode: props.callbackMode ?? "client",
+  claim_mappings: { ...props.claimMappings },
+  groups_claim: props.groupsClaim ?? "",
+  oidc_disable_confirmation: false,
+  oidc_scopes: [...props.oidcScopes ?? []],
+  role_type: props.roleType,
+  user_claim: props.userClaim,
+  verbose_oidc_logging: false,
+  ...tokenBody(props)
+});
+var NAME2 = /^[a-z0-9_](?:[a-z0-9_.-]*[a-z0-9_])?$/;
+var problems2 = (props) => {
+  const found = [...tokenProblems(props)];
+  if (!NAME2.test(props.name))
+    found.push(`name \`${props.name}\` must be lower case (the server folds it)`);
+  if (props.userClaim.trim() === "")
+    found.push("userClaim is empty; the server requires one");
+  const bound = (props.boundAudiences?.length ?? 0) > 0 || (props.boundSubject ?? "") !== "" || Object.keys(props.boundClaims ?? {}).length > 0 || (props.tokenBoundCidrs?.length ?? 0) > 0;
+  if (props.roleType === "jwt" && !bound) {
+    found.push("a jwt role needs a bound constraint: boundAudiences, boundSubject, boundClaims or tokenBoundCidrs");
+  }
+  if (props.roleType === "oidc" && (props.allowedRedirectUris?.length ?? 0) === 0) {
+    found.push("an oidc role needs allowedRedirectUris");
+  }
+  const targets = Object.values(props.claimMappings ?? {});
+  if (targets.includes("role"))
+    found.push("claimMappings may not map to the reserved key `role`");
+  if (new Set(targets).size !== targets.length)
+    found.push("claimMappings maps two claims to one key");
+  return found;
+};
+
+// src/openbao/jwt-role.ts
+var BaoJwtRole = Resource5("Bao.JwtRole", {
+  defaultRemovalPolicy: "retain"
+});
+var jwtRoleSpec = (props) => ({
+  attributesOf: (live) => attributesOf6(props, live),
+  body: writeBody4(props),
+  family: "Bao.JwtRole",
+  matches: (attributes) => matches5(attributes, props),
+  path: rolePath2(props),
+  problems: problems2(props)
+});
+var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect16.succeed(BaoJwtRole.Provider.of({
+  list: () => Effect16.succeed([]),
+  read: Effect16.fn(function* ({ olds }) {
+    const found = yield* readRoleAt(jwtRoleSpec(olds));
+    return found?.attributes;
+  }),
+  diff: Effect16.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved5(news))
+      return;
+    if (mountOf2(news) !== output.mount || news.name !== output.name) {
+      return { action: "replace" };
+    }
+    return { action: yield* planRole(jwtRoleSpec(news)) };
+  }),
+  reconcile: Effect16.fn(function* ({ news }) {
+    return yield* reconcileRole(jwtRoleSpec(news));
+  }),
+  delete: Effect16.fn(function* ({ output }) {
+    yield* baoDelete(rolePath2(output));
+    return;
+  })
+})));
+// src/openbao/kubernetes-role.ts
+import { Resource as Resource6 } from "alchemy";
+import { isResolved as isResolved6 } from "alchemy/Diff";
+import * as Provider6 from "alchemy/Provider";
+import * as Effect17 from "effect/Effect";
+
+// src/openbao/kubernetes-role-form.ts
+var sortedSet4 = (values) => [...new Set(values)].sort();
+var text7 = (value) => typeof value === "string" ? value : "";
+var strings5 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var canonical4 = (input) => ({
+  aliasNameSource: input.aliasNameSource,
+  audience: input.audience,
+  boundServiceAccountNames: sortedSet4(input.boundServiceAccountNames),
+  boundServiceAccountNamespaceSelector: input.boundServiceAccountNamespaceSelector.trim(),
+  boundServiceAccountNamespaces: sortedSet4(input.boundServiceAccountNamespaces),
+  ...tokenFields(input)
+});
+var canonicalFromProps3 = (props) => canonical4({
+  ...tokenFormOfProps(props),
+  aliasNameSource: props.aliasNameSource,
+  audience: props.audience ?? "",
+  boundServiceAccountNames: props.boundServiceAccountNames,
+  boundServiceAccountNamespaceSelector: props.boundServiceAccountNamespaceSelector ?? "",
+  boundServiceAccountNamespaces: props.boundServiceAccountNamespaces ?? []
+});
+var canonicalFromLive3 = (live) => canonical4({
+  ...tokenFormOfLive(live),
+  aliasNameSource: text7(live["alias_name_source"]),
+  audience: text7(live["audience"]),
+  boundServiceAccountNames: strings5(live["bound_service_account_names"]),
+  boundServiceAccountNamespaceSelector: text7(live["bound_service_account_namespace_selector"]),
+  boundServiceAccountNamespaces: strings5(live["bound_service_account_namespaces"])
+});
+var mountOf3 = (props) => mountPath(props.mount ?? "kubernetes");
+var rolePath3 = (props) => `auth/${mountOf3(props)}/role/${props.name}`;
+var attributesOf7 = (props, live) => {
+  const form = canonicalFromLive3(live);
+  return { ...form, digest: sha256(JSON.stringify(form)), mount: mountOf3(props), name: props.name };
+};
+var matches6 = (attributes, props) => attributes.digest === sha256(JSON.stringify(canonicalFromProps3(props)));
+var writeBody5 = (props) => ({
+  alias_name_source: props.aliasNameSource,
+  audience: props.audience ?? "",
+  bound_service_account_names: [...props.boundServiceAccountNames],
+  bound_service_account_namespace_selector: props.boundServiceAccountNamespaceSelector ?? "",
+  bound_service_account_namespaces: [...props.boundServiceAccountNamespaces ?? []],
+  ...tokenBody(props)
+});
+var NAME3 = /^[a-z0-9_](?:[a-z0-9_.-]*[a-z0-9_])?$/;
+var starMixed = (values) => values.length > 1 && values.includes("*");
+var problems3 = (props) => {
+  const found = [...tokenProblems(props)];
+  const namespaces = props.boundServiceAccountNamespaces ?? [];
+  const selector = (props.boundServiceAccountNamespaceSelector ?? "").trim();
+  if (!NAME3.test(props.name))
+    found.push(`name \`${props.name}\` must be lower case (stored folded)`);
+  if (props.boundServiceAccountNames.length === 0)
+    found.push("boundServiceAccountNames is empty");
+  if (starMixed(props.boundServiceAccountNames))
+    found.push("`*` mixed with other account names");
+  if (namespaces.length === 0 && selector === "") {
+    found.push("boundServiceAccountNamespaces is empty and no namespace selector is set");
+  }
+  if (starMixed(namespaces))
+    found.push("`*` mixed with other namespaces");
+  return found;
+};
+
+// src/openbao/kubernetes-role.ts
+var BaoKubernetesRole = Resource6("Bao.KubernetesRole", {
+  defaultRemovalPolicy: "retain"
+});
+var kubernetesRoleSpec = (props) => ({
+  attributesOf: (live) => attributesOf7(props, live),
+  body: writeBody5(props),
+  family: "Bao.KubernetesRole",
+  matches: (attributes) => matches6(attributes, props),
+  path: rolePath3(props),
+  problems: problems3(props)
+});
+var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect17.succeed(BaoKubernetesRole.Provider.of({
+  list: () => Effect17.succeed([]),
+  read: Effect17.fn(function* ({ olds }) {
+    const found = yield* readRoleAt(kubernetesRoleSpec(olds));
+    return found?.attributes;
+  }),
+  diff: Effect17.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved6(news))
+      return;
+    if (mountOf3(news) !== output.mount || news.name !== output.name) {
+      return { action: "replace" };
+    }
+    return { action: yield* planRole(kubernetesRoleSpec(news)) };
+  }),
+  reconcile: Effect17.fn(function* ({ news }) {
+    return yield* reconcileRole(kubernetesRoleSpec(news));
+  }),
+  delete: Effect17.fn(function* ({ output }) {
+    yield* baoDelete(rolePath3(output));
+    return;
+  })
+})));
+// src/openbao/mfa-enforcement.ts
+import { Resource as Resource7 } from "alchemy";
+import { isResolved as isResolved7 } from "alchemy/Diff";
+import * as Provider7 from "alchemy/Provider";
+import * as Effect19 from "effect/Effect";
+
+// src/openbao/mfa-enforcement-form.ts
+var sortedSet5 = (values) => [...new Set(values.map((value) => value.trim()))].filter((value) => value !== "").sort();
+var strings6 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var text8 = (value) => typeof value === "string" ? value : "";
+var canonical5 = (input) => ({
+  authMethodAccessors: sortedSet5(input.authMethodAccessors),
+  authMethodTypes: sortedSet5(input.authMethodTypes),
+  identityEntityIds: sortedSet5(input.identityEntityIds),
+  identityGroupIds: sortedSet5(input.identityGroupIds),
+  mfaMethodIds: sortedSet5(input.mfaMethodIds)
+});
+var canonicalFromProps4 = (props, resolved) => canonical5({
+  authMethodAccessors: [...props.authMethodAccessors ?? [], ...resolved],
+  authMethodTypes: props.authMethodTypes ?? [],
+  identityEntityIds: props.identityEntityIds ?? [],
+  identityGroupIds: props.identityGroupIds ?? [],
+  mfaMethodIds: props.mfaMethodIds
+});
+var canonicalFromLive4 = (live) => canonical5({
+  authMethodAccessors: strings6(live["auth_method_accessors"]),
+  authMethodTypes: strings6(live["auth_method_types"]),
+  identityEntityIds: strings6(live["identity_entity_ids"]),
+  identityGroupIds: strings6(live["identity_group_ids"]),
+  mfaMethodIds: strings6(live["mfa_method_ids"])
+});
+var attributesOf8 = (name, live) => {
+  const form = canonicalFromLive4(live);
+  return {
+    ...form,
+    digest: sha256(JSON.stringify(form)),
+    enforcementId: text8(live["id"]),
+    name,
+    namespacePath: text8(live["namespace_path"])
+  };
+};
+var matches7 = (attributes, props, resolved) => attributes.digest === sha256(JSON.stringify(canonicalFromProps4(props, resolved)));
+var writeBody6 = (form) => ({
+  auth_method_accessors: [...form.authMethodAccessors],
+  auth_method_types: [...form.authMethodTypes],
+  identity_entity_ids: [...form.identityEntityIds],
+  identity_group_ids: [...form.identityGroupIds],
+  mfa_method_ids: [...form.mfaMethodIds]
+});
+var NAME4 = /^\w(?:[\w.-]*\w)?$/;
+var problems4 = (props, missingPaths) => {
+  const found = [];
+  if (!NAME4.test(props.name))
+    found.push(`name \`${props.name}\` is not a valid enforcement name`);
+  if (sortedSet5(props.mfaMethodIds).length === 0)
+    found.push("mfaMethodIds is empty");
+  const targets = [
+    props.authMethodPaths,
+    props.authMethodAccessors,
+    props.authMethodTypes,
+    props.identityGroupIds,
+    props.identityEntityIds
+  ].some((list) => sortedSet5(list ?? []).length > 0);
+  if (!targets)
+    found.push("no target: an enforcement with none is accepted and enforces NOTHING");
+  if (missingPaths.length > 0) {
+    found.push(`no auth mount at ${missingPaths.map((path) => mountPath(path)).join(", ")}`);
+  }
+  return found;
+};
+
+// src/openbao/mfa-wire.ts
+import * as Effect18 from "effect/Effect";
+var TOTP_PATH = "identity/mfa/method/totp";
+var METHODS_PATH = "identity/mfa/method";
+var enforcementPath = (name) => `identity/mfa/login-enforcement/${name}`;
+var record4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+var ownNamespacePath = Effect18.gen(function* () {
+  const env = yield* BaoEnv;
+  return namespacePath(envNamespace(env));
+});
+var findTotp = (name) => Effect18.gen(function* () {
+  const listing = yield* baoRead(`${METHODS_PATH}?list=true`);
+  const info = record4(listing?.["key_info"]) ?? {};
+  const own = yield* ownNamespacePath;
+  for (const [id, raw] of Object.entries(info)) {
+    const live = record4(raw);
+    if (live === undefined || live["name"] !== name || live["namespace_path"] !== own)
+      continue;
+    if (live["type"] !== "totp") {
+      return yield* Effect18.die(new Error(`Bao.MfaTotpMethod ${name}: that name belongs to a ${String(live["type"])} method ` + `(${id}) in this namespace, and a TOTP write would convert it. Pick another name.`));
+    }
+    return { id, live };
+  }
+  return;
+});
+var writeTotp = (body) => Effect18.asVoid(baoCall("write", "POST", TOTP_PATH, body));
+var deleteTotp = (id) => baoDelete(`${TOTP_PATH}/${id}`);
+var readEnforcement = (name) => baoRead(enforcementPath(name));
+var writeEnforcement = (name, body) => Effect18.asVoid(baoCall("write", "POST", enforcementPath(name), body));
+var authAccessors = (paths) => Effect18.gen(function* () {
+  if (paths.length === 0)
+    return { accessors: [], missing: [] };
+  const table = (yield* baoRead("sys/auth")) ?? {};
+  const accessors = [];
+  const missing = [];
+  for (const path of paths) {
+    const accessor = record4(table[`${mountPath(path)}/`])?.["accessor"];
+    if (typeof accessor === "string" && accessor !== "")
+      accessors.push(accessor);
+    else
+      missing.push(mountPath(path));
+  }
+  return { accessors, missing };
+});
+
+// src/openbao/mfa-enforcement.ts
+var BaoMfaLoginEnforcement = Resource7("Bao.MfaLoginEnforcement", {
+  defaultRemovalPolicy: "retain"
+});
+var refuse3 = (name, message) => Effect19.die(new Error(`Bao.MfaLoginEnforcement ${name}: ${message}`));
+var resolveTargets = (props) => Effect19.map(authAccessors(props.authMethodPaths ?? []), ({ accessors, missing }) => ({
+  bad: problems4(props, missing),
+  resolved: accessors
+}));
+var readLive = (name) => Effect19.map(readEnforcement(name), (live) => live === undefined ? undefined : attributesOf8(name, live));
+var planEnforcement = (props) => Effect19.gen(function* () {
+  const { bad, resolved } = yield* resolveTargets(props);
+  if (bad.length > 0)
+    return "update";
+  const live = yield* readLive(props.name);
+  return live !== undefined && matches7(live, props, resolved) ? "noop" : "update";
+});
+var reconcileEnforcement = (props) => Effect19.gen(function* () {
+  const { bad, resolved } = yield* resolveTargets(props);
+  if (bad.length > 0)
+    return yield* refuse3(props.name, bad.join("; "));
+  const live = yield* readLive(props.name);
+  if (live === undefined || !matches7(live, props, resolved)) {
+    yield* writeEnforcement(props.name, writeBody6(canonicalFromProps4(props, resolved)));
+  }
+  const after = yield* readLive(props.name);
+  if (after === undefined)
+    return yield* refuse3(props.name, "the write succeeded but it is absent.");
+  if (!matches7(after, props, resolved)) {
+    return yield* refuse3(props.name, "the enforcement read back different.");
+  }
+  return after;
+});
+var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforcement, Effect19.succeed(BaoMfaLoginEnforcement.Provider.of({
+  list: () => Effect19.succeed([]),
+  read: Effect19.fn(function* ({ olds }) {
+    return yield* readLive(olds.name);
+  }),
+  diff: Effect19.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved7(news))
+      return;
+    if (news.name !== output.name)
+      return { action: "replace" };
+    return { action: yield* planEnforcement(news) };
+  }),
+  reconcile: Effect19.fn(function* ({ news }) {
+    return yield* reconcileEnforcement(news);
+  }),
+  delete: Effect19.fn(function* ({ output }) {
+    return yield* refuse3(output.name, "REFUSING to delete: OpenBao 2.6.2 drops a login enforcement from memory only, and it " + "returns on the next unseal (openbao/openbao#4030). Set this resource back to " + "retain to drop it from state; remove it for good only once the server is fixed.");
+  })
+})));
+// src/openbao/mfa-totp.ts
+import { Resource as Resource8 } from "alchemy";
+import { isResolved as isResolved8 } from "alchemy/Diff";
+import * as Provider8 from "alchemy/Provider";
+import * as Effect20 from "effect/Effect";
+
+// src/openbao/mfa-totp-form.ts
+var canonical6 = (input) => ({
+  algorithm: input.algorithm,
+  digits: input.digits,
+  issuer: input.issuer,
+  keySize: input.keySize,
+  maxValidationAttempts: input.maxValidationAttempts,
+  periodSeconds: input.periodSeconds,
+  qrSize: input.qrSize,
+  skew: input.skew
+});
+var canonicalFromProps5 = (props) => canonical6({
+  algorithm: props.algorithm ?? "SHA1",
+  digits: props.digits ?? 6,
+  issuer: props.issuer,
+  keySize: props.keySize ?? 20,
+  maxValidationAttempts: props.maxValidationAttempts ?? 5,
+  periodSeconds: parseDuration(props.period ?? "30s") ?? -1,
+  qrSize: props.qrSize ?? 200,
+  skew: props.skew ?? 1
+});
+var num = (value) => typeof value === "number" && Number.isFinite(value) ? value : -1;
+var text9 = (value) => typeof value === "string" ? value : "";
+var canonicalFromLive5 = (live) => canonical6({
+  algorithm: text9(live["algorithm"]),
+  digits: num(live["digits"]),
+  issuer: text9(live["issuer"]),
+  keySize: num(live["key_size"]),
+  maxValidationAttempts: num(live["max_validation_attempts"]),
+  periodSeconds: ttlSeconds(live["period"]) ?? -1,
+  qrSize: num(live["qr_size"]),
+  skew: num(live["skew"])
+});
+var attributesOf9 = (methodId, live) => {
+  const form = canonicalFromLive5(live);
+  return {
+    ...form,
+    digest: sha256(JSON.stringify(form)),
+    methodId,
+    name: text9(live["name"]),
+    namespacePath: text9(live["namespace_path"])
+  };
+};
+var matches8 = (attributes, props) => attributes.digest === sha256(JSON.stringify(canonicalFromProps5(props)));
+var writeBody7 = (props) => {
+  const form = canonicalFromProps5(props);
+  return {
+    algorithm: form.algorithm,
+    digits: form.digits,
+    issuer: form.issuer,
+    key_size: form.keySize,
+    max_validation_attempts: form.maxValidationAttempts,
+    method_name: props.name,
+    period: props.period ?? "30s",
+    qr_size: form.qrSize,
+    skew: form.skew
+  };
+};
+var renameProblem = (from, to) => from === to ? undefined : `renaming from \`${from}\` would strand every enrolled secret. Declare the new method as a ` + "second resource, list both ids on the enforcement, enrol, then remove the old one " + "(mfa-totp.ts).";
+var problems5 = (props) => {
+  const found = [];
+  const form = canonicalFromProps5(props);
+  if (props.name.trim() === "")
+    found.push("name is empty; it is the only key a declaration has");
+  if (props.issuer.trim() === "")
+    found.push("issuer is empty; the server requires one");
+  if (form.periodSeconds <= 0)
+    found.push(`period \`${props.period ?? ""}\` must be a duration above zero`);
+  if (form.keySize <= 0)
+    found.push("keySize must be above zero");
+  if (form.maxValidationAttempts < 1)
+    found.push("maxValidationAttempts must be at least 1 (0 reads back as 5)");
+  return found;
+};
+
+// src/openbao/mfa-totp.ts
+var BaoMfaTotpMethod = Resource8("Bao.MfaTotpMethod", {
+  defaultRemovalPolicy: "retain"
+});
+var refuse4 = (props, message) => Effect20.die(new Error(`Bao.MfaTotpMethod ${props.name}: ${message}`));
+var readTotp = (props) => Effect20.map(findTotp(props.name), (found) => found === undefined ? undefined : attributesOf9(found.id, found.live));
+var planTotp = (props) => Effect20.gen(function* () {
+  if (problems5(props).length > 0)
+    return "update";
+  const live = yield* readTotp(props);
+  return live !== undefined && matches8(live, props) ? "noop" : "update";
+});
+var reconcileTotp = (props) => Effect20.gen(function* () {
+  const bad = problems5(props);
+  if (bad.length > 0)
+    return yield* refuse4(props, bad.join("; "));
+  const live = yield* readTotp(props);
+  if (live === undefined || !matches8(live, props))
+    yield* writeTotp(writeBody7(props));
+  const after = yield* readTotp(props);
+  if (after === undefined)
+    return yield* refuse4(props, "the write succeeded but no method has that name.");
+  if (!matches8(after, props))
+    return yield* refuse4(props, "the method read back different.");
+  return after;
+});
+var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect20.succeed(BaoMfaTotpMethod.Provider.of({
+  list: () => Effect20.succeed([]),
+  read: Effect20.fn(function* ({ olds }) {
+    return yield* readTotp(olds);
+  }),
+  diff: Effect20.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved8(news))
+      return;
+    const rename = renameProblem(output.name, news.name);
+    if (rename !== undefined)
+      return yield* refuse4(news, rename);
+    return { action: yield* planTotp(news) };
+  }),
+  reconcile: Effect20.fn(function* ({ news }) {
+    return yield* reconcileTotp(news);
+  }),
+  delete: Effect20.fn(function* ({ output }) {
+    yield* deleteTotp(output.methodId);
+    return;
+  })
+})));
+// src/openbao/mount.ts
+import { Resource as Resource9 } from "alchemy";
+import { isResolved as isResolved9 } from "alchemy/Diff";
+import * as Provider9 from "alchemy/Provider";
+import * as Effect23 from "effect/Effect";
+
+// src/openbao/mount-reconcile.ts
+import * as Effect22 from "effect/Effect";
 
 // src/openbao/mount-wire.ts
-import * as Effect9 from "effect/Effect";
-var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect9.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+import * as Effect21 from "effect/Effect";
+var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect21.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
   ...asked.errors,
   `sys/mounts could not confirm the mount is absent: ${listing.message}`
-])), Effect9.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect9.succeed(undefined) : Effect9.fail(asked)));
-var readMountData = (path) => baoRead(readPath(path)).pipe(Effect9.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
+])), Effect21.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect21.succeed(undefined) : Effect21.fail(asked)));
+var readMountData = (path) => baoRead(readPath(path)).pipe(Effect21.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
 var enableMount = (props) => baoWrite("POST", readPath(props.path), enableBody(props));
 var tuneMount = (props) => baoWrite("POST", tunePath(props.path), tuneBody(props));
 var disableMount = (path) => baoDelete(readPath(path));
 
-// src/openbao/mount.ts
-var BaoMount = Resource4("Bao.Mount", {
-  defaultRemovalPolicy: "retain"
-});
-var readMount = (props) => Effect10.gen(function* () {
+// src/openbao/mount-reconcile.ts
+var readMount = (props) => Effect22.gen(function* () {
   const live = yield* readMountData(props.path);
   if (live === undefined)
     return;
   return attributesOf(props, live);
 });
-var BaoMountProvider = () => Provider4.effect(BaoMount, Effect10.succeed(BaoMount.Provider.of({
-  list: () => Effect10.succeed([]),
-  read: Effect10.fn(function* ({ olds }) {
+var moveTarget2 = (props) => ({
+  family: "Bao.Mount",
+  path: props.path,
+  read: (path) => readMount({ ...props, path }),
+  type: props.type,
+  wire: mountPath
+});
+var reconcileMount = (news, stated, options) => Effect22.gen(function* () {
+  const move = planMove("Bao.Mount", stated, news.path, news.remountFrom);
+  if (move.kind === "refuse")
+    return yield* Effect22.die(new Error(move.message));
+  if (move.kind === "move")
+    yield* performMove(moveTarget2(news), move.from, options);
+  let live = yield* readMount(news);
+  if (live === undefined) {
+    yield* enableMount(news);
+    if (wantsTune(news))
+      yield* tuneMount(news);
+  } else if (!matches(live, news)) {
+    if (live.type !== news.type) {
+      return yield* Effect22.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
+    }
+    yield* tuneMount(news);
+  }
+  live = yield* readMount(news);
+  if (live === undefined) {
+    return yield* Effect22.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
+  }
+  return live;
+});
+
+// src/openbao/mount.ts
+var BaoMount = Resource9("Bao.Mount", {
+  defaultRemovalPolicy: "retain"
+});
+var BaoMountProvider = () => Provider9.effect(BaoMount, Effect23.succeed(BaoMount.Provider.of({
+  list: () => Effect23.succeed([]),
+  read: Effect23.fn(function* ({ olds }) {
     return yield* readMount(olds);
   }),
-  diff: Effect10.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved4(news))
+  diff: Effect23.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved9(news))
       return;
+    const move = planMove("Bao.Mount", output.path, news.path, news.remountFrom);
+    if (move.kind === "refuse")
+      return yield* Effect23.die(new Error(move.message));
+    if (move.kind === "move")
+      return { action: "update" };
     const live = yield* readMount(news);
     if (live === undefined)
       return { action: "update" };
@@ -1277,39 +2405,29 @@ var BaoMountProvider = () => Provider4.effect(BaoMount, Effect10.succeed(BaoMoun
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect10.fn(function* ({ news }) {
-    let live = yield* readMount(news);
-    if (live === undefined) {
-      yield* enableMount(news);
-      if (wantsTune(news))
-        yield* tuneMount(news);
-    } else if (!matches(live, news)) {
-      if (live.type !== news.type) {
-        return yield* Effect10.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
-      }
-      yield* tuneMount(news);
-    }
-    live = yield* readMount(news);
-    if (live === undefined) {
-      return yield* Effect10.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
-    }
-    return live;
+  reconcile: Effect23.fn(function* ({ news, output }) {
+    return yield* reconcileMount(news, output?.path);
   }),
-  delete: Effect10.fn(function* ({ output }) {
+  delete: Effect23.fn(function* ({ output }) {
     yield* disableMount(output.path);
     return;
   })
 })));
 // src/openbao/pki-role.ts
-import { Resource as Resource5 } from "alchemy";
-import { isResolved as isResolved5 } from "alchemy/Diff";
-import * as Provider5 from "alchemy/Provider";
-import * as Effect11 from "effect/Effect";
+import { Resource as Resource10 } from "alchemy";
+import { isResolved as isResolved10 } from "alchemy/Diff";
+import * as Provider10 from "alchemy/Provider";
+import * as Effect24 from "effect/Effect";
 
-// src/openbao/pki-role-form.ts
+// src/openbao/pki-role-canonical.ts
+var DEFAULT_KEY_USAGE = [
+  "DigitalSignature",
+  "KeyAgreement",
+  "KeyEncipherment"
+];
 var sorted = (values) => [...values].sort();
 var foldedUsages = (values) => sorted(values.map((v) => v.toLowerCase()));
-var canonical2 = (input) => ({
+var canonical7 = (input) => ({
   allowBareDomains: input.allowBareDomains,
   allowGlobDomains: input.allowGlobDomains,
   allowIpSans: input.allowIpSans,
@@ -1317,18 +2435,24 @@ var canonical2 = (input) => ({
   allowSubdomains: input.allowSubdomains,
   allowWildcardCertificates: input.allowWildcardCertificates,
   allowedDomains: sorted(input.allowedDomains),
+  allowedDomainsTemplate: input.allowedDomainsTemplate,
   clientFlag: input.clientFlag,
   cnValidations: sorted(input.cnValidations),
+  enforceHostnames: input.enforceHostnames,
   extKeyUsage: foldedUsages(input.extKeyUsage),
+  generateLease: input.generateLease,
   keyBits: input.keyBits,
   keyType: input.keyType,
+  keyUsage: foldedUsages(input.keyUsage),
   maxTtlSeconds: input.maxTtlSeconds,
+  noStore: input.noStore,
+  requireCn: input.requireCn,
   serverFlag: input.serverFlag,
   signatureBits: input.signatureBits,
   ttlSeconds: input.ttlSeconds
 });
-var seconds2 = (text4) => parseDuration(text4) ?? -1;
-var canonicalFromProps = (props) => canonical2({
+var seconds3 = (text10) => parseDuration(text10) ?? -1;
+var canonicalFromProps6 = (props) => canonical7({
   allowBareDomains: props.allowBareDomains ?? false,
   allowGlobDomains: props.allowGlobDomains ?? false,
   allowIpSans: props.allowIpSans ?? false,
@@ -1336,21 +2460,27 @@ var canonicalFromProps = (props) => canonical2({
   allowSubdomains: props.allowSubdomains ?? false,
   allowWildcardCertificates: props.allowWildcardCertificates ?? false,
   allowedDomains: props.allowedDomains,
+  allowedDomainsTemplate: props.allowedDomainsTemplate ?? false,
   clientFlag: props.clientFlag ?? true,
   cnValidations: props.cnValidations ?? ["hostname"],
+  enforceHostnames: props.enforceHostnames ?? true,
   extKeyUsage: props.extKeyUsage ?? [],
+  generateLease: props.generateLease ?? false,
   keyBits: props.keyBits ?? 0,
   keyType: props.keyType ?? "rsa",
-  maxTtlSeconds: seconds2(props.maxTtl),
+  keyUsage: props.keyUsage ?? DEFAULT_KEY_USAGE,
+  maxTtlSeconds: seconds3(props.maxTtl),
+  noStore: props.noStore ?? false,
+  requireCn: props.requireCn ?? true,
   serverFlag: props.serverFlag ?? true,
   signatureBits: props.signatureBits ?? 0,
-  ttlSeconds: seconds2(props.ttl)
+  ttlSeconds: seconds3(props.ttl)
 });
 var bool2 = (value, fallback) => typeof value === "boolean" ? value : fallback;
 var int2 = (value, fallback) => typeof value === "number" && Number.isFinite(value) ? value : fallback;
 var list = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
 var str = (value, fallback) => typeof value === "string" ? value : fallback;
-var canonicalFromLive = (live) => canonical2({
+var canonicalFromLive6 = (live) => canonical7({
   allowBareDomains: bool2(live["allow_bare_domains"], false),
   allowGlobDomains: bool2(live["allow_glob_domains"], false),
   allowIpSans: bool2(live["allow_ip_sans"], false),
@@ -1358,16 +2488,25 @@ var canonicalFromLive = (live) => canonical2({
   allowSubdomains: bool2(live["allow_subdomains"], false),
   allowWildcardCertificates: bool2(live["allow_wildcard_certificates"], false),
   allowedDomains: list(live["allowed_domains"]),
+  allowedDomainsTemplate: bool2(live["allowed_domains_template"], false),
   clientFlag: bool2(live["client_flag"], true),
   cnValidations: list(live["cn_validations"]),
+  enforceHostnames: bool2(live["enforce_hostnames"], false),
   extKeyUsage: list(live["ext_key_usage"]),
+  generateLease: bool2(live["generate_lease"], false),
   keyBits: int2(live["key_bits"], 0),
   keyType: str(live["key_type"], "rsa"),
+  keyUsage: list(live["key_usage"]),
   maxTtlSeconds: ttlSeconds(live["max_ttl"]) ?? -1,
+  noStore: bool2(live["no_store"], false),
+  requireCn: bool2(live["require_cn"], false),
   serverFlag: bool2(live["server_flag"], true),
   signatureBits: int2(live["signature_bits"], 0),
   ttlSeconds: ttlSeconds(live["ttl"]) ?? -1
 });
+var digestOf = (form) => sha256(JSON.stringify(form));
+
+// src/openbao/pki-role-form.ts
 var ttlText2 = (value) => {
   if (value < 0)
     return "";
@@ -1379,10 +2518,9 @@ var ttlText2 = (value) => {
     return `${String(value / 60)}m`;
   return `${String(value)}s`;
 };
-var digestOf = (form) => sha256(JSON.stringify(form));
-var rolePath2 = (props) => `${mountPath(props.mount ?? "pki")}/roles/${props.name}`;
-var attributesOf5 = (props, live) => {
-  const form = canonicalFromLive(live);
+var rolePath4 = (props) => `${mountPath(props.mount ?? "pki")}/roles/${props.name}`;
+var attributesOf10 = (props, live) => {
+  const form = canonicalFromLive6(live);
   return {
     ...form,
     name: props.name,
@@ -1392,8 +2530,8 @@ var attributesOf5 = (props, live) => {
     digest: digestOf(form)
   };
 };
-var writeBody3 = (props) => {
-  const form = canonicalFromProps(props);
+var writeBody8 = (props) => {
+  const form = canonicalFromProps6(props);
   const body = {
     allowed_domains: form.allowedDomains.join(","),
     allow_bare_domains: String(form.allowBareDomains),
@@ -1409,76 +2547,94 @@ var writeBody3 = (props) => {
     key_bits: String(form.keyBits),
     signature_bits: String(form.signatureBits),
     ttl: props.ttl,
-    max_ttl: props.maxTtl
+    max_ttl: props.maxTtl,
+    require_cn: String(form.requireCn),
+    enforce_hostnames: String(form.enforceHostnames),
+    key_usage: (props.keyUsage ?? DEFAULT_KEY_USAGE).join(","),
+    allowed_domains_template: String(form.allowedDomainsTemplate),
+    no_store: String(form.noStore),
+    generate_lease: String(form.generateLease)
   };
   const usages = props.extKeyUsage ?? [];
   if (usages.length > 0)
     body["ext_key_usage"] = usages.join(",");
   return body;
 };
-var matches4 = (attributes, props) => attributes.digest === digestOf(canonicalFromProps(props));
+var matches9 = (attributes, props) => attributes.digest === digestOf(canonicalFromProps6(props));
+var problems6 = (props) => {
+  const found = [];
+  if (props.allowedDomains.length === 0) {
+    found.push("allowedDomains is empty. With allow_any_name false that role can issue no certificate at all.");
+  }
+  const bad = [
+    ["ttl", props.ttl],
+    ["maxTtl", props.maxTtl]
+  ].filter(([, text10]) => parseDuration(text10 ?? "") === undefined);
+  if (bad.length > 0) {
+    found.push(`${bad.map(([k, v]) => `${k ?? ""}=${v ?? ""}`).join(", ")} is not a duration OpenBao ` + "parses (expect 30m, 720h, 8760h or 0).");
+  }
+  if (props.noStore === true && props.generateLease === true) {
+    found.push("noStore and generateLease are both true; OpenBao keeps no_store and drops the lease.");
+  }
+  return found;
+};
 
 // src/openbao/pki-role.ts
-var BaoPkiRole = Resource5("Bao.PkiRole", {
+var BaoPkiRole = Resource10("Bao.PkiRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole2 = (props) => Effect11.gen(function* () {
-  const live = yield* baoRead(rolePath2(props));
+var readRole2 = (props) => Effect24.gen(function* () {
+  const live = yield* baoRead(rolePath4(props));
   if (live === undefined)
     return;
-  return attributesOf5(props, live);
+  return attributesOf10(props, live);
 });
-var badDurations = (props) => [["ttl", props.ttl], ["maxTtl", props.maxTtl]].filter(([, text4]) => parseDuration(text4) === undefined);
-var BaoPkiRoleProvider = () => Provider5.effect(BaoPkiRole, Effect11.succeed(BaoPkiRole.Provider.of({
-  list: () => Effect11.succeed([]),
-  read: Effect11.fn(function* ({ olds }) {
+var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect24.succeed(BaoPkiRole.Provider.of({
+  list: () => Effect24.succeed([]),
+  read: Effect24.fn(function* ({ olds }) {
     return yield* readRole2(olds);
   }),
-  diff: Effect11.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved5(news))
+  diff: Effect24.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved10(news))
       return;
-    if (mountPath(news.mount ?? "pki") !== output.mount)
+    if (mountPath(news.mount ?? "pki") !== output.mount || news.name !== output.name)
       return { action: "replace" };
-    if (news.allowedDomains.length === 0 || badDurations(news).length > 0) {
+    if (problems6(news).length > 0)
       return { action: "update" };
-    }
     const live = yield* readRole2(news);
     if (live === undefined)
       return { action: "update" };
-    return matches4(live, news) ? { action: "noop" } : { action: "update" };
+    return matches9(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect11.fn(function* ({ news }) {
-    const path = rolePath2(news);
-    if (news.allowedDomains.length === 0) {
-      return yield* Effect11.die(new Error(`Bao.PkiRole ${path}: allowedDomains is empty. With allow_any_name false ` + "that role can issue no certificate at all."));
-    }
-    const bad = badDurations(news);
+  reconcile: Effect24.fn(function* ({ news }) {
+    const path = rolePath4(news);
+    const bad = problems6(news);
     if (bad.length > 0) {
-      return yield* Effect11.die(new Error(`Bao.PkiRole ${path}: ${bad.map(([k, v]) => `${k}=${v}`).join(", ")} ` + "is not a duration OpenBao parses (expect 30m, 720h, 8760h or 0)."));
+      return yield* Effect24.die(new Error(`Bao.PkiRole ${path}: ${bad.join(" ")}`));
     }
     const live = yield* readRole2(news);
-    if (live === undefined || !matches4(live, news)) {
-      yield* baoWrite("PUT", path, writeBody3(news));
+    if (live === undefined || !matches9(live, news)) {
+      yield* baoWrite("PUT", path, writeBody8(news));
     }
     const after = yield* readRole2(news);
     if (after === undefined) {
-      return yield* Effect11.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
+      return yield* Effect24.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
     }
-    if (!matches4(after, news)) {
-      return yield* Effect11.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
+    if (!matches9(after, news)) {
+      return yield* Effect24.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
     }
     return after;
   }),
-  delete: Effect11.fn(function* ({ output }) {
-    yield* baoDelete(rolePath2(output));
+  delete: Effect24.fn(function* ({ output }) {
+    yield* baoDelete(rolePath4(output));
     return;
   })
 })));
 // src/openbao/plugin.ts
-import { Resource as Resource6 } from "alchemy";
-import { isResolved as isResolved6 } from "alchemy/Diff";
-import * as Provider6 from "alchemy/Provider";
-import * as Effect13 from "effect/Effect";
+import { Resource as Resource11 } from "alchemy";
+import { isResolved as isResolved11 } from "alchemy/Diff";
+import * as Provider11 from "alchemy/Provider";
+import * as Effect26 from "effect/Effect";
 
 // src/openbao/plugin-form.ts
 var resolve = (props) => ({
@@ -1490,7 +2646,7 @@ var resolve = (props) => ({
   version: props.version ?? ""
 });
 var CANONICAL_VERSION = /^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$/;
-var problems = (form) => {
+var problems7 = (form) => {
   const found = [];
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(form.name) || form.name.includes("..")) {
     found.push(`name ${JSON.stringify(form.name)} is not a plain catalog name`);
@@ -1516,25 +2672,25 @@ var registerBody = (form) => ({
   ...form.args.length > 0 ? { args: form.args } : {},
   ...form.version === "" ? {} : { version: form.version }
 });
-var text4 = (value) => typeof value === "string" ? value : "";
+var text10 = (value) => typeof value === "string" ? value : "";
 var list2 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-var attributesOf6 = (form, live) => {
+var attributesOf11 = (form, live) => {
   const attrs = {
     name: form.name,
     type: form.type,
-    version: text4(live["version"]),
-    sha256: text4(live["sha256"]).toLowerCase(),
-    command: text4(live["command"]),
+    version: text10(live["version"]),
+    sha256: text10(live["sha256"]).toLowerCase(),
+    command: text10(live["command"]),
     args: list2(live["args"]),
     builtin: live["builtin"] === true
   };
   return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
 };
 var sameArgs = (want, have) => want.length === have.length && want.every((entry, index) => entry === have[index]);
-var matches5 = (attributes, form) => !attributes.builtin && attributes.version === form.version && attributes.sha256 === form.sha256 && attributes.command === form.command && sameArgs(form.args, attributes.args);
+var matches10 = (attributes, form) => !attributes.builtin && attributes.version === form.version && attributes.sha256 === form.sha256 && attributes.command === form.command && sameArgs(form.args, attributes.args);
 
 // src/openbao/plugin-reconcile.ts
-import * as Effect12 from "effect/Effect";
+import * as Effect25 from "effect/Effect";
 
 // src/openbao/plugin-wire.ts
 var readPluginData = (form) => baoRead(versionedPath(form.type, form.name, form.version));
@@ -1542,44 +2698,44 @@ var registerPlugin = (form) => baoWrite("PUT", catalogPath(form.type, form.name)
 var deregisterPlugin = (type, name, version) => baoDelete(versionedPath(type, name, version));
 
 // src/openbao/plugin-reconcile.ts
-var readEntry = (form) => Effect12.map(readPluginData(form), (live) => live === undefined ? undefined : { attributes: attributesOf6(form, live), live });
-var refuse = (form, message) => Effect12.die(new Error(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}: ${message}`));
+var readEntry = (form) => Effect25.map(readPluginData(form), (live) => live === undefined ? undefined : { attributes: attributesOf11(form, live), live });
+var refuse5 = (form, message) => Effect25.die(new Error(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}: ${message}`));
 var SELF_REPORTED = "the write succeeded but the read-back does not match. If the binary reports its own version, " + "OpenBao filed the registration under it (plugin_catalog.go setInternal) — declare `version` " + "as exactly the version the binary reports; that adopts the entry this write just made.";
-var reconcilePlugin = (props) => Effect12.gen(function* () {
+var reconcilePlugin = (props) => Effect25.gen(function* () {
   const form = resolve(props);
-  const bad = problems(form);
+  const bad = problems7(form);
   if (bad.length > 0)
-    return yield* refuse(form, bad.join("; "));
+    return yield* refuse5(form, bad.join("; "));
   const found = yield* readEntry(form);
-  if (found !== undefined && !matches5(found.attributes, form)) {
+  if (found !== undefined && !matches10(found.attributes, form)) {
     if (found.live["declarative"] === true || found.live["oci"] === true) {
-      return yield* refuse(form, "the live entry is declarative/OCI; manage it in server config.");
+      return yield* refuse5(form, "the live entry is declarative/OCI; manage it in server config.");
     }
     if (found.attributes.builtin) {
-      return yield* refuse(form, "this name is a builtin; an unversioned write would shadow it.");
+      return yield* refuse5(form, "this name is a builtin; an unversioned write would shadow it.");
     }
   }
-  if (found === undefined || !matches5(found.attributes, form))
+  if (found === undefined || !matches10(found.attributes, form))
     yield* registerPlugin(form);
   const after = yield* readEntry(form);
-  if (after === undefined || !matches5(after.attributes, form)) {
-    return yield* refuse(form, SELF_REPORTED);
+  if (after === undefined || !matches10(after.attributes, form)) {
+    return yield* refuse5(form, SELF_REPORTED);
   }
   return after.attributes;
 });
 
 // src/openbao/plugin.ts
-var BaoPlugin = Resource6("Bao.Plugin", {
+var BaoPlugin = Resource11("Bao.Plugin", {
   defaultRemovalPolicy: "retain"
 });
-var BaoPluginProvider = () => Provider6.effect(BaoPlugin, Effect13.succeed(BaoPlugin.Provider.of({
-  list: () => Effect13.succeed([]),
-  read: Effect13.fn(function* ({ olds }) {
+var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect26.succeed(BaoPlugin.Provider.of({
+  list: () => Effect26.succeed([]),
+  read: Effect26.fn(function* ({ olds }) {
     const found = yield* readEntry(resolve(olds));
     return found?.attributes;
   }),
-  diff: Effect13.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved6(news))
+  diff: Effect26.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved11(news))
       return;
     const form = resolve(news);
     if (output.name !== form.name || output.type !== form.type || output.version !== form.version) {
@@ -1588,21 +2744,21 @@ var BaoPluginProvider = () => Provider6.effect(BaoPlugin, Effect13.succeed(BaoPl
     const found = yield* readEntry(form);
     if (found === undefined)
       return { action: "update" };
-    return matches5(found.attributes, form) ? { action: "noop" } : { action: "update" };
+    return matches10(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect13.fn(function* ({ news }) {
+  reconcile: Effect26.fn(function* ({ news }) {
     return yield* reconcilePlugin(news);
   }),
-  delete: Effect13.fn(function* ({ output }) {
+  delete: Effect26.fn(function* ({ output }) {
     yield* deregisterPlugin(output.type, output.name, output.version);
     return;
   })
 })));
 // src/openbao/policy.ts
-import { Resource as Resource7 } from "alchemy";
-import { isResolved as isResolved7 } from "alchemy/Diff";
-import * as Provider7 from "alchemy/Provider";
-import * as Effect15 from "effect/Effect";
+import { Resource as Resource12 } from "alchemy";
+import { isResolved as isResolved12 } from "alchemy/Diff";
+import * as Provider12 from "alchemy/Provider";
+import * as Effect28 from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 
@@ -1610,32 +2766,32 @@ import * as Path from "effect/Path";
 var isEmptyAssembly = (parts, joined) => parts === 0 || !/^\s*path\s+"/m.test(joined);
 
 // src/openbao/policy-wire.ts
-import * as Effect14 from "effect/Effect";
+import * as Effect27 from "effect/Effect";
 var policyPath = (name) => `sys/policies/acl/${name}`;
-var readPolicy = (name) => Effect14.flatMap(baoRead(policyPath(name)), (data) => {
+var readPolicy = (name) => Effect27.flatMap(baoRead(policyPath(name)), (data) => {
   if (data === undefined)
-    return Effect14.succeed("");
-  const text5 = data["policy"];
-  return typeof text5 === "string" ? Effect14.succeed(text5) : Effect14.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
+    return Effect27.succeed("");
+  const text11 = data["policy"];
+  return typeof text11 === "string" ? Effect27.succeed(text11) : Effect27.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
 });
 var writePolicy = (name, hcl) => baoWrite("PUT", policyPath(name), { policy: hcl });
 var deletePolicy = (name) => baoDelete(policyPath(name));
 
 // src/openbao/policy.ts
-var BaoPolicy = Resource7("Bao.Policy", {
+var BaoPolicy = Resource12("Bao.Policy", {
   defaultRemovalPolicy: "retain"
 });
 var grantsOf = (hcl) => (hcl.match(/^path /gm) ?? []).length;
-var attributesOf7 = (name, hcl, parts) => ({
+var attributesOf12 = (name, hcl, parts) => ({
   name,
   digest: sha256(hcl),
   grants: grantsOf(hcl),
   parts
 });
-var BaoPolicyProvider = () => Provider7.effect(BaoPolicy, Effect15.gen(function* () {
+var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect28.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const assemble = (dir) => Effect15.gen(function* () {
+  const assemble = (dir) => Effect28.gen(function* () {
     const entries2 = (yield* fs.readDirectory(dir)).filter((f) => f.endsWith(".hcl")).sort();
     let joined = "";
     for (const f of entries2)
@@ -1644,67 +2800,77 @@ var BaoPolicyProvider = () => Provider7.effect(BaoPolicy, Effect15.gen(function*
     return { joined, parts: entries2.length };
   });
   return BaoPolicy.Provider.of({
-    list: () => Effect15.succeed([]),
-    read: Effect15.fn(function* ({ olds }) {
+    list: () => Effect28.succeed([]),
+    read: Effect28.fn(function* ({ olds }) {
       const live = yield* readPolicy(olds.name);
-      return live.length === 0 ? undefined : attributesOf7(olds.name, live, 0);
+      return live.length === 0 ? undefined : attributesOf12(olds.name, live, 0);
     }),
-    diff: Effect15.fn(function* ({ news, output }) {
-      if (output === undefined || !isResolved7(news))
+    diff: Effect28.fn(function* ({ news, olds, output }) {
+      const tried = output?.name ?? declaredString(olds, "name");
+      const declared = declaredString(news, "name");
+      const move = yield* judgeMove("Bao.Policy", tried, declared, policyPath, policyKey);
+      if (output === undefined)
+        return;
+      if (move !== undefined)
+        return { action: "replace" };
+      if (!isResolved12(news))
         return;
       const { joined } = yield* assemble(news.fragments);
       const live = yield* readPolicy(news.name);
       return live.length > 0 && sha256(live) === sha256(joined) ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect15.fn(function* ({ news }) {
+    reconcile: Effect28.fn(function* ({ news, output }) {
       const name = news.name;
+      if (output !== undefined && isMoved(output.name, name, policyKey) === true) {
+        return yield* refuseMovedUpdate(`Bao.Policy ${name}`, output.name, name);
+      }
       const { joined, parts } = yield* assemble(news.fragments);
       if (isEmptyAssembly(parts, joined))
-        return yield* Effect15.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
+        return yield* Effect28.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
       const current = yield* readPolicy(name);
       if (current.length > 0 && sha256(current) === sha256(joined)) {
-        return attributesOf7(name, joined, parts);
+        return attributesOf12(name, joined, parts);
       }
       yield* writePolicy(name, joined);
-      return attributesOf7(name, joined, parts);
+      return attributesOf12(name, joined, parts);
     }),
-    delete: Effect15.fn(function* ({ output }) {
+    delete: Effect28.fn(function* ({ output }) {
       yield* deletePolicy(output.name);
       return;
     })
   });
 }));
 // src/openbao/proxmox-role.ts
-import { Resource as Resource8 } from "alchemy";
-import { isResolved as isResolved8 } from "alchemy/Diff";
-import * as Provider8 from "alchemy/Provider";
-import * as Effect16 from "effect/Effect";
+import { Resource as Resource13 } from "alchemy";
+import { isResolved as isResolved13 } from "alchemy/Diff";
+import * as Provider13 from "alchemy/Provider";
+import * as Effect30 from "effect/Effect";
 
 // src/openbao/proxmox-role-form.ts
-var text5 = (value) => typeof value === "string" ? value : "";
-var ttlText3 = (seconds3, fallback = "0") => {
-  if (seconds3 === undefined)
+var text11 = (value) => typeof value === "string" ? value : "";
+var ttlText3 = (seconds4, fallback = "0") => {
+  if (seconds4 === undefined)
     return fallback;
-  if (seconds3 % 86400 === 0)
-    return `${String(seconds3 / 86400)}d`;
-  if (seconds3 % 3600 === 0)
-    return `${String(seconds3 / 3600)}h`;
-  if (seconds3 % 60 === 0)
-    return `${String(seconds3 / 60)}m`;
-  return `${String(seconds3)}s`;
-};
-var rolePath3 = (mount, name) => `${mountPath(mount)}/roles/${name}`;
-var attributesOf8 = (props, live) => {
+  if (seconds4 % 86400 === 0)
+    return `${String(seconds4 / 86400)}d`;
+  if (seconds4 % 3600 === 0)
+    return `${String(seconds4 / 3600)}h`;
+  if (seconds4 % 60 === 0)
+    return `${String(seconds4 / 60)}m`;
+  return `${String(seconds4)}s`;
+};
+var rolePath5 = (mount, name) => `${mountPath(mount)}/roles/${name}`;
+var attributesOf13 = (props, live) => {
   const attrs = {
     mount: mountPath(props.mount),
-    name: text5(live["name"]) || props.name,
-    mintUser: text5(live["mint_user"]),
+    name: text11(live["name"]) || props.name,
+    mintUser: text11(live["mint_user"]),
     ttl: ttlText3(ttlSeconds(live["ttl"])),
     maxTtl: ttlText3(ttlSeconds(live["max_ttl"]))
   };
   return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
 };
-var writeBody4 = (props) => {
+var writeBody9 = (props) => {
   const ttl = parseDuration(props.ttl);
   const maxTtl = parseDuration(props.maxTtl);
   const bad = [];
@@ -1724,68 +2890,94 @@ var sameTtl5 = (want, have) => {
   const haveSeconds = ttlSeconds(have);
   return wantSeconds !== undefined && wantSeconds === haveSeconds;
 };
-var matches6 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl5(props.ttl, attributes.ttl) && sameTtl5(props.maxTtl, attributes.maxTtl);
+var rescopeRefusal = (before, mintUser, allowMintUserChange) => before === mintUser || allowMintUserChange === before ? undefined : `re-scopes mint_user ${before} → ${mintUser}. Every token this role mints inherits ` + `the ACL of that PVE user. To re-scope deliberately, declare allowMintUserChange: '${before}'.`;
+var matches11 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl5(props.ttl, attributes.ttl) && sameTtl5(props.maxTtl, attributes.maxTtl);
 
-// src/openbao/proxmox-role.ts
-var BaoProxmoxRole = Resource8("Bao.ProxmoxRole", {
-  defaultRemovalPolicy: "retain"
-});
-var readRole3 = (props) => Effect16.gen(function* () {
-  const live = yield* baoRead(rolePath3(props.mount, props.name));
+// src/openbao/proxmox-role-wire.ts
+import * as Effect29 from "effect/Effect";
+var readRole3 = (props) => Effect29.gen(function* () {
+  const live = yield* baoRead(rolePath5(props.mount, props.name));
   if (live === undefined)
     return;
-  return attributesOf8(props, live);
+  return attributesOf13(props, live);
 });
-var BaoProxmoxRoleProvider = () => Provider8.effect(BaoProxmoxRole, Effect16.succeed(BaoProxmoxRole.Provider.of({
-  list: () => Effect16.succeed([]),
-  read: Effect16.fn(function* ({ olds }) {
+
+// src/openbao/proxmox-role.ts
+var BaoProxmoxRole = Resource13("Bao.ProxmoxRole", {
+  defaultRemovalPolicy: "retain"
+});
+var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect30.succeed(BaoProxmoxRole.Provider.of({
+  list: () => Effect30.succeed([]),
+  read: Effect30.fn(function* ({ olds }) {
     return yield* readRole3(olds);
   }),
-  diff: Effect16.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved8(news))
+  diff: Effect30.fn(function* ({ news, olds, output }) {
+    const tried = triedRolePath(output, olds, rolePath5);
+    const declared = declaredRolePath(news, rolePath5);
+    const move = yield* judgeMove("Bao.ProxmoxRole", tried, declared, (path) => path);
+    if (output === undefined)
+      return;
+    if (move !== undefined) {
+      const mintUser = declaredString(news, "mintUser");
+      if (mintUser === undefined || isPendingProp(news, "allowMintUserChange"))
+        return;
+      const from = (yield* readRole3(output))?.mintUser ?? output.mintUser;
+      const allow = declaredString(news, "allowMintUserChange");
+      const refusal2 = rescopeRefusal(from, mintUser, allow);
+      if (refusal2 === undefined)
+        return { action: "replace" };
+      return yield* Effect30.die(new Error(`Bao.ProxmoxRole ${move.from} → ${move.to}: the rename ${refusal2}`));
+    }
+    if (!isResolved13(news))
       return;
     const live = yield* readRole3(news);
     if (live === undefined)
       return { action: "update" };
-    if (matches6(live, news))
+    if (matches11(live, news))
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect16.fn(function* ({ news }) {
+  reconcile: Effect30.fn(function* ({ news, output }) {
+    const path = rolePath5(news.mount, news.name);
+    const before = output === undefined ? path : rolePath5(output.mount, output.name);
+    if (isMoved(before, path) === true) {
+      return yield* refuseMovedUpdate("Bao.ProxmoxRole", before, path);
+    }
     const live = yield* readRole3(news);
-    if (live !== undefined && live.mintUser !== news.mintUser && news.allowMintUserChange !== live.mintUser) {
-      return yield* Effect16.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: live mint_user ` + `${live.mintUser} != declared ${news.mintUser}. Every token this role mints ` + "inherits the ACL of that PVE user. To re-scope deliberately, declare " + `allowMintUserChange: '${live.mintUser}'.`));
+    const rescope = live === undefined ? undefined : rescopeRefusal(live.mintUser, news.mintUser, news.allowMintUserChange);
+    if (rescope !== undefined) {
+      return yield* Effect30.die(new Error(`Bao.ProxmoxRole ${path}: ${rescope}`));
     }
-    if (live === undefined || !matches6(live, news)) {
-      const write = writeBody4(news);
+    if (live === undefined || !matches11(live, news)) {
+      const write = writeBody9(news);
       if (!write.ok) {
-        return yield* Effect16.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
+        return yield* Effect30.die(new Error(`Bao.ProxmoxRole ${path}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
       }
-      yield* baoWrite("PUT", rolePath3(news.mount, news.name), write.body);
+      yield* baoWrite("PUT", path, write.body);
     }
     const after = yield* readRole3(news);
     if (after === undefined) {
-      return yield* Effect16.die(new Error(`Bao.ProxmoxRole ${rolePath3(news.mount, news.name)}: write returned no error ` + "but the role is still absent."));
+      return yield* Effect30.die(new Error(`Bao.ProxmoxRole ${path}: write returned no error ` + "but the role is still absent."));
     }
     return after;
   }),
-  delete: Effect16.fn(function* ({ output }) {
-    yield* baoDelete(rolePath3(output.mount, output.name));
+  delete: Effect30.fn(function* ({ output }) {
+    yield* baoDelete(rolePath5(output.mount, output.name));
     return;
   })
 })));
 // src/openbao/ssh-role.ts
-import { Resource as Resource9 } from "alchemy";
-import { isResolved as isResolved9 } from "alchemy/Diff";
-import * as Provider9 from "alchemy/Provider";
-import * as Effect17 from "effect/Effect";
+import { Resource as Resource14 } from "alchemy";
+import { isResolved as isResolved14 } from "alchemy/Diff";
+import * as Provider14 from "alchemy/Provider";
+import * as Effect31 from "effect/Effect";
 
 // src/openbao/ssh-role-form.ts
 var readPath4 = (mount, name) => `${sshMountOf(mount)}/roles/${name}`;
-var text6 = (value) => typeof value === "string" ? value : "";
+var text12 = (value) => typeof value === "string" ? value : "";
 var bool3 = (value, fallback) => typeof value === "boolean" ? value : fallback;
 var csvList = (value) => {
-  const parts = Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : text6(value).split(",");
+  const parts = Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : text12(value).split(",");
   return [
     ...new Set(parts.map((entry) => entry.trim()).filter((entry) => entry.length > 0))
   ].sort();
@@ -1796,7 +2988,7 @@ var extMap = (value) => {
     return out;
   const source = value;
   for (const key of Object.keys(source).sort())
-    out[key] = text6(source[key]);
+    out[key] = text12(source[key]);
   return out;
 };
 var resolve2 = (props) => ({
@@ -1817,12 +3009,12 @@ var resolve2 = (props) => ({
   ttl: props.ttl,
   maxTtl: props.maxTtl
 });
-var attributesOf9 = (form, live) => {
+var attributesOf14 = (form, live) => {
   const attrs = {
     name: form.name,
     mount: form.mount,
     allowedUsers: csvList(live["allowed_users"]),
-    defaultUser: text6(live["default_user"]),
+    defaultUser: text12(live["default_user"]),
     allowUserCertificates: bool3(live["allow_user_certificates"], false),
     allowHostCertificates: bool3(live["allow_host_certificates"], false),
     allowedDomains: csvList(live["allowed_domains"]),
@@ -1833,14 +3025,14 @@ var attributesOf9 = (form, live) => {
     allowedCriticalOptions: csvList(live["allowed_critical_options"]),
     defaultCriticalOptions: extMap(live["default_critical_options"]),
     allowEmptyPrincipals: bool3(live["allow_empty_principals"], false),
-    keyType: text6(live["key_type"]) || "ca",
+    keyType: text12(live["key_type"]) || "ca",
     ttlSeconds: ttlSeconds(live["ttl"]) ?? 0,
     maxTtlSeconds: ttlSeconds(live["max_ttl"]) ?? 0
   };
   return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
 };
-var mapValue = (map5) => extMap(map5);
-var writeBody5 = (form) => ({
+var mapValue = (map10) => extMap(map10);
+var writeBody10 = (form) => ({
   key_type: "ca",
   allowed_users: form.allowedUsers.join(","),
   default_user: form.defaultUser,
@@ -1863,18 +3055,18 @@ var sameMap = (want, have) => {
   return keys.length === Object.keys(have).length && keys.every((key) => have[key] === want[key]);
 };
 var sameTtl6 = (want, have) => parseDuration(want) === have;
-var badDurations2 = (form) => ["ttl", "maxTtl"].filter((field) => parseDuration(form[field]) === undefined);
-var matches7 = (attributes, form) => attributes.keyType === "ca" && sameList2(form.allowedUsers, attributes.allowedUsers) && attributes.defaultUser === form.defaultUser && attributes.allowUserCertificates === form.allowUserCertificates && attributes.allowHostCertificates === form.allowHostCertificates && sameList2(form.allowedDomains, attributes.allowedDomains) && attributes.allowSubdomains === form.allowSubdomains && attributes.allowBareDomains === form.allowBareDomains && sameList2(form.allowedExtensions, attributes.allowedExtensions) && sameMap(form.defaultExtensions, attributes.defaultExtensions) && sameList2(form.allowedCriticalOptions, attributes.allowedCriticalOptions) && sameMap(form.defaultCriticalOptions, attributes.defaultCriticalOptions) && attributes.allowEmptyPrincipals === form.allowEmptyPrincipals && sameTtl6(form.ttl, attributes.ttlSeconds) && sameTtl6(form.maxTtl, attributes.maxTtlSeconds);
+var badDurations = (form) => ["ttl", "maxTtl"].filter((field) => parseDuration(form[field]) === undefined);
+var matches12 = (attributes, form) => attributes.keyType === "ca" && sameList2(form.allowedUsers, attributes.allowedUsers) && attributes.defaultUser === form.defaultUser && attributes.allowUserCertificates === form.allowUserCertificates && attributes.allowHostCertificates === form.allowHostCertificates && sameList2(form.allowedDomains, attributes.allowedDomains) && attributes.allowSubdomains === form.allowSubdomains && attributes.allowBareDomains === form.allowBareDomains && sameList2(form.allowedExtensions, attributes.allowedExtensions) && sameMap(form.defaultExtensions, attributes.defaultExtensions) && sameList2(form.allowedCriticalOptions, attributes.allowedCriticalOptions) && sameMap(form.defaultCriticalOptions, attributes.defaultCriticalOptions) && attributes.allowEmptyPrincipals === form.allowEmptyPrincipals && sameTtl6(form.ttl, attributes.ttlSeconds) && sameTtl6(form.maxTtl, attributes.maxTtlSeconds);
 
 // src/openbao/ssh-role.ts
-var BaoSshRole = Resource9("Bao.SshRole", {
+var BaoSshRole = Resource14("Bao.SshRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole4 = (form) => Effect17.gen(function* () {
+var readRole4 = (form) => Effect31.gen(function* () {
   const live = yield* baoRead(readPath4(form.mount, form.name));
   if (live === undefined)
     return;
-  return { attributes: attributesOf9(form, live), live };
+  return { attributes: attributesOf14(form, live), live };
 });
 var UNMANAGED_DEFAULTS = {
   algorithm_signer: "default",
@@ -1889,22 +3081,22 @@ var UNMANAGED_DEFAULTS = {
   not_before_duration: 30
 };
 var isDefault = (live, field) => live[field] === undefined || live[field] === "" || live[field] === UNMANAGED_DEFAULTS[field];
-var wouldErase = (live) => {
+var wouldErase2 = (live) => {
   const lost = Object.keys(UNMANAGED_DEFAULTS).filter((field) => !isDefault(live, field));
   if (Object.keys(extMap(live["allowed_user_key_lengths"])).length > 0) {
     lost.push("allowed_user_key_lengths");
   }
   return lost.sort();
 };
-var refuse2 = (message) => Effect17.die(new Error(message));
-var BaoSshRoleProvider = () => Provider9.effect(BaoSshRole, Effect17.succeed(BaoSshRole.Provider.of({
-  list: () => Effect17.succeed([]),
-  read: Effect17.fn(function* ({ olds }) {
+var refuse6 = (message) => Effect31.die(new Error(message));
+var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect31.succeed(BaoSshRole.Provider.of({
+  list: () => Effect31.succeed([]),
+  read: Effect31.fn(function* ({ olds }) {
     const found = yield* readRole4(resolve2(olds));
     return found?.attributes;
   }),
-  diff: Effect17.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved9(news))
+  diff: Effect31.fn(function* ({ news, output }) {
+    if (output === undefined || !isResolved14(news))
       return;
     const form = resolve2(news);
     if (output.mount !== form.mount || output.name !== form.name) {
@@ -1913,35 +3105,35 @@ var BaoSshRoleProvider = () => Provider9.effect(BaoSshRole, Effect17.succeed(Bao
     const found = yield* readRole4(form);
     if (found === undefined)
       return { action: "update" };
-    return matches7(found.attributes, form) ? { action: "noop" } : { action: "update" };
+    return matches12(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect17.fn(function* ({ news }) {
+  reconcile: Effect31.fn(function* ({ news }) {
     const form = resolve2(news);
     const path = readPath4(form.mount, form.name);
-    const bad = badDurations2(form);
+    const bad = badDurations(form);
     if (bad.length > 0) {
-      return yield* refuse2(`Bao.SshRole ${path}: ${bad.join(", ")} is not a duration parseDuration understands ` + "(`0` or `<n>s|m|h|d`). It would write, then report update on every plan forever.");
+      return yield* refuse6(`Bao.SshRole ${path}: ${bad.join(", ")} is not a duration parseDuration understands ` + "(`0` or `<n>s|m|h|d`). It would write, then report update on every plan forever.");
     }
     if (form.allowUserCertificates && form.allowedUsers.length === 0 && !form.allowEmptyPrincipals) {
-      return yield* refuse2(`Bao.SshRole ${path}: allowUserCertificates with an empty allowedUsers and ` + "allowEmptyPrincipals false. Every sign request against it would be rejected.");
+      return yield* refuse6(`Bao.SshRole ${path}: allowUserCertificates with an empty allowedUsers and ` + "allowEmptyPrincipals false. Every sign request against it would be rejected.");
     }
     const found = yield* readRole4(form);
-    if (found === undefined || !matches7(found.attributes, form)) {
+    if (found === undefined || !matches12(found.attributes, form)) {
       if (found !== undefined) {
-        const lost = wouldErase(found.live);
+        const lost = wouldErase2(found.live);
         if (lost.length > 0) {
-          return yield* refuse2(`Bao.SshRole ${path}: live role carries ${lost.join(", ")}, which this ` + "resource does not declare and the full-replace write would ERASE. " + "Fold those settings into the declaration, or clear them by hand first.");
+          return yield* refuse6(`Bao.SshRole ${path}: live role carries ${lost.join(", ")}, which this ` + "resource does not declare and the full-replace write would ERASE. " + "Fold those settings into the declaration, or clear them by hand first.");
         }
       }
-      yield* baoWrite("PUT", path, writeBody5(form));
+      yield* baoWrite("PUT", path, writeBody10(form));
     }
     const after = yield* readRole4(form);
     if (after === undefined) {
-      return yield* refuse2(`Bao.SshRole ${path}: write returned no error but the role is still absent.`);
+      return yield* refuse6(`Bao.SshRole ${path}: write returned no error but the role is still absent.`);
     }
     return after.attributes;
   }),
-  delete: Effect17.fn(function* ({ output }) {
+  delete: Effect31.fn(function* ({ output }) {
     yield* baoDelete(readPath4(output.mount, output.name));
     return;
   })
@@ -1953,7 +3145,18 @@ export {
   BaoAuthRoleProvider,
   BaoCloudflareRole,
   BaoCloudflareRoleProvider,
+  BaoIdentityError,
+  BaoJwtAuthConfig,
+  BaoJwtAuthConfigProvider,
+  BaoJwtRole,
+  BaoJwtRoleProvider,
+  BaoKubernetesRole,
+  BaoKubernetesRoleProvider,
   BaoLoginError,
+  BaoMfaLoginEnforcement,
+  BaoMfaLoginEnforcementProvider,
+  BaoMfaTotpMethod,
+  BaoMfaTotpMethodProvider,
   BaoMount,
   BaoMountProvider,
   BaoPkiRole,
@@ -1967,10 +3170,15 @@ export {
   BaoSshRole,
   BaoSshRoleProvider,
   CloudflarePermissionGroups,
+  HOST_ROLE_SEPARATOR,
   appRoleLogin,
   appRoleLoginEffect,
+  assertBaoIdentity,
+  assertBaoIdentityEffect,
   expandAccount,
   expandAll,
+  hostAppRoles,
+  hostRoleName,
   mountName,
   parseRolesConfig,
   permissionGroupsFromEngine,
@@ -1979,5 +3187,5 @@ export {
   revokeSelfEffect
 };
 
-//# debugId=1C57EE110DEE3DA764756E2164756E21
+//# debugId=81D869587FC0B7AF64756E2164756E21
 //# sourceMappingURL=index.js.map