@homeflare/alchemy 0.5.0 → 0.7.0

package/dist/openbao/fake-stack.d.ts

@@ -0,0 +1,29 @@
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import type { BaoEnvironment } from './bao-address.ts';
+import { type Fake, type Reply, type Seen } from './fake-bao.ts';
+/** The planned action for each resource, deletions included, keyed by FQN. */
+export type Planned = Readonly<Record<string, string>>;
+/** A stack body: resource declarations, as an `alchemy.run.ts` would write them. */
+export type StackBody = Effect.Effect<unknown, unknown, unknown>;
+export interface FakeStack {
+    /** Plan, then apply, `body`. Resolves to the plan; rejects with the apply's failure. */
+    readonly deploy: (body: StackBody) => Promise<Planned>;
+}
+/**
+ * One stack over one state store, shared by every `deploy`, so the second deploy plans against what
+ * the first one recorded.
+ *
+ * ⚠️ THE CASTS ARE AT THE ENGINE'S TYPED BOUNDARY, NOT IN THE PROVIDERS. `Alchemy.Stack` types its body
+ *   against every service a CLI run provides. Here the body needs only the providers given, and a
+ *   missing one fails the test by name ("Provider not found for …").
+ */
+export declare const fakeStack: <ROut, E, RIn>(providers: Layer.Layer<ROut, E, RIn>, env: BaoEnvironment, name?: string) => FakeStack;
+/**
+ * A fake engine answering with `answer`, and one stack over it, for one test. The fake stops however
+ * `body` ends.
+ */
+export declare const withFakeStack: <ROut, E, RIn>(providers: Layer.Layer<ROut, E, RIn>, answer: (seen: Seen) => Reply, body: (stack: FakeStack, bao: Fake) => Promise<void>) => Promise<void>;
+/** Every call that changed something, as `METHOD /v1/path`, in order. */
+export declare const writesOf: (seen: readonly Seen[]) => string[];
+//# sourceMappingURL=fake-stack.d.ts.map

package/dist/openbao/fake-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-stack.d.ts","sourceRoot":"","sources":["../../src/openbao/fake-stack.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,KAAK,IAAI,EAAE,KAAK,KAAK,EAAE,KAAK,IAAI,EAAW,MAAM,eAAe,CAAC;AAE1E,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvD,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEjE,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAiBD;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,aACzB,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAC/B,cAAc,oBAElB,SA4BF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAU,IAAI,EAAE,CAAC,EAAE,GAAG,aACnC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAC5B,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,QACvB,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,KACnD,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,QAAQ,SAAU,SAAS,IAAI,EAAE,KAAG,MAAM,EACoC,CAAC"}

package/dist/openbao/host-approles.d.ts

@@ -0,0 +1,62 @@
+/**
+ * One AppRole role per host, generated from a host list and a few class definitions — pure, so a
+ * scaffold test can render every role from one site config and assert on it without a vault.
+ *
+ * ★ WHY PER HOST, NOT PER CLASS. OpenBao sets an AppRole login's entity alias to the role_id, so
+ *   every host sharing a class role is ONE identity: one entity in every audit line, and one cached
+ *   token when two hosts send the same login through a caching proxy (vault consolidation plan,
+ *   decision 8 as amended 2026-09-21; not re-measured here). The CLASS carries the policies and
+ *   TTLs; the ROLE carries the host.
+ *
+ * ★ THE NAMING RULE: `<class>--<host>`, e.g. `pve-node--node-a`.
+ *   · Class and host names are lowercase letters, digits and SINGLE hyphens, so `--` can only ever
+ *     be the separator and a name splits back into exactly one (class, host) pair.
+ *   · Class first, so one class's roles share a prefix a reader (or a policy path glob,
+ *     `auth/approle/role/pve-node--*`) can select — and no hand-made role (`deploy`,
+ *     `approle-rotator`) can match it, because none of them contains `--`.
+ *   · Lowercase because AppRole stores role names lowercased (builtin/credential/approle stores
+ *     `role/<lowercased name>`); a mixed-case name would read back as a different string.
+ *
+ * ⛔ NO ROLE WITHOUT AN EXPIRING SECRET_ID. `secretIdTtl` must parse to MORE than zero: `0` is a
+ *   secret_id that never expires, which is the `deploy` credential the plan is retiring. The plan's
+ *   class default is 90 days (`2160h`, which auth-role-form.test.ts shows OpenBao accepts).
+ * ⛔ `bindSecretId` IS ALWAYS TRUE. A role that logs in on role_id alone makes the role_id — which
+ *   is not treated as a secret — the whole credential.
+ * ⚠️ A RENAMED HOST OR CLASS IS A NEW ROLE: a new role_id, and a new secret_id to push to the host
+ *   in the same change. What Alchemy calls it depends on the logical id. Keyed by the role name (as
+ *   the README does), the old id VANISHES from the stack, so it is an orphan delete, not a
+ *   `replace`. Keyed by something stable, Bao.AuthRole plans a `replace`. Either way the default
+ *   `retain` leaves the old role LIVE, its secret_ids still logging in (alchemy Plan.ts:2040 and
+ *   Apply.ts:2152-2173 honour retain on both paths) — see the ⚠️ in auth-role.ts before renaming.
+ */
+import type { BaoAuthRoleProps } from './auth-role-form.ts';
+/** What every host of one class gets. */
+export interface HostRoleClass {
+    /** Policy names. ⛔ Never empty, never `root`. */
+    readonly policies: readonly string[];
+    readonly tokenTtl: string;
+    readonly tokenMaxTtl: string;
+    /** ⛔ Must be more than zero — e.g. `2160h` (90 days). */
+    readonly secretIdTtl: string;
+    /** `0` (the default) means unlimited uses, which a host that logs in repeatedly needs. */
+    readonly secretIdNumUses?: number;
+}
+export interface HostRoleHost {
+    /** Short host name, e.g. `node-a`. */
+    readonly name: string;
+    /** Key into `classes`. */
+    readonly class: string;
+}
+export interface HostAppRolesInput {
+    readonly hosts: readonly HostRoleHost[];
+    readonly classes: Readonly<Record<string, HostRoleClass>>;
+}
+export declare const HOST_ROLE_SEPARATOR = "--";
+/** The naming rule, in one place: `<class>--<host>`. */
+export declare const hostRoleName: (className: string, host: string) => string;
+/**
+ * Every host's role props, sorted by role name. Throws, naming every problem at once, on a class or
+ * host that breaks a rule above — this runs when a stack is defined, so a throw stops the plan.
+ */
+export declare const hostAppRoles: (input: HostAppRolesInput) => readonly BaoAuthRoleProps[];
+//# sourceMappingURL=host-approles.d.ts.map

package/dist/openbao/host-approles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-approles.d.ts","sourceRoot":"","sources":["../../src/openbao/host-approles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;CAC3D;AAKD,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,wDAAwD;AACxD,eAAO,MAAM,YAAY,cAAe,MAAM,QAAQ,MAAM,KAAG,MAClB,CAAC;AAyB9C;;;GAGG;AACH,eAAO,MAAM,YAAY,UAAW,iBAAiB,KAAG,SAAS,gBAAgB,EA+BhF,CAAC"}

package/dist/openbao/index.d.ts

@@ -10,17 +10,36 @@
  * ★ THE APPROLE LOGIN IS HERE FOR SCRIPTS, NOT STACKS (approle-login.ts). A wrapper that logs in
  *   and revokes on exit needs it, and giving it the families' own transport is what keeps a script
  *   and a stack from disagreeing about which server BAO_ADDR means.
+ * ★ SO IS THE IDENTITY GUARD (bao-identity.ts), for the opposite reason: a stack calls it FIRST, so
+ *   no family plans against a vault that is not the one the stack was written for.
+ * ★ hostAppRoles IS PURE — no provider, no call — so a scaffold test can render every per-host
+ *   AppRole from one site config.
  */
 export type { AppRoleLogin, AppRoleLoginInput, BaoLoginFailure } from './approle-login.ts';
 export { BaoLoginError, appRoleLogin, appRoleLoginEffect, revokeSelf, revokeSelfEffect, } from './approle-login.ts';
 export { BaoAuthMethod, BaoAuthMethodProvider } from './auth-method.ts';
+export type { BaoAuthRoleProps } from './auth-role.ts';
 export { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
+export type { BaoIdentity, BaoIdentityExpected, BaoIdentityFailure } from './bao-identity.ts';
+export { BaoIdentityError, assertBaoIdentity, assertBaoIdentityEffect } from './bao-identity.ts';
 export { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';
 export { CloudflarePermissionGroups, permissionGroupsFromEngine, permissionGroupsFromLiveRoles, } from './cloudflare-permission-groups.ts';
 export type { CloudflareZone, ExpandedRole } from './cloudflare-roles-expand.ts';
 export { expandAccount, expandAll, mountName } from './cloudflare-roles-expand.ts';
 export type { RolesConfig, SurfaceSpec } from './cloudflare-roles-config.ts';
 export { parseRolesConfig } from './cloudflare-roles-config.ts';
+export type { HostAppRolesInput, HostRoleClass, HostRoleHost } from './host-approles.ts';
+export { HOST_ROLE_SEPARATOR, hostAppRoles, hostRoleName } from './host-approles.ts';
+export type { BaoJwtAuthConfigProps } from './jwt-config.ts';
+export { BaoJwtAuthConfig, BaoJwtAuthConfigProvider } from './jwt-config.ts';
+export type { BaoJwtRoleProps, BaoJwtRoleType } from './jwt-role.ts';
+export { BaoJwtRole, BaoJwtRoleProvider } from './jwt-role.ts';
+export type { BaoKubernetesAliasSource, BaoKubernetesRoleProps } from './kubernetes-role.ts';
+export { BaoKubernetesRole, BaoKubernetesRoleProvider } from './kubernetes-role.ts';
+export type { BaoMfaLoginEnforcementProps } from './mfa-enforcement.ts';
+export { BaoMfaLoginEnforcement, BaoMfaLoginEnforcementProvider } from './mfa-enforcement.ts';
+export type { BaoMfaTotpMethodProps, BaoTotpAlgorithm } from './mfa-totp.ts';
+export { BaoMfaTotpMethod, BaoMfaTotpMethodProvider } from './mfa-totp.ts';
 export { BaoMount, BaoMountProvider } from './mount.ts';
 export { BaoPkiRole, BaoPkiRoleProvider } from './pki-role.ts';
 export type { BaoPluginProps, BaoPluginType } from './plugin.ts';

package/dist/openbao/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/openbao/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EACL,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACnF,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/D,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/openbao/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EACL,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACxE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACnF,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrF,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/D,YAAY,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpF,YAAY,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAC9F,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/D,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}