@homeflare/distilled-openbao 0.2.0

package/dist/services/workflows.js

@@ -0,0 +1,149 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.js";
+import { OpenBaoProtocol, } from "../protocol.js";
+import * as Retry from "../retry.js";
+export const DeleteWorkflowsManagePathRequest = /*@__PURE__*/ S.suspend(() => S.Struct({
+    path: S.String.pipe(T.Label()),
+}).pipe(T.Http({
+    method: "DELETE",
+    uri: "/sys/workflows/manage/{path}",
+    code: 200,
+}))).annotate({
+    identifier: "DeleteWorkflowsManagePathRequest",
+});
+export const DeleteWorkflowsManagePathResponse = /*@__PURE__*/ S.suspend(() => S.Struct({})).annotate({
+    identifier: "DeleteWorkflowsManagePathResponse",
+});
+export const ReadWorkflowsManagePathRequest = /*@__PURE__*/ S.suspend(() => S.Struct({
+    path: S.String.pipe(T.Label()),
+    list: S.optional(S.String.pipe(T.Query())),
+    scan: S.optional(S.String.pipe(T.Query())),
+}).pipe(T.Http({ method: "GET", uri: "/sys/workflows/manage/{path}", code: 200 }))).annotate({
+    identifier: "ReadWorkflowsManagePathRequest",
+});
+export const WorkflowsReadWorkflowsManagePathResponse = /*@__PURE__*/ S.suspend(() => S.Struct({
+    allow_unauthenticated: S.optional(S.Boolean),
+    cas_required: S.optional(S.Boolean),
+    description: S.optional(S.String),
+    version: S.optional(S.Number),
+    workflow: S.optional(S.String),
+})).annotate({
+    identifier: "WorkflowsReadWorkflowsManagePathResponse",
+});
+export const WorkflowsExecuteWriteWorkflowsExecutePathRequest = 
+/*@__PURE__*/ S.suspend(() => S.Struct({
+    path: S.String.pipe(T.Label()),
+}).pipe(T.Http({
+    method: "POST",
+    uri: "/sys/workflows/execute/{path}",
+    code: 200,
+}))).annotate({
+    identifier: "WorkflowsExecuteWriteWorkflowsExecutePathRequest",
+});
+export const WorkflowsExecuteWriteWorkflowsExecutePathResponse = 
+/*@__PURE__*/ S.suspend(() => S.Struct({})).annotate({
+    identifier: "WorkflowsExecuteWriteWorkflowsExecutePathResponse",
+});
+export const WorkflowsScanWorkflowsManageRequestList = S.String;
+export const WorkflowsScanWorkflowsManageRequestScan = S.String;
+export const WorkflowsScanWorkflowsManageRequest = /*@__PURE__*/ S.suspend(() => S.Struct({
+    list: WorkflowsScanWorkflowsManageRequestList.pipe(T.Query()),
+    scan: WorkflowsScanWorkflowsManageRequestScan.pipe(T.Query()),
+}).pipe(T.Http({ method: "GET", uri: "/sys/workflows/manage", code: 200 }))).annotate({
+    identifier: "WorkflowsScanWorkflowsManageRequest",
+});
+export const WorkflowsScanWorkflowsManageResponseKeysList = 
+/*@__PURE__*/ S.Array(S.String);
+export const WorkflowsScanWorkflowsManageResponse = /*@__PURE__*/ S.suspend(() => S.Struct({
+    key_info: S.optional(S.Unknown),
+    keys: S.optional(WorkflowsScanWorkflowsManageResponseKeysList),
+})).annotate({
+    identifier: "WorkflowsScanWorkflowsManageResponse",
+});
+export const WorkflowsTraceWriteWorkflowsTracePathRequest = 
+/*@__PURE__*/ S.suspend(() => S.Struct({
+    path: S.String.pipe(T.Label()),
+}).pipe(T.Http({ method: "POST", uri: "/sys/workflows/trace/{path}", code: 200 }))).annotate({
+    identifier: "WorkflowsTraceWriteWorkflowsTracePathRequest",
+});
+export const WorkflowsTraceWriteWorkflowsTracePathResponse = 
+/*@__PURE__*/ S.suspend(() => S.Struct({})).annotate({
+    identifier: "WorkflowsTraceWriteWorkflowsTracePathResponse",
+});
+export const WorkflowsWriteWorkflowsManagePathRequest = /*@__PURE__*/ S.suspend(() => S.Struct({
+    path: S.String.pipe(T.Label()),
+    after: S.optional(S.String),
+    allow_unauthenticated: S.optional(S.Boolean),
+    cas: S.optional(S.Number),
+    cas_required: S.optional(S.Boolean),
+    description: S.optional(S.String),
+    limit: S.optional(S.Number),
+    workflow: S.String,
+}).pipe(T.Http({
+    method: "POST",
+    uri: "/sys/workflows/manage/{path}",
+    code: 200,
+}))).annotate({
+    identifier: "WorkflowsWriteWorkflowsManagePathRequest",
+});
+export const WorkflowsWriteWorkflowsManagePathResponse = 
+/*@__PURE__*/ S.suspend(() => S.Struct({
+    allow_unauthenticated: S.optional(S.Boolean),
+    cas_required: S.optional(S.Boolean),
+    description: S.optional(S.String),
+    version: S.optional(S.Number),
+    workflow: S.optional(S.String),
+})).annotate({
+    identifier: "WorkflowsWriteWorkflowsManagePathResponse",
+});
+/** Delete a workflow. */
+export const deleteWorkflowsManagePath = /*@__PURE__*/ API.make(() => ({
+    input: DeleteWorkflowsManagePathRequest,
+    output: DeleteWorkflowsManagePathResponse,
+    errors: [],
+    protocol: OpenBaoProtocol,
+    retry: Retry.Retry,
+}));
+/** Retrieve a workflow. */
+export const readWorkflowsManagePath = /*@__PURE__*/ API.make(() => ({
+    input: ReadWorkflowsManagePathRequest,
+    output: WorkflowsReadWorkflowsManagePathResponse,
+    errors: [],
+    protocol: OpenBaoProtocol,
+    retry: Retry.Retry,
+}));
+/** Execute the given workflow. */
+export const workflowsExecuteWriteWorkflowsExecutePath = /*@__PURE__*/ API.make(() => ({
+    input: WorkflowsExecuteWriteWorkflowsExecutePathRequest,
+    output: WorkflowsExecuteWriteWorkflowsExecutePathResponse,
+    errors: [],
+    protocol: OpenBaoProtocol,
+    retry: Retry.Retry,
+}));
+/** Scan (recursively list) workflows. */
+export const workflowsScanWorkflowsManage = /*@__PURE__*/ API.make(() => ({
+    input: WorkflowsScanWorkflowsManageRequest,
+    output: WorkflowsScanWorkflowsManageResponse,
+    errors: [],
+    protocol: OpenBaoProtocol,
+    retry: Retry.Retry,
+}));
+/** Execute the given workflow. */
+export const workflowsTraceWriteWorkflowsTracePath = /*@__PURE__*/ API.make(() => ({
+    input: WorkflowsTraceWriteWorkflowsTracePathRequest,
+    output: WorkflowsTraceWriteWorkflowsTracePathResponse,
+    errors: [],
+    protocol: OpenBaoProtocol,
+    retry: Retry.Retry,
+}));
+/** Create or update a workflow. */
+export const workflowsWriteWorkflowsManagePath = /*@__PURE__*/ API.make(() => ({
+    input: WorkflowsWriteWorkflowsManagePathRequest,
+    output: WorkflowsWriteWorkflowsManagePathResponse,
+    errors: [],
+    protocol: OpenBaoProtocol,
+    retry: Retry.Retry,
+}));
+//# sourceMappingURL=workflows.js.map

package/dist/services/workflows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../src/services/workflows.ts"],"names":[],"mappings":"AAAA,wIAAwI;AACxI,OAAO,KAAK,CAAC,MAAM,8BAA8B,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,2BAA2B,CAAC;AACjD,OAAO,KAAK,CAAC,MAAM,cAAc,CAAC;AAClC,OAAO,EACL,eAAe,GAGhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,KAAK,MAAM,aAAa,CAAC;AAQrC,MAAM,CAAC,MAAM,gCAAgC,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3E,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;CAC/B,CAAC,CAAC,IAAI,CACL,CAAC,CAAC,IAAI,CAAC;IACL,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,8BAA8B;IACnC,IAAI,EAAE,GAAG;CACV,CAAC,CACH,CACF,CAAC,QAAQ,CAAC;IACT,UAAU,EAAE,kCAAkC;CAC/C,CAAsD,CAAC;AAGxD,MAAM,CAAC,MAAM,iCAAiC,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAC5E,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CACb,CAAC,QAAQ,CAAC;IACT,UAAU,EAAE,mCAAmC;CAChD,CAAuD,CAAC;AAUzD,MAAM,CAAC,MAAM,8BAA8B,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CACzE,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;CAC3C,CAAC,CAAC,IAAI,CACL,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,8BAA8B,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAC1E,CACF,CAAC,QAAQ,CAAC;IACT,UAAU,EAAE,gCAAgC;CAC7C,CAAoD,CAAC;AActD,MAAM,CAAC,MAAM,wCAAwC,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAC7E,GAAG,EAAE,CACH,CAAC,CAAC,MAAM,CAAC;IACP,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5C,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;CAC/B,CAAC,CACL,CAAC,QAAQ,CAAC;IACT,UAAU,EAAE,0CAA0C;CACvD,CAA8D,CAAC;AAMhE,MAAM,CAAC,MAAM,gDAAgD;AAC3D,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3B,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;CAC/B,CAAC,CAAC,IAAI,CACL,CAAC,CAAC,IAAI,CAAC;IACL,MAAM,EAAE,MAAM;IACd,GAAG,EAAE,+BAA+B;IACpC,IAAI,EAAE,GAAG;CACV,CAAC,CACH,CACF,CAAC,QAAQ,CAAC;IACT,UAAU,EAAE,kDAAkD;CAC/D,CAAsE,CAAC;AAG1E,MAAM,CAAC,MAAM,iDAAiD;AAC5D,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnD,UAAU,EAAE,mDAAmD;CAChE,CAAuE,CAAC;AAG3E,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;AAGhE,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;AAQhE,MAAM,CAAC,MAAM,mCAAmC,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAC9E,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,uCAAuC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,EAAE,uCAAuC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;CAC9D,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,uBAAuB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAC5E,CAAC,QAAQ,CAAC;IACT,UAAU,EAAE,qCAAqC;CAClD,CAAyD,CAAC;AAI3D,MAAM,CAAC,MAAM,4CAA4C;AACvD,aAAa,CAAC,CAAC,CAAC,KAAK,CACnB,CAAC,CAAC,MAAM,CACwD,CAAC;AAQrE,MAAM,CAAC,MAAM,oCAAoC,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CACzE,GAAG,EAAE,CACH,CAAC,CAAC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;CAC/D,CAAC,CACL,CAAC,QAAQ,CAAC;IACT,UAAU,EAAE,sCAAsC;CACnD,CAA0D,CAAC;AAM5D,MAAM,CAAC,MAAM,4CAA4C;AACvD,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3B,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;CAC/B,CAAC,CAAC,IAAI,CACL,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,6BAA6B,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAC1E,CACF,CAAC,QAAQ,CAAC;IACT,UAAU,EAAE,8CAA8C;CAC3D,CAAkE,CAAC;AAGtE,MAAM,CAAC,MAAM,6CAA6C;AACxD,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnD,UAAU,EAAE,+CAA+C;CAC5D,CAAmE,CAAC;AAoBvE,MAAM,CAAC,MAAM,wCAAwC,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAC7E,GAAG,EAAE,CACH,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3B,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACzB,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM;CACnB,CAAC,CAAC,IAAI,CACL,CAAC,CAAC,IAAI,CAAC;IACL,MAAM,EAAE,MAAM;IACd,GAAG,EAAE,8BAA8B;IACnC,IAAI,EAAE,GAAG;CACV,CAAC,CACH,CACJ,CAAC,QAAQ,CAAC;IACT,UAAU,EAAE,0CAA0C;CACvD,CAA8D,CAAC;AAchE,MAAM,CAAC,MAAM,yCAAyC;AACpD,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3B,CAAC,CAAC,MAAM,CAAC;IACP,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5C,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;CAC/B,CAAC,CACH,CAAC,QAAQ,CAAC;IACT,UAAU,EAAE,2CAA2C;CACxD,CAA+D,CAAC;AAGnE,yBAAyB;AACzB,MAAM,CAAC,MAAM,yBAAyB,GAKlC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,KAAK,CAAC,KAAK;CACnB,CAAC,CAAC,CAAC;AAGJ,2BAA2B;AAC3B,MAAM,CAAC,MAAM,uBAAuB,GAKhC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,KAAK,EAAE,8BAA8B;IACrC,MAAM,EAAE,wCAAwC;IAChD,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,KAAK,CAAC,KAAK;CACnB,CAAC,CAAC,CAAC;AAGJ,kCAAkC;AAClC,MAAM,CAAC,MAAM,yCAAyC,GAKlD,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,KAAK,EAAE,gDAAgD;IACvD,MAAM,EAAE,iDAAiD;IACzD,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,KAAK,CAAC,KAAK;CACnB,CAAC,CAAC,CAAC;AAGJ,yCAAyC;AACzC,MAAM,CAAC,MAAM,4BAA4B,GAKrC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,KAAK,EAAE,mCAAmC;IAC1C,MAAM,EAAE,oCAAoC;IAC5C,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,KAAK,CAAC,KAAK;CACnB,CAAC,CAAC,CAAC;AAGJ,kCAAkC;AAClC,MAAM,CAAC,MAAM,qCAAqC,GAK9C,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,KAAK,EAAE,4CAA4C;IACnD,MAAM,EAAE,6CAA6C;IACrD,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,KAAK,CAAC,KAAK;CACnB,CAAC,CAAC,CAAC;AAGJ,mCAAmC;AACnC,MAAM,CAAC,MAAM,iCAAiC,GAK1C,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,KAAK,EAAE,wCAAwC;IAC/C,MAAM,EAAE,yCAAyC;IACjD,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,KAAK,CAAC,KAAK;CACnB,CAAC,CAAC,CAAC"}

package/dist/traits.d.ts

@@ -0,0 +1,11 @@
+/**
+ * OpenBao SDK trait surface — hand-written.
+ *
+ * Re-exports the generic protocol traits from core so generated operations
+ * import everything from one place. OpenBao speaks plain token-REST JSON
+ * with a `data`-enveloped success body (unwrapped in `protocol.ts`), so
+ * there are no provider-specific traits.
+ */
+export { Body, Header, Query, Label, Http, ResponseCode, HttpBody, FormDataFile, KeyDictionary, UnionCases, applyErrorMatchers, getErrorMatchers, type HttpTrait, type ErrorMatcher, bodySymbol, headerSymbol, querySymbol, labelSymbol, httpSymbol, responseCodeSymbol, httpBodySymbol, formDataFileSymbol, keyDictionarySymbol, unionCasesSymbol, errorMatchersSymbol, } from "@distilled.cloud/core/trait";
+export { SensitiveValue, RawResponse, RawResponseRoot, sensitiveValueSymbol, rawResponseSymbol, rawResponseRootSymbol, } from "@distilled.cloud/core/protocol-rest";
+//# sourceMappingURL=traits.d.ts.map

package/dist/traits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traits.d.ts","sourceRoot":"","sources":["../src/traits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,IAAI,EACJ,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,cAAc,EACd,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qCAAqC,CAAC"}

package/dist/traits.js

@@ -0,0 +1,12 @@
+/**
+ * OpenBao SDK trait surface — hand-written.
+ *
+ * Re-exports the generic protocol traits from core so generated operations
+ * import everything from one place. OpenBao speaks plain token-REST JSON
+ * with a `data`-enveloped success body (unwrapped in `protocol.ts`), so
+ * there are no provider-specific traits.
+ */
+export { Body, Header, Query, Label, Http, ResponseCode, HttpBody, FormDataFile, KeyDictionary, UnionCases, applyErrorMatchers, getErrorMatchers, bodySymbol, headerSymbol, querySymbol, labelSymbol, httpSymbol, responseCodeSymbol, httpBodySymbol, formDataFileSymbol, keyDictionarySymbol, unionCasesSymbol, errorMatchersSymbol, } from "@distilled.cloud/core/trait";
+// Bearer-REST protocol traits (sensitive strings, bare-payload responses).
+export { SensitiveValue, RawResponse, RawResponseRoot, sensitiveValueSymbol, rawResponseSymbol, rawResponseRootSymbol, } from "@distilled.cloud/core/protocol-rest";
+//# sourceMappingURL=traits.js.map

package/dist/traits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"traits.js","sourceRoot":"","sources":["../src/traits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,IAAI,EACJ,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAGhB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAErC,2EAA2E;AAC3E,OAAO,EACL,cAAc,EACd,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qCAAqC,CAAC"}

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "@homeflare/distilled-openbao",
+  "version": "0.2.0",
+  "description": "Interim npm home for @distilled.cloud/openbao — see docs/distilled-interim.md. Not published upstream yet; the kit aliases @distilled.cloud/openbao onto this package until it is.",
+  "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/distilled-openbao#readme",
+  "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",
+  "license": "Apache-2.0",
+  "author": "Timothy Schneider",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/taslabs-net/homeflare-kit.git",
+    "directory": "packages/distilled-openbao"
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "bun": "./src/index.ts",
+      "worker": "./src/index.ts",
+      "default": "./dist/index.js"
+    },
+    "./Credentials": {
+      "types": "./dist/credentials.d.ts",
+      "bun": "./src/credentials.ts",
+      "worker": "./src/credentials.ts",
+      "default": "./dist/credentials.js"
+    },
+    "./Errors": {
+      "types": "./dist/errors.d.ts",
+      "bun": "./src/errors.ts",
+      "worker": "./src/errors.ts",
+      "default": "./dist/errors.js"
+    },
+    "./Traits": {
+      "types": "./dist/traits.d.ts",
+      "bun": "./src/traits.ts",
+      "worker": "./src/traits.ts",
+      "default": "./dist/traits.js"
+    },
+    "./Protocol": {
+      "types": "./dist/protocol.d.ts",
+      "bun": "./src/protocol.ts",
+      "worker": "./src/protocol.ts",
+      "default": "./dist/protocol.js"
+    },
+    "./Retry": {
+      "types": "./dist/retry.d.ts",
+      "bun": "./src/retry.ts",
+      "worker": "./src/retry.ts",
+      "default": "./dist/retry.js"
+    },
+    "./*": {
+      "types": "./dist/services/*.d.ts",
+      "bun": "./src/services/*.ts",
+      "worker": "./src/services/*.ts",
+      "default": "./dist/services/*.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@distilled.cloud/core": "1.0.0-rc.12"
+  },
+  "peerDependencies": {
+    "effect": "4.0.0-rc.115"
+  }
+}

package/src/credentials.test.ts

@@ -0,0 +1,36 @@
+/**
+ * Proves `normalizeBaseUrl`'s trailing-slash trim is a linear scan, not the
+ * `/\/+$/` regex CodeQL flagged as js/polynomial-redos (alert 15 on kit PR
+ * 263): a long run of `/` must normalize correctly AND fast, not just
+ * correctly — a passing assertion alone wouldn't prove the fix, since the
+ * regex it replaces was also correct, just slow on adversarial input.
+ */
+import { describe, expect, test } from "bun:test";
+import { normalizeBaseUrl } from "./credentials.ts";
+
+describe("normalizeBaseUrl", () => {
+  test("drops a single trailing slash and appends /v1", () => {
+    expect(normalizeBaseUrl("http://127.0.0.1:8200/")).toBe(
+      "http://127.0.0.1:8200/v1",
+    );
+  });
+
+  test("leaves an already-complete /v1 root alone", () => {
+    expect(normalizeBaseUrl("http://127.0.0.1:8200/v1")).toBe(
+      "http://127.0.0.1:8200/v1",
+    );
+  });
+
+  test("a long run of trailing slashes normalizes correctly and in linear time", () => {
+    const pathological = `http://127.0.0.1:8200${"/".repeat(50_000)}`;
+    const start = performance.now();
+    const result = normalizeBaseUrl(pathological);
+    const elapsedMs = performance.now() - start;
+
+    expect(result).toBe("http://127.0.0.1:8200/v1");
+    // The polynomial regex this replaced would visibly stall (seconds, not
+    // milliseconds) on an input this size; a generous bound still catches
+    // a regression without being a flaky timing assertion.
+    expect(elapsedMs).toBeLessThan(200);
+  });
+});

package/src/credentials.ts

@@ -0,0 +1,100 @@
+/**
+ * OpenBao credentials — hand-written.
+ *
+ * The `Credentials` service resolves `{ token, apiBaseUrl, namespace }` per
+ * request; the protocol layer formats the `X-Vault-Token` (and, when set,
+ * `X-Vault-Namespace`) headers from it.
+ *
+ * OpenBao is self-hosted, so — unlike a single-tenant SaaS — there is no
+ * default API root: the address is part of the credential, same shape as
+ * `@distilled.cloud/forgejo`'s `FORGEJO_URL`/`FORGEJO_TOKEN`. The env var
+ * names (`BAO_ADDR`, `BAO_TOKEN`, `BAO_NAMESPACE`) match the kit's own
+ * `packages/alchemy/src/openbao/bao-address.ts` and the `bao` CLI itself.
+ */
+import * as EffectConfig from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { ConfigError } from "@distilled.cloud/core/errors";
+
+/**
+ * API path prefix — every OpenBao route is documented "prefixed with
+ * `/v1/`" (the generated spec's own `info.description`). It is a fixed path
+ * segment, not a header, so it belongs to the base URL exactly as Forgejo's
+ * `API_PATH` does.
+ */
+export const API_PATH = "/v1";
+
+/**
+ * Drop trailing slashes; the address carries no other structure to fix up.
+ * A loop, not `/\/+$/`: that regex backtracks polynomially on a long run of
+ * `/` (CodeQL js/polynomial-redos, alert 15 on kit PR 263) — the same fix
+ * as distilled-netbox's and distilled-unifi-network's `normalizeBaseUrl`.
+ */
+const trimTrailingSlashes = (addr: string): string => {
+  let end = addr.length;
+  while (end > 0 && addr.charCodeAt(end - 1) === 47) end--;
+  return addr.slice(0, end);
+};
+
+/** Normalize an address (or an already-complete `/v1` root) into the API base URL. */
+export const normalizeBaseUrl = (addr: string): string => {
+  const trimmed = trimTrailingSlashes(addr);
+  return trimmed.endsWith(API_PATH) ? trimmed : `${trimmed}${API_PATH}`;
+};
+
+export interface Config {
+  readonly token: Redacted.Redacted<string>;
+  /** Fully-qualified API root, e.g. `http://127.0.0.1:8200/v1`. */
+  readonly apiBaseUrl: string;
+  /** `X-Vault-Namespace`, when the estate uses one. Absent = root namespace. */
+  readonly namespace?: string;
+}
+
+export class Credentials extends Context.Service<
+  Credentials,
+  Effect.Effect<Config>
+>()("OpenBaoCredentials") {}
+
+const envConfig = EffectConfig.all({
+  token: EffectConfig.String("BAO_TOKEN"),
+  addr: EffectConfig.String("BAO_ADDR"),
+  namespace: EffectConfig.String("BAO_NAMESPACE").pipe(EffectConfig.option),
+});
+
+export const CredentialsFromEnv = Layer.succeed(
+  Credentials,
+  envConfig.pipe(
+    Effect.mapError(
+      () =>
+        new ConfigError({
+          message: "BAO_ADDR and BAO_TOKEN environment variables are required",
+        }),
+    ),
+    Effect.map(({ token, addr, namespace }) => ({
+      token: Redacted.make(token),
+      apiBaseUrl: normalizeBaseUrl(addr),
+      namespace: namespace.valueOrUndefined,
+    })),
+    Effect.orDie,
+  ),
+);
+
+/** Convenience layer from a plain token, address and optional namespace. */
+export const credentials = (config: {
+  readonly token: string | Redacted.Redacted<string>;
+  readonly addr: string;
+  readonly namespace?: string;
+}): Layer.Layer<Credentials> =>
+  Layer.succeed(
+    Credentials,
+    Effect.succeed({
+      token:
+        typeof config.token === "string"
+          ? Redacted.make(config.token)
+          : config.token,
+      apiBaseUrl: normalizeBaseUrl(config.addr),
+      namespace: config.namespace,
+    }),
+  );

package/src/errors.ts

@@ -0,0 +1,73 @@
+/**
+ * OpenBao-specific error types.
+ *
+ * Re-exports the common HTTP errors from core and adds the OpenBao-specific
+ * unknown-error and parse-error wrappers.
+ *
+ * OpenBao's failure envelope is `{"errors": [...]}` — zero or more strings,
+ * frequently empty (measured 2026-09-24: a 404 on a missing ACL policy
+ * answers `{"errors":[]}`, no text at all — vault/logical_system.go's
+ * `handlePoliciesRead` returns no response, which `RespondErrorCommon` turns
+ * into a bare status). There is rarely a machine-readable code, so most
+ * operations dispatch on the HTTP status alone: the per-operation classes
+ * generated from each operation's declared responses first, then core's
+ * shared status map, then {@link UnknownOpenBaoError}. Operations whose
+ * absence, conflict or refusal needs a resource-specific tag are typed by
+ * status (and message, when OpenBao supplies one) under `patches/`.
+ */
+export {
+  BadGateway,
+  BadRequest,
+  Conflict,
+  ConfigError,
+  Forbidden,
+  GatewayTimeout,
+  InternalServerError,
+  Locked,
+  NotFound,
+  ServiceUnavailable,
+  TooManyRequests,
+  Unauthorized,
+  UnprocessableEntity,
+  HTTP_STATUS_MAP,
+  DEFAULT_ERRORS,
+  API_ERRORS,
+} from "@distilled.cloud/core/errors";
+import type { DefaultErrors as CoreDefaultErrors } from "@distilled.cloud/core/errors";
+
+import * as Schema from "effect/Schema";
+import * as Category from "@distilled.cloud/core/category";
+
+/**
+ * Unknown OpenBao error — returned when a failed response's HTTP status has
+ * no mapped error class. Carries the raw body for later cataloging.
+ */
+export class UnknownOpenBaoError extends Schema.TaggedError<UnknownOpenBaoError>()(
+  "UnknownOpenBaoError",
+  {
+    code: Schema.optional(Schema.String),
+    message: Schema.optional(Schema.String),
+    body: Schema.Unknown,
+  },
+).pipe(Category.withServerError) {}
+
+/** Schema parse error wrapper. */
+export class OpenBaoParseError extends Schema.TaggedError<OpenBaoParseError>()(
+  "OpenBaoParseError",
+  {
+    body: Schema.Unknown,
+    cause: Schema.Unknown,
+  },
+).pipe(Category.withParseError) {}
+
+/**
+ * Errors any OpenBao operation may surface in addition to the per-operation
+ * typed status errors.
+ */
+export type ClientErrors = UnknownOpenBaoError | OpenBaoParseError;
+
+/**
+ * Default OpenBao operation errors: the shared HTTP status errors from core
+ * plus the client-level fallback/decode errors.
+ */
+export type DefaultErrors = CoreDefaultErrors | ClientErrors;

package/src/index.ts

@@ -0,0 +1,33 @@
+/**
+ * @distilled.cloud/openbao — OpenBao HTTP API SDK for Effect.
+ *
+ * `./services` is generated by `scripts/generate.ts` from the Smithy models
+ * in `.generated-specs` (written by `scripts/convert.ts` from the OpenAPI
+ * document that `stacks/distilled-submodules/spec-repos/openbao/
+ * fetch-specs.ts` generates by mounting OpenBao's own stock backends on a
+ * throwaway local `-dev` server). Everything else in this folder is
+ * hand-written.
+ *
+ * One module per mount/backend prefix — `policies`, `kv`, `pki`, `approle`,
+ * `database`, `ssh`, `sys`, … — bucketed from each operation's own
+ * `operationId` (see `scripts/convert.ts`'s module docs).
+ *
+ * @example
+ * ```ts
+ * import * as OpenBao from "@distilled.cloud/openbao";
+ *
+ * const policy = yield* OpenBao.Services.policies.policiesReadAclPolicy({
+ *   name: "agent",
+ * });
+ * ```
+ */
+export * from "./credentials.ts";
+export * from "./errors.ts";
+export * as T from "./traits.ts";
+export {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "./protocol.ts";
+export * as Retry from "./retry.ts";
+export * as Services from "./services/index.ts";

package/src/protocol.test.ts

@@ -0,0 +1,123 @@
+/**
+ * Proves the two measured, package-specific rules in `protocol.ts`: the
+ * `{"errors": [...]}` envelope (often empty — the common 404 shape) and the
+ * `data`-envelope unwrap on 2xx bodies. Same pattern as
+ * `@distilled.cloud/proxmox`'s `protocol.test.ts` (a fake `HttpClient`
+ * layer in front of a real generated operation), written after that file's
+ * own history: an adversarial review is what caught the proxmox bug this
+ * pattern exists to stop recurring, so OpenBao gets the same coverage from
+ * the start rather than after its own incident.
+ */
+import { describe, expect, test } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import { credentials } from "./credentials.ts";
+import { Forbidden, UnknownOpenBaoError } from "./errors.ts";
+import * as Retry from "./retry.ts";
+import { PolicyNotFound, policiesReadAclPolicy } from "./services/policies.ts";
+
+const testCredentials = credentials({
+  token: "test-token",
+  addr: "http://127.0.0.1:8299",
+  namespace: "homeflare",
+});
+
+const fakeOpenBao = (status: number, body: unknown) =>
+  Layer.succeed(
+    HttpClient.HttpClient,
+    HttpClient.make((request) =>
+      Effect.sync(() =>
+        HttpClientResponse.fromWeb(
+          request,
+          new Response(body === undefined ? undefined : JSON.stringify(body), {
+            status,
+          }),
+        ),
+      ),
+    ),
+  );
+
+const readAbsent = (status: number, body: unknown) =>
+  Effect.runPromise(
+    policiesReadAclPolicy({ name: "zz-probe-absent" }).pipe(
+      Retry.none,
+      Effect.provide(
+        Layer.mergeAll(fakeOpenBao(status, body), testCredentials),
+      ),
+      Effect.flip,
+    ),
+  );
+
+describe("protocol.ts error decoding", () => {
+  test("a 404 with an EMPTY errors array (the measured absent-policy shape) is PolicyNotFound", async () => {
+    // Measured on OpenBao 2.6.2, 2026-09-24: GET sys/policies/acl/<absent>
+    // answers exactly this — see patches/policies/_errors.json.
+    const error = await readAbsent(404, { errors: [] });
+    expect(error).toBeInstanceOf(PolicyNotFound);
+  });
+
+  test("a 403 with an errors array falls back to core's status map (Forbidden), joined", async () => {
+    const error = await readAbsent(403, {
+      errors: ["permission denied", "token expired"],
+    });
+    expect(error).toBeInstanceOf(Forbidden);
+    expect(error).toMatchObject({
+      message: "permission denied; token expired",
+    });
+  });
+
+  // 418 is neither in HTTP_STATUS_MAP nor >= 500 (the unmapped-5xx fallback
+  // in core's makeRestProtocol answers InternalServerError for those before
+  // unknownError is ever reached).
+  test("a genuinely unmapped, non-5xx status still falls back to UnknownOpenBaoError", async () => {
+    const error = await readAbsent(418, { errors: ["teapot"] });
+    expect(error).toBeInstanceOf(UnknownOpenBaoError);
+  });
+
+  test('the {"data": ...} envelope is unwrapped before decode', async () => {
+    const result = await Effect.runPromise(
+      policiesReadAclPolicy({ name: "agent" }).pipe(
+        Effect.provide(
+          Layer.mergeAll(
+            fakeOpenBao(200, {
+              request_id: "r-1",
+              lease_id: "",
+              renewable: false,
+              lease_duration: 0,
+              data: { name: "agent", policy: 'path "secret/*" {}', version: 1 },
+              wrap_info: null,
+              warnings: null,
+              auth: null,
+            }),
+            testCredentials,
+          ),
+        ),
+      ),
+    );
+    expect(result).toMatchObject({
+      name: "agent",
+      policy: 'path "secret/*" {}',
+    });
+  });
+
+  test("sys/health-shaped bodies (no data envelope) pass through unchanged", async () => {
+    // Not every endpoint is a logical response — sys/health answers its
+    // fields at the top level, with no `data` wrapper. This operation never
+    // calls that endpoint; the test exercises transformResponse directly
+    // through a 2xx body that happens to have no `data` field, confirming
+    // the unwrap only fires when one is actually present.
+    const result = await Effect.runPromise(
+      policiesReadAclPolicy({ name: "agent" }).pipe(
+        Effect.provide(
+          Layer.mergeAll(
+            fakeOpenBao(200, { name: "agent", policy: "" }),
+            testCredentials,
+          ),
+        ),
+      ),
+    );
+    expect(result).toMatchObject({ name: "agent", policy: "" });
+  });
+});