@homeflare/alchemy 0.31.0 → 0.31.1

package/dist/proxmox/distilled-pve.d.ts

@@ -55,6 +55,7 @@ import type * as Duration from 'effect/Duration';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
 import type { ProxmoxOpContext } from '@distilled.cloud/proxmox/Protocol';
+import type { PveCredentialDenied } from './credential-errors.ts';
 import type { PveCredential, PveRole, PveTarget } from './credentials.ts';
 import { type MemberAttempt } from './members.ts';
 /** Every member answered nothing usable — the direct successor to `client.ts`'s `clusterExhausted`. */
@@ -81,9 +82,15 @@ export declare const runPveWith: <A, E>(target: PveTarget, credential: PveCreden
  * resource file calls.
  *
  * ⚠️ `| Error` IN THE RETURN TYPE IS `leased()`'s OWN FAILURE, NOT A NEW ONE THIS FILE ADDS.
- *   `credentials.ts`'s `mint` fails with a plain `Error` (an OpenBao refusal — sealed, denied, no
- *   such role) and was never typed more narrowly there; `pve()` carried the same untyped
- *   possibility before this file existed, just without a signature that said so.
+ *   `mint.ts`'s `mint` fails with a plain `Error` for most refusals (sealed, no such role) and
+ *   was never typed more narrowly there; `pve()` carried the same untyped possibility before
+ *   this file existed, just without a signature that said so.
+ *
+ * ★ `| PveCredentialDenied` IS SPELLED OUT HERE, NOT LEFT TO COLLAPSE INTO `Error`. It IS an
+ *   `Error` subtype (Data.TaggedError), so leaving it out of this union would still typecheck —
+ *   but `Effect.catchTag('PveCredentialDenied', …)` downstream (unreadable-read.ts) needs the
+ *   tag to be STATICALLY visible in the error channel to compile at all, not merely true at
+ *   runtime. Naming it here is what lets a migrated family's `readOrUnreadable` catch it.
  */
-export declare const runPve: <A, E>(target: PveTarget, role: PveRole, isWrite: boolean, op: Effect.Effect<A, E, ProxmoxOpContext>) => Effect.Effect<A, E | Cause.TimeoutError | PveClusterExhausted | Error, HttpClient.HttpClient>;
+export declare const runPve: <A, E>(target: PveTarget, role: PveRole, isWrite: boolean, op: Effect.Effect<A, E, ProxmoxOpContext>) => Effect.Effect<A, E | Cause.TimeoutError | PveClusterExhausted | PveCredentialDenied | Error, HttpClient.HttpClient>;
 //# sourceMappingURL=distilled-pve.d.ts.map

package/dist/proxmox/distilled-pve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distilled-pve.d.ts","sourceRoot":"","sources":["../../src/proxmox/distilled-pve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EAEL,KAAK,aAAa,EAOnB,MAAM,cAAc,CAAC;AAEtB,uGAAuG;AACvG,qBAAa,mBAAoB,SAAQ,KAAK;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE;IAAvD,YAAqB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAGtD;CACF;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,UACrB,SAAS,cACL,aAAa,WAChB,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,YAChC,QAAQ,CAAC,KAAK,KACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,EAAE,UAAU,CAAC,UAAU,CA0BnF,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,CAAC,UACjB,SAAS,QACX,OAAO,WACJ,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,KACxC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,GAAG,KAAK,EAAE,UAAU,CAAC,UAAU,CAI3F,CAAC"}
+{"version":3,"file":"distilled-pve.d.ts","sourceRoot":"","sources":["../../src/proxmox/distilled-pve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EAEL,KAAK,aAAa,EAOnB,MAAM,cAAc,CAAC;AAEtB,uGAAuG;AACvG,qBAAa,mBAAoB,SAAQ,KAAK;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE;IAAvD,YAAqB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAGtD;CACF;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,UACrB,SAAS,cACL,aAAa,WAChB,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,YAChC,QAAQ,CAAC,KAAK,KACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,EAAE,UAAU,CAAC,UAAU,CA0BnF,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,CAAC,UACjB,SAAS,QACX,OAAO,WACJ,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,KACxC,MAAM,CAAC,MAAM,CACd,CAAC,EACD,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,KAAK,EAC1E,UAAU,CAAC,UAAU,CAKnB,CAAC"}

package/dist/proxmox/generated/constraints/index.d.ts

@@ -15,5 +15,5 @@ export declare const PROXMOX_CONSTRAINTS: Readonly<Record<string, EndpointConstr
  * ★ A DIGEST OF THE DATA, NOT OF THE FILE TEXT, so reformatting is not a stale generation while
  *   changing a 128 to a 129 by hand is. `tests/schema-manifest.test.ts` recomputes it.
  */
-export declare const PROXMOX_CONSTRAINTS_DIGEST = "33b42b52d396c9e0";
+export declare const PROXMOX_CONSTRAINTS_DIGEST = "56eba80750ddb1d2";
 //# sourceMappingURL=index.d.ts.map

package/dist/proxmox/generated/constraints/pve-access.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pve-access.d.ts","sourceRoot":"","sources":["../../../../src/proxmox/generated/constraints/pve-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CA8ChF,CAAC"}
+{"version":3,"file":"pve-access.d.ts","sourceRoot":"","sources":["../../../../src/proxmox/generated/constraints/pve-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CA2ChF,CAAC"}

package/dist/proxmox/generated/constraints/pve-cluster-backup.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-ceph.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-firewall.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-ha.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-metrics.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-notifications.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-replication.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-sdn.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-ceph.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-disks.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-lxc.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-network.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-qemu.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-pools.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-storage.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/group-wire.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `Proxmox.Group`'s wire shape: PVE's create/update forms and how a live item becomes
+ * attributes. Split out of group.ts (2026-09-24) to keep that file under the 250-line cap —
+ * the api-token.ts/api-token-form.ts seam, same reasoning as acl.ts/acl-wire.ts.
+ */
+import type * as access from '@distilled.cloud/proxmox/access';
+import type { GroupAttributes, GroupProps } from './group.ts';
+export declare const GROUP_CREATE = "pve:POST /access/groups";
+export declare const GROUP_UPDATE = "pve:PUT /access/groups/{groupid}";
+/**
+ * The comment PVE will actually END UP HOLDING for a given declaration.
+ *
+ * ⛔ PVE CANNOT STORE THE COMMENT `'0'`, AND A PROVIDER THAT DOES NOT MODEL THAT DIFFS FOREVER.
+ *   `create_group`/`write_user_config`/the config parser all test the comment for TRUTH, and in
+ *   Perl the one-character string `'0'` is false. So a declared `comment: '0'` is accepted by the
+ *   API, dropped on the way to `user.cfg`, and read back as absent. Normalising BOTH sides is how
+ *   `values.ts` already treats `''` as the absence of a boolean rather than as `false`.
+ */
+export declare const storedComment: (comment: string | undefined) => string;
+export declare const createForm: (props: GroupProps) => access.CreateAccessGroupRequest;
+/** ⚠️ ALWAYS SENT, EVEN EMPTY — that is how a comment is CLEARED (see group.ts's own header). */
+export declare const updateForm: (props: GroupProps) => access.PutAccessGroupRequest;
+export declare const attributesOf: (live: access.GetAccessGroupResponse, props: GroupProps) => GroupAttributes;
+/**
+ * ⚠️ `members` IS NOT COMPARED, AND NOTHING ELSE IS LEFT TO COMPARE. `comment` is the only field
+ *   a PUT here accepts, so it is the only field whose drift this provider can repair.
+ */
+export declare const matches: (attributes: GroupAttributes, props: GroupProps) => boolean;
+//# sourceMappingURL=group-wire.d.ts.map

package/dist/proxmox/group-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/group-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG9D,eAAO,MAAM,YAAY,4BAA4B,CAAC;AACtD,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAE/D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,YAAa,MAAM,GAAG,SAAS,WAGxD,CAAC;AAQF,eAAO,MAAM,UAAU,UAAW,UAAU,KAAG,MAAM,CAAC,wBAGpD,CAAC;AAEH,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAW,UAAU,KAAG,MAAM,CAAC,qBAGpD,CAAC;AAEH,eAAO,MAAM,YAAY,SACjB,MAAM,CAAC,sBAAsB,SAC5B,UAAU,KAChB,eASD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,eAAe,SAAS,UAAU,YACjB,CAAC"}

package/dist/proxmox/group.d.ts

@@ -22,8 +22,9 @@
  *                                     "users":"hf-provision@pve,hf-read@pve"}, …]
  *     GET /access/groups/hf-mint -> {"comment":"…","members":["hf-provision@pve","hf-read@pve"]}
  *   The index says `users` and hands back a COMMA STRING; the item says `members` and hands back an
- *   ARRAY. A reader that looked for `users` on the item path would find nothing, report an empty
- *   group, and quietly show a delete as harmless.
+ *   ARRAY. distilled's generator reflects the SAME split (`GetAccessGroupResponse.members: string[]`
+ *   vs `ListAccessGroupsResponseBodyItem.users?: string`), so reading the item is what keeps this
+ *   file on the array shape it already normalises.
  *
  * ⛔ AND THE ITEM'S ORDER IS NOT STABLE BETWEEN TWO CONSECUTIVE CALLS. MEASURED, seconds apart, on
  *   the same endpoint:
@@ -38,35 +39,37 @@
  *   exactly `comment` and `members`, so the id comes from props — the same arrangement, and the
  *   same reason, as `user.ts`.
  *
- * ★ PRIVILEGES: NOTHING HAD TO BE WIDENED, WHICH MAKES THIS THE FIRST FAMILY HERE THAT COST
- *   NOTHING. Measured with `pveum user permissions`, 2026-09-13:
+ * ★ PRIVILEGES: NOTHING HAD TO BE WIDENED. Measured with `pveum user permissions`, 2026-09-13:
  *     · item GET checks `['perm','/access/groups',['Sys.Audit','Group.Allocate'], any => 1]`, and
- *       `hf-read@pve` already holds `Sys.Audit` there (propagated from `/` by `PVEAuditor`).
- *       So `readRole` is left at the default `read` — unlike storage/sdn-zone/sdn-vnet, whose ITEM
- *       reads PVE gates on an allocate privilege. See the ⛔ on `readRole` in `resource.ts`.
+ *       `hf-read@pve` already holds `Sys.Audit` there. So `readAttributes` below reads with the
+ *       default `read` role — unlike acl.ts, user.ts and api-token.ts, whose item/list reads PVE
+ *       gates on an allocate privilege the 3600s read lease does not hold.
  *     · POST, PUT and DELETE each check `Group.Allocate` on `/access/groups`, and
  *       `hf-provision@pve` holds it via the provision role (`PROVISION_PRIVILEGES`).
  *
  * ⛔ `retain` BY DEFAULT, BECAUSE DELETING A GROUP DESTROYS TWO THINGS THIS FILE CANNOT PUT BACK.
  *   Measured in `PVE::AccessControl` on the node:
- *     · The member list IS the group. `user.cfg` stores it on the GROUP line (`group:<id>:<users>:
- *       <comment>:`) and DERIVES each user's `groups` map from it at parse time. Deleting the group
- *       deletes the list, and this resource has no `members` prop to restore it from.
+ *     · The member list IS the group. `user.cfg` stores it on the GROUP line and DERIVES each
+ *       user's `groups` map from it at parse time. Deleting the group deletes the list, and this
+ *       resource has no `members` prop to restore it from.
  *     · `delete_group_acl` then walks the whole ACL tree and drops every grant where the group is
  *       the SUBJECT. On this cluster that is `admins -> Administrator on /` and
  *       `automation -> PVEAuditor on /`: whole populations of access, gone in one call, with no
  *       confirmation and nothing in the plan to suggest it.
- *   `delete` is FULLY IMPLEMENTED — `DELETE /access/groups/{groupid}` exists, unlike the ACL
- *   family's — so `.pipe(RemovalPolicy.destroy())` really removes the group. See the ★ in
- *   `resource.ts` for why the policy is a guard rather than a stubbed-out operation.
+ *   `delete` is FULLY IMPLEMENTED — `DELETE /access/groups/{groupid}` exists — so
+ *   `.pipe(RemovalPolicy.destroy())` really removes the group.
  *
- * ⛔ NO SECRET REACHES STATE. A group holds a comment and a list of userids; there is no password,
- *   no token and no key anywhere on these endpoints. `user.ts`'s ⛔ about unencrypted state applies
- *   to this package, and this family simply has nothing to trip it.
+ * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s
+ *   typed `access.getAccessGroup`/`createAccessGroup`/`putAccessGroup`/`deleteAccessGroup`
+ *   (2026-09-24, decision 43's proxmox walk-down, access sub-area, second resource after Acl).
+ *   `distilled-pve.ts`'s `runPve` replaces `pve()` as in acl.ts; the CRIES-WOLF FIX
+ *   (unreadable-read.ts) is wired the same way: a refused `provision` mint on the WRITE-side
+ *   guard, or a refused `read` mint on the plain read, reports `noop` with a warning rather than
+ *   forcing `update` with nothing compared.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 export interface GroupProps extends WithTarget {
     /**
      * PVE's primary key for a group.
@@ -93,12 +96,5 @@ export interface ProxmoxGroup extends Resource<'Proxmox.Group', GroupProps, Grou
 }
 /** ★ `retain` by default — a delete takes the membership and the group's grants. See the header. */
 export declare const ProxmoxGroup: import("alchemy").ResourceClass<ProxmoxGroup>;
-/**
- * ⛔ THE EMPTY `list` IS INHERITED FROM `pveHandlers` AND IT MATTERS HERE. `GET /access/groups`
- *   answers with every group on the cluster — on this one that is `admins`, which grants
- *   `Administrator` on `/` to every human who logs in. Handing it to Alchemy would invite adoption,
- *   and therefore one day a delete that takes the whole admin group's access with it. Adoption
- *   stays an explicit act, here as everywhere else in this package.
- */
 export declare const ProxmoxGroupProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxGroup>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=group.d.ts.map

package/dist/proxmox/group.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/proxmox/group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,UAAU,EACV,eAAe,EACf,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,oGAAoG;AACpG,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAqFH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,kIACkD,CAAC"}
+{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/proxmox/group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAY7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAStE,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,UAAU,EACV,eAAe,EACf,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,oGAAoG;AACpG,eAAO,MAAM,YAAY,+CAEvB,CAAC;AA2BH,eAAO,MAAM,oBAAoB,kIA4E9B,CAAC"}