@homeflare/alchemy 0.6.0 → 0.7.0

package/dist/openbao/policy.d.ts

@@ -77,6 +77,8 @@ export interface BaoPolicy extends Resource<'Bao.Policy', BaoPolicyProps, BaoPol
  *   orphaned resource; a caller that means it opts in with `.pipe(RemovalPolicy.destroy())`. This
  *   is Terraform's `prevent_destroy`, not a stubbed operation — a delete that silently did nothing
  *   would lie to whoever read the plan.
+ * ⚠️ `retain` ALSO KEEPS THE OLD GENERATION OF A RENAME. A new `name` plans `replace`, and under
+ *   `retain` the old policy is left live and unmanaged (rename.ts, REPLACE.md).
  */
 export declare const BaoPolicy: import("alchemy").ResourceClass<BaoPolicy>;
 export declare const BaoPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoPolicy>, never, FileSystem.FileSystem | HttpClient.HttpClient | Path.Path>;

package/dist/openbao/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAYH,eAAO,MAAM,iBAAiB,oIAuG3B,CAAC"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAMnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAYH,eAAO,MAAM,iBAAiB,oIA2H3B,CAAC"}

package/dist/openbao/proxmox-role-form.d.ts

@@ -63,18 +63,18 @@ export interface BaoProxmoxRoleAttributes {
 }
 /** `proxmox-tb4/roles/read` — read, write and delete all address the role here. */
 export declare const rolePath: (mount: string, name: string) => string;
-export declare const attributesOf: (props: BaoProxmoxRoleProps, live: Record<string, unknown>) => BaoProxmoxRoleAttributes;
+export declare const attributesOf: (props: Pick<BaoProxmoxRoleProps, 'mount' | 'name'>, live: Record<string, unknown>) => BaoProxmoxRoleAttributes;
 /**
  * The body for `PUT <mount>/roles/<name>` — all strings, the `k=v` pairs `bao write` sent — or
  * the prop names whose duration would not parse.
  *
- * ⛔ A WRITE TO roles/{name} REPLACES THE ROLE, IT DOES NOT MERGE. An omitted `ttl` is written
- *   as the field's zero value, so a resource that treated undeclared TTLs as "unmanaged" — the
- *   Bao.Mount shape — would silently reset a lease ceiling every time it rewrote the role for an
- *   unrelated reason. Both TTLs are therefore required props and EVERY write carries all three
- *   fields. REASONED from the Vault secrets-framework write semantics plus this plugin's schema
- *   marking only `mint_user` required; NOT measured, because this session was read-only and
- *   proving it would have meant writing to the live engine.
+ * ⛔ EVERY WRITE CARRIES ALL THREE FIELDS, and both TTLs are required props, so `matches` covers
+ *   the whole role and no field is left unmanaged behind a green plan.
+ * ⚠️ CORRECTED 2026-09-21 FROM THE PLUGIN SOURCE. This said a write REPLACES the role and resets an
+ *   omitted TTL to zero. The port in homeflare-openbao-plugins (secrets/proxmox/path_roles.go,
+ *   pathRolesWrite, commit 0e79154) MERGES: it loads the stored role and sets only the fields
+ *   present (`d.GetOk`). An omitted TTL would keep its old value, which is still a value this
+ *   resource would not be managing. The build running live was not re-checked against that source.
  *
  * ⚠️ Seconds go on the wire as integers, not as `1h`. The schema declares both TTLs
  *   `"format": "seconds"`, and an integer is accepted unambiguously by every path that reads
@@ -87,6 +87,16 @@ export declare const writeBody: (props: BaoProxmoxRoleProps) => {
     ok: false;
     bad: string[];
 };
+/**
+ * Why moving the role's mint user from `before` to the declared one must be refused, or undefined.
+ * The ⛔ on reconcile in proxmox-role.ts says why a re-scope needs `allowMintUserChange`.
+ *
+ * ★ ONE DEFINITION FOR BOTH PLACES THAT ASK. Reconcile asks it of the live role at the same path.
+ *   The diff asks it across a rename, where `before` is the role being replaced: a rename writes a
+ *   brand-new role, so reconcile alone would see nothing to re-scope, and a rename would become the
+ *   way around the guard.
+ */
+export declare const rescopeRefusal: (before: string, mintUser: string, allowMintUserChange: string | undefined) => string | undefined;
 /** True when the live role already matches the declaration on every field the plugin stores. */
 export declare const matches: (attributes: BaoProxmoxRoleAttributes, props: BaoProxmoxRoleProps) => boolean;
 //# sourceMappingURL=proxmox-role-form.d.ts.map

package/dist/openbao/proxmox-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxmox-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role-form.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,mBAAmB;IAClC,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,mFAAmF;AACnF,eAAO,MAAM,QAAQ,UAAW,MAAM,QAAQ,MAAM,WAAwC,CAAC;AAE7F,eAAO,MAAM,YAAY,UAChB,mBAAmB,QACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,wBAYF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,UACb,mBAAmB,KACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAWzE,CAAC;AAaF,gGAAgG;AAChG,eAAO,MAAM,OAAO,eAAgB,wBAAwB,SAAS,mBAAmB,YAG9C,CAAC"}
+{"version":3,"file":"proxmox-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role-form.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,mBAAmB;IAClC,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,mFAAmF;AACnF,eAAO,MAAM,QAAQ,UAAW,MAAM,QAAQ,MAAM,WAAwC,CAAC;AAE7F,eAAO,MAAM,YAAY,UAChB,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,CAAC,QAC5C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,wBAYF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,UACb,mBAAmB,KACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAWzE,CAAC;AAaF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,WACjB,MAAM,YACJ,MAAM,uBACK,MAAM,GAAG,SAAS,KACtC,MAAM,GAAG,SAIyF,CAAC;AAEtG,gGAAgG;AAChG,eAAO,MAAM,OAAO,eAAgB,wBAAwB,SAAS,mBAAmB,YAG9C,CAAC"}

package/dist/openbao/proxmox-role-wire.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The read Bao.ProxmoxRole makes of `<mount>/roles/<name>`, split from proxmox-role.ts so the diff,
+ * reconcile and the rename's re-scope check share one definition of "the live role".
+ */
+import * as Effect from 'effect/Effect';
+import { type BaoProxmoxRoleProps } from './proxmox-role-form.ts';
+/**
+ * The live role, or undefined when OpenBao answers 404.
+ *
+ * ⚠️ A missing MOUNT and a missing ROLE both read as undefined here, because both answer 404:
+ *   an absent role is a read that found nothing, and a path under no mount is OpenBao's
+ *   unsupported-path error, which is also a 404 (sdk/logical/response_util.go). They are not the
+ *   same failure — one is a typo in `mount`, the other is a role that has yet to be created — so
+ *   reconcile lets OpenBao's own `errors` through on the write rather than inventing a message.
+ *   A bad mount says "no handler for route".
+ */
+export declare const readRole: (props: Pick<BaoProxmoxRoleProps, 'mount' | 'name'>) => Effect.Effect<import("./proxmox-role-form.ts").BaoProxmoxRoleAttributes | undefined, import("./bao-status.ts").BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=proxmox-role-wire.d.ts.map

package/dist/openbao/proxmox-role-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxmox-role-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role-wire.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,mBAAmB,EAA0B,MAAM,wBAAwB,CAAC;AAE1F;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,UAAW,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,CAAC,mLAKvE,CAAC"}

package/dist/openbao/proxmox-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxmox-role.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAE9D,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAiBH,eAAO,MAAM,sBAAsB,qGAoIhC,CAAC"}
+{"version":3,"file":"proxmox-role.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,wBAAwB,CAAC;AAYhC,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAE9D,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,eAAO,MAAM,sBAAsB,qGAkKhC,CAAC"}

package/dist/openbao/rename.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Rename safety for the families whose identity is a name, or a mount and a name: Bao.Policy,
+ * Bao.CloudflareRole and Bao.ProxmoxRole. REPLACE.md has the audit and what each answer does.
+ *
+ * ⛔ THE BUG THIS CLOSES, REPRODUCED 2026-09-21 AGAINST alchemy@2.0.0-beta.79's OWN PLAN AND APPLY
+ *   (fake-stack.ts): a Bao.Policy deployed as `old`, then redeclared as `new` under
+ *   `RemovalPolicy.destroy()`, planned `update` and left BOTH policies live. diff read the NEW
+ *   path, found nothing, answered `update`, and reconcile wrote the new object. The old one stayed
+ *   live under no state record, so no later plan would mention it, and not even `destroy` could
+ *   remove it.
+ * ★ A CHANGED IDENTITY IS A DIFFERENT OBJECT, SO THE ANSWER IS `replace`. Create-first
+ *   (`deleteFirst` false): the new path never collides with the old, the new generation is written,
+ *   dependents are updated in the same graph, and only then is the old generation deleted. The
+ *   engine hands that delete the OLD generation's attributes (Apply.ts deleteOldGenerations and the
+ *   GC pass both pass `output: old.attr`), and every delete here reads `output`, never `news`.
+ *   ⛔ A new path that collides with ANOTHER live object is refused at plan instead (`judgeMove`).
+ * ⚠️ UNDER `retain` THE OLD OBJECT STAYS LIVE. Apply.ts:2164-2173 skips the old generation's delete
+ *   and logs "Retaining replaced resource (removal policy: retain)". The plan still says `replace`
+ *   and the apply says what it kept, so it is no longer silent, but the old object is unmanaged
+ *   from then on. Remove it by hand, or opt into `RemovalPolicy.destroy()`.
+ */
+import * as Effect from 'effect/Effect';
+/**
+ * A string prop of a diff's `news`, once that one prop is resolved; `undefined` while it is still an
+ * Output of a changing upstream (a function-typed proxy) or an Effect.
+ *
+ * ★ THE IDENTITY IS JUDGED BEFORE `isResolved(news)`. That guard returns `undefined` when ANY prop is
+ *   pending, and the engine then falls back to `update` (Plan.ts, `havePropsChanged`). A rename that
+ *   lands in the same deploy as a pending `fragments` or `policies` Output would slip through as
+ *   `update`, which is the orphan again. launchd/host-effect.ts reads its identity the same way.
+ */
+export declare const declaredString: (news: unknown, key: string) => string | undefined;
+/** True while an optional prop is declared but is not yet a value: an Output of a changing upstream. */
+export declare const isPendingProp: (news: unknown, key: string) => boolean;
+/** A role's API path from a diff's `news`, once both `mount` and `name` are resolved. */
+export declare const declaredRolePath: (news: unknown, rolePath: (mount: string, name: string) => string) => string | undefined;
+/**
+ * How OpenBao keys an ACL policy: trimmed and lowercased. openbao v2.6.2
+ * vault/policy/policy_store.go:698-700 (`sanitizeName`), applied by SetPolicy (:268), GetPolicy
+ * (:378) and DeletePolicy (:562).
+ *
+ * ⛔ SO `Admin` → `admin` IS THE SAME POLICY, NOT A RENAME. A `replace` there would write it, and then,
+ *   under `destroy`, delete the old generation, which is that same policy. Every grant it carries
+ *   would be revoked by a change of case.
+ */
+export declare const policyKey: (name: string) => string;
+/**
+ * Whether the declared identity names a different object than the one in state: `true` → moved (the
+ * diff asks `judgeMove`, which also reads the target); `false` → the same object; `undefined` → not
+ * knowable yet, because the declared side is still an Output. `key` is how the SERVER keys the object (`policyKey`); the default is exact,
+ * which is right for a mount path (vault/routing/router.go folds no case) and for both plugins'
+ * roles (each stores `roles/<name>` verbatim).
+ *
+ * ⛔ NEVER `replace` ON AN UNKNOWN IDENTITY. The Output may resolve to the same path, and a replace
+ *   onto the same path deletes, under `destroy`, the object it has just written. The diff defers
+ *   instead. If the engine then plans `update` and the identity turns out to have changed,
+ *   `refuseMovedUpdate` stops reconcile before it writes anything.
+ */
+export declare const isMoved: (stored: string, declared: string | undefined, key?: (identity: string) => string) => boolean | undefined;
+/**
+ * The role path a resource last wrote, or last tried to: its attributes once a write finished, else
+ * the props of the create or replacement that did not (`output` is undefined for both).
+ */
+export declare const triedRolePath: (output: {
+    readonly mount: string;
+    readonly name: string;
+} | undefined, olds: unknown, rolePath: (mount: string, name: string) => string) => string | undefined;
+/**
+ * The diff's first question, asked before `isResolved(news)`: the move from the identity this
+ * resource last wrote or tried (`tried`) to the declared one, or undefined when both name the same
+ * object or either is still unknown. `pathOf` is the API path an identity is read at.
+ *
+ * ⛔ A MOVE ONTO AN OBJECT THAT ALREADY EXISTS FAILS THE PLAN. MEASURED 2026-09-21 through the engine
+ *   (rename-occupied.test.ts): two policies that swapped names under `RemovalPolicy.destroy()` each
+ *   planned `replace`, each new generation wrote over the other's live policy, and each old
+ *   generation's delete then removed the name the other had just written. The deploy was green and
+ *   both policies were gone, every grant revoked. A shift (a → b while b → c), and a move onto the
+ *   name of a resource leaving the stack, were measured ending the same way. So was reverting a
+ *   move whose new generation failed: the old generation still holds the name, and its delete runs
+ *   after the revert has rewritten it. That is why `tried` falls back to the props of an unfinished
+ *   write.
+ * ⚠️ THE DIFF CANNOT SEE THE REMOVAL POLICY, SO THIS REFUSES UNDER `retain` TOO, where a swap, or a
+ *   move back onto a retained old generation, would have been harmless. The cost is a move in two
+ *   deploys through a free name, or removing the target by hand. The alternative is a green deploy
+ *   that deletes what it has just written.
+ * ★ ONE PLAN-TIME READ, OF A PATH THE NEW GENERATION'S RECONCILE READS ANYWAY. A 404, a missing mount
+ *   included, is free; a refused read fails the plan, as any other diff read does.
+ */
+export declare const judgeMove: (family: string, tried: string | undefined, declared: string | undefined, pathOf: (identity: string) => string, key?: (identity: string) => string) => Effect.Effect<{
+    from: string;
+    to: string;
+} | undefined, import("./bao-status.ts").BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * Reconcile's guard: an `update` whose prior attributes name another object.
+ *
+ * ★ REACHED ONLY WHEN THE DIFF COULD NOT SEE THE NEW IDENTITY at plan time. A fresh create, and the
+ *   new generation of a `replace`, both reach reconcile with `output` undefined (Apply.ts passes
+ *   `output: attr`, which is empty for a new generation). An `update` reaches it with the previous
+ *   generation's attributes.
+ * ★ THE FAILED DEPLOY SETTLES ITSELF. Apply has already committed the row as `updating`, with the new
+ *   props and the OLD attributes. By the next plan the upstream Output has landed, so the diff sees
+ *   both names and answers `replace` (or refuses, if the new name is already taken: `judgeMove`).
+ *   The old object is then deleted, or retained, by the removal policy, with no hand repair.
+ */
+export declare const refuseMovedUpdate: (family: string, from: string, to: string) => Effect.Effect<never, never, never>;
+//# sourceMappingURL=rename.d.ts.map

package/dist/openbao/rename.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename.d.ts","sourceRoot":"","sources":["../../src/openbao/rename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,SAAU,OAAO,OAAO,MAAM,KAAG,OAI1D,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,SACrB,OAAO,YACH,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,KAChD,MAAM,GAAG,SAIX,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAmC,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,WACV,MAAM,YACJ,MAAM,GAAG,SAAS,QACvB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,KAChC,OAAO,GAAG,SAAiF,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,aAAa,WAChB;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,QAC/D,OAAO,YACH,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,KAChD,MAAM,GAAG,SACmF,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,WACZ,MAAM,SACP,MAAM,GAAG,SAAS,YACf,MAAM,GAAG,SAAS,UACpB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,QAC/B,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM;;;wGAgB/B,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,WAAY,MAAM,QAAQ,MAAM,MAAM,MAAM,uCAOvE,CAAC"}

package/docs/caddy.md

@@ -0,0 +1,180 @@
+# Caddy — `@homeflare/alchemy/caddy`
+
+Declare a running Caddy's config as Caddyfile text and apply it through Caddy's own admin API:
+`POST /load` to apply (a graceful reload), `GET /config/` to detect drift. `caddyWithFile()` also
+writes the same Caddyfile to the file Caddy starts from, with launchd's `HostFile`, so a restart
+keeps it. Every admin call goes through one injectable `CaddyAdmin` transport.
+
+```ts
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import { caddyProviders, caddyWithFile } from '@homeflare/alchemy/caddy';
+import { LaunchdJob, launchdProviders } from '@homeflare/alchemy/launchd';
+
+const caddyfile = `app.example.com {
+\treverse_proxy 127.0.0.1:8080
+\ttls {
+\t\tdns cloudflare {env.CF_API_TOKEN}
+\t}
+}
+`;
+
+export const edge = Effect.gen(function* () {
+  const { file } = yield* caddyWithFile('caddy', { caddyfile, path: '/usr/local/etc/Caddyfile' });
+  yield* LaunchdJob('caddy-daemon', {
+    label: 'com.example.caddy',
+    domain: 'system',
+    // --envfile: a file a secret renderer (openbao-agent) writes; {env.CF_API_TOKEN} reads it.
+    programArguments: [
+      '/usr/local/bin/caddy',
+      'run',
+      '--config',
+      file.path,
+      '--adapter',
+      'caddyfile',
+      '--envfile',
+      '/usr/local/etc/caddy.env',
+    ],
+    runAtLoad: true,
+    keepAlive: true,
+  });
+});
+// ★ launchdProviders() for the HostFile and the job; caddyProviders() for the config.
+export const providers = Layer.mergeAll(caddyProviders(), launchdProviders());
+```
+
+## CaddyConfig
+
+| prop         | notes                                                                        |
+| ------------ | ---------------------------------------------------------------------------- |
+| `caddyfile`  | the whole Caddyfile; it REPLACES the running config. ⛔ never a secret       |
+| `sourceFile` | the file Caddy was started with; `caddyWithFile()` sets it from its HostFile |
+
+| attribute      | what                                                                                 |
+| -------------- | ------------------------------------------------------------------------------------ |
+| `configSha256` | SHA-256 of the adapted JSON Caddy reported after the apply — never the config itself |
+| `endpoint`     | where the admin API was reached                                                      |
+| `sourceFile`   | as applied                                                                           |
+
+| step    | what happens                                                                                                                             |
+| ------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| plan    | `POST /adapt` the Caddyfile (side-effect free): a syntax error, a literal secret, no apps or an unsafe `admin` block fails the **plan**  |
+| apply   | `POST /load` with `text/caddyfile`, then `GET /config/` must hash to what `/adapt` produced; skipped when Caddy already runs it          |
+| refused | Caddy keeps the old config (it rolls back itself); the deploy fails with Caddy's reason and says whether the old config is still running |
+| read    | the digest of `GET /config/` — with no state, a running Caddy is **adopted** (its live config becomes the baseline)                      |
+| drift   | live ≠ stored → `update`: a hand `curl` to the API, or a restart that loaded a different file                                            |
+| replace | never — a new Caddyfile is a reload of the same Caddy                                                                                    |
+| delete  | ⛔ nothing. See [Removing it](#removing-it)                                                                                              |
+
+The digests compare adapted JSON, not bytes: `/adapt` answers Go struct order, `GET /config/` sorted
+keys with `<>&` escaped and a trailing newline. `digest.ts` erases all three. ★ Measured 2026-09-21
+against a throwaway Caddy 2.11.4: the digests agree after a load and for a Caddy started from the
+same file, and a refused load kept serving the old config and answered **200** with the error after
+the adapter's warnings, which the provider still reports as a refusal.
+
+⚠️ **A stopped Caddy does not fail the plan.** Its launchd job may be the fix in the same stack, so
+`read` and `diff` plan a create/update with a warning (the plan-time `/adapt` did not run). The apply
+still needs Caddy, and fails loudly until it answers.
+
+## Order: file, then `/load`
+
+`caddyWithFile()` passes the HostFile's `path` Output into the CaddyConfig, so Alchemy writes the
+file first. It is the only order that bootstraps: a new host's Caddy job starts from the file,
+before any admin API exists to load into. What bounds the cost:
+
+- ★ **A Caddyfile that does not adapt never reaches disk** once the config has state: the plan-time
+  `/adapt` fails the plan. On the very first deploy the path is still an Output, Alchemy skips the
+  adoption probe, and the check runs at apply instead.
+- ⚠️ **A Caddyfile that adapts but that Caddy refuses** (a port in use, a missing cert file) is on
+  disk when `/load` fails. Caddy keeps serving the old config — but a **restart before the fix loads
+  the refused file**. Fix and redeploy, or run Caddy with `--resume` (below).
+- ⛔ Secrets are refused at declaration, before the HostFile exists (its `content` is a prop too).
+- ★ Both resources retain: removing them from a stack leaves the file a restart needs.
+
+## Autosave and `--resume`
+
+After every successful load (ours included) Caddy writes the config JSON to `autosave.json`
+(`$XDG_CONFIG_HOME/caddy/`, else `~/Library/Application Support/Caddy/` on macOS, `~/.config/caddy/`
+on Linux), unless the Caddyfile says `persist_config off`. ⚠️ A daemon started with no `HOME` and no
+`XDG_CONFIG_HOME` falls back to `./caddy/` under its working directory (storage.go AppConfigDir):
+set `XDG_CONFIG_HOME` in the launchd job so autosave lands where you expect.
+
+- **Without `--resume`** (the mini's Caddy today): a restart loads `--config`. The file and the
+  running config agree after every successful deploy; see the ⚠️ above for a failed one.
+- **With `caddy run --resume --config <file>`**: a restart loads `autosave.json` — the last config
+  Caddy **accepted** — and `--config` only when no autosave exists. A refused file on disk can then
+  never take sites down. The trade: a hand change through the API also survives a restart; the next
+  plan reports it as drift and the deploy puts the declaration back.
+- `--watch` reloads the file on change; our `/load` right after is then a no-op ("config is
+  unchanged").
+- `sourceFile` rides as `Caddy-Config-Source-File`, as `caddy reload` sends it. Without it a load
+  makes Caddy forget its source file, and SIGUSR1 stops reloading from it. The header only KEEPS the
+  file Caddy started with (caddy.go ClearLastConfigIfDifferent); it never sets a new one. ⚠️ Under
+  `--resume` with an autosave, Caddy records no source file at all, so SIGUSR1 has nothing to reload.
+
+## Secrets
+
+Alchemy stores props unencrypted, and the Caddyfile is a prop. Use RUNTIME placeholders, which Caddy
+resolves in its own process, so the value never enters the state, the adapted JSON or the autosave:
+
+- `{env.NAME}` — start Caddy with `--envfile <path>`; a secret renderer (openbao-agent) writes that
+  file. A rotated value needs a Caddy restart.
+- `{file./path}` — the file's contents (trailing newline trimmed), read when the placeholder runs.
+- ⚠️ `{$NAME}` is substituted at **adapt** time: the value is in the adapted JSON, readable at
+  `GET /config/` and written to `autosave.json`. Not refused, but worse.
+- ⛔ `{$NAME:default}` puts the default in the prop, and Caddy uses it whenever `NAME` is unset. The
+  tripwire checks the default as a literal.
+- `basic_auth` replaces placeholders in the hash too: `admin {env.ADMIN_HASH}`.
+
+The tripwire refuses a PEM private key, a literal after `dns`/`acme_dns <provider>`, a secret-named
+subdirective (`api_token`, `client_secret`, `password`, …) with a literal value, a literal
+`Authorization`/`Cookie`/`X-Api-Key` header, and token shapes (GitHub, AWS, Slack, `sk-…`, JWT,
+bcrypt/argon2 hashes). It never echoes what it found. It is a tripwire, not a scanner.
+
+## The admin endpoint
+
+⛔ The admin API has no authentication. `localCaddyAdmin()` accepts only `http://` loopback
+(`127.0.0.0/8`, `localhost`, `[::1]`) or `unix:///path`; the default is `http://127.0.0.1:2019`.
+
+- **Host and Origin.** Caddy refuses a request whose `Host` is not an allowed origin (DNS-rebinding
+  guard; measured on Caddy 2.11.4: `403 host not allowed`), and checks `Origin` when one is sent or
+  `enforce_origin` is on. The transport sends both as the Caddy CLI does. A unix socket skips the
+  Host check entirely.
+- **`admin { origins … }`** narrowed, or **an SSH-forwarded port** (Caddy checks the Host against
+  ITS port): pass `hostHeader: 'localhost:2019'`.
+- **Another host's Caddy** (SSH later): forward its socket or port to loopback here and point a
+  `localCaddyAdmin()` at it, or implement `CaddyAdmin` over your own route. Never expose :2019.
+- **A Caddyfile cannot strand the provider.** Before loading, the adapted `admin` block is refused
+  if it turns the API off, listens off loopback or somewhere the transport does not reach (another
+  port, socket or loopback address: `[::1]` is not `127.0.0.1`, and `localhost` binds IPv4), allows
+  no Host the transport sends (its `origins`, or Caddy's loopback defaults when there are none), sets
+  `enforce_origin` over a unix socket (no Origin is sent there), enables `remote`, or pulls config.
+- ⛔ **No `admin` address means Caddy's default** (`localhost:2019`, or `$CADDY_ADMIN`) after the
+  load. That is refused unless the transport is at that default: a Caddy reached on a socket or
+  another port declares `admin <address>` in its Caddyfile.
+
+## Adoption
+
+With no state, `read` reports the running Caddy's live config as plain (owned) attributes, so the
+first deploy adopts it silently and its forced update loads the declared Caddyfile — a full replace
+of whatever ran before. ⚠️ Review the plan: the Caddy on this loopback admin API is the one you get.
+
+## Removing it
+
+⛔ Delete never touches Caddy, under either removal policy. There is no "less config" to fall back
+to, and an empty config stops every server. `retain` is the default; with `destroy`, delete still
+only forgets. It never calls `/stop` or `DELETE /config/`. An empty Caddyfile, or one that adapts
+to no apps (only comments or global options), is refused for the same reason. To empty a Caddy, do
+it by hand at its admin API.
+
+## Traps
+
+- ⚠️ `import` paths resolve against Caddy's working directory (the API adapts with no file name).
+  Keep them absolute.
+- ⚠️ `/adapt` runs on the **running** binary. A Caddyfile that uses a plugin's directive (Cloudflare
+  DNS, caddy-security, layer4) needs that custom build running before it will validate.
+- ⚠️ **Bootstrap race.** Where Caddy is not running yet, the config can reach the admin API before
+  its launchd job has Caddy listening. The transport retries a refused connection (`retries`,
+  `retryDelayMs`; default 2 × 500 ms) — raise them, or rerun the deploy.
+- ⚠️ One `CaddyAdmin` per stack: the transport picks the Caddy, not a prop. Pointing it at another
+  Caddy plans an update that loads there; the old one keeps what it had.

package/docs/mesh-node.md

@@ -0,0 +1,188 @@
+# MeshNode — a Cloudflare Mesh node without its token in state
+
+`MeshNode` (`Cloudflare.MeshNode`) declares a Cloudflare Mesh node: the `warp_connector` object
+that a Linux host joins with the Cloudflare One Client. `fetchMeshNodeToken` fetches the node's
+enrolment token on demand, for a one-off enrolment step. Read 2026-09-21 against
+`alchemy@2.0.0-beta.79`, `@distilled.cloud/cloudflare@1.0.0-rc.12` and Cloudflare's Mesh docs.
+
+## Why not `Cloudflare.Tunnel.WarpConnector`
+
+- ⛔ **It puts the node token in state.** Its `toAttributes` calls the token endpoint on every
+  `read`, `reconcile` and `list`, and stores the result as an attribute. `Redacted` keeps it out
+  of logs, not out of the state store. The token lets any Linux host join the account's Mesh as
+  that node.
+- **It has no `ha` prop.** High availability can only be chosen when the node is created.
+- **Its plans need a Write token.** The token endpoint requires "Cloudflare One Connectors Write"
+  (or the cloudflared or Tunnel Write groups). `MeshNode` never calls it, so a plan can run on a
+  read token.
+
+## Declaring a node
+
+```ts
+import * as Cloudflare from 'alchemy/Cloudflare';
+import { MeshNode, providers as homeflareCloudflare } from '@homeflare/alchemy/cloudflare';
+
+// providers: Layer.mergeAll(Cloudflare.providers(), homeflareCloudflare()),
+const door = yield * MeshNode('vault-door', { name: 'door-a', ha: false });
+```
+
+| prop   | type      | notes                                                                             |
+| ------ | --------- | --------------------------------------------------------------------------------- |
+| `name` | `string`  | Unique per account. The identity used for adoption. Renames in place.             |
+| `ha`   | `boolean` | **Required, create-only.** The API default is `false`, the dashboard's is `true`. |
+
+Attributes: `id` (the node UUID), `accountId`, `name`, `status` (`inactive`, `degraded`,
+`healthy` or `down`, as of the last read or write) and `ha`. ⛔ There is no token attribute.
+
+The account and credentials come from Alchemy's own Cloudflare environment
+(`Cloudflare.CloudflareApiLive()`): an Alchemy profile, or `CLOUDFLARE_API_TOKEN` and
+`CLOUDFLARE_ACCOUNT_ID` in CI. So the node lands in the same account as the `Gateway.Rule` and
+`DNS.Record` resources that refer to it. `providers()` builds that layer itself, so the provider
+works whether or not the stack also merges `Cloudflare.providers()`.
+
+⛔ **Removal policy: `retain` by default**, like the kit's other resources whose deletion breaks
+their consumers. Dropping the declaration or `alchemy destroy` leaves the node live and only drops
+it from state. Opt a declaration into deletion with `.pipe(RemovalPolicy.destroy())`.
+
+### Choosing `ha`: a door is `ha: false`
+
+HA fails over the CIDR **routes** a node advertises. A node with no routes (a door: callers dial
+its Mesh IP) gains nothing from it, because the Mesh IP belongs to each replica: "Nodes without
+routes do not benefit from HA failover" (Cloudflare's Mesh HA page, read 2026-09-21). After a
+failover the promoted replica answers on its own Mesh IP, so nothing dialling the first one
+follows it.
+
+So a door is `ha: false`, and **a second door is a second `MeshNode`** with its own name, token
+and Mesh IP. Callers list both addresses. Keep `ha: true` for a subnet gateway with routes, on a
+device profile that uses MASQUE.
+
+## What each change does
+
+| change                   | answer                      | what happens on Cloudflare                                                                  |
+| ------------------------ | --------------------------- | ------------------------------------------------------------------------------------------- |
+| `name`                   | `update`                    | `PATCH`. The id, token, enrolled replicas and Mesh IPs all survive.                         |
+| `ha`, same `name`        | `replace`, **delete-first** | `retain` (default): **refused**, nothing written. `destroy`: old deleted, then new created. |
+| `ha` and `name` together | `replace`, create-first     | The new node is created. Under `retain` the old one stays live.                             |
+| account (provider env)   | `replace`, create-first     | As above; names are unique per account, so the two cannot collide.                          |
+
+⛔ **An `ha` replace is an outage for that node.** The new node has a new id and a new token, and
+each replica gets a new Mesh IP. Re-enrol every replica with the new token, and update anything
+that pins the old Mesh IP (Gateway rules, listener allow-lists) in the same change.
+
+★ **Why delete-first only when the name stays.** The new node needs the name the old one holds, so
+creating first would fail with code 1013 (`DuplicateTunnelName`). ⚠️ Unmeasured: whether a
+just-deleted node frees its name at once. If it does not, the create fails with code 1013 and a
+sentence; deploy again once the name is free. An invalid declaration is refused at plan time,
+before anything is deleted.
+
+### An `ha` change under `retain`
+
+`retain` also skips the old node's delete inside a replace. So a same-name `ha` change keeps the old
+node, which still holds the name, and the create **refuses** with a sentence and writes nothing. It
+never quietly reuses the old node, because that node still has the old `ha`. Measured through
+Alchemy's own plan/apply in `mesh-node-policy.test.ts`:
+
+| you want             | do                                                                                                                    |
+| -------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| the replace          | Deploy once with `.pipe(RemovalPolicy.destroy())`: delete, then create. Then drop it.                                 |
+| the replace, by hand | Delete the old node yourself, then deploy again.                                                                      |
+| to keep the old node | `alchemy state rm <stack>/<stage>/<fqn>` (state only, not the node), then deploy the old declaration + `adopt(true)`. |
+
+⚠️ **Reverting `ha` is not enough.** The refused deploy leaves a `replacing` row, and the next
+plan resumes that replace whatever the props say, so it refuses again.
+
+⚠️ **`adopt(true)` alone does nothing to a `replacing` row.** The plan asks `read` to adopt only
+when a resource has no row, or after an interrupted first create. So every way back from inside a
+replace starts with `alchemy state rm`.
+
+⛔ **The old-node advice holds only when the name stayed.** After an `ha` + `name` change (a
+create-first replace), a node already holding the new name is another node, not the old one.
+`RemovalPolicy.destroy()` never touches it, and the refusal says not to delete it: choose another
+name, or check its HA badge, drop the row and adopt it.
+
+⚠️ Never deploy with `DISTILLED_DEBUG_HTTP` set: distilled prints the start of every response,
+and the create response carries the node's `token` field (Cloudflare's HA page says so).
+
+⚠️ Cloudflare may refuse to delete a node while replicas are connected. This is noted in Alchemy's
+WarpConnector and was not measured here. Stop the client on every replica before a destroy or an
+`ha` replace.
+
+## Adoption
+
+An existing node is found by **exact** name and returned `Unowned`. Alchemy refuses to take it
+over until the resource is wrapped in `adopt(true)` (or `--adopt` is passed). A deleted node is
+never matched, and a name that matches two live nodes is refused.
+
+An interrupted create (the node was made, its state was not saved) is found the same way on the
+next plan, so it too needs `adopt(true)`. ⚠️ distilled retries a create after a lost response or a
+5xx, and the retry is answered code 1013 by the node the first attempt made: the error then names
+that node's id. It is never adopted silently, because a concurrent creator looks the same. Inside
+a replace, drop the row before `adopt(true)`, as above.
+
+⚠️ **Adoption records the declared `ha`.** No documented read returns a node's HA flag:
+`GET /warp_connector/{id}` has no such field. Check the node's **HA** badge in the dashboard
+before adopting. A wrong value cannot be detected by any later plan.
+
+## Enrolling a host: `fetchMeshNodeToken`
+
+The token is a runtime credential. It never goes into Alchemy state or the vault; it goes straight
+to the host that runs the node. A one-off Bun `mesh-enroll` step:
+
+```ts
+import { fromApiToken } from '@distilled.cloud/cloudflare/Credentials';
+import { fetchMeshNodeToken } from '@homeflare/alchemy/cloudflare';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as Redacted from 'effect/Redacted';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import { open } from 'node:fs/promises';
+
+const token = await Effect.runPromise(
+  fetchMeshNodeToken({ accountId, id: nodeId }).pipe(
+    Effect.provide(Layer.mergeAll(fromApiToken({ apiToken }), FetchHttpClient.layer)),
+  ),
+);
+// ⛔ Created 0600 from the start, as root: no window where a chmod has not happened yet.
+const file = await open('/root/mesh-node.token', 'wx', 0o600);
+await file.writeFile(Redacted.value(token));
+await file.close();
+```
+
+- `{ accountId, name }` works too; the name is matched exactly.
+- The value comes back `Redacted`: `console.log`, `Effect.log` and `JSON.stringify` show
+  `<redacted>`. Call `Redacted.value` only at the write.
+- ⛔ **`fromApiToken`, not `Credentials.fromEnv()`.** `fromEnv` falls back to the Global API Key
+  (`CLOUDFLARE_API_KEY` + `CLOUDFLARE_EMAIL`) when no token is set.
+- ⚠️ **The endpoint needs a Write permission.** Mint a short-lived token for this step alone. A
+  read token gets a 403, and the error names the permission.
+- ⚠️ `warp-cli --accept-tos connector new <token>` (Mesh get-started page) takes the token as an
+  **argument**, so it is visible in the host's process list while that command runs. Run it as
+  root on the node itself, in a shell that does not keep history.
+- An empty token fails closed. An empty file would otherwise "enrol" a host that never joined.
+- ⛔ **Refused before any request:** `DISTILLED_DEBUG_HTTP` set (distilled then prints the first
+  400 characters of every response body to stderr, which is the whole token), the Global API Key
+  (`apiKey` credentials), and an empty API token (a denied secrets grant, not a permission).
+
+## Permissions
+
+| step                    | needs (any one, per the API reference)                                   |
+| ----------------------- | ------------------------------------------------------------------------ |
+| plan / read (get, list) | Cloudflare One Connectors Read, or Cloudflare One Connector: WARP Read   |
+| create, rename, delete  | Cloudflare One Connectors Write, or Cloudflare One Connector: WARP Write |
+| `fetchMeshNodeToken`    | Cloudflare One Connectors Write (see below)                              |
+
+The token endpoint's API reference lists Connectors Write, "Cloudflare One Connector: cloudflared
+Write" and "Cloudflare Tunnel Write"; the Mesh get-started guide lists Connectors Write and
+"Cloudflare One Connector: WARP Write". Connectors Write is the one both name.
+
+## Not covered here
+
+- **Routes, device profiles and Gateway rules:** use Alchemy's `Tunnel.Route`,
+  `Devices.CustomProfile` and `Gateway.Rule`. ⚠️ HA needs MASQUE on the node's device profile.
+- **The HA provider configuration** (`/warp_connector/{id}/configurations`: `ha_mode` of `none`,
+  `disabled`, `aws` or `local` with VIPs) and **manual failover**. Its semantics for a node
+  created without `ha` are undocumented, so this resource neither reads nor writes it.
+- **Mesh IPs.** They belong to each replica (the `/connections` endpoint), not to the node, so
+  they are not attributes. Pin them in site config and check them against the API.
+- **`alchemy unsafe nuke`.** `list` is empty and nuke skips this type, because Alchemy's own
+  WarpConnector provider already lists every `warp_connector` in the account.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.6.0",
-  "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos and launchd.",
+  "version": "0.7.0",
+  "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",
   "license": "MIT",
@@ -49,12 +49,17 @@
       "types": "./dist/launchd/index.d.ts",
       "default": "./dist/launchd/index.js"
     },
+    "./caddy": {
+      "types": "./dist/caddy/index.d.ts",
+      "default": "./dist/caddy/index.js"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
+    "@distilled.cloud/cloudflare": "1.0.0-rc.12",
     "@effect/platform-node": "4.0.0-rc.115",
     "alchemy": "2.0.0-beta.79",
     "cloudflare": ">=4.5.0",