@homeflare/alchemy 0.5.0 → 0.7.0

package/dist/launchd/launchctl.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The four `launchctl` subcommands LaunchdJob uses — print, print-disabled, bootstrap, bootout —
+ * over a HostRunner, plus the parsers for the two read-only ones.
+ *
+ * ★ MEASURED 2026-09-21 ON macOS 27.2 (read-only `print` / `print-disabled` only; nothing was
+ *   bootstrapped or booted out to write this):
+ *   - `print system/<unknown>` exits **113** with "Could not find service … in domain for system"
+ *     on stderr. 113 is therefore "not loaded", not an error.
+ *   - `print` of a loaded job is a `<target> = {` block. Its own fields sit one tab deep
+ *     (`\tstate = running`, `\tpid = 1219`, `\tlast exit code = 0` or `(never exited)`); nested
+ *     blocks (`resource coalition`, `semaphores`) repeat names like `state` two tabs deep.
+ *   - `print-disabled <domain>` lists `"label" => enabled|disabled`.
+ *   - reading needs no root: a uid-501 shell printed system-domain jobs.
+ *   - `print gui/<uid>/<label>` for a uid with NO LOGIN SESSION exits **112** with "Could not find
+ *     domain for user gui: <uid>" (and so does `print-disabled gui/<uid>`); a malformed target is
+ *     64, a missing service in a live gui domain is 113. So 112 + that text is "the domain does
+ *     not exist", which means the job cannot be loaded — not an error for a read or a delete.
+ * ⚠️ REASONED, NOT MEASURED: bootstrap/bootout exit codes. nix-darwin's own activation script on the
+ *   same host notes "`bootout` on an already-absent job is a no-op that returns non-zero", which is
+ *   why bootout here is always preceded by a print and followed by a poll, never trusted alone.
+ * ⛔ NEVER PUT `print` STDOUT IN AN ERROR. It contains the job's whole environment.
+ */
+import type { HostRunner } from './runner.ts';
+export declare const LAUNCHCTL = "/bin/launchctl";
+/** `launchctl print` of an unknown service — measured, see above. */
+export declare const NOT_FOUND = 113;
+/** `launchctl print` into a gui domain with no login session — measured, see above. */
+export declare const NO_DOMAIN = 112;
+export declare class LaunchctlError extends Error {
+    constructor(command: string, exitCode: number, stderr: string);
+}
+export type ServiceStatus = {
+    readonly loaded: boolean;
+    /** The domain itself is absent (a gui/<uid> with no login session). Implies `loaded: false`. */
+    readonly domainMissing?: true;
+    readonly state?: string;
+    readonly pid?: number;
+    readonly lastExitCode?: number;
+};
+/**
+ * The job block's own `key = value` lines, ignoring nested blocks.
+ * ⚠️ A multi-line ProgramArguments entry is printed raw inside `arguments = {`, so a close is only
+ *   accepted when its indentation matches the open. An argument that itself contains a line of
+ *   exactly one tab and `}` would still desynchronise this; no real job has one.
+ */
+export declare const printFields: (stdout: string) => Map<string, string>;
+export declare const parsePrint: (stdout: string) => ServiceStatus;
+/** Labels `print-disabled` reports as disabled. Older releases printed `=> true` for disabled. */
+export declare const parseDisabled: (stdout: string) => Set<string>;
+export declare const printService: (runner: HostRunner, target: string) => Promise<ServiceStatus>;
+export declare const isDisabled: (runner: HostRunner, domain: string, label: string) => Promise<boolean>;
+export declare const bootstrap: (runner: HostRunner, domain: string, plistPath: string) => Promise<void>;
+/**
+ * Poll `print` until the service is gone. ⚠️ bootout can return before launchd lets go of it.
+ * ★ 30 s, because a job gets SIGTERM and then its ExitTimeOut before SIGKILL: launchd.plist(5)
+ *   documents a 20 s default (a macOS 27.2 `print` showed `exit timeout = 5` for a job that sets
+ *   none). Giving up sooner would fail a deploy over a job that was, correctly, still exiting.
+ */
+export declare const waitUnloaded: (runner: HostRunner, target: string, attempts?: number, intervalMs?: number) => Promise<void>;
+/** Boot a service out if it is loaded, and wait until launchd has let go. Idempotent. */
+export declare const bootoutIfLoaded: (runner: HostRunner, target: string) => Promise<void>;
+//# sourceMappingURL=launchctl.d.ts.map

package/dist/launchd/launchctl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchctl.d.ts","sourceRoot":"","sources":["../../src/launchd/launchctl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAC1C,qEAAqE;AACrE,eAAO,MAAM,SAAS,MAAM,CAAC;AAC7B,uFAAuF;AACvF,eAAO,MAAM,SAAS,MAAM,CAAC;AAG7B,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAG5D;CACF;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,gGAAgG;IAChG,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,WAAY,MAAM,KAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAuB9D,CAAC;AAOF,eAAO,MAAM,UAAU,WAAY,MAAM,KAAG,aAY3C,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,aAAa,WAAY,MAAM,KAAG,GAAG,CAAC,MAAM,CAQxD,CAAC;AAEF,eAAO,MAAM,YAAY,WAAkB,UAAU,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CAW5F,CAAC;AAEF,eAAO,MAAM,UAAU,WACb,UAAU,UACV,MAAM,SACP,MAAM,KACZ,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF,eAAO,MAAM,SAAS,WACZ,UAAU,UACV,MAAM,aACH,MAAM,KAChB,OAAO,CAAC,IAAI,CAKd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,WACf,UAAU,UACV,MAAM,6CAGb,OAAO,CAAC,IAAI,CAQd,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,eAAe,WAAkB,UAAU,UAAU,MAAM,KAAG,OAAO,CAAC,IAAI,CAqBtF,CAAC"}

package/dist/launchd/local-runner.d.ts

@@ -0,0 +1,7 @@
+import type { HostRunner } from './runner.ts';
+export type LocalRunnerOptions = {
+    /** Kill a spawned program after this long. @default 120_000 */
+    readonly execTimeoutMs?: number;
+};
+export declare const localRunner: (options?: LocalRunnerOptions) => HostRunner;
+//# sourceMappingURL=local-runner.d.ts.map

package/dist/launchd/local-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-runner.d.ts","sourceRoot":"","sources":["../../src/launchd/local-runner.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAwB,UAAU,EAAgB,MAAM,aAAa,CAAC;AAElF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAyEF,eAAO,MAAM,WAAW,aAAa,kBAAkB,KAAQ,UAgD9D,CAAC"}

package/dist/launchd/plist.d.ts

@@ -0,0 +1,41 @@
+/**
+ * An XML property list serializer — the subset launchd.plist(5) reads, and nothing else.
+ *
+ * ★ WHY NOT AN npm LIBRARY. Nothing in this workspace depends on one (checked 2026-09-21: no
+ *   `plist`, `xmlbuilder` or `@xmldom/xmldom` anywhere under node_modules), and the common one pulls
+ *   an XML DOM in for PARSING, which a provider that only RENDERS never does. The subset a launchd
+ *   job needs is five node types, so this is ~100 lines plus exhaustive tests (plist.test.ts), which
+ *   also round-trip every case through Apple's own `plutil` when the tests run on macOS.
+ *
+ * ⛔ THE OUTPUT MUST BE DETERMINISTIC. LaunchdJob diffs by the SHA-256 of these bytes, so two
+ *   renders of one declaration must be byte-identical: dict keys are sorted, indentation is fixed,
+ *   and nothing depends on insertion order. A non-deterministic render is a forever-`update`.
+ * ⚠️ AND A CHANGE TO THIS FILE'S OUTPUT RESTARTS EVERY JOB. A new header, indent or escape changes
+ *   every digest, so the next deploy after the kit upgrade updates — restarts — every declared
+ *   job at once. Treat any byte change here as a breaking change and say so in its changeset.
+ *
+ * ⛔ REFUSE, NEVER COERCE. `undefined`, `null`, a fraction, NaN, a class instance or a character XML
+ *   1.0 cannot carry is a thrown PlistError naming the path, not a silently dropped key. A dropped
+ *   `KeepAlive` is a daemon that never restarts, and nothing downstream would say why.
+ */
+/** Every value launchd reads. ⚠️ No `<real>`, `<date>` or `<data>`: no launchd key needs one. */
+export type PlistValue = string | number | boolean | readonly PlistValue[] | {
+    readonly [key: string]: PlistValue;
+};
+export type PlistDict = {
+    readonly [key: string]: PlistValue;
+};
+export declare class PlistError extends Error {
+    readonly path: string;
+    constructor(path: string, detail: string);
+}
+/**
+ * Escape text content.
+ * ⚠️ CR IS A CHARACTER REFERENCE, NOT A LITERAL. An XML parser normalises a literal CR (and CRLF)
+ *   to LF before the application sees it (XML 1.0 §2.11), so `a\r\nb` would come back as `a\nb` and
+ *   the argument launchd passes would differ from the one declared. `&#13;` survives normalisation.
+ */
+export declare const escapeText: (text: string, path: string) => string;
+/** Render a top-level dict as a complete XML plist document, ending in a newline. */
+export declare const renderPlist: (dict: PlistDict) => string;
+//# sourceMappingURL=plist.d.ts.map

package/dist/launchd/plist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plist.d.ts","sourceRoot":"","sources":["../../src/launchd/plist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,iGAAiG;AACjG,MAAM,MAAM,UAAU,GAClB,MAAM,GACN,MAAM,GACN,OAAO,GACP,SAAS,UAAU,EAAE,GACrB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,CAAC;AAE/D,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,IAAI,EAAE,MAAM;IADvB,YACW,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EAIf;CACF;AAoBD;;;;;GAKG;AACH,eAAO,MAAM,UAAU,SAAU,MAAM,QAAQ,MAAM,KAAG,MAcvD,CAAC;AAoEF,qFAAqF;AACrF,eAAO,MAAM,WAAW,SAAU,SAAS,KAAG,MAO7C,CAAC"}

package/dist/launchd/providers.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Both launchd-subpath providers with one HostRunner, as a single layer for a host stack.
+ *
+ *     Layer.mergeAll(launchdProviders(), …the stack's other providers)
+ *
+ * ★ ONE RUNNER FOR BOTH, so a daemon's config file (HostFile) and the daemon (LaunchdJob) are
+ *   written by the same identity on the same host — a stack cannot write the file as one user and
+ *   bootstrap the job as another by accident.
+ * ⚠️ The default is localRunner(): this process, never elevated. A system-domain job therefore
+ *   needs the deploy itself started as root, or a runner passed here with `privileged: true`.
+ */
+import * as Layer from 'effect/Layer';
+import { type HostRunner } from './runner.ts';
+export declare const launchdProviders: (runner?: HostRunner) => Layer.Layer<import("alchemy").Provider<import("./host-file.ts").HostFile> | import("alchemy").Provider<import("./job.ts").LaunchdJob>, never, never>;
+//# sourceMappingURL=providers.d.ts.map

package/dist/launchd/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/launchd/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,aAAa,CAAC;AAE/D,eAAO,MAAM,gBAAgB,YAAY,UAAU,yJAGhD,CAAC"}

package/dist/launchd/runner.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The one seam between the launchd providers and the host: every file read, file write and
+ * `launchctl` call goes through a HostRunner, and nothing in this directory touches the host any
+ * other way.
+ *
+ * ★ WHY A SEAM AND NOT DIRECT node:fs CALLS. launchd has no SDK — the provider renders a plist and
+ *   drives `launchctl` — so the only way to test the lifecycle without a real launchd (and without
+ *   writing /Library) is to swap the host out. fake-runner.ts is an in-memory host with a scripted
+ *   launchd; local-runner.ts is the real one. The same seam is where a consumer plugs in a runner
+ *   that reaches a host some other way.
+ *
+ * ★ PROMISES, NOT EFFECTS, ON PURPOSE. A consumer writing their own runner implements plain async
+ *   functions; the providers lift them into Effect at the call site (host-effect.ts).
+ */
+import * as Context from 'effect/Context';
+import * as Layer from 'effect/Layer';
+/** One finished process. ⛔ `stdout` may carry anything the job's environment holds — never log it. */
+export type ExecResult = {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+};
+/**
+ * What `lstat` says about a path. ⚠️ lstat, not stat: a symlink is reported as a symlink, because
+ *   writing through one would change a file this resource never named.
+ */
+export type FileStat = {
+    readonly kind: 'file' | 'directory' | 'symlink' | 'other';
+    /** Permission bits only (`& 0o7777`), never the file-type bits. */
+    readonly mode: number;
+    readonly uid: number;
+    readonly gid: number;
+    readonly size: number;
+};
+export type WriteOptions = {
+    /** Permission bits for the final file, applied BEFORE it becomes visible at `path`. */
+    readonly mode: number;
+    /** Numeric owner; omitted means whoever the runner writes as. */
+    readonly uid?: number;
+    /** Numeric group; omitted means the directory's default. */
+    readonly gid?: number;
+};
+export type HostUser = {
+    readonly uid: number;
+    readonly gid: number;
+    readonly home: string;
+};
+export interface HostRunner {
+    /**
+     * ⛔ DECLARED, NEVER INFERRED. `true` only when every call this runner makes already runs with
+     *   root's authority — a runner that talks to a root helper, say. The providers refuse
+     *   system-domain writes unless `effectiveUid()` is 0 or this is `true`, so claiming it falsely
+     *   turns that refusal into an EACCES halfway through a deploy.
+     * ⛔ THE KIT NEVER ELEVATES. No runner here calls `sudo`: a deploy that prompts for a password
+     *   mid-plan, or silently uses a cached sudo ticket, is exactly the "no silent sudo" failure. A
+     *   consumer who wants elevation writes that runner deliberately and sets this flag.
+     */
+    readonly privileged: boolean;
+    /** The uid file writes and launchctl calls run as. */
+    effectiveUid(): number;
+    /** Run a program with an argv — ⛔ never through a shell. */
+    exec(argv: readonly string[]): Promise<ExecResult>;
+    /** File bytes, or `undefined` when nothing is at `path`. */
+    readFile(path: string): Promise<Uint8Array | undefined>;
+    /** lstat, or `undefined` when nothing is at `path`. */
+    stat(path: string): Promise<FileStat | undefined>;
+    /**
+     * Write `bytes` so that `path` holds either the old file or the new one, never a torn mix:
+     * a temporary file in the same directory, mode and owner set on it, then rename(2) over `path`.
+     * ⚠️ The parent directory must exist; creating it would invent an owner and mode nobody declared.
+     */
+    writeFileAtomic(path: string, bytes: Uint8Array, options: WriteOptions): Promise<void>;
+    /** Remove a file. Idempotent: nothing at `path` is success. */
+    removeFile(path: string): Promise<void>;
+    /** A user by name or numeric id, or `undefined` when the host has none. */
+    lookupUser(nameOrId: string): Promise<HostUser | undefined>;
+    /** A group's gid by name or numeric id, or `undefined` when the host has none. */
+    lookupGroup(nameOrId: string): Promise<number | undefined>;
+    /** Wait between launchctl polls. ★ Injected so a test never sleeps for real. */
+    sleep(ms: number): Promise<void>;
+}
+declare const HostRunnerService_base: Context.ServiceClass<HostRunnerService, "homeflare/launchd/HostRunner", HostRunner>;
+/** The Effect service every launchd provider reads its runner from. */
+export declare class HostRunnerService extends HostRunnerService_base {
+}
+/** Provide a runner to the providers: `Layer.provide(hostRunnerLayer(localRunner()))`. */
+export declare const hostRunnerLayer: (runner: HostRunner) => Layer.Layer<HostRunnerService>;
+/** True when this runner may write root-owned paths and drive the system domain. */
+export declare const canActAsRoot: (runner: HostRunner) => boolean;
+export {};
+//# sourceMappingURL=runner.d.ts.map

package/dist/launchd/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/launchd/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,sGAAsG;AACtG,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1D,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,UAAU;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,YAAY,IAAI,MAAM,CAAC;IACvB,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACxD,uDAAuD;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAClD;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,+DAA+D;IAC/D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,2EAA2E;IAC3E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC5D,kFAAkF;IAClF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3D,gFAAgF;IAChF,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;;AAED,uEAAuE;AACvE,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,eAAe,WAAY,UAAU,KAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;AAE3C,oFAAoF;AACpF,eAAO,MAAM,YAAY,WAAY,UAAU,KAAG,OACA,CAAC"}

package/dist/launchd/secret-tripwire.d.ts

@@ -0,0 +1,24 @@
+/**
+ * A tripwire for the obvious ways a secret ends up in Alchemy state through these providers.
+ *
+ * ⛔ WHY IT EXISTS. Alchemy persists every prop UNENCRYPTED in its state store — the same reason
+ *   the OpenBao families are metadata-only (openbao/policy.ts). A LaunchdJob's `environment` and
+ *   `programArguments`, and a HostFile's `content`, are props. A token declared there is a token
+ *   copied into the state store, into every plan diff, and into the plist or file on disk.
+ * ★ THE ALTERNATIVE, NAMED IN EVERY REFUSAL: let a secret renderer (openbao-agent, or any other)
+ *   write the secret to a root-owned file, and declare only its PATH — `FOO_TOKEN_FILE=/path`,
+ *   `--token-file /path`. The job reads the file at start; the state holds a path.
+ *
+ * ⚠️ A TRIPWIRE, NOT A SCANNER. It catches the names and shapes people actually type. A token in
+ *   an innocently named variable passes; nothing here can make a secret safe to declare.
+ */
+import type { PlistDict } from './plist.ts';
+export declare const PRIVATE_KEY: RegExp;
+/**
+ * Refusals for a job's environment, argv and extraKeys. Empty means nothing tripped.
+ * ★ extraKeys too: it is a prop like the others, so it lands in state just the same.
+ */
+export declare const jobSecretProblems: (environment: Readonly<Record<string, string>> | undefined, argv: readonly string[], extraKeys?: PlistDict) => string[];
+/** Refusals for a HostFile's content. */
+export declare const fileSecretProblems: (content: string) => string[];
+//# sourceMappingURL=secret-tripwire.d.ts.map

package/dist/launchd/secret-tripwire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-tripwire.d.ts","sourceRoot":"","sources":["../../src/launchd/secret-tripwire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AAgBxD,eAAO,MAAM,WAAW,QAA0C,CAAC;AAgBnE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,gBACf,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,QACnD,SAAS,MAAM,EAAE,cACX,SAAS,KACpB,MAAM,EAsBR,CAAC;AAEF,yCAAyC;AACzC,eAAO,MAAM,kBAAkB,YAAa,MAAM,KAAG,MAAM,EACuB,CAAC"}

package/dist/openbao/auth-method-form.d.ts

@@ -9,6 +9,13 @@ export interface BaoAuthMethodProps {
     defaultLeaseTtl?: string;
     /** Max lease TTL, e.g. `8760h`. */
     maxLeaseTtl?: string;
+    /**
+     * The path this method lives at NOW, when `path` is where it should move to — `sys/remount`
+     * from `auth/<remountFrom>`, keeping every role. Without it a changed `path` fails the plan
+     * (mount-move.ts). ⚠️ Every token issued through the method is revoked by the move, and login
+     * URLs, policies and MFA enforcements by accessor are not rewritten (the accessor is kept).
+     */
+    remountFrom?: string;
 }
 export interface BaoAuthMethodAttributes {
     path: string;

package/dist/openbao/auth-method-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-method-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method-form.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAoB,CAAC;AAiB1D,eAAO,MAAM,YAAY,UAChB,kBAAkB,QACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,uBAUF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAiC,CAAC;AAEvE;;;GAGG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,WAA6B,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,kBAAkB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAI3E,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,QAAQ,UAAW,kBAAkB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMzE,CAAC;AASF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,uBAAuB,SAAS,kBAAkB,YAIlC,CAAC;AAErD,eAAO,MAAM,SAAS,UAAW,kBAAkB,YAGlB,CAAC"}
+{"version":3,"file":"auth-method-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method-form.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAoB,CAAC;AAiB1D,eAAO,MAAM,YAAY,UAChB,kBAAkB,QACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,uBAUF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAiC,CAAC;AAEvE;;;GAGG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,WAA6B,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,kBAAkB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAI3E,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,QAAQ,UAAW,kBAAkB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMzE,CAAC;AASF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,uBAAuB,SAAS,kBAAkB,YAIlC,CAAC;AAErD,eAAO,MAAM,SAAS,UAAW,kBAAkB,YAGlB,CAAC"}

package/dist/openbao/auth-method-reconcile.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Bao.AuthMethod's read and reconcile as plain effects — split from auth-method.ts so the move runs
+ * against a fake server. Same shape as mount-reconcile.ts; the one difference that matters is the
+ * `auth/` prefix sys/remount needs (vault/logical_system.go:1295-1310 refuses to move an auth mount
+ * to a non-auth path, and `token/` cannot move at all).
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoAuthMethodAttributes, type BaoAuthMethodProps } from './auth-method-form.ts';
+import type { BaoError } from './bao-status.ts';
+import type { RemountError, RemountOptions } from './remount-wire.ts';
+export declare const readMethod: (props: BaoAuthMethodProps) => Effect.Effect<BaoAuthMethodAttributes | undefined, BaoError, HttpClient.HttpClient>;
+/** Converge one auth method. `stated` is the path in Alchemy's state, if any. */
+export declare const reconcileAuthMethod: (news: BaoAuthMethodProps, stated: string | undefined, options?: RemountOptions) => Effect.Effect<BaoAuthMethodAttributes, BaoError | RemountError, HttpClient.HttpClient>;
+//# sourceMappingURL=auth-method-reconcile.d.ts.map

package/dist/openbao/auth-method-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-method-reconcile.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,UAAU,UACd,kBAAkB,KACxB,MAAM,CAAC,MAAM,CAAC,uBAAuB,GAAG,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAKjF,CAAC;AAUL,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,SACxB,kBAAkB,UAChB,MAAM,GAAG,SAAS,YAChB,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,GAAG,YAAY,EAAE,UAAU,CAAC,UAAU,CA8BpF,CAAC"}

package/dist/openbao/auth-method.d.ts

@@ -7,6 +7,12 @@
  * ★ `defaultRemovalPolicy: 'retain'` — disabling a method destroys every role under it
  *   and revokes tokens minted through those roles. Opt in with
  *   `.pipe(RemovalPolicy.destroy())`.
+ *
+ * ★ REPLACE SEMANTICS (audited 2026-09-21, see REPLACE.md): `type` changed → plans `replace`, whose
+ *   create half dies on the still-occupied path before any write, so the apply fails and nothing is
+ *   disabled (auth-method-reconcile.ts); `path` changed → FAILS unless `remountFrom` names the old
+ *   path (then an in-place move). It used to plan `update` and enable an empty method at the new
+ *   path, exactly as Bao.Mount did.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/auth-method.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-method.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAQ/B,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,CAAC;AAE5D,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,aAAa,gDAExB,CAAC;AASH,eAAO,MAAM,qBAAqB,oGAmE/B,CAAC"}
+{"version":3,"file":"auth-method.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,uBAAuB,CAAC;AAK/B,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,CAAC;AAE5D,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,aAAa,gDAExB,CAAC;AAEH,eAAO,MAAM,qBAAqB,oGAqD/B,CAAC"}

package/dist/openbao/auth-role-form.d.ts

@@ -33,6 +33,15 @@ export declare const readPath: (name: string) => string;
  * ★ ALL STRINGS, EXACTLY THE `k=v` PAIRS `bao write` USED TO SEND — see `baoWrite` in bao-http.ts.
  */
 export declare const writeBody: (props: BaoAuthRoleProps) => Record<string, string>;
+/**
+ * Whether a changed `name` names a DIFFERENT role — the diff's `replace` question.
+ *
+ * ⚠️ CASE-INSENSITIVELY, BECAUSE THE SERVER IS. AppRole stores `role/<lowercased name>` (openbao
+ *   v2.6.2 builtin/credential/approle/path_role.go:1485, and roleEntry reads the same key, :1537),
+ *   so `Host` → `host` is the SAME role: a `replace` there would write it, then — under `destroy` —
+ *   delete the old generation, which is that same role.
+ */
+export declare const isRename: (from: string, to: string) => boolean;
 /** True when live already matches the declaration on every managed field. */
 export declare const matches: (attributes: BaoAuthRoleAttributes, props: BaoAuthRoleProps) => boolean;
 //# sourceMappingURL=auth-role-form.d.ts.map

package/dist/openbao/auth-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-form.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,eAAO,MAAM,YAAY,UAChB,gBAAgB,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,qBAWF,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAgC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,SAAS,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAYxE,CAAC;AAWF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAUjF,CAAC"}
+{"version":3,"file":"auth-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role-form.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,eAAO,MAAM,YAAY,UAChB,gBAAgB,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,qBAWF,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,WAAgC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,SAAS,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAYxE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,MAAM,MAAM,KAAG,OACX,CAAC;AAW1C,6EAA6E;AAC7E,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAUjF,CAAC"}

package/dist/openbao/auth-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-role.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAKtB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AASH,eAAO,MAAM,mBAAmB,kGAsD7B,CAAC"}
+{"version":3,"file":"auth-role.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAMtB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AASH,eAAO,MAAM,mBAAmB,kGAiE7B,CAAC"}

package/dist/openbao/auth-token-form.d.ts

@@ -0,0 +1,48 @@
+export type BaoTokenType = 'batch' | 'default' | 'service';
+export interface BaoTokenProps {
+    /** Policies on tokens this role issues. Names only. */
+    tokenPolicies: readonly string[];
+    /** Token TTL (`15m`). Default `0` — the mount's default. */
+    tokenTtl?: string;
+    /** Token max TTL (`1h`). Default `0` — the mount's max. */
+    tokenMaxTtl?: string;
+    /** Hard ceiling that renewal cannot pass. Default `0` (none). */
+    tokenExplicitMaxTtl?: string;
+    /** Periodic tokens renew forever within this period. Default `0` (not periodic). */
+    tokenPeriod?: string;
+    /** Leave the `default` policy off. Default false. */
+    tokenNoDefaultPolicy?: boolean;
+    /** CIDRs a token may be USED from. Default none. */
+    tokenBoundCidrs?: readonly string[];
+    /** Uses before the token dies; `0` is unlimited. Default 0. */
+    tokenNumUses?: number;
+    /** Default `default` — the mount decides, which means service tokens unless it says otherwise. */
+    tokenType?: BaoTokenType;
+}
+/** The token fields as seconds and sorted sets — both sides of a diff are built by `tokenForm`. */
+export interface BaoTokenForm {
+    tokenBoundCidrs: readonly string[];
+    tokenExplicitMaxTtlSeconds: number;
+    tokenMaxTtlSeconds: number;
+    tokenNoDefaultPolicy: boolean;
+    tokenNumUses: number;
+    tokenPeriodSeconds: number;
+    tokenPolicies: readonly string[];
+    tokenTtlSeconds: number;
+    tokenType: string;
+}
+/**
+ * The token fields of an already-normalised form, in one fixed key order — what a role family's own
+ * canonical literal spreads, so its digest cannot depend on how the object was assembled.
+ */
+export declare const tokenFields: (input: BaoTokenForm) => BaoTokenForm;
+export declare const tokenFormOfProps: (props: BaoTokenProps) => BaoTokenForm;
+export declare const tokenFormOfLive: (live: Record<string, unknown>) => BaoTokenForm;
+/**
+ * The token half of a role write — every field, defaults included (the merge ⚠️ above). Durations
+ * go over as the author's own strings; lists as JSON arrays, which a comma-string-slice accepts.
+ */
+export declare const tokenBody: (props: BaoTokenProps) => Record<string, unknown>;
+/** Refusals the token half can know without a server. */
+export declare const tokenProblems: (props: BaoTokenProps) => readonly string[];
+//# sourceMappingURL=auth-token-form.d.ts.map

package/dist/openbao/auth-token-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-token-form.d.ts","sourceRoot":"","sources":["../../src/openbao/auth-token-form.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,oDAAoD;IACpD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,mGAAmG;AACnG,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,0BAA0B,EAAE,MAAM,CAAC;IACnC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAgBD;;;GAGG;AACH,eAAO,MAAM,WAAW,UAAW,YAAY,KAAG,YAUhD,CAAC;AAeH,eAAO,MAAM,gBAAgB,UAAW,aAAa,KAAG,YAWpD,CAAC;AAEL,eAAO,MAAM,eAAe,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAW5D,CAAC;AAEL;;;GAGG;AACH,eAAO,MAAM,SAAS,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAUrE,CAAC;AAEH,yDAAyD;AACzD,eAAO,MAAM,aAAa,UAAW,aAAa,KAAG,SAAS,MAAM,EAqBnE,CAAC"}

package/dist/openbao/bao-identity.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Refuse to plan against the wrong vault: assert the `cluster_name` and namespace a stack expects
+ * BEFORE any Bao.* resource reads or writes.
+ *
+ * ⛔ WHY IT EXISTS. A `BAO_ADDR` left exported for one vault (or a `BAO_AGENT_ADDR`, which wins)
+ *   would otherwise apply a stack written for another vault to it, and every family here would
+ *   plan CREATEs against the wrong server with a clean conscience (the estate's site-config plan,
+ *   "Identity checks on every live plan").
+ *   A missing `BAO_NAMESPACE` does the same thing one level down: the stack lands in root.
+ *
+ * ★ `sys/health`, UNAUTHENTICATED, WITH NO TOKEN AND NO NAMESPACE HEADER. READ FROM openbao v2.6.2:
+ *   · http/sys_health.go:143-165 — `cluster_name` and `cluster_id` are filled ONLY while unsealed,
+ *     and the body is top-level JSON, not wrapped in `data`.
+ *   · http/handler.go:108-124, :405-411 — `health` is a root-only API: a request carrying
+ *     `X-Vault-Namespace` is answered 400 "operation unavailable in namespaces". So the header is
+ *     stripped for this one call, whatever BAO_NAMESPACE says.
+ *   · The query asks for 200 when sealed, uninitialised or standby (`sealedcode`, `uninitcode`,
+ *     `standbyok`, :78-110), so the body is always there to read and the refusal can say WHICH.
+ *   ⛔ NO TOKEN IS SENT. Until this check passes, the server has not even claimed to be ours, and a
+ *     token sent to the wrong server is a token handed over.
+ * ⚠️ IT CATCHES A MISTARGET, NOT AN IMPOSTOR (review 2026-09-21). `cluster_name` is answered to
+ *   anyone, unauthenticated, so a hostile server can echo the expected one; passing proves the
+ *   address is configured right, never who answers. TLS to a trusted certificate is what
+ *   authenticates the server — keep an https BAO_ADDR on anything that is not loopback or a socket.
+ * ★ THE NAMESPACE IS CHECKED TWICE. Locally first: the namespace every later call will send (the
+ *   same bao-address.ts resolution) must BE the expected one. Then remotely: unauthenticated
+ *   `sys/internal/ui/mounts` with that namespace header answers 200 when the namespace exists and
+ *   404 "namespace not found" when it does not (vault/request_handling.go:607-612; the path is in
+ *   the system backend's Unauthenticated list, vault/logical_system.go:95). Only the status is read.
+ *   REASONED FROM SOURCE, not measured against a live server.
+ * ⚠️ IT PROVES THE CLUSTER, NOT THE NODE. A standby answers with the cluster's name, which is the
+ *   point: a standby forwards to the same vault.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoEnvironment } from './bao-address.ts';
+/** `input` a blank expectation · `mismatch` the wrong vault · `unconfirmed` could not tell · `unreachable` no answer. */
+export type BaoIdentityFailure = 'input' | 'mismatch' | 'unconfirmed' | 'unreachable';
+/** ⛔ Every message starts `REFUSING:`, and none carries a token — only the address and names. */
+export declare class BaoIdentityError extends Error {
+    readonly reason: BaoIdentityFailure;
+    constructor(reason: BaoIdentityFailure, detail: string);
+}
+export interface BaoIdentityExpected {
+    /** The vault's `cluster_name` (server config `cluster_name`, or the one generated at init). */
+    readonly clusterName: string;
+    /** The namespace the stack targets: `team-a`, or `''` / `root` for the root namespace. */
+    readonly namespace: string;
+}
+/** What the vault said about itself once every check passed. */
+export interface BaoIdentity {
+    /** The resolved address, without any token. */
+    readonly address: string;
+    readonly clusterName: string;
+    readonly clusterId: string;
+    readonly version: string;
+    /** Canonical: `''` is root. */
+    readonly namespace: string;
+}
+export declare const HEALTH_PATH = "sys/health?standbyok=true&sealedcode=200&uninitcode=200";
+export declare const NAMESPACE_PROBE_PATH = "sys/internal/ui/mounts";
+/** Read a health body into the one question asked of it. Pure, for the tests. */
+export declare const checkHealth: (address: string, expectedCluster: string, body: Record<string, unknown> | undefined) => {
+    readonly clusterId: string;
+    readonly version: string;
+} | BaoIdentityError;
+/**
+ * The check, as an Effect under BaoEnv (process.env unless provided). Fails with BaoIdentityError
+ * and nothing else.
+ */
+export declare const assertBaoIdentityEffect: (expected: BaoIdentityExpected) => Effect.Effect<BaoIdentity, BaoIdentityError, HttpClient.HttpClient>;
+/**
+ * `assertBaoIdentityEffect` for a plain script. `env` defaults to `process.env`, read at call time.
+ * ★ Rejects with the BaoIdentityError itself (Effect.runPromise, as in approle-login.ts).
+ *
+ *     await assertBaoIdentity({ clusterName: 'vault-example', namespace: 'team-a' });
+ */
+export declare const assertBaoIdentity: (input: BaoIdentityExpected & {
+    readonly env?: BaoEnvironment;
+}) => Promise<BaoIdentity>;
+//# sourceMappingURL=bao-identity.d.ts.map

package/dist/openbao/bao-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bao-identity.d.ts","sourceRoot":"","sources":["../../src/openbao/bao-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,kBAAkB,CAAC;AAKvE,yHAAyH;AACzH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,UAAU,GAAG,aAAa,GAAG,aAAa,CAAC;AAEtF,iGAAiG;AACjG,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,MAAM,EAAE,kBAAkB;IADrC,YACW,MAAM,EAAE,kBAAkB,EACnC,MAAM,EAAE,MAAM,EAIf;CACF;AAED,MAAM,WAAW,mBAAmB;IAClC,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+BAA+B;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,WAAW,4DAA4D,CAAC;AACrF,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAc7D,iFAAiF;AACjF,eAAO,MAAM,WAAW,YACb,MAAM,mBACE,MAAM,QACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KACxC;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,gBAyB7D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,aACxB,mBAAmB,KAC5B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,UAAU,CAAC,UAAU,CA8CjE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,UACrB,mBAAmB,GAAG;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,cAAc,CAAA;CAAE,KAC7D,OAAO,CAAC,WAAW,CAKrB,CAAC"}

package/dist/openbao/bao-namespace.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Namespace spellings, made comparable. `homeflare`, `/homeflare/` and `homeflare/` are one
+ * namespace to OpenBao, and `root` (or nothing) is the root namespace.
+ *
+ * ★ READ FROM openbao v2.6.2: namespace.Canonicalize trims the leading slash and appends a trailing
+ *   one, and ResolveNamespaceFromRequest (vault/namespace_store.go:1573-1598) re-routes a header
+ *   that is literally `root/` to the root namespace. A namespace's own `namespace_path` in an API
+ *   answer is that canonical form: `''` for root, `a/b/` below it (vault/login_mfa.go
+ *   mfaConfigToMap and mfaLoginEnforcementConfigToMap).
+ */
+import { type BaoEnvironment } from './bao-address.ts';
+/** The bare name: no leading or trailing slash, and `''` for the root namespace. */
+export declare const canonicalNamespace: (namespace: string | undefined) => string;
+/** OpenBao's `namespace_path` rendering of the same namespace: `''` or `a/b/`. */
+export declare const namespacePath: (namespace: string | undefined) => string;
+/** The namespace every call under `env` targets, canonical. */
+export declare const envNamespace: (env: BaoEnvironment) => string;
+/** How a namespace reads in a message: `root` rather than an empty pair of backticks. */
+export declare const namespaceLabel: (namespace: string) => string;
+//# sourceMappingURL=bao-namespace.d.ts.map

package/dist/openbao/bao-namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bao-namespace.d.ts","sourceRoot":"","sources":["../../src/openbao/bao-namespace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,kBAAkB,CAAC;AAGvE,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,cAAe,MAAM,GAAG,SAAS,KAAG,MAGlE,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,aAAa,cAAe,MAAM,GAAG,SAAS,KAAG,MAG7D,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,YAAY,QAAS,cAAc,KAAG,MACA,CAAC;AAEpD,yFAAyF;AACzF,eAAO,MAAM,cAAc,cAAe,MAAM,KAAG,MACZ,CAAC"}

package/dist/openbao/cloudflare-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-role.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,0BAA0B,EAAiB,MAAM,mCAAmC,CAAC;AAE9F,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAOnC,YAAY,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,yBAAyB,qIA+HnC,CAAC"}
+{"version":3,"file":"cloudflare-role.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,0BAA0B,EAAiB,MAAM,mCAAmC,CAAC;AAE9F,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAM5B,MAAM,2BAA2B,CAAC;AAcnC,YAAY,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,yBAAyB,qIA8InC,CAAC"}

package/dist/openbao/cloudflare-roles-expand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-roles-expand.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-roles-expand.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAgB,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE3F,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;CAC/B;AAED,0DAA0D;AAC1D,eAAO,MAAM,IAAI,SAAU,MAAM,WAIL,CAAC;AAE7B;;;;GAIG;AACH,eAAO,MAAM,QAAQ,SAAU,cAAc,WACY,CAAC;AAE1D,qFAAqF;AACrF,eAAO,MAAM,SAAS,YAAa,MAAM,WAAW,MAAM,WAAuC,CAAC;AAkFlG,+FAA+F;AAC/F,eAAO,MAAM,aAAa,WAChB,WAAW,WACV,WAAW,SACb,SAAS,cAAc,EAAE,KAC/B,YAAY,EAwBd,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,WACZ,WAAW,kBACH,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,KAClE,WAAW,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAgB7C,CAAC"}
+{"version":3,"file":"cloudflare-roles-expand.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-roles-expand.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAgB,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG3F,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;CAC/B;AAED,0DAA0D;AAC1D,eAAO,MAAM,IAAI,SAAU,MAAM,WAAkE,CAAC;AAEpG;;;;GAIG;AACH,eAAO,MAAM,QAAQ,SAAU,cAAc,WACY,CAAC;AAE1D,qFAAqF;AACrF,eAAO,MAAM,SAAS,YAAa,MAAM,WAAW,MAAM,WAAuC,CAAC;AAkFlG,+FAA+F;AAC/F,eAAO,MAAM,aAAa,WAChB,WAAW,WACV,WAAW,SACb,SAAS,cAAc,EAAE,KAC/B,YAAY,EAwBd,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,WACZ,WAAW,kBACH,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,KAClE,WAAW,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAgB7C,CAAC"}

package/dist/openbao/fake-engines.d.ts

@@ -0,0 +1,30 @@
+import * as Layer from 'effect/Layer';
+import type { Reply, Seen } from './fake-bao.ts';
+type Stored = Record<string, unknown>;
+/** An answer for fake-bao that also exposes what it holds, keyed by API path (no `/v1/`). */
+export type Store = ((seen: Seen) => Reply) & {
+    readonly live: Map<string, Stored>;
+};
+/**
+ * `sys/policies/acl/<name>`. It strips the policy's trailing newline on write (measured on the live
+ * server — digest.ts), and keys the name as OpenBao does: trimmed and lowercased (`policyKey`).
+ */
+export declare const aclPolicies: () => Store;
+/**
+ * `<mount>/roles/<name>` on the Cloudflare engine. A write parses the duration text into seconds and
+ * re-marshals `policies` (path_roles.go:117-146, :199-210). Names are stored verbatim.
+ */
+export declare const cloudflareRoles: () => Store;
+/**
+ * `<mount>/roles/<name>` on the proxmox engine. A write MERGES into the stored role, and TTLs go over
+ * as seconds (homeflare-openbao-plugins secrets/proxmox/path_roles.go, pathRolesWrite).
+ */
+export declare const proxmoxRoles: () => Store;
+/**
+ * Bao.Policy's provider over fragment directories that exist only here: `…/empty` holds no file,
+ * `…/two` holds two, and any other directory one. Each file is one grant named after its own path,
+ * so a directory's content is its name.
+ */
+export declare const fakePolicyProviders: Layer.Layer<import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Provider<import("./policy.ts").BaoPolicy>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export {};
+//# sourceMappingURL=fake-engines.d.ts.map

package/dist/openbao/fake-engines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-engines.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-engines.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAMjD,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtC,6FAA6F;AAC7F,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AA6BrF;;;GAGG;AACH,eAAO,MAAM,WAAW,QAAO,KAU5B,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAO,KAQ9B,CAAC;AAEN;;;GAGG;AACH,eAAO,MAAM,YAAY,QAAO,KAS3B,CAAC;AAEN;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,8LAiB/B,CAAC"}