@homeflare/alchemy 0.30.0 → 0.31.1

package/dist/proxmox/credentials.d.ts

@@ -28,8 +28,6 @@
  *   secret that reached an attribute would outlive its 300s lease by months, in four places.
  *   Nothing here returns it to a resource; it is used to build a header and then dropped.
  */
-import * as Effect from 'effect/Effect';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
 /**
  * ★ NO SESSION, ON PURPOSE, AND THIS IS WHAT UNBLOCKED `wip/bao-policy`.
  *   `CommandExecutor.run` requires a `ScopedPlanStatusSession`, and Alchemy gives one to
@@ -114,40 +112,4 @@ export type PveCredential = {
 };
 /** The environment `mint` resolves OpenBao from — `process.env` unless a test passes its own. */
 export type BaoEnvironment = Readonly<Record<string, string | undefined>>;
-/**
- * Mint one credential for `role`: `GET /v1/<mount>/creds/<role>` on OpenBao's HTTP API.
- *
- * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one
- *   client could not disagree with `bao kv get` about what this machine may do. <estate>/openbao then
- *   learned twice what deciding by stderr costs — every failure read as absent, and two commands
- *   said "absent" in different words — so this reads STATUS CODES: 2xx is a credential, and 403
- *   (denied), 404 (no such role or mount — a mint has no "absent"), 503 (sealed) all fail.
- * ★ THE ENVIRONMENT CONTRACT IS STILL THE CLI's, READ THE CLI's WAY, which keeps the case above
- *   true (openbao v2.6.2 api/client.go:34-66, 370, 503-507, 761-762, 776-785): BAO_AGENT_ADDR over
- *   BAO_ADDR over https://127.0.0.1:8200; BAO_NAMESPACE as X-Vault-Namespace; BAO_TOKEN as
- *   X-Vault-Token; X-Vault-Request always. <estate>/openbao/src/bao-address.ts has the long form.
- * ★ AGENT MODE IS NO BAO_TOKEN AND NO TOKEN HEADER. An Agent or Proxy listener with
- *   `api_proxy { use_auto_auth_token = true }` (or the older `cache { … }`) substitutes its
- *   auto-auth token exactly when a request carries none — command/agentproxyshared/cache/handler.go
- *   :29-38, command/agent.go:517-541, command/agent/config/config.go:288-292, and
- *   website/content/docs/agent-and-proxy/agent/apiproxy.mdx:57-62. The CLI's token-file fallback
- *   is deliberately not read. ⚠️ So an unset BAO_TOKEN aimed at a SERVER rather than an agent is a
- *   403, which reads like a missing grant rather than a missing variable.
- * ★ UNIX SOCKETS: `unix:///path` is plain HTTP to `localhost` over that socket, as the CLI does it
- *   (api/client.go:654-667). Bun's fetch takes a `unix` option; `FetchHttpClient.RequestInit` is
- *   Effect's documented way to pass fetch options, read from the calling fiber (effect
- *   FetchHttpClient.ts:59-72). Off Bun it REFUSES, rather than reach http://localhost:80.
- */
-export declare const mint: (target: ApiTarget, role: PveRole, env?: BaoEnvironment) => Effect.Effect<{
-    leaseSeconds: number;
-    secret: string;
-    tokenId: string;
-}, Error, HttpClient.HttpClient>;
-/**
- * The header PVE wants. `PVEAPIToken=<tokenid>=<secret>`.
- *
- * ⚠️ THE SEPARATOR IS `=`, NOT `:`. Proxmox rejects the colon form with a 401 that says only
- *   "authentication failure", which reads as a bad credential rather than as a malformed header.
- */
-export declare const authorization: (credential: PveCredential, target: ApiTarget) => string;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/proxmox/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/proxmox/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D;;;;;;;;;;;;GAYG;AACH,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAM1E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,IAAI,WAAY,SAAS,QAAQ,OAAO,QAAO,cAAc;;;;gCAuFtE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,aAAa,eAAgB,aAAa,UAAU,SAAS,KAAG,MAGf,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/proxmox/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH;;;;;;;;;;;;GAYG;AACH,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC"}

package/dist/proxmox/distilled-guard.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Vendor-constraint guards (constraint-guard.ts) for a distilled-backed family — the seam
+ * acl.ts's own local `guardWrite` established (acl-wire.ts), generalized once a second family
+ * (Group) needed the SAME create/update split `resource.ts`'s `specGuards` (resource-guard.ts)
+ * gives every family still on `client.ts`. `codegen/constraints.ts` scans this package's SOURCE
+ * TEXT for the endpoint-key strings a caller passes here, so a family switching to this helper
+ * changes nothing about which vendor rules apply — same keys, same generated tables.
+ *
+ * ★ WHY `asForm` IS THE ONLY TRANSLATION NEEDED. Distilled's generated request types for every
+ *   PVE form-urlencoded operation are already `Record<string, string | undefined>` — the SAME
+ *   shape `PveForm`/`guardForm` want, minus the `?`. There is no JSON vs form-encoding gap to
+ *   bridge here the way client.ts's `pve()` had to.
+ */
+import type * as Effect from 'effect/Effect';
+import type { EndpointKey } from './constraints.ts';
+/**
+ * Drops non-string fields — distilled's request type carries `?`, `guardForm` wants a plain
+ * form. ⚠️ `body: object`, NOT `Record<string, string | undefined>`: distilled's generated
+ * request types are `interface`s with no index signature, so TypeScript refuses that stricter
+ * parameter type for every one of them ("index signature ... is missing") even though every
+ * field they declare fits it. `object` accepts any of them; the cast below is where the shape
+ * is actually asserted, once, rather than at every call site.
+ */
+export declare const asForm: (body: object) => Record<string, string>;
+/**
+ * `presence`: whether a CREATE is really about to happen (required fields are enforced) or the
+ * form is only being value-checked in passing — see resource-guard.ts's own header on why this
+ * is not "this is the create form" but "a create is really about to happen".
+ */
+export declare const guardWrite: (endpoint: EndpointKey, body: object, presence: boolean) => Effect.Effect<void>;
+//# sourceMappingURL=distilled-guard.d.ts.map

package/dist/proxmox/distilled-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distilled-guard.d.ts","sourceRoot":"","sources":["../../src/proxmox/distilled-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,SAAU,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,UAAU,aACX,WAAW,QACf,MAAM,YACF,OAAO,KAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAgD,CAAC"}

package/dist/proxmox/distilled-pve.d.ts

@@ -55,6 +55,7 @@ import type * as Duration from 'effect/Duration';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
 import type { ProxmoxOpContext } from '@distilled.cloud/proxmox/Protocol';
+import type { PveCredentialDenied } from './credential-errors.ts';
 import type { PveCredential, PveRole, PveTarget } from './credentials.ts';
 import { type MemberAttempt } from './members.ts';
 /** Every member answered nothing usable — the direct successor to `client.ts`'s `clusterExhausted`. */
@@ -81,9 +82,15 @@ export declare const runPveWith: <A, E>(target: PveTarget, credential: PveCreden
  * resource file calls.
  *
  * ⚠️ `| Error` IN THE RETURN TYPE IS `leased()`'s OWN FAILURE, NOT A NEW ONE THIS FILE ADDS.
- *   `credentials.ts`'s `mint` fails with a plain `Error` (an OpenBao refusal — sealed, denied, no
- *   such role) and was never typed more narrowly there; `pve()` carried the same untyped
- *   possibility before this file existed, just without a signature that said so.
+ *   `mint.ts`'s `mint` fails with a plain `Error` for most refusals (sealed, no such role) and
+ *   was never typed more narrowly there; `pve()` carried the same untyped possibility before
+ *   this file existed, just without a signature that said so.
+ *
+ * ★ `| PveCredentialDenied` IS SPELLED OUT HERE, NOT LEFT TO COLLAPSE INTO `Error`. It IS an
+ *   `Error` subtype (Data.TaggedError), so leaving it out of this union would still typecheck —
+ *   but `Effect.catchTag('PveCredentialDenied', …)` downstream (unreadable-read.ts) needs the
+ *   tag to be STATICALLY visible in the error channel to compile at all, not merely true at
+ *   runtime. Naming it here is what lets a migrated family's `readOrUnreadable` catch it.
  */
-export declare const runPve: <A, E>(target: PveTarget, role: PveRole, isWrite: boolean, op: Effect.Effect<A, E, ProxmoxOpContext>) => Effect.Effect<A, E | Cause.TimeoutError | PveClusterExhausted | Error, HttpClient.HttpClient>;
+export declare const runPve: <A, E>(target: PveTarget, role: PveRole, isWrite: boolean, op: Effect.Effect<A, E, ProxmoxOpContext>) => Effect.Effect<A, E | Cause.TimeoutError | PveClusterExhausted | PveCredentialDenied | Error, HttpClient.HttpClient>;
 //# sourceMappingURL=distilled-pve.d.ts.map

package/dist/proxmox/distilled-pve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distilled-pve.d.ts","sourceRoot":"","sources":["../../src/proxmox/distilled-pve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EAEL,KAAK,aAAa,EAOnB,MAAM,cAAc,CAAC;AAEtB,uGAAuG;AACvG,qBAAa,mBAAoB,SAAQ,KAAK;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE;IAAvD,YAAqB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAGtD;CACF;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,UACrB,SAAS,cACL,aAAa,WAChB,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,YAChC,QAAQ,CAAC,KAAK,KACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,EAAE,UAAU,CAAC,UAAU,CA0BnF,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,CAAC,UACjB,SAAS,QACX,OAAO,WACJ,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,KACxC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,GAAG,KAAK,EAAE,UAAU,CAAC,UAAU,CAI3F,CAAC"}
+{"version":3,"file":"distilled-pve.d.ts","sourceRoot":"","sources":["../../src/proxmox/distilled-pve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EAEL,KAAK,aAAa,EAOnB,MAAM,cAAc,CAAC;AAEtB,uGAAuG;AACvG,qBAAa,mBAAoB,SAAQ,KAAK;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE;IAAvD,YAAqB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAGtD;CACF;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,UACrB,SAAS,cACL,aAAa,WAChB,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,YAChC,QAAQ,CAAC,KAAK,KACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,EAAE,UAAU,CAAC,UAAU,CA0BnF,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,CAAC,UACjB,SAAS,QACX,OAAO,WACJ,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,KACxC,MAAM,CAAC,MAAM,CACd,CAAC,EACD,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,KAAK,EAC1E,UAAU,CAAC,UAAU,CAKnB,CAAC"}

package/dist/proxmox/generated/constraints/index.d.ts

@@ -15,5 +15,5 @@ export declare const PROXMOX_CONSTRAINTS: Readonly<Record<string, EndpointConstr
  * ★ A DIGEST OF THE DATA, NOT OF THE FILE TEXT, so reformatting is not a stale generation while
  *   changing a 128 to a 129 by hand is. `tests/schema-manifest.test.ts` recomputes it.
  */
-export declare const PROXMOX_CONSTRAINTS_DIGEST = "33b42b52d396c9e0";
+export declare const PROXMOX_CONSTRAINTS_DIGEST = "56eba80750ddb1d2";
 //# sourceMappingURL=index.d.ts.map

package/dist/proxmox/generated/constraints/pve-access.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pve-access.d.ts","sourceRoot":"","sources":["../../../../src/proxmox/generated/constraints/pve-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CA8ChF,CAAC"}
+{"version":3,"file":"pve-access.d.ts","sourceRoot":"","sources":["../../../../src/proxmox/generated/constraints/pve-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CA2ChF,CAAC"}

package/dist/proxmox/generated/constraints/pve-cluster-backup.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-ceph.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-firewall.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-ha.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-metrics.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-notifications.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-replication.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-sdn.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-ceph.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-disks.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-lxc.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-network.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-qemu.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-pools.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-storage.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/group-wire.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `Proxmox.Group`'s wire shape: PVE's create/update forms and how a live item becomes
+ * attributes. Split out of group.ts (2026-09-24) to keep that file under the 250-line cap —
+ * the api-token.ts/api-token-form.ts seam, same reasoning as acl.ts/acl-wire.ts.
+ */
+import type * as access from '@distilled.cloud/proxmox/access';
+import type { GroupAttributes, GroupProps } from './group.ts';
+export declare const GROUP_CREATE = "pve:POST /access/groups";
+export declare const GROUP_UPDATE = "pve:PUT /access/groups/{groupid}";
+/**
+ * The comment PVE will actually END UP HOLDING for a given declaration.
+ *
+ * ⛔ PVE CANNOT STORE THE COMMENT `'0'`, AND A PROVIDER THAT DOES NOT MODEL THAT DIFFS FOREVER.
+ *   `create_group`/`write_user_config`/the config parser all test the comment for TRUTH, and in
+ *   Perl the one-character string `'0'` is false. So a declared `comment: '0'` is accepted by the
+ *   API, dropped on the way to `user.cfg`, and read back as absent. Normalising BOTH sides is how
+ *   `values.ts` already treats `''` as the absence of a boolean rather than as `false`.
+ */
+export declare const storedComment: (comment: string | undefined) => string;
+export declare const createForm: (props: GroupProps) => access.CreateAccessGroupRequest;
+/** ⚠️ ALWAYS SENT, EVEN EMPTY — that is how a comment is CLEARED (see group.ts's own header). */
+export declare const updateForm: (props: GroupProps) => access.PutAccessGroupRequest;
+export declare const attributesOf: (live: access.GetAccessGroupResponse, props: GroupProps) => GroupAttributes;
+/**
+ * ⚠️ `members` IS NOT COMPARED, AND NOTHING ELSE IS LEFT TO COMPARE. `comment` is the only field
+ *   a PUT here accepts, so it is the only field whose drift this provider can repair.
+ */
+export declare const matches: (attributes: GroupAttributes, props: GroupProps) => boolean;
+//# sourceMappingURL=group-wire.d.ts.map

package/dist/proxmox/group-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/group-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG9D,eAAO,MAAM,YAAY,4BAA4B,CAAC;AACtD,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAE/D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,YAAa,MAAM,GAAG,SAAS,WAGxD,CAAC;AAQF,eAAO,MAAM,UAAU,UAAW,UAAU,KAAG,MAAM,CAAC,wBAGpD,CAAC;AAEH,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAW,UAAU,KAAG,MAAM,CAAC,qBAGpD,CAAC;AAEH,eAAO,MAAM,YAAY,SACjB,MAAM,CAAC,sBAAsB,SAC5B,UAAU,KAChB,eASD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,eAAe,SAAS,UAAU,YACjB,CAAC"}

package/dist/proxmox/group.d.ts

@@ -22,8 +22,9 @@
  *                                     "users":"hf-provision@pve,hf-read@pve"}, …]
  *     GET /access/groups/hf-mint -> {"comment":"…","members":["hf-provision@pve","hf-read@pve"]}
  *   The index says `users` and hands back a COMMA STRING; the item says `members` and hands back an
- *   ARRAY. A reader that looked for `users` on the item path would find nothing, report an empty
- *   group, and quietly show a delete as harmless.
+ *   ARRAY. distilled's generator reflects the SAME split (`GetAccessGroupResponse.members: string[]`
+ *   vs `ListAccessGroupsResponseBodyItem.users?: string`), so reading the item is what keeps this
+ *   file on the array shape it already normalises.
  *
  * ⛔ AND THE ITEM'S ORDER IS NOT STABLE BETWEEN TWO CONSECUTIVE CALLS. MEASURED, seconds apart, on
  *   the same endpoint:
@@ -38,35 +39,37 @@
  *   exactly `comment` and `members`, so the id comes from props — the same arrangement, and the
  *   same reason, as `user.ts`.
  *
- * ★ PRIVILEGES: NOTHING HAD TO BE WIDENED, WHICH MAKES THIS THE FIRST FAMILY HERE THAT COST
- *   NOTHING. Measured with `pveum user permissions`, 2026-09-13:
+ * ★ PRIVILEGES: NOTHING HAD TO BE WIDENED. Measured with `pveum user permissions`, 2026-09-13:
  *     · item GET checks `['perm','/access/groups',['Sys.Audit','Group.Allocate'], any => 1]`, and
- *       `hf-read@pve` already holds `Sys.Audit` there (propagated from `/` by `PVEAuditor`).
- *       So `readRole` is left at the default `read` — unlike storage/sdn-zone/sdn-vnet, whose ITEM
- *       reads PVE gates on an allocate privilege. See the ⛔ on `readRole` in `resource.ts`.
+ *       `hf-read@pve` already holds `Sys.Audit` there. So `readAttributes` below reads with the
+ *       default `read` role — unlike acl.ts, user.ts and api-token.ts, whose item/list reads PVE
+ *       gates on an allocate privilege the 3600s read lease does not hold.
  *     · POST, PUT and DELETE each check `Group.Allocate` on `/access/groups`, and
  *       `hf-provision@pve` holds it via the provision role (`PROVISION_PRIVILEGES`).
  *
  * ⛔ `retain` BY DEFAULT, BECAUSE DELETING A GROUP DESTROYS TWO THINGS THIS FILE CANNOT PUT BACK.
  *   Measured in `PVE::AccessControl` on the node:
- *     · The member list IS the group. `user.cfg` stores it on the GROUP line (`group:<id>:<users>:
- *       <comment>:`) and DERIVES each user's `groups` map from it at parse time. Deleting the group
- *       deletes the list, and this resource has no `members` prop to restore it from.
+ *     · The member list IS the group. `user.cfg` stores it on the GROUP line and DERIVES each
+ *       user's `groups` map from it at parse time. Deleting the group deletes the list, and this
+ *       resource has no `members` prop to restore it from.
  *     · `delete_group_acl` then walks the whole ACL tree and drops every grant where the group is
  *       the SUBJECT. On this cluster that is `admins -> Administrator on /` and
  *       `automation -> PVEAuditor on /`: whole populations of access, gone in one call, with no
  *       confirmation and nothing in the plan to suggest it.
- *   `delete` is FULLY IMPLEMENTED — `DELETE /access/groups/{groupid}` exists, unlike the ACL
- *   family's — so `.pipe(RemovalPolicy.destroy())` really removes the group. See the ★ in
- *   `resource.ts` for why the policy is a guard rather than a stubbed-out operation.
+ *   `delete` is FULLY IMPLEMENTED — `DELETE /access/groups/{groupid}` exists — so
+ *   `.pipe(RemovalPolicy.destroy())` really removes the group.
  *
- * ⛔ NO SECRET REACHES STATE. A group holds a comment and a list of userids; there is no password,
- *   no token and no key anywhere on these endpoints. `user.ts`'s ⛔ about unencrypted state applies
- *   to this package, and this family simply has nothing to trip it.
+ * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s
+ *   typed `access.getAccessGroup`/`createAccessGroup`/`putAccessGroup`/`deleteAccessGroup`
+ *   (2026-09-24, decision 43's proxmox walk-down, access sub-area, second resource after Acl).
+ *   `distilled-pve.ts`'s `runPve` replaces `pve()` as in acl.ts; the CRIES-WOLF FIX
+ *   (unreadable-read.ts) is wired the same way: a refused `provision` mint on the WRITE-side
+ *   guard, or a refused `read` mint on the plain read, reports `noop` with a warning rather than
+ *   forcing `update` with nothing compared.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 export interface GroupProps extends WithTarget {
     /**
      * PVE's primary key for a group.
@@ -93,12 +96,5 @@ export interface ProxmoxGroup extends Resource<'Proxmox.Group', GroupProps, Grou
 }
 /** ★ `retain` by default — a delete takes the membership and the group's grants. See the header. */
 export declare const ProxmoxGroup: import("alchemy").ResourceClass<ProxmoxGroup>;
-/**
- * ⛔ THE EMPTY `list` IS INHERITED FROM `pveHandlers` AND IT MATTERS HERE. `GET /access/groups`
- *   answers with every group on the cluster — on this one that is `admins`, which grants
- *   `Administrator` on `/` to every human who logs in. Handing it to Alchemy would invite adoption,
- *   and therefore one day a delete that takes the whole admin group's access with it. Adoption
- *   stays an explicit act, here as everywhere else in this package.
- */
 export declare const ProxmoxGroupProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxGroup>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=group.d.ts.map

package/dist/proxmox/group.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/proxmox/group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,UAAU,EACV,eAAe,EACf,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,oGAAoG;AACpG,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAqFH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,kIACkD,CAAC"}
+{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/proxmox/group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAY7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAStE,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,UAAU,EACV,eAAe,EACf,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,oGAAoG;AACpG,eAAO,MAAM,YAAY,+CAEvB,CAAC;AA2BH,eAAO,MAAM,oBAAoB,kIA4E9B,CAAC"}