@homeflare/distilled-openbao 0.2.0 → 0.2.2

package/README.md

@@ -33,6 +33,22 @@ actually measured against the ephemeral dev server (see
 `patches/policies/_errors.json` in the distilled clone); more are added as
 each kit family migrates onto this SDK.
 
+The copied source is distilled commit
+`52a18936d4e46786c005424549b6085c144ce047` (2026-09-24). Its auth-method and
+secrets-engine inventories return typed maps keyed by exact mount path. The
+OpenBao 2.6.2 OpenAPI document omits both response schemas; source-side Smithy
+patches derive them from the pinned server's `vault/logical_system.go`
+`mountInfo`, `handleAuthTable` and `handleMountTable`, cross-checked against the
+official Go API client. See `packages/openbao/patches/mount-tables.md` in that
+source commit for provenance and reproduction.
+
+Only those two inventory operations require and validate a `data` map.
+Unknown metadata and nested mount paths survive; malformed bodies fail with
+`OpenBaoParseError` without response values. An explicit empty map is valid.
+HTTP failures remain typed errors, including a 404 of the table endpoint;
+individual mount absence is a missing key in a successful inventory. This
+does not add auth/login envelope support or custom plugin endpoints.
+
 ```ts
 import * as OpenBao from '@distilled.cloud/openbao'; // aliased onto this package — see docs/distilled-interim.md
 import * as Effect from 'effect/Effect';
@@ -59,15 +75,24 @@ swap with no import changes anywhere in the kit.
 
 ## Updating it
 
-From the distilled clone's `homeflare/openbao` worktree:
+⚠️ **The commit above lives only in the house's local `alchemy-run/distilled`
+clone.** Per the never-push policy at the top of this file (decision 42),
+that clone's `homeflare/openbao` worktree is never pushed anywhere — no
+fork, no branch, no PR on `alchemy-run/distilled` itself — so the commit
+hash is a provenance record for this copy, not a fetchable ref. Regenerating
+needs a machine with that clone (or a fresh one built from
+`.agents/skills/distilled-sdk/SKILL.md` against the same OpenBao pin), not
+a checkout of the hash from origin.
+
+From that worktree, at the recorded source commit:
 
 ```sh
 DISTILLED_SPECS_LOCAL=1 pnpm generate openbao   # or pnpm specs:sync first for a real refresh
 pnpm typecheck:ci && pnpm specs:check && pnpm format:check
 ```
 
-Then copy `src/` back here (`cp -R`, `diff -rq` to prove it), bump this
-package's `version`, and add a changeset.
+Then copy `src/` back here (`cp -R`, `diff -rq` to prove it), update the source
+commit above, and add a changeset. Changesets owns the package version bump.
 
 ## License
 

package/dist/credentials.d.ts

@@ -12,7 +12,8 @@ export declare const API_PATH = "/v1";
 /** Normalize an address (or an already-complete `/v1` root) into the API base URL. */
 export declare const normalizeBaseUrl: (addr: string) => string;
 export interface Config {
-    readonly token: Redacted.Redacted<string>;
+    /** Absent for a local agent listener that supplies its own identity. */
+    readonly token?: Redacted.Redacted<string>;
     /** Fully-qualified API root, e.g. `http://127.0.0.1:8200/v1`. */
     readonly apiBaseUrl: string;
     /** `X-Vault-Namespace`, when the estate uses one. Absent = root namespace. */
@@ -24,7 +25,7 @@ export declare class Credentials extends Credentials_base {
 export declare const CredentialsFromEnv: Layer.Layer<Credentials, never, never>;
 /** Convenience layer from a plain token, address and optional namespace. */
 export declare const credentials: (config: {
-    readonly token: string | Redacted.Redacted<string>;
+    readonly token?: string | Redacted.Redacted<string>;
     readonly addr: string;
     readonly namespace?: string;
 }) => Layer.Layer<Credentials>;

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAc9B,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,MAG/C,CAAC;AAEF,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;;AAED,qBAAa,WAAY,SAAQ,gBAGR;CAAG;AAQ5B,eAAO,MAAM,kBAAkB,wCAgB9B,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,WAAW,WAAY;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,KAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAWxB,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAc9B,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,MAG/C,CAAC;AAEF,MAAM,WAAW,MAAM;IACrB,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;;AAED,qBAAa,WAAY,SAAQ,gBAGR;CAAG;AAQ5B,eAAO,MAAM,kBAAkB,wCAmB9B,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,WAAW,WAAY;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,KAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAWxB,CAAC"}

package/dist/credentials.js

@@ -44,14 +44,16 @@ export const normalizeBaseUrl = (addr) => {
 export class Credentials extends Context.Service()("OpenBaoCredentials") {
 }
 const envConfig = EffectConfig.all({
-    token: EffectConfig.String("BAO_TOKEN"),
+    token: EffectConfig.String("BAO_TOKEN").pipe(EffectConfig.option),
     addr: EffectConfig.String("BAO_ADDR"),
     namespace: EffectConfig.String("BAO_NAMESPACE").pipe(EffectConfig.option),
 });
 export const CredentialsFromEnv = Layer.succeed(Credentials, envConfig.pipe(Effect.mapError(() => new ConfigError({
-    message: "BAO_ADDR and BAO_TOKEN environment variables are required",
+    message: "BAO_ADDR environment variable is required",
 })), Effect.map(({ token, addr, namespace }) => ({
-    token: Redacted.make(token),
+    token: token.valueOrUndefined === undefined
+        ? undefined
+        : Redacted.make(token.valueOrUndefined),
     apiBaseUrl: normalizeBaseUrl(addr),
     namespace: namespace.valueOrUndefined,
 })), Effect.orDie));

package/dist/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,YAAY,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAU,EAAE;IACnD,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,CAAC;IACzD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAU,EAAE;IACvD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC;AACxE,CAAC,CAAC;AAUF,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAG7C,CAAC,oBAAoB,CAAC;CAAG;AAE5B,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC;IACjC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC;IACvC,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;IACrC,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;CAC1E,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAC7C,WAAW,EACX,SAAS,CAAC,IAAI,CACZ,MAAM,CAAC,QAAQ,CACb,GAAG,EAAE,CACH,IAAI,WAAW,CAAC;IACd,OAAO,EAAE,2DAA2D;CACrE,CAAC,CACL,EACD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;IAC3B,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;IAClC,SAAS,EAAE,SAAS,CAAC,gBAAgB;CACtC,CAAC,CAAC,EACH,MAAM,CAAC,KAAK,CACb,CACF,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAI3B,EAA4B,EAAE,CAC7B,KAAK,CAAC,OAAO,CACX,WAAW,EACX,MAAM,CAAC,OAAO,CAAC;IACb,KAAK,EACH,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAC9B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC7B,CAAC,CAAC,MAAM,CAAC,KAAK;IAClB,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC,SAAS;CAC5B,CAAC,CACH,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,YAAY,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAU,EAAE;IACnD,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,CAAC;IACzD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAU,EAAE;IACvD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC;AACxE,CAAC,CAAC;AAWF,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAG7C,CAAC,oBAAoB,CAAC;CAAG;AAE5B,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC;IACjC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;IACjE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;IACrC,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;CAC1E,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAC7C,WAAW,EACX,SAAS,CAAC,IAAI,CACZ,MAAM,CAAC,QAAQ,CACb,GAAG,EAAE,CACH,IAAI,WAAW,CAAC;IACd,OAAO,EAAE,2CAA2C;CACrD,CAAC,CACL,EACD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,KAAK,EACH,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAClC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC3C,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;IAClC,SAAS,EAAE,SAAS,CAAC,gBAAgB;CACtC,CAAC,CAAC,EACH,MAAM,CAAC,KAAK,CACb,CACF,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAI3B,EAA4B,EAAE,CAC7B,KAAK,CAAC,OAAO,CACX,WAAW,EACX,MAAM,CAAC,OAAO,CAAC;IACb,KAAK,EACH,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAC9B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC7B,CAAC,CAAC,MAAM,CAAC,KAAK;IAClB,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC,SAAS;CAC5B,CAAC,CACH,CAAC"}

package/dist/errors.d.ts

@@ -16,7 +16,7 @@
  * status (and message, when OpenBao supplies one) under `patches/`.
  */
 export { BadGateway, BadRequest, Conflict, ConfigError, Forbidden, GatewayTimeout, InternalServerError, Locked, NotFound, ServiceUnavailable, TooManyRequests, Unauthorized, UnprocessableEntity, HTTP_STATUS_MAP, DEFAULT_ERRORS, API_ERRORS, } from "@distilled.cloud/core/errors";
-import type { DefaultErrors as CoreDefaultErrors } from "@distilled.cloud/core/errors";
+import type { API_ERRORS } from "@distilled.cloud/core/errors";
 import * as Schema from "effect/Schema";
 declare const UnknownOpenBaoError_base: Schema.Class<UnknownOpenBaoError, Schema.TaggedStruct<"UnknownOpenBaoError", {
     readonly code: Schema.optional<Schema.String>;
@@ -53,5 +53,5 @@ export type ClientErrors = UnknownOpenBaoError | OpenBaoParseError;
  * Default OpenBao operation errors: the shared HTTP status errors from core
  * plus the client-level fallback/decode errors.
  */
-export type DefaultErrors = CoreDefaultErrors | ClientErrors;
+export type DefaultErrors = InstanceType<(typeof API_ERRORS)[number]> | ClientErrors;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,UAAU,EACV,UAAU,EACV,QAAQ,EACR,WAAW,EACX,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,MAAM,EACN,QAAQ,EACR,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,UAAU,GACX,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;;;;;;;;;;AAGxC;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,wBAOT;CAAG;;;;;;;;;AAEnC,kCAAkC;AAClC,qBAAa,iBAAkB,SAAQ,sBAMR;CAAG;AAElC;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,YAAY,CAAC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,UAAU,EACV,UAAU,EACV,QAAQ,EACR,WAAW,EACX,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,MAAM,EACN,QAAQ,EACR,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,UAAU,GACX,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;;;;;;;;;;AAGxC;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,wBAOT;CAAG;;;;;;;;;AAEnC,kCAAkC;AAClC,qBAAa,iBAAkB,SAAQ,sBAMR;CAAG;AAElC;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,YAAY,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,GACzC,YAAY,CAAC"}

package/dist/protocol-mount-tables.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The auth/mount inventories require a data map (OpenBao v2.6.2
+ * vault/logical_system.go:930-959,2108-2134; api/v2 sys_{auth,mounts}.go).
+ * A missing envelope must never masquerade as an empty table and authorize
+ * a consumer's create. Other logical, health and login shapes are separate.
+ */
+import * as API from "@distilled.cloud/core/api";
+import * as Layer from "effect/Layer";
+export declare const withMountTables: (base: Layer.Layer<API.Protocol>) => Layer.Layer<API.Protocol>;
+//# sourceMappingURL=protocol-mount-tables.d.ts.map

package/dist/protocol-mount-tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-mount-tables.d.ts","sourceRoot":"","sources":["../src/protocol-mount-tables.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,GAAG,MAAM,2BAA2B,CAAC;AAGjD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAatC,eAAO,MAAM,eAAe,SACpB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAC9B,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAmCE,CAAC"}

package/dist/protocol-mount-tables.js

@@ -0,0 +1,39 @@
+/**
+ * The auth/mount inventories require a data map (OpenBao v2.6.2
+ * vault/logical_system.go:930-959,2108-2134; api/v2 sys_{auth,mounts}.go).
+ * A missing envelope must never masquerade as an empty table and authorize
+ * a consumer's create. Other logical, health and login shapes are separate.
+ */
+import * as API from "@distilled.cloud/core/api";
+import { getAnn } from "@distilled.cloud/core/protocol-http";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import { OpenBaoParseError } from "./errors.js";
+import { mountTableSymbol } from "./traits.js";
+const invalidTable = () => new OpenBaoParseError({
+    body: undefined,
+    cause: "Response does not match the declared OpenBao mount table schema",
+});
+const record = (body) => typeof body === "object" && body !== null && !Array.isArray(body);
+export const withMountTables = (base) => Layer.effect(API.Protocol, Effect.gen(function* () {
+    const protocol = yield* API.Protocol;
+    return API.Protocol.of({
+        encode: protocol.encode,
+        decode: (args) => {
+            if (!getAnn(args.outputAst, mountTableSymbol) ||
+                args.response.status >= 400 ||
+                args.config.output === undefined)
+                return protocol.decode(args);
+            // These schemas use wire names and contain no sensitive transforms.
+            // Validate the original envelope before core's empty-body fallback;
+            // retain unknown metadata after validation for forward compatibility.
+            // Neither body values nor schema diagnostics may enter parse errors.
+            const output = args.config.output;
+            return args.response.json.pipe(Effect.mapError(invalidTable), Effect.flatMap((envelope) => record(envelope) && record(envelope.data)
+                ? Schema.decodeUnknownEffect(Schema.toType(output))(envelope.data).pipe(Effect.as(envelope.data), Effect.mapError(invalidTable))
+                : Effect.fail(invalidTable())));
+        },
+    });
+})).pipe(Layer.provide(base));
+//# sourceMappingURL=protocol-mount-tables.js.map

package/dist/protocol-mount-tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-mount-tables.js","sourceRoot":"","sources":["../src/protocol-mount-tables.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,GAAG,MAAM,2BAA2B,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,qCAAqC,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,IAAI,iBAAiB,CAAC;IACpB,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,iEAAiE;CACzE,CAAC,CAAC;AACL,MAAM,MAAM,GAAG,CAAC,IAAa,EAAmC,EAAE,CAChE,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAEpE,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,IAA+B,EACJ,EAAE,CAC7B,KAAK,CAAC,MAAM,CACV,GAAG,CAAC,QAAQ,EACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACrC,OAAO,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACf,IACE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC;gBACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG;gBAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;gBAEhC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/B,oEAAoE;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAC5B,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC7B,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACvC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAC/C,QAAQ,CAAC,IAAI,CACd,CAAC,IAAI,CACJ,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EACxB,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC9B;gBACH,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAChC,CACwB,CAAC;QAC9B,CAAC;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC"}

package/dist/protocol-mount-tables.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=protocol-mount-tables.test.d.ts.map

package/dist/protocol-mount-tables.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-mount-tables.test.d.ts","sourceRoot":"","sources":["../src/protocol-mount-tables.test.ts"],"names":[],"mappings":""}

package/dist/protocol-mount-tables.test.js

@@ -0,0 +1,164 @@
+import { describe, expect, test } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import { credentials } from "./credentials.js";
+import { OpenBaoParseError } from "./errors.js";
+import * as Retry from "./retry.js";
+import { authListEnabledMethods } from "./services/auth.js";
+import { mountsListSecretsEngines } from "./services/mounts.js";
+// Synthetic fixture from v2.6.2 vault/logical_system.go:871-928, not a live
+// vault inventory. Nil options is legal; optional arrays may be absent.
+const entry = {
+    type: "approle",
+    description: "fixture",
+    accessor: "auth_fixture",
+    uuid: "fixture-uuid",
+    plugin_version: "",
+    running_plugin_version: "v2.6.2+builtin",
+    running_sha256: "",
+    local: false,
+    seal_wrap: false,
+    external_entropy_access: false,
+    options: null,
+    config: { default_lease_ttl: 0, max_lease_ttl: 0, force_no_cache: false },
+};
+for (const [path, operation] of [
+    ["/sys/auth", authListEnabledMethods],
+    ["/sys/mounts", mountsListSecretsEngines],
+]) {
+    describe(path, () => {
+        const call = (body, status = 200, raw = false) => {
+            let calls = 0;
+            const client = HttpClient.make((request) => {
+                calls++;
+                expect(request.method).toBe("GET");
+                expect(new URL(request.url).pathname).toBe(`/v1${path}`);
+                expect(request.headers["x-vault-request"]).toBe("true");
+                expect(request.headers["x-vault-token"]).toBeUndefined();
+                expect(request.headers["x-vault-namespace"]).toBe("fixture");
+                return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(status === 204 ? null : raw ? String(body) : JSON.stringify(body), { status })));
+            });
+            const effect = operation({}).pipe(Retry.none, Effect.provide(Layer.mergeAll(Layer.succeed(HttpClient.HttpClient, client), credentials({ addr: "http://fake.invalid", namespace: "fixture" }))));
+            return { effect, calls: () => calls };
+        };
+        test("dynamic nested mount paths and unknown metadata survive", async () => {
+            const configured = {
+                ...entry,
+                type: "kv",
+                options: { version: "2", custom_option: "yes" },
+                deprecation_status: "supported",
+                future_metadata: { key: "retained" },
+                config: {
+                    ...entry.config,
+                    token_type: "default-service",
+                    listing_visibility: "unauth",
+                    audit_non_hmac_request_keys: ["mount-secret-marker"],
+                    audit_non_hmac_response_keys: [],
+                    passthrough_request_headers: ["X-Forwarded-For"],
+                    allowed_response_headers: ["X-Fixture"],
+                    future_config: { keep: true },
+                    user_lockout_config: {
+                        user_lockout_counter_reset_duration: 900,
+                        user_lockout_threshold: 5,
+                        user_lockout_duration: 900,
+                        user_lockout_disable: false,
+                    },
+                },
+            };
+            const data = { "approle/": entry, "team/nested/": configured };
+            const { effect, calls } = call({
+                request_id: "synthetic",
+                data,
+                warnings: null,
+            });
+            const result = await Effect.runPromise(effect);
+            // Indexed values are typed MountInfo | undefined, not {} or unknown.
+            const type = result["team/nested/"]?.type;
+            expect(type).toBe("kv");
+            expect(result).toEqual(data);
+            expect(calls()).toBe(1);
+        });
+        test("an explicit empty data map is a valid inventory", async () => {
+            expect(await Effect.runPromise(call({ data: {} }).effect)).toEqual({});
+        });
+        for (const [name, body] of [
+            ["no envelope", {}],
+            ["null body", null],
+            ["no data", { request_id: "fixture" }],
+            ["null data", { data: null }],
+            ["array data", { data: [] }],
+            ["scalar data", { data: "mount-secret-marker" }],
+            ["null entry", { data: { "x/": null } }],
+            ["empty entry", { data: { "x/": {} } }],
+            [
+                "invalid field",
+                {
+                    data: {
+                        "x/": { ...entry, type: "mount-secret-marker", local: "false" },
+                    },
+                },
+            ],
+            [
+                "invalid config",
+                {
+                    data: {
+                        "x/": {
+                            ...entry,
+                            config: { ...entry.config, max_lease_ttl: "60" },
+                        },
+                    },
+                },
+            ],
+            [
+                "invalid options",
+                { data: { "x/": { ...entry, options: { version: 2 } } } },
+            ],
+            [
+                "invalid lockout",
+                {
+                    data: {
+                        "x/": {
+                            ...entry,
+                            config: { ...entry.config, user_lockout_config: {} },
+                        },
+                    },
+                },
+            ],
+        ]) {
+            test(`rejects ${name} without exposing response values`, async () => {
+                const { effect, calls } = call(body);
+                const error = await Effect.runPromise(effect.pipe(Effect.flip));
+                expect(error).toBeInstanceOf(OpenBaoParseError);
+                expect(error).toMatchObject({ body: undefined });
+                expect(JSON.stringify(error)).not.toContain("mount-secret-marker");
+                expect(calls()).toBe(1);
+            });
+        }
+        for (const [status, text] of [
+            [200, ""],
+            [200, "mount-secret-marker: invalid JSON"],
+            [204, ""],
+        ]) {
+            test(`rejects ${status} empty or invalid JSON safely`, async () => {
+                const error = await Effect.runPromise(call(text, status, true).effect.pipe(Effect.flip));
+                expect(error).toBeInstanceOf(OpenBaoParseError);
+                expect(JSON.stringify(error)).not.toContain("mount-secret-marker");
+            });
+        }
+        for (const [status, tag] of [
+            [401, "Unauthorized"],
+            [403, "Forbidden"],
+            [404, "NotFound"],
+            [500, "InternalServerError"],
+        ]) {
+            test(`${status} remains a typed HTTP failure, never an empty map`, async () => {
+                const { effect, calls } = call({ errors: ["fixture refusal"] }, status);
+                expect(await Effect.runPromise(effect.pipe(Effect.flip))).toMatchObject({ _tag: tag });
+                expect(calls()).toBe(1);
+            });
+        }
+    });
+}
+//# sourceMappingURL=protocol-mount-tables.test.js.map

package/dist/protocol-mount-tables.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-mount-tables.test.js","sourceRoot":"","sources":["../src/protocol-mount-tables.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,kBAAkB,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAkB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,4EAA4E;AAC5E,wEAAwE;AACxE,MAAM,KAAK,GAAG;IACZ,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,SAAS;IACtB,QAAQ,EAAE,cAAc;IACxB,IAAI,EAAE,cAAc;IACpB,cAAc,EAAE,EAAE;IAClB,sBAAsB,EAAE,gBAAgB;IACxC,cAAc,EAAE,EAAE;IAClB,KAAK,EAAE,KAAK;IACZ,SAAS,EAAE,KAAK;IAChB,uBAAuB,EAAE,KAAK;IAC9B,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE;CACtD,CAAC;AAEtB,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI;IAC9B,CAAC,WAAW,EAAE,sBAAsB,CAAC;IACrC,CAAC,aAAa,EAAE,wBAAwB,CAAC;CACjC,EAAE,CAAC;IACX,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE;QAClB,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,GAAG,GAAG,KAAK,EAAE,EAAE;YACxD,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBACzC,KAAK,EAAE,CAAC;gBACR,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;gBACzD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACxD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;gBACzD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC7D,OAAO,MAAM,CAAC,OAAO,CACnB,kBAAkB,CAAC,OAAO,CACxB,OAAO,EACP,IAAI,QAAQ,CACV,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EACjE,EAAE,MAAM,EAAE,CACX,CACF,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAC/B,KAAK,CAAC,IAAI,EACV,MAAM,CAAC,OAAO,CACZ,KAAK,CAAC,QAAQ,CACZ,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,EAC5C,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CACnE,CACF,CACF,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QACxC,CAAC,CAAC;QAEF,IAAI,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,UAAU,GAAG;gBACjB,GAAG,KAAK;gBACR,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE;gBAC/C,kBAAkB,EAAE,WAAW;gBAC/B,eAAe,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;gBACpC,MAAM,EAAE;oBACN,GAAG,KAAK,CAAC,MAAM;oBACf,UAAU,EAAE,iBAAiB;oBAC7B,kBAAkB,EAAE,QAAQ;oBAC5B,2BAA2B,EAAE,CAAC,qBAAqB,CAAC;oBACpD,4BAA4B,EAAE,EAAE;oBAChC,2BAA2B,EAAE,CAAC,iBAAiB,CAAC;oBAChD,wBAAwB,EAAE,CAAC,WAAW,CAAC;oBACvC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;oBAC7B,mBAAmB,EAAE;wBACnB,mCAAmC,EAAE,GAAG;wBACxC,sBAAsB,EAAE,CAAC;wBACzB,qBAAqB,EAAE,GAAG;wBAC1B,oBAAoB,EAAE,KAAK;qBAC5B;iBACF;aACF,CAAC;YACF,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;YAC/D,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;gBAC7B,UAAU,EAAE,WAAW;gBACvB,IAAI;gBACJ,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC/C,qEAAqE;YACrE,MAAM,IAAI,GAAuB,MAAM,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;YACzB,CAAC,aAAa,EAAE,EAAE,CAAC;YACnB,CAAC,WAAW,EAAE,IAAI,CAAC;YACnB,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;YACtC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC7B,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC5B,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;YAChD,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YACxC,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC;YACvC;gBACE,eAAe;gBACf;oBACE,IAAI,EAAE;wBACJ,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE;qBAChE;iBACF;aACF;YACD;gBACE,gBAAgB;gBAChB;oBACE,IAAI,EAAE;wBACJ,IAAI,EAAE;4BACJ,GAAG,KAAK;4BACR,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE;yBACjD;qBACF;iBACF;aACF;YACD;gBACE,iBAAiB;gBACjB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;aAC1D;YACD;gBACE,iBAAiB;gBACjB;oBACE,IAAI,EAAE;wBACJ,IAAI,EAAE;4BACJ,GAAG,KAAK;4BACR,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,EAAE;yBACrD;qBACF;iBACF;aACF;SACO,EAAE,CAAC;YACX,IAAI,CAAC,WAAW,IAAI,mCAAmC,EAAE,KAAK,IAAI,EAAE;gBAClE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChE,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;gBAChD,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBACjD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;gBACnE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI;YAC3B,CAAC,GAAG,EAAE,EAAE,CAAC;YACT,CAAC,GAAG,EAAE,mCAAmC,CAAC;YAC1C,CAAC,GAAG,EAAE,EAAE,CAAC;SACD,EAAE,CAAC;YACX,IAAI,CAAC,WAAW,MAAM,+BAA+B,EAAE,KAAK,IAAI,EAAE;gBAChE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,UAAU,CACnC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAClD,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI;YAC1B,CAAC,GAAG,EAAE,cAAc,CAAC;YACrB,CAAC,GAAG,EAAE,WAAW,CAAC;YAClB,CAAC,GAAG,EAAE,UAAU,CAAC;YACjB,CAAC,GAAG,EAAE,qBAAqB,CAAC;SACpB,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,MAAM,mDAAmD,EAAE,KAAK,IAAI,EAAE;gBAC5E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACxE,MAAM,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CACrE,EAAE,IAAI,EAAE,GAAG,EAAE,CACd,CAAC;gBACF,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/protocol-requests.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=protocol-requests.test.d.ts.map

package/dist/protocol-requests.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-requests.test.d.ts","sourceRoot":"","sources":["../src/protocol-requests.test.ts"],"names":[],"mappings":""}

package/dist/protocol-requests.test.js

@@ -0,0 +1,32 @@
+import { expect, test } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import { credentials } from "./credentials.js";
+import * as Retry from "./retry.js";
+import { policiesDeleteAclPolicy } from "./services/policies.js";
+for (const token of [undefined, "", "test-token"]) {
+    test(`agent request header is present; ${token ? "nonempty" : "absent or empty"} token has correct header semantics`, async () => {
+        const client = HttpClient.make((request) => {
+            expect(request.headers["x-vault-request"]).toBe("true");
+            if (token)
+                expect(request.headers["x-vault-token"]).toBe(token);
+            else
+                expect(request.headers["x-vault-token"]).toBeUndefined();
+            expect(request.headers["x-vault-namespace"]).toBeUndefined();
+            return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null, { status: 204 })));
+        });
+        await Effect.runPromise(policiesDeleteAclPolicy({ name: "test" }).pipe(Retry.none, Effect.provide(Layer.mergeAll(Layer.succeed(HttpClient.HttpClient, client), credentials({ addr: "http://fake.invalid", token })))));
+    });
+}
+test("every status mapped by the protocol is represented in the operation error union", async () => {
+    // These catchTag calls must compile: core DEFAULT_ERRORS excludes both tags,
+    // but OpenBaoProtocol's default HTTP_STATUS_MAP emits them for every operation.
+    for (const status of [403, 404]) {
+        const client = HttpClient.make((request) => Effect.succeed(HttpClientResponse.fromWeb(request, Response.json({ errors: [] }, { status }))));
+        const tag = await Effect.runPromise(policiesDeleteAclPolicy({ name: "test" }).pipe(Retry.none, Effect.as("success"), Effect.catchTag("Forbidden", () => Effect.succeed("Forbidden")), Effect.catchTag("NotFound", () => Effect.succeed("NotFound")), Effect.provide(Layer.mergeAll(Layer.succeed(HttpClient.HttpClient, client), credentials({ addr: "http://fake.invalid", token: "test-token" })))));
+        expect(tag).toBe(status === 403 ? "Forbidden" : "NotFound");
+    }
+});
+//# sourceMappingURL=protocol-requests.test.js.map

package/dist/protocol-requests.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-requests.test.js","sourceRoot":"","sources":["../src/protocol-requests.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,kBAAkB,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC;IAClD,IAAI,CAAC,oCAAoC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,qCAAqC,EAAE,KAAK,IAAI,EAAE;QAC/H,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACzC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,KAAK;gBAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;gBAC3D,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YAC9D,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YAC7D,OAAO,MAAM,CAAC,OAAO,CACnB,kBAAkB,CAAC,OAAO,CACxB,OAAO,EACP,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACpC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,CACrB,uBAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAC5C,KAAK,CAAC,IAAI,EACV,MAAM,CAAC,OAAO,CACZ,KAAK,CAAC,QAAQ,CACZ,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,EAC5C,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CACpD,CACF,CACF,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;IACjG,6EAA6E;IAC7E,gFAAgF;IAChF,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,MAAM,CAAC,OAAO,CACZ,kBAAkB,CAAC,OAAO,CACxB,OAAO,EACP,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAC1C,CACF,CACF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CACjC,uBAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAC5C,KAAK,CAAC,IAAI,EACV,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EACpB,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAC/D,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAC7D,MAAM,CAAC,OAAO,CACZ,KAAK,CAAC,QAAQ,CACZ,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,EAC5C,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAClE,CACF,CACF,CACF,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,KAAK,eAAe,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,KAAK,GAAG,MAAM,2BAA2B,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAKhE,OAAO,EAAE,WAAW,EAAe,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB,aAAa,GACb,WAAW,GACX,eAAe,CAAC,eAAe,CAAC;AAEpC,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC;AAyBnE,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CA4BlD,CAAC"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,KAAK,eAAe,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,KAAK,GAAG,MAAM,2BAA2B,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAKhE,OAAO,EAAE,WAAW,EAAe,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAGtE;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB,aAAa,GACb,WAAW,GACX,eAAe,CAAC,eAAe,CAAC;AAEpC,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC;AAyBnE,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CA+B5B,CAAC"}

package/dist/protocol.js

@@ -31,9 +31,11 @@
  * match on status, or on message when OpenBao actually supplies one — see
  * `patches/`.
  *
- * Authentication is a single header, `X-Vault-Token`, plus an optional
- * `X-Vault-Namespace` when the credential carries one — the estate always
- * does (`BAO_NAMESPACE=homeflare`). A namespace does not change a mounted
+ * Authentication is `X-Vault-Token` when a credential carries a nonempty
+ * token; omit it for a local agent that supplies its own identity. An
+ * optional `X-Vault-Namespace` selects a namespace; absent means root.
+ * `X-Vault-Request: true` admits agent listeners with require_request_header
+ * (OpenBao v2.6.2 command/agent.go:544-548). A namespace does not change a mounted
  * backend's own path shape (see `stacks/distilled-submodules/spec-repos/
  * openbao/fetch-specs.ts`'s module docs for how that was confirmed), so it
  * is purely a request header here, never a path segment.
@@ -43,6 +45,7 @@ import * as Redacted from "effect/Redacted";
 import { makeRestProtocol, } from "@distilled.cloud/core/protocol-rest";
 import { Credentials } from "./credentials.js";
 import { UnknownOpenBaoError } from "./errors.js";
+import { withMountTables } from "./protocol-mount-tables.js";
 /**
  * OpenBao error bodies are `{"errors": [...]}`. Several strings are joined
  * (`"; "`) rather than only the first kept, so a matcher's `includes` still
@@ -77,7 +80,10 @@ export const OpenBaoProtocol = makeRestProtocol({
     }),
     baseUrl: (creds) => creds.apiBaseUrl,
     headers: (creds) => ({
-        "X-Vault-Token": Redacted.value(creds.token),
+        ...(creds.token && Redacted.value(creds.token) !== ""
+            ? { "X-Vault-Token": Redacted.value(creds.token) }
+            : {}),
+        "X-Vault-Request": "true",
         ...(creds.namespace ? { "X-Vault-Namespace": creds.namespace } : {}),
         Accept: "application/json",
     }),
@@ -92,5 +98,5 @@ export const OpenBaoProtocol = makeRestProtocol({
         message,
         body,
     }),
-});
+}).pipe(withMountTables);
 //# sourceMappingURL=protocol.js.map

package/dist/protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAK5C,OAAO,EACL,gBAAgB,GAEjB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAe,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AAgBtE;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,IAAa,EAAiC,EAAE;IACrE,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC5E,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC5E,CAAC,CAAC;AAEF,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,CAAC,IAAa,EAAW,EAAE;IACnD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,IAAI,GAAI,IAAgC,CAAC,IAAI,CAAC;IACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAC1B,gBAAgB,CAAS;IACvB,uEAAuE;IACvE,wEAAwE;IACxE,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;IACxB,CAAC,CAAC;IACF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU;IACpC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnB,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;QAC5C,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,aAAa;IACb,iBAAiB;IACjB,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CACxC,IAAI,mBAAmB,CAAC;QACtB,IAAI,EACF,OAAO,IAAI,KAAK,QAAQ;YACtB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,KAAK,SAAS;gBAClB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBACd,CAAC,CAAC,SAAS;QACjB,OAAO;QACP,IAAI;KACL,CAAC;CACL,CAAC,CAAC"}
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAK5C,OAAO,EACL,gBAAgB,GAEjB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAe,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAgB7D;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,IAAa,EAAiC,EAAE;IACrE,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC5E,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC5E,CAAC,CAAC;AAEF,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,CAAC,IAAa,EAAW,EAAE;IACnD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,IAAI,GAAI,IAAgC,CAAC,IAAI,CAAC;IACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAC1B,gBAAgB,CAAS;IACvB,uEAAuE;IACvE,wEAAwE;IACxE,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;IACxB,CAAC,CAAC;IACF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU;IACpC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnB,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;YACnD,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,iBAAiB,EAAE,MAAM;QACzB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,aAAa;IACb,iBAAiB;IACjB,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CACxC,IAAI,mBAAmB,CAAC;QACtB,IAAI,EACF,OAAO,IAAI,KAAK,QAAQ;YACtB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,KAAK,SAAS;gBAClB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBACd,CAAC,CAAC,SAAS;QACjB,OAAO;QACP,IAAI;KACL,CAAC;CACL,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC"}

package/dist/retry.d.ts

@@ -10,11 +10,10 @@
  * `packages/alchemy/src/openbao/bao-http.ts` caps in-flight OpenBao
  * exchanges at 8 process-wide (`BaoGate`, a `Semaphore`) after a real
  * outage: unbounded Alchemy fan-out took the dev listener's socket down
- * (measured 2026-09-14). That cap is `HttpClient` middleware, not a retry
- * policy, and stays exactly where it is — the kit's Effect runtime provides
- * the gated `HttpClient.HttpClient` layer underneath whichever protocol
- * (hand-rolled or this SDK) issues the request, so it keeps applying
- * unchanged to every call this package makes.
+ * (measured 2026-09-14). That cap lives inside the kit's call runner, not
+ * inside HttpClient. SDK consumers must explicitly share the same gate;
+ * merely supplying the HTTP client does not apply it. The kit runner also
+ * selects Retry.none so a failed response cannot repeat a sent write.
  *
  * @example
  * ```ts

package/dist/retry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,OAAO,MAAM,6BAA6B,CAAC;AAEvD,MAAM,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;AACtC,MAAM,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;AACtC,MAAM,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;;AAEpC,uEAAuE;AACvE,qBAAa,KAAM,SAAQ,UAAgD;CAAG;AAE9E,yEAAyE;AACzE,eAAO,MAAM,MAAM,EAAE;IACnB,CACE,OAAO,EAAE,OAAO,GACf,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EACT,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5C,CACE,OAAO,EAAE,OAAO,GACf,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EACT,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;CAEU,CAAC;AAEzD,sCAAsC;AACtC,eAAO,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAEzC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,OAA6B,CAAC;AAExD,eAAO,MAAM,QAAQ,0JAAmB,CAAC;AACzC,eAAO,MAAM,MAAM,uMAAiB,CAAC;AAErC,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,EAAE,OAAmC,CAAC;AAEpE,0EAA0E;AAC1E,eAAO,MAAM,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAqC,CAAC;AAEhF,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,OAAkC,CAAC;AAElE,yEAAyE;AACzE,eAAO,MAAM,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAoC,CAAC"}
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,OAAO,MAAM,6BAA6B,CAAC;AAEvD,MAAM,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;AACtC,MAAM,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;AACtC,MAAM,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;;AAEpC,uEAAuE;AACvE,qBAAa,KAAM,SAAQ,UAAgD;CAAG;AAE9E,yEAAyE;AACzE,eAAO,MAAM,MAAM,EAAE;IACnB,CACE,OAAO,EAAE,OAAO,GACf,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EACT,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5C,CACE,OAAO,EAAE,OAAO,GACf,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EACT,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;CAEU,CAAC;AAEzD,sCAAsC;AACtC,eAAO,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAEzC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,OAA6B,CAAC;AAExD,eAAO,MAAM,QAAQ,0JAAmB,CAAC;AACzC,eAAO,MAAM,MAAM,uMAAiB,CAAC;AAErC,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,EAAE,OAAmC,CAAC;AAEpE,0EAA0E;AAC1E,eAAO,MAAM,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAqC,CAAC;AAEhF,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,OAAkC,CAAC;AAElE,yEAAyE;AACzE,eAAO,MAAM,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAoC,CAAC"}

package/dist/retry.js

@@ -10,11 +10,10 @@
  * `packages/alchemy/src/openbao/bao-http.ts` caps in-flight OpenBao
  * exchanges at 8 process-wide (`BaoGate`, a `Semaphore`) after a real
  * outage: unbounded Alchemy fan-out took the dev listener's socket down
- * (measured 2026-09-14). That cap is `HttpClient` middleware, not a retry
- * policy, and stays exactly where it is — the kit's Effect runtime provides
- * the gated `HttpClient.HttpClient` layer underneath whichever protocol
- * (hand-rolled or this SDK) issues the request, so it keeps applying
- * unchanged to every call this package makes.
+ * (measured 2026-09-14). That cap lives inside the kit's call runner, not
+ * inside HttpClient. SDK consumers must explicitly share the same gate;
+ * merely supplying the HTTP client does not apply it. The kit runner also
+ * selects Retry.none so a failed response cannot repeat a sent write.
  *
  * @example
  * ```ts

package/dist/retry.js.map

@@ -1 +1 @@
-{"version":3,"file":"retry.js","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,6BAA6B,CAAC;AAMvD,uEAAuE;AACvE,MAAM,OAAO,KAAM,SAAQ,OAAO,CAAC,OAAO,EAAiB,CAAC,cAAc,CAAC;CAAG;AAE9E,yEAAyE;AACzE,MAAM,CAAC,MAAM,MAAM,GAWf,CAAC,gBAAmC,EAAE,EAAE,CAC1C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEzD,sCAAsC;AACtC,MAAM,CAAC,MAAM,IAAI,GAE6B,MAAM,CAAC,OAAO,CAC1D,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAC7C,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAY,OAAO,CAAC,WAAW,CAAC;AAExD,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;AACzC,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;AAErC,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAY,OAAO,CAAC,iBAAiB,CAAC;AAEpE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,UAAU,GAEuB,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhF,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAY,OAAO,CAAC,gBAAgB,CAAC;AAElE,yEAAyE;AACzE,MAAM,CAAC,MAAM,SAAS,GAEwB,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"retry.js","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,6BAA6B,CAAC;AAMvD,uEAAuE;AACvE,MAAM,OAAO,KAAM,SAAQ,OAAO,CAAC,OAAO,EAAiB,CAAC,cAAc,CAAC;CAAG;AAE9E,yEAAyE;AACzE,MAAM,CAAC,MAAM,MAAM,GAWf,CAAC,gBAAmC,EAAE,EAAE,CAC1C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEzD,sCAAsC;AACtC,MAAM,CAAC,MAAM,IAAI,GAE6B,MAAM,CAAC,OAAO,CAC1D,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAC7C,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAY,OAAO,CAAC,WAAW,CAAC;AAExD,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;AACzC,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;AAErC,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAY,OAAO,CAAC,iBAAiB,CAAC;AAEpE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,UAAU,GAEuB,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhF,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAY,OAAO,CAAC,gBAAgB,CAAC;AAElE,yEAAyE;AACzE,MAAM,CAAC,MAAM,SAAS,GAEwB,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC"}

package/dist/services/auth.d.ts

@@ -39,8 +39,53 @@ export declare const AuthEnableMethodResponse: S.Schema<AuthEnableMethodResponse
 export interface AuthListEnabledMethodsRequest {
 }
 export declare const AuthListEnabledMethodsRequest: S.Schema<AuthListEnabledMethodsRequest>;
-export interface AuthListEnabledMethodsResponse {
+export type MountOptions = {
+    [key: string]: string | undefined;
+};
+export declare const MountOptions: S.Schema<MountOptions>;
+export type MountStrings = Array<string>;
+export declare const MountStrings: S.Schema<MountStrings>;
+export interface MountUserLockoutConfig {
+    user_lockout_counter_reset_duration: number;
+    user_lockout_threshold: number;
+    user_lockout_duration: number;
+    user_lockout_disable: boolean;
 }
+export declare const MountUserLockoutConfig: S.Schema<MountUserLockoutConfig>;
+export interface MountConfig {
+    default_lease_ttl: number;
+    max_lease_ttl: number;
+    force_no_cache: boolean;
+    audit_non_hmac_request_keys?: MountStrings;
+    audit_non_hmac_response_keys?: MountStrings;
+    passthrough_request_headers?: MountStrings;
+    allowed_response_headers?: MountStrings;
+    listing_visibility?: string;
+    token_type?: string;
+    user_lockout_config?: MountUserLockoutConfig;
+}
+export declare const MountConfig: S.Schema<MountConfig>;
+export interface MountInfo {
+    type: string;
+    description: string;
+    accessor: string;
+    uuid: string;
+    plugin_version: string;
+    running_plugin_version: string;
+    running_sha256: string;
+    local: boolean;
+    seal_wrap: boolean;
+    external_entropy_access: boolean;
+    options: MountOptions | null;
+    config: MountConfig;
+    deprecation_status?: string;
+}
+export declare const MountInfo: S.Schema<MountInfo>;
+export type MountTable = {
+    [key: string]: MountInfo | undefined;
+};
+export declare const MountTable: S.Schema<MountTable>;
+export type AuthListEnabledMethodsResponse = MountTable;
 export declare const AuthListEnabledMethodsResponse: S.Schema<AuthListEnabledMethodsResponse>;
 export interface AuthReadConfigurationRequest {
     /** The path to mount to. Cannot be delimited. Example: "user" */