@homeflare/alchemy 0.28.0 → 0.29.1

package/dist/paperless/matching.d.ts

@@ -1,44 +1,47 @@
 import type { Input } from 'alchemy/Input';
+import type { PaperlessNgxOpContext } from '@distilled.cloud/paperless-ngx/Protocol';
 import * as Effect from 'effect/Effect';
 import type { MatchingProps, MatchingSpec } from './matching-types.ts';
 /** Re-exported so `tag.ts`/`document-type.ts`/`storage-path.ts`/`custom-field.ts` keep importing the contract from `./matching.ts` — only the shape itself lives in `matching-types.ts`, split out to hold the file-size cap. */
-export type { FieldSpec, MatchingError, MatchingProps, MatchingRequirements, MatchingSpec, } from './matching-types.ts';
-export declare const matchingOperations: <Props extends MatchingProps, Attributes extends {
+export type { FieldSpec, MatchingPage, MatchingProps, MatchingRequirements, MatchingSpec, } from './matching-types.ts';
+export { LOCATE_PAGE, soleMatch } from './matching-locate.ts';
+export declare const matchingOperations: <Props extends MatchingProps, Live extends {
     readonly id: number;
-}>(spec: MatchingSpec<Props, Attributes>) => {
-    read: (props: Props) => Effect.Effect<Attributes | undefined, import("./credentials.ts").PaperlessCredentialsError | import("./errors.ts").PaperlessUnauthorized | import("./errors.ts").PaperlessUnavailable | import("./errors.ts").PaperlessValidation, import("./client.ts").PaperlessRequirements>;
+    readonly name: string;
+}, Attributes extends {
+    readonly id: number;
+}, E>(spec: MatchingSpec<Props, Live, Attributes, E>) => {
+    read: (props: Props) => Effect.Effect<Attributes | undefined, E, PaperlessNgxOpContext>;
     diff: (news: Input<Props>, output: Attributes | undefined) => Effect.Effect<{
         readonly action: 'update';
     } | {
         readonly action: 'noop';
     } | {
         readonly action: 'replace';
-    } | undefined, import("./credentials.ts").PaperlessCredentialsError | import("./errors.ts").PaperlessUnauthorized | import("./errors.ts").PaperlessUnavailable | import("./errors.ts").PaperlessValidation, import("./client.ts").PaperlessRequirements>;
-    reconcile: (news: Props, output: Attributes | undefined) => Effect.Effect<Attributes, import("./credentials.ts").PaperlessCredentialsError | import("./errors.ts").PaperlessError, import("./client.ts").PaperlessRequirements>;
-    /**
-     * ⛔ `output.id` FIRST, SAME SWITCH AS `fetchLive` (PR 163 re-review). The engine always
-     *   passes `output` here too (`Apply.ts`'s delete call sites all carry `output: attr`) —
-     *   `olds` is only the PROPS as last persisted, which drifts from the live object exactly
-     *   the way `news` did pre-fix: rename it out of band (by hand, or by another tool) after
-     *   the last successful reconcile, and a name-only locate silently finds nothing, `destroy`
-     *   returns as if there were nothing to delete, and the engine drops the state row anyway —
-     *   reporting "deleted" while the live object survives, permanently orphaned (the same
-     *   consequence `matching.ts`'s header describes for the original bug, on the delete path
-     *   the original fix didn't touch). A 404 on the `output.id` itself is NOT an error here,
-     *   unlike `fetchLive`'s die — it means the object is already gone, which is exactly the
-     *   idempotent success `delete` is supposed to report (S11, alchemy-provider-standard).
-     */
-    destroy: (olds: Props, output: Attributes | undefined) => Effect.Effect<void, import("./credentials.ts").PaperlessCredentialsError | import("./errors.ts").PaperlessUnauthorized | import("./errors.ts").PaperlessUnavailable | import("./errors.ts").PaperlessValidation, import("./client.ts").PaperlessRequirements>;
+    } | undefined, E, PaperlessNgxOpContext>;
+    reconcile: (news: Props, output: Attributes | undefined) => Effect.Effect<Attributes, E, PaperlessNgxOpContext>;
+    /** ⛔ `output.id` FIRST, SAME SWITCH AS `fetchLive` (PR 163 re-review). A 404 on `output.id` is idempotent success, not an error, unlike `fetchLive`'s die. */
+    destroy: (olds: Props, output: Attributes | undefined) => Effect.Effect<void, E, PaperlessNgxOpContext>;
 };
-/** The five provider handlers for a spec'd Paperless taxonomy object, wired once. */
-export declare const matchingHandlers: <Props extends MatchingProps, Attributes extends {
+/**
+ * The five provider handlers for a spec'd Paperless taxonomy object, wired once.
+ *
+ * ★ CREDENTIALS ARE PROVIDED HERE, ONCE, NOT BY EVERY CALLER — the same shape
+ *   `netboxHandlers`/`forgejoHandlers` use. `CredentialsFromEnv` resolves `PAPERLESS_URL` /
+ *   `PAPERLESS_TOKEN` on the calling fiber per request, so this closure keeps that laziness —
+ *   nothing is captured at module load. ⛔ THE TOKEN IS NEVER A PROP.
+ */
+export declare const matchingHandlers: <Props extends MatchingProps, Live extends {
+    readonly id: number;
+    readonly name: string;
+}, Attributes extends {
     readonly id: number;
-}>(spec: MatchingSpec<Props, Attributes>) => {
+}, E>(spec: MatchingSpec<Props, Live, Attributes, E>) => {
     /** ⚠️ `[]` — Paperless index endpoints return the whole estate; adoption stays explicit. */
     list: () => Effect.Effect<never[], never, never>;
     read: ({ olds }: {
         olds: Props;
-    }) => Effect.Effect<Attributes | undefined, import("./credentials.ts").PaperlessCredentialsError | import("./errors.ts").PaperlessUnauthorized | import("./errors.ts").PaperlessUnavailable | import("./errors.ts").PaperlessValidation, import("./client.ts").PaperlessRequirements>;
+    }) => Effect.Effect<Attributes | undefined, E, import("effect/unstable/http/HttpClient").HttpClient>;
     diff: ({ news, output }: {
         news: Input<Props>;
         output: Attributes | undefined;
@@ -48,14 +51,14 @@ export declare const matchingHandlers: <Props extends MatchingProps, Attributes
         readonly action: 'noop';
     } | {
         readonly action: 'replace';
-    } | undefined, import("./credentials.ts").PaperlessCredentialsError | import("./errors.ts").PaperlessUnauthorized | import("./errors.ts").PaperlessUnavailable | import("./errors.ts").PaperlessValidation, import("./client.ts").PaperlessRequirements>;
+    } | undefined, E, import("effect/unstable/http/HttpClient").HttpClient>;
     reconcile: ({ news, output }: {
         news: Props;
         output?: Attributes | undefined;
-    }) => Effect.Effect<Attributes, import("./credentials.ts").PaperlessCredentialsError | import("./errors.ts").PaperlessError, import("./client.ts").PaperlessRequirements>;
+    }) => Effect.Effect<Attributes, E, import("effect/unstable/http/HttpClient").HttpClient>;
     delete: ({ olds, output }: {
         olds: Props;
         output?: Attributes | undefined;
-    }) => Effect.Effect<void, import("./credentials.ts").PaperlessCredentialsError | import("./errors.ts").PaperlessUnauthorized | import("./errors.ts").PaperlessUnavailable | import("./errors.ts").PaperlessValidation, import("./client.ts").PaperlessRequirements>;
+    }) => Effect.Effect<void, E, import("effect/unstable/http/HttpClient").HttpClient>;
 };
 //# sourceMappingURL=matching.d.ts.map

package/dist/paperless/matching.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"matching.d.ts","sourceRoot":"","sources":["../../src/paperless/matching.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAMxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEvE,iOAAiO;AACjO,YAAY,EACV,SAAS,EACT,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAM7B,eAAO,MAAM,kBAAkB,GAC7B,KAAK,SAAS,aAAa,EAC3B,UAAU,SAAS;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,QAEpC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC;kBAOhB,KAAK;iBAuDX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAGP,MAAM;;yBAEjC,SAAS;;sBAIV,KAAK,UAAU,UAAU,GAAG,SAAS;IAqCvD;;;;;;;;;;;;OAYG;oBACa,KAAK,UAAU,UAAU,GAAG,SAAS;CAOxD,CAAC;AAEF,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,GAC3B,KAAK,SAAS,aAAa,EAC3B,UAAU,SAAS;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,QAEpC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC;IAInC,4FAA4F;IAC5F,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAIhC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBAnFlC,QAAQ;;yBAGP,MAAM;;yBAEjC,SAAS;;IAqF5B,SAAS,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAI9E,MAAM,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;CAG9E,CAAC"}
+{"version":3,"file":"matching.d.ts","sourceRoot":"","sources":["../../src/paperless/matching.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEvE,iOAAiO;AACjO,YAAY,EACV,SAAS,EACT,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAM9D,eAAO,MAAM,kBAAkB,GAC7B,KAAK,SAAS,aAAa,EAC3B,IAAI,SAAS;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAC3D,UAAU,SAAS;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EAC1C,CAAC,QAEK,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;kBAyBzB,KAAK;iBAgDX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAGP,MAAM;;yBAEjC,SAAS;;sBAIV,KAAK,UAAU,UAAU,GAAG,SAAS;IA+BvD,8JAA8J;oBAC9I,KAAK,UAAU,UAAU,GAAG,SAAS;CAOxD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAC3B,KAAK,SAAS,aAAa,EAC3B,IAAI,SAAS;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAC3D,UAAU,SAAS;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EAC1C,CAAC,QAEK,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAM5C,4FAA4F;IAC5F,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAMhC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBA9ElC,QAAQ;;yBAGP,MAAM;;yBAEjC,SAAS;;IA2E5B,SAAS,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE9E,MAAM,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;CAG9E,CAAC"}

package/dist/paperless/providers.d.ts

@@ -1,15 +1,21 @@
 /**
- * All four Paperless taxonomy providers, one credentials layer shared between them.
+ * All four Paperless taxonomy providers.
  *
  *     Layer.mergeAll(paperlessProviders(), …the stack's other providers)
  *
  * ⚠️ `HttpClient.HttpClient` IS NOT BUNDLED HERE, and that follows `../netbox/index.ts` and
- *   `../forgejo/client.ts`'s own precedent (its header: "the idiom Alchemy's own providers
- *   follow — `Hetzner/Providers.ts` builds on `FetchHttpClient.layer`") rather than diverging
- *   from it: the transport is the consuming STACK's choice (`FetchHttpClient.layer` in
- *   production, a fake `HttpClient` in a test), not a house default a provider file should pin.
+ *   `../forgejo/client.ts`'s own precedent: the transport is the consuming STACK's choice
+ *   (`FetchHttpClient.layer` in production, a fake `HttpClient` in a test), not a house default a
+ *   provider file should pin.
+ *
+ * 🔴 NO `credentials` PARAMETER ANY MORE (2026-09-24, the `@distilled.cloud/paperless-ngx`
+ *   migration — see `matching.ts`'s header). Each of the four `xxxProvider()`s now bakes in
+ *   `CredentialsFromEnv` itself, the same way `netboxHandlers`/`forgejoHandlers` do — there is no
+ *   longer a layer for this file to merge in or accept an override for. Nothing in this estate
+ *   called `paperlessProviders(customLayer)` (measured 2026-09-24: no tray repo declares a
+ *   Paperless resource at all — grep across `homeflare-landscape`'s tray repos' `origin/main`),
+ *   so this is an uneventful simplification, not a behaviour change for anything live.
  */
 import * as Layer from 'effect/Layer';
-import { type PaperlessCredentials } from './credentials.ts';
-export declare const paperlessProviders: (credentials?: Layer.Layer<PaperlessCredentials>) => Layer.Layer<import("alchemy").Provider<import("./custom-field.ts").CustomField> | import("alchemy").Provider<import("./document-type.ts").DocumentType> | import("alchemy").Provider<import("./storage-path.ts").StoragePath> | import("alchemy").Provider<import("./tag.ts").Tag>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const paperlessProviders: () => Layer.Layer<import("alchemy").Provider<import("./custom-field.ts").CustomField> | import("alchemy").Provider<import("./document-type.ts").DocumentType> | import("alchemy").Provider<import("./storage-path.ts").StoragePath> | import("alchemy").Provider<import("./tag.ts").Tag>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=providers.d.ts.map

package/dist/paperless/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/paperless/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,EAAE,KAAK,oBAAoB,EAAoB,MAAM,kBAAkB,CAAC;AAI/E,eAAO,MAAM,kBAAkB,iBAChB,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,qVAOZ,CAAC"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/paperless/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAMtC,eAAO,MAAM,kBAAkB,wVAM5B,CAAC"}

package/dist/paperless/storage-path.d.ts

@@ -1,14 +1,18 @@
 /**
  * `Paperless.StoragePath` — a Paperless-ngx storage path template, create-or-update and never
- * deleted. Same shape as `document-type.ts` plus the vendor-required `path` template string.
+ * deleted. Same shape as `document-type.ts` plus the vendor-required `path` template string; see
+ * `tag.ts`'s header for the 2026-09-24 transport migration this file follows exactly.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
+import * as storagePaths from '@distilled.cloud/paperless-ngx/storage_paths';
+import * as Effect from 'effect/Effect';
 import type { PaperlessStoragePathRequest } from './generated/types/storage-paths.ts';
-import { type MatchingProps, type MatchingRequirements } from './matching.ts';
-export interface StoragePathProps extends MatchingProps {
+import { type MatchingRequirements, type MatchingSpec } from './matching.ts';
+export interface StoragePathProps {
     /** ⚠️ maxLength 128 (generated constraint table). The locate key. */
     name: string;
+    owner?: number;
     /** ⚠️ minLength 1 (generated table). Paperless's storage-path template syntax, e.g. `{correspondent}/{title}`. */
     path: string;
     /** ⚠️ maxLength 256. */
@@ -28,5 +32,31 @@ export interface StoragePathAttributes {
 export interface StoragePath extends Resource<'Paperless.StoragePath', StoragePathProps, StoragePathAttributes, never, MatchingRequirements> {
 }
 export declare const StoragePath: import("alchemy").ResourceClass<StoragePath>;
-export declare const StoragePathProvider: () => import("effect/Layer").Layer<Provider.Provider<StoragePath>, never, import("./client.ts").PaperlessRequirements>;
+/** ★ Exported for direct testing — see tag.ts's own note on this seam. */
+export declare const spec: MatchingSpec<StoragePathProps, storagePaths.StoragePath, StoragePathAttributes, storagePaths.CreateStoragePathError | storagePaths.GetStoragePathError | storagePaths.ListStoragePathsError | storagePaths.UpdateStoragePathsPartialError | storagePaths.StoragePathsDestroyError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: StoragePathProps;
+    }) => Effect.Effect<StoragePathAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | storagePaths.BadRequest | import("@distilled.cloud/caddy").ConfigError | storagePaths.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | storagePaths.NotFound | import("@distilled.cloud/paperless-ngx/Errors").PaperlessNgxParseError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/paperless-ngx/Errors").UnknownPaperlessNgxError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: ({ news, output }: {
+        news: import("alchemy").Input<StoragePathProps>;
+        output: StoragePathAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | {
+        readonly action: 'replace';
+    } | undefined, import("@distilled.cloud/caddy").BadGateway | storagePaths.BadRequest | import("@distilled.cloud/caddy").ConfigError | storagePaths.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | storagePaths.NotFound | import("@distilled.cloud/paperless-ngx/Errors").PaperlessNgxParseError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/paperless-ngx/Errors").UnknownPaperlessNgxError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: ({ news, output }: {
+        news: StoragePathProps;
+        output?: StoragePathAttributes | undefined;
+    }) => Effect.Effect<StoragePathAttributes, import("@distilled.cloud/caddy").BadGateway | storagePaths.BadRequest | import("@distilled.cloud/caddy").ConfigError | storagePaths.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | storagePaths.NotFound | import("@distilled.cloud/paperless-ngx/Errors").PaperlessNgxParseError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/paperless-ngx/Errors").UnknownPaperlessNgxError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds, output }: {
+        olds: StoragePathProps;
+        output?: StoragePathAttributes | undefined;
+    }) => Effect.Effect<void, import("@distilled.cloud/caddy").BadGateway | storagePaths.BadRequest | import("@distilled.cloud/caddy").ConfigError | storagePaths.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | storagePaths.NotFound | import("@distilled.cloud/paperless-ngx/Errors").PaperlessNgxParseError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/paperless-ngx/Errors").UnknownPaperlessNgxError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const StoragePathProvider: () => import("effect/Layer").Layer<Provider.Provider<StoragePath>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=storage-path.d.ts.map

package/dist/paperless/storage-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage-path.d.ts","sourceRoot":"","sources":["../../src/paperless/storage-path.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAoB,MAAM,eAAe,CAAC;AAEhG,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,kHAAkH;IAClH,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,2BAA2B,CAAC,oBAAoB,CAAC,CAAC;IACtE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAmCH,eAAO,MAAM,mBAAmB,wHACiD,CAAC"}
+{"version":3,"file":"storage-path.d.ts","sourceRoot":"","sources":["../../src/paperless/storage-path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,YAAY,MAAM,8CAA8C,CAAC;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,YAAY,EAElB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kHAAkH;IAClH,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,2BAA2B,CAAC,oBAAoB,CAAC,CAAC;IACtE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,IAAI,EAAE,YAAY,CAC7B,gBAAgB,EAChB,YAAY,CAAC,WAAW,EACxB,qBAAqB,EACnB,YAAY,CAAC,sBAAsB,GACnC,YAAY,CAAC,mBAAmB,GAChC,YAAY,CAAC,qBAAqB,GAClC,YAAY,CAAC,8BAA8B,GAC3C,YAAY,CAAC,wBAAwB,CAyCxC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;CAAyB,CAAC;AAE/C,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}

package/dist/paperless/tag.d.ts

@@ -2,22 +2,26 @@
  * `Paperless.Tag` — a Paperless-ngx tag, create-or-update and never deleted by default.
  *
  * ★ `matchingAlgorithm` AND THE OTHER ENUM-SHAPED FIELDS ARE INDEXED OFF THE GENERATED REQUEST
- *   TYPE (`PaperlessTagRequest['matching_algorithm']`), NEVER RETYPED. The literal union `0 | 1 |
- *   … | 6` comes from `codegen/paperless.ts`'s reading of the vendor's own `MatchingAlgorithm`
- *   enum — copying it by hand here would be exactly the guess `schema-provenance` doctrine
- *   forbids, and a vendor that adds a seventh algorithm would leave this type silently stale.
+ *   TYPE (`PaperlessTagRequest['matching_algorithm']`), NEVER RETYPED — see this family's header
+ *   in `docs/paperless.md`. Unchanged by the 2026-09-24 transport migration below: that generated
+ *   table is `codegen/paperless.ts`'s own concern, not `@distilled.cloud/paperless-ngx`'s.
  *
- * ⛔ NO CREDENTIAL IS A PROP. `PAPERLESS_URL`/`PAPERLESS_TOKEN` come from `credentials.ts`.
+ * ⛔ NO CREDENTIAL IS A PROP. `PAPERLESS_URL`/`PAPERLESS_TOKEN` come from
+ *   `@distilled.cloud/paperless-ngx`'s `CredentialsFromEnv` (matching.ts), the same two variable
+ *   names the retired hand-rolled `credentials.ts` read.
  * ⛔ `defaultRemovalPolicy: 'retain'` — the reconciler this replaces never deletes taxonomy, and
  *   a tag's id is referenced by every document it is attached to.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
+import * as tags from '@distilled.cloud/paperless-ngx/tags';
+import * as Effect from 'effect/Effect';
 import type { PaperlessTagRequest } from './generated/types/tags.ts';
-import { type MatchingProps, type MatchingRequirements } from './matching.ts';
-export interface TagProps extends MatchingProps {
+import { type MatchingRequirements, type MatchingSpec } from './matching.ts';
+export interface TagProps {
     /** ⚠️ maxLength 128 (generated constraint table). The locate key — see matching.ts's header. */
     name: string;
+    owner?: number;
     /** ⚠️ minLength 1, maxLength 7 (a CSS hex color, generated table doesn't enforce the `#`). */
     color?: string;
     /** ⚠️ maxLength 256. The text or pattern documents are matched against. */
@@ -43,5 +47,36 @@ export interface TagAttributes {
 export interface Tag extends Resource<'Paperless.Tag', TagProps, TagAttributes, never, MatchingRequirements> {
 }
 export declare const Tag: import("alchemy").ResourceClass<Tag>;
-export declare const TagProvider: () => import("effect/Layer").Layer<Provider.Provider<Tag>, never, import("./client.ts").PaperlessRequirements>;
+/**
+ * ★ EXPORTED, NOT JUST PASSED INLINE — so a test can call `matchingOperations(spec)` directly
+ *   (tag.test.ts does), against an explicit fake `Credentials` layer, without touching
+ *   `matchingHandlers`'s baked-in `CredentialsFromEnv` — the same seam `../forgejo/repository.ts`
+ *   and `../netbox/prefix.ts` use.
+ */
+export declare const spec: MatchingSpec<TagProps, tags.Tag, TagAttributes, tags.CreateTagError | tags.GetTagError | tags.ListTagsError | tags.UpdateTagsPartialError | tags.TagsDestroyError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: TagProps;
+    }) => Effect.Effect<TagAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | tags.BadRequest | import("@distilled.cloud/caddy").ConfigError | tags.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | tags.NotFound | import("@distilled.cloud/paperless-ngx/Errors").PaperlessNgxParseError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/paperless-ngx/Errors").UnknownPaperlessNgxError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: ({ news, output }: {
+        news: import("alchemy").Input<TagProps>;
+        output: TagAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | {
+        readonly action: 'replace';
+    } | undefined, import("@distilled.cloud/caddy").BadGateway | tags.BadRequest | import("@distilled.cloud/caddy").ConfigError | tags.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | tags.NotFound | import("@distilled.cloud/paperless-ngx/Errors").PaperlessNgxParseError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/paperless-ngx/Errors").UnknownPaperlessNgxError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: ({ news, output }: {
+        news: TagProps;
+        output?: TagAttributes | undefined;
+    }) => Effect.Effect<TagAttributes, import("@distilled.cloud/caddy").BadGateway | tags.BadRequest | import("@distilled.cloud/caddy").ConfigError | tags.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | tags.NotFound | import("@distilled.cloud/paperless-ngx/Errors").PaperlessNgxParseError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/paperless-ngx/Errors").UnknownPaperlessNgxError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds, output }: {
+        olds: TagProps;
+        output?: TagAttributes | undefined;
+    }) => Effect.Effect<void, import("@distilled.cloud/caddy").BadGateway | tags.BadRequest | import("@distilled.cloud/caddy").ConfigError | tags.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | tags.NotFound | import("@distilled.cloud/paperless-ngx/Errors").PaperlessNgxParseError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/paperless-ngx/Errors").UnknownPaperlessNgxError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const TagProvider: () => import("effect/Layer").Layer<Provider.Provider<Tag>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=tag.d.ts.map

package/dist/paperless/tag.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tag.d.ts","sourceRoot":"","sources":["../../src/paperless/tag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAoB,MAAM,eAAe,CAAC;AAEhG,MAAM,WAAW,QAAS,SAAQ,aAAa;IAC7C,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mFAAmF;IACnF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,GAAI,SAAQ,QAAQ,CACnC,eAAe,EACf,QAAQ,EACR,aAAa,EACb,KAAK,EACL,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,GAAG,sCAAqE,CAAC;AAoCtF,eAAO,MAAM,WAAW,gHAAwE,CAAC"}
+{"version":3,"file":"tag.d.ts","sourceRoot":"","sources":["../../src/paperless/tag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,qCAAqC,CAAC;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,YAAY,EAElB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,QAAQ;IACvB,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mFAAmF;IACnF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,GAAI,SAAQ,QAAQ,CACnC,eAAe,EACf,QAAQ,EACR,aAAa,EACb,KAAK,EACL,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,GAAG,sCAAqE,CAAC;AAEtF;;;;;GAKG;AACH,eAAO,MAAM,IAAI,EAAE,YAAY,CAC7B,QAAQ,EACR,IAAI,CAAC,GAAG,EACR,aAAa,EACX,IAAI,CAAC,cAAc,GACnB,IAAI,CAAC,WAAW,GAChB,IAAI,CAAC,aAAa,GAClB,IAAI,CAAC,sBAAsB,GAC3B,IAAI,CAAC,gBAAgB,CAsCxB,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;CAAyB,CAAC;AAE/C,eAAO,MAAM,WAAW,yHAAwE,CAAC"}

package/dist/proxmox/acl.d.ts

@@ -6,39 +6,52 @@
  *   {path, user|group|token, role} exists. That is what makes those four families worth declaring,
  *   and why the grants that let OpenBao mint a PVE token today are only clicks somebody made once.
  *
- * ⛔ THE ONE FAMILY THAT DOES NOT FIT `pveOperations` AS WRITTEN, AND THE MISFIT IS MEASURED. The
+ * ⛔ THE ONE FAMILY THAT DOES NOT FIT A GENERIC PATH+FORM SHAPE, AND THE MISFIT IS MEASURED. The
  *   cluster's own schema — `/pve-docs/api-viewer/apidoc.js`, read unauthenticated 2026-09-13 —
  *   lists exactly TWO methods on `/access/acl`: GET and PUT. There is no DELETE (it answers
- *   "Method 'DELETE /access/acl' not implemented") and, less famously, NO POST either. So create
- *   and update are the SAME call, `PUT /access/acl`, and removal is that PUT with `delete=1` —
- *   which is why `delete` below does not use `ops.destroy`.
- *   ⚠️ THE REAL FIX BELONGS IN `resource.ts`: give `PveSpec` a `deleteForm` and the method to go
- *     with it, and this override disappears. Until then it is local and loud — do not "restore
- *     symmetry" by pointing `delete` at `ops.destroy`, which reports every removal as a 501 while
- *     the grant stays exactly where it was.
+ *   "Method 'DELETE /access/acl' not implemented") and, less famously, NO POST either — which is
+ *   why `@distilled.cloud/proxmox`'s generator, reading the same schema, emits `listAccessAcl` and
+ *   `putAccessAcl` and NOTHING ELSE for this path. So create and update are the SAME call, `PUT
+ *   /access/acl`, and removal is that PUT with `delete=1` — there is no `destroyAccessAcl` to call.
  *
  * ⛔ A SINGLE GRANT HAS NO URL OF ITS OWN. `GET /access/acl` answers ONE FLAT LIST for the whole
- *   cluster, so identity is the tuple (path, type, ugid, roleid), matched client-side in
- *   `attributes` below. Two resources declaring the SAME tuple are the SAME grant — Alchemy sees
- *   two resource ids, not one collision — and deleting either takes the access away from both,
- *   the same hazard as two guests declaring one vmid.
+ *   cluster, so identity is the tuple (path, type, ugid, roleid), matched client-side in `find`
+ *   below. Two resources declaring the SAME tuple are the SAME grant — Alchemy sees two resource
+ *   ids, not one collision — and deleting either takes the access away from both, the same hazard
+ *   as two guests declaring one vmid.
  *
  * ⛔ AND THAT LIST IS FILTERED BY WHO IS ASKING. The schema's own words for GET: "The returned list
  *   is restricted to objects where you have rights to modify permissions." A credential that can
  *   read the cluster but not modify permissions is answered `[]` — not a 403, not an error — so
  *   the mount's `read` role needs permission-modify rights on the declared path exactly as
- *   `provision` does. Work reported on a grant that is plainly there means that role is too narrow.
+ *   `provision` does (below, `listAcl` reads with the `provision` role for this reason). Work
+ *   reported on a grant that is plainly there means that role is too narrow.
+ *
+ * ★ MIGRATED OFF `client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s typed
+ *   `access.listAccessAcl`/`access.putAccessAcl` (2026-09-23, decision 43's proxmox walk-down,
+ *   the sub-area's first resource — ACL was already the misfit `pveOperations` could not cover
+ *   cleanly, which is exactly why it goes first). `distilled-pve.ts`'s `runPve` replaces `pve()`:
+ *   same lease reuse (lease-cache.ts), same cluster-member failover (members.ts), now handing the
+ *   request itself to the SDK instead of a hand-assembled `HttpClientRequest`.
+ *   ⛔ ONE DEAD BRANCH REMOVED, NOT PRESERVED: the old code's generic factory POSTed on a "live
+ *     undefined" read, which its own header called unreachable on a healthy cluster and
+ *     documented as MISLEADING — PVE has no POST here, so that 501 said nothing about the real
+ *     failure. `@distilled.cloud/proxmox` has no `createAccessAcl` at all (the vendor schema has
+ *     no POST to generate one from), so there is nothing to call that way. `reconcile` below
+ *     always PUTs instead — the only write PVE actually implements for this path — so a read that
+ *     genuinely failed now surfaces its REAL cause (a typed error, or `PveClusterExhausted`)
+ *     rather than a confusing 501 from a verb that was never there.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 /** PVE's three kinds of subject. The read answers this word; the write wants its plural. */
 export type AclSubjectType = 'user' | 'group' | 'token';
 export interface AclProps extends WithTarget {
     /**
      * The PVE object path the grant is ON — `/`, `/pool/lab`, `/vms/101`, `/storage/local-zfs`.
-     * ⚠️ NOT THE API PATH: `spec.path` below is the endpoint (`access/acl`). PVE's API overloads the
-     *   word, so this file does too rather than renaming a field the cluster calls `path`.
+     * ⚠️ NOT THE API PATH — the endpoint is fixed (`access/acl`). PVE's API overloads the word,
+     *   so this file does too rather than renaming a field the cluster calls `path`.
      */
     path: string;
     /** Which kind of subject `ugid` names. Identity: changing it is a different grant. */
@@ -56,13 +69,7 @@ export interface AclAttributes {
     ugid: string;
     roleid: string;
     propagate: boolean;
-    /**
-     * ⛔ PRESENCE AS AN ATTRIBUTE, AND IT IS WHAT MAKES THE FACTORY WORK HERE. `attributes` never
-     *   returns undefined: if it did, `reconcile` would take the create branch and POST to
-     *   `access/acl`, which PVE does not implement. Present-but-unbound sends every write down the
-     *   PUT branch instead, the only branch PVE has. The cost: the factory's read-back guard cannot
-     *   fire, so `reconcile` below re-checks this field itself and dies with the same honesty.
-     */
+    /** Presence, so a PUT-only family can tell "matches" from "does not exist yet" — see below. */
     bound: boolean;
 }
 export interface ProxmoxAcl extends Resource<'Proxmox.Acl', AclProps, AclAttributes, never, PveRequirements> {

package/dist/proxmox/acl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAiB,MAAM,eAAe,CAAC;AAErF,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,cAAc,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAqH9D,eAAO,MAAM,kBAAkB,gIAqE5B,CAAC"}
+{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGtE,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,cAAc,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAuF9D,eAAO,MAAM,kBAAkB,gIAoE5B,CAAC"}

package/dist/proxmox/distilled-pve.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Running one `@distilled.cloud/proxmox` typed operation the way `client.ts`'s `pve()` ran a raw
+ * HTTP call — same credential lease reuse (lease-cache.ts) and the same cluster-member failover
+ * safety rule (members.ts), now handing the request itself to the SDK instead of building one.
+ *
+ * ★ THIS IS THE SEAM A DISTILLED-BACKED FAMILY CALLS INSTEAD OF `pve()`. `client.ts` stays for
+ *   every family not yet migrated — see acl.ts, the first one, for what a migrated family looks
+ *   like. A family migrates by calling its own `@distilled.cloud/proxmox/<segment>` typed
+ *   operations through `runPve` below, never through a generic method+path+form call: that is
+ *   what "no hand-rolled client" means in practice (upstream Alchemy PR 1425).
+ *
+ * ⚠️ THE WHOLE OPERATION IS RE-RUN PER MEMBER, NOT JUST ONE HTTP CALL. `executeOnCluster` in
+ *   members.ts retries a single already-built `HttpClientRequest`; a distilled operation builds
+ *   its OWN request internally from whatever `Credentials` it is given, so there is no request to
+ *   hand between attempts. Failover here instead re-provides `Credentials` with the next member's
+ *   `apiBaseUrl` and re-runs the same operation value. This is safe under the identical rule
+ *   `executeOnCluster` documents and members.ts's classifiers still enforce: a write may repeat
+ *   only on a PROVABLY pre-send transport failure (connection refused, DNS, a refused
+ *   certificate) — never on a timeout after connect, and never on an HTTP answer of any kind,
+ *   because an answer (even a typed error the SDK decoded) proves the request reached a live
+ *   member and must not be sent again elsewhere. Reads may fail over on any transport failure.
+ *
+ * ⛔ A TYPED ANSWER-ERROR IS NEVER A REASON TO TRY ANOTHER MEMBER. `Forbidden`,
+ *   `ParameterVerificationFailed`, `ClusterNodeUnreachable`, … all mean the request reached a
+ *   member and that member answered — `isTransportFailure`/`isPreSendTransport` (members.ts)
+ *   return `false` for all of them, exactly as they do for the `HttpClientResponse` case in
+ *   `executeOnCluster`, since neither function inspects anything but a transport-level
+ *   `HttpClientError`. Such an error propagates from here UNCHANGED — not wrapped, not retried —
+ *   which is what lets a caller `catchTag` it directly.
+ *
+ * TRAP FOUND WHILE WRITING THE FAILOVER TEST: `Retry.none` on every attempt, and it is not
+ *   optional. `@distilled.cloud/core`'s DEFAULT policy retries any error in its `ServerError`
+ *   category automatically, with no caller opt-in (protocol.ts's own header names the mechanism:
+ *   `core/category.ts`'s `isTransientError` via `makeDefault`) -- and that category covers
+ *   transport failures too, not just 5xx answers: MEASURED -- a plain `listAccessAcl({})` against
+ *   a member that refuses the connection hung past a 5-second test timeout, backing off inside
+ *   the SDK before this file's own failover loop ever saw a failure to classify. Left enabled, a
+ *   WRITE could be resent to the SAME member several times before `runPveWith` gets a result at
+ *   all -- silently reintroducing, inside one member, the exact risk `executeOnCluster`
+ *   (members.ts) exists to rule out across members ("a request that may have reached a member
+ *   must not be sent again"). The hand-rolled client never auto-retried anything; member failover
+ *   was its only resilience. `Retry.none` below keeps that property true here too.
+ *
+ * ⛔ GAP FOUND ON REVIEW, FIXED 2026-09-24: `Retry.none` only stops the SDK re-sending to the SAME
+ *   member -- it added no bound on how long ONE attempt may wait. A member that accepts the TCP
+ *   connection but never answers hung this whole function forever, since the for-loop below never
+ *   got a result to classify and so never reached a healthy member. `MEMBER_TIMEOUT` (members.ts,
+ *   shared with `client.ts`'s `executeOnCluster`) now bounds each attempt; `isTransportFailure`
+ *   treats the resulting `Cause.TimeoutError` as failover-eligible for a read, and
+ *   `isPreSendTransport` still refuses it for a write, for the same reason a post-send timeout
+ *   always was refused.
+ */
+import type * as Cause from 'effect/Cause';
+import type * as Duration from 'effect/Duration';
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { ProxmoxOpContext } from '@distilled.cloud/proxmox/Protocol';
+import type { PveCredential, PveRole, PveTarget } from './credentials.ts';
+import { type MemberAttempt } from './members.ts';
+/** Every member answered nothing usable — the direct successor to `client.ts`'s `clusterExhausted`. */
+export declare class PveClusterExhausted extends Error {
+    readonly attempts: readonly MemberAttempt[];
+    constructor(attempts: readonly MemberAttempt[]);
+}
+/**
+ * Run `op` against `target`'s cluster on an ALREADY-HELD credential — the direct successor to
+ * `client.ts`'s `pveWith`, for a caller reasoning about identity rather than cost (or a test that
+ * wants a fixed, explicit credential rather than a live OpenBao mint — see distilled-pve.test.ts).
+ *
+ * @param isWrite Whether `op` may have a side effect once sent — decides which transport
+ *   failures may retry on the next member. Pass `true` for anything that is not a plain read.
+ * @param timeout Bound on ONE member's attempt — defaults to `MEMBER_TIMEOUT` (members.ts). A
+ *   test passes a short one to prove failover/bounding without waiting out the real bound;
+ *   production code never overrides it. A member that answers past this is failed over (a read)
+ *   or failed outright (a write, since the request may already have landed) — see
+ *   `isTransportFailure`/`isPreSendTransport`.
+ */
+export declare const runPveWith: <A, E>(target: PveTarget, credential: PveCredential, isWrite: boolean, op: Effect.Effect<A, E, ProxmoxOpContext>, timeout?: Duration.Input) => Effect.Effect<A, E | Cause.TimeoutError | PveClusterExhausted, HttpClient.HttpClient>;
+/**
+ * `runPveWith`, minting/reusing a `role` lease exactly as `pve()` did — the seam a migrated
+ * resource file calls.
+ *
+ * ⚠️ `| Error` IN THE RETURN TYPE IS `leased()`'s OWN FAILURE, NOT A NEW ONE THIS FILE ADDS.
+ *   `credentials.ts`'s `mint` fails with a plain `Error` (an OpenBao refusal — sealed, denied, no
+ *   such role) and was never typed more narrowly there; `pve()` carried the same untyped
+ *   possibility before this file existed, just without a signature that said so.
+ */
+export declare const runPve: <A, E>(target: PveTarget, role: PveRole, isWrite: boolean, op: Effect.Effect<A, E, ProxmoxOpContext>) => Effect.Effect<A, E | Cause.TimeoutError | PveClusterExhausted | Error, HttpClient.HttpClient>;
+//# sourceMappingURL=distilled-pve.d.ts.map

package/dist/proxmox/distilled-pve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distilled-pve.d.ts","sourceRoot":"","sources":["../../src/proxmox/distilled-pve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EAEL,KAAK,aAAa,EAOnB,MAAM,cAAc,CAAC;AAEtB,uGAAuG;AACvG,qBAAa,mBAAoB,SAAQ,KAAK;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE;IAAvD,YAAqB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAGtD;CACF;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,UACrB,SAAS,cACL,aAAa,WAChB,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,YAChC,QAAQ,CAAC,KAAK,KACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,EAAE,UAAU,CAAC,UAAU,CA0BnF,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,CAAC,UACjB,SAAS,QACX,OAAO,WACJ,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,KACxC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,GAAG,KAAK,EAAE,UAAU,CAAC,UAAU,CAI3F,CAAC"}