@homeflare/alchemy 0.5.0 → 0.7.0

package/src/openbao/kubernetes-role-form.ts

@@ -0,0 +1,149 @@
+/**
+ * The form half of Bao.KubernetesRole — `auth/<mount>/role/<name>` on a `kubernetes` auth mount:
+ * which service accounts, in which namespaces, may log in, and what their token carries.
+ *
+ * ★ READ FROM openbao v2.6.2 builtin/credential/kubernetes/path_role.go, NOT RECALLED:
+ *   · The write MERGES for names, namespaces, audience and alias source (`GetOk`, :335-392), but
+ *     `bound_service_account_namespace_selector` is `data.Get` — RESET when omitted (:353). Every
+ *     field is therefore sent on every write, defaults included.
+ *   · Names may not be empty, and `*` may not be mixed with other names; namespaces may be empty
+ *     only when a selector is set, with the same `*` rule (:335-372). Refused here first.
+ *   · Roles are stored under the LOWER-CASED name (:396, backend.go:361), so a mixed-case name
+ *     would read back as a different string. Refused, not folded.
+ *   · `audience` is omitted from a read when empty (:206-208); read as `''`.
+ * ⚠️ `aliasNameSource` DECIDES WHO A POD IS. `serviceaccount_uid` (OpenBao's default) names the
+ *   entity alias by the service account's UID; `serviceaccount_name` by `<namespace>/<name>`
+ *   (backend.go:30-34). Changing it on a live role re-names every pod's alias, so their next logins
+ *   land on NEW entities and attribution splits.
+ * ⛔ SO IT IS REQUIRED, NOT DEFAULTED (review 2026-09-21). Every field is sent on every write, so a
+ *   default here would be WRITTEN: adopting a hand-made `serviceaccount_name` role with the prop
+ *   left out would plan a bare `update` and silently re-key every pod onto new entities. The
+ *   machine-access plan chose `serviceaccount_name`; the server's default is the other one — a
+ *   choice this important is made in the declaration, the way Bao.JwtRole's `roleType` is.
+ */
+import {
+  type BaoTokenForm,
+  type BaoTokenProps,
+  tokenBody,
+  tokenFields,
+  tokenFormOfLive,
+  tokenFormOfProps,
+  tokenProblems,
+} from './auth-token-form.ts';
+import { sha256 } from './digest.ts';
+import { mountPath } from './mount-form.ts';
+
+export type BaoKubernetesAliasSource = 'serviceaccount_name' | 'serviceaccount_uid';
+
+export interface BaoKubernetesRoleProps extends BaoTokenProps {
+  /** Auth mount path. Default `kubernetes`. */
+  mount?: string;
+  /** Role name — lower case, as the server stores it. */
+  name: string;
+  /** Service account names; `['*']` for any. Never empty. */
+  boundServiceAccountNames: readonly string[];
+  /** Namespaces; `['*']` for any. May be empty only with a selector. */
+  boundServiceAccountNamespaces?: readonly string[];
+  /** A label selector (JSON or YAML) for namespaces, ORed with the list. */
+  boundServiceAccountNamespaceSelector?: string;
+  /** The `aud` a service account token must carry. Default none. */
+  audience?: string;
+  /** ⛔ Required — read the ⚠️ and ⛔ above before changing it on a live role. */
+  aliasNameSource: BaoKubernetesAliasSource;
+}
+
+export interface BaoKubernetesRoleCanonical extends BaoTokenForm {
+  aliasNameSource: string;
+  audience: string;
+  boundServiceAccountNames: readonly string[];
+  boundServiceAccountNamespaceSelector: string;
+  boundServiceAccountNamespaces: readonly string[];
+}
+
+/** ⛔ No secret: account names, namespaces, policy names, TTLs. */
+export interface BaoKubernetesRoleAttributes extends BaoKubernetesRoleCanonical {
+  mount: string;
+  name: string;
+  digest: string;
+}
+
+const sortedSet = (values: readonly string[]) => [...new Set(values)].sort();
+const text = (value: unknown) => (typeof value === 'string' ? value : '');
+const strings = (value: unknown): readonly string[] =>
+  Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string') : [];
+
+const canonical = (input: BaoKubernetesRoleCanonical): BaoKubernetesRoleCanonical => ({
+  aliasNameSource: input.aliasNameSource,
+  audience: input.audience,
+  boundServiceAccountNames: sortedSet(input.boundServiceAccountNames),
+  boundServiceAccountNamespaceSelector: input.boundServiceAccountNamespaceSelector.trim(),
+  boundServiceAccountNamespaces: sortedSet(input.boundServiceAccountNamespaces),
+  ...tokenFields(input),
+});
+
+export const canonicalFromProps = (props: BaoKubernetesRoleProps): BaoKubernetesRoleCanonical =>
+  canonical({
+    ...tokenFormOfProps(props),
+    aliasNameSource: props.aliasNameSource,
+    audience: props.audience ?? '',
+    boundServiceAccountNames: props.boundServiceAccountNames,
+    boundServiceAccountNamespaceSelector: props.boundServiceAccountNamespaceSelector ?? '',
+    boundServiceAccountNamespaces: props.boundServiceAccountNamespaces ?? [],
+  });
+
+export const canonicalFromLive = (live: Record<string, unknown>): BaoKubernetesRoleCanonical =>
+  canonical({
+    ...tokenFormOfLive(live),
+    aliasNameSource: text(live['alias_name_source']),
+    audience: text(live['audience']),
+    boundServiceAccountNames: strings(live['bound_service_account_names']),
+    boundServiceAccountNamespaceSelector: text(live['bound_service_account_namespace_selector']),
+    boundServiceAccountNamespaces: strings(live['bound_service_account_namespaces']),
+  });
+
+export const mountOf = (props: { mount?: string }): string =>
+  mountPath(props.mount ?? 'kubernetes');
+
+export const rolePath = (props: { mount?: string; name: string }): string =>
+  `auth/${mountOf(props)}/role/${props.name}`;
+
+export const attributesOf = (
+  props: BaoKubernetesRoleProps,
+  live: Record<string, unknown>,
+): BaoKubernetesRoleAttributes => {
+  const form = canonicalFromLive(live);
+  return { ...form, digest: sha256(JSON.stringify(form)), mount: mountOf(props), name: props.name };
+};
+
+export const matches = (
+  attributes: BaoKubernetesRoleAttributes,
+  props: BaoKubernetesRoleProps,
+): boolean => attributes.digest === sha256(JSON.stringify(canonicalFromProps(props)));
+
+export const writeBody = (props: BaoKubernetesRoleProps): Record<string, unknown> => ({
+  alias_name_source: props.aliasNameSource,
+  audience: props.audience ?? '',
+  bound_service_account_names: [...props.boundServiceAccountNames],
+  bound_service_account_namespace_selector: props.boundServiceAccountNamespaceSelector ?? '',
+  bound_service_account_namespaces: [...(props.boundServiceAccountNamespaces ?? [])],
+  ...tokenBody(props),
+});
+
+const NAME = /^[a-z0-9_](?:[a-z0-9_.-]*[a-z0-9_])?$/;
+
+const starMixed = (values: readonly string[]) => values.length > 1 && values.includes('*');
+
+export const problems = (props: BaoKubernetesRoleProps): readonly string[] => {
+  const found = [...tokenProblems(props)];
+  const namespaces = props.boundServiceAccountNamespaces ?? [];
+  const selector = (props.boundServiceAccountNamespaceSelector ?? '').trim();
+  if (!NAME.test(props.name))
+    found.push(`name \`${props.name}\` must be lower case (stored folded)`);
+  if (props.boundServiceAccountNames.length === 0) found.push('boundServiceAccountNames is empty');
+  if (starMixed(props.boundServiceAccountNames)) found.push('`*` mixed with other account names');
+  if (namespaces.length === 0 && selector === '') {
+    found.push('boundServiceAccountNamespaces is empty and no namespace selector is set');
+  }
+  if (starMixed(namespaces)) found.push('`*` mixed with other namespaces');
+  return found;
+};

package/src/openbao/kubernetes-role.ts

@@ -0,0 +1,94 @@
+/**
+ * A role on a `kubernetes` auth mount — `auth/<mount>/role/<name>`: which service accounts may log
+ * in and what their token carries. METADATA ONLY. The machine-access plan gives k8s pods this
+ * instead of AppRole: one role per namespace/service account.
+ *
+ * ⛔ NO SECRET IN PROPS OR ATTRIBUTES — see policy.ts. The mount's own config (the cluster's CA and
+ *   the token reviewer JWT) is not declared here, and the reviewer JWT must never be.
+ * ⚠️ DELETING A ROLE DOES NOT REVOKE THE TOKENS IT ISSUED — pathRoleDelete removes the storage entry
+ *   and nothing else (path_role.go:239-256).
+ *
+ * ★ REPLACE SEMANTICS (REPLACE.md): `mount` or `name` changed → `replace`, create-first (the new
+ *   path cannot collide). Under the default `retain` the old role stays live until removed by hand.
+ */
+import { Resource } from 'alchemy';
+import { isResolved } from 'alchemy/Diff';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { baoDelete } from './bao-http.ts';
+import {
+  type BaoKubernetesRoleAttributes,
+  type BaoKubernetesRoleProps,
+  attributesOf,
+  matches,
+  mountOf,
+  problems,
+  rolePath,
+  writeBody,
+} from './kubernetes-role-form.ts';
+import { type RoleSpec, planRole, readRoleAt, reconcileRole } from './role-reconcile.ts';
+
+export type {
+  BaoKubernetesAliasSource,
+  BaoKubernetesRoleAttributes,
+  BaoKubernetesRoleProps,
+} from './kubernetes-role-form.ts';
+
+export interface BaoKubernetesRole extends Resource<
+  'Bao.KubernetesRole',
+  BaoKubernetesRoleProps,
+  BaoKubernetesRoleAttributes,
+  never,
+  HttpClient.HttpClient
+> {}
+
+export const BaoKubernetesRole = Resource<BaoKubernetesRole>('Bao.KubernetesRole', {
+  defaultRemovalPolicy: 'retain',
+});
+
+export const kubernetesRoleSpec = (
+  props: BaoKubernetesRoleProps,
+): RoleSpec<BaoKubernetesRoleAttributes> => ({
+  attributesOf: (live) => attributesOf(props, live),
+  body: writeBody(props),
+  family: 'Bao.KubernetesRole',
+  matches: (attributes) => matches(attributes, props),
+  path: rolePath(props),
+  problems: problems(props),
+});
+
+export const BaoKubernetesRoleProvider = () =>
+  Provider.effect(
+    BaoKubernetesRole,
+    Effect.succeed(
+      BaoKubernetesRole.Provider.of({
+        /** ⛔ The mount's role listing is not a list of things this owns. */
+        list: () => Effect.succeed([]),
+
+        read: Effect.fn(function* ({ olds }) {
+          const found = yield* readRoleAt(kubernetesRoleSpec(olds));
+          return found?.attributes;
+        }),
+
+        /** ⛔ IT COMPARES THE LIVE ROLE, NOT THE STORED DIGEST. */
+        diff: Effect.fn(function* ({ news, output }) {
+          if (output === undefined || !isResolved(news)) return undefined;
+          if (mountOf(news) !== output.mount || news.name !== output.name) {
+            return { action: 'replace' } as const;
+          }
+          return { action: yield* planRole(kubernetesRoleSpec(news)) } as const;
+        }),
+
+        reconcile: Effect.fn(function* ({ news }) {
+          return yield* reconcileRole(kubernetesRoleSpec(news));
+        }),
+
+        /** Idempotent as Alchemy requires — a missing role deletes as success. */
+        delete: Effect.fn(function* ({ output }) {
+          yield* baoDelete(rolePath(output));
+          return undefined;
+        }),
+      }),
+    ),
+  );

package/src/openbao/mfa-enforcement-form.ts

@@ -0,0 +1,147 @@
+/**
+ * The form half of Bao.MfaLoginEnforcement — `identity/mfa/login-enforcement/<name>`: which logins
+ * must pass which MFA methods.
+ *
+ * ★ READ FROM openbao v2.6.2 vault/identity/mfa.go handleMFALoginEnforcementUpdate (:511-646):
+ *   · `mfa_method_ids` is required, and each id must exist in this namespace or a parent.
+ *   · The four target lists are each `GetOk`: an omitted list KEEPS its stored value, and ANY list
+ *     that is present — even empty — satisfies "one of … must be specified" (:634-636). So every
+ *     list is sent on every write (a stale target is cleared), and "all four empty" — which the
+ *     server would accept, and which enforces NOTHING — is refused here.
+ *   · Every field is a TypeStringSlice (store.go:751-772). ⚠️ A comma string there is ONE element
+ *     (sdk framework/field_data.go:343-356 WeakDecodes a string into a one-item slice), so lists
+ *     go over as JSON arrays.
+ * ⚠️ A TYPE TARGET IS BROAD. `authMethodTypes: ['jwt']` matches EVERY jwt-type mount — including a
+ *   GitHub Actions or Kubernetes issuer mount, whose logins cannot answer a TOTP prompt. Target
+ *   mounts by path (resolved to accessors) or by identity group instead.
+ */
+import { sha256 } from './digest.ts';
+import { mountPath } from './mount-form.ts';
+
+export interface BaoMfaLoginEnforcementProps {
+  /** Enforcement name, unique per namespace. */
+  name: string;
+  /** Method ids — typically `[totp.methodId]`. Any ONE listed method passing is enough. */
+  mfaMethodIds: readonly string[];
+  /**
+   * Auth mount PATHS (`oidc`, `jwt`), resolved to their accessors at plan and deploy time.
+   * ⚠️ A plain string makes no graph edge. When the mount is a BaoAuthMethod in the same stack, pass
+   *   its output (`[oidc.path]`) so it exists before this resolves — otherwise the deploy can reach
+   *   this first and refuse with "no auth mount at …".
+   */
+  authMethodPaths?: readonly string[];
+  /** Raw accessors (`auth_jwt_…`), for a mount outside this stack. */
+  authMethodAccessors?: readonly string[];
+  /** Auth mount TYPES — read the ⚠️ above first. */
+  authMethodTypes?: readonly string[];
+  /** Identity group ids whose members must pass MFA, on any mount. */
+  identityGroupIds?: readonly string[];
+  /** Identity entity ids, likewise. */
+  identityEntityIds?: readonly string[];
+}
+
+/** The live shape, and the declared one once paths are resolved to accessors. */
+export interface BaoMfaEnforcementCanonical {
+  authMethodAccessors: readonly string[];
+  authMethodTypes: readonly string[];
+  identityEntityIds: readonly string[];
+  identityGroupIds: readonly string[];
+  mfaMethodIds: readonly string[];
+}
+
+/** ⛔ No secret — ids, accessors and names. */
+export interface BaoMfaLoginEnforcementAttributes extends BaoMfaEnforcementCanonical {
+  name: string;
+  /** The server-made id. */
+  enforcementId: string;
+  namespacePath: string;
+  digest: string;
+}
+
+const sortedSet = (values: readonly string[]) =>
+  [...new Set(values.map((value) => value.trim()))].filter((value) => value !== '').sort();
+const strings = (value: unknown): readonly string[] =>
+  Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string') : [];
+const text = (value: unknown) => (typeof value === 'string' ? value : '');
+
+const canonical = (input: BaoMfaEnforcementCanonical): BaoMfaEnforcementCanonical => ({
+  authMethodAccessors: sortedSet(input.authMethodAccessors),
+  authMethodTypes: sortedSet(input.authMethodTypes),
+  identityEntityIds: sortedSet(input.identityEntityIds),
+  identityGroupIds: sortedSet(input.identityGroupIds),
+  mfaMethodIds: sortedSet(input.mfaMethodIds),
+});
+
+/** The declaration, with `authMethodPaths` already resolved into `resolved` accessors. */
+export const canonicalFromProps = (
+  props: BaoMfaLoginEnforcementProps,
+  resolved: readonly string[],
+): BaoMfaEnforcementCanonical =>
+  canonical({
+    authMethodAccessors: [...(props.authMethodAccessors ?? []), ...resolved],
+    authMethodTypes: props.authMethodTypes ?? [],
+    identityEntityIds: props.identityEntityIds ?? [],
+    identityGroupIds: props.identityGroupIds ?? [],
+    mfaMethodIds: props.mfaMethodIds,
+  });
+
+export const canonicalFromLive = (live: Record<string, unknown>): BaoMfaEnforcementCanonical =>
+  canonical({
+    authMethodAccessors: strings(live['auth_method_accessors']),
+    authMethodTypes: strings(live['auth_method_types']),
+    identityEntityIds: strings(live['identity_entity_ids']),
+    identityGroupIds: strings(live['identity_group_ids']),
+    mfaMethodIds: strings(live['mfa_method_ids']),
+  });
+
+export const attributesOf = (
+  name: string,
+  live: Record<string, unknown>,
+): BaoMfaLoginEnforcementAttributes => {
+  const form = canonicalFromLive(live);
+  return {
+    ...form,
+    digest: sha256(JSON.stringify(form)),
+    enforcementId: text(live['id']),
+    name,
+    namespacePath: text(live['namespace_path']),
+  };
+};
+
+export const matches = (
+  attributes: BaoMfaLoginEnforcementAttributes,
+  props: BaoMfaLoginEnforcementProps,
+  resolved: readonly string[],
+): boolean => attributes.digest === sha256(JSON.stringify(canonicalFromProps(props, resolved)));
+
+/** Every list, as a JSON array, every time — the ⚠️ on GetOk above. */
+export const writeBody = (form: BaoMfaEnforcementCanonical): Record<string, unknown> => ({
+  auth_method_accessors: [...form.authMethodAccessors],
+  auth_method_types: [...form.authMethodTypes],
+  identity_entity_ids: [...form.identityEntityIds],
+  identity_group_ids: [...form.identityGroupIds],
+  mfa_method_ids: [...form.mfaMethodIds],
+});
+
+const NAME = /^\w(?:[\w.-]*\w)?$/;
+
+export const problems = (
+  props: BaoMfaLoginEnforcementProps,
+  missingPaths: readonly string[],
+): readonly string[] => {
+  const found: string[] = [];
+  if (!NAME.test(props.name)) found.push(`name \`${props.name}\` is not a valid enforcement name`);
+  if (sortedSet(props.mfaMethodIds).length === 0) found.push('mfaMethodIds is empty');
+  const targets = [
+    props.authMethodPaths,
+    props.authMethodAccessors,
+    props.authMethodTypes,
+    props.identityGroupIds,
+    props.identityEntityIds,
+  ].some((list) => sortedSet(list ?? []).length > 0);
+  if (!targets) found.push('no target: an enforcement with none is accepted and enforces NOTHING');
+  if (missingPaths.length > 0) {
+    found.push(`no auth mount at ${missingPaths.map((path) => mountPath(path)).join(', ')}`);
+  }
+  return found;
+};

package/src/openbao/mfa-enforcement.ts

@@ -0,0 +1,143 @@
+/**
+ * A login-MFA enforcement — `identity/mfa/login-enforcement/<name>`: logins through these mounts
+ * (or by these groups/entities) must also pass one of these MFA methods. The machine-access plan's
+ * "admin requires OpenBao login MFA" is this resource.
+ *
+ * ⛔ ENROL BEFORE YOU ENFORCE. A login the enforcement matches, by an entity with no secret for any
+ *   listed method, FAILS (login_mfa.go validateLoginMFAInternal: "MFA secret … not present"). Enrol
+ *   every admin (`identity/mfa/method/totp/admin-generate`, which RETURNS the secret — never through
+ *   Alchemy) before the first deploy of this, or the admin lane locks itself out.
+ * ⚠️ IT MATCHES MOUNTS, GROUPS AND ENTITIES — NEVER ROLES. An enforcement on the `jwt/` accessor
+ *   covers every role on that mount (login_mfa.go buildMFAEnforcementConfigList :932-1017). To put
+ *   MFA on admin only, give admin its own auth mount, or target an identity group of admins.
+ * ⛔ THE DELETE IS REFUSED: IN 2.6.2 IT DOES NOT STICK. DeleteMFALoginEnforcementConfigByNameAndNamespace
+ *   (login_mfa.go:1879-1902) removes the entry from memory and never from storage, so it RETURNS on the
+ *   next unseal — tracked upstream as openbao/openbao#4030, open on 2026-09-21. Worse, a method
+ *   deleted in between leaves the resurrected enforcement naming an id that no longer exists, and
+ *   every login it matches then fails ("MFA method configuration not present", :871-877). A delete
+ *   that reports success and quietly comes back is the lie this package refuses to tell. Under the
+ *   default `retain` it never runs; with `destroy`, set `retain` to drop it from state and leave it
+ *   live — which is what the server would do anyway.
+ *
+ * ★ REPLACE SEMANTICS (REPLACE.md): `name` changed → `replace`, create-first (names are per
+ *   namespace; the new one cannot collide). Under `retain` BOTH enforcements then apply — fail
+ *   closed. Under `destroy` the old one's delete is refused, so the deploy stops after creating.
+ */
+import { Resource } from 'alchemy';
+import { isResolved } from 'alchemy/Diff';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+import {
+  type BaoMfaLoginEnforcementAttributes,
+  type BaoMfaLoginEnforcementProps,
+  attributesOf,
+  canonicalFromProps,
+  matches,
+  problems,
+  writeBody,
+} from './mfa-enforcement-form.ts';
+import { authAccessors, readEnforcement, writeEnforcement } from './mfa-wire.ts';
+
+export type {
+  BaoMfaLoginEnforcementAttributes,
+  BaoMfaLoginEnforcementProps,
+} from './mfa-enforcement-form.ts';
+
+export interface BaoMfaLoginEnforcement extends Resource<
+  'Bao.MfaLoginEnforcement',
+  BaoMfaLoginEnforcementProps,
+  BaoMfaLoginEnforcementAttributes,
+  never,
+  HttpClient.HttpClient
+> {}
+
+export const BaoMfaLoginEnforcement = Resource<BaoMfaLoginEnforcement>('Bao.MfaLoginEnforcement', {
+  defaultRemovalPolicy: 'retain',
+});
+
+type Env = HttpClient.HttpClient;
+
+const refuse = (name: string, message: string): Effect.Effect<never> =>
+  Effect.die(new Error(`Bao.MfaLoginEnforcement ${name}: ${message}`));
+
+/** Paths resolved to accessors, and what the declaration would be refused for. */
+const resolveTargets = (props: BaoMfaLoginEnforcementProps) =>
+  Effect.map(authAccessors(props.authMethodPaths ?? []), ({ accessors, missing }) => ({
+    bad: problems(props, missing),
+    resolved: accessors,
+  }));
+
+const readLive = (
+  name: string,
+): Effect.Effect<BaoMfaLoginEnforcementAttributes | undefined, BaoError, Env> =>
+  Effect.map(readEnforcement(name), (live) =>
+    live === undefined ? undefined : attributesOf(name, live),
+  );
+
+export const planEnforcement = (
+  props: BaoMfaLoginEnforcementProps,
+): Effect.Effect<'noop' | 'update', BaoError, Env> =>
+  Effect.gen(function* () {
+    const { bad, resolved } = yield* resolveTargets(props);
+    if (bad.length > 0) return 'update';
+    const live = yield* readLive(props.name);
+    return live !== undefined && matches(live, props, resolved) ? 'noop' : 'update';
+  });
+
+/** Write when live differs, then prove it by reading back. */
+export const reconcileEnforcement = (
+  props: BaoMfaLoginEnforcementProps,
+): Effect.Effect<BaoMfaLoginEnforcementAttributes, BaoError, Env> =>
+  Effect.gen(function* () {
+    const { bad, resolved } = yield* resolveTargets(props);
+    if (bad.length > 0) return yield* refuse(props.name, bad.join('; '));
+    const live = yield* readLive(props.name);
+    if (live === undefined || !matches(live, props, resolved)) {
+      yield* writeEnforcement(props.name, writeBody(canonicalFromProps(props, resolved)));
+    }
+    const after = yield* readLive(props.name);
+    if (after === undefined)
+      return yield* refuse(props.name, 'the write succeeded but it is absent.');
+    if (!matches(after, props, resolved)) {
+      return yield* refuse(props.name, 'the enforcement read back different.');
+    }
+    return after;
+  });
+
+export const BaoMfaLoginEnforcementProvider = () =>
+  Provider.effect(
+    BaoMfaLoginEnforcement,
+    Effect.succeed(
+      BaoMfaLoginEnforcement.Provider.of({
+        /** ⛔ The namespace's enforcement listing is not a list of things this owns. */
+        list: () => Effect.succeed([]),
+
+        read: Effect.fn(function* ({ olds }) {
+          return yield* readLive(olds.name);
+        }),
+
+        /** ⛔ IT COMPARES THE LIVE ENFORCEMENT — a target removed by hand is drift, not a noop. */
+        diff: Effect.fn(function* ({ news, output }) {
+          if (output === undefined || !isResolved(news)) return undefined;
+          if (news.name !== output.name) return { action: 'replace' } as const;
+          return { action: yield* planEnforcement(news) } as const;
+        }),
+
+        reconcile: Effect.fn(function* ({ news }) {
+          return yield* reconcileEnforcement(news);
+        }),
+
+        /** ⛔ REFUSED — read the header: in 2.6.2 the delete does not survive a restart. */
+        delete: Effect.fn(function* ({ output }) {
+          return yield* refuse(
+            output.name,
+            'REFUSING to delete: OpenBao 2.6.2 drops a login enforcement from memory only, and it ' +
+              'returns on the next unseal (openbao/openbao#4030). Set this resource back to ' +
+              'retain to drop it from state; remove it for good only once the server is fixed.',
+          );
+        }),
+      }),
+    ),
+  );