@homeflare/alchemy 0.23.0 → 0.25.0

package/dist/litellm/index.js.map

@@ -0,0 +1,14 @@
+{
+  "version": 3,
+  "sources": ["../src/litellm/credentials.ts", "../src/litellm/client.ts", "../src/litellm/pass-through-endpoint.ts", "../src/litellm/pass-through-form.ts", "../src/litellm/providers.ts"],
+  "sourcesContent": [
+    "/**\n * The lazy Auth service every LiteLLM call reads from, and nothing else reads the environment.\n *\n * ★ LITELLM'S OWN VARIABLE NAMES, NOT A HOUSE CHOICE. `LITELLM_PROXY_URL` and\n *   `LITELLM_PROXY_API_KEY` are what LiteLLM's own CLI client reads\n *   (litellm/proxy/client/cli/main.py:70,78 at tag v1.100.0) — using the vendor's own names means\n *   a consumer who already has a `.env` for the `litellm` CLI needs nothing new for this package.\n * ⛔ NO DEFAULT URL. A published package that fell back to a loopback address would let a\n *   consumer who forgot the variable watch every call fail against a proxy that is not theirs,\n *   instead of being told which variable is missing (S24/S25 — the house rule, not a vendor one).\n * ⛔ THE KEY IS NEVER A PROP. Alchemy persists attributes unencrypted (S25); the master key that\n *   `update_config_general_settings` requires (PROXY_ADMIN only, proxy_server.py:16411 at the\n *   tag) is read fresh from the environment on every call, never stored in state.\n * ★ LAZY: the service's VALUE is an `Effect` that resolves the credential, not the credential\n *   itself — so a layer built once still reads the environment inside each operation\n *   (`yield* yield* LitellmCredentials`), the idiom `alchemy/Auth`'s custom-auth-provider guide\n *   describes for a credential a layer must not capture at build time.\n */\nimport * as Context from 'effect/Context';\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\n\nexport const LITELLM_PROXY_URL_ENV = 'LITELLM_PROXY_URL';\nexport const LITELLM_PROXY_API_KEY_ENV = 'LITELLM_PROXY_API_KEY';\n\nexport interface LitellmCreds {\n  /** Trailing slash stripped. No default — see the header. */\n  readonly baseUrl: string;\n  /** LiteLLM's master (or a PROXY_ADMIN) key. Never logged, never an attribute. */\n  readonly apiKey: string;\n}\n\nexport class LitellmCredentialsError extends Data.TaggedError('LitellmCredentialsError')<{\n  readonly message: string;\n}> {}\n\nconst missing = (name: string): LitellmCredentialsError =>\n  new LitellmCredentialsError({\n    message:\n      `${name} is not set. Export it — the same variable LiteLLM's own \\`litellm\\` CLI ` +\n      'reads — before running a stack that declares a LiteLLM.PassThroughEndpoint.',\n  });\n\n/** Read at call time. Exported so a test can call it directly against `process.env`. */\nexport const resolveCreds: Effect.Effect<LitellmCreds, LitellmCredentialsError> = Effect.gen(\n  function* () {\n    const rawUrl = process.env[LITELLM_PROXY_URL_ENV];\n    if (rawUrl === undefined || rawUrl.trim() === '')\n      return yield* Effect.fail(missing(LITELLM_PROXY_URL_ENV));\n    const rawKey = process.env[LITELLM_PROXY_API_KEY_ENV];\n    if (rawKey === undefined || rawKey.trim() === '') {\n      return yield* Effect.fail(missing(LITELLM_PROXY_API_KEY_ENV));\n    }\n    return { baseUrl: rawUrl.trim().replace(/\\/$/, ''), apiKey: rawKey.trim() };\n  },\n);\n\n/** The Effect service a LiteLLM operation reads: `yield* yield* LitellmCredentials`. */\nexport class LitellmCredentials extends Context.Service<\n  LitellmCredentials,\n  Effect.Effect<LitellmCreds, LitellmCredentialsError>\n>()('homeflare/litellm/Credentials') {}\n\n/** The default layer: resolves from the environment, fresh, on every `yield*`. */\nexport const litellmCredentialsLayer: Layer.Layer<LitellmCredentials> = Layer.succeed(\n  LitellmCredentials,\n  resolveCreds,\n);\n\n/** For a test: a fixed credential, never touching the environment. */\nexport const litellmCredentialsLayerFor = (creds: LitellmCreds): Layer.Layer<LitellmCredentials> =>\n  Layer.succeed(LitellmCredentials, Effect.succeed(creds));\n",
+    "/**\n * The four LiteLLM proxy calls a `LiteLLM.PassThroughEndpoint` needs, and nothing else reaches\n * LiteLLM's `/config/pass_through_endpoint` routes.\n *\n * ⛔ WRAPPED IN A PER-BASE-URL SEMAPHORE. LiteLLM stores every pass-through endpoint in ONE\n *   `general_settings.pass_through_endpoints` list (pass_through_endpoints.py at tag v1.100.0),\n *   so create/update/delete are each a read-modify-write of the WHOLE list through\n *   `update_config_general_settings`. Two of this package's own calls racing each other — two\n *   endpoints created in the same deploy — would each read the list, add their own row and write\n *   it back, and the second write would silently drop the first row. One permit per proxy\n *   serialises this package's own writes; it cannot serialise against the LiteLLM UI or a second\n *   deploy process, which is why `reconcile` reads back after writing rather than trusting the\n *   call that just returned (docs/litellm.md).\n * ★ `Authorization: Bearer <key>` — LiteLLM's own client uses it (litellm/proxy/client/cli, and\n *   every `/config/*` route decorator at the tag takes `user_api_key_dict = Depends(user_api_key_auth)`,\n *   which accepts a bearer token). Every mutation additionally requires the caller be\n *   PROXY_ADMIN (`update_config_general_settings`, proxy_server.py:16411 at the tag) — an\n *   ordinary virtual key gets `LitellmUnauthorizedError`, not a clearer 403 body naming the role.\n * ⛔ NO MESSAGE SNIFFING (S21). Every status this file maps becomes a typed tag; nothing here or\n *   above it matches an error body's text. Deleting an id LiteLLM does not have answers 400\n *   (measured against the tag's `pass_through_endpoint_delete` — the id is looked up in the list\n *   and a miss raises `HTTPException(400)`, not 404) — but so does a genuinely-live row when the\n *   caller isn't PROXY_ADMIN, or the DB is disconnected (`update_config_general_settings`,\n *   proxy_server.py:16389-16416 at the tag): the SAME status, for a delete that did NOT happen.\n *   `deletePassThroughEndpoint` tells them apart by re-listing (a GET, which needs no PROXY_ADMIN —\n *   proxy_server.py:3245-3251) rather than by the 400's body text — see its own comment.\n */\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport * as Semaphore from 'effect/Semaphore';\nimport { LitellmCredentials, type LitellmCredentialsError } from './credentials.ts';\nimport type {\n  PassThroughEndpointResponse,\n  PassThroughGenericEndpoint,\n} from './generated/pass-through.ts';\n\nexport type LitellmRequirements = HttpClient.HttpClient | LitellmCredentials;\n\n/**\n * The `litellm:<METHOD> <path>` operations this package writes to and reads from.\n *\n * ★ `codegen/litellm.ts` scans this FILE's text for these exact literals to pick which of\n *   LiteLLM 1.100.0's 696 paths to generate types from (codegen/litellm.ts header). Keep each one\n *   a literal string on one line; the generator matches text, it does not evaluate the object.\n */\nexport const LITELLM_OPERATIONS = {\n  create: 'litellm:POST /config/pass_through_endpoint',\n  delete: 'litellm:DELETE /config/pass_through_endpoint',\n  list: 'litellm:GET /config/pass_through_endpoint',\n  update: 'litellm:POST /config/pass_through_endpoint/{endpoint_id}',\n} as const;\n\nexport class LitellmUnauthorizedError extends Data.TaggedError('LitellmUnauthorizedError')<{\n  readonly status: number;\n  readonly method: string;\n  readonly path: string;\n}> {}\nexport class LitellmBadRequestError extends Data.TaggedError('LitellmBadRequestError')<{\n  readonly method: string;\n  readonly path: string;\n  readonly detail: string;\n}> {}\nexport class LitellmHttpError extends Data.TaggedError('LitellmHttpError')<{\n  readonly status: number;\n  readonly method: string;\n  readonly path: string;\n  readonly detail: string;\n}> {}\nexport class LitellmTransportError extends Data.TaggedError('LitellmTransportError')<{\n  readonly method: string;\n  readonly path: string;\n  readonly cause: string;\n}> {}\n\nexport type LitellmError =\n  | LitellmUnauthorizedError\n  | LitellmBadRequestError\n  | LitellmHttpError\n  | LitellmTransportError\n  | LitellmCredentialsError;\n\nconst semaphores = new Map<string, Semaphore.Semaphore>();\n\n/** One semaphore per base URL, created on first use. Never `Hash.structure` (S18) — a plain Map key. */\nconst semaphoreFor = (baseUrl: string): Effect.Effect<Semaphore.Semaphore> =>\n  Effect.sync(() => {\n    const existing = semaphores.get(baseUrl);\n    if (existing !== undefined) return existing;\n    const created = Semaphore.makeUnsafe(1);\n    semaphores.set(baseUrl, created);\n    return created;\n  });\n\nconst call = <T>(method: 'GET' | 'POST' | 'DELETE', path: string, body?: unknown) =>\n  Effect.gen(function* () {\n    const creds = yield* yield* LitellmCredentials;\n    const client = yield* HttpClient.HttpClient;\n    const url = `${creds.baseUrl}${path}`;\n    const request = HttpClientRequest.make(method)(url).pipe(\n      HttpClientRequest.setHeaders({\n        Accept: 'application/json',\n        Authorization: `Bearer ${creds.apiKey}`,\n      }),\n      body === undefined\n        ? (self) => self\n        : HttpClientRequest.bodyText(JSON.stringify(body), 'application/json'),\n    );\n    const response = yield* client\n      .execute(request)\n      .pipe(\n        Effect.mapError(\n          (cause) => new LitellmTransportError({ cause: String(cause), method, path }),\n        ),\n      );\n    const text = yield* response.text.pipe(\n      Effect.mapError((cause) => new LitellmTransportError({ cause: String(cause), method, path })),\n    );\n    if (response.status === 401 || response.status === 403) {\n      return yield* Effect.fail(\n        new LitellmUnauthorizedError({ method, path, status: response.status }),\n      );\n    }\n    if (response.status === 400) {\n      return yield* Effect.fail(\n        new LitellmBadRequestError({ detail: text.slice(0, 300), method, path }),\n      );\n    }\n    if (response.status < 200 || response.status >= 300) {\n      return yield* Effect.fail(\n        new LitellmHttpError({ detail: text.slice(0, 300), method, path, status: response.status }),\n      );\n    }\n    return (text === '' ? undefined : JSON.parse(text)) as T;\n  });\n\n/** GET /config/pass_through_endpoint — every row, config-file and DB alike. Not under the semaphore: reads don't race the field. */\nexport const listPassThroughEndpoints = (): Effect.Effect<\n  readonly PassThroughGenericEndpoint[],\n  LitellmError,\n  LitellmRequirements\n> =>\n  call<PassThroughEndpointResponse>('GET', '/config/pass_through_endpoint').pipe(\n    Effect.map((body) => body.endpoints),\n  );\n\nconst mutate = <T>(io: Effect.Effect<T, LitellmError, LitellmRequirements>) =>\n  Effect.gen(function* () {\n    const creds = yield* yield* LitellmCredentials;\n    const semaphore = yield* semaphoreFor(creds.baseUrl);\n    return yield* semaphore.withPermits(1)(io);\n  });\n\n/** POST /config/pass_through_endpoint. `body` carries `id` — see pass-through-endpoint.ts. */\nexport const createPassThroughEndpoint = (\n  body: PassThroughGenericEndpoint,\n): Effect.Effect<void, LitellmError, LitellmRequirements> =>\n  mutate(call('POST', '/config/pass_through_endpoint', body));\n\n/** POST /config/pass_through_endpoint/{endpoint_id}. Merges with `exclude_none` — see pass-through-form.ts. */\nexport const updatePassThroughEndpoint = (\n  endpointId: string,\n  body: Partial<PassThroughGenericEndpoint>,\n): Effect.Effect<void, LitellmError, LitellmRequirements> =>\n  mutate(call('POST', `/config/pass_through_endpoint/${encodeURIComponent(endpointId)}`, body));\n\n/**\n * DELETE /config/pass_through_endpoint?endpoint_id=… — idempotent BY THIS FUNCTION, not by the\n * vendor. ⚠️ Measured at v1.100.0: deleting an id the list does not have raises `HTTPException(400)`\n * from `pass_through_endpoint_delete` — but the SAME route also 400s `not_allowed_access` for a\n * non-PROXY_ADMIN caller or a disconnected DB (`update_config_general_settings`,\n * proxy_server.py:16389-16416), on a row that never got deleted. A 400 alone cannot tell the two\n * apart, so THIS FUNCTION DOESN'T GUESS FROM THE STATUS ALONE: on 400 it re-lists (a GET — no\n * PROXY_ADMIN required, proxy_server.py:3245-3251) and only treats the delete as already-done if\n * `endpointId` is genuinely absent; otherwise the delete failed and this re-fails with the ORIGINAL\n * error, not a message match (S21 — a status-and-a-real-read decision, never body text).\n */\nexport const deletePassThroughEndpoint = (\n  endpointId: string,\n): Effect.Effect<void, LitellmError, LitellmRequirements> =>\n  mutate(\n    call(\n      'DELETE',\n      `/config/pass_through_endpoint?endpoint_id=${encodeURIComponent(endpointId)}`,\n    ).pipe(\n      Effect.catchTag('LitellmBadRequestError', (original) =>\n        Effect.gen(function* () {\n          const rows = yield* listPassThroughEndpoints();\n          if (rows.some((row) => row.id === endpointId)) return yield* Effect.fail(original);\n        }),\n      ),\n      Effect.asVoid,\n    ),\n  );\n",
+    "/**\n * `LiteLLM.PassThroughEndpoint` — one row in LiteLLM's `general_settings.pass_through_endpoints`.\n *\n * ★ ADOPT-FRIENDLY BY id, NOT BY PATH. `output?.id` is used as the object's live id once the\n *   engine has one — from our own prior create (the deterministic physical name) or from an\n *   adopted foreign row — and `read` computes a FRESH physical name only for a resource the\n *   engine has never resolved before. This is S7/S9's \"output is a cache of stable identifiers,\n *   not proof the object exists\" and S13's \"an adopted object keeps its live name as an explicit\n *   prop\", applied to an id LiteLLM lets a client choose (`_types.py:2192` at v1.100.0: create\n *   takes a caller-supplied `id`, else `uuid4()`).\n *\n * ⛔ A PATH HELD BY AN `is_from_config` ROW IS REFUSED, NOT ADOPTED. A DB row on the same path\n *   overrides it at runtime (`pass_through_endpoints.py` merges DB after config, at the tag) — so\n *   creating one would silently take over a route the operator declared in `config.yaml`, the\n *   exact \"DB row silently overrides the file\" the task names. `is_from_config` rows are also\n *   never updated or deleted by this provider, for the same reason.\n * ⛔ A DB ROW WITH NO `id` (path-only, `_types.py`'s \"backwards compatibility\" case) CANNOT BE\n *   ADDRESSED by the id-keyed update/delete calls this provider uses, so it is refused rather than\n *   silently adopted into an id-based lifecycle it cannot actually manage — see docs/litellm.md.\n * ⛔ NO CREDENTIAL IS A PROP (S25). `LITELLM_PROXY_URL`/`LITELLM_PROXY_API_KEY` are read at call\n *   time by credentials.ts.\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport { createPhysicalName } from 'alchemy/PhysicalName';\nimport * as Provider from 'alchemy/Provider';\nimport type { Stack } from 'alchemy/Stack';\nimport type { Stage } from 'alchemy/Stage';\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\nimport * as Predicate from 'effect/Predicate';\nimport {\n  type LitellmError,\n  type LitellmRequirements,\n  createPassThroughEndpoint,\n  deletePassThroughEndpoint,\n  listPassThroughEndpoints,\n  updatePassThroughEndpoint,\n} from './client.ts';\nimport type { PassThroughGenericEndpoint } from './generated/pass-through.ts';\nimport {\n  type PassThroughEndpointAttributes,\n  type PassThroughEndpointProps,\n  createBody,\n  literalSecretHeaders,\n  matches,\n  needsReplace,\n  updateBody,\n} from './pass-through-form.ts';\n\nexport type { PassThroughEndpointAttributes, PassThroughEndpointProps };\n\nexport class LitellmConfigPathConflictError extends Data.TaggedError(\n  'LitellmConfigPathConflictError',\n)<{\n  readonly path: string;\n}> {}\nexport class LitellmUnaddressableRowError extends Data.TaggedError('LitellmUnaddressableRowError')<{\n  readonly path: string;\n}> {}\nexport class LitellmLiteralSecretHeaderError extends Data.TaggedError(\n  'LitellmLiteralSecretHeaderError',\n)<{\n  readonly headers: readonly string[];\n}> {}\n\nexport type PassThroughEndpointError =\n  | LitellmError\n  | LitellmConfigPathConflictError\n  | LitellmUnaddressableRowError\n  | LitellmLiteralSecretHeaderError;\n\nexport interface LiteLLMPassThroughEndpoint extends Resource<\n  'LiteLLM.PassThroughEndpoint',\n  PassThroughEndpointProps,\n  PassThroughEndpointAttributes,\n  never,\n  LitellmRequirements | Stack | Stage\n> {}\n\nexport const LiteLLMPassThroughEndpoint = Resource<LiteLLMPassThroughEndpoint>(\n  'LiteLLM.PassThroughEndpoint',\n);\n\nexport const isLiteLLMPassThroughEndpoint = (value: unknown): value is LiteLLMPassThroughEndpoint =>\n  Predicate.hasProperty(value, 'Type') && value.Type === 'LiteLLM.PassThroughEndpoint';\n\nconst toAttributes = (\n  row: PassThroughGenericEndpoint,\n  fallbackId: string,\n): PassThroughEndpointAttributes => ({\n  ...row,\n  id: row.id ?? fallbackId,\n});\n\nconst physicalIdOf = (logicalId: string, instanceId: string) =>\n  createPhysicalName({ id: logicalId, instanceId, lowercase: true, maxLength: 64 });\n\n/**\n * Find this resource's live row (by id) and, when absent, the row that already holds its `path`\n * (a config-file row to refuse, or a DB row LiteLLM did not give an id — also refused, see the\n * file header — or a genuine foreign DB row to hand back `Unowned`).\n */\nconst locate = (\n  rows: readonly PassThroughGenericEndpoint[],\n  objectId: string,\n  path: string,\n): {\n  readonly mine: PassThroughGenericEndpoint | undefined;\n  readonly conflict: PassThroughGenericEndpoint | undefined;\n} => {\n  const mine = rows.find((row) => row.id === objectId);\n  const conflict = mine === undefined ? rows.find((row) => row.path === path) : undefined;\n  return { conflict, mine };\n};\n\n/** The typed refusal for a `path` conflict that cannot ever be adopted (config row, or no id). */\nconst conflictRefusal = (conflict: PassThroughGenericEndpoint, path: string) =>\n  conflict.is_from_config === true\n    ? new LitellmConfigPathConflictError({ path })\n    : new LitellmUnaddressableRowError({ path });\n\n/** `read`'s answer for a path conflict: `Unowned` when it is a real, addressable DB row — a typed refusal otherwise. */\nconst readConflict = (conflict: PassThroughGenericEndpoint, path: string) =>\n  conflict.is_from_config !== true && conflict.id !== undefined && conflict.id !== null\n    ? Effect.succeed(Unowned(toAttributes(conflict, conflict.id)))\n    : Effect.fail(conflictRefusal(conflict, path));\n\nconst refuseLiteralSecrets = (headers: Readonly<Record<string, unknown>> | undefined) => {\n  const bad = literalSecretHeaders(headers);\n  return bad.length === 0\n    ? Effect.void\n    : Effect.fail(new LitellmLiteralSecretHeaderError({ headers: bad }));\n};\n\n/** ⛔ TEST-ONLY EXPORT. Not on index.ts's barrel — a lifecycle test calls these directly against the fake. */\nexport const passThroughHandlers = {\n  read: ({\n    id,\n    instanceId,\n    olds,\n    output,\n  }: {\n    id: string;\n    instanceId: string;\n    olds: PassThroughEndpointProps;\n    output: PassThroughEndpointAttributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      const objectId = output?.id ?? (yield* physicalIdOf(id, instanceId));\n      const rows = yield* listPassThroughEndpoints();\n      const { conflict, mine } = locate(rows, objectId, olds.path);\n      if (mine !== undefined) return toAttributes(mine, objectId);\n      if (conflict === undefined) return undefined;\n      return yield* readConflict(conflict, olds.path);\n    }),\n\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<PassThroughEndpointProps>;\n    output: PassThroughEndpointAttributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      if (!isResolved(news)) return undefined;\n      yield* refuseLiteralSecrets(news.headers);\n      if (output === undefined) return undefined;\n      // ⛔ deleteFirst: TRUE — a create-first replace mints a new instanceId/id before the old row\n      //   on `path` is gone, so the new generation's `reconcile` would refuse it as a foreign\n      //   conflict (Apply.ts). Same fix this kit's other unique-identity providers use.\n      if (needsReplace(output, news)) return { action: 'replace', deleteFirst: true } as const;\n      return matches(output, news)\n        ? ({ action: 'noop' } as const)\n        : ({ action: 'update' } as const);\n    }),\n\n  reconcile: ({\n    id,\n    instanceId,\n    news,\n    output,\n  }: {\n    id: string;\n    instanceId: string;\n    news: PassThroughEndpointProps;\n    output: PassThroughEndpointAttributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      yield* refuseLiteralSecrets(news.headers);\n      const objectId = output?.id ?? (yield* physicalIdOf(id, instanceId));\n      const rows = yield* listPassThroughEndpoints();\n      const { conflict, mine } = locate(rows, objectId, news.path);\n\n      if (mine === undefined) {\n        // ⚠️ A CONFLICT HERE — reconcile, not read — means ownership shifted between plan and\n        //   apply (a config row or a foreign DB row landed on this path after `read` cleared it).\n        //   `read` gates a genuine adopt by returning `Unowned`; reconcile itself never adopts,\n        //   so ANY conflict here fails rather than risking a second row on one path.\n        if (conflict !== undefined) return yield* Effect.fail(conflictRefusal(conflict, news.path));\n        yield* createPassThroughEndpoint(createBody(news, objectId));\n      } else if (mine.is_from_config === true) {\n        // ⛔ NEVER UPDATE OR DELETE AN `is_from_config` ROW, even one this resource's own\n        //   deterministic id happens to match (a config.yaml author could in principle choose the\n        //   same id `createPhysicalName` would). Refuse rather than silently editing the file's row.\n        return yield* Effect.fail(new LitellmConfigPathConflictError({ path: news.path }));\n      } else if (needsReplace(toAttributes(mine, objectId), news)) {\n        yield* deletePassThroughEndpoint(objectId);\n        yield* createPassThroughEndpoint(createBody(news, objectId));\n      } else if (!matches(toAttributes(mine, objectId), news)) {\n        const body = updateBody(news);\n        if (Object.keys(body).length > 0) yield* updatePassThroughEndpoint(objectId, body);\n      }\n\n      const after = (yield* listPassThroughEndpoints()).find((row) => row.id === objectId);\n      if (after === undefined) {\n        return yield* Effect.die(\n          new Error(\n            `LiteLLM.PassThroughEndpoint ${news.path}: the write returned no error but id ` +\n              `${objectId} is still absent from GET /config/pass_through_endpoint — read back ` +\n              'rather than trusting the call that just returned.',\n          ),\n        );\n      }\n      return toAttributes(after, objectId);\n    }),\n\n  delete: ({\n    id,\n    instanceId,\n    olds,\n    output,\n  }: {\n    id: string;\n    instanceId: string;\n    olds: PassThroughEndpointProps;\n    output: PassThroughEndpointAttributes;\n  }) =>\n    Effect.gen(function* () {\n      const objectId = output.id ?? (yield* physicalIdOf(id, instanceId));\n      const rows = yield* listPassThroughEndpoints();\n      const live = rows.find((row) => row.id === objectId);\n      // ⛔ NEVER DELETE AN `is_from_config` ROW, and a DB row this resource never created (a path\n      //   match with a different id) is not this resource's to remove either.\n      if (live === undefined || live.is_from_config === true || live.path !== olds.path) return;\n      yield* deletePassThroughEndpoint(objectId);\n    }),\n\n  list: () => Effect.succeed([]),\n};\n\nexport const LiteLLMPassThroughEndpointProvider = () =>\n  Provider.effect(\n    LiteLLMPassThroughEndpoint,\n    Effect.succeed(LiteLLMPassThroughEndpoint.Provider.of(passThroughHandlers)),\n  );\n",
+    "/**\n * The wire body for a `LiteLLM.PassThroughEndpoint`, the comparison that decides whether it needs\n * writing, and the refusals that stop a plan before it writes anything unsafe.\n *\n * ★ EXTRACTED SO IT CAN BE TESTED WITHOUT A SERVER — the same reason netbox keeps `prefix-form.ts`\n *   beside `prefix.ts` (S32/testing-and-docs.md).\n *\n * ⛔ PROPS ARE THE GENERATED TYPE, MINUS THE TWO FIELDS THIS RESOURCE OWNS ITSELF: `id` (a\n *   deterministic physical name — pass-through-endpoint.ts) and `is_from_config` (response-only;\n *   the vendor sets it, a declaration never does). Deriving `Props` with `Omit<>` rather than\n *   hand-typing it means a vendor schema change that adds, removes or narrows a field is felt here\n *   as a compiler error, not silently ignored.\n */\nimport { deepEqual } from 'alchemy/Diff';\nimport type * as Generated from './generated/pass-through.ts';\n\nexport type PassThroughEndpointProps = Omit<\n  Generated.PassThroughGenericEndpoint,\n  'id' | 'is_from_config'\n>;\n\n/** What `read` returns: the props plus the two vendor-owned fields, `id` now guaranteed present. */\nexport type PassThroughEndpointAttributes = Omit<Generated.PassThroughGenericEndpoint, 'id'> & {\n  readonly id: string;\n};\n\n/** ⚠️ NetBox `settled()`'s pattern: only fields the SCHEMA gives a vendor default for, copied from it (not assumed). */\nexport const settled = (props: PassThroughEndpointProps) => ({\n  auth: props.auth ?? true,\n  cost_per_request: props.cost_per_request ?? 0,\n  default_query_params: props.default_query_params ?? {},\n  headers: props.headers ?? {},\n  include_subpath: props.include_subpath ?? false,\n});\n\n/** The three fields whose absence the vendor's `exclude_none` update can never write (see client.ts). */\nexport const NULLABLE_FIELDS = ['timeout', 'methods', 'guardrails'] as const;\n\nconst isUnset = (value: unknown): boolean => value === undefined || value === null;\n\n/**\n * ⚠️ BUILT AS A WIDER RECORD AND PRUNED, NOT AS THE GENERATED TYPE DIRECTLY.\n *   `exactOptionalPropertyTypes` is on (packages/config/tsconfig.base.json), so writing\n *   `timeout: undefined` into a `{ timeout?: number | null }` is a type error rather than an\n *   absent key — the same reason `codegen/openapi.ts`'s `prune` exists, and the same fix.\n */\nconst prune = (value: Record<string, unknown>): Record<string, unknown> =>\n  Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined));\n\n/**\n * Full body for CREATE. `id` is the deterministic physical name (pass-through-endpoint.ts), sent\n * so a failed create is recoverable by `read` rather than orphaning a second row on retry.\n */\nexport const createBody = (\n  props: PassThroughEndpointProps,\n  id: string,\n): Generated.PassThroughGenericEndpoint =>\n  prune({\n    ...settled(props),\n    guardrails: isUnset(props.guardrails) ? undefined : props.guardrails,\n    id,\n    methods: isUnset(props.methods) ? undefined : props.methods,\n    path: props.path,\n    target: props.target,\n    timeout: isUnset(props.timeout) ? undefined : props.timeout,\n  }) as unknown as Generated.PassThroughGenericEndpoint;\n\n/**\n * Partial body for UPDATE (`POST /{id}`). ⛔ ONLY FIELDS THIS DECLARATION ACTUALLY SETS — the\n * vendor merges the parsed body with `model_dump(exclude_none=True)` (measured at v1.100.0), so an\n * `undefined` OR an explicit `null` here would be dropped by the server anyway; sending neither is\n * the same outcome with no request made when nothing changed (`Object.keys(body).length === 0`\n * checked by the caller in pass-through-endpoint.ts).\n */\nexport const updateBody = (\n  props: PassThroughEndpointProps,\n): Partial<Generated.PassThroughGenericEndpoint> =>\n  prune({\n    ...settled(props),\n    guardrails: isUnset(props.guardrails) ? undefined : props.guardrails,\n    methods: isUnset(props.methods) ? undefined : props.methods,\n    path: props.path,\n    target: props.target,\n    timeout: isUnset(props.timeout) ? undefined : props.timeout,\n  }) as Partial<Generated.PassThroughGenericEndpoint>;\n\n/**\n * Whether ANY of the three nullable fields went from set (in `live`) to unset (in `props`) — the\n * one case `updateBody` cannot express, because the vendor's `exclude_none` merge silently keeps\n * the old value instead of clearing it. Detected here so `pass-through-endpoint.ts` can plan a\n * `replace` (delete-then-create) instead of an update that would look like it worked.\n */\nexport const needsReplace = (\n  live: PassThroughEndpointAttributes,\n  props: PassThroughEndpointProps,\n): boolean => NULLABLE_FIELDS.some((field) => !isUnset(live[field]) && isUnset(props[field]));\n\n/** Whether the live object already says what the declaration says — the `diff` \"noop\" test. */\nexport const matches = (\n  live: PassThroughEndpointAttributes,\n  props: PassThroughEndpointProps,\n): boolean => {\n  const fixed = settled(props);\n  return (\n    live.target === props.target &&\n    live.auth === fixed.auth &&\n    live.cost_per_request === fixed.cost_per_request &&\n    live.include_subpath === fixed.include_subpath &&\n    deepEqual(live.headers, fixed.headers) &&\n    deepEqual(live.default_query_params, fixed.default_query_params) &&\n    (isUnset(props.timeout) ? isUnset(live.timeout) : live.timeout === props.timeout) &&\n    (isUnset(props.methods) ? isUnset(live.methods) : deepEqual(live.methods, props.methods)) &&\n    (isUnset(props.guardrails)\n      ? isUnset(live.guardrails)\n      : deepEqual(live.guardrails, props.guardrails))\n  );\n};\n\n/**\n * A literal secret in a forwarded header (S25, house rule — not a vendor one; see\n * pass-through-endpoint.ts). Case-insensitive on the header name; the reference form is LiteLLM's\n * own, `os.environ/NAME` (`set_env_variables_in_header`, pass_through_endpoints.py:117-160 at the\n * tag) — a missing variable on the proxy host leaves that literal string in the header, which\n * nothing in the API can detect, so this is enforced here rather than trusted to the vendor.\n */\nconst SECRET_HEADER_NAMES = new Set(['authorization', 'x-api-key', 'cf-aig-authorization']);\n\nexport const literalSecretHeaders = (\n  headers: Readonly<Record<string, unknown>> | undefined,\n): readonly string[] =>\n  Object.entries(headers ?? {})\n    .filter(\n      ([name, value]) =>\n        SECRET_HEADER_NAMES.has(name.toLowerCase()) && !String(value).includes('os.environ/'),\n    )\n    .map(([name]) => name);\n",
+    "/**\n * The LiteLLM provider, with its credential source, as one layer for a stack.\n *\n *     Layer.mergeAll(litellmProviders(), …the stack's other providers)\n *\n * ★ THE DEFAULT READS `LITELLM_PROXY_URL`/`LITELLM_PROXY_API_KEY` AT CALL TIME (credentials.ts),\n *   never at layer build — pass another `Layer.Layer<LitellmCredentials>` (see\n *   `litellmCredentialsLayerFor` in a test) to source them another way.\n * ⚠️ `HttpClient` is NOT provided here. It is ambient in every Alchemy runtime the same way it is\n *   for `netboxProviders`-style families in this kit; a stack that already deploys anything over\n *   HTTP already has one.\n */\nimport * as Layer from 'effect/Layer';\nimport { type LitellmCredentials, litellmCredentialsLayer } from './credentials.ts';\nimport { LiteLLMPassThroughEndpointProvider } from './pass-through-endpoint.ts';\n\nexport const litellmProviders = (\n  creds: Layer.Layer<LitellmCredentials> = litellmCredentialsLayer,\n) => LiteLLMPassThroughEndpointProvider().pipe(Layer.provide(creds));\n"
+  ],
+  "mappings": ";AAkBA;AACA;AACA;AACA;AAEO,IAAM,wBAAwB;AAC9B,IAAM,4BAA4B;AAAA;AASlC,MAAM,gCAAqC,iBAAY,yBAAyB,EAEpF;AAAC;AAEJ,IAAM,UAAU,CAAC,SACf,IAAI,wBAAwB;AAAA,EAC1B,SACE,GAAG,kFACH;AACJ,CAAC;AAGI,IAAM,eAA4E,WACvF,UAAU,GAAG;AAAA,EACX,MAAM,SAAS,QAAQ,IAAI;AAAA,EAC3B,IAAI,WAAW,aAAa,OAAO,KAAK,MAAM;AAAA,IAC5C,OAAO,OAAc,YAAK,QAAQ,qBAAqB,CAAC;AAAA,EAC1D,MAAM,SAAS,QAAQ,IAAI;AAAA,EAC3B,IAAI,WAAW,aAAa,OAAO,KAAK,MAAM,IAAI;AAAA,IAChD,OAAO,OAAc,YAAK,QAAQ,yBAAyB,CAAC;AAAA,EAC9D;AAAA,EACA,OAAO,EAAE,SAAS,OAAO,KAAK,EAAE,QAAQ,OAAO,EAAE,GAAG,QAAQ,OAAO,KAAK,EAAE;AAAA,CAE9E;AAAA;AAGO,MAAM,2BAAmC,gBAG9C,EAAE,+BAA+B,EAAE;AAAC;AAG/B,IAAM,0BAAiE,cAC5E,oBACA,YACF;AAGO,IAAM,6BAA6B,CAAC,UACnC,cAAQ,oBAA2B,eAAQ,KAAK,CAAC;;AC7CzD;AACA;AACA;AACA;AACA;AAgBO,IAAM,qBAAqB;AAAA,EAChC,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AACV;AAAA;AAEO,MAAM,iCAAsC,kBAAY,0BAA0B,EAItF;AAAC;AAAA;AACG,MAAM,+BAAoC,kBAAY,wBAAwB,EAIlF;AAAC;AAAA;AACG,MAAM,yBAA8B,kBAAY,kBAAkB,EAKtE;AAAC;AAAA;AACG,MAAM,8BAAmC,kBAAY,uBAAuB,EAIhF;AAAC;AASJ,IAAM,aAAa,IAAI;AAGvB,IAAM,eAAe,CAAC,YACb,aAAK,MAAM;AAAA,EAChB,MAAM,WAAW,WAAW,IAAI,OAAO;AAAA,EACvC,IAAI,aAAa;AAAA,IAAW,OAAO;AAAA,EACnC,MAAM,UAAoB,qBAAW,CAAC;AAAA,EACtC,WAAW,IAAI,SAAS,OAAO;AAAA,EAC/B,OAAO;AAAA,CACR;AAEH,IAAM,OAAO,CAAI,QAAmC,MAAc,SACzD,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,OAAO;AAAA,EAC5B,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,MAAM,GAAG,MAAM,UAAU;AAAA,EAC/B,MAAM,UAA4B,uBAAK,MAAM,EAAE,GAAG,EAAE,KAChC,6BAAW;AAAA,IAC3B,QAAQ;AAAA,IACR,eAAe,UAAU,MAAM;AAAA,EACjC,CAAC,GACD,SAAS,YACL,CAAC,SAAS,OACQ,2BAAS,KAAK,UAAU,IAAI,GAAG,kBAAkB,CACzE;AAAA,EACA,MAAM,WAAW,OAAO,OACrB,QAAQ,OAAO,EACf,KACQ,iBACL,CAAC,UAAU,IAAI,sBAAsB,EAAE,OAAO,OAAO,KAAK,GAAG,QAAQ,KAAK,CAAC,CAC7E,CACF;AAAA,EACF,MAAM,OAAO,OAAO,SAAS,KAAK,KACzB,iBAAS,CAAC,UAAU,IAAI,sBAAsB,EAAE,OAAO,OAAO,KAAK,GAAG,QAAQ,KAAK,CAAC,CAAC,CAC9F;AAAA,EACA,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;AAAA,IACtD,OAAO,OAAc,aACnB,IAAI,yBAAyB,EAAE,QAAQ,MAAM,QAAQ,SAAS,OAAO,CAAC,CACxE;AAAA,EACF;AAAA,EACA,IAAI,SAAS,WAAW,KAAK;AAAA,IAC3B,OAAO,OAAc,aACnB,IAAI,uBAAuB,EAAE,QAAQ,KAAK,MAAM,GAAG,GAAG,GAAG,QAAQ,KAAK,CAAC,CACzE;AAAA,EACF;AAAA,EACA,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IACnD,OAAO,OAAc,aACnB,IAAI,iBAAiB,EAAE,QAAQ,KAAK,MAAM,GAAG,GAAG,GAAG,QAAQ,MAAM,QAAQ,SAAS,OAAO,CAAC,CAC5F;AAAA,EACF;AAAA,EACA,OAAQ,SAAS,KAAK,YAAY,KAAK,MAAM,IAAI;AAAA,CAClD;AAGI,IAAM,2BAA2B,MAKtC,KAAkC,OAAO,+BAA+B,EAAE,KACjE,YAAI,CAAC,SAAS,KAAK,SAAS,CACrC;AAEF,IAAM,SAAS,CAAI,OACV,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,OAAO;AAAA,EAC5B,MAAM,YAAY,OAAO,aAAa,MAAM,OAAO;AAAA,EACnD,OAAO,OAAO,UAAU,YAAY,CAAC,EAAE,EAAE;AAAA,CAC1C;AAGI,IAAM,4BAA4B,CACvC,SAEA,OAAO,KAAK,QAAQ,iCAAiC,IAAI,CAAC;AAGrD,IAAM,4BAA4B,CACvC,YACA,SAEA,OAAO,KAAK,QAAQ,iCAAiC,mBAAmB,UAAU,KAAK,IAAI,CAAC;AAavF,IAAM,4BAA4B,CACvC,eAEA,OACE,KACE,UACA,6CAA6C,mBAAmB,UAAU,GAC5E,EAAE,KACO,iBAAS,0BAA0B,CAAC,aAClC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,yBAAyB;AAAA,EAC7C,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,UAAU;AAAA,IAAG,OAAO,OAAc,aAAK,QAAQ;AAAA,CAClF,CACH,GACO,cACT,CACF;;AC5KF;AACA;AACA;AAEA;AACA;AAGA;AACA;AACA;;;ACnBA;AAcO,IAAM,UAAU,CAAC,WAAqC;AAAA,EAC3D,MAAM,MAAM,QAAQ;AAAA,EACpB,kBAAkB,MAAM,oBAAoB;AAAA,EAC5C,sBAAsB,MAAM,wBAAwB,CAAC;AAAA,EACrD,SAAS,MAAM,WAAW,CAAC;AAAA,EAC3B,iBAAiB,MAAM,mBAAmB;AAC5C;AAGO,IAAM,kBAAkB,CAAC,WAAW,WAAW,YAAY;AAElE,IAAM,UAAU,CAAC,UAA4B,UAAU,aAAa,UAAU;AAQ9E,IAAM,QAAQ,CAAC,UACb,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,IAAI,OAAO,MAAM,SAAS,CAAC;AAMtE,IAAM,aAAa,CACxB,OACA,OAEA,MAAM;AAAA,KACD,QAAQ,KAAK;AAAA,EAChB,YAAY,QAAQ,MAAM,UAAU,IAAI,YAAY,MAAM;AAAA,EAC1D;AAAA,EACA,SAAS,QAAQ,MAAM,OAAO,IAAI,YAAY,MAAM;AAAA,EACpD,MAAM,MAAM;AAAA,EACZ,QAAQ,MAAM;AAAA,EACd,SAAS,QAAQ,MAAM,OAAO,IAAI,YAAY,MAAM;AACtD,CAAC;AASI,IAAM,aAAa,CACxB,UAEA,MAAM;AAAA,KACD,QAAQ,KAAK;AAAA,EAChB,YAAY,QAAQ,MAAM,UAAU,IAAI,YAAY,MAAM;AAAA,EAC1D,SAAS,QAAQ,MAAM,OAAO,IAAI,YAAY,MAAM;AAAA,EACpD,MAAM,MAAM;AAAA,EACZ,QAAQ,MAAM;AAAA,EACd,SAAS,QAAQ,MAAM,OAAO,IAAI,YAAY,MAAM;AACtD,CAAC;AAQI,IAAM,eAAe,CAC1B,MACA,UACY,gBAAgB,KAAK,CAAC,UAAU,CAAC,QAAQ,KAAK,MAAM,KAAK,QAAQ,MAAM,MAAM,CAAC;AAGrF,IAAM,UAAU,CACrB,MACA,UACY;AAAA,EACZ,MAAM,QAAQ,QAAQ,KAAK;AAAA,EAC3B,OACE,KAAK,WAAW,MAAM,UACtB,KAAK,SAAS,MAAM,QACpB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,oBAAoB,MAAM,mBAC/B,UAAU,KAAK,SAAS,MAAM,OAAO,KACrC,UAAU,KAAK,sBAAsB,MAAM,oBAAoB,MAC9D,QAAQ,MAAM,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,KAAK,YAAY,MAAM,aACxE,QAAQ,MAAM,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,UAAU,KAAK,SAAS,MAAM,OAAO,OACtF,QAAQ,MAAM,UAAU,IACrB,QAAQ,KAAK,UAAU,IACvB,UAAU,KAAK,YAAY,MAAM,UAAU;AAAA;AAWnD,IAAM,sBAAsB,IAAI,IAAI,CAAC,iBAAiB,aAAa,sBAAsB,CAAC;AAEnF,IAAM,uBAAuB,CAClC,YAEA,OAAO,QAAQ,WAAW,CAAC,CAAC,EACzB,OACC,EAAE,MAAM,WACN,oBAAoB,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,SAAS,aAAa,CACxF,EACC,IAAI,EAAE,UAAU,IAAI;;;ADjFlB,MAAM,uCAA4C,kBACvD,gCACF,EAEG;AAAC;AAAA;AACG,MAAM,qCAA0C,kBAAY,8BAA8B,EAE9F;AAAC;AAAA;AACG,MAAM,wCAA6C,kBACxD,iCACF,EAEG;AAAC;AAgBG,IAAM,6BAA6B,SACxC,6BACF;AAEO,IAAM,+BAA+B,CAAC,UACjC,sBAAY,OAAO,MAAM,KAAK,MAAM,SAAS;AAEzD,IAAM,eAAe,CACnB,KACA,gBACmC;AAAA,KAChC;AAAA,EACH,IAAI,IAAI,MAAM;AAChB;AAEA,IAAM,eAAe,CAAC,WAAmB,eACvC,mBAAmB,EAAE,IAAI,WAAW,YAAY,WAAW,MAAM,WAAW,GAAG,CAAC;AAOlF,IAAM,SAAS,CACb,MACA,UACA,SAIG;AAAA,EACH,MAAM,OAAO,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,QAAQ;AAAA,EACnD,MAAM,WAAW,SAAS,YAAY,KAAK,KAAK,CAAC,QAAQ,IAAI,SAAS,IAAI,IAAI;AAAA,EAC9E,OAAO,EAAE,UAAU,KAAK;AAAA;AAI1B,IAAM,kBAAkB,CAAC,UAAsC,SAC7D,SAAS,mBAAmB,OACxB,IAAI,+BAA+B,EAAE,KAAK,CAAC,IAC3C,IAAI,6BAA6B,EAAE,KAAK,CAAC;AAG/C,IAAM,eAAe,CAAC,UAAsC,SAC1D,SAAS,mBAAmB,QAAQ,SAAS,OAAO,aAAa,SAAS,OAAO,OACtE,gBAAQ,QAAQ,aAAa,UAAU,SAAS,EAAE,CAAC,CAAC,IACpD,aAAK,gBAAgB,UAAU,IAAI,CAAC;AAEjD,IAAM,uBAAuB,CAAC,YAA2D;AAAA,EACvF,MAAM,MAAM,qBAAqB,OAAO;AAAA,EACxC,OAAO,IAAI,WAAW,IACX,eACA,aAAK,IAAI,gCAAgC,EAAE,SAAS,IAAI,CAAC,CAAC;AAAA;AAIhE,IAAM,sBAAsB;AAAA,EACjC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAOO,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,WAAW,QAAQ,OAAO,OAAO,aAAa,IAAI,UAAU;AAAA,IAClE,MAAM,OAAO,OAAO,yBAAyB;AAAA,IAC7C,QAAQ,UAAU,SAAS,OAAO,MAAM,UAAU,KAAK,IAAI;AAAA,IAC3D,IAAI,SAAS;AAAA,MAAW,OAAO,aAAa,MAAM,QAAQ;AAAA,IAC1D,IAAI,aAAa;AAAA,MAAW;AAAA,IAC5B,OAAO,OAAO,aAAa,UAAU,KAAK,IAAI;AAAA,GAC/C;AAAA,EAEH,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAKO,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,WAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,qBAAqB,KAAK,OAAO;AAAA,IACxC,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,IAAI,aAAa,QAAQ,IAAI;AAAA,MAAG,OAAO,EAAE,QAAQ,WAAW,aAAa,KAAK;AAAA,IAC9E,OAAO,QAAQ,QAAQ,IAAI,IACtB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAEH,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAOO,YAAI,UAAU,GAAG;AAAA,IACtB,OAAO,qBAAqB,KAAK,OAAO;AAAA,IACxC,MAAM,WAAW,QAAQ,OAAO,OAAO,aAAa,IAAI,UAAU;AAAA,IAClE,MAAM,OAAO,OAAO,yBAAyB;AAAA,IAC7C,QAAQ,UAAU,SAAS,OAAO,MAAM,UAAU,KAAK,IAAI;AAAA,IAE3D,IAAI,SAAS,WAAW;AAAA,MAKtB,IAAI,aAAa;AAAA,QAAW,OAAO,OAAc,aAAK,gBAAgB,UAAU,KAAK,IAAI,CAAC;AAAA,MAC1F,OAAO,0BAA0B,WAAW,MAAM,QAAQ,CAAC;AAAA,IAC7D,EAAO,SAAI,KAAK,mBAAmB,MAAM;AAAA,MAIvC,OAAO,OAAc,aAAK,IAAI,+BAA+B,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC;AAAA,IACnF,EAAO,SAAI,aAAa,aAAa,MAAM,QAAQ,GAAG,IAAI,GAAG;AAAA,MAC3D,OAAO,0BAA0B,QAAQ;AAAA,MACzC,OAAO,0BAA0B,WAAW,MAAM,QAAQ,CAAC;AAAA,IAC7D,EAAO,SAAI,CAAC,QAAQ,aAAa,MAAM,QAAQ,GAAG,IAAI,GAAG;AAAA,MACvD,MAAM,OAAO,WAAW,IAAI;AAAA,MAC5B,IAAI,OAAO,KAAK,IAAI,EAAE,SAAS;AAAA,QAAG,OAAO,0BAA0B,UAAU,IAAI;AAAA,IACnF;AAAA,IAEA,MAAM,SAAS,OAAO,yBAAyB,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,QAAQ;AAAA,IACnF,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,YACnB,IAAI,MACF,+BAA+B,KAAK,8CAClC,GAAG,iFACH,mDACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO,aAAa,OAAO,QAAQ;AAAA,GACpC;AAAA,EAEH,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAOO,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,WAAW,OAAO,OAAO,OAAO,aAAa,IAAI,UAAU;AAAA,IACjE,MAAM,OAAO,OAAO,yBAAyB;AAAA,IAC7C,MAAM,OAAO,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,QAAQ;AAAA,IAGnD,IAAI,SAAS,aAAa,KAAK,mBAAmB,QAAQ,KAAK,SAAS,KAAK;AAAA,MAAM;AAAA,IACnF,OAAO,0BAA0B,QAAQ;AAAA,GAC1C;AAAA,EAEH,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAC/B;AAEO,IAAM,qCAAqC,MACvC,gBACP,4BACO,gBAAQ,2BAA2B,SAAS,GAAG,mBAAmB,CAAC,CAC5E;;AErPF;AAIO,IAAM,mBAAmB,CAC9B,QAAyC,4BACtC,mCAAmC,EAAE,KAAW,eAAQ,KAAK,CAAC;",
+  "debugId": "9216FE33E5E3721264756E2164756E21",
+  "names": []
+}

package/dist/litellm/pass-through-endpoint.d.ts

@@ -0,0 +1,94 @@
+/**
+ * `LiteLLM.PassThroughEndpoint` — one row in LiteLLM's `general_settings.pass_through_endpoints`.
+ *
+ * ★ ADOPT-FRIENDLY BY id, NOT BY PATH. `output?.id` is used as the object's live id once the
+ *   engine has one — from our own prior create (the deterministic physical name) or from an
+ *   adopted foreign row — and `read` computes a FRESH physical name only for a resource the
+ *   engine has never resolved before. This is S7/S9's "output is a cache of stable identifiers,
+ *   not proof the object exists" and S13's "an adopted object keeps its live name as an explicit
+ *   prop", applied to an id LiteLLM lets a client choose (`_types.py:2192` at v1.100.0: create
+ *   takes a caller-supplied `id`, else `uuid4()`).
+ *
+ * ⛔ A PATH HELD BY AN `is_from_config` ROW IS REFUSED, NOT ADOPTED. A DB row on the same path
+ *   overrides it at runtime (`pass_through_endpoints.py` merges DB after config, at the tag) — so
+ *   creating one would silently take over a route the operator declared in `config.yaml`, the
+ *   exact "DB row silently overrides the file" the task names. `is_from_config` rows are also
+ *   never updated or deleted by this provider, for the same reason.
+ * ⛔ A DB ROW WITH NO `id` (path-only, `_types.py`'s "backwards compatibility" case) CANNOT BE
+ *   ADDRESSED by the id-keyed update/delete calls this provider uses, so it is refused rather than
+ *   silently adopted into an id-based lifecycle it cannot actually manage — see docs/litellm.md.
+ * ⛔ NO CREDENTIAL IS A PROP (S25). `LITELLM_PROXY_URL`/`LITELLM_PROXY_API_KEY` are read at call
+ *   time by credentials.ts.
+ */
+import { Resource } from 'alchemy';
+import type { Input } from 'alchemy/Input';
+import * as Provider from 'alchemy/Provider';
+import type { Stack } from 'alchemy/Stack';
+import type { Stage } from 'alchemy/Stage';
+import * as Effect from 'effect/Effect';
+import { type LitellmError, type LitellmRequirements } from './client.ts';
+import { type PassThroughEndpointAttributes, type PassThroughEndpointProps } from './pass-through-form.ts';
+export type { PassThroughEndpointAttributes, PassThroughEndpointProps };
+declare const LitellmConfigPathConflictError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmConfigPathConflictError";
+} & Readonly<A>;
+export declare class LitellmConfigPathConflictError extends LitellmConfigPathConflictError_base<{
+    readonly path: string;
+}> {
+}
+declare const LitellmUnaddressableRowError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmUnaddressableRowError";
+} & Readonly<A>;
+export declare class LitellmUnaddressableRowError extends LitellmUnaddressableRowError_base<{
+    readonly path: string;
+}> {
+}
+declare const LitellmLiteralSecretHeaderError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmLiteralSecretHeaderError";
+} & Readonly<A>;
+export declare class LitellmLiteralSecretHeaderError extends LitellmLiteralSecretHeaderError_base<{
+    readonly headers: readonly string[];
+}> {
+}
+export type PassThroughEndpointError = LitellmError | LitellmConfigPathConflictError | LitellmUnaddressableRowError | LitellmLiteralSecretHeaderError;
+export interface LiteLLMPassThroughEndpoint extends Resource<'LiteLLM.PassThroughEndpoint', PassThroughEndpointProps, PassThroughEndpointAttributes, never, LitellmRequirements | Stack | Stage> {
+}
+export declare const LiteLLMPassThroughEndpoint: import("alchemy").ResourceClass<LiteLLMPassThroughEndpoint>;
+export declare const isLiteLLMPassThroughEndpoint: (value: unknown) => value is LiteLLMPassThroughEndpoint;
+/** ⛔ TEST-ONLY EXPORT. Not on index.ts's barrel — a lifecycle test calls these directly against the fake. */
+export declare const passThroughHandlers: {
+    read: ({ id, instanceId, olds, output, }: {
+        id: string;
+        instanceId: string;
+        olds: PassThroughEndpointProps;
+        output: PassThroughEndpointAttributes | undefined;
+    }) => Effect.Effect<PassThroughEndpointAttributes | undefined, LitellmConfigPathConflictError | LitellmUnaddressableRowError | LitellmError, import("alchemy").InstanceId | Stack | Stage | LitellmRequirements>;
+    diff: ({ news, output, }: {
+        news: Input<PassThroughEndpointProps>;
+        output: PassThroughEndpointAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'replace';
+        readonly deleteFirst: true;
+    } | {
+        readonly deleteFirst?: never;
+        readonly action: 'noop';
+    } | {
+        readonly deleteFirst?: never;
+        readonly action: 'update';
+    } | undefined, LitellmLiteralSecretHeaderError, never>;
+    reconcile: ({ id, instanceId, news, output, }: {
+        id: string;
+        instanceId: string;
+        news: PassThroughEndpointProps;
+        output: PassThroughEndpointAttributes | undefined;
+    }) => Effect.Effect<PassThroughEndpointAttributes, LitellmConfigPathConflictError | LitellmLiteralSecretHeaderError | LitellmUnaddressableRowError | LitellmError, import("alchemy").InstanceId | Stack | Stage | LitellmRequirements>;
+    delete: ({ id, instanceId, olds, output, }: {
+        id: string;
+        instanceId: string;
+        olds: PassThroughEndpointProps;
+        output: PassThroughEndpointAttributes;
+    }) => Effect.Effect<void, LitellmError, import("alchemy").InstanceId | Stack | Stage | LitellmRequirements>;
+    list: () => Effect.Effect<never[], never, never>;
+};
+export declare const LiteLLMPassThroughEndpointProvider: () => import("effect/Layer").Layer<Provider.Provider<LiteLLMPassThroughEndpoint>, never, Stack | Stage | LitellmRequirements>;
+//# sourceMappingURL=pass-through-endpoint.d.ts.map

package/dist/litellm/pass-through-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pass-through-endpoint.d.ts","sourceRoot":"","sources":["../../src/litellm/pass-through-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,mBAAmB,EAKzB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAM9B,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,CAAC;;;;AAExE,qBAAa,8BAA+B,SAAQ,oCAElD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;CAAG;;;;AACL,qBAAa,4BAA6B,SAAQ,kCAAiD;IACjG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;CAAG;;;;AACL,qBAAa,+BAAgC,SAAQ,qCAEnD;IACA,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;CAAG;AAEL,MAAM,MAAM,wBAAwB,GAChC,YAAY,GACZ,8BAA8B,GAC9B,4BAA4B,GAC5B,+BAA+B,CAAC;AAEpC,MAAM,WAAW,0BAA2B,SAAQ,QAAQ,CAC1D,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,mBAAmB,GAAG,KAAK,GAAG,KAAK,CACpC;CAAG;AAEJ,eAAO,MAAM,0BAA0B,6DAEtC,CAAC;AAEF,eAAO,MAAM,4BAA4B,UAAW,OAAO,KAAG,KAAK,IAAI,0BACe,CAAC;AAkDvF,6GAA6G;AAC7G,eAAO,MAAM,mBAAmB;IAC9B,IAAI,sCAKD;QACD,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,wBAAwB,CAAC;QAC/B,MAAM,EAAE,6BAA6B,GAAG,SAAS,CAAC;KACnD;IAUD,IAAI,sBAGD;QACD,IAAI,EAAE,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACtC,MAAM,EAAE,6BAA6B,GAAG,SAAS,CAAC;KACnD;yBAQoD,SAAS;;;;yBAE3C,MAAM;;;yBACN,QAAQ;;IAG3B,SAAS,sCAKN;QACD,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,wBAAwB,CAAC;QAC/B,MAAM,EAAE,6BAA6B,GAAG,SAAS,CAAC;KACnD;IAwCD,MAAM,sCAKH;QACD,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,wBAAwB,CAAC;QAC/B,MAAM,EAAE,6BAA6B,CAAC;KACvC;IAWD,IAAI;CACL,CAAC;AAEF,eAAO,MAAM,kCAAkC,+HAI5C,CAAC"}

package/dist/litellm/pass-through-form.d.ts

@@ -0,0 +1,40 @@
+import type * as Generated from './generated/pass-through.ts';
+export type PassThroughEndpointProps = Omit<Generated.PassThroughGenericEndpoint, 'id' | 'is_from_config'>;
+/** What `read` returns: the props plus the two vendor-owned fields, `id` now guaranteed present. */
+export type PassThroughEndpointAttributes = Omit<Generated.PassThroughGenericEndpoint, 'id'> & {
+    readonly id: string;
+};
+/** ⚠️ NetBox `settled()`'s pattern: only fields the SCHEMA gives a vendor default for, copied from it (not assumed). */
+export declare const settled: (props: PassThroughEndpointProps) => {
+    auth: boolean;
+    cost_per_request: number;
+    default_query_params: Record<string, unknown>;
+    headers: Record<string, unknown>;
+    include_subpath: boolean;
+};
+/** The three fields whose absence the vendor's `exclude_none` update can never write (see client.ts). */
+export declare const NULLABLE_FIELDS: readonly ['timeout', 'methods', 'guardrails'];
+/**
+ * Full body for CREATE. `id` is the deterministic physical name (pass-through-endpoint.ts), sent
+ * so a failed create is recoverable by `read` rather than orphaning a second row on retry.
+ */
+export declare const createBody: (props: PassThroughEndpointProps, id: string) => Generated.PassThroughGenericEndpoint;
+/**
+ * Partial body for UPDATE (`POST /{id}`). ⛔ ONLY FIELDS THIS DECLARATION ACTUALLY SETS — the
+ * vendor merges the parsed body with `model_dump(exclude_none=True)` (measured at v1.100.0), so an
+ * `undefined` OR an explicit `null` here would be dropped by the server anyway; sending neither is
+ * the same outcome with no request made when nothing changed (`Object.keys(body).length === 0`
+ * checked by the caller in pass-through-endpoint.ts).
+ */
+export declare const updateBody: (props: PassThroughEndpointProps) => Partial<Generated.PassThroughGenericEndpoint>;
+/**
+ * Whether ANY of the three nullable fields went from set (in `live`) to unset (in `props`) — the
+ * one case `updateBody` cannot express, because the vendor's `exclude_none` merge silently keeps
+ * the old value instead of clearing it. Detected here so `pass-through-endpoint.ts` can plan a
+ * `replace` (delete-then-create) instead of an update that would look like it worked.
+ */
+export declare const needsReplace: (live: PassThroughEndpointAttributes, props: PassThroughEndpointProps) => boolean;
+/** Whether the live object already says what the declaration says — the `diff` "noop" test. */
+export declare const matches: (live: PassThroughEndpointAttributes, props: PassThroughEndpointProps) => boolean;
+export declare const literalSecretHeaders: (headers: Readonly<Record<string, unknown>> | undefined) => readonly string[];
+//# sourceMappingURL=pass-through-form.d.ts.map

package/dist/litellm/pass-through-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pass-through-form.d.ts","sourceRoot":"","sources":["../../src/litellm/pass-through-form.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,KAAK,SAAS,MAAM,6BAA6B,CAAC;AAE9D,MAAM,MAAM,wBAAwB,GAAG,IAAI,CACzC,SAAS,CAAC,0BAA0B,EACpC,IAAI,GAAG,gBAAgB,CACxB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAAC,SAAS,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG;IAC7F,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wHAAwH;AACxH,eAAO,MAAM,OAAO,UAAW,wBAAwB;IACrD,IAAI;IACJ,gBAAgB;IAChB,oBAAoB;IACpB,OAAO;IACP,eAAe;CACf,CAAC;AAEH,yGAAyG;AACzG,eAAO,MAAM,eAAe,YAAI,SAAS,EAAE,SAAS,EAAE,YAAY,CAAU,CAAC;AAa7E;;;GAGG;AACH,eAAO,MAAM,UAAU,UACd,wBAAwB,MAC3B,MAAM,KACT,SAAS,CAAC,0BAS0C,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,UACd,wBAAwB,KAC9B,OAAO,CAAC,SAAS,CAAC,0BAA0B,CAQM,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SACjB,6BAA6B,SAC5B,wBAAwB,KAC9B,OAA0F,CAAC;AAE9F,+FAA+F;AAC/F,eAAO,MAAM,OAAO,SACZ,6BAA6B,SAC5B,wBAAwB,KAC9B,OAeF,CAAC;AAWF,eAAO,MAAM,oBAAoB,YACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,KACrD,SAAS,MAAM,EAMQ,CAAC"}

package/dist/litellm/providers.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The LiteLLM provider, with its credential source, as one layer for a stack.
+ *
+ *     Layer.mergeAll(litellmProviders(), …the stack's other providers)
+ *
+ * ★ THE DEFAULT READS `LITELLM_PROXY_URL`/`LITELLM_PROXY_API_KEY` AT CALL TIME (credentials.ts),
+ *   never at layer build — pass another `Layer.Layer<LitellmCredentials>` (see
+ *   `litellmCredentialsLayerFor` in a test) to source them another way.
+ * ⚠️ `HttpClient` is NOT provided here. It is ambient in every Alchemy runtime the same way it is
+ *   for `netboxProviders`-style families in this kit; a stack that already deploys anything over
+ *   HTTP already has one.
+ */
+import * as Layer from 'effect/Layer';
+import { type LitellmCredentials } from './credentials.ts';
+export declare const litellmProviders: (creds?: Layer.Layer<LitellmCredentials>) => Layer.Layer<import("alchemy").Provider<import("./pass-through-endpoint.ts").LiteLLMPassThroughEndpoint>, never, import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stack | import("alchemy").Stage>;
+//# sourceMappingURL=providers.d.ts.map

package/dist/litellm/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/litellm/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,KAAK,kBAAkB,EAA2B,MAAM,kBAAkB,CAAC;AAGpF,eAAO,MAAM,gBAAgB,WACpB,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,8NAC4B,CAAC"}

package/dist/paperless/client.d.ts

@@ -0,0 +1,37 @@
+/**
+ * One authenticated call to the Paperless-ngx REST API at `/api`.
+ *
+ * ⚠️ `Authorization: Token <value>`, NOT `Bearer`. Paperless-ngx's `securitySchemes.tokenAuth`
+ *   (the v3.1.1 served schema) states the "Token" prefix explicitly — the same DRF
+ *   `TokenAuthentication` NetBox uses (netbox/client.ts), a different vendor, same convention.
+ *
+ * ⛔ `Accept: application/json; version=10` ON EVERY CALL. Paperless-ngx versions its API with
+ *   DRF's `AcceptHeaderVersioning` (`REST_FRAMEWORK.DEFAULT_VERSION = '10'`, measured against the
+ *   v3.1.1 source). Omitting the header still answers — DRF falls back to `DEFAULT_VERSION` — but
+ *   pinning it here means an estate upgrade that moves the default cannot silently change what
+ *   this package receives without a version bump of its own noticing.
+ *
+ * ⚠️ A LIST IS WRAPPED, A DETAIL IS NOT: `{count, next, previous, results: […]}` vs. the bare
+ *   object — the same DRF pagination shape NetBox uses.
+ */
+import * as Effect from 'effect/Effect';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
+import { PaperlessCredentials, type PaperlessCredentialsError } from './credentials.ts';
+import { type PaperlessError } from './errors.ts';
+export interface PaperlessList<T> {
+    readonly count: number;
+    readonly next: string | null;
+    readonly previous: string | null;
+    readonly results: readonly T[];
+}
+export type PaperlessRow = Record<string, unknown>;
+/**
+ * ⚠️ `PaperlessCredentials` IS PART OF THIS, NOT JUST `HttpClient`. `paperless()` reads the lazy
+ *   credentials service (`yield* yield* PaperlessCredentials`), so a stack that wires the
+ *   providers without also providing a credentials layer should fail to TYPECHECK, not fail at
+ *   the first call. `providers.ts` supplies `environmentLayer` by default for exactly this.
+ */
+export type PaperlessRequirements = HttpClient.HttpClient | PaperlessCredentials;
+/** One JSON call. Returns the parsed body, or `undefined` for an empty response (DELETE). */
+export declare const paperless: <T>(method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', path: string, body?: Record<string, unknown>) => Effect.Effect<T, PaperlessError | PaperlessCredentialsError, PaperlessRequirements>;
+//# sourceMappingURL=client.d.ts.map

package/dist/paperless/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/paperless/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,KAAK,cAAc,EAAuC,MAAM,aAAa,CAAC;AAKvF,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;CAChC;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,UAAU,CAAC,UAAU,GAAG,oBAAoB,CAAC;AAEjF,6FAA6F;AAC7F,eAAO,MAAM,SAAS,GAAI,CAAC,UACjB,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,QAC7C,MAAM,SACL,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,cAAc,GAAG,yBAAyB,EAAE,qBAAqB,CAwCjF,CAAC"}

package/dist/paperless/constraint-guard.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The generated tables, looked up by endpoint, and the refusal that stops a plan.
+ *
+ * ⛔ AN UNKNOWN KEY IS A DEFECT, NOT A REASON TO SKIP THE CHECK — the generator resolves every key
+ *   in its source scan against the vendor document, so a key absent here means the tables were
+ *   not regenerated, which the message says. Same posture as `../netbox/constraint-guard.ts`.
+ */
+import * as Effect from 'effect/Effect';
+import { type EndpointConstraints, type EndpointKey, type PaperlessBody } from './constraints.ts';
+import { PAPERLESS_CONSTRAINTS } from './generated/constraints/index.ts';
+export { PAPERLESS_CONSTRAINTS };
+export declare const constraintsFor: (key: EndpointKey) => EndpointConstraints;
+export declare const bodyViolations: (key: EndpointKey, body: PaperlessBody, presence: boolean) => readonly string[];
+/**
+ * ⛔ `Effect.die`, NOT `Effect.fail`. A declaration the vendor would reject is a DEFECT in the
+ *   stack file, not a recoverable condition.
+ */
+export declare const guardBody: (key: EndpointKey | undefined, body: PaperlessBody, presence: boolean) => Effect.Effect<void>;
+//# sourceMappingURL=constraint-guard.d.ts.map

package/dist/paperless/constraint-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraint-guard.d.ts","sourceRoot":"","sources":["../../src/paperless/constraint-guard.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,aAAa,EAGnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,eAAO,MAAM,cAAc,QAAS,WAAW,KAAG,mBASjD,CAAC;AAEF,eAAO,MAAM,cAAc,QACpB,WAAW,QACV,aAAa,YACT,OAAO,KAChB,SAAS,MAAM,EAAyD,CAAC;AAE5E;;;GAGG;AACH,eAAO,MAAM,SAAS,QACf,WAAW,GAAG,SAAS,QACtB,aAAa,YACT,OAAO,KAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAKjB,CAAC"}

package/dist/paperless/constraints.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Paperless-ngx's own rules, checked here, before the request is built.
+ *
+ * ★ THE SAME READER SHAPE AS `../netbox/constraints.ts`, AND FOR THE SAME REASON: both vendors
+ *   send a JSON body where a number stays a number and a boolean stays a boolean, so `String(v)`
+ *   at the door would be the exact mangling that incident (codegen/README.md) exists to prevent.
+ *   The table itself is generated by `bun codegen/paperless.ts` from the vendor's own OpenAPI
+ *   document — nothing here is hand-typed.
+ *
+ * ⚠️ WHAT THIS DELIBERATELY DOES NOT ENFORCE: a `format` name (a DRF validator run server-side); a
+ *   pattern the generator could not carry faithfully (codegen/py-pattern.ts), recorded verbatim as
+ *   `patternSource`; the `(name, owner)` uniqueness constraint (models.py) — that is `matching.ts`'s
+ *   job, not a per-field rule; and `CustomField.select_options`, which is not in the schema at all
+ *   (groundTruth: the serializer's own rule is unverified at 3.1.1 and this table cannot state a
+ *   rule the vendor document does not carry).
+ */
+export interface ParamConstraint {
+    readonly type?: string;
+    /** From the schema's `required` array. ⚠️ Checked on CREATE only. */
+    readonly required?: boolean;
+    readonly maxLength?: number;
+    readonly minLength?: number;
+    readonly minimum?: number;
+    readonly maximum?: number;
+    /** ⚠️ `(string | number)[]` — `matching_algorithm`'s enum is numeric (`DataTypeEnum`'s is not). */
+    readonly enum?: readonly (string | number)[];
+    readonly pattern?: string;
+    readonly patternSource?: string;
+    readonly format?: string;
+    readonly default?: string;
+}
+export type EndpointConstraints = Readonly<Record<string, ParamConstraint>>;
+/** `paperless:POST /api/tags/` — exactly how the generated tables key an endpoint. */
+export type EndpointKey = string;
+export type PaperlessBody = Record<string, unknown>;
+export interface ViolationOptions {
+    /** ⛔ CREATE ONLY. A PATCH is deliberately partial, so presence there refuses every ordinary edit. */
+    readonly presence?: boolean;
+}
+/**
+ * Every vendor rule this body breaks. Pure — no network, no clock, no environment.
+ *
+ * ⚠️ `null` IS A VALUE, NOT AN ABSENCE — Paperless uses explicit `null` to clear a nullable
+ *   foreign key (`owner`, `parent`), so it must not trip the presence check, and no string/number
+ *   rule applies to it.
+ */
+export declare const violations: (table: EndpointConstraints, body: PaperlessBody, options?: ViolationOptions) => readonly string[];
+/** The message a plan dies with. */
+export declare const refusal: (endpoint: EndpointKey, found: readonly string[]) => string;
+//# sourceMappingURL=constraints.d.ts.map

package/dist/paperless/constraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraints.d.ts","sourceRoot":"","sources":["../../src/paperless/constraints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,mGAAmG;IACnG,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;AAE5E,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,WAAW,gBAAgB;IAC/B,qGAAqG;IACrG,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAsCD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,UACd,mBAAmB,QACpB,aAAa,YACV,gBAAgB,KACxB,SAAS,MAAM,EAYjB,CAAC;AAEF,oCAAoC;AACpC,eAAO,MAAM,OAAO,aAAc,WAAW,SAAS,SAAS,MAAM,EAAE,KAAG,MAGM,CAAC"}

package/dist/paperless/credentials.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Where the Paperless URL and token come from — S24's shape (alchemy-provider-standard): a lazy
+ * `Context.Service` whose VALUE is itself an `Effect`, resolved inside each operation with
+ * `yield* yield* PaperlessCredentials`. Resolving twice, not once at layer build, is what keeps a
+ * token out of any state the engine might persist and lets a consumer swap the source (an env var
+ * today, an OpenBao mint tomorrow) without touching a resource file.
+ *
+ * ⛔ NO DEFAULT HOST, AND NO DEFAULT TOKEN. A published package that fell back to a loopback
+ *   address would let a consumer who forgot the variable watch every call fail against a machine
+ *   that is not theirs, instead of being told which variable is missing.
+ * ⛔ THE TOKEN IS NEVER A PROP, NEVER AN ATTRIBUTE. Alchemy persists attributes unencrypted
+ *   (S25); nothing this family returns from `read`/`reconcile` may carry it.
+ */
+import * as Context from 'effect/Context';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+declare const PaperlessCredentialsError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PaperlessCredentialsError";
+} & Readonly<A>;
+export declare class PaperlessCredentialsError extends PaperlessCredentialsError_base<{
+    readonly message: string;
+}> {
+}
+export interface PaperlessCredentialValue {
+    /** Trailing slash stripped, e.g. `https://paperless.example.com`. */
+    readonly url: string;
+    readonly token: string;
+}
+declare const PaperlessCredentials_base: Context.ServiceClass<PaperlessCredentials, "PaperlessCredentials", Effect.Effect<PaperlessCredentialValue, PaperlessCredentialsError, never>>;
+/**
+ * The lazy service. ⚠️ `Layer.succeed` registers the EFFECT, not its result — `readEnvironment`
+ *   runs once per `yield* yield*`, so a call after the variables are exported sees them even if
+ *   the layer itself was built before that (true in `fake-paperless.test.ts`, which sets the env
+ *   vars right before each call).
+ */
+export declare class PaperlessCredentials extends PaperlessCredentials_base {
+}
+export declare const environmentLayer: Layer.Layer<PaperlessCredentials>;
+export {};
+//# sourceMappingURL=credentials.d.ts.map

package/dist/paperless/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/paperless/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;;;AAEtC,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;;AA4BD;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,yBAGf;CAAG;AAE9B,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAG9D,CAAC"}

package/dist/paperless/custom-field.d.ts

@@ -0,0 +1,75 @@
+/**
+ * `Paperless.CustomField` — a Paperless-ngx custom field, create-or-update and never deleted.
+ *
+ * ⛔ `dataType` IS CREATE-ONLY, ENFORCED AT PLAN TIME, NEVER A PATCH AND NEVER A REPLACE. A
+ *   replace would delete this id and create a new one — and Paperless deletes the field's VALUE
+ *   on every document when its custom field is deleted. `matching.ts`'s `immutable` hook carries
+ *   this refusal generically; `dataType` is simply never listed in `fields`, so nothing in
+ *   `matching.ts` ever builds a PATCH body that includes it.
+ *
+ * ⛔ NO `owner` FIELD. Unlike `Tag`/`DocumentType`/`StoragePath`, `CustomField` does not extend
+ *   Paperless-ngx's `OwnedObjectSerializer` — its wire body is exactly `{name, data_type,
+ *   extra_data}` (measured against the v3.1.1 schema). `owned: false` stops `matching.ts`
+ *   sending a field the vendor's serializer does not declare.
+ *
+ * ⚠️ `CustomField.select_options` (the vendor's own rule for a `select` field's option list) is
+ *   not in the served schema at all, so it is recorded here and NOT enforced (groundTruth).
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import type { PaperlessCustomFieldRequest } from './generated/types/custom-fields.ts';
+import type { PaperlessRow } from './client.ts';
+import { type MatchingRequirements } from './matching.ts';
+export interface CustomFieldProps {
+    /** ⚠️ maxLength 128 (generated constraint table). The locate key — CustomField's name is globally unique (models.py:1169), with no owner to further scope it. */
+    name: string;
+    /**
+     * ⛔ CREATE-ONLY — see this file's header. `select`'s own option list
+     *   (`select_options`) is not in the vendor schema and is unenforced here.
+     */
+    dataType: PaperlessCustomFieldRequest['data_type'];
+    /** Arbitrary JSON the vendor attaches no schema to (e.g. a `select` field's option list). */
+    extraData?: unknown;
+}
+export interface CustomFieldAttributes {
+    id: number;
+    name: string;
+    dataType: string;
+    extraData: unknown;
+}
+export interface CustomField extends Resource<'Paperless.CustomField', CustomFieldProps, CustomFieldAttributes, never, MatchingRequirements> {
+}
+export declare const CustomField: import("alchemy").ResourceClass<CustomField>;
+/**
+ * ⛔ EXTRACTED SO IT CAN BE TESTED WITHOUT A SERVER (custom-field.test.ts) — the same reason
+ *   `../netbox/prefix-form.ts` pulls its body/matches functions out of `prefix.ts`.
+ */
+export declare const dataTypeImmutable: (live: PaperlessRow, props: CustomFieldProps) => string | undefined;
+/** ⚠️ Exported (not through index.ts) so custom-field.test.ts can drive the real lifecycle. */
+export declare const customFieldHandlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: CustomFieldProps;
+    }) => Effect.Effect<CustomFieldAttributes | undefined, import("./credentials.ts").PaperlessCredentialsError | import("./errors.ts").PaperlessUnauthorized | import("./errors.ts").PaperlessUnavailable | import("./errors.ts").PaperlessValidation, import("./client.ts").PaperlessRequirements>;
+    diff: ({ news, output }: {
+        news: import("alchemy").Input<CustomFieldProps>;
+        output: CustomFieldAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | {
+        readonly action: 'replace';
+    } | undefined, import("./credentials.ts").PaperlessCredentialsError | import("./errors.ts").PaperlessUnauthorized | import("./errors.ts").PaperlessUnavailable | import("./errors.ts").PaperlessValidation, import("./client.ts").PaperlessRequirements>;
+    reconcile: ({ news, output }: {
+        news: CustomFieldProps;
+        output?: CustomFieldAttributes | undefined;
+    }) => Effect.Effect<CustomFieldAttributes, import("./credentials.ts").PaperlessCredentialsError | import("./errors.ts").PaperlessError, import("./client.ts").PaperlessRequirements>;
+    delete: ({ olds, output }: {
+        olds: CustomFieldProps;
+        output?: CustomFieldAttributes | undefined;
+    }) => Effect.Effect<void, import("./credentials.ts").PaperlessCredentialsError | import("./errors.ts").PaperlessUnauthorized | import("./errors.ts").PaperlessUnavailable | import("./errors.ts").PaperlessValidation, import("./client.ts").PaperlessRequirements>;
+};
+export declare const CustomFieldProvider: () => import("effect/Layer").Layer<Provider.Provider<CustomField>, never, import("./client.ts").PaperlessRequirements>;
+//# sourceMappingURL=custom-field.d.ts.map

package/dist/paperless/custom-field.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-field.d.ts","sourceRoot":"","sources":["../../src/paperless/custom-field.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,KAAK,oBAAoB,EAAoB,MAAM,eAAe,CAAC;AAE5E,MAAM,WAAW,gBAAgB;IAC/B,iKAAiK;IACjK,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,QAAQ,EAAE,2BAA2B,CAAC,WAAW,CAAC,CAAC;IACnD,6FAA6F;IAC7F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iBAAiB,SACtB,YAAY,SACX,gBAAgB,KACtB,MAAM,GAAG,SAKG,CAAC;AAEhB,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;CAqB9B,CAAC;AAEH,eAAO,MAAM,mBAAmB,wHAC4D,CAAC"}

package/dist/paperless/document-type.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `Paperless.DocumentType` — a Paperless-ngx document type, create-or-update and never deleted.
+ * Same shape as `tag.ts` minus `color`/`isInboxTag`/`parent` — see that file's header for why
+ * `matchingAlgorithm`'s type comes off the generated request type rather than being retyped.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type { PaperlessDocumentTypeRequest } from './generated/types/document-types.ts';
+import { type MatchingProps, type MatchingRequirements } from './matching.ts';
+export interface DocumentTypeProps extends MatchingProps {
+    /** ⚠️ maxLength 128 (generated constraint table). The locate key. */
+    name: string;
+    /** ⚠️ maxLength 256. */
+    match?: string;
+    matchingAlgorithm?: PaperlessDocumentTypeRequest['matching_algorithm'];
+    isInsensitive?: boolean;
+}
+export interface DocumentTypeAttributes {
+    id: number;
+    name: string;
+    match: string;
+    matchingAlgorithm: number;
+    isInsensitive: boolean;
+    owner: number | undefined;
+}
+export interface DocumentType extends Resource<'Paperless.DocumentType', DocumentTypeProps, DocumentTypeAttributes, never, MatchingRequirements> {
+}
+export declare const DocumentType: import("alchemy").ResourceClass<DocumentType>;
+export declare const DocumentTypeProvider: () => import("effect/Layer").Layer<Provider.Provider<DocumentType>, never, import("./client.ts").PaperlessRequirements>;
+//# sourceMappingURL=document-type.d.ts.map

package/dist/paperless/document-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-type.d.ts","sourceRoot":"","sources":["../../src/paperless/document-type.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAoB,MAAM,eAAe,CAAC;AAEhG,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAiCH,eAAO,MAAM,oBAAoB,yHACkD,CAAC"}

package/dist/paperless/errors.d.ts

@@ -0,0 +1,49 @@
+declare const PaperlessNotFound_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PaperlessNotFound";
+} & Readonly<A>;
+/** No object at that path. The only tag `matching.ts` folds to "absent". */
+export declare class PaperlessNotFound extends PaperlessNotFound_base<{
+    readonly method: string;
+    readonly path: string;
+}> {
+}
+declare const PaperlessUnauthorized_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PaperlessUnauthorized";
+} & Readonly<A>;
+/** 401 (no/bad token) or 403 (token valid, forbidden) — NEVER read as "the object is absent". */
+export declare class PaperlessUnauthorized extends PaperlessUnauthorized_base<{
+    readonly status: 401 | 403;
+    readonly method: string;
+    readonly path: string;
+}> {
+}
+declare const PaperlessValidation_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PaperlessValidation";
+} & Readonly<A>;
+/** 400 — the vendor rejected the body. Carries it, so the message quotes Paperless's own words. */
+export declare class PaperlessValidation extends PaperlessValidation_base<{
+    readonly method: string;
+    readonly path: string;
+    readonly body: string;
+}> {
+}
+declare const PaperlessUnavailable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PaperlessUnavailable";
+} & Readonly<A>;
+/** 5xx, or a status this family's endpoints do not otherwise document. */
+export declare class PaperlessUnavailable extends PaperlessUnavailable_base<{
+    readonly status: number;
+    readonly method: string;
+    readonly path: string;
+    readonly detail: string;
+}> {
+}
+export type PaperlessError = PaperlessNotFound | PaperlessUnauthorized | PaperlessValidation | PaperlessUnavailable;
+/**
+ * The one place a status code is read. ⚠️ Anything outside {400,401,403,404,5xx} — 405, 409, 429
+ *   — is not documented for these four endpoints, so it falls to `PaperlessValidation` rather than
+ *   inventing a fifth tag for a case that was never measured.
+ */
+export declare const statusToError: (status: number, method: string, path: string, body: string) => PaperlessError;
+export {};
+//# sourceMappingURL=errors.d.ts.map