@homeflare/alchemy 0.5.0 → 0.7.0

package/dist/openbao/jwt-config-form.d.ts

@@ -0,0 +1,51 @@
+export interface BaoJwtAuthConfigProps {
+    /** Auth mount path. Default `jwt`. */
+    mount?: string;
+    /** Issuer base URL, WITHOUT `/.well-known/openid-configuration` (the server refuses that). */
+    oidcDiscoveryUrl?: string;
+    /** PEM CA for the discovery URL, when its certificate is not publicly trusted. */
+    oidcDiscoveryCaPem?: string;
+    /** A JWKS URL, instead of discovery. */
+    jwksUrl?: string;
+    /** PEM CA for the JWKS URL. */
+    jwksCaPem?: string;
+    /** PEM PUBLIC keys, instead of either URL. */
+    jwtValidationPubkeys?: readonly string[];
+    /** Algorithms accepted. Default none — which the server reads as RS256. */
+    jwtSupportedAlgs?: readonly string[];
+    /** The `iss` a token must carry. */
+    boundIssuer?: string;
+    /** Role used when a login names none. Lower case. */
+    defaultRole?: string;
+}
+export interface BaoJwtAuthConfigCanonical {
+    boundIssuer: string;
+    defaultRole: string;
+    jwksCaPem: string;
+    jwksUrl: string;
+    jwtSupportedAlgs: readonly string[];
+    jwtValidationPubkeys: readonly string[];
+    oidcDiscoveryCaPem: string;
+    oidcDiscoveryUrl: string;
+}
+/** ⛔ No secret — URLs, public keys, CA certificates, names. */
+export interface BaoJwtAuthConfigAttributes extends BaoJwtAuthConfigCanonical {
+    mount: string;
+    digest: string;
+}
+export declare const canonicalFromProps: (props: BaoJwtAuthConfigProps) => BaoJwtAuthConfigCanonical;
+export declare const canonicalFromLive: (live: Record<string, unknown>) => BaoJwtAuthConfigCanonical;
+export declare const mountOf: (props: {
+    mount?: string;
+}) => string;
+export declare const configPath: (props: {
+    mount?: string;
+}) => string;
+export declare const attributesOf: (props: BaoJwtAuthConfigProps, live: Record<string, unknown>) => BaoJwtAuthConfigAttributes;
+export declare const matches: (attributes: BaoJwtAuthConfigAttributes, props: BaoJwtAuthConfigProps) => boolean;
+/** Every non-secret field — the write is a full replace, so what is left out is reset. */
+export declare const writeBody: (props: BaoJwtAuthConfigProps) => Record<string, unknown>;
+/** Live fields the full-replace write would reset, which this resource deliberately does not model. */
+export declare const wouldErase: (live: Record<string, unknown>) => readonly string[];
+export declare const problems: (props: BaoJwtAuthConfigProps) => readonly string[];
+//# sourceMappingURL=jwt-config-form.d.ts.map

package/dist/openbao/jwt-config-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-config-form.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-config-form.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,+DAA+D;AAC/D,MAAM,WAAW,0BAA2B,SAAQ,yBAAyB;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,eAAO,MAAM,kBAAkB,UAAW,qBAAqB,KAAG,yBAU9D,CAAC;AAEL,eAAO,MAAM,iBAAiB,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,yBAU9D,CAAC;AAEL,eAAO,MAAM,OAAO,UAAW;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,MAAyC,CAAC;AAE9F,eAAO,MAAM,UAAU,UAAW;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,MAAyC,CAAC;AAEjG,eAAO,MAAM,YAAY,UAChB,qBAAqB,QACtB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,0BAGF,CAAC;AAEF,eAAO,MAAM,OAAO,eAAgB,0BAA0B,SAAS,qBAAqB,YACnB,CAAC;AAE1E,0FAA0F;AAC1F,eAAO,MAAM,SAAS,UAAW,qBAAqB,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAS7E,CAAC;AAEH,uGAAuG;AACvG,eAAO,MAAM,UAAU,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,SAAS,MAAM,EAazE,CAAC;AAEF,eAAO,MAAM,QAAQ,UAAW,qBAAqB,KAAG,SAAS,MAAM,EAgBtE,CAAC"}

package/dist/openbao/jwt-config.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `auth/<mount>/config` for a JWT-validating mount — the issuer, keys and algorithms a login token
+ * is checked against. OPTIONAL, NON-SECRET, and deliberately unable to configure an OIDC browser
+ * login: read the ⛔ in jwt-config-form.ts for why `oidc_client_secret` stays out of Alchemy.
+ *
+ * ⚠️ THERE IS NO DELETE. openbao v2.6.2 path_config.go:126-141 defines read and update only; the
+ *   config lives exactly as long as its mount. So `delete` here writes nothing and says so in its
+ *   comment — it cannot be made to "remove" a config, and refusing would wedge every destroy. The
+ *   `retain` default means it only runs when a stack opted into destroy.
+ *
+ * ★ REPLACE SEMANTICS (REPLACE.md): `mount` changed → `replace`: the new mount gets the config;
+ *   the old one keeps its own until that mount is disabled. There is no identity but the mount.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoJwtAuthConfigAttributes, type BaoJwtAuthConfigProps } from './jwt-config-form.ts';
+import { type RoleSpec } from './role-reconcile.ts';
+export type { BaoJwtAuthConfigAttributes, BaoJwtAuthConfigProps } from './jwt-config-form.ts';
+export interface BaoJwtAuthConfig extends Resource<'Bao.JwtAuthConfig', BaoJwtAuthConfigProps, BaoJwtAuthConfigAttributes, never, HttpClient.HttpClient> {
+}
+export declare const BaoJwtAuthConfig: import("alchemy").ResourceClass<BaoJwtAuthConfig>;
+export declare const jwtConfigSpec: (props: BaoJwtAuthConfigProps) => RoleSpec<BaoJwtAuthConfigAttributes>;
+export declare const BaoJwtAuthConfigProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoJwtAuthConfig>, never, HttpClient.HttpClient>;
+//# sourceMappingURL=jwt-config.d.ts.map

package/dist/openbao/jwt-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-config.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAQ3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE9F,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAEH,eAAO,MAAM,aAAa,UACjB,qBAAqB,KAC3B,QAAQ,CAAC,0BAA0B,CAQpC,CAAC;AAEH,eAAO,MAAM,wBAAwB,uGA2BlC,CAAC"}

package/dist/openbao/jwt-role-form.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The form half of Bao.JwtRole — a role on a `jwt` or `oidc` auth mount (one plugin, two names).
+ *
+ * ★ READ FROM openbao v2.6.2 builtin/credential/jwt/path_role.go, NOT RECALLED:
+ *   · The write MERGES (pathRoleCreateUpdate :494-720): almost every field is `GetOk`, so an
+ *     omitted one keeps its stored value — EXCEPT four that are rebuilt from `data.Get` on every
+ *     write and so RESET when omitted: `role_type` (to `oidc`! :520-526), `bound_claims_type`
+ *     (`string`), `callback_mode` (`client`) and `oidc_disable_confirmation` (false). All four are
+ *     managed here, and every managed field is sent on every write, defaults included, so a value
+ *     set by hand cannot survive behind a green plan.
+ *   · `name` is a lower-case string (:77): `Admins` and `admins` are one role. Refused, not folded.
+ *   · A `jwt` role needs one bound constraint (audiences, subject, claims or token CIDRs) and an
+ *     `oidc` role needs allowed_redirect_uris (:694-709) — refused here with the same rule.
+ *   · `bound_claims` is a TypeMap and `claim_mappings` a TypeKVPairs: sent as JSON OBJECTS. A JSON
+ *     string is refused for a map (the ⛔ on mapValue in ssh-role-form.ts, measured 2026-09-21).
+ * ⛔ `verbose_oidc_logging` AND `oidc_disable_confirmation` ARE ALWAYS SENT FALSE, and a live true
+ *   plans `update`. The first logs received tokens and claims at debug level (:189-194); the second
+ *   removes the confirmation page that guards direct-callback logins against token hijacking
+ *   (RFC 8628 5.4, :205-210). Neither is a prop.
+ * ⚠️ LEFT ALONE (merged, never sent): the three leeways, `oauth2_metadata`, `max_age`,
+ *   `poll_interval`, `user_claim_json_pointer`, `token_policies_template_claims`,
+ *   `token_strictly_bind_ip`. A hand-set value there survives, and is not compared.
+ */
+import { type BaoTokenForm, type BaoTokenProps } from './auth-token-form.ts';
+export type BaoJwtRoleType = 'jwt' | 'oidc';
+export type BaoJwtCallbackMode = 'client' | 'device' | 'direct';
+export interface BaoJwtRoleProps extends BaoTokenProps {
+    /** Auth mount path, no trailing slash. Default `jwt`; an OIDC mount is often `oidc`. */
+    mount?: string;
+    /** Role name — lower case, as the server stores it. */
+    name: string;
+    /** ⛔ REQUIRED ON PURPOSE: the server's default is `oidc`, even when re-writing a `jwt` role. */
+    roleType: BaoJwtRoleType;
+    /** The claim that names the entity alias, e.g. `sub` or `email`. */
+    userClaim: string;
+    /** `aud` values; any one must match. */
+    boundAudiences?: readonly string[];
+    /** The `sub` a token must carry. */
+    boundSubject?: string;
+    /** How `boundClaims` values match. Default `string`. */
+    boundClaimsType?: 'glob' | 'string';
+    /** Claims that must match, each a value or a list of acceptable values. */
+    boundClaims?: Readonly<Record<string, string | readonly string[]>>;
+    /** Claim → alias metadata key. `role` is reserved, and two claims may not share a key. */
+    claimMappings?: Readonly<Record<string, string>>;
+    /** The claim that names identity group aliases. */
+    groupsClaim?: string;
+    /** OIDC only: the redirect URIs a login may return to. Required for `oidc`. */
+    allowedRedirectUris?: readonly string[];
+    /** OIDC only: scopes to request beyond `openid`. */
+    oidcScopes?: readonly string[];
+    /** OIDC only. Default `client`. */
+    callbackMode?: BaoJwtCallbackMode;
+}
+/** Every managed field, normalised. Both sides are built by `canonical`, so key order matches. */
+export interface BaoJwtRoleCanonical extends BaoTokenForm {
+    allowedRedirectUris: readonly string[];
+    boundAudiences: readonly string[];
+    boundClaims: Readonly<Record<string, readonly string[]>>;
+    boundClaimsType: string;
+    boundSubject: string;
+    callbackMode: string;
+    claimMappings: Readonly<Record<string, string>>;
+    groupsClaim: string;
+    oidcDisableConfirmation: boolean;
+    oidcScopes: readonly string[];
+    roleType: string;
+    userClaim: string;
+    verboseOidcLogging: boolean;
+}
+/** ⛔ No secret: claim names, audiences, URIs, policy names and TTLs. */
+export interface BaoJwtRoleAttributes extends BaoJwtRoleCanonical {
+    mount: string;
+    name: string;
+    digest: string;
+}
+export declare const canonicalFromProps: (props: BaoJwtRoleProps) => BaoJwtRoleCanonical;
+export declare const canonicalFromLive: (live: Record<string, unknown>) => BaoJwtRoleCanonical;
+export declare const mountOf: (props: {
+    mount?: string;
+}) => string;
+export declare const rolePath: (props: {
+    mount?: string;
+    name: string;
+}) => string;
+export declare const attributesOf: (props: BaoJwtRoleProps, live: Record<string, unknown>) => BaoJwtRoleAttributes;
+export declare const matches: (attributes: BaoJwtRoleAttributes, props: BaoJwtRoleProps) => boolean;
+/** The PUT body — every managed field, the two fixed-false ones included (the ⛔ above). */
+export declare const writeBody: (props: BaoJwtRoleProps) => Record<string, unknown>;
+export declare const problems: (props: BaoJwtRoleProps) => readonly string[];
+//# sourceMappingURL=jwt-role-form.d.ts.map

package/dist/openbao/jwt-role-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-role-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAMnB,MAAM,sBAAsB,CAAC;AAI9B,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,CAAC;AAC5C,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,QAAQ,EAAE,cAAc,CAAC;IACzB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IACpC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnE,0FAA0F;IAC1F,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,oDAAoD;IACpD,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,mCAAmC;IACnC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,kGAAkG;AAClG,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACzD,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,wEAAwE;AACxE,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AA8CD,eAAO,MAAM,kBAAkB,UAAW,eAAe,KAAG,mBAgBxD,CAAC;AAEL,eAAO,MAAM,iBAAiB,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,mBAgB9D,CAAC;AAEL,eAAO,MAAM,OAAO,UAAW;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,MAAyC,CAAC;AAE9F,eAAO,MAAM,QAAQ,UAAW;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KAAG,MACtB,CAAC;AAE9C,eAAO,MAAM,YAAY,UAChB,eAAe,QAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,oBAGF,CAAC;AAEF,eAAO,MAAM,OAAO,eAAgB,oBAAoB,SAAS,eAAe,KAAG,OACV,CAAC;AAE1E,2FAA2F;AAC3F,eAAO,MAAM,SAAS,UAAW,eAAe,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAevE,CAAC;AAIH,eAAO,MAAM,QAAQ,UAAW,eAAe,KAAG,SAAS,MAAM,EAuBhE,CAAC"}

package/dist/openbao/jwt-role.d.ts

@@ -0,0 +1,31 @@
+/**
+ * A role on a `jwt` or `oidc` auth mount — `auth/<mount>/role/<name>`: which tokens may log in,
+ * how the entity is named, and what the resulting OpenBao token carries. METADATA ONLY.
+ *
+ * ⛔ NO SECRET IN PROPS OR ATTRIBUTES — see policy.ts. A role holds claim names, audiences, redirect
+ *   URIs and policy names. The mount's OIDC client secret is config, not role, and stays out of
+ *   Alchemy entirely (the ⛔ in jwt-config.ts).
+ * ⛔ HUMANS GET A NON-ADMIN DEFAULT (machine-access plan, "Admin boundary"): a human role's
+ *   `tokenPolicies` should not include an admin policy, and admin needs login MFA
+ *   (mfa-enforcement.ts). This resource does not know which policy is admin, so it cannot refuse —
+ *   the stack that declares the role owns that line.
+ * ⚠️ DELETING A ROLE DOES NOT REVOKE THE TOKENS IT ISSUED. path_role.go:478 pathRoleDelete removes the
+ *   storage entry and nothing else; those tokens live to their TTL.
+ *
+ * ★ REPLACE SEMANTICS (REPLACE.md): `mount` or `name` changed → `replace`, create-first. The new
+ *   path cannot collide with the old, so no `deleteFirst`. Under the default `retain` the old role
+ *   stays live, and still admits logins, until removed by hand.
+ * ★ `defaultRemovalPolicy: 'retain'`, like every Bao.* family.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoJwtRoleAttributes, type BaoJwtRoleProps } from './jwt-role-form.ts';
+import { type RoleSpec } from './role-reconcile.ts';
+export type { BaoJwtCallbackMode, BaoJwtRoleAttributes, BaoJwtRoleProps, BaoJwtRoleType, } from './jwt-role-form.ts';
+export interface BaoJwtRole extends Resource<'Bao.JwtRole', BaoJwtRoleProps, BaoJwtRoleAttributes, never, HttpClient.HttpClient> {
+}
+export declare const BaoJwtRole: import("alchemy").ResourceClass<BaoJwtRole>;
+export declare const jwtRoleSpec: (props: BaoJwtRoleProps) => RoleSpec<BaoJwtRoleAttributes>;
+export declare const BaoJwtRoleProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoJwtRole>, never, HttpClient.HttpClient>;
+//# sourceMappingURL=jwt-role.d.ts.map

package/dist/openbao/jwt-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-role.d.ts","sourceRoot":"","sources":["../../src/openbao/jwt-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAOrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAEH,eAAO,MAAM,WAAW,UAAW,eAAe,KAAG,QAAQ,CAAC,oBAAoB,CAOhF,CAAC;AAEH,eAAO,MAAM,kBAAkB,iGAoC5B,CAAC"}

package/dist/openbao/kubernetes-role-form.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The form half of Bao.KubernetesRole — `auth/<mount>/role/<name>` on a `kubernetes` auth mount:
+ * which service accounts, in which namespaces, may log in, and what their token carries.
+ *
+ * ★ READ FROM openbao v2.6.2 builtin/credential/kubernetes/path_role.go, NOT RECALLED:
+ *   · The write MERGES for names, namespaces, audience and alias source (`GetOk`, :335-392), but
+ *     `bound_service_account_namespace_selector` is `data.Get` — RESET when omitted (:353). Every
+ *     field is therefore sent on every write, defaults included.
+ *   · Names may not be empty, and `*` may not be mixed with other names; namespaces may be empty
+ *     only when a selector is set, with the same `*` rule (:335-372). Refused here first.
+ *   · Roles are stored under the LOWER-CASED name (:396, backend.go:361), so a mixed-case name
+ *     would read back as a different string. Refused, not folded.
+ *   · `audience` is omitted from a read when empty (:206-208); read as `''`.
+ * ⚠️ `aliasNameSource` DECIDES WHO A POD IS. `serviceaccount_uid` (OpenBao's default) names the
+ *   entity alias by the service account's UID; `serviceaccount_name` by `<namespace>/<name>`
+ *   (backend.go:30-34). Changing it on a live role re-names every pod's alias, so their next logins
+ *   land on NEW entities and attribution splits.
+ * ⛔ SO IT IS REQUIRED, NOT DEFAULTED (review 2026-09-21). Every field is sent on every write, so a
+ *   default here would be WRITTEN: adopting a hand-made `serviceaccount_name` role with the prop
+ *   left out would plan a bare `update` and silently re-key every pod onto new entities. The
+ *   machine-access plan chose `serviceaccount_name`; the server's default is the other one — a
+ *   choice this important is made in the declaration, the way Bao.JwtRole's `roleType` is.
+ */
+import { type BaoTokenForm, type BaoTokenProps } from './auth-token-form.ts';
+export type BaoKubernetesAliasSource = 'serviceaccount_name' | 'serviceaccount_uid';
+export interface BaoKubernetesRoleProps extends BaoTokenProps {
+    /** Auth mount path. Default `kubernetes`. */
+    mount?: string;
+    /** Role name — lower case, as the server stores it. */
+    name: string;
+    /** Service account names; `['*']` for any. Never empty. */
+    boundServiceAccountNames: readonly string[];
+    /** Namespaces; `['*']` for any. May be empty only with a selector. */
+    boundServiceAccountNamespaces?: readonly string[];
+    /** A label selector (JSON or YAML) for namespaces, ORed with the list. */
+    boundServiceAccountNamespaceSelector?: string;
+    /** The `aud` a service account token must carry. Default none. */
+    audience?: string;
+    /** ⛔ Required — read the ⚠️ and ⛔ above before changing it on a live role. */
+    aliasNameSource: BaoKubernetesAliasSource;
+}
+export interface BaoKubernetesRoleCanonical extends BaoTokenForm {
+    aliasNameSource: string;
+    audience: string;
+    boundServiceAccountNames: readonly string[];
+    boundServiceAccountNamespaceSelector: string;
+    boundServiceAccountNamespaces: readonly string[];
+}
+/** ⛔ No secret: account names, namespaces, policy names, TTLs. */
+export interface BaoKubernetesRoleAttributes extends BaoKubernetesRoleCanonical {
+    mount: string;
+    name: string;
+    digest: string;
+}
+export declare const canonicalFromProps: (props: BaoKubernetesRoleProps) => BaoKubernetesRoleCanonical;
+export declare const canonicalFromLive: (live: Record<string, unknown>) => BaoKubernetesRoleCanonical;
+export declare const mountOf: (props: {
+    mount?: string;
+}) => string;
+export declare const rolePath: (props: {
+    mount?: string;
+    name: string;
+}) => string;
+export declare const attributesOf: (props: BaoKubernetesRoleProps, live: Record<string, unknown>) => BaoKubernetesRoleAttributes;
+export declare const matches: (attributes: BaoKubernetesRoleAttributes, props: BaoKubernetesRoleProps) => boolean;
+export declare const writeBody: (props: BaoKubernetesRoleProps) => Record<string, unknown>;
+export declare const problems: (props: BaoKubernetesRoleProps) => readonly string[];
+//# sourceMappingURL=kubernetes-role-form.d.ts.map

package/dist/openbao/kubernetes-role-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/kubernetes-role-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAMnB,MAAM,sBAAsB,CAAC;AAI9B,MAAM,MAAM,wBAAwB,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEpF,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,sEAAsE;IACtE,6BAA6B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,0EAA0E;IAC1E,oCAAoC,CAAC,EAAE,MAAM,CAAC;IAC9C,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,eAAe,EAAE,wBAAwB,CAAC;CAC3C;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,oCAAoC,EAAE,MAAM,CAAC;IAC7C,6BAA6B,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED,kEAAkE;AAClE,MAAM,WAAW,2BAA4B,SAAQ,0BAA0B;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAgBD,eAAO,MAAM,kBAAkB,UAAW,sBAAsB,KAAG,0BAQ/D,CAAC;AAEL,eAAO,MAAM,iBAAiB,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,0BAQ9D,CAAC;AAEL,eAAO,MAAM,OAAO,UAAW;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,MACZ,CAAC;AAEzC,eAAO,MAAM,QAAQ,UAAW;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KAAG,MACtB,CAAC;AAE9C,eAAO,MAAM,YAAY,UAChB,sBAAsB,QACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,2BAGF,CAAC;AAEF,eAAO,MAAM,OAAO,eACN,2BAA2B,SAChC,sBAAsB,KAC5B,OAAkF,CAAC;AAEtF,eAAO,MAAM,SAAS,UAAW,sBAAsB,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAO9E,CAAC;AAMH,eAAO,MAAM,QAAQ,UAAW,sBAAsB,KAAG,SAAS,MAAM,EAavE,CAAC"}

package/dist/openbao/kubernetes-role.d.ts

@@ -0,0 +1,25 @@
+/**
+ * A role on a `kubernetes` auth mount — `auth/<mount>/role/<name>`: which service accounts may log
+ * in and what their token carries. METADATA ONLY. The machine-access plan gives k8s pods this
+ * instead of AppRole: one role per namespace/service account.
+ *
+ * ⛔ NO SECRET IN PROPS OR ATTRIBUTES — see policy.ts. The mount's own config (the cluster's CA and
+ *   the token reviewer JWT) is not declared here, and the reviewer JWT must never be.
+ * ⚠️ DELETING A ROLE DOES NOT REVOKE THE TOKENS IT ISSUED — pathRoleDelete removes the storage entry
+ *   and nothing else (path_role.go:239-256).
+ *
+ * ★ REPLACE SEMANTICS (REPLACE.md): `mount` or `name` changed → `replace`, create-first (the new
+ *   path cannot collide). Under the default `retain` the old role stays live until removed by hand.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoKubernetesRoleAttributes, type BaoKubernetesRoleProps } from './kubernetes-role-form.ts';
+import { type RoleSpec } from './role-reconcile.ts';
+export type { BaoKubernetesAliasSource, BaoKubernetesRoleAttributes, BaoKubernetesRoleProps, } from './kubernetes-role-form.ts';
+export interface BaoKubernetesRole extends Resource<'Bao.KubernetesRole', BaoKubernetesRoleProps, BaoKubernetesRoleAttributes, never, HttpClient.HttpClient> {
+}
+export declare const BaoKubernetesRole: import("alchemy").ResourceClass<BaoKubernetesRole>;
+export declare const kubernetesRoleSpec: (props: BaoKubernetesRoleProps) => RoleSpec<BaoKubernetesRoleAttributes>;
+export declare const BaoKubernetesRoleProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoKubernetesRole>, never, HttpClient.HttpClient>;
+//# sourceMappingURL=kubernetes-role.d.ts.map

package/dist/openbao/kubernetes-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes-role.d.ts","sourceRoot":"","sources":["../../src/openbao/kubernetes-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAO5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,KAAK,QAAQ,EAAuC,MAAM,qBAAqB,CAAC;AAEzF,YAAY,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,kBAAkB,UACtB,sBAAsB,KAC5B,QAAQ,CAAC,2BAA2B,CAOrC,CAAC;AAEH,eAAO,MAAM,yBAAyB,wGAiCnC,CAAC"}

package/dist/openbao/mfa-enforcement-form.d.ts

@@ -0,0 +1,46 @@
+export interface BaoMfaLoginEnforcementProps {
+    /** Enforcement name, unique per namespace. */
+    name: string;
+    /** Method ids — typically `[totp.methodId]`. Any ONE listed method passing is enough. */
+    mfaMethodIds: readonly string[];
+    /**
+     * Auth mount PATHS (`oidc`, `jwt`), resolved to their accessors at plan and deploy time.
+     * ⚠️ A plain string makes no graph edge. When the mount is a BaoAuthMethod in the same stack, pass
+     *   its output (`[oidc.path]`) so it exists before this resolves — otherwise the deploy can reach
+     *   this first and refuse with "no auth mount at …".
+     */
+    authMethodPaths?: readonly string[];
+    /** Raw accessors (`auth_jwt_…`), for a mount outside this stack. */
+    authMethodAccessors?: readonly string[];
+    /** Auth mount TYPES — read the ⚠️ above first. */
+    authMethodTypes?: readonly string[];
+    /** Identity group ids whose members must pass MFA, on any mount. */
+    identityGroupIds?: readonly string[];
+    /** Identity entity ids, likewise. */
+    identityEntityIds?: readonly string[];
+}
+/** The live shape, and the declared one once paths are resolved to accessors. */
+export interface BaoMfaEnforcementCanonical {
+    authMethodAccessors: readonly string[];
+    authMethodTypes: readonly string[];
+    identityEntityIds: readonly string[];
+    identityGroupIds: readonly string[];
+    mfaMethodIds: readonly string[];
+}
+/** ⛔ No secret — ids, accessors and names. */
+export interface BaoMfaLoginEnforcementAttributes extends BaoMfaEnforcementCanonical {
+    name: string;
+    /** The server-made id. */
+    enforcementId: string;
+    namespacePath: string;
+    digest: string;
+}
+/** The declaration, with `authMethodPaths` already resolved into `resolved` accessors. */
+export declare const canonicalFromProps: (props: BaoMfaLoginEnforcementProps, resolved: readonly string[]) => BaoMfaEnforcementCanonical;
+export declare const canonicalFromLive: (live: Record<string, unknown>) => BaoMfaEnforcementCanonical;
+export declare const attributesOf: (name: string, live: Record<string, unknown>) => BaoMfaLoginEnforcementAttributes;
+export declare const matches: (attributes: BaoMfaLoginEnforcementAttributes, props: BaoMfaLoginEnforcementProps, resolved: readonly string[]) => boolean;
+/** Every list, as a JSON array, every time — the ⚠️ on GetOk above. */
+export declare const writeBody: (form: BaoMfaEnforcementCanonical) => Record<string, unknown>;
+export declare const problems: (props: BaoMfaLoginEnforcementProps, missingPaths: readonly string[]) => readonly string[];
+//# sourceMappingURL=mfa-enforcement-form.d.ts.map

package/dist/openbao/mfa-enforcement-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-enforcement-form.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-enforcement-form.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,2BAA2B;IAC1C,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,kDAAkD;IAClD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,qCAAqC;IACrC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,iFAAiF;AACjF,MAAM,WAAW,0BAA0B;IACzC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAED,8CAA8C;AAC9C,MAAM,WAAW,gCAAiC,SAAQ,0BAA0B;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAgBD,0FAA0F;AAC1F,eAAO,MAAM,kBAAkB,UACtB,2BAA2B,YACxB,SAAS,MAAM,EAAE,KAC1B,0BAOC,CAAC;AAEL,eAAO,MAAM,iBAAiB,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,0BAO9D,CAAC;AAEL,eAAO,MAAM,YAAY,SACjB,MAAM,QACN,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,gCASF,CAAC;AAEF,eAAO,MAAM,OAAO,eACN,gCAAgC,SACrC,2BAA2B,YACxB,SAAS,MAAM,EAAE,KAC1B,OAA4F,CAAC;AAEhG,uEAAuE;AACvE,eAAO,MAAM,SAAS,SAAU,0BAA0B,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAMjF,CAAC;AAIH,eAAO,MAAM,QAAQ,UACZ,2BAA2B,gBACpB,SAAS,MAAM,EAAE,KAC9B,SAAS,MAAM,EAgBjB,CAAC"}

package/dist/openbao/mfa-enforcement.d.ts

@@ -0,0 +1,41 @@
+/**
+ * A login-MFA enforcement — `identity/mfa/login-enforcement/<name>`: logins through these mounts
+ * (or by these groups/entities) must also pass one of these MFA methods. The machine-access plan's
+ * "admin requires OpenBao login MFA" is this resource.
+ *
+ * ⛔ ENROL BEFORE YOU ENFORCE. A login the enforcement matches, by an entity with no secret for any
+ *   listed method, FAILS (login_mfa.go validateLoginMFAInternal: "MFA secret … not present"). Enrol
+ *   every admin (`identity/mfa/method/totp/admin-generate`, which RETURNS the secret — never through
+ *   Alchemy) before the first deploy of this, or the admin lane locks itself out.
+ * ⚠️ IT MATCHES MOUNTS, GROUPS AND ENTITIES — NEVER ROLES. An enforcement on the `jwt/` accessor
+ *   covers every role on that mount (login_mfa.go buildMFAEnforcementConfigList :932-1017). To put
+ *   MFA on admin only, give admin its own auth mount, or target an identity group of admins.
+ * ⛔ THE DELETE IS REFUSED: IN 2.6.2 IT DOES NOT STICK. DeleteMFALoginEnforcementConfigByNameAndNamespace
+ *   (login_mfa.go:1879-1902) removes the entry from memory and never from storage, so it RETURNS on the
+ *   next unseal — tracked upstream as openbao/openbao#4030, open on 2026-09-21. Worse, a method
+ *   deleted in between leaves the resurrected enforcement naming an id that no longer exists, and
+ *   every login it matches then fails ("MFA method configuration not present", :871-877). A delete
+ *   that reports success and quietly comes back is the lie this package refuses to tell. Under the
+ *   default `retain` it never runs; with `destroy`, set `retain` to drop it from state and leave it
+ *   live — which is what the server would do anyway.
+ *
+ * ★ REPLACE SEMANTICS (REPLACE.md): `name` changed → `replace`, create-first (names are per
+ *   namespace; the new one cannot collide). Under `retain` BOTH enforcements then apply — fail
+ *   closed. Under `destroy` the old one's delete is refused, so the deploy stops after creating.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+import { type BaoMfaLoginEnforcementAttributes, type BaoMfaLoginEnforcementProps } from './mfa-enforcement-form.ts';
+export type { BaoMfaLoginEnforcementAttributes, BaoMfaLoginEnforcementProps, } from './mfa-enforcement-form.ts';
+export interface BaoMfaLoginEnforcement extends Resource<'Bao.MfaLoginEnforcement', BaoMfaLoginEnforcementProps, BaoMfaLoginEnforcementAttributes, never, HttpClient.HttpClient> {
+}
+export declare const BaoMfaLoginEnforcement: import("alchemy").ResourceClass<BaoMfaLoginEnforcement>;
+type Env = HttpClient.HttpClient;
+export declare const planEnforcement: (props: BaoMfaLoginEnforcementProps) => Effect.Effect<'noop' | 'update', BaoError, Env>;
+/** Write when live differs, then prove it by reading back. */
+export declare const reconcileEnforcement: (props: BaoMfaLoginEnforcementProps) => Effect.Effect<BaoMfaLoginEnforcementAttributes, BaoError, Env>;
+export declare const BaoMfaLoginEnforcementProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoMfaLoginEnforcement>, never, HttpClient.HttpClient>;
+//# sourceMappingURL=mfa-enforcement.d.ts.map

package/dist/openbao/mfa-enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-enforcement.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAMjC,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,sBAAuB,SAAQ,QAAQ,CACtD,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,sBAAsB,yDAEjC,CAAC;AAEH,KAAK,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC;AAmBjC,eAAO,MAAM,eAAe,UACnB,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAM7C,CAAC;AAEL,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,UACxB,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,gCAAgC,EAAE,QAAQ,EAAE,GAAG,CAe5D,CAAC;AAEL,eAAO,MAAM,8BAA8B,6GAkCxC,CAAC"}

package/dist/openbao/mfa-totp-form.d.ts

@@ -0,0 +1,52 @@
+export type BaoTotpAlgorithm = 'SHA1' | 'SHA256' | 'SHA512';
+export interface BaoMfaTotpMethodProps {
+    /** `method_name` — the declarative key, unique per namespace. ⛔ A rename is refused (mfa-totp.ts). */
+    name: string;
+    /** The issuer an authenticator app shows, e.g. `vault-example`. */
+    issuer: string;
+    /** Code lifetime. Default `30s`. */
+    period?: string;
+    /** Secret size in bytes. Default 20. */
+    keySize?: number;
+    /** QR code size in pixels; `0` for none. Default 200. */
+    qrSize?: number;
+    /** Default `SHA1` — the one every authenticator app supports. */
+    algorithm?: BaoTotpAlgorithm;
+    /** Default 6. */
+    digits?: 6 | 8;
+    /** Periods of clock skew accepted. Default 1. */
+    skew?: 0 | 1;
+    /** Failed codes before the entity is locked out of this method. Default 5. */
+    maxValidationAttempts?: number;
+}
+export interface BaoMfaTotpCanonical {
+    algorithm: string;
+    digits: number;
+    issuer: string;
+    keySize: number;
+    maxValidationAttempts: number;
+    periodSeconds: number;
+    qrSize: number;
+    skew: number;
+}
+export interface BaoMfaTotpMethodAttributes extends BaoMfaTotpCanonical {
+    /** The server-made UUID — what a Bao.MfaLoginEnforcement names in `mfaMethodIds`. */
+    methodId: string;
+    name: string;
+    /** `''` for root, `team-a/` below it. */
+    namespacePath: string;
+    digest: string;
+}
+export declare const canonicalFromProps: (props: BaoMfaTotpMethodProps) => BaoMfaTotpCanonical;
+export declare const canonicalFromLive: (live: Record<string, unknown>) => BaoMfaTotpCanonical;
+export declare const attributesOf: (methodId: string, live: Record<string, unknown>) => BaoMfaTotpMethodAttributes;
+export declare const matches: (attributes: BaoMfaTotpMethodAttributes, props: BaoMfaTotpMethodProps) => boolean;
+/** The upsert body — by `method_name`, never `method_id` (mfa-wire.ts). */
+export declare const writeBody: (props: BaoMfaTotpMethodProps) => Record<string, unknown>;
+/**
+ * The diff's refusal for a changed name, or undefined when the name is unchanged. Never a
+ * `replace`: the ⛔ on a rename in mfa-totp.ts says why.
+ */
+export declare const renameProblem: (from: string, to: string) => string | undefined;
+export declare const problems: (props: BaoMfaTotpMethodProps) => readonly string[];
+//# sourceMappingURL=mfa-totp-form.d.ts.map

package/dist/openbao/mfa-totp-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-totp-form.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-totp-form.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE5D,MAAM,WAAW,qBAAqB;IACpC,sGAAsG;IACtG,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,iBAAiB;IACjB,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,iDAAiD;IACjD,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACb,8EAA8E;IAC9E,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,0BAA2B,SAAQ,mBAAmB;IACrE,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAaD,eAAO,MAAM,kBAAkB,UAAW,qBAAqB,KAAG,mBAU9D,CAAC;AAKL,eAAO,MAAM,iBAAiB,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,mBAU9D,CAAC;AAEL,eAAO,MAAM,YAAY,aACb,MAAM,QACV,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,0BASF,CAAC;AAEF,eAAO,MAAM,OAAO,eAAgB,0BAA0B,SAAS,qBAAqB,YACnB,CAAC;AAE1E,2EAA2E;AAC3E,eAAO,MAAM,SAAS,UAAW,qBAAqB,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAa9E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,SAAU,MAAM,MAAM,MAAM,KAAG,MAAM,GAAG,SAK5C,CAAC;AAEvB,eAAO,MAAM,QAAQ,UAAW,qBAAqB,KAAG,SAAS,MAAM,EAWtE,CAAC"}

package/dist/openbao/mfa-totp.d.ts

@@ -0,0 +1,33 @@
+/**
+ * A TOTP login-MFA method — `identity/mfa/method/totp`, found by `method_name`. The method is
+ * policy only: issuer, period, digits. Its `methodId` is what a Bao.MfaLoginEnforcement names.
+ *
+ * ⛔ A RENAME IS REFUSED, NOT REPLACED. A new name is a new method with a new id, and every entity's
+ *   enrolled secret belongs to the OLD id (login_mfa.go validateTOTP reads `entity.MFASecrets[id]`).
+ *   The enforcement would follow the new id in the same deploy, and every enrolled admin would then
+ *   fail MFA — with nobody left able to log in and re-enrol them. The safe move is additive: declare
+ *   the new method as a SECOND resource, list both ids on the enforcement (any one method passes,
+ *   login_mfa.go:831-858), enrol everyone, then drop the old one.
+ * ⛔ DELETING THE METHOD DESTROYS EVERY ENROLLED SECRET FOR IT (mfa-wire.ts deleteTotp) — and with
+ *   openbao/openbao#4030, a deleted enforcement can come back after a restart still naming this id,
+ *   failing every login it matches. `retain` is the default for exactly that reason.
+ *
+ * ★ REPLACE SEMANTICS (REPLACE.md): never `replace`. `name` changed → the plan FAILS (above); any
+ *   other field is an in-place `update`, because the upsert keeps the id.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+import { type BaoMfaTotpMethodAttributes, type BaoMfaTotpMethodProps } from './mfa-totp-form.ts';
+export type { BaoMfaTotpMethodAttributes, BaoMfaTotpMethodProps, BaoTotpAlgorithm, } from './mfa-totp-form.ts';
+export interface BaoMfaTotpMethod extends Resource<'Bao.MfaTotpMethod', BaoMfaTotpMethodProps, BaoMfaTotpMethodAttributes, never, HttpClient.HttpClient> {
+}
+export declare const BaoMfaTotpMethod: import("alchemy").ResourceClass<BaoMfaTotpMethod>;
+export declare const readTotp: (props: BaoMfaTotpMethodProps) => Effect.Effect<BaoMfaTotpMethodAttributes | undefined, BaoError, HttpClient.HttpClient>;
+export declare const planTotp: (props: BaoMfaTotpMethodProps) => Effect.Effect<'noop' | 'update', BaoError, HttpClient.HttpClient>;
+/** Upsert by name when live differs, then prove it by reading back. */
+export declare const reconcileTotp: (props: BaoMfaTotpMethodProps) => Effect.Effect<BaoMfaTotpMethodAttributes, BaoError, HttpClient.HttpClient>;
+export declare const BaoMfaTotpMethodProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoMfaTotpMethod>, never, HttpClient.HttpClient>;
+//# sourceMappingURL=mfa-totp.d.ts.map

package/dist/openbao/mfa-totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-totp.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAM3B,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAE3B,CAAC;AAKH,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAGrF,CAAC;AAEJ,eAAO,MAAM,QAAQ,UACZ,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK/D,CAAC;AAEL,uEAAuE;AACvE,eAAO,MAAM,aAAa,UACjB,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAWxE,CAAC;AAEL,eAAO,MAAM,wBAAwB,uGA8BlC,CAAC"}

package/dist/openbao/mfa-wire.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The OpenBao calls behind login MFA: TOTP methods under identity/mfa/method/totp, login
+ * enforcements under identity/mfa/login-enforcement/<name>, and the auth table that turns a mount
+ * path into the accessor an enforcement names.
+ *
+ * ★ OpenBao 2.6.2 SHIPS LOGIN MFA — confirmed in source before any of this was written:
+ *   vault/identity/store.go:312-800 (mfaPaths) registers `mfa/method/totp`, `mfa/login-enforcement/
+ *   <name>` and their listings on the identity backend; vault/identity/mfa.go holds the handlers
+ *   and vault/login_mfa.go the storage.
+ * ★ A TOTP METHOD IS FOUND BY NAME, NOT ID. The id is a server-made UUID; `method_name` is the only
+ *   thing a declaration can know. An update without `method_id` UPSERTS by name within the request's
+ *   namespace (identity/mfa.go:159-230, MemDBMFAConfigByName keys on namespace + name), so the same
+ *   write both creates and updates. The listing (`key_info`, one entry per id, :63-69) answers the
+ *   methods of this namespace AND its parents (login_mfa.go:652-713), so the match also requires
+ *   this namespace's `namespace_path`.
+ * ⛔ THE NAME INDEX IGNORES THE TYPE, SO THIS LISTS EVERY TYPE. login_mfa.go's `name` index is
+ *   (namespace_id, name) across all methods (:1642-1655, :1818), and handleMFAMethodUpdateCommon
+ *   then sets `mConfig.Type = "totp"` on whatever it found (identity/mfa.go:228). A TOTP write under
+ *   the name of a Duo or Okta method would silently CONVERT that method — and every enforcement
+ *   naming its id would start demanding a TOTP code nobody is enrolled for. The per-type listing
+ *   (`.../method/totp?list=true`) cannot see the clash, so this reads the global one
+ *   (`identity/mfa/method?list=true`, store.go:335) and refuses a same-named method of
+ *   another type. ⚠️ The deploying token needs `list` on `identity/mfa/method`.
+ * ⚠️ AN UPDATE BY A STALE `method_id` IS A SILENT NO-OP: the handler returns nil for an unknown id
+ *   (identity/mfa.go:172-183), which HTTP answers 204. So this never writes by id.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+export declare const TOTP_PATH = "identity/mfa/method/totp";
+/** Every MFA method of every type — the only listing that can see a name clash across types. */
+export declare const METHODS_PATH = "identity/mfa/method";
+export declare const enforcementPath: (name: string) => string;
+/** This call's namespace as OpenBao writes `namespace_path`: `''` or `team-a/`. */
+export declare const ownNamespacePath: Effect.Effect<string>;
+export type TotpEntry = {
+    readonly id: string;
+    readonly live: Record<string, unknown>;
+};
+/**
+ * The TOTP method named `name` in this namespace, or undefined. Dies when the name belongs to a
+ * method of ANOTHER type here — writing would convert it (the ⛔ above).
+ */
+export declare const findTotp: (name: string) => Effect.Effect<TotpEntry | undefined, BaoError, HttpClient.HttpClient>;
+/** Create-or-update by `method_name` — never by id (the ⚠️ above). */
+export declare const writeTotp: (body: Readonly<Record<string, unknown>>) => Effect.Effect<void, BaoError, HttpClient.HttpClient>;
+/**
+ * ⛔ DESTROYS EVERY ENTITY'S ENROLLED SECRET FOR THIS METHOD (login_mfa.go:1965-1973 clears the TOTP
+ *   keys under the method id). OpenBao refuses it while an enforcement in memory still names the id
+ *   (:1914-1924) — a refusal this passes on.
+ */
+export declare const deleteTotp: (id: string) => Effect.Effect<void, BaoError, HttpClient.HttpClient>;
+export declare const readEnforcement: (name: string) => Effect.Effect<Record<string, unknown> | undefined, BaoError, HttpClient.HttpClient>;
+export declare const writeEnforcement: (name: string, body: Readonly<Record<string, unknown>>) => Effect.Effect<void, BaoError, HttpClient.HttpClient>;
+/**
+ * Accessors for auth mount paths, from `GET sys/auth` (keys are `<path>/`). A path with no mount
+ * comes back in `missing`, never as a guess.
+ */
+export declare const authAccessors: (paths: readonly string[]) => Effect.Effect<{
+    readonly accessors: readonly string[];
+    readonly missing: readonly string[];
+}, BaoError, HttpClient.HttpClient>;
+//# sourceMappingURL=mfa-wire.d.ts.map

package/dist/openbao/mfa-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/mfa-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGhD,eAAO,MAAM,SAAS,6BAA6B,CAAC;AACpD,gGAAgG;AAChG,eAAO,MAAM,YAAY,wBAAwB,CAAC;AAClD,eAAO,MAAM,eAAe,SAAU,MAAM,KAAG,MAAkD,CAAC;AAOlG,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAGjD,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAExF;;;GAGG;AACH,eAAO,MAAM,QAAQ,SACb,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAmBnE,CAAC;AAEL,sEAAsE;AACtE,eAAO,MAAM,SAAS,SAAU,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,yDACP,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,UAAU,OAAQ,MAAM,yDAAoC,CAAC;AAE1E,eAAO,MAAM,eAAe,SAAU,MAAM,wFAAmC,CAAC;AAEhF,eAAO,MAAM,gBAAgB,SAAU,MAAM,QAAQ,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,yDAChB,CAAC;AAEvE;;;GAGG;AACH,eAAO,MAAM,aAAa,UACjB,SAAS,MAAM,EAAE,KACvB,MAAM,CAAC,MAAM,CACd;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAC9E,QAAQ,EACR,UAAU,CAAC,UAAU,CAanB,CAAC"}

package/dist/openbao/mount-form.d.ts

@@ -17,6 +17,13 @@ export interface BaoMountProps {
     maxLeaseTtl?: string;
     /** KV only — sent as `options.version` on enable, as `-version=2` was. Immutable after create. */
     version?: 1 | 2;
+    /**
+     * The path this mount lives at NOW, when `path` is where it should move to. Moves it with
+     * `sys/remount`, keeping every secret. Without it, a changed `path` fails the plan — see
+     * mount-move.ts. ⛔ Every lease under the old path is revoked, and policies are not rewritten.
+     * Harmless to leave declared after the move: once state holds `path`, it is ignored.
+     */
+    remountFrom?: string;
 }
 export interface BaoMountAttributes {
     path: string;