@homeflare/alchemy 0.5.0 → 0.7.0

package/dist/openbao/mount-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount-form.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-form.ts"],"names":[],"mappings":"AAEA,0FAA0F;AAC1F,eAAO,MAAM,SAAS,SAAU,MAAM,WAA6B,CAAC;AAIpE,qEAAqE;AACrE,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MAAM,GAAG,SAkBrD,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,UAAU,UAAW,OAAO,KAAG,MAAM,GAAG,SAIpD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAiBD,eAAO,MAAM,YAAY,UAChB,aAAa,QACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,kBAYF,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAoC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,WAA6B,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CACsB,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMpE,CAAC;AASF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,kBAAkB,SAAS,aAAa,YAIxB,CAAC;AAErD,eAAO,MAAM,SAAS,UAAW,aAAa,YAGb,CAAC"}
+{"version":3,"file":"mount-form.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-form.ts"],"names":[],"mappings":"AAGA,0FAA0F;AAC1F,eAAO,MAAM,SAAS,SAAU,MAAM,WAA8B,CAAC;AAIrE,qEAAqE;AACrE,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MAAM,GAAG,SAkBrD,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,UAAU,UAAW,OAAO,KAAG,MAAM,GAAG,SAIpD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAChB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAiBD,eAAO,MAAM,YAAY,UAChB,aAAa,QACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,kBAYF,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAoC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,WAA6B,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CACsB,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMpE,CAAC;AASF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,kBAAkB,SAAS,aAAa,YAIxB,CAAC;AAErD,eAAO,MAAM,SAAS,UAAW,aAAa,YAGb,CAAC"}

package/dist/openbao/mount-move.d.ts

@@ -0,0 +1,49 @@
+/**
+ * What a changed path means for Bao.Mount and Bao.AuthMethod — and the move, when one is declared.
+ *
+ * ⛔ A CHANGED PATH USED TO PLAN `update` AND ENABLE AN EMPTY MOUNT AT THE NEW PATH. diff read the
+ *   new path, found nothing, answered `update`, and reconcile ran `enable` there: a fresh, empty
+ *   `kv2/` beside the retained `kv/` that still held every secret, with Alchemy's state now naming
+ *   only the empty one. Nothing failed, so nothing said so (site-config plan, Guards).
+ * ★ NOW A CHANGED PATH FAILS AT PLAN TIME, unless the declaration says where it came from:
+ *   `remountFrom: '<old path>'` moves the mount with `sys/remount` (remount-wire.ts), which keeps
+ *   every secret. A genuinely new, empty mount is a new resource id, never an edited path.
+ * ★ THE MOVE IS DECIDED BY LIVE STATE, SO A RE-RUN CONVERGES. Source present and target absent is
+ *   a move; target present and source absent is a move that already happened; both present, or
+ *   neither, is a refusal — "neither" in particular is exactly the empty-mount failure above.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+import { type RemountError, type RemountOptions } from './remount-wire.ts';
+export type Move = {
+    readonly kind: 'stay';
+} | {
+    readonly kind: 'move';
+    readonly from: string;
+} | {
+    readonly kind: 'refuse';
+    readonly message: string;
+};
+/**
+ * @param family  `Bao.Mount` or `Bao.AuthMethod`, for the message.
+ * @param stated  the path Alchemy's state holds, or undefined on a first reconcile.
+ * @param path    the declared path.
+ * @param remountFrom the declared source, if any.
+ */
+export declare const planMove: (family: string, stated: string | undefined, path: string, remountFrom: string | undefined) => Move;
+export interface MoveTarget {
+    readonly family: string;
+    /** Declared path, bare. */
+    readonly path: string;
+    readonly type: string;
+    /** Read one path's live entry — undefined when absent. */
+    readonly read: (path: string) => Effect.Effect<{
+        readonly type: string;
+    } | undefined, BaoError, HttpClient.HttpClient>;
+    /** The path as sys/remount takes it: the bare path for secrets, `auth/<path>` for auth. */
+    readonly wire: (path: string) => string;
+}
+/** Perform a planned move, deciding by live state. Returns once the target is in place. */
+export declare const performMove: (target: MoveTarget, from: string, options?: RemountOptions) => Effect.Effect<void, BaoError | RemountError, HttpClient.HttpClient>;
+//# sourceMappingURL=mount-move.d.ts.map

package/dist/openbao/mount-move.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-move.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-move.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAkB,MAAM,mBAAmB,CAAC;AAE3F,MAAM,MAAM,IAAI,GACZ;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,WACX,MAAM,UACN,MAAM,GAAG,SAAS,QACpB,MAAM,eACC,MAAM,GAAG,SAAS,KAC9B,IAyBF,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,CACb,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC3F,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACzC;AAID,2FAA2F;AAC3F,eAAO,MAAM,WAAW,WACd,UAAU,QACZ,MAAM,YACF,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CA6BjE,CAAC"}

package/dist/openbao/mount-path.d.ts

@@ -1,10 +1,14 @@
 /**
- * Slash trimming for caller-supplied mount paths.
+ * Trimming runs of one character from caller-supplied paths and names.
  *
- * ★ LOOPS, NOT `/^\/+|\/+$/g` OR `/\/+$/`. A trailing `\/+$` backtracks polynomially on a long run
- *   of `/` followed by anything else (CodeQL js/polynomial-redos), and mount paths are caller input.
- *   Both loops are linear in the input length.
+ * ★ LOOPS, NOT `/^\/+|\/+$/g`, `/\/+$/` OR `/^-+|-+$/g`. A trailing `x+$` backtracks polynomially
+ *   on a long run of `x` followed by anything else (CodeQL js/polynomial-redos), and mount paths,
+ *   namespaces and slugs are caller input. Every loop here is linear in the input length.
  */
+/** `text` without a trailing run of `char` (one UTF-16 unit). */
+export declare const trimTrailing: (text: string, char: string) => string;
+/** `text` without a leading or trailing run of `char` (one UTF-16 unit). */
+export declare const trimRuns: (text: string, char: string) => string;
 /** `text` without trailing `/`. */
 export declare const trimTrailingSlashes: (text: string) => string;
 /** `text` without leading or trailing `/`. */

package/dist/openbao/mount-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount-path.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-path.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mCAAmC;AACnC,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAIlD,CAAC;AAEF,8CAA8C;AAC9C,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,MAI1C,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,UAAU,UAAW,MAAM,GAAG,SAAS,KAAG,MAClB,CAAC"}
+{"version":3,"file":"mount-path.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-path.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,iEAAiE;AACjE,eAAO,MAAM,YAAY,SAAU,MAAM,QAAQ,MAAM,KAAG,MAIzD,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,QAAQ,SAAU,MAAM,QAAQ,MAAM,KAAG,MAIrD,CAAC;AAEF,mCAAmC;AACnC,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAAiC,CAAC;AAErF,8CAA8C;AAC9C,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,MAA6B,CAAC;AAEzE,kFAAkF;AAClF,eAAO,MAAM,UAAU,UAAW,MAAM,GAAG,SAAS,KAAG,MAClB,CAAC"}

package/dist/openbao/mount-reconcile.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Bao.Mount's read and reconcile as plain effects — split from mount.ts so the move (and its
+ * refusals) run against a fake server, not only in a reviewer's head.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+import { type BaoMountAttributes, type BaoMountProps } from './mount-form.ts';
+import type { RemountError, RemountOptions } from './remount-wire.ts';
+export declare const readMount: (props: BaoMountProps) => Effect.Effect<BaoMountAttributes | undefined, BaoError, HttpClient.HttpClient>;
+/**
+ * Converge one mount. `stated` is the path in Alchemy's state (undefined on a first reconcile).
+ * Dies on a refusal; fails with OpenBao's own error on a refused call.
+ */
+export declare const reconcileMount: (news: BaoMountProps, stated: string | undefined, options?: RemountOptions) => Effect.Effect<BaoMountAttributes, BaoError | RemountError, HttpClient.HttpClient>;
+//# sourceMappingURL=mount-reconcile.d.ts.map

package/dist/openbao/mount-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/mount-reconcile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAKnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,SAAS,UACb,aAAa,KACnB,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAK5E,CAAC;AAUL;;;GAGG;AACH,eAAO,MAAM,cAAc,SACnB,aAAa,UACX,MAAM,GAAG,SAAS,YAChB,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CA8B/E,CAAC"}

package/dist/openbao/mount.d.ts

@@ -7,6 +7,15 @@
  *
  * ★ `defaultRemovalPolicy: 'retain'` — disabling a mount destroys every secret under it.
  *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *
+ * ★ REPLACE SEMANTICS (audited 2026-09-21, see src/openbao/REPLACE.md):
+ *   · `type` changed → plans `replace`, and the APPLY FAILS, destroying nothing: the new
+ *     generation's path is the old one's, still occupied, so its reconcile dies "type is
+ *     immutable" before any write (mount-reconcile.ts). Change a type by hand. ⛔ Not `deleteFirst`
+ *     on purpose — under `destroy` that would disable the mount, every secret with it, on a typo.
+ *   · `path` changed → FAILS the plan unless `remountFrom` names the old path, which is an
+ *     in-place `update` that moves the mount and its data (mount-move.ts). It used to be an
+ *     `update` that enabled an EMPTY mount at the new path.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../src/openbao/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAKnB,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAElD,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,QAAQ,2CAEnB,CAAC;AASH,eAAO,MAAM,gBAAgB,+FAqF1B,CAAC"}
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../src/openbao/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,aAAa,EAAW,MAAM,iBAAiB,CAAC;AAKvF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAElD,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,QAAQ,2CAEnB,CAAC;AAEH,eAAO,MAAM,gBAAgB,+FAuE1B,CAAC"}

package/dist/openbao/pki-role-canonical.d.ts

@@ -0,0 +1,46 @@
+import type { BaoPkiRoleProps } from './pki-role-form.ts';
+/**
+ * The managed field set, normalised so both sides of a diff are byte-comparable.
+ *
+ * ⚠️ KEY ORDER IS THE DIGEST. The props side and the live side are both built by the single
+ *   canonical() literal below, so `JSON.stringify` emits the same key order for each. Two
+ *   hand-written object literals would drift apart and produce a forever-diff nobody could
+ *   read from the plan output.
+ */
+export interface BaoPkiRoleCanonical {
+    allowBareDomains: boolean;
+    allowGlobDomains: boolean;
+    allowIpSans: boolean;
+    allowLocalhost: boolean;
+    allowSubdomains: boolean;
+    allowWildcardCertificates: boolean;
+    allowedDomains: readonly string[];
+    allowedDomainsTemplate: boolean;
+    clientFlag: boolean;
+    cnValidations: readonly string[];
+    enforceHostnames: boolean;
+    extKeyUsage: readonly string[];
+    generateLease: boolean;
+    keyBits: number;
+    keyType: string;
+    keyUsage: readonly string[];
+    /** ⚠️ `-1` means the duration prop did not parse — reconcile refuses rather than writing it. */
+    maxTtlSeconds: number;
+    noStore: boolean;
+    requireCn: boolean;
+    serverFlag: boolean;
+    signatureBits: number;
+    ttlSeconds: number;
+}
+/** ★ OpenBao's own `key_usage` default (path_roles.go:697-698) — what an omitted field becomes. */
+export declare const DEFAULT_KEY_USAGE: readonly string[];
+export declare const canonicalFromProps: (props: BaoPkiRoleProps) => BaoPkiRoleCanonical;
+/**
+ * ⚠️ AN ABSENT NEW FIELD READS AS ITS ZERO VALUE, NOT ITS SCHEMA DEFAULT. A role read always carries
+ *   the six new fields (ToResponseData, path_roles.go:1720-1780; `generate_lease` only when set,
+ *   and getRole upgrades a missing one to false at :1034), so the fallback only answers a body
+ *   that is not OpenBao's — and then "false"/"none" reads as drift rather than a false noop.
+ */
+export declare const canonicalFromLive: (live: Record<string, unknown>) => BaoPkiRoleCanonical;
+export declare const digestOf: (form: BaoPkiRoleCanonical) => string;
+//# sourceMappingURL=pki-role-canonical.d.ts.map

package/dist/openbao/pki-role-canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pki-role-canonical.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role-canonical.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,yBAAyB,EAAE,OAAO,CAAC;IACnC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sBAAsB,EAAE,OAAO,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,gGAAgG;IAChG,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,mGAAmG;AACnG,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAI9C,CAAC;AAqCF,eAAO,MAAM,kBAAkB,UAAW,eAAe,KAAG,mBAwBxD,CAAC;AAYL;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,mBAwB9D,CAAC;AAEL,eAAO,MAAM,QAAQ,SAAU,mBAAmB,KAAG,MAAsC,CAAC"}

package/dist/openbao/pki-role-form.d.ts

@@ -1,3 +1,5 @@
+import { type BaoPkiRoleCanonical } from './pki-role-canonical.ts';
+export type { BaoPkiRoleCanonical };
 /** ★ MEASURED: the OpenAPI enum for `key_type` is exactly these four, lowercase. */
 export type BaoPkiKeyType = 'any' | 'ec' | 'ed25519' | 'rsa';
 /** ★ MEASURED: live roles carry `["hostname"]` or the default `["email","hostname"]`. */
@@ -51,33 +53,29 @@ export interface BaoPkiRoleProps {
     cnValidations?: readonly BaoPkiCnValidation[];
     /** Signature hash bits; `0` auto-detects from key length. One live role pins 256. */
     signatureBits?: number;
-}
-/**
- * The managed field set, normalised so both sides of a diff are byte-comparable.
- *
- * ⚠️ KEY ORDER IS THE DIGEST. The props side and the live side are both built by the single
- *   canonical() literal below, so `JSON.stringify` emits the same key order for each. Two
- *   hand-written object literals would drift apart and produce a forever-diff nobody could
- *   read from the plan output.
- */
-export interface BaoPkiRoleCanonical {
-    allowBareDomains: boolean;
-    allowGlobDomains: boolean;
-    allowIpSans: boolean;
-    allowLocalhost: boolean;
-    allowSubdomains: boolean;
-    allowWildcardCertificates: boolean;
-    allowedDomains: readonly string[];
-    clientFlag: boolean;
-    cnValidations: readonly string[];
-    extKeyUsage: readonly string[];
-    keyBits: number;
-    keyType: string;
-    /** ⚠️ `-1` means the duration prop did not parse — reconcile refuses rather than writing it. */
-    maxTtlSeconds: number;
-    serverFlag: boolean;
-    signatureBits: number;
-    ttlSeconds: number;
+    /**
+     * ★ THE SIX BELOW (added 2026-09-21) default to OpenBao's OWN values, not closed ones — a role this
+     *   resource wrote before they were props carries exactly those, so it still plans `noop`. The
+     *   write already sent them implicitly; see the header of pki-role-canonical.ts.
+     */
+    /** A request must carry a common_name. Default true. */
+    requireCn?: boolean;
+    /** Only valid host names in the CN and DNS SANs. Default true. */
+    enforceHostnames?: boolean;
+    /**
+     * Key usages minus the `KeyUsage` prefix. Default `DigitalSignature, KeyAgreement,
+     * KeyEncipherment`. ⚠️ `[]` is a real value — it removes every key usage — and is sent as such.
+     */
+    keyUsage?: readonly string[];
+    /** Allowed domains may use identity templates (`{{identity.entity.name}}`). Default false. */
+    allowedDomainsTemplate?: boolean;
+    /**
+     * Do not store issued certificates. Default false. ⛔ They can then be neither listed nor
+     *   revoked. ⚠️ Implies `generateLease: false`; declaring both true is refused (see problems).
+     */
+    noStore?: boolean;
+    /** Attach an OpenBao lease to every issued certificate. Default false — leases slow startup. */
+    generateLease?: boolean;
 }
 export interface BaoPkiRoleAttributes extends BaoPkiRoleCanonical {
     name: string;
@@ -88,9 +86,6 @@ export interface BaoPkiRoleAttributes extends BaoPkiRoleCanonical {
     /** SHA-256 of the canonical form — safe to persist; see policy.ts. */
     digest: string;
 }
-export declare const canonicalFromProps: (props: BaoPkiRoleProps) => BaoPkiRoleCanonical;
-export declare const canonicalFromLive: (live: Record<string, unknown>) => BaoPkiRoleCanonical;
-export declare const digestOf: (form: BaoPkiRoleCanonical) => string;
 export declare const rolePath: (props: {
     name: string;
     mount?: string;
@@ -109,10 +104,23 @@ export declare const attributesOf: (props: BaoPkiRoleProps, live: Record<string,
  * ★ `ext_key_usage` is OMITTED when empty rather than sent as `ext_key_usage=`. The write
  *   replaces the whole role, so an absent field already lands on the `[]` default, and
  *   omitting sidesteps how an empty value would be encoded.
+ * ⚠️ `key_usage` CANNOT BE OMITTED THAT WAY — its default is NOT empty — so it is always sent, and
+ *   an empty declaration goes over as `""`. That encoding is now READ, not guessed: for a
+ *   comma-string-slice field, go-secure-stdlib parseutil.ParseCommaStringSlice (:389-392)
+ *   answers `""` with an empty list.
  *
  * ★ THE BODY FOR `PUT <mount>/roles/<name>`, ALL STRINGS — the same `k=v` pairs `bao write` sent.
  */
 export declare const writeBody: (props: BaoPkiRoleProps) => Record<string, string>;
 /** True when live already matches the declaration on every managed field. */
 export declare const matches: (attributes: BaoPkiRoleAttributes, props: BaoPkiRoleProps) => boolean;
+/**
+ * Declarations reconcile must refuse rather than write. diff routes any of these to `update` so the
+ * refusal is seen on the next deploy, never hidden behind a `noop`.
+ *
+ * ⚠️ `noStore` WITH `generateLease` IS NOT AN ERROR ON THE SERVER — pathRoleCreate stores
+ *   generate_lease false and adds a warning (path_roles.go:1250-1256) — so the role would read back
+ *   different from its declaration and plan `update` forever. Refused here instead.
+ */
+export declare const problems: (props: BaoPkiRoleProps) => readonly string[];
 //# sourceMappingURL=pki-role-form.d.ts.map

package/dist/openbao/pki-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pki-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role-form.ts"],"names":[],"mappings":"AAGA,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC;AAE7D,yFAAyF;AACzF,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC9B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oDAAoD;IACpD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oGAAoG;IACpG,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,gGAAgG;IAChG,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kFAAkF;IAClF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,8FAA8F;IAC9F,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC9C,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,yBAAyB,EAAE,OAAO,CAAC;IACnC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AA8BD,eAAO,MAAM,kBAAkB,UAAW,eAAe,KAAG,mBAkBxD,CAAC;AAYL,eAAO,MAAM,iBAAiB,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,mBAkB9D,CAAC;AAWL,eAAO,MAAM,QAAQ,SAAU,mBAAmB,WAAiC,CAAC;AAEpF,eAAO,MAAM,QAAQ,UAAW;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,WACN,CAAC;AAE3D,eAAO,MAAM,YAAY,UAChB,eAAe,QAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,oBAUF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,UAAW,eAAe,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAsBvE,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,oBAAoB,SAAS,eAAe,YACrB,CAAC"}
+{"version":3,"file":"pki-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role-form.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,mBAAmB,EAKzB,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC;AAE7D,yFAAyF;AACzF,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC9B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oDAAoD;IACpD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oGAAoG;IACpG,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,gGAAgG;IAChG,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kFAAkF;IAClF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,8FAA8F;IAC9F,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC9C,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,8FAA8F;IAC9F,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gGAAgG;IAChG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAWD,eAAO,MAAM,QAAQ,UAAW;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,WACN,CAAC;AAE3D,eAAO,MAAM,YAAY,UAChB,eAAe,QAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,oBAUF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,SAAS,UAAW,eAAe,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CA4BvE,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,oBAAoB,SAAS,eAAe,YACrB,CAAC;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,UAAW,eAAe,KAAG,SAAS,MAAM,EAuBhE,CAAC"}

package/dist/openbao/pki-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pki-role.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAKrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAeH,eAAO,MAAM,kBAAkB,iGAsH5B,CAAC"}
+{"version":3,"file":"pki-role.d.ts","sourceRoot":"","sources":["../../src/openbao/pki-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAMrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AASH,eAAO,MAAM,kBAAkB,iGA4G5B,CAAC"}

package/dist/openbao/policy.d.ts

@@ -77,6 +77,8 @@ export interface BaoPolicy extends Resource<'Bao.Policy', BaoPolicyProps, BaoPol
  *   orphaned resource; a caller that means it opts in with `.pipe(RemovalPolicy.destroy())`. This
  *   is Terraform's `prevent_destroy`, not a stubbed operation — a delete that silently did nothing
  *   would lie to whoever read the plan.
+ * ⚠️ `retain` ALSO KEEPS THE OLD GENERATION OF A RENAME. A new `name` plans `replace`, and under
+ *   `retain` the old policy is left live and unmanaged (rename.ts, REPLACE.md).
  */
 export declare const BaoPolicy: import("alchemy").ResourceClass<BaoPolicy>;
 export declare const BaoPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoPolicy>, never, FileSystem.FileSystem | HttpClient.HttpClient | Path.Path>;

package/dist/openbao/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAYH,eAAO,MAAM,iBAAiB,oIAuG3B,CAAC"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAMnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAYH,eAAO,MAAM,iBAAiB,oIA2H3B,CAAC"}

package/dist/openbao/proxmox-role-form.d.ts

@@ -63,18 +63,18 @@ export interface BaoProxmoxRoleAttributes {
 }
 /** `proxmox-tb4/roles/read` — read, write and delete all address the role here. */
 export declare const rolePath: (mount: string, name: string) => string;
-export declare const attributesOf: (props: BaoProxmoxRoleProps, live: Record<string, unknown>) => BaoProxmoxRoleAttributes;
+export declare const attributesOf: (props: Pick<BaoProxmoxRoleProps, 'mount' | 'name'>, live: Record<string, unknown>) => BaoProxmoxRoleAttributes;
 /**
  * The body for `PUT <mount>/roles/<name>` — all strings, the `k=v` pairs `bao write` sent — or
  * the prop names whose duration would not parse.
  *
- * ⛔ A WRITE TO roles/{name} REPLACES THE ROLE, IT DOES NOT MERGE. An omitted `ttl` is written
- *   as the field's zero value, so a resource that treated undeclared TTLs as "unmanaged" — the
- *   Bao.Mount shape — would silently reset a lease ceiling every time it rewrote the role for an
- *   unrelated reason. Both TTLs are therefore required props and EVERY write carries all three
- *   fields. REASONED from the Vault secrets-framework write semantics plus this plugin's schema
- *   marking only `mint_user` required; NOT measured, because this session was read-only and
- *   proving it would have meant writing to the live engine.
+ * ⛔ EVERY WRITE CARRIES ALL THREE FIELDS, and both TTLs are required props, so `matches` covers
+ *   the whole role and no field is left unmanaged behind a green plan.
+ * ⚠️ CORRECTED 2026-09-21 FROM THE PLUGIN SOURCE. This said a write REPLACES the role and resets an
+ *   omitted TTL to zero. The port in homeflare-openbao-plugins (secrets/proxmox/path_roles.go,
+ *   pathRolesWrite, commit 0e79154) MERGES: it loads the stored role and sets only the fields
+ *   present (`d.GetOk`). An omitted TTL would keep its old value, which is still a value this
+ *   resource would not be managing. The build running live was not re-checked against that source.
  *
  * ⚠️ Seconds go on the wire as integers, not as `1h`. The schema declares both TTLs
  *   `"format": "seconds"`, and an integer is accepted unambiguously by every path that reads
@@ -87,6 +87,16 @@ export declare const writeBody: (props: BaoProxmoxRoleProps) => {
     ok: false;
     bad: string[];
 };
+/**
+ * Why moving the role's mint user from `before` to the declared one must be refused, or undefined.
+ * The ⛔ on reconcile in proxmox-role.ts says why a re-scope needs `allowMintUserChange`.
+ *
+ * ★ ONE DEFINITION FOR BOTH PLACES THAT ASK. Reconcile asks it of the live role at the same path.
+ *   The diff asks it across a rename, where `before` is the role being replaced: a rename writes a
+ *   brand-new role, so reconcile alone would see nothing to re-scope, and a rename would become the
+ *   way around the guard.
+ */
+export declare const rescopeRefusal: (before: string, mintUser: string, allowMintUserChange: string | undefined) => string | undefined;
 /** True when the live role already matches the declaration on every field the plugin stores. */
 export declare const matches: (attributes: BaoProxmoxRoleAttributes, props: BaoProxmoxRoleProps) => boolean;
 //# sourceMappingURL=proxmox-role-form.d.ts.map

package/dist/openbao/proxmox-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxmox-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role-form.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,mBAAmB;IAClC,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,mFAAmF;AACnF,eAAO,MAAM,QAAQ,UAAW,MAAM,QAAQ,MAAM,WAAwC,CAAC;AAE7F,eAAO,MAAM,YAAY,UAChB,mBAAmB,QACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,wBAYF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,UACb,mBAAmB,KACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAWzE,CAAC;AAaF,gGAAgG;AAChG,eAAO,MAAM,OAAO,eAAgB,wBAAwB,SAAS,mBAAmB,YAG9C,CAAC"}
+{"version":3,"file":"proxmox-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role-form.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,mBAAmB;IAClC,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,mFAAmF;AACnF,eAAO,MAAM,QAAQ,UAAW,MAAM,QAAQ,MAAM,WAAwC,CAAC;AAE7F,eAAO,MAAM,YAAY,UAChB,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,CAAC,QAC5C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,wBAYF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,UACb,mBAAmB,KACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAWzE,CAAC;AAaF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,WACjB,MAAM,YACJ,MAAM,uBACK,MAAM,GAAG,SAAS,KACtC,MAAM,GAAG,SAIyF,CAAC;AAEtG,gGAAgG;AAChG,eAAO,MAAM,OAAO,eAAgB,wBAAwB,SAAS,mBAAmB,YAG9C,CAAC"}

package/dist/openbao/proxmox-role-wire.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The read Bao.ProxmoxRole makes of `<mount>/roles/<name>`, split from proxmox-role.ts so the diff,
+ * reconcile and the rename's re-scope check share one definition of "the live role".
+ */
+import * as Effect from 'effect/Effect';
+import { type BaoProxmoxRoleProps } from './proxmox-role-form.ts';
+/**
+ * The live role, or undefined when OpenBao answers 404.
+ *
+ * ⚠️ A missing MOUNT and a missing ROLE both read as undefined here, because both answer 404:
+ *   an absent role is a read that found nothing, and a path under no mount is OpenBao's
+ *   unsupported-path error, which is also a 404 (sdk/logical/response_util.go). They are not the
+ *   same failure — one is a typo in `mount`, the other is a role that has yet to be created — so
+ *   reconcile lets OpenBao's own `errors` through on the write rather than inventing a message.
+ *   A bad mount says "no handler for route".
+ */
+export declare const readRole: (props: Pick<BaoProxmoxRoleProps, 'mount' | 'name'>) => Effect.Effect<import("./proxmox-role-form.ts").BaoProxmoxRoleAttributes | undefined, import("./bao-status.ts").BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=proxmox-role-wire.d.ts.map

package/dist/openbao/proxmox-role-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxmox-role-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role-wire.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,mBAAmB,EAA0B,MAAM,wBAAwB,CAAC;AAE1F;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,UAAW,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,CAAC,mLAKvE,CAAC"}

package/dist/openbao/proxmox-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxmox-role.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAE9D,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAiBH,eAAO,MAAM,sBAAsB,qGAoIhC,CAAC"}
+{"version":3,"file":"proxmox-role.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,wBAAwB,CAAC;AAYhC,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAE9D,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,eAAO,MAAM,sBAAsB,qGAkKhC,CAAC"}

package/dist/openbao/remount-wire.d.ts

@@ -0,0 +1,44 @@
+/**
+ * `sys/remount` — move a secrets engine or auth method to a new path WITH its data — and the status
+ * polling it needs, because the move finishes after the call returns.
+ *
+ * ★ READ FROM openbao v2.6.2, NOT RECALLED:
+ *   · api/sys_mounts.go:95-191 — the CLI's `bao secrets move` POSTs `{from, to}` to sys/remount,
+ *     takes `data.migration_id`, then GETs sys/remount/status/<id> once a second until
+ *     `migration_info.status` is `success` or `failure`. This is that loop, bounded.
+ *   · vault/logical_system.go:1257-1357 — the handler validates, records the migration and
+ *     answers AT ONCE; a goroutine does the move. So a 200 means "queued", never "moved".
+ *   · vault/mount.go:630-735 — the mount keeps its UUID, and storage lives under the UUID, so every
+ *     secret stays. ⛔ BUT EVERY LEASE UNDER THE SOURCE IS REVOKED (`RevokePrefix`, :684): a move of
+ *     a dynamic-secrets mount kills every credential it has issued. KV has no leases.
+ *   · vault/logical_system.go:67-69 — `remount` is a sudo path. The status path is not.
+ * ⚠️ THE STATUS TRACKER IS IN MEMORY (vault/mount.go:2303-2336, a sync.Map on the active node). A
+ *   restart or leader change mid-move loses it, and the status read then answers 404. That is not a
+ *   failure and not a success; `confirm` settles it from the mount tables, or the call fails.
+ * ⛔ POLICIES ARE NOT REWRITTEN. Every ACL path naming the old mount keeps naming it.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+/** A move OpenBao reported failed, or one this could not confirm. Never carries a token. */
+export declare class RemountError extends Error {
+    constructor(message: string);
+}
+export interface RemountOptions {
+    /** Milliseconds between status reads. Default 1000 — the CLI's own pace. */
+    readonly intervalMillis?: number;
+    /** Status reads before giving up. Default 120, so about two minutes. */
+    readonly attempts?: number;
+}
+/** POST sys/remount and return the migration id. `from`/`to` are full paths (`auth/x` for auth). */
+export declare const startRemount: (from: string, to: string) => Effect.Effect<string, BaoError | RemountError, HttpClient.HttpClient>;
+/** `in-progress`, `success`, `failure` — or undefined when the server no longer knows the id. */
+export declare const remountStatus: (id: string) => Effect.Effect<string | undefined, BaoError, HttpClient.HttpClient>;
+/**
+ * Move `from` to `to` and wait until OpenBao says it is done.
+ *
+ * @param confirm answers "does the mount table show the move finished?" — asked only when the
+ *   status tracker has forgotten the id. True is success; false fails.
+ */
+export declare const remountAndWait: (from: string, to: string, confirm: Effect.Effect<boolean, BaoError, HttpClient.HttpClient>, options?: RemountOptions) => Effect.Effect<void, BaoError | RemountError, HttpClient.HttpClient>;
+//# sourceMappingURL=remount-wire.d.ts.map

package/dist/openbao/remount-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remount-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/remount-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,4FAA4F;AAC5F,qBAAa,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAOD,oGAAoG;AACpG,eAAO,MAAM,YAAY,SACjB,MAAM,MACR,MAAM,KACT,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CAMnE,CAAC;AAEL,iGAAiG;AACjG,eAAO,MAAM,aAAa,OACpB,MAAM,KACT,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAKhE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SACnB,MAAM,MACR,MAAM,WACD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,YACvD,cAAc,KACtB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CAkCjE,CAAC"}

package/dist/openbao/rename.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Rename safety for the families whose identity is a name, or a mount and a name: Bao.Policy,
+ * Bao.CloudflareRole and Bao.ProxmoxRole. REPLACE.md has the audit and what each answer does.
+ *
+ * ⛔ THE BUG THIS CLOSES, REPRODUCED 2026-09-21 AGAINST alchemy@2.0.0-beta.79's OWN PLAN AND APPLY
+ *   (fake-stack.ts): a Bao.Policy deployed as `old`, then redeclared as `new` under
+ *   `RemovalPolicy.destroy()`, planned `update` and left BOTH policies live. diff read the NEW
+ *   path, found nothing, answered `update`, and reconcile wrote the new object. The old one stayed
+ *   live under no state record, so no later plan would mention it, and not even `destroy` could
+ *   remove it.
+ * ★ A CHANGED IDENTITY IS A DIFFERENT OBJECT, SO THE ANSWER IS `replace`. Create-first
+ *   (`deleteFirst` false): the new path never collides with the old, the new generation is written,
+ *   dependents are updated in the same graph, and only then is the old generation deleted. The
+ *   engine hands that delete the OLD generation's attributes (Apply.ts deleteOldGenerations and the
+ *   GC pass both pass `output: old.attr`), and every delete here reads `output`, never `news`.
+ *   ⛔ A new path that collides with ANOTHER live object is refused at plan instead (`judgeMove`).
+ * ⚠️ UNDER `retain` THE OLD OBJECT STAYS LIVE. Apply.ts:2164-2173 skips the old generation's delete
+ *   and logs "Retaining replaced resource (removal policy: retain)". The plan still says `replace`
+ *   and the apply says what it kept, so it is no longer silent, but the old object is unmanaged
+ *   from then on. Remove it by hand, or opt into `RemovalPolicy.destroy()`.
+ */
+import * as Effect from 'effect/Effect';
+/**
+ * A string prop of a diff's `news`, once that one prop is resolved; `undefined` while it is still an
+ * Output of a changing upstream (a function-typed proxy) or an Effect.
+ *
+ * ★ THE IDENTITY IS JUDGED BEFORE `isResolved(news)`. That guard returns `undefined` when ANY prop is
+ *   pending, and the engine then falls back to `update` (Plan.ts, `havePropsChanged`). A rename that
+ *   lands in the same deploy as a pending `fragments` or `policies` Output would slip through as
+ *   `update`, which is the orphan again. launchd/host-effect.ts reads its identity the same way.
+ */
+export declare const declaredString: (news: unknown, key: string) => string | undefined;
+/** True while an optional prop is declared but is not yet a value: an Output of a changing upstream. */
+export declare const isPendingProp: (news: unknown, key: string) => boolean;
+/** A role's API path from a diff's `news`, once both `mount` and `name` are resolved. */
+export declare const declaredRolePath: (news: unknown, rolePath: (mount: string, name: string) => string) => string | undefined;
+/**
+ * How OpenBao keys an ACL policy: trimmed and lowercased. openbao v2.6.2
+ * vault/policy/policy_store.go:698-700 (`sanitizeName`), applied by SetPolicy (:268), GetPolicy
+ * (:378) and DeletePolicy (:562).
+ *
+ * ⛔ SO `Admin` → `admin` IS THE SAME POLICY, NOT A RENAME. A `replace` there would write it, and then,
+ *   under `destroy`, delete the old generation, which is that same policy. Every grant it carries
+ *   would be revoked by a change of case.
+ */
+export declare const policyKey: (name: string) => string;
+/**
+ * Whether the declared identity names a different object than the one in state: `true` → moved (the
+ * diff asks `judgeMove`, which also reads the target); `false` → the same object; `undefined` → not
+ * knowable yet, because the declared side is still an Output. `key` is how the SERVER keys the object (`policyKey`); the default is exact,
+ * which is right for a mount path (vault/routing/router.go folds no case) and for both plugins'
+ * roles (each stores `roles/<name>` verbatim).
+ *
+ * ⛔ NEVER `replace` ON AN UNKNOWN IDENTITY. The Output may resolve to the same path, and a replace
+ *   onto the same path deletes, under `destroy`, the object it has just written. The diff defers
+ *   instead. If the engine then plans `update` and the identity turns out to have changed,
+ *   `refuseMovedUpdate` stops reconcile before it writes anything.
+ */
+export declare const isMoved: (stored: string, declared: string | undefined, key?: (identity: string) => string) => boolean | undefined;
+/**
+ * The role path a resource last wrote, or last tried to: its attributes once a write finished, else
+ * the props of the create or replacement that did not (`output` is undefined for both).
+ */
+export declare const triedRolePath: (output: {
+    readonly mount: string;
+    readonly name: string;
+} | undefined, olds: unknown, rolePath: (mount: string, name: string) => string) => string | undefined;
+/**
+ * The diff's first question, asked before `isResolved(news)`: the move from the identity this
+ * resource last wrote or tried (`tried`) to the declared one, or undefined when both name the same
+ * object or either is still unknown. `pathOf` is the API path an identity is read at.
+ *
+ * ⛔ A MOVE ONTO AN OBJECT THAT ALREADY EXISTS FAILS THE PLAN. MEASURED 2026-09-21 through the engine
+ *   (rename-occupied.test.ts): two policies that swapped names under `RemovalPolicy.destroy()` each
+ *   planned `replace`, each new generation wrote over the other's live policy, and each old
+ *   generation's delete then removed the name the other had just written. The deploy was green and
+ *   both policies were gone, every grant revoked. A shift (a → b while b → c), and a move onto the
+ *   name of a resource leaving the stack, were measured ending the same way. So was reverting a
+ *   move whose new generation failed: the old generation still holds the name, and its delete runs
+ *   after the revert has rewritten it. That is why `tried` falls back to the props of an unfinished
+ *   write.
+ * ⚠️ THE DIFF CANNOT SEE THE REMOVAL POLICY, SO THIS REFUSES UNDER `retain` TOO, where a swap, or a
+ *   move back onto a retained old generation, would have been harmless. The cost is a move in two
+ *   deploys through a free name, or removing the target by hand. The alternative is a green deploy
+ *   that deletes what it has just written.
+ * ★ ONE PLAN-TIME READ, OF A PATH THE NEW GENERATION'S RECONCILE READS ANYWAY. A 404, a missing mount
+ *   included, is free; a refused read fails the plan, as any other diff read does.
+ */
+export declare const judgeMove: (family: string, tried: string | undefined, declared: string | undefined, pathOf: (identity: string) => string, key?: (identity: string) => string) => Effect.Effect<{
+    from: string;
+    to: string;
+} | undefined, import("./bao-status.ts").BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * Reconcile's guard: an `update` whose prior attributes name another object.
+ *
+ * ★ REACHED ONLY WHEN THE DIFF COULD NOT SEE THE NEW IDENTITY at plan time. A fresh create, and the
+ *   new generation of a `replace`, both reach reconcile with `output` undefined (Apply.ts passes
+ *   `output: attr`, which is empty for a new generation). An `update` reaches it with the previous
+ *   generation's attributes.
+ * ★ THE FAILED DEPLOY SETTLES ITSELF. Apply has already committed the row as `updating`, with the new
+ *   props and the OLD attributes. By the next plan the upstream Output has landed, so the diff sees
+ *   both names and answers `replace` (or refuses, if the new name is already taken: `judgeMove`).
+ *   The old object is then deleted, or retained, by the removal policy, with no hand repair.
+ */
+export declare const refuseMovedUpdate: (family: string, from: string, to: string) => Effect.Effect<never, never, never>;
+//# sourceMappingURL=rename.d.ts.map

package/dist/openbao/rename.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename.d.ts","sourceRoot":"","sources":["../../src/openbao/rename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,SAAU,OAAO,OAAO,MAAM,KAAG,OAI1D,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,SACrB,OAAO,YACH,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,KAChD,MAAM,GAAG,SAIX,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAmC,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,WACV,MAAM,YACJ,MAAM,GAAG,SAAS,QACvB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,KAChC,OAAO,GAAG,SAAiF,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,aAAa,WAChB;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,QAC/D,OAAO,YACH,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,KAChD,MAAM,GAAG,SACmF,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,WACZ,MAAM,SACP,MAAM,GAAG,SAAS,YACf,MAAM,GAAG,SAAS,UACpB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,QAC/B,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM;;;wGAgB/B,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,WAAY,MAAM,QAAQ,MAAM,MAAM,MAAM,uCAOvE,CAAC"}