@homeflare/alchemy 0.31.0 → 0.31.1

package/dist/proxmox/lease-cache.d.ts

@@ -94,5 +94,5 @@ export declare const makeLeases: <E, R>(mintFor: (key: LeaseKey) => Effect.Effec
  * ★ client.ts is the one place that decides to use the cache. `mint` stays exported and unchanged
  *   for the caller that reasons about identity rather than cost — network-apply.ts.
  */
-export declare const leased: (target: ApiTarget, role: PveRole) => Effect.Effect<PveCredential, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const leased: (target: ApiTarget, role: PveRole) => Effect.Effect<PveCredential, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=lease-cache.d.ts.map

package/dist/proxmox/lease-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lease-cache.d.ts","sourceRoot":"","sources":["../../src/proxmox/lease-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,KAAK,OAAO,EAAQ,MAAM,kBAAkB,CAAC;AAe1F;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;CACtC,CAAC;AAQF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,SAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,KAAG,QAAQ,CAAC,QAG3D,CAAC;AAEpB;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,4EACX,CAAC;AASrF;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,WAAY,SAAS,QAAQ,OAAO,8FAA2C,CAAC"}
+{"version":3,"file":"lease-cache.d.ts","sourceRoot":"","sources":["../../src/proxmox/lease-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAgBpF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;CACtC,CAAC;AAQF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,SAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,KAAG,QAAQ,CAAC,QAG3D,CAAC;AAEpB;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,4EACX,CAAC;AASrF;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,WAAY,SAAS,QAAQ,OAAO,qJAA2C,CAAC"}

package/dist/proxmox/lxc-lifecycle.d.ts

@@ -24,7 +24,7 @@
  *   a cached lease can be handed out with 60s left (lease-cache.ts).
  */
 import * as Effect from 'effect/Effect';
-import { type PveTarget } from './credentials.ts';
+import type { PveTarget } from './credentials.ts';
 import { type LxcChange } from './lxc-judge.ts';
 import type { LxcAttributes, LxcProps } from './lxc-props.ts';
 /** A plan-time or apply-time refusal. Nothing was written when one of these is raised. */
@@ -39,10 +39,10 @@ export type LxcWhere = {
 };
 export declare const guestPath: (where: LxcWhere) => string;
 /** The live config, or undefined when no guest holds this vmid anywhere in the cluster. */
-export declare const readLive: (where: LxcWhere) => Effect.Effect<Record<string, unknown> | undefined, Error | LxcRefusedError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readLive: (where: LxcWhere) => Effect.Effect<Record<string, unknown> | undefined, Error | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 export declare const attributesOf: (where: LxcWhere, live: Record<string, unknown>) => LxcAttributes;
 /** POST the create and wait for the template to unpack. ⛔ Refusals are the caller's to check. */
-export declare const createGuest: (props: LxcProps) => Effect.Effect<undefined, Error | LxcRefusedError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const createGuest: (props: LxcProps) => Effect.Effect<undefined, Error | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * Apply a judged change: the config PUT first, then each resize.
  * ⚠️ IN THAT ORDER BECAUSE A MOUNT POINT'S PUT CARRIES ITS LIVE `size=`, and the resize rewrites it.
@@ -53,7 +53,7 @@ export declare const createGuest: (props: LxcProps) => Effect.Effect<undefined,
  *   seen by reconcile's fresh judge instead: a declared key edited meanwhile is written back to the
  *   declaration (even after a plan that warned of nothing), an undeclared one is left alone.
  */
-export declare const updateGuest: (props: LxcProps, change: LxcChange, digest: string) => Effect.Effect<void, Error | LxcRefusedError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const updateGuest: (props: LxcProps, change: LxcChange, digest: string) => Effect.Effect<void, Error | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ⛔ NO `force`, NO `purge`, NO STOP FIRST. PVE refuses to destroy a running or protected guest,
  *   and that refusal is kept: stopping a guest so a delete can proceed is an operator's decision.
@@ -64,5 +64,5 @@ export declare const updateGuest: (props: LxcProps, change: LxcChange, digest: s
  *   first; one that no longer matches is refused with the keys that differ, and deleting it (or
  *   declaring it again) is the operator's call.
  */
-export declare const destroyGuest: (where: LxcWhere, declared: LxcProps) => Effect.Effect<undefined, Error | LxcRefusedError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const destroyGuest: (where: LxcWhere, declared: LxcProps) => Effect.Effect<undefined, Error | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=lxc-lifecycle.d.ts.map

package/dist/proxmox/lxc-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lxc-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,EAAE,KAAK,SAAS,EAAQ,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK9D,0FAA0F;AAC1F,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAkB,IAAI,qBAAqB;CAC5C;AAED,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG,eAAO,MAAM,SAAS,UAAW,QAAQ,WAAoD,CAAC;AAgC9F,2FAA2F;AAC3F,eAAO,MAAM,QAAQ,UAAW,QAAQ,sIAqCpC,CAAC;AAEL,eAAO,MAAM,YAAY,UAAW,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,aAK5E,CAAC;AAgCH,iGAAiG;AACjG,eAAO,MAAM,WAAW,UAAW,QAAQ,4GAmBvC,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,UAAW,QAAQ,UAAU,SAAS,UAAU,MAAM,uGAyB1E,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,UAAW,QAAQ,YAAY,QAAQ,4GAe5D,CAAC"}
+{"version":3,"file":"lxc-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK9D,0FAA0F;AAC1F,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAkB,IAAI,qBAAqB;CAC5C;AAED,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG,eAAO,MAAM,SAAS,UAAW,QAAQ,WAAoD,CAAC;AAgC9F,2FAA2F;AAC3F,eAAO,MAAM,QAAQ,UAAW,QAAQ,6LAqCpC,CAAC;AAEL,eAAO,MAAM,YAAY,UAAW,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,aAK5E,CAAC;AAgCH,iGAAiG;AACjG,eAAO,MAAM,WAAW,UAAW,QAAQ,mKAmBvC,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,UAAW,QAAQ,UAAU,SAAS,UAAU,MAAM,8JAyB1E,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,UAAW,QAAQ,YAAY,QAAQ,mKAe5D,CAAC"}

package/dist/proxmox/mint.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Minting one PVE/PBS credential from OpenBao: `GET /v1/<mount>/creds/<role>`, alive for five
+ * minutes. Split out of `credentials.ts` (2026-09-24) to keep that file's TYPES under the
+ * 250-line cap once `PveCredentialDenied`'s catchers needed a real header there; the reasoning
+ * for WHY the estate mints rather than stores a token is still credentials.ts's own header.
+ *
+ * ⛔ THE SECRET NEVER TOUCHES DISK, A LOG, OR ALCHEMY STATE — see credentials.ts's ⛔. Nothing
+ *   here returns it to a resource; it is used to build a header and then dropped.
+ */
+import * as Effect from 'effect/Effect';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
+import { PveCredentialDenied } from './credential-errors.ts';
+import type { ApiTarget, BaoEnvironment, PveCredential, PveRole } from './credentials.ts';
+/**
+ * Mint one credential for `role`: `GET /v1/<mount>/creds/<role>` on OpenBao's HTTP API.
+ *
+ * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one
+ *   client could not disagree with `bao kv get` about what this machine may do. <estate>/openbao then
+ *   learned twice what deciding by stderr costs — every failure read as absent, and two commands
+ *   said "absent" in different words — so this reads STATUS CODES: 2xx is a credential, and 403
+ *   (denied), 404 (no such role or mount — a mint has no "absent"), 503 (sealed) all fail.
+ * ★ THE ENVIRONMENT CONTRACT IS STILL THE CLI's, READ THE CLI's WAY, which keeps the case above
+ *   true (openbao v2.6.2 api/client.go:34-66, 370, 503-507, 761-762, 776-785): BAO_AGENT_ADDR over
+ *   BAO_ADDR over https://127.0.0.1:8200; BAO_NAMESPACE as X-Vault-Namespace; BAO_TOKEN as
+ *   X-Vault-Token; X-Vault-Request always. <estate>/openbao/src/bao-address.ts has the long form.
+ * ★ AGENT MODE IS NO BAO_TOKEN AND NO TOKEN HEADER. An Agent or Proxy listener with
+ *   `api_proxy { use_auto_auth_token = true }` (or the older `cache { … }`) substitutes its
+ *   auto-auth token exactly when a request carries none — command/agentproxyshared/cache/handler.go
+ *   :29-38, command/agent.go:517-541, command/agent/config/config.go:288-292, and
+ *   website/content/docs/agent-and-proxy/agent/apiproxy.mdx:57-62. The CLI's token-file fallback
+ *   is deliberately not read. ⚠️ So an unset BAO_TOKEN aimed at a SERVER rather than an agent is a
+ *   403, which reads like a missing grant rather than a missing variable.
+ * ★ UNIX SOCKETS: `unix:///path` is plain HTTP to `localhost` over that socket, as the CLI does it
+ *   (api/client.go:654-667). Bun's fetch takes a `unix` option; `FetchHttpClient.RequestInit` is
+ *   Effect's documented way to pass fetch options, read from the calling fiber (effect
+ *   FetchHttpClient.ts:59-72). Off Bun it REFUSES, rather than reach http://localhost:80.
+ */
+export declare const mint: (target: ApiTarget, role: PveRole, env?: BaoEnvironment) => Effect.Effect<{
+    leaseSeconds: number;
+    secret: string;
+    tokenId: string;
+}, Error | PveCredentialDenied, HttpClient.HttpClient>;
+/**
+ * The header PVE wants. `PVEAPIToken=<tokenid>=<secret>`.
+ *
+ * ⚠️ THE SEPARATOR IS `=`, NOT `:`. Proxmox rejects the colon form with a 401 that says only
+ *   "authentication failure", which reads as a bad credential rather than as a malformed header.
+ */
+export declare const authorization: (credential: PveCredential, target: ApiTarget) => string;
+//# sourceMappingURL=mint.d.ts.map

package/dist/proxmox/mint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint.d.ts","sourceRoot":"","sources":["../../src/proxmox/mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAM1F;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,IAAI,WAAY,SAAS,QAAQ,OAAO,QAAO,cAAc;;;;sDAoGtE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,aAAa,eAAgB,aAAa,UAAU,SAAS,KAAG,MAGf,CAAC"}

package/dist/proxmox/network-apply-read.d.ts

@@ -54,7 +54,7 @@ export type ClusterHealth = {
  */
 export declare const pendingLines: (diff: string) => number;
 /** How many staged lines this node is carrying. Zero is the only settled value. */
-export declare const pendingCount: (target: PveTarget, node: string) => Effect.Effect<number, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const pendingCount: (target: PveTarget, node: string) => Effect.Effect<number, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * Why the cluster is not healthy, or `undefined` when it is.
  *
@@ -69,7 +69,7 @@ export declare const pendingCount: (target: PveTarget, node: string) => Effect.E
  *   pools losing min_size; reloading another node's networking while it is out is the move that
  *   completes the outage. Bring it back, or apply by hand with the cluster in front of you.
  */
-export declare const degradedReason: (target: PveTarget) => Effect.Effect<string | undefined, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const degradedReason: (target: PveTarget) => Effect.Effect<string | undefined, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ⛔ NOT AN EXITSTATUS PVE CAN RETURN, AND THAT IS THE POINT. The caller compares against `'OK'`;
  *   these two say WHY the answer is not OK without needing a second branch for "we do not know".

package/dist/proxmox/network-apply-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-apply-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAatE,oGAAoG;AACpG,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AA0B7E;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,WAWxC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,WAAY,SAAS,QAAQ,MAAM,uFACH,CAAC;AAiC1D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,WAAY,SAAS,mGAO7C,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,0FACiE,CAAC;AAY1F;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS,WACZ,SAAS,cACL,aAAa,QACnB,MAAM,QACN,MAAM,aAEF,MAAM,uFAgCd,CAAC"}
+{"version":3,"file":"network-apply-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAatE,oGAAoG;AACpG,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AA0B7E;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,WAWxC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,WAAY,SAAS,QAAQ,MAAM,8IACH,CAAC;AAiC1D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,WAAY,SAAS,0JAO7C,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,0FACiE,CAAC;AAY1F;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS,WACZ,SAAS,cACL,aAAa,QACnB,MAAM,QACN,MAAM,aAEF,MAAM,uFAgCd,CAAC"}

package/dist/proxmox/pbs-notification-target-lifecycle.d.ts

@@ -91,10 +91,10 @@ export declare const handlers: {
         header: string;
         headerDigest: string;
         secret: string;
-    }, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+    }, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
     delete: ({ olds }: {
         olds: Props;
-    }) => Effect.Effect<unknown, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<unknown, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 };
 export {};
 //# sourceMappingURL=pbs-notification-target-lifecycle.d.ts.map

package/dist/proxmox/pbs-sync-job-form.d.ts

@@ -75,9 +75,9 @@ export declare const handlers: {
     } | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
     reconcile: ({ news }: {
         news: SyncJobProps;
-    }) => import("effect/Effect").Effect<SyncJobAttributes, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => import("effect/Effect").Effect<SyncJobAttributes, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
     delete: ({ olds }: {
         olds: SyncJobProps;
-    }) => import("effect/Effect").Effect<unknown, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => import("effect/Effect").Effect<unknown, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 };
 //# sourceMappingURL=pbs-sync-job-form.d.ts.map

package/dist/proxmox/provision-cli-fake.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provision-cli-fake.d.ts","sourceRoot":"","sources":["../../src/proxmox/provision-cli-fake.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,OAAO,GAAG;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,EAAE,QAAQ,EAAE,CAAC;CACjB,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,YAAY,QAAO,QAc9B,CAAC;AAIH,mGAAmG;AACnG,eAAO,MAAM,OAAO,UAAW,QAAQ,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAsB/D,CAAC;AA0FF,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,QAAQ,CAAC;CACjB,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,SAAS,WAAkB,MAAM,SAAS,QAAQ,KAAG,OAAO,CAAC,SAAS,CAkClF,CAAC"}
+{"version":3,"file":"provision-cli-fake.d.ts","sourceRoot":"","sources":["../../src/proxmox/provision-cli-fake.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,OAAO,GAAG;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,EAAE,QAAQ,EAAE,CAAC;CACjB,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,YAAY,QAAO,QAc9B,CAAC;AAIH,mGAAmG;AACnG,eAAO,MAAM,OAAO,UAAW,QAAQ,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAiC/D,CAAC;AA0FF,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,QAAQ,CAAC;CACjB,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,SAAS,WAAkB,MAAM,SAAS,QAAQ,KAAG,OAAO,CAAC,SAAS,CAkClF,CAAC"}

package/dist/proxmox/resource.d.ts

@@ -19,13 +19,13 @@ export declare const pveOperations: <Props extends WithApiTarget, Attributes>(sp
     } | {
         readonly action: 'replace';
     } | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
-    reconcile: (news: Props) => Effect.Effect<Attributes & ({} | null), Error, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (news: Props) => Effect.Effect<Attributes & ({} | null), Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
     /**
      * ⚠️ PVE REFUSES TO DELETE THINGS THAT ARE STILL IN USE — a pool holding guests, a storage with
      *   volumes. That refusal is the cluster declining to orphan something because a line left a
      *   file, so it is surfaced as-is rather than retried with a force flag.
      */
-    destroy: (olds: Props) => Effect.Effect<unknown, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+    destroy: (olds: Props) => Effect.Effect<unknown, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 };
 /**
  * The five provider handlers for a spec'd PVE object, wired once.
@@ -77,9 +77,9 @@ export declare const pveHandlers: <Props extends WithApiTarget, Attributes exten
     } | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
     reconcile: ({ news }: {
         news: Props;
-    }) => Effect.Effect<Attributes, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<Attributes, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
     delete: ({ olds }: {
         olds: Props;
-    }) => Effect.Effect<unknown, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<unknown, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 };
 //# sourceMappingURL=resource.d.ts.map

package/dist/proxmox/role-wire.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `Proxmox.Role`'s wire shape: PVE's create/update forms and how a live list row becomes
+ * attributes. Split out of role.ts (2026-09-24, the distilled migration) to keep that file
+ * under the 250-line cap — the api-token.ts/api-token-form.ts seam.
+ */
+import type * as access from '@distilled.cloud/proxmox/access';
+import type { RoleAttributes, RoleProps } from './role.ts';
+export declare const ROLE_CREATE = "pve:POST /access/roles";
+export declare const ROLE_UPDATE = "pve:PUT /access/roles/{roleid}";
+/**
+ * The only shape two privilege sets may be compared in: sorted, de-duplicated, blanks dropped.
+ *
+ * ⚠️ THE TRIM AND THE EMPTY FILTER ARE NOT DECORATION. `'A,B,'.split(',')` yields a trailing `''`,
+ *   and a hand-written list is quite likely to carry a stray space after a comma. Either one turns
+ *   into a phantom member that no live answer can contain, so `matches` would be false on every
+ *   plan and the deploy would rewrite the role to exactly what it already was.
+ */
+export declare const canonical: (privs: readonly string[]) => string[];
+export declare const createForm: (props: RoleProps) => access.CreateAccessRoleRequest;
+/**
+ * ⚠️ NO `append` FIELD, DELIBERATELY. Sending `append=1` would make every update additive, so a
+ *   privilege could be granted from here but never taken away — see role.ts's own header.
+ */
+export declare const updateForm: (props: RoleProps) => access.PutAccessRoleRequest;
+export declare const find: (rows: readonly access.ListAccessRolesResponseBodyItem[], roleid: string) => access.ListAccessRolesResponseBodyItem | undefined;
+export declare const attributesOf: (row: access.ListAccessRolesResponseBodyItem, props: RoleProps) => RoleAttributes;
+export declare const matches: (attributes: RoleAttributes, props: RoleProps) => boolean;
+//# sourceMappingURL=role-wire.d.ts.map

package/dist/proxmox/role-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/role-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3D,eAAO,MAAM,WAAW,2BAA2B,CAAC;AACpD,eAAO,MAAM,WAAW,mCAAmC,CAAC;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,UAAW,SAAS,MAAM,EAAE,KAAG,MAAM,EAC8B,CAAC;AAE1F,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,uBAGnD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,oBAGnD,CAAC;AAEH,eAAO,MAAM,IAAI,SAAU,SAAS,MAAM,CAAC,+BAA+B,EAAE,UAAU,MAAM,uDACjD,CAAC;AAE5C,eAAO,MAAM,YAAY,QAClB,MAAM,CAAC,+BAA+B,SACpC,SAAS,KACf,cAGD,CAAC;AAEH,eAAO,MAAM,OAAO,eAAgB,cAAc,SAAS,SAAS,YACQ,CAAC"}

package/dist/proxmox/role.d.ts

@@ -2,53 +2,54 @@
  * `Proxmox.Role` — a PVE role: one name, one set of privileges. The object every other resource
  * in this package stands on, because a role is what the provision credential actually holds.
  *
- * ★ THIS IS WHERE pool.ts's ⚠️ STOPS BEING A MEMORY. That file records, in prose, that the
- *   provision role lacked `Pool.Allocate`, that reconcile answered "Permission check failed", and
- *   that a human widened the role over SSH with `pveum role modify`. Prose cannot be planned
- *   against: it goes stale the first time somebody edits the role in the UI and tells nobody.
- *   Declared here, the same fact is a diff — the privileges the role is SUPPOSED to hold are read
- *   off the cluster on every plan, and a hand edit shows up as `1 to update` rather than as a 403
- *   six weeks later in the middle of something else.
- *
- * ⛔ THE INDEX AND THE ITEM DISAGREE ABOUT WHAT `privs` IS, AND MISSING THAT COSTS A DIFF THAT
- *   NEVER CONVERGES. `GET /access/roles` (the index) reports each role's privileges as a COMMA
- *   STRING. `GET /access/roles/{roleid}` — the path this resource reads — returns a privilege MAP
- *   instead, `{"VM.Allocate":1,"Sys.Audit":1,…}`, and its key order is a Perl hash's order, so it
- *   is not stable between two calls to the same endpoint. Compare the raw string, or the raw
- *   object, or the keys in the order they arrived, and every plan reports an update forever.
- *   `canonical` below is the whole answer: both sides become a sorted, de-duplicated set before
- *   anything is compared, and `attributes` STORES the sorted form so Alchemy's state does not
- *   churn either.
+ * ★ THIS IS WHERE pool.ts's ⚠️ STOPS BEING A MEMORY. Declared here, a hand edit shows up as
+ *   `1 to update` rather than as a 403 six weeks later in the middle of something else.
  *
  * ⚠️ A DECLARATION REPLACES THE PRIVILEGE SET; IT DOES NOT ADD TO IT. `PUT /access/roles/{roleid}`
- *   accepts an `append` flag and this resource deliberately never sends it — with append a role
- *   could only ever grow, so `matches` would report an update forever whenever props were a subset
- *   of live, which is the same perpetual diff by a different road. The consequence is the one that
- *   bites: anything a human added by hand is REVOKED on the next deploy unless it is in `privs`.
- *   Copy the live set out of `pveum role list` before declaring a role that already exists; do not
- *   type it from memory.
+ *   accepts an `append` flag and this resource deliberately never sends it (role-wire.ts) — with
+ *   append a role could only ever grow, the same perpetual diff by a different road. The
+ *   consequence: anything a human added by hand is REVOKED on the next deploy unless it is in
+ *   `privs`. Copy the live set out of `pveum role list` before declaring a role that already
+ *   exists; do not type it from memory.
  *
  * ⛔ A ROLE CAN LOCK ITS OWN PROVIDER OUT, AND NOTHING IN THIS PACKAGE CAN UNDO IT. Reconcile runs
  *   as the provision credential, and that credential holds a role. Declare THAT role without the
  *   privileges the provider needs — `Sys.Modify` on `/access` above all — and the write succeeds,
  *   after which every later plan reads 403 and the repair has to happen out of band as `root@pam`
- *   over SSH. It is a one-way door, which is why the privileges a reconcile needs are written
- *   down at the bottom of this comment rather than left to be rediscovered from an error message.
+ *   over SSH.
  *
  * ⚠️ PVE REFUSES TO EDIT ITS OWN BUILT-IN ROLES (`Administrator`, `NoAccess`, the `PVE*` set), and
- *   the item endpoint gives no sign of which those are — only the index carries the `special`
- *   flag. A declaration aimed at a built-in role therefore READS BACK CLEANLY and fails at write
- *   time, which reads like a broken provider rather than like a refusal. Declare roles you own.
+ *   the LIST read (below) DOES carry the `special` flag that marks them, unlike the item endpoint
+ *   this file used before the distilled migration — `role-wire.ts`'s `attributesOf` does not use
+ *   it, but a caller reading `list`'s own answer could. A declaration aimed at a built-in role
+ *   still reads back cleanly and fails at write time. Declare roles you own.
  *
  * ★ PRIVILEGES A RECONCILE NEEDS: `Sys.Audit` on `/access` to read and diff, `Sys.Modify` on
- *   `/access` to create, update or delete. Not `Permissions.Modify` — binding a role to a user is
- *   `/access/acl`, a different object, and nothing here writes it. An auditor-shaped credential
- *   can already PLAN this resource and cannot DEPLOY it, which is the honest failure: the plan is
- *   true and the deploy says exactly which privilege is missing.
+ *   `/access` to create, update or delete. Not `Permissions.Modify` — that is a different object.
+ *
+ * ★ READ VIA THE LIST, NOT THE ITEM — A DELIBERATE CHANGE FROM THE PRE-MIGRATION CODE, AND THE
+ *   REASON IS THE ITEM'S OWN GENERATED SCHEMA. `access.getAccessRole`'s response
+ *   (`GetAccessRoleResponse`) enumerates a FIXED list of ~47 known privilege field names
+ *   (`Sys_Modify`, `VM_Allocate`, …), each its own optional property — MEASURED in
+ *   `@distilled.cloud/proxmox`'s generated `access.ts`. A privilege this package's generator did
+ *   not know about would silently not appear as a field at all, and this file's old `privs: []`
+ *   reconstruction would drop it from state without a diff ever seeing the loss. The LIST read
+ *   (`access.listAccessRoles`) answers `privs` as the SAME plain comma string PVE's item read
+ *   also disagreed with the index about pre-migration — a shape with no fixed enumeration to fall
+ *   behind. `find` below (role-wire.ts) does the item-read's old job client-side.
+ * ⚠️ REASONED, NOT MEASURED, THAT THE LIST READ NEEDS NO MORE THAN `read`'s AUDITOR SHAPE. The
+ *   item read's own privilege check (`Sys.Audit` on `/access`) was measured; the list's was not
+ *   separately checked, but PVE's own convention is that an index read is never MORE restrictive
+ *   than its item. `readRole` stays at the default `read` on that basis, same as before.
+ *
+ * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s
+ *   typed `access.listAccessRoles`/`createAccessRole`/`putAccessRole`/`deleteAccessRole`
+ *   (2026-09-24, decision 43's proxmox walk-down). `distilled-pve.ts`'s `runPve` replaces
+ *   `pve()`; the cries-wolf fix is wired the same way as acl.ts, group.ts and user.ts.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 export interface RoleProps extends WithTarget {
     /**
      * PVE's primary key for a role.
@@ -60,13 +61,11 @@ export interface RoleProps extends WithTarget {
     roleid: string;
     /**
      * The COMPLETE privilege set, e.g. `['VM.Allocate', 'VM.Audit', 'Sys.Audit']`. Order and
-     * duplicates do not matter — see the ⛔ in the header — but completeness does: this list is the
+     * duplicates do not matter — see the header — but completeness does: this list is the
      * role, not an addition to it.
      *
      * ⚠️ DECLARE AT LEAST ONE. A role with no privileges grants nothing and reads back as an empty
-     *   document, which is the one shape the factory cannot tell apart from an object that is not
-     *   there — reconcile would then refuse with its "the write returned no error but the object is
-     *   still absent" message, which is true of the read and misleading about the cause.
+     *   document, which reconcile cannot tell apart from an object that is not there.
      */
     privs: string[];
 }
@@ -78,20 +77,5 @@ export interface RoleAttributes {
 export interface ProxmoxRole extends Resource<'Proxmox.Role', RoleProps, RoleAttributes, never, PveRequirements> {
 }
 export declare const ProxmoxRole: import("alchemy").ResourceClass<ProxmoxRole>;
-/**
-* ⛔ AN EMPTY LIST, AND NOWHERE DOES IT MATTER MORE. `GET /access/roles` returns every
-*   role on the cluster, PVE's own built-ins included. Returning them would invite Alchemy
-*   to adopt `Administrator` — and therefore one day to narrow or delete it. Adoption is
-*   an explicit act, here as everywhere else in this package.
- 
- *
-* ⛔ DO NOT CARRY THE FACTORY'S REASSURANCE OVER TO THIS ONE. `destroy` there notes that
-*   PVE refuses to delete things still in use — a pool holding guests, a storage with
-*   volumes — and a role is NOT protected that way. Whoever is bound to the role loses
-*   those privileges the moment it goes, and the credential this provider runs with is
-*   bound through exactly such a binding. Checking who holds a role before removing it is
-*   an operator's job, and it is not done here on their behalf while they read a diff.
- 
- */
 export declare const ProxmoxRoleProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxRole>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=role.d.ts.map

package/dist/proxmox/role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/proxmox/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAyDjE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/proxmox/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAa7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAStE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAiBjE,eAAO,MAAM,mBAAmB,iIA+E7B,CAAC"}

package/dist/proxmox/sdn-apply-read.d.ts

@@ -76,5 +76,5 @@ export declare const canonical: (value: unknown) => string;
  *   Alchemy always calls it the first time a resource appears — and `PUT /cluster/sdn` regenerates
  *   `/etc/network/interfaces.d/sdn` on every node. On C1 that file carries Ceph's cluster network.
  */
-export declare const sdnPendingCount: (target: PveTarget) => Effect.Effect<number, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const sdnPendingCount: (target: PveTarget) => Effect.Effect<number, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=sdn-apply-read.d.ts.map

package/dist/proxmox/sdn-apply-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdn-apply-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-apply-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAwBlD;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,YAAI,mBAAmB,EAAE,iBAAiB,CAAU,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,UAAW,OAAO,KAAG,OACE,CAAC;AAqBpD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,WACf,MAAM,GAAG,SAAS,WACjB,MAAM,GAAG,SAAS,KAC1B,MAAM,GAAG,cAIX,CAAC;AAuCF,+FAA+F;AAC/F,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,MAAyC,CAAC;AAiBrF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAAY,SAAS,uFAG9C,CAAC"}
+{"version":3,"file":"sdn-apply-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-apply-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAwBlD;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,YAAI,mBAAmB,EAAE,iBAAiB,CAAU,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,UAAW,OAAO,KAAG,OACE,CAAC;AAqBpD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,WACf,MAAM,GAAG,SAAS,WACjB,MAAM,GAAG,SAAS,KAC1B,MAAM,GAAG,cAIX,CAAC;AAuCF,+FAA+F;AAC/F,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,MAAyC,CAAC;AAiBrF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAAY,SAAS,8IAG9C,CAAC"}

package/dist/proxmox/unreadable-read.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The "unreadable" outcome a refused read produces — distinct from `undefined` (genuinely
+ * absent) and from a real attributes object (present) — so `diff` stops treating a REFUSED read
+ * the same as a confirmed-gone one. Fixes the "cries wolf" bug (measured 2026-09-24): on a lane
+ * whose credential cannot mint `provision`, every already-correct ACL and storage row read back
+ * as absent, and `diff` forced `update` for every one of them without comparing a single field,
+ * because `.pipe(Effect.orElseSucceed(() => undefined))` folds every failure — a genuine 404, a
+ * network blip, AND a permission refusal — into the one "absent" value `diff` cannot tell apart.
+ *
+ * ★ WHY A SENTINEL, NOT A FAILED `diff`. Upstream's `Diff` type is exactly
+ *   `NoopDiff | UpdateDiff | ReplaceDiff` (`packages/alchemy/src/Diff.ts@v2.0.0-beta.79`) — there
+ *   is no fourth "unreadable" action to return. And `Plan.ts`'s resource pass runs every
+ *   resource's `diff` under `Effect.exit`, then FAILS THE WHOLE PLAN if even one failed
+ *   (`diffFailures.length > 0` -> `Effect.failCause`, `Plan.ts@v2.0.0-beta.79` ~lines 1711-1731).
+ *   So making `diff` FAIL on a refused read would not report one honest row — it would abort
+ *   `bun run plan` for every OTHER resource in the stack too, worse than today's false "update".
+ *   `{ action: 'noop' }` plus a logged warning is the only outcome that (a) never forces a write
+ *   on a lane that cannot prove one is needed and (b) never takes the rest of the plan down with
+ *   it — the "noop-with-warning" reading of the fix, over the alternative of a typed plan error.
+ *
+ * ⛔ ONLY THE CREDENTIAL DENIAL IS CAUGHT HERE. Every other read failure (a genuine
+ *   `Cause.TimeoutError`, `PveClusterExhausted`, a network error) keeps folding into `undefined`
+ *   exactly as it always has — this narrows ONE typed tag out of that fold, via `catchTag`, and
+ *   changes nothing else about it. See credential-errors.ts's own ⛔ for why 403 alone qualifies.
+ */
+import * as Effect from 'effect/Effect';
+import type { PveCredentialDenied } from './credential-errors.ts';
+/** Distinct from `undefined` (absent) and from a real attributes object (present). */
+export declare const UNREADABLE: unique symbol;
+export type Unreadable = typeof UNREADABLE;
+/**
+ * Catches ONLY `PveCredentialDenied` and turns it into the sentinel, so a caller that also
+ * `.pipe(Effect.orElseSucceed(() => undefined))` for every OTHER failure never conflates a
+ * refusal with a genuine absence. Compose this INSIDE that fold, never after it.
+ *
+ * ⚠️ `E | PveCredentialDenied` IN, `E` OUT — not a generic `E` narrowed by `Exclude`. `catchTag`
+ *   needs the tag to be STATICALLY present in the error union to typecheck at all; a bare
+ *   unconstrained `E` gives it nothing to match against. Every caller's `runPve` already carries
+ *   `PveCredentialDenied` explicitly (distilled-pve.ts's own ★ on why), so this signature costs
+ *   nothing at the call site.
+ */
+export declare const readOrUnreadable: <A, E, R>(effect: Effect.Effect<A, E | PveCredentialDenied, R>) => Effect.Effect<A | Unreadable, E, R>;
+/**
+ * The warning `diff` logs when it reports `noop` for a row it could not actually read — visible
+ * in `bun run plan`'s own output (Effect's default logger), even though the Diff type has
+ * nowhere to carry the distinction through to the printed action. See the header for why a log
+ * line, not a failed diff or a fourth Diff action, is what "the plan reports" means here.
+ */
+export declare const unreadableWarning: (type: string, identity: string) => Effect.Effect<void>;
+//# sourceMappingURL=unreadable-read.d.ts.map

package/dist/proxmox/unreadable-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unreadable-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/unreadable-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,sFAAsF;AACtF,eAAO,MAAM,UAAU,eAA2B,CAAC;AACnD,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,UAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,CAAC,KACnD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,CAAC,CACkD,CAAC;AAExF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,SAAU,MAAM,YAAY,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAKlF,CAAC"}

package/dist/proxmox/user-wire.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `Proxmox.User`'s wire shape: PVE's create/update forms and how a live item becomes
+ * attributes. Split out of user.ts (2026-09-24, the distilled migration) to keep that file
+ * under the 250-line cap — the api-token.ts/api-token-form.ts seam.
+ */
+import type * as access from '@distilled.cloud/proxmox/access';
+import type { UserAttributes, UserProps } from './user.ts';
+export declare const USER_CREATE = "pve:POST /access/users";
+export declare const USER_UPDATE = "pve:PUT /access/users/{userid}";
+export declare const createForm: (props: UserProps) => access.CreateAccessUserRequest;
+export declare const updateForm: (props: UserProps) => access.PutAccessUserRequest;
+export declare const attributesOf: (live: access.GetAccessUserResponse, props: UserProps) => UserAttributes;
+/**
+ * ⚠️ `tokens` IS NOT COMPARED, and neither is anything create-only. What is compared is exactly
+ *   what a PUT can put back; a field PVE reports but will not accept is drift nobody can fix.
+ */
+export declare const matches: (attributes: UserAttributes, props: UserProps) => boolean;
+//# sourceMappingURL=user-wire.d.ts.map

package/dist/proxmox/user-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/user-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3D,eAAO,MAAM,WAAW,2BAA2B,CAAC;AACpD,eAAO,MAAM,WAAW,mCAAmC,CAAC;AA2D5D,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,uBAGnD,CAAC;AAEH,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,oBAGnD,CAAC;AAEH,eAAO,MAAM,YAAY,SACjB,MAAM,CAAC,qBAAqB,SAC3B,SAAS,KACf,cAgBD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,cAAc,SAAS,SAAS,YAOF,CAAC"}

package/dist/proxmox/user.d.ts

@@ -2,7 +2,7 @@
  * `Proxmox.User` — a PVE account. The identity every other resource in this package borrows.
  *
  * ★ THIS IS THE ONE OBJECT THAT CAN CUT THE BRANCH IT SITS ON. The user the credential mount vends
- *   tokens for, and the group whose members are allowed to mint, are what `src/credentials.ts`
+ *   tokens for, and the group whose members are allowed to mint, are what `credentials.ts`
  *   ultimately asks OpenBao for. A cluster rebuilt without them cannot plan ANY resource here —
  *   including the plan that would recreate them, which needs a credential to run. So this resource
  *   is drift repair for an account that already exists (comment, email, enable, expire, groups),
@@ -18,37 +18,43 @@
  *
  * ⚠️ `groups` COMES BACK AS AN ARRAY AND GOES OUT AS A COMMA STRING, and the asymmetry is the whole
  *   trap. GET answers `["a","b"]`, POST/PUT want `a,b`, and PVE returns the list in ITS order, not
- *   the declared one. Compared naively, `matches` reads ['b','a'] against 'a,b' and every plan for
- *   the rest of time says "1 to update". Both sides are normalised to a sorted, deduplicated set
- *   below. Joining is a safe comparison precisely because a group id cannot contain a comma — the
- *   wire format is comma-separated, so PVE refuses one.
+ *   the declared one. Both sides are normalised to a sorted, deduplicated set — see user-wire.ts.
  *
  * ⚠️ `tokens` IS NESTED AND IS NOT SETTABLE THROUGH THIS ENDPOINT. The read hands back a map of the
  *   account's API tokens; `PUT /access/users/{userid}` has no parameter for them, because they are
- *   their own objects under `.../token/{tokenid}`. So they are reported as an attribute — a plan
- *   can then say what a delete would take with it — and kept OUT of `matches`, exactly like
- *   `pool.members`. Reported, never declared.
+ *   their own objects under `.../token/{tokenid}` (api-token.ts). So they are reported as an
+ *   attribute and kept OUT of `matches`, exactly like `pool.members`. Reported, never declared.
  *
  * ⚠️ RECONCILE NEEDS PRIVILEGES A GUEST-ONLY ROLE DOES NOT HOLD, so they are stated rather than met
- *   as a 403 in the middle of a deploy (pool.ts records how that went the last time).
- *   `PROVISION_PRIVILEGES` (provision-baseline.ts) carries every one of them:
+ *   as a 403 in the middle of a deploy. `PROVISION_PRIVILEGES` (provision-baseline.ts) carries:
  *     · `Realm.AllocateUser` on `/access/realm/<realm>` — create and delete.
  *     · `User.Modify` on `/access/groups`, and on `/access/groups/<group>` for EVERY group named in
  *       `groups` — create, update and delete. PVE checks the groups you are granting, not just the
- *       user, so a role wide enough to edit the account can still be refused for one group in the
- *       list.
+ *       user, so a role wide enough to edit the account can still be refused for one group.
  *     · `Sys.Audit` (or `User.Modify`) for the read, which the `read` role's auditor already has.
- *   `Permissions.Modify` is NOT on this list: that governs ACL entries, which are a different PVE
- *   object and would be a different resource here.
  *
- * ⚠️ A MISSING USER IS A 500, NOT A 404 — "no such user ('x@pve')" — and the factory turns any
- *   failed read into "absent". A 403 therefore also reads as absent, and the honest error arrives
- *   one step later, from the create: "Permission check failed (/access/groups, User.Modify)". That
- *   string is the one to grep for when a plan insists on creating an account that plainly exists.
+ * ⚠️ A MISSING USER IS A 500, NOT A 404 — "no such user ('x@pve')". distilled turns that into an
+ *   `UnknownProxmoxError` (protocol.ts), and `readOrUnreadable`'s own `orElseSucceed` folds it
+ *   into "absent" same as the old hand-rolled client did. A 403 therefore also reads as absent
+ *   UNLESS it is the one refusal `readOrUnreadable` catches (unreadable-read.ts): a REFUSED
+ *   `provision` mint, the cries-wolf case. Any other refusal still reads as absent, and the
+ *   honest error arrives one step later, from the create.
+ *
+ * ⚠️ THE WIRE URL FOR THIS FAMILY CHANGED, THOUGH NOTHING A CALLER SEES DID. MEASURED
+ *   (user.test.ts): distilled's `{userid}` label substitution percent-encodes it —
+ *   `iac@pve` -> `.../access/users/iac%40pve` — where `client.ts`'s plain string concatenation
+ *   sent the `@` literally. A real PVE (any HTTP server) decodes both the same way, so this is
+ *   not a behaviour change a stack observes; a fake in a test has to decode it, `client.ts`'s
+ *   own fixtures never had to.
+ *
+ * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s
+ *   typed `access.getAccessUser`/`createAccessUser`/`putAccessUser`/`deleteAccessUser`
+ *   (2026-09-24, decision 43's proxmox walk-down, access sub-area). `distilled-pve.ts`'s `runPve`
+ *   replaces `pve()` as in acl.ts and group.ts; the cries-wolf fix is wired the same way.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 export interface UserProps extends WithTarget {
     /**
      * ⛔ REALM-QUALIFIED, ALWAYS: `someone@pve`, `someone@pam`. The realm is part of PVE's primary
@@ -91,18 +97,5 @@ export interface UserAttributes {
 export interface ProxmoxUser extends Resource<'Proxmox.User', UserProps, UserAttributes, never, PveRequirements> {
 }
 export declare const ProxmoxUser: import("alchemy").ResourceClass<ProxmoxUser>;
-/**
-* ⛔ EMPTY, AND MORE POINTEDLY SO HERE THAN ANYWHERE ELSE. `GET /access/users` answers with
-*   every account on the cluster: `root@pam`, every human who logs in, every service
-*   identity someone made years ago. Handing that list to Alchemy would invite it to adopt
-*   — and therefore one day DELETE — people. Adoption is an explicit act.
- 
- *
-* ⛔ DELETING A USER TAKES ITS API TOKENS AND ITS ACL ENTRIES WITH IT, in one call and
-*   without a confirmation. For the identity a credential mount vends from, that revokes
-*   every outstanding lease at once and every plan in this package stops working — this one
-*   included. PVE refuses only for `root@pam`; for everyone else it simply obeys.
- 
- */
 export declare const ProxmoxUserProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxUser>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=user.d.ts.map

package/dist/proxmox/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAmGjE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAiBtE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAajE,eAAO,MAAM,mBAAmB,iIAgF7B,CAAC"}

package/dist/proxmox/zfs-pool-write.d.ts

@@ -110,7 +110,7 @@ export declare const createForm: (props: ZfsPoolProps) => Record<string, string>
  *   here is the same `Effect.die` idiom as every other refusal in this package, and it costs
  *   nothing this pool did not already lack.
  */
-export declare const createPool: <E, R>(props: ZfsPoolProps, collection: string, path: string, read: (props: ZfsPoolProps) => Effect.Effect<ZfsPoolAttributes | undefined, E, R>) => Effect.Effect<ZfsPoolAttributes, E | Error, R | import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const createPool: <E, R>(props: ZfsPoolProps, collection: string, path: string, read: (props: ZfsPoolProps) => Effect.Effect<ZfsPoolAttributes | undefined, E, R>) => Effect.Effect<ZfsPoolAttributes, E | Error | import("./credential-errors.ts").PveCredentialDenied, R | import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ⛔ `DELETE /nodes/{node}/disks/zfs/{name}` RUNS `zpool destroy` AND THE DATASETS GO WITH IT. Per
  *   S14 (alchemy-provider-standard), it is implemented rather than stubbed — a `delete` that
@@ -124,5 +124,5 @@ export declare const createPool: <E, R>(props: ZfsPoolProps, collection: string,
  *   resource reaching over to delete another's is how a stack ends up with state describing
  *   something that is gone.
  */
-export declare const destroyPool: (olds: ZfsPoolProps, path: string) => Effect.Effect<unknown, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const destroyPool: (olds: ZfsPoolProps, path: string) => Effect.Effect<unknown, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=zfs-pool-write.d.ts.map