@homeflare/alchemy 0.31.0 → 0.31.1

package/dist/proxmox/acl-wire.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `Proxmox.Acl`'s wire shape: PVE's PUT form, identity, and how a live row becomes attributes.
+ * Split out of acl.ts (2026-09-24) to keep that file under the 250-line cap once the cries-wolf
+ * fix needed real space — the api-token.ts/api-token-form.ts seam, same reasoning: this file
+ * answers "what does PVE store", acl.ts answers "when has it changed" and drives the provider.
+ */
+import type * as access from '@distilled.cloud/proxmox/access';
+import type { AclAttributes, AclProps } from './acl.ts';
+/** ⚠️ PVE normalises ACL paths (collapses repeated slashes, strips the trailing one, adds a leading one). */
+export declare const normalize: (raw: string) => string;
+/** The tuple PVE keys a grant by, as PUT's fields. */
+export declare const tuple: (props: AclProps) => access.PutAccessAclRequest;
+/** Create and update are one call: the tuple plus the single mutable field. */
+export declare const bind: (props: AclProps) => access.PutAccessAclRequest;
+/**
+ * ⚠️ ALWAYS PRESENCE-CHECKED. `bind`'s output IS the create form (there is no separate,
+ *   narrower update form for this family — see acl.ts's header), so the vendor's
+ *   required-parameter check is never wrong to run; the two separate create/update passes the
+ *   generic factory ran elsewhere collapse to one call here without losing coverage.
+ */
+export declare const guardWrite: (props: AclProps) => import("effect/Effect").Effect<void, never, never>;
+/** What a change of this string means: not an edit, a different grant. */
+export declare const identity: (grant: Pick<AclAttributes, 'path' | 'roleid' | 'type' | 'ugid'>) => string;
+export declare const attributesOf: (rows: readonly access.ListAccessAclResponseBodyItem[], props: AclProps) => AclAttributes;
+export declare const matches: (attributes: AclAttributes, props: AclProps) => boolean;
+//# sourceMappingURL=acl-wire.d.ts.map

package/dist/proxmox/acl-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl-wire.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAExD,6GAA6G;AAC7G,eAAO,MAAM,SAAS,QAAS,MAAM,WAAmD,CAAC;AAQzF,sDAAsD;AACtD,eAAO,MAAM,KAAK,UAAW,QAAQ,KAAG,MAAM,CAAC,mBAI7C,CAAC;AAEH,+EAA+E;AAC/E,eAAO,MAAM,IAAI,UAAW,QAAQ,KAAG,MAAM,CAAC,mBAG5C,CAAC;AAMH;;;;;GAKG;AACH,eAAO,MAAM,UAAU,UAAW,QAAQ,uDAAmD,CAAC;AAE9F,0EAA0E;AAC1E,eAAO,MAAM,QAAQ,UAAW,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,WACf,CAAC;AAoB1E,eAAO,MAAM,YAAY,SACjB,SAAS,MAAM,CAAC,6BAA6B,EAAE,SAC9C,QAAQ,KACd,aAUF,CAAC;AAEF,eAAO,MAAM,OAAO,eAAgB,aAAa,SAAS,QAAQ,YACQ,CAAC"}

package/dist/proxmox/acl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGtE,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,cAAc,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAuF9D,eAAO,MAAM,kBAAkB,gIAoE5B,CAAC"}
+{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAStE,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,cAAc,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAmB9D,eAAO,MAAM,kBAAkB,gIA6E5B,CAAC"}

package/dist/proxmox/api-token-form.d.ts

@@ -15,9 +15,14 @@ import type { ApiTokenAttributes, ApiTokenProps } from './api-token.ts';
  *   `update_token_info`, read over SSH on node-b on 2026-09-13. The two disagree in exactly the place
  *   that costs a forever-diff: the schema gives `expire` the default "same as user", and the code
  *   never implements it. api-token.ts records what that means.
+ *
+ * ★ MIGRATED OFF THE GENERATED `generated/pve.ts` PARAM TYPES ONTO `@distilled.cloud/proxmox`'s
+ *   typed `access.PutAccessUserTokenRequest`/`access.GetAccessUserTokenResponse` (2026-09-24) —
+ *   the same three fields, still form-urlencoded strings on the wire; distilled's generator
+ *   reads the identical vendor schema `generated/pve.ts` came from.
  */
-import type { AccessUsersUseridTokenTokenidPostParams, AccessUsersUseridTokenTokenidPutParams } from './generated/pve.ts';
-import type { PveSpec } from './resource.ts';
+import type * as access from '@distilled.cloud/proxmox/access';
+export declare const API_TOKEN_UPDATE = "pve:PUT /access/users/{userid}/token/{tokenid}";
 /**
  * `<userid>!<tokenid>` — the name the rest of PVE calls this object by.
  *
@@ -32,12 +37,8 @@ import type { PveSpec } from './resource.ts';
  */
 export declare const fullTokenid: (props: ApiTokenProps) => string;
 /**
- * Everything a token has, in the form PVE wants. Create and update send exactly this.
- *
- * ⛔ `userid` AND `tokenid` ARE NOT IN IT, and that is not an omission. Both are path segments of
- *   `access/users/{userid}/token/{tokenid}` — which is the path the POST goes to as well as the
- *   PUT — so a second copy in the body can only ever disagree with the path it was sent to.
- *   metric-server.ts omits its `id` for the same reason and says so there.
+ * Everything a token has, in the form PVE wants. Update sends exactly this (this family never
+ * creates — see api-token.ts's header).
  *
  * ⚠️ EVERY FIELD IS SENT ON EVERY WRITE, THE EMPTY COMMENT INCLUDED, BECAUSE A PUT MERGES.
  *   MEASURED in `update_token_info`: `$token->{comment} = $param->{comment} if defined(...)`
@@ -48,23 +49,24 @@ export declare const fullTokenid: (props: ApiTokenProps) => string;
  *     literally `my $deletable = { comment => 1 };`, and anything else answers
  *     "unknown option '<k>'" — so `expire` and `privsep` have no clear path at all, which is the
  *     other half of why both are required props rather than optional ones.
- *
- * ⚠️ `flag()` FROM values.ts IS DELIBERATELY NOT USED FOR `privsep`. Its entire job is turning an
- *   UNDECLARED boolean into `undefined` so the field is omitted from the form; `privsep` is a
- *   required prop precisely so that it is never undeclared, so there is nothing for it to do and
- *   its `string | undefined` return would have to be asserted away to fit `Record<string,string>`.
- *   An assertion here would be a claim about the prop that the type already makes properly.
- *
- * ★ TYPED AGAINST THE GENERATED PUT AND POST PARAMS, NOT `Record<string, string>`, since
- *   2026-09-23 — the `notification-matcher-form.ts` pattern: `Pick` rather than the whole type,
- *   because neither `AccessUsersUseridTokenTokenidPutParams` nor …`PostParams` (generated/pve.ts)
- *   carries `userid`/`tokenid` (they are path segments — see the ⛔ above) and Put alone also
- *   carries `delete`/`regenerate`, which this family never sends. A schema drift on any of the
- *   three fields this function DOES send fails `tsc` here rather than surfacing as a 400 on a live
- *   cluster; api-token.test.ts pins the assignment both ways (Put and Post) without a cast.
- *   `expire` is written as a template literal, not `String(...)`, because the generated type is
- *   `` `${number}` ``, not `string` — `String(n)` widens to plain `string` and would not typecheck.
  */
-export declare const shape: (props: ApiTokenProps) => Pick<AccessUsersUseridTokenTokenidPutParams, 'comment' | 'expire' | 'privsep'> & Pick<AccessUsersUseridTokenTokenidPostParams, 'comment' | 'expire' | 'privsep'>;
-export declare const apiTokenSpec: PveSpec<ApiTokenProps, ApiTokenAttributes>;
+export declare const shape: (props: ApiTokenProps) => access.PutAccessUserTokenRequest;
+/**
+ * ★ NOTHING PVE REPORTS HERE IS UNWRITABLE, WHICH IS UNUSUAL IN THIS PACKAGE. The GET returns
+ *   exactly `comment`, `expire` and `privsep`; PUT accepts exactly those three.
+ * ⛔ `undefined` WHEN NEITHER FLAG IS THERE, BECAUSE BOTH ARE ALWAYS THERE FOR A REAL TOKEN.
+ *   `user.cfg` materialises `expire` and `privsep` for every token it stores, so an answer
+ *   carrying neither is not a token — the same "distilled unwraps a missing object's `{"data":
+ *   null}` to `{}`" trap group.ts's header measures, checked here the way this guard already was
+ *   before the distilled migration (api-token.ts's ⛔ on the create refusal cites the same
+ *   MEASURED schema). Without this guard `bool`/`int` would invent one out of their fallbacks and
+ *   the read-back guard in `reconcile` could never fire.
+ */
+export declare const attributesOf: (live: access.GetAccessUserTokenResponse, props: ApiTokenProps) => ApiTokenAttributes | undefined;
+/**
+ * ⚠️ EXACTLY THE THREE FIELDS A PUT CAN PUT BACK, WHICH IS ALSO EXACTLY WHAT THE GET REPORTS.
+ *   MEASURED (pre-migration, replaying against four live token shapes — see the old PR): all
+ *   answer noop; flipping `privsep` answers update; an empty body answers absent.
+ */
+export declare const matches: (attributes: ApiTokenAttributes, props: ApiTokenProps) => boolean;
 //# sourceMappingURL=api-token-form.d.ts.map

package/dist/proxmox/api-token-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/api-token-form.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxE;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EACV,uCAAuC,EACvC,sCAAsC,EACvC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG7C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,UAAW,aAAa,WAAuC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,KAAK,UACT,aAAa,KACnB,IAAI,CAAC,sCAAsC,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC,GAC/E,IAAI,CAAC,uCAAuC,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAI9E,CAAC;AAEH,eAAO,MAAM,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE,kBAAkB,CA6DnE,CAAC"}
+{"version":3,"file":"api-token-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/api-token-form.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAG/D,eAAO,MAAM,gBAAgB,mDAAmD,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,UAAW,aAAa,WAAuC,CAAC;AAExF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,KAAK,UAAW,aAAa,KAAG,MAAM,CAAC,yBAMlD,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,SACjB,MAAM,CAAC,0BAA0B,SAChC,aAAa,KACnB,kBAAkB,GAAG,SAYvB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,OAAO,eAAgB,kBAAkB,SAAS,aAAa,YAGtC,CAAC"}

package/dist/proxmox/api-token.d.ts

@@ -2,17 +2,15 @@
  * `Proxmox.ApiToken` — a PVE API token: the thing a service actually authenticates as.
  *
  * ⛔ THE SECRET EXISTS FOR ONE HTTP RESPONSE AND THEN NOWHERE. MEASURED from the cluster's own
- *   schema (`/usr/share/pve-docs/api-viewer/apidoc.js` on node-b, 2026-09-13): POST returns
- *   `["full-tokenid","info","value"]`; PUT returns `["comment","expire","full-tokenid","privsep",
- *   "value"]` with `value` present ONLY when `regenerate` was set; GET returns
- *   `["comment","expire","privsep"]` and never the secret. A live token agrees —
- *   `GET /access/users/metrics@pve/token/exporter` answers `{"expire":0,"privsep":0}`. PVE says
- *   it plainly on the POST: the value "needs to be stored as it cannot be retrieved afterwards".
+ *   schema: POST returns `["full-tokenid","info","value"]`; PUT returns `["comment","expire",
+ *   "full-tokenid","privsep","value"]` with `value` present ONLY when `regenerate` was set; GET
+ *   returns `["comment","expire","privsep"]` and never the secret. PVE says it plainly on the
+ *   POST: the value "needs to be stored as it cannot be retrieved afterwards".
  *
  * ⛔ SO A TOKEN THIS RESOURCE CREATES IS UNUSABLE, AND SAYING SO IS THE POINT OF THIS BLOCK. The
  *   secret may not become an attribute: Alchemy persists attributes UNENCRYPTED, and this estate's
- *   state store is a Postgres dumped nightly (the ⛔ in credentials.ts). So `reconcile` drops the
- *   value on the floor, and what lands is a live credential in `/etc/pve/user.cfg` whose secret
+ *   state store is a Postgres dumped nightly (the ⛔ in credentials.ts). So `reconcile` refuses
+ *   before any POST, and what would land is a live credential in `/etc/pve/user.cfg` whose secret
  *   nobody holds. No `regenerate` rescues it, because a regenerated value is discarded the same
  *   way. The only escape is an operator who captured the value out of band — which this provider
  *   gives them no way to do.
@@ -20,48 +18,37 @@
  *     whole of a token's policy, and declaring them is real work: it is how `expire` stops being
  *     whatever somebody typed in 2024. Mint NEW tokens where the secret can be caught — OpenBao's
  *     `proxmox-c1` mount, or a human at `pveum user token add`.
- *   ⛔ ★ CORRECTED 2026-09-23 — THIS PARAGRAPH PREVIOUSLY SAID "THE CREATE PATH IS LEFT REACHABLE
- *     RATHER THAN STUBBED… the honest arrangement is a create that works". THAT CONTRADICTED THE
- *     `reconcile` BELOW, WHICH REFUSES: `handlers.reconcile` calls `Effect.die` by name when `read`
- *     answers absent, before any POST — metadata-only per decision 9 (2026-09-23), exported on the
- *     barrel as an adopt-and-manage-only Resource. A create that silently did nothing WOULD be the
- *     lie resource.ts's ★ describes for a stubbed delete; refusing loudly, by name, with the two
- *     ways to get a usable token, is the honest arrangement instead — see the ★ further down and
- *     api-token-adopt.test.ts's absent-token row, which pins the refusal and zero writes.
  *
  * ⛔ THERE IS NO `regenerate` PROP, AND IT IS NOT AN OVERSIGHT. PVE's own description: "All users
  *   of the previous secret will lose access after this operation." A prop for it would revoke a
  *   live credential during a deploy whose plan said `update`, and hand back a replacement this
- *   provider is obliged to throw away — breakage with no recovery. Rotation belongs to the mount
- *   that owns the lease, or to a human who is watching.
+ *   provider is obliged to throw away — breakage with no recovery.
  *
  * ⚠️ THERE IS A SECOND WRITER TO THESE OBJECTS AND IT IS THE ONE THIS PROVIDER RUNS ON. OpenBao's
- *   `proxmox-c1` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` — read from
- *   `<estate>/platform/secrets/vault/plugin-proxmox/proxmox/`: `privsep=0` (client.go), `expire` set
- *   to the lease deadline, and an id the plugin CHOOSES,
- *   `hf-<role>-<actor>-<entity6>-<stamp>-<nonce>` (tokenname.go). Revocation and WAL rollback look
- *   up that one exact id (wal.go); neither sweeps a prefix. So the two systems cannot collide on
- *   one object by accident — but they share the USER: `hf-read@pve` held three live leases when
- *   this was written, and `Proxmox.User` deleting that account takes every one of them with it.
- *   ⛔ DO NOT DECLARE A TOKEN UNDER A MINT USER. `expire` is what makes that dangerous rather than
- *     untidy: point this resource at a lease token with the wrong expire and a 300-second
- *     credential becomes a permanent one — and on `hf-provision@pve` that credential carries
- *     `Permissions.Modify` at `/`. docs/privileges.md records what those 27 privileges buy.
+ *   `proxmox-c1` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` with an id it
+ *   CHOOSES (`hf-<role>-<actor>-<entity6>-<stamp>-<nonce>`), so the two systems cannot collide on
+ *   one object by accident — but they share the USER, and `Proxmox.User` deleting that account
+ *   takes every one of its tokens with it. ⛔ DO NOT DECLARE A TOKEN UNDER A MINT USER: `expire`
+ *   is what makes that dangerous — a 300-second lease token becomes a permanent one.
  *
  * ⚠️ PRIVILEGES, AND THE READ LANE CANNOT DO IT. MEASURED: all four methods on this path check
  *   `['or', ['userid-param','self'], ['userid-group', ['User.Modify']]]` — with no `Sys.Audit`
- *   alternative, unlike `GET /access/users/{userid}`, which has one. And
- *   `pvesh get /access/permissions --userid hf-read@pve --path /access/groups` answers the seven
- *   PVEAuditor audit privileges and no `User.Modify`, while `hf-provision@pve` has it. So the
- *   3600s read lease reaches at most its OWN account's tokens and is refused for every other
- *   userid — which `read` in resource.ts folds into "absent", so the plan says create and the POST
- *   then fails with "Token already exists". Hence `readRole: 'provision'` below, for the same
- *   reason storage.ts, sdn-zone.ts and sdn-vnet.ts set it, at the same cost: every plan mints a
- *   300s non-renewable provision lease just to read.
+ *   alternative — so the 3600s read lease reaches at most its OWN account's tokens and is refused
+ *   for every other userid. `readRole: 'provision'` below, for the same reason storage.ts,
+ *   sdn-zone.ts and sdn-vnet.ts set it, at the same cost: every plan mints a 300s non-renewable
+ *   provision lease just to read.
+ *
+ * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers`/`pveOperations` ONTO
+ *   `@distilled.cloud/proxmox`'s typed `access.getAccessUserToken`/`putAccessUserToken`/
+ *   `deleteAccessUserToken` (2026-09-24, decision 43's proxmox walk-down, the last access-family
+ *   resource). There is no `createAccessUserToken` call anywhere in this file — the create branch
+ *   was already provably unreachable before the migration (`reconcile` dies on an absent read
+ *   before any create path runs), so nothing calls distilled's POST-shaped `updateAccessUserToken`
+ *   operation either; see api-token-form.ts for why the generator gave it that name.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 export interface ApiTokenProps extends WithTarget {
     /**
      * The account that owns the token, realm-qualified: `iac@pve`, `root@pam`. Identity.
@@ -75,57 +62,36 @@ export interface ApiTokenProps extends WithTarget {
     /**
      * The token's own name, unique within the account. Identity.
      *
-     * ⚠️ PVE HAS NO RENAME, AND HERE THAT COSTS MORE THAN IT DOES FOR A USER. Editing this prop (or
-     *   `userid`) points `path` at a DIFFERENT token, which reads as absent and is then created —
-     *   leaving the old token LIVE, with its secret still working, invisible to the plan, while the
-     *   new one is the unusable kind described at the top. Rename by declaring a delete and a
-     *   create, the way user.ts says for an account.
-     *   ⛔ `diff` IS NOT OVERRIDDEN TO SAY `replace` THE WAY acl.ts DOES, AND THE DIFFERENCE IS THE
-     *     OBJECT. There, replace removes a grant that can be rebuilt from its own tuple; here it
-     *     would DELETE a live token — destroying an irrecoverable secret, and everything using it —
-     *     to tidy up a name. Leaving the old token standing is the lesser harm, and saying so here
-     *     is what keeps it from looking like an omission.
-     * ⚠️ PATTERN `[A-Za-z][A-Za-z0-9.\-_]+`: a letter first, two characters minimum. The schema
-     *   declares no maxLength; the OpenBao plugin assumes a conservative 64 rather than finding the
-     *   real limit in production, and so should anything else.
+     * ⚠️ PVE HAS NO RENAME. Editing this prop (or `userid`) points `path` at a DIFFERENT token,
+     *   which reads as absent and is then created — leaving the old token LIVE, invisible to the
+     *   plan, while the new one is the unusable kind described at the top. Rename by declaring a
+     *   delete and a create.
+     *   ⛔ `diff` IS NOT OVERRIDDEN TO SAY `replace` THE WAY acl.ts DOES: there, replace removes a
+     *     grant that can be rebuilt from its own tuple; here it would DELETE a live token —
+     *     destroying an irrecoverable secret — to tidy up a name. Leaving the old token standing is
+     *     the lesser harm.
+     * ⚠️ PATTERN `[A-Za-z][A-Za-z0-9.\-_]+`: a letter first, two characters minimum.
      */
     tokenid: string;
-    /**
-     * Free text in `pveum user token list` and the UI. Empty is how it is cleared — see `shape`.
-     * ⚠️ ANY CHARACTER IS SAFE HERE, MEASURED, and it was worth checking: `user.cfg` is a
-     *   colon-delimited line, so a comment holding a colon or a newline is the obvious place for a
-     *   round-trip to lose a character and diff forever. PVE escapes it — `encode_text` turns
-     *   `a:b\nc%d` into `a%3Ab%0Ac%25d` and `decode_text` gives it back byte for byte.
-     */
+    /** Free text in `pveum user token list` and the UI. Empty is how it is cleared — see `shape`. */
     comment?: string;
     /**
      * Seconds since the epoch, or 0 for "never expires".
      *
      * ⛔ REQUIRED, AND THE SCHEMA WILL TELL YOU IT NEED NOT BE. It declares the default "same as
      *   user", and the code never implements it: `generate_token` writes `expire` only when the
-     *   parameter is defined, `user.cfg` stores a token as `token:<id>:<expire>:<privsep>:<comment>:`
-     *   with no absent state, and the parser does `$expire = 0 if !$expire` (AccessControl.pm:1624).
-     *   MEASURED end to end: every token on this cluster that was created without an expire reads
-     *   back `"expire":0`. So "same as user" is documentation of an intention, not behaviour.
-     * ⛔ WHICH IS WHY IT IS NOT OPTIONAL-DEFAULTING-TO-0. That spelling reads identically and is far
-     *   worse: an omitted `expire` would then quietly WRITE 0 over a live deadline, turning an
-     *   expiring credential into a permanent one, and the plan would call it an update. Requiring
-     *   the field makes "this token never expires" a sentence somebody had to type.
+     *   parameter is defined, and the parser does `$expire = 0 if !$expire`. Required, so "this
+     *   token never expires" is a sentence somebody had to type, rather than an omission that would
+     *   quietly WRITE 0 over a live deadline.
      */
     expire: number;
     /**
      * True keeps the token's privileges separate from its owner's — it gets NOTHING until an ACL
      *   names `fullTokenid`. False gives it the owner's privileges entire.
      *
-     * ⛔ REQUIRED FOR THE SAME REASON AS `expire`, AND THE BLAST RADIUS IS LARGER. PVE's API default
-     *   is 1, every token on this cluster is 0 (measured), and `user.cfg` materialises it either way
-     *   — `$privsep = $privsep ? 1 : 0` (AccessControl.pm:1622), so there is no unset state to
-     *   preserve. Were this optional, adopting a live token without mentioning `privsep` would plan
-     *   an update to 1 and STRIP a working credential of every privilege it has, silently: PVE
-     *   returns 401/403 to the service, nothing errors here, and `iac@pve!apply` simply stops
-     *   working. Required, so adopting a token is a sentence that states what it is.
-     * ⚠️ AND `false` IS NOT A SHRUG. It is a token with its owner's whole privilege set; under a
-     *   provisioning account that is the account's full authority with a separate secret.
+     * ⛔ REQUIRED FOR THE SAME REASON AS `expire`, AND THE BLAST RADIUS IS LARGER. Were this
+     *   optional, adopting a live token without mentioning `privsep` would plan an update to 1 and
+     *   STRIP a working credential of every privilege it has, silently.
      */
     privsep: boolean;
 }
@@ -142,23 +108,16 @@ export interface ProxmoxApiToken extends Resource<'Proxmox.ApiToken', ApiTokenPr
 }
 /**
  * ★ `retain` BY DEFAULT, AND THIS IS THE PLAINEST CASE FOR IT IN THE PACKAGE. A token's contents
- *   are one irreplaceable secret: delete it and the value is gone, a replacement is a DIFFERENT
- *   value, and every holder loses access the instant `cfs_write_file` returns — with no error
- *   raised anywhere near them. The live cluster's tokens are `metrics@pve!exporter` (the PVE
- *   exporter feeding VictoriaMetrics), `agent@pve!executor`, `iac@pve!apply`, `iac@pve!ro`,
- *   `app@pve!app` and `mint@pve!engine` — the last being the parent credential the
- *   OpenBao mount itself authenticates with, so orphaning that one would stop every plan in this
- *   package, this resource included. `delete` is FULLY IMPLEMENTED (DELETE is a real method on
- *   this path, measured) and runs the moment a caller opts in with `.pipe(RemovalPolicy.destroy())`.
- *   See the ★ in resource.ts, which explains the convention once.
+ *   are one irreplaceable secret: delete it and the value is gone, and every holder loses access
+ *   the instant `cfs_write_file` returns — with no error raised anywhere near them. `delete` is
+ *   FULLY IMPLEMENTED and runs the moment a caller opts in with `.pipe(RemovalPolicy.destroy())`.
  */
 export declare const ProxmoxApiToken: import("alchemy").ResourceClass<ProxmoxApiToken>;
 /**
- * ⛔ `list` IS EMPTY, AND FOR THIS FAMILY THAT MATTERS MORE THAN THE GENERIC ARGUMENT IN
- *   resource.ts. A token index handed to Alchemy would offer up `mint@pve!engine` and every
- *   live OpenBao lease for adoption — and adoption is what makes a later plan willing to delete.
- *   The mount's leases in particular appear and vanish on their own; anything that adopted one
- *   would report drift against a credential that was never its to hold.
+ * ⛔ THIS FAMILY ADOPTS AND MANAGES TOKENS; IT REFUSES TO MINT ONE — see the header. `reconcile`
+ *   refuses by name before any write when the read finds nothing, so the create path this
+ *   family's spec would otherwise need never runs, and no `createAccessUserToken`-shaped call
+ *   exists in this file at all.
  */
 export declare const ProxmoxApiTokenProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxApiToken>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=api-token.d.ts.map

package/dist/proxmox/api-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.d.ts","sourceRoot":"","sources":["../../src/proxmox/api-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAA8B,MAAM,eAAe,CAAC;AAElG,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAOlB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,kDAE1B,CAAC;AA6CH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,qIACqD,CAAC"}
+{"version":3,"file":"api-token.d.ts","sourceRoot":"","sources":["../../src/proxmox/api-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAStE,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;OAQG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAKlB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,eAAe,kDAE1B,CAAC;AAaH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,qIAgFjC,CAAC"}

package/dist/proxmox/ceph-fs-wire.d.ts

@@ -80,7 +80,7 @@ export declare const createForm: (props: CephFsProps) => Record<string, string>;
  * ⚠️ BOTH WRITES CHECK `Sys.Modify` ON `/` -- the root, with the breadth metric-server.ts warns
  *   about: granting it buys datacenter options and every other cluster-wide config write too.
  */
-export declare const createFs: (props: CephFsProps) => Effect.Effect<undefined, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const createFs: (props: CephFsProps) => Effect.Effect<undefined, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * DELETE the filesystem, then wait for the worker.
  *
@@ -91,7 +91,7 @@ export declare const createFs: (props: CephFsProps) => Effect.Effect<undefined,
  *   fails with "ceph pools '<name>_data' and/or '<name>_metadata' already exist" -- that refusal is
  *   a BRAKE, not a bug, and it is the last thing standing between a mis-typed rename and the data.
  */
-export declare const destroyFs: (props: CephFsProps) => Effect.Effect<void, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const destroyFs: (props: CephFsProps) => Effect.Effect<void, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * The two read-back failures, as messages rather than as guesses.
  *

package/dist/proxmox/ceph-fs-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-fs-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-fs-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKlE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,OAAO,SACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,WAAW,KACjB,gBAAgB,GAAG,SAkBrB,CAAC;AAaF,6FAA6F;AAC7F,eAAO,MAAM,UAAU,UAAW,WAAW,WAAgD,CAAC;AAM9F;;;GAGG;AACH,eAAO,MAAM,UAAU,UAAW,WAAW,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnE,CAAC;AA2DH;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,UAAW,WAAW,0FAiBvC,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,UAAW,WAAW,qFAQxC,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,UAAW,WAAW,UAK1C,CAAC;AAEJ,eAAO,MAAM,YAAY,UAAW,WAAW,UAK5C,CAAC"}
+{"version":3,"file":"ceph-fs-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-fs-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKlE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,OAAO,SACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,WAAW,KACjB,gBAAgB,GAAG,SAkBrB,CAAC;AAaF,6FAA6F;AAC7F,eAAO,MAAM,UAAU,UAAW,WAAW,WAAgD,CAAC;AAM9F;;;GAGG;AACH,eAAO,MAAM,UAAU,UAAW,WAAW,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnE,CAAC;AA2DH;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,UAAW,WAAW,iJAiBvC,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,UAAW,WAAW,4IAQxC,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,UAAW,WAAW,UAK1C,CAAC;AAEJ,eAAO,MAAM,YAAY,UAAW,WAAW,UAK5C,CAAC"}

package/dist/proxmox/ceph-osd-tree.d.ts

@@ -149,6 +149,6 @@ export declare const osdAttributes: (leaf: CrushNode, props: CephOsdProps) => Ce
  *   added. ⚠️ A 404 or a 403 both arrive here as `undefined`: see the ⛔ on `readRole` in
  *   resource.ts for why that distinction is invisible and what it costs.
  */
-export declare const readOsd: (props: CephOsdProps) => Effect.Effect<CephOsdAttributes | undefined, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readOsd: (props: CephOsdProps) => Effect.Effect<CephOsdAttributes | undefined, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 export {};
 //# sourceMappingURL=ceph-osd-tree.d.ts.map

package/dist/proxmox/ceph-osd-tree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-osd-tree.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-osd-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAIlD,iFAAiF;AACjF,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAOzC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,SAAU,SAAS,KAAG,SAAS,EAQpD,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,OAAO,SAAU,SAAS,SAAS,MAAM,0BACiB,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,EAAE,EAAE,OAAO,CAAC;IACZ,8FAA8F;IAC9F,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IACZ,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,SAAU,SAAS,SAAS,YAAY,KAAG,iBAanE,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,UAAW,YAAY,8GAMxC,CAAC"}
+{"version":3,"file":"ceph-osd-tree.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-osd-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAIlD,iFAAiF;AACjF,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAOzC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,SAAU,SAAS,KAAG,SAAS,EAQpD,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,OAAO,SAAU,SAAS,SAAS,MAAM,0BACiB,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,EAAE,EAAE,OAAO,CAAC;IACZ,8FAA8F;IAC9F,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IACZ,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,SAAU,SAAS,SAAS,YAAY,KAAG,iBAanE,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,UAAW,YAAY,qKAMxC,CAAC"}

package/dist/proxmox/ceph-osd-write.d.ts

@@ -32,7 +32,7 @@ export declare const OSD_CREATE_ENDPOINT: EndpointKey;
  * ⚠️ `dev` is `string | undefined` on the props and non-optional here: `createOsd` refuses first.
  */
 export declare const createOsdForm: (props: CephOsdProps, dev: string) => Record<string, string>;
-export declare const createOsd: (news: CephOsdProps) => Effect.Effect<import("./ceph-osd-tree.ts").CephOsdAttributes, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const createOsd: (news: CephOsdProps) => Effect.Effect<import("./ceph-osd-tree.ts").CephOsdAttributes, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ⛔ REMOVING THE DECLARATION REMOVES THE ASSERTION, NOT THE REPLICA, AND THAT ASYMMETRY IS THE
  *   POINT. `DELETE /nodes/{node}/ceph/osd/{osdid}` takes a replica out of a live pool — with
@@ -51,5 +51,5 @@ export declare const createOsd: (news: CephOsdProps) => Effect.Effect<import("./
  * ⚠️ `cleanup` DEFAULTS TO FALSE, so the logical volumes survive and the disk can be re-added
  *   without a rebuild. Ceph still starts backfilling the missing copies the moment the OSD goes.
  */
-export declare const destroyOsd: (olds: CephOsdProps) => Effect.Effect<unknown, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const destroyOsd: (olds: CephOsdProps) => Effect.Effect<unknown, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=ceph-osd-write.d.ts.map

package/dist/proxmox/ceph-osd-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-osd-write.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-osd-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAA+C,CAAC;AAIlF;;;GAGG;AACH,eAAO,MAAM,aAAa,UAAW,YAAY,OAAO,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGpF,CAAC;AAEH,eAAO,MAAM,SAAS,oJA6BpB,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,UAAU,SAAU,YAAY,wFAO1C,CAAC"}
+{"version":3,"file":"ceph-osd-write.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-osd-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAA+C,CAAC;AAIlF;;;GAGG;AACH,eAAO,MAAM,aAAa,UAAW,YAAY,OAAO,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGpF,CAAC;AAEH,eAAO,MAAM,SAAS,2MA6BpB,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,UAAU,SAAU,YAAY,+IAO1C,CAAC"}

package/dist/proxmox/ceph-pool-settle.d.ts

@@ -24,7 +24,7 @@ export type PoolRead = (props: CephPoolProps) => Effect.Effect<CephPoolAttribute
  *   An empty list is trusted: the collection 403s when the role is too narrow rather than
  *   filtering, so `[]` really does mean a cluster with no pools.
  */
-export declare const confirmAbsent: (props: CephPoolProps, collection: string, describe: string) => Effect.Effect<void, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const confirmAbsent: (props: CephPoolProps, collection: string, describe: string) => Effect.Effect<void, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * Wait for the cluster to agree, then answer the last thing it said.
  *

package/dist/proxmox/ceph-pool-settle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-pool-settle.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool-settle.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,CACrB,KAAK,EAAE,aAAa,KACjB,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,UAAW,aAAa,cAAc,MAAM,YAAY,MAAM,qFAcrF,CAAC;AAEJ;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,UACV,aAAa,QACd,QAAQ,QACR,CAAC,IAAI,EAAE,kBAAkB,GAAG,SAAS,KAAK,OAAO,+GASrD,CAAC"}
+{"version":3,"file":"ceph-pool-settle.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool-settle.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,CACrB,KAAK,EAAE,aAAa,KACjB,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,UAAW,aAAa,cAAc,MAAM,YAAY,MAAM,4IAcrF,CAAC;AAEJ;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,UACV,aAAa,QACd,QAAQ,QACR,CAAC,IAAI,EAAE,kBAAkB,GAAG,SAAS,KAAK,OAAO,+GASrD,CAAC"}

package/dist/proxmox/client.d.ts

@@ -14,7 +14,7 @@
  */
 import * as Effect from 'effect/Effect';
 import * as HttpClient from 'effect/unstable/http/HttpClient';
-import { type ApiTarget, type PveCredential, type PveRole, type PveTarget } from './credentials.ts';
+import type { ApiTarget, PveCredential, PveRole, PveTarget } from './credentials.ts';
 export declare class PveError extends Error {
     readonly status: number;
     readonly method: string;
@@ -60,5 +60,5 @@ export declare const pveEnvelopeWith: (target: PveTarget, credential: PveCredent
  *   node that received the PUT. Any member serves any task path; the privilege skip is keyed on
  *   whether the caller IS the task's owner.
  */
-export declare const pve: <T>(target: ApiTarget, role: PveRole, method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, form?: PveForm) => Effect.Effect<T | undefined, Error, HttpClient.HttpClient>;
+export declare const pve: <T>(target: ApiTarget, role: PveRole, method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, form?: PveForm) => Effect.Effect<T | undefined, Error | import("./credential-errors.ts").PveCredentialDenied, HttpClient.HttpClient>;
 //# sourceMappingURL=client.d.ts.map

package/dist/proxmox/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/proxmox/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EACL,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAC;AAI1B,qBAAa,QAAS,SAAQ,KAAK;IAE/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EAIf;CACF;AAcD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;AA8FjE,uFAAuF;AACvF,eAAO,MAAM,OAAO,GAAI,CAAC,UACf,SAAS,cACL,aAAa,UACjB,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,QACnC,MAAM,SACL,OAAO,kEAgBZ,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAClB,SAAS,cACL,aAAa,UACjB,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,QACnC,MAAM,4EAmBV,CAAC;AAEL;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,UACX,SAAS,QACX,OAAO,UACL,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,QACnC,MAAM,SACL,OAAO,+DAKZ,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/proxmox/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAE9D,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAKrF,qBAAa,QAAS,SAAQ,KAAK;IAE/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EAIf;CACF;AAcD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;AA8FjE,uFAAuF;AACvF,eAAO,MAAM,OAAO,GAAI,CAAC,UACf,SAAS,cACL,aAAa,UACjB,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,QACnC,MAAM,SACL,OAAO,kEAgBZ,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAClB,SAAS,cACL,aAAa,UACjB,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,QACnC,MAAM,4EAmBV,CAAC;AAEL;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,UACX,SAAS,QACX,OAAO,UACL,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,QACnC,MAAM,SACL,OAAO,sHAKZ,CAAC"}

package/dist/proxmox/credential-errors.d.ts

@@ -0,0 +1,27 @@
+import type { PveRole } from './credentials.ts';
+declare const PveCredentialDenied_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PveCredentialDenied";
+} & Readonly<A>;
+/**
+ * OpenBao answered 403 to `GET /v1/<mount>/creds/<role>`: this identity's AppRole has no grant
+ * for `role` on `mount` — measured 2026-09-24 as "the agent lane cannot mint `provision`" (the
+ * lane's policy grants `read` but not `provision`). A TYPED tag, not the plain `Error` every
+ * other mint failure still is (404 no such role/mount, 503 sealed, a network failure), because
+ * this ONE case means "refused, not evidence of anything about the object" — a family's
+ * `readOrUnreadable` (unreadable-read.ts) `catchTag`s exactly this, never any other mint
+ * failure, which stays a hard error precisely because it is NOT a scoped refusal.
+ *
+ * ⛔ WHY NOT EVERY NON-2xx: A 503 (sealed) or a 404 (misconfigured mount/role) is the estate
+ *   BROKEN, not this identity being narrowly scoped — folding those into "unreadable, report
+ *   noop" would hide a real outage behind a quiet, misleadingly reassuring plan. Only 403 is
+ *   "this identity, this role, denied" and safe to read as "cannot see, not evidence of absence".
+ */
+export declare class PveCredentialDenied extends PveCredentialDenied_base<{
+    readonly mount: string;
+    readonly role: PveRole;
+    readonly detail: string;
+}> {
+    get message(): string;
+}
+export {};
+//# sourceMappingURL=credential-errors.d.ts.map

package/dist/proxmox/credential-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-errors.d.ts","sourceRoot":"","sources":["../../src/proxmox/credential-errors.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;;;;AAEhD;;;;;;;;;;;;;GAaG;AACH,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF"}

package/dist/proxmox/credentials.d.ts

@@ -28,8 +28,6 @@
  *   secret that reached an attribute would outlive its 300s lease by months, in four places.
  *   Nothing here returns it to a resource; it is used to build a header and then dropped.
  */
-import * as Effect from 'effect/Effect';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
 /**
  * ★ NO SESSION, ON PURPOSE, AND THIS IS WHAT UNBLOCKED `wip/bao-policy`.
  *   `CommandExecutor.run` requires a `ScopedPlanStatusSession`, and Alchemy gives one to
@@ -114,40 +112,4 @@ export type PveCredential = {
 };
 /** The environment `mint` resolves OpenBao from — `process.env` unless a test passes its own. */
 export type BaoEnvironment = Readonly<Record<string, string | undefined>>;
-/**
- * Mint one credential for `role`: `GET /v1/<mount>/creds/<role>` on OpenBao's HTTP API.
- *
- * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one
- *   client could not disagree with `bao kv get` about what this machine may do. <estate>/openbao then
- *   learned twice what deciding by stderr costs — every failure read as absent, and two commands
- *   said "absent" in different words — so this reads STATUS CODES: 2xx is a credential, and 403
- *   (denied), 404 (no such role or mount — a mint has no "absent"), 503 (sealed) all fail.
- * ★ THE ENVIRONMENT CONTRACT IS STILL THE CLI's, READ THE CLI's WAY, which keeps the case above
- *   true (openbao v2.6.2 api/client.go:34-66, 370, 503-507, 761-762, 776-785): BAO_AGENT_ADDR over
- *   BAO_ADDR over https://127.0.0.1:8200; BAO_NAMESPACE as X-Vault-Namespace; BAO_TOKEN as
- *   X-Vault-Token; X-Vault-Request always. <estate>/openbao/src/bao-address.ts has the long form.
- * ★ AGENT MODE IS NO BAO_TOKEN AND NO TOKEN HEADER. An Agent or Proxy listener with
- *   `api_proxy { use_auto_auth_token = true }` (or the older `cache { … }`) substitutes its
- *   auto-auth token exactly when a request carries none — command/agentproxyshared/cache/handler.go
- *   :29-38, command/agent.go:517-541, command/agent/config/config.go:288-292, and
- *   website/content/docs/agent-and-proxy/agent/apiproxy.mdx:57-62. The CLI's token-file fallback
- *   is deliberately not read. ⚠️ So an unset BAO_TOKEN aimed at a SERVER rather than an agent is a
- *   403, which reads like a missing grant rather than a missing variable.
- * ★ UNIX SOCKETS: `unix:///path` is plain HTTP to `localhost` over that socket, as the CLI does it
- *   (api/client.go:654-667). Bun's fetch takes a `unix` option; `FetchHttpClient.RequestInit` is
- *   Effect's documented way to pass fetch options, read from the calling fiber (effect
- *   FetchHttpClient.ts:59-72). Off Bun it REFUSES, rather than reach http://localhost:80.
- */
-export declare const mint: (target: ApiTarget, role: PveRole, env?: BaoEnvironment) => Effect.Effect<{
-    leaseSeconds: number;
-    secret: string;
-    tokenId: string;
-}, Error, HttpClient.HttpClient>;
-/**
- * The header PVE wants. `PVEAPIToken=<tokenid>=<secret>`.
- *
- * ⚠️ THE SEPARATOR IS `=`, NOT `:`. Proxmox rejects the colon form with a 401 that says only
- *   "authentication failure", which reads as a bad credential rather than as a malformed header.
- */
-export declare const authorization: (credential: PveCredential, target: ApiTarget) => string;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/proxmox/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/proxmox/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D;;;;;;;;;;;;GAYG;AACH,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAM1E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,IAAI,WAAY,SAAS,QAAQ,OAAO,QAAO,cAAc;;;;gCAuFtE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,aAAa,eAAgB,aAAa,UAAU,SAAS,KAAG,MAGf,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/proxmox/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH;;;;;;;;;;;;GAYG;AACH,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC"}

package/dist/proxmox/distilled-guard.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Vendor-constraint guards (constraint-guard.ts) for a distilled-backed family — the seam
+ * acl.ts's own local `guardWrite` established (acl-wire.ts), generalized once a second family
+ * (Group) needed the SAME create/update split `resource.ts`'s `specGuards` (resource-guard.ts)
+ * gives every family still on `client.ts`. `codegen/constraints.ts` scans this package's SOURCE
+ * TEXT for the endpoint-key strings a caller passes here, so a family switching to this helper
+ * changes nothing about which vendor rules apply — same keys, same generated tables.
+ *
+ * ★ WHY `asForm` IS THE ONLY TRANSLATION NEEDED. Distilled's generated request types for every
+ *   PVE form-urlencoded operation are already `Record<string, string | undefined>` — the SAME
+ *   shape `PveForm`/`guardForm` want, minus the `?`. There is no JSON vs form-encoding gap to
+ *   bridge here the way client.ts's `pve()` had to.
+ */
+import type * as Effect from 'effect/Effect';
+import type { EndpointKey } from './constraints.ts';
+/**
+ * Drops non-string fields — distilled's request type carries `?`, `guardForm` wants a plain
+ * form. ⚠️ `body: object`, NOT `Record<string, string | undefined>`: distilled's generated
+ * request types are `interface`s with no index signature, so TypeScript refuses that stricter
+ * parameter type for every one of them ("index signature ... is missing") even though every
+ * field they declare fits it. `object` accepts any of them; the cast below is where the shape
+ * is actually asserted, once, rather than at every call site.
+ */
+export declare const asForm: (body: object) => Record<string, string>;
+/**
+ * `presence`: whether a CREATE is really about to happen (required fields are enforced) or the
+ * form is only being value-checked in passing — see resource-guard.ts's own header on why this
+ * is not "this is the create form" but "a create is really about to happen".
+ */
+export declare const guardWrite: (endpoint: EndpointKey, body: object, presence: boolean) => Effect.Effect<void>;
+//# sourceMappingURL=distilled-guard.d.ts.map

package/dist/proxmox/distilled-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distilled-guard.d.ts","sourceRoot":"","sources":["../../src/proxmox/distilled-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,SAAU,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,UAAU,aACX,WAAW,QACf,MAAM,YACF,OAAO,KAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAgD,CAAC"}