@homeflare/alchemy 0.30.0 → 0.31.1

package/dist/discord/resource.d.ts

@@ -0,0 +1,75 @@
+import type { Input } from 'alchemy/Input';
+import type { DiscordOpContext } from '@distilled.cloud/discord/Protocol';
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+/**
+ * What every stack must still provide after `discordHandlers` bakes in `CredentialsFromEnv`
+ * (below): the transport. `DiscordOpContext` is `Credentials | HttpClient.HttpClient`, so once
+ * `Credentials` is supplied, `HttpClient.HttpClient` is what remains — mirroring
+ * `../netbox/resource.ts#NetboxRequirements`.
+ */
+export type DiscordRequirements = HttpClient.HttpClient;
+/** Every Discord command resource's identity key, regardless of scope. */
+export interface DiscordCommandIdentity {
+    readonly name: string;
+}
+/**
+ * One Discord command object's distilled calls. `Live` is whatever the SDK decodes
+ * (`ApplicationCommandResponse`); `E` is left to each resource file to declare, so a call site's
+ * precise error union (in practice always `DiscordOpError` — see `protocol.ts` — because every
+ * generated Discord operation shares one error channel) flows straight through.
+ */
+export type DiscordSpec<Props extends DiscordCommandIdentity, Live, Attributes extends object, E> = {
+    /** Locate the live command by its declared name within this spec's scope (app, or app+guild). */
+    readonly fetchByName: (props: Props) => Effect.Effect<Live | undefined, E, DiscordOpContext>;
+    readonly attributes: (live: Live) => Attributes;
+    readonly matches: (attributes: Attributes, props: Props) => boolean;
+    readonly upsertBody: (props: Props) => Record<string, unknown>;
+    /** POST create-or-overwrite — see the upsert note above. */
+    readonly upsert: (props: Props, body: Record<string, unknown>) => Effect.Effect<Live, E, DiscordOpContext>;
+    readonly destroy: (props: Props, live: Live) => Effect.Effect<unknown, E, DiscordOpContext>;
+    /** For error messages and test descriptions. */
+    readonly describe: (props: Props) => string;
+};
+export declare const discordOperations: <Props extends DiscordCommandIdentity, Live, Attributes extends object, E>(spec: DiscordSpec<Props, Live, Attributes, E>) => {
+    read: ({ olds, output }: {
+        olds: Props;
+        output: Attributes | undefined;
+    }) => Effect.Effect<Attributes | undefined, E, DiscordOpContext>;
+    diff: (news: Input<Props>, output: Attributes | undefined) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, E, DiscordOpContext>;
+    reconcile: (news: Props) => Effect.Effect<Attributes, E, DiscordOpContext>;
+    destroy: (olds: Props) => Effect.Effect<void, E, DiscordOpContext>;
+};
+/**
+ * The four provider handlers for a spec'd Discord command, wired once.
+ *
+ * ★ CREDENTIALS ARE PROVIDED HERE, ONCE. `CredentialsFromEnv` resolves `DISCORD_BOT_TOKEN` /
+ *   `DISCORD_TOKEN` on the calling fiber per request (credentials.ts), so this closure keeps that
+ *   laziness — nothing is captured at module load.
+ */
+export declare const discordHandlers: <Props extends DiscordCommandIdentity, Live, Attributes extends object, E>(spec: DiscordSpec<Props, Live, Attributes, E>) => {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds, output }: {
+        olds: Props;
+        output: Attributes | undefined;
+    }) => Effect.Effect<Attributes | undefined, E, HttpClient.HttpClient>;
+    diff: ({ news, output }: {
+        news: Input<Props>;
+        output: Attributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, E, HttpClient.HttpClient>;
+    reconcile: ({ news }: {
+        news: Props;
+    }) => Effect.Effect<Attributes, E, HttpClient.HttpClient>;
+    delete: ({ olds }: {
+        olds: Props;
+    }) => Effect.Effect<void, E, HttpClient.HttpClient>;
+};
+//# sourceMappingURL=resource.d.ts.map

package/dist/discord/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/discord/resource.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,UAAU,CAAC;AAExD,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,CACrB,KAAK,SAAS,sBAAsB,EACpC,IAAI,EACJ,UAAU,SAAS,MAAM,EACzB,CAAC,IACC;IACF,iGAAiG;IACjG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC7F,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/D,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC5F,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;CAC7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,KAAK,SAAS,sBAAsB,EACpC,IAAI,EACJ,UAAU,SAAS,MAAM,EACzB,CAAC,QAEK,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAE7C,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAYxE,IAAI,SAAS,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;IAIzB,SAAS,SAAS,KAAK;IAiBvB,OAAO,SAAS,KAAK;CAMrB,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC1B,KAAK,SAAS,sBAAsB,EACpC,IAAI,EACJ,UAAU,SAAS,MAAM,EACzB,CAAC,QAEK,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAM3C,IAAI;IACJ,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAExE,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBArDpC,QAAQ;;yBAElC,MAAM;;IAqDvB,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}

package/dist/proxmox/acl-wire.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `Proxmox.Acl`'s wire shape: PVE's PUT form, identity, and how a live row becomes attributes.
+ * Split out of acl.ts (2026-09-24) to keep that file under the 250-line cap once the cries-wolf
+ * fix needed real space — the api-token.ts/api-token-form.ts seam, same reasoning: this file
+ * answers "what does PVE store", acl.ts answers "when has it changed" and drives the provider.
+ */
+import type * as access from '@distilled.cloud/proxmox/access';
+import type { AclAttributes, AclProps } from './acl.ts';
+/** ⚠️ PVE normalises ACL paths (collapses repeated slashes, strips the trailing one, adds a leading one). */
+export declare const normalize: (raw: string) => string;
+/** The tuple PVE keys a grant by, as PUT's fields. */
+export declare const tuple: (props: AclProps) => access.PutAccessAclRequest;
+/** Create and update are one call: the tuple plus the single mutable field. */
+export declare const bind: (props: AclProps) => access.PutAccessAclRequest;
+/**
+ * ⚠️ ALWAYS PRESENCE-CHECKED. `bind`'s output IS the create form (there is no separate,
+ *   narrower update form for this family — see acl.ts's header), so the vendor's
+ *   required-parameter check is never wrong to run; the two separate create/update passes the
+ *   generic factory ran elsewhere collapse to one call here without losing coverage.
+ */
+export declare const guardWrite: (props: AclProps) => import("effect/Effect").Effect<void, never, never>;
+/** What a change of this string means: not an edit, a different grant. */
+export declare const identity: (grant: Pick<AclAttributes, 'path' | 'roleid' | 'type' | 'ugid'>) => string;
+export declare const attributesOf: (rows: readonly access.ListAccessAclResponseBodyItem[], props: AclProps) => AclAttributes;
+export declare const matches: (attributes: AclAttributes, props: AclProps) => boolean;
+//# sourceMappingURL=acl-wire.d.ts.map

package/dist/proxmox/acl-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl-wire.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAExD,6GAA6G;AAC7G,eAAO,MAAM,SAAS,QAAS,MAAM,WAAmD,CAAC;AAQzF,sDAAsD;AACtD,eAAO,MAAM,KAAK,UAAW,QAAQ,KAAG,MAAM,CAAC,mBAI7C,CAAC;AAEH,+EAA+E;AAC/E,eAAO,MAAM,IAAI,UAAW,QAAQ,KAAG,MAAM,CAAC,mBAG5C,CAAC;AAMH;;;;;GAKG;AACH,eAAO,MAAM,UAAU,UAAW,QAAQ,uDAAmD,CAAC;AAE9F,0EAA0E;AAC1E,eAAO,MAAM,QAAQ,UAAW,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,WACf,CAAC;AAoB1E,eAAO,MAAM,YAAY,SACjB,SAAS,MAAM,CAAC,6BAA6B,EAAE,SAC9C,QAAQ,KACd,aAUF,CAAC;AAEF,eAAO,MAAM,OAAO,eAAgB,aAAa,SAAS,QAAQ,YACQ,CAAC"}

package/dist/proxmox/acl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGtE,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,cAAc,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAuF9D,eAAO,MAAM,kBAAkB,gIAoE5B,CAAC"}
+{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAStE,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,cAAc,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAmB9D,eAAO,MAAM,kBAAkB,gIA6E5B,CAAC"}

package/dist/proxmox/api-token-form.d.ts

@@ -15,9 +15,14 @@ import type { ApiTokenAttributes, ApiTokenProps } from './api-token.ts';
  *   `update_token_info`, read over SSH on node-b on 2026-09-13. The two disagree in exactly the place
  *   that costs a forever-diff: the schema gives `expire` the default "same as user", and the code
  *   never implements it. api-token.ts records what that means.
+ *
+ * ★ MIGRATED OFF THE GENERATED `generated/pve.ts` PARAM TYPES ONTO `@distilled.cloud/proxmox`'s
+ *   typed `access.PutAccessUserTokenRequest`/`access.GetAccessUserTokenResponse` (2026-09-24) —
+ *   the same three fields, still form-urlencoded strings on the wire; distilled's generator
+ *   reads the identical vendor schema `generated/pve.ts` came from.
  */
-import type { AccessUsersUseridTokenTokenidPostParams, AccessUsersUseridTokenTokenidPutParams } from './generated/pve.ts';
-import type { PveSpec } from './resource.ts';
+import type * as access from '@distilled.cloud/proxmox/access';
+export declare const API_TOKEN_UPDATE = "pve:PUT /access/users/{userid}/token/{tokenid}";
 /**
  * `<userid>!<tokenid>` — the name the rest of PVE calls this object by.
  *
@@ -32,12 +37,8 @@ import type { PveSpec } from './resource.ts';
  */
 export declare const fullTokenid: (props: ApiTokenProps) => string;
 /**
- * Everything a token has, in the form PVE wants. Create and update send exactly this.
- *
- * ⛔ `userid` AND `tokenid` ARE NOT IN IT, and that is not an omission. Both are path segments of
- *   `access/users/{userid}/token/{tokenid}` — which is the path the POST goes to as well as the
- *   PUT — so a second copy in the body can only ever disagree with the path it was sent to.
- *   metric-server.ts omits its `id` for the same reason and says so there.
+ * Everything a token has, in the form PVE wants. Update sends exactly this (this family never
+ * creates — see api-token.ts's header).
  *
  * ⚠️ EVERY FIELD IS SENT ON EVERY WRITE, THE EMPTY COMMENT INCLUDED, BECAUSE A PUT MERGES.
  *   MEASURED in `update_token_info`: `$token->{comment} = $param->{comment} if defined(...)`
@@ -48,23 +49,24 @@ export declare const fullTokenid: (props: ApiTokenProps) => string;
  *     literally `my $deletable = { comment => 1 };`, and anything else answers
  *     "unknown option '<k>'" — so `expire` and `privsep` have no clear path at all, which is the
  *     other half of why both are required props rather than optional ones.
- *
- * ⚠️ `flag()` FROM values.ts IS DELIBERATELY NOT USED FOR `privsep`. Its entire job is turning an
- *   UNDECLARED boolean into `undefined` so the field is omitted from the form; `privsep` is a
- *   required prop precisely so that it is never undeclared, so there is nothing for it to do and
- *   its `string | undefined` return would have to be asserted away to fit `Record<string,string>`.
- *   An assertion here would be a claim about the prop that the type already makes properly.
- *
- * ★ TYPED AGAINST THE GENERATED PUT AND POST PARAMS, NOT `Record<string, string>`, since
- *   2026-09-23 — the `notification-matcher-form.ts` pattern: `Pick` rather than the whole type,
- *   because neither `AccessUsersUseridTokenTokenidPutParams` nor …`PostParams` (generated/pve.ts)
- *   carries `userid`/`tokenid` (they are path segments — see the ⛔ above) and Put alone also
- *   carries `delete`/`regenerate`, which this family never sends. A schema drift on any of the
- *   three fields this function DOES send fails `tsc` here rather than surfacing as a 400 on a live
- *   cluster; api-token.test.ts pins the assignment both ways (Put and Post) without a cast.
- *   `expire` is written as a template literal, not `String(...)`, because the generated type is
- *   `` `${number}` ``, not `string` — `String(n)` widens to plain `string` and would not typecheck.
  */
-export declare const shape: (props: ApiTokenProps) => Pick<AccessUsersUseridTokenTokenidPutParams, 'comment' | 'expire' | 'privsep'> & Pick<AccessUsersUseridTokenTokenidPostParams, 'comment' | 'expire' | 'privsep'>;
-export declare const apiTokenSpec: PveSpec<ApiTokenProps, ApiTokenAttributes>;
+export declare const shape: (props: ApiTokenProps) => access.PutAccessUserTokenRequest;
+/**
+ * ★ NOTHING PVE REPORTS HERE IS UNWRITABLE, WHICH IS UNUSUAL IN THIS PACKAGE. The GET returns
+ *   exactly `comment`, `expire` and `privsep`; PUT accepts exactly those three.
+ * ⛔ `undefined` WHEN NEITHER FLAG IS THERE, BECAUSE BOTH ARE ALWAYS THERE FOR A REAL TOKEN.
+ *   `user.cfg` materialises `expire` and `privsep` for every token it stores, so an answer
+ *   carrying neither is not a token — the same "distilled unwraps a missing object's `{"data":
+ *   null}` to `{}`" trap group.ts's header measures, checked here the way this guard already was
+ *   before the distilled migration (api-token.ts's ⛔ on the create refusal cites the same
+ *   MEASURED schema). Without this guard `bool`/`int` would invent one out of their fallbacks and
+ *   the read-back guard in `reconcile` could never fire.
+ */
+export declare const attributesOf: (live: access.GetAccessUserTokenResponse, props: ApiTokenProps) => ApiTokenAttributes | undefined;
+/**
+ * ⚠️ EXACTLY THE THREE FIELDS A PUT CAN PUT BACK, WHICH IS ALSO EXACTLY WHAT THE GET REPORTS.
+ *   MEASURED (pre-migration, replaying against four live token shapes — see the old PR): all
+ *   answer noop; flipping `privsep` answers update; an empty body answers absent.
+ */
+export declare const matches: (attributes: ApiTokenAttributes, props: ApiTokenProps) => boolean;
 //# sourceMappingURL=api-token-form.d.ts.map

package/dist/proxmox/api-token-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/api-token-form.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxE;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EACV,uCAAuC,EACvC,sCAAsC,EACvC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG7C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,UAAW,aAAa,WAAuC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,KAAK,UACT,aAAa,KACnB,IAAI,CAAC,sCAAsC,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC,GAC/E,IAAI,CAAC,uCAAuC,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAI9E,CAAC;AAEH,eAAO,MAAM,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE,kBAAkB,CA6DnE,CAAC"}
+{"version":3,"file":"api-token-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/api-token-form.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAG/D,eAAO,MAAM,gBAAgB,mDAAmD,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,UAAW,aAAa,WAAuC,CAAC;AAExF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,KAAK,UAAW,aAAa,KAAG,MAAM,CAAC,yBAMlD,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,SACjB,MAAM,CAAC,0BAA0B,SAChC,aAAa,KACnB,kBAAkB,GAAG,SAYvB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,OAAO,eAAgB,kBAAkB,SAAS,aAAa,YAGtC,CAAC"}

package/dist/proxmox/api-token.d.ts

@@ -2,17 +2,15 @@
  * `Proxmox.ApiToken` — a PVE API token: the thing a service actually authenticates as.
  *
  * ⛔ THE SECRET EXISTS FOR ONE HTTP RESPONSE AND THEN NOWHERE. MEASURED from the cluster's own
- *   schema (`/usr/share/pve-docs/api-viewer/apidoc.js` on node-b, 2026-09-13): POST returns
- *   `["full-tokenid","info","value"]`; PUT returns `["comment","expire","full-tokenid","privsep",
- *   "value"]` with `value` present ONLY when `regenerate` was set; GET returns
- *   `["comment","expire","privsep"]` and never the secret. A live token agrees —
- *   `GET /access/users/metrics@pve/token/exporter` answers `{"expire":0,"privsep":0}`. PVE says
- *   it plainly on the POST: the value "needs to be stored as it cannot be retrieved afterwards".
+ *   schema: POST returns `["full-tokenid","info","value"]`; PUT returns `["comment","expire",
+ *   "full-tokenid","privsep","value"]` with `value` present ONLY when `regenerate` was set; GET
+ *   returns `["comment","expire","privsep"]` and never the secret. PVE says it plainly on the
+ *   POST: the value "needs to be stored as it cannot be retrieved afterwards".
  *
  * ⛔ SO A TOKEN THIS RESOURCE CREATES IS UNUSABLE, AND SAYING SO IS THE POINT OF THIS BLOCK. The
  *   secret may not become an attribute: Alchemy persists attributes UNENCRYPTED, and this estate's
- *   state store is a Postgres dumped nightly (the ⛔ in credentials.ts). So `reconcile` drops the
- *   value on the floor, and what lands is a live credential in `/etc/pve/user.cfg` whose secret
+ *   state store is a Postgres dumped nightly (the ⛔ in credentials.ts). So `reconcile` refuses
+ *   before any POST, and what would land is a live credential in `/etc/pve/user.cfg` whose secret
  *   nobody holds. No `regenerate` rescues it, because a regenerated value is discarded the same
  *   way. The only escape is an operator who captured the value out of band — which this provider
  *   gives them no way to do.
@@ -20,48 +18,37 @@
  *     whole of a token's policy, and declaring them is real work: it is how `expire` stops being
  *     whatever somebody typed in 2024. Mint NEW tokens where the secret can be caught — OpenBao's
  *     `proxmox-c1` mount, or a human at `pveum user token add`.
- *   ⛔ ★ CORRECTED 2026-09-23 — THIS PARAGRAPH PREVIOUSLY SAID "THE CREATE PATH IS LEFT REACHABLE
- *     RATHER THAN STUBBED… the honest arrangement is a create that works". THAT CONTRADICTED THE
- *     `reconcile` BELOW, WHICH REFUSES: `handlers.reconcile` calls `Effect.die` by name when `read`
- *     answers absent, before any POST — metadata-only per decision 9 (2026-09-23), exported on the
- *     barrel as an adopt-and-manage-only Resource. A create that silently did nothing WOULD be the
- *     lie resource.ts's ★ describes for a stubbed delete; refusing loudly, by name, with the two
- *     ways to get a usable token, is the honest arrangement instead — see the ★ further down and
- *     api-token-adopt.test.ts's absent-token row, which pins the refusal and zero writes.
  *
  * ⛔ THERE IS NO `regenerate` PROP, AND IT IS NOT AN OVERSIGHT. PVE's own description: "All users
  *   of the previous secret will lose access after this operation." A prop for it would revoke a
  *   live credential during a deploy whose plan said `update`, and hand back a replacement this
- *   provider is obliged to throw away — breakage with no recovery. Rotation belongs to the mount
- *   that owns the lease, or to a human who is watching.
+ *   provider is obliged to throw away — breakage with no recovery.
  *
  * ⚠️ THERE IS A SECOND WRITER TO THESE OBJECTS AND IT IS THE ONE THIS PROVIDER RUNS ON. OpenBao's
- *   `proxmox-c1` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` — read from
- *   `<estate>/platform/secrets/vault/plugin-proxmox/proxmox/`: `privsep=0` (client.go), `expire` set
- *   to the lease deadline, and an id the plugin CHOOSES,
- *   `hf-<role>-<actor>-<entity6>-<stamp>-<nonce>` (tokenname.go). Revocation and WAL rollback look
- *   up that one exact id (wal.go); neither sweeps a prefix. So the two systems cannot collide on
- *   one object by accident — but they share the USER: `hf-read@pve` held three live leases when
- *   this was written, and `Proxmox.User` deleting that account takes every one of them with it.
- *   ⛔ DO NOT DECLARE A TOKEN UNDER A MINT USER. `expire` is what makes that dangerous rather than
- *     untidy: point this resource at a lease token with the wrong expire and a 300-second
- *     credential becomes a permanent one — and on `hf-provision@pve` that credential carries
- *     `Permissions.Modify` at `/`. docs/privileges.md records what those 27 privileges buy.
+ *   `proxmox-c1` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` with an id it
+ *   CHOOSES (`hf-<role>-<actor>-<entity6>-<stamp>-<nonce>`), so the two systems cannot collide on
+ *   one object by accident — but they share the USER, and `Proxmox.User` deleting that account
+ *   takes every one of its tokens with it. ⛔ DO NOT DECLARE A TOKEN UNDER A MINT USER: `expire`
+ *   is what makes that dangerous — a 300-second lease token becomes a permanent one.
  *
  * ⚠️ PRIVILEGES, AND THE READ LANE CANNOT DO IT. MEASURED: all four methods on this path check
  *   `['or', ['userid-param','self'], ['userid-group', ['User.Modify']]]` — with no `Sys.Audit`
- *   alternative, unlike `GET /access/users/{userid}`, which has one. And
- *   `pvesh get /access/permissions --userid hf-read@pve --path /access/groups` answers the seven
- *   PVEAuditor audit privileges and no `User.Modify`, while `hf-provision@pve` has it. So the
- *   3600s read lease reaches at most its OWN account's tokens and is refused for every other
- *   userid — which `read` in resource.ts folds into "absent", so the plan says create and the POST
- *   then fails with "Token already exists". Hence `readRole: 'provision'` below, for the same
- *   reason storage.ts, sdn-zone.ts and sdn-vnet.ts set it, at the same cost: every plan mints a
- *   300s non-renewable provision lease just to read.
+ *   alternative — so the 3600s read lease reaches at most its OWN account's tokens and is refused
+ *   for every other userid. `readRole: 'provision'` below, for the same reason storage.ts,
+ *   sdn-zone.ts and sdn-vnet.ts set it, at the same cost: every plan mints a 300s non-renewable
+ *   provision lease just to read.
+ *
+ * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers`/`pveOperations` ONTO
+ *   `@distilled.cloud/proxmox`'s typed `access.getAccessUserToken`/`putAccessUserToken`/
+ *   `deleteAccessUserToken` (2026-09-24, decision 43's proxmox walk-down, the last access-family
+ *   resource). There is no `createAccessUserToken` call anywhere in this file — the create branch
+ *   was already provably unreachable before the migration (`reconcile` dies on an absent read
+ *   before any create path runs), so nothing calls distilled's POST-shaped `updateAccessUserToken`
+ *   operation either; see api-token-form.ts for why the generator gave it that name.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 export interface ApiTokenProps extends WithTarget {
     /**
      * The account that owns the token, realm-qualified: `iac@pve`, `root@pam`. Identity.
@@ -75,57 +62,36 @@ export interface ApiTokenProps extends WithTarget {
     /**
      * The token's own name, unique within the account. Identity.
      *
-     * ⚠️ PVE HAS NO RENAME, AND HERE THAT COSTS MORE THAN IT DOES FOR A USER. Editing this prop (or
-     *   `userid`) points `path` at a DIFFERENT token, which reads as absent and is then created —
-     *   leaving the old token LIVE, with its secret still working, invisible to the plan, while the
-     *   new one is the unusable kind described at the top. Rename by declaring a delete and a
-     *   create, the way user.ts says for an account.
-     *   ⛔ `diff` IS NOT OVERRIDDEN TO SAY `replace` THE WAY acl.ts DOES, AND THE DIFFERENCE IS THE
-     *     OBJECT. There, replace removes a grant that can be rebuilt from its own tuple; here it
-     *     would DELETE a live token — destroying an irrecoverable secret, and everything using it —
-     *     to tidy up a name. Leaving the old token standing is the lesser harm, and saying so here
-     *     is what keeps it from looking like an omission.
-     * ⚠️ PATTERN `[A-Za-z][A-Za-z0-9.\-_]+`: a letter first, two characters minimum. The schema
-     *   declares no maxLength; the OpenBao plugin assumes a conservative 64 rather than finding the
-     *   real limit in production, and so should anything else.
+     * ⚠️ PVE HAS NO RENAME. Editing this prop (or `userid`) points `path` at a DIFFERENT token,
+     *   which reads as absent and is then created — leaving the old token LIVE, invisible to the
+     *   plan, while the new one is the unusable kind described at the top. Rename by declaring a
+     *   delete and a create.
+     *   ⛔ `diff` IS NOT OVERRIDDEN TO SAY `replace` THE WAY acl.ts DOES: there, replace removes a
+     *     grant that can be rebuilt from its own tuple; here it would DELETE a live token —
+     *     destroying an irrecoverable secret — to tidy up a name. Leaving the old token standing is
+     *     the lesser harm.
+     * ⚠️ PATTERN `[A-Za-z][A-Za-z0-9.\-_]+`: a letter first, two characters minimum.
      */
     tokenid: string;
-    /**
-     * Free text in `pveum user token list` and the UI. Empty is how it is cleared — see `shape`.
-     * ⚠️ ANY CHARACTER IS SAFE HERE, MEASURED, and it was worth checking: `user.cfg` is a
-     *   colon-delimited line, so a comment holding a colon or a newline is the obvious place for a
-     *   round-trip to lose a character and diff forever. PVE escapes it — `encode_text` turns
-     *   `a:b\nc%d` into `a%3Ab%0Ac%25d` and `decode_text` gives it back byte for byte.
-     */
+    /** Free text in `pveum user token list` and the UI. Empty is how it is cleared — see `shape`. */
     comment?: string;
     /**
      * Seconds since the epoch, or 0 for "never expires".
      *
      * ⛔ REQUIRED, AND THE SCHEMA WILL TELL YOU IT NEED NOT BE. It declares the default "same as
      *   user", and the code never implements it: `generate_token` writes `expire` only when the
-     *   parameter is defined, `user.cfg` stores a token as `token:<id>:<expire>:<privsep>:<comment>:`
-     *   with no absent state, and the parser does `$expire = 0 if !$expire` (AccessControl.pm:1624).
-     *   MEASURED end to end: every token on this cluster that was created without an expire reads
-     *   back `"expire":0`. So "same as user" is documentation of an intention, not behaviour.
-     * ⛔ WHICH IS WHY IT IS NOT OPTIONAL-DEFAULTING-TO-0. That spelling reads identically and is far
-     *   worse: an omitted `expire` would then quietly WRITE 0 over a live deadline, turning an
-     *   expiring credential into a permanent one, and the plan would call it an update. Requiring
-     *   the field makes "this token never expires" a sentence somebody had to type.
+     *   parameter is defined, and the parser does `$expire = 0 if !$expire`. Required, so "this
+     *   token never expires" is a sentence somebody had to type, rather than an omission that would
+     *   quietly WRITE 0 over a live deadline.
      */
     expire: number;
     /**
      * True keeps the token's privileges separate from its owner's — it gets NOTHING until an ACL
      *   names `fullTokenid`. False gives it the owner's privileges entire.
      *
-     * ⛔ REQUIRED FOR THE SAME REASON AS `expire`, AND THE BLAST RADIUS IS LARGER. PVE's API default
-     *   is 1, every token on this cluster is 0 (measured), and `user.cfg` materialises it either way
-     *   — `$privsep = $privsep ? 1 : 0` (AccessControl.pm:1622), so there is no unset state to
-     *   preserve. Were this optional, adopting a live token without mentioning `privsep` would plan
-     *   an update to 1 and STRIP a working credential of every privilege it has, silently: PVE
-     *   returns 401/403 to the service, nothing errors here, and `iac@pve!apply` simply stops
-     *   working. Required, so adopting a token is a sentence that states what it is.
-     * ⚠️ AND `false` IS NOT A SHRUG. It is a token with its owner's whole privilege set; under a
-     *   provisioning account that is the account's full authority with a separate secret.
+     * ⛔ REQUIRED FOR THE SAME REASON AS `expire`, AND THE BLAST RADIUS IS LARGER. Were this
+     *   optional, adopting a live token without mentioning `privsep` would plan an update to 1 and
+     *   STRIP a working credential of every privilege it has, silently.
      */
     privsep: boolean;
 }
@@ -142,23 +108,16 @@ export interface ProxmoxApiToken extends Resource<'Proxmox.ApiToken', ApiTokenPr
 }
 /**
  * ★ `retain` BY DEFAULT, AND THIS IS THE PLAINEST CASE FOR IT IN THE PACKAGE. A token's contents
- *   are one irreplaceable secret: delete it and the value is gone, a replacement is a DIFFERENT
- *   value, and every holder loses access the instant `cfs_write_file` returns — with no error
- *   raised anywhere near them. The live cluster's tokens are `metrics@pve!exporter` (the PVE
- *   exporter feeding VictoriaMetrics), `agent@pve!executor`, `iac@pve!apply`, `iac@pve!ro`,
- *   `app@pve!app` and `mint@pve!engine` — the last being the parent credential the
- *   OpenBao mount itself authenticates with, so orphaning that one would stop every plan in this
- *   package, this resource included. `delete` is FULLY IMPLEMENTED (DELETE is a real method on
- *   this path, measured) and runs the moment a caller opts in with `.pipe(RemovalPolicy.destroy())`.
- *   See the ★ in resource.ts, which explains the convention once.
+ *   are one irreplaceable secret: delete it and the value is gone, and every holder loses access
+ *   the instant `cfs_write_file` returns — with no error raised anywhere near them. `delete` is
+ *   FULLY IMPLEMENTED and runs the moment a caller opts in with `.pipe(RemovalPolicy.destroy())`.
  */
 export declare const ProxmoxApiToken: import("alchemy").ResourceClass<ProxmoxApiToken>;
 /**
- * ⛔ `list` IS EMPTY, AND FOR THIS FAMILY THAT MATTERS MORE THAN THE GENERIC ARGUMENT IN
- *   resource.ts. A token index handed to Alchemy would offer up `mint@pve!engine` and every
- *   live OpenBao lease for adoption — and adoption is what makes a later plan willing to delete.
- *   The mount's leases in particular appear and vanish on their own; anything that adopted one
- *   would report drift against a credential that was never its to hold.
+ * ⛔ THIS FAMILY ADOPTS AND MANAGES TOKENS; IT REFUSES TO MINT ONE — see the header. `reconcile`
+ *   refuses by name before any write when the read finds nothing, so the create path this
+ *   family's spec would otherwise need never runs, and no `createAccessUserToken`-shaped call
+ *   exists in this file at all.
  */
 export declare const ProxmoxApiTokenProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxApiToken>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=api-token.d.ts.map

package/dist/proxmox/api-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.d.ts","sourceRoot":"","sources":["../../src/proxmox/api-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAA8B,MAAM,eAAe,CAAC;AAElG,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAOlB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,kDAE1B,CAAC;AA6CH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,qIACqD,CAAC"}
+{"version":3,"file":"api-token.d.ts","sourceRoot":"","sources":["../../src/proxmox/api-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAStE,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;OAQG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAKlB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,eAAe,kDAE1B,CAAC;AAaH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,qIAgFjC,CAAC"}

package/dist/proxmox/ceph-fs-wire.d.ts

@@ -80,7 +80,7 @@ export declare const createForm: (props: CephFsProps) => Record<string, string>;
  * ⚠️ BOTH WRITES CHECK `Sys.Modify` ON `/` -- the root, with the breadth metric-server.ts warns
  *   about: granting it buys datacenter options and every other cluster-wide config write too.
  */
-export declare const createFs: (props: CephFsProps) => Effect.Effect<undefined, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const createFs: (props: CephFsProps) => Effect.Effect<undefined, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * DELETE the filesystem, then wait for the worker.
  *
@@ -91,7 +91,7 @@ export declare const createFs: (props: CephFsProps) => Effect.Effect<undefined,
  *   fails with "ceph pools '<name>_data' and/or '<name>_metadata' already exist" -- that refusal is
  *   a BRAKE, not a bug, and it is the last thing standing between a mis-typed rename and the data.
  */
-export declare const destroyFs: (props: CephFsProps) => Effect.Effect<void, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const destroyFs: (props: CephFsProps) => Effect.Effect<void, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * The two read-back failures, as messages rather than as guesses.
  *

package/dist/proxmox/ceph-fs-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-fs-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-fs-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKlE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,OAAO,SACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,WAAW,KACjB,gBAAgB,GAAG,SAkBrB,CAAC;AAaF,6FAA6F;AAC7F,eAAO,MAAM,UAAU,UAAW,WAAW,WAAgD,CAAC;AAM9F;;;GAGG;AACH,eAAO,MAAM,UAAU,UAAW,WAAW,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnE,CAAC;AA2DH;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,UAAW,WAAW,0FAiBvC,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,UAAW,WAAW,qFAQxC,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,UAAW,WAAW,UAK1C,CAAC;AAEJ,eAAO,MAAM,YAAY,UAAW,WAAW,UAK5C,CAAC"}
+{"version":3,"file":"ceph-fs-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-fs-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKlE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,OAAO,SACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,WAAW,KACjB,gBAAgB,GAAG,SAkBrB,CAAC;AAaF,6FAA6F;AAC7F,eAAO,MAAM,UAAU,UAAW,WAAW,WAAgD,CAAC;AAM9F;;;GAGG;AACH,eAAO,MAAM,UAAU,UAAW,WAAW,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnE,CAAC;AA2DH;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,UAAW,WAAW,iJAiBvC,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,UAAW,WAAW,4IAQxC,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,UAAW,WAAW,UAK1C,CAAC;AAEJ,eAAO,MAAM,YAAY,UAAW,WAAW,UAK5C,CAAC"}

package/dist/proxmox/ceph-osd-tree.d.ts

@@ -149,6 +149,6 @@ export declare const osdAttributes: (leaf: CrushNode, props: CephOsdProps) => Ce
  *   added. ⚠️ A 404 or a 403 both arrive here as `undefined`: see the ⛔ on `readRole` in
  *   resource.ts for why that distinction is invisible and what it costs.
  */
-export declare const readOsd: (props: CephOsdProps) => Effect.Effect<CephOsdAttributes | undefined, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readOsd: (props: CephOsdProps) => Effect.Effect<CephOsdAttributes | undefined, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 export {};
 //# sourceMappingURL=ceph-osd-tree.d.ts.map

package/dist/proxmox/ceph-osd-tree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-osd-tree.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-osd-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAIlD,iFAAiF;AACjF,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAOzC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,SAAU,SAAS,KAAG,SAAS,EAQpD,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,OAAO,SAAU,SAAS,SAAS,MAAM,0BACiB,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,EAAE,EAAE,OAAO,CAAC;IACZ,8FAA8F;IAC9F,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IACZ,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,SAAU,SAAS,SAAS,YAAY,KAAG,iBAanE,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,UAAW,YAAY,8GAMxC,CAAC"}
+{"version":3,"file":"ceph-osd-tree.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-osd-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAIlD,iFAAiF;AACjF,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAOzC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,SAAU,SAAS,KAAG,SAAS,EAQpD,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,OAAO,SAAU,SAAS,SAAS,MAAM,0BACiB,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,EAAE,EAAE,OAAO,CAAC;IACZ,8FAA8F;IAC9F,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IACZ,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,SAAU,SAAS,SAAS,YAAY,KAAG,iBAanE,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,UAAW,YAAY,qKAMxC,CAAC"}

package/dist/proxmox/ceph-osd-write.d.ts

@@ -32,7 +32,7 @@ export declare const OSD_CREATE_ENDPOINT: EndpointKey;
  * ⚠️ `dev` is `string | undefined` on the props and non-optional here: `createOsd` refuses first.
  */
 export declare const createOsdForm: (props: CephOsdProps, dev: string) => Record<string, string>;
-export declare const createOsd: (news: CephOsdProps) => Effect.Effect<import("./ceph-osd-tree.ts").CephOsdAttributes, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const createOsd: (news: CephOsdProps) => Effect.Effect<import("./ceph-osd-tree.ts").CephOsdAttributes, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ⛔ REMOVING THE DECLARATION REMOVES THE ASSERTION, NOT THE REPLICA, AND THAT ASYMMETRY IS THE
  *   POINT. `DELETE /nodes/{node}/ceph/osd/{osdid}` takes a replica out of a live pool — with
@@ -51,5 +51,5 @@ export declare const createOsd: (news: CephOsdProps) => Effect.Effect<import("./
  * ⚠️ `cleanup` DEFAULTS TO FALSE, so the logical volumes survive and the disk can be re-added
  *   without a rebuild. Ceph still starts backfilling the missing copies the moment the OSD goes.
  */
-export declare const destroyOsd: (olds: CephOsdProps) => Effect.Effect<unknown, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const destroyOsd: (olds: CephOsdProps) => Effect.Effect<unknown, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=ceph-osd-write.d.ts.map

package/dist/proxmox/ceph-osd-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-osd-write.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-osd-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAA+C,CAAC;AAIlF;;;GAGG;AACH,eAAO,MAAM,aAAa,UAAW,YAAY,OAAO,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGpF,CAAC;AAEH,eAAO,MAAM,SAAS,oJA6BpB,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,UAAU,SAAU,YAAY,wFAO1C,CAAC"}
+{"version":3,"file":"ceph-osd-write.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-osd-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAA+C,CAAC;AAIlF;;;GAGG;AACH,eAAO,MAAM,aAAa,UAAW,YAAY,OAAO,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGpF,CAAC;AAEH,eAAO,MAAM,SAAS,2MA6BpB,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,UAAU,SAAU,YAAY,+IAO1C,CAAC"}

package/dist/proxmox/ceph-pool-settle.d.ts

@@ -24,7 +24,7 @@ export type PoolRead = (props: CephPoolProps) => Effect.Effect<CephPoolAttribute
  *   An empty list is trusted: the collection 403s when the role is too narrow rather than
  *   filtering, so `[]` really does mean a cluster with no pools.
  */
-export declare const confirmAbsent: (props: CephPoolProps, collection: string, describe: string) => Effect.Effect<void, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const confirmAbsent: (props: CephPoolProps, collection: string, describe: string) => Effect.Effect<void, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * Wait for the cluster to agree, then answer the last thing it said.
  *

package/dist/proxmox/ceph-pool-settle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-pool-settle.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool-settle.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,CACrB,KAAK,EAAE,aAAa,KACjB,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,UAAW,aAAa,cAAc,MAAM,YAAY,MAAM,qFAcrF,CAAC;AAEJ;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,UACV,aAAa,QACd,QAAQ,QACR,CAAC,IAAI,EAAE,kBAAkB,GAAG,SAAS,KAAK,OAAO,+GASrD,CAAC"}
+{"version":3,"file":"ceph-pool-settle.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool-settle.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,CACrB,KAAK,EAAE,aAAa,KACjB,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,UAAW,aAAa,cAAc,MAAM,YAAY,MAAM,4IAcrF,CAAC;AAEJ;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,UACV,aAAa,QACd,QAAQ,QACR,CAAC,IAAI,EAAE,kBAAkB,GAAG,SAAS,KAAK,OAAO,+GASrD,CAAC"}

package/dist/proxmox/client.d.ts

@@ -14,7 +14,7 @@
  */
 import * as Effect from 'effect/Effect';
 import * as HttpClient from 'effect/unstable/http/HttpClient';
-import { type ApiTarget, type PveCredential, type PveRole, type PveTarget } from './credentials.ts';
+import type { ApiTarget, PveCredential, PveRole, PveTarget } from './credentials.ts';
 export declare class PveError extends Error {
     readonly status: number;
     readonly method: string;
@@ -60,5 +60,5 @@ export declare const pveEnvelopeWith: (target: PveTarget, credential: PveCredent
  *   node that received the PUT. Any member serves any task path; the privilege skip is keyed on
  *   whether the caller IS the task's owner.
  */
-export declare const pve: <T>(target: ApiTarget, role: PveRole, method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, form?: PveForm) => Effect.Effect<T | undefined, Error, HttpClient.HttpClient>;
+export declare const pve: <T>(target: ApiTarget, role: PveRole, method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, form?: PveForm) => Effect.Effect<T | undefined, Error | import("./credential-errors.ts").PveCredentialDenied, HttpClient.HttpClient>;
 //# sourceMappingURL=client.d.ts.map

package/dist/proxmox/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/proxmox/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EACL,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAC;AAI1B,qBAAa,QAAS,SAAQ,KAAK;IAE/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EAIf;CACF;AAcD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;AA8FjE,uFAAuF;AACvF,eAAO,MAAM,OAAO,GAAI,CAAC,UACf,SAAS,cACL,aAAa,UACjB,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,QACnC,MAAM,SACL,OAAO,kEAgBZ,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAClB,SAAS,cACL,aAAa,UACjB,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,QACnC,MAAM,4EAmBV,CAAC;AAEL;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,UACX,SAAS,QACX,OAAO,UACL,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,QACnC,MAAM,SACL,OAAO,+DAKZ,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/proxmox/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAE9D,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAKrF,qBAAa,QAAS,SAAQ,KAAK;IAE/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EAIf;CACF;AAcD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;AA8FjE,uFAAuF;AACvF,eAAO,MAAM,OAAO,GAAI,CAAC,UACf,SAAS,cACL,aAAa,UACjB,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,QACnC,MAAM,SACL,OAAO,kEAgBZ,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAClB,SAAS,cACL,aAAa,UACjB,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,QACnC,MAAM,4EAmBV,CAAC;AAEL;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,UACX,SAAS,QACX,OAAO,UACL,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,QACnC,MAAM,SACL,OAAO,sHAKZ,CAAC"}

package/dist/proxmox/credential-errors.d.ts

@@ -0,0 +1,27 @@
+import type { PveRole } from './credentials.ts';
+declare const PveCredentialDenied_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PveCredentialDenied";
+} & Readonly<A>;
+/**
+ * OpenBao answered 403 to `GET /v1/<mount>/creds/<role>`: this identity's AppRole has no grant
+ * for `role` on `mount` — measured 2026-09-24 as "the agent lane cannot mint `provision`" (the
+ * lane's policy grants `read` but not `provision`). A TYPED tag, not the plain `Error` every
+ * other mint failure still is (404 no such role/mount, 503 sealed, a network failure), because
+ * this ONE case means "refused, not evidence of anything about the object" — a family's
+ * `readOrUnreadable` (unreadable-read.ts) `catchTag`s exactly this, never any other mint
+ * failure, which stays a hard error precisely because it is NOT a scoped refusal.
+ *
+ * ⛔ WHY NOT EVERY NON-2xx: A 503 (sealed) or a 404 (misconfigured mount/role) is the estate
+ *   BROKEN, not this identity being narrowly scoped — folding those into "unreadable, report
+ *   noop" would hide a real outage behind a quiet, misleadingly reassuring plan. Only 403 is
+ *   "this identity, this role, denied" and safe to read as "cannot see, not evidence of absence".
+ */
+export declare class PveCredentialDenied extends PveCredentialDenied_base<{
+    readonly mount: string;
+    readonly role: PveRole;
+    readonly detail: string;
+}> {
+    get message(): string;
+}
+export {};
+//# sourceMappingURL=credential-errors.d.ts.map

package/dist/proxmox/credential-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-errors.d.ts","sourceRoot":"","sources":["../../src/proxmox/credential-errors.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;;;;AAEhD;;;;;;;;;;;;;GAaG;AACH,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF"}