@homeflare/alchemy 0.31.0 → 0.31.2

package/dist/proxmox/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/proxmox/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D;;;;;;;;;;;;GAYG;AACH,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAM1E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,IAAI,WAAY,SAAS,QAAQ,OAAO,QAAO,cAAc;;;;gCAuFtE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,aAAa,eAAgB,aAAa,UAAU,SAAS,KAAG,MAGf,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/proxmox/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH;;;;;;;;;;;;GAYG;AACH,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC"}

package/dist/proxmox/distilled-guard.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Vendor-constraint guards (constraint-guard.ts) for a distilled-backed family — the seam
+ * acl.ts's own local `guardWrite` established (acl-wire.ts), generalized once a second family
+ * (Group) needed the SAME create/update split `resource.ts`'s `specGuards` (resource-guard.ts)
+ * gives every family still on `client.ts`. `codegen/constraints.ts` scans this package's SOURCE
+ * TEXT for the endpoint-key strings a caller passes here, so a family switching to this helper
+ * changes nothing about which vendor rules apply — same keys, same generated tables.
+ *
+ * ★ WHY `asForm` IS THE ONLY TRANSLATION NEEDED. Distilled's generated request types for every
+ *   PVE form-urlencoded operation are already `Record<string, string | undefined>` — the SAME
+ *   shape `PveForm`/`guardForm` want, minus the `?`. There is no JSON vs form-encoding gap to
+ *   bridge here the way client.ts's `pve()` had to.
+ */
+import type * as Effect from 'effect/Effect';
+import type { EndpointKey } from './constraints.ts';
+/**
+ * Drops non-string fields — distilled's request type carries `?`, `guardForm` wants a plain
+ * form. ⚠️ `body: object`, NOT `Record<string, string | undefined>`: distilled's generated
+ * request types are `interface`s with no index signature, so TypeScript refuses that stricter
+ * parameter type for every one of them ("index signature ... is missing") even though every
+ * field they declare fits it. `object` accepts any of them; the cast below is where the shape
+ * is actually asserted, once, rather than at every call site.
+ */
+export declare const asForm: (body: object) => Record<string, string>;
+/**
+ * `presence`: whether a CREATE is really about to happen (required fields are enforced) or the
+ * form is only being value-checked in passing — see resource-guard.ts's own header on why this
+ * is not "this is the create form" but "a create is really about to happen".
+ */
+export declare const guardWrite: (endpoint: EndpointKey, body: object, presence: boolean) => Effect.Effect<void>;
+//# sourceMappingURL=distilled-guard.d.ts.map

package/dist/proxmox/distilled-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distilled-guard.d.ts","sourceRoot":"","sources":["../../src/proxmox/distilled-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,SAAU,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,UAAU,aACX,WAAW,QACf,MAAM,YACF,OAAO,KAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAgD,CAAC"}

package/dist/proxmox/distilled-pve.d.ts

@@ -55,6 +55,7 @@ import type * as Duration from 'effect/Duration';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
 import type { ProxmoxOpContext } from '@distilled.cloud/proxmox/Protocol';
+import type { PveCredentialDenied } from './credential-errors.ts';
 import type { PveCredential, PveRole, PveTarget } from './credentials.ts';
 import { type MemberAttempt } from './members.ts';
 /** Every member answered nothing usable — the direct successor to `client.ts`'s `clusterExhausted`. */
@@ -81,9 +82,15 @@ export declare const runPveWith: <A, E>(target: PveTarget, credential: PveCreden
  * resource file calls.
  *
  * ⚠️ `| Error` IN THE RETURN TYPE IS `leased()`'s OWN FAILURE, NOT A NEW ONE THIS FILE ADDS.
- *   `credentials.ts`'s `mint` fails with a plain `Error` (an OpenBao refusal — sealed, denied, no
- *   such role) and was never typed more narrowly there; `pve()` carried the same untyped
- *   possibility before this file existed, just without a signature that said so.
+ *   `mint.ts`'s `mint` fails with a plain `Error` for most refusals (sealed, no such role) and
+ *   was never typed more narrowly there; `pve()` carried the same untyped possibility before
+ *   this file existed, just without a signature that said so.
+ *
+ * ★ `| PveCredentialDenied` IS SPELLED OUT HERE, NOT LEFT TO COLLAPSE INTO `Error`. It IS an
+ *   `Error` subtype (Data.TaggedError), so leaving it out of this union would still typecheck —
+ *   but `Effect.catchTag('PveCredentialDenied', …)` downstream (unreadable-read.ts) needs the
+ *   tag to be STATICALLY visible in the error channel to compile at all, not merely true at
+ *   runtime. Naming it here is what lets a migrated family's `readOrUnreadable` catch it.
  */
-export declare const runPve: <A, E>(target: PveTarget, role: PveRole, isWrite: boolean, op: Effect.Effect<A, E, ProxmoxOpContext>) => Effect.Effect<A, E | Cause.TimeoutError | PveClusterExhausted | Error, HttpClient.HttpClient>;
+export declare const runPve: <A, E>(target: PveTarget, role: PveRole, isWrite: boolean, op: Effect.Effect<A, E, ProxmoxOpContext>) => Effect.Effect<A, E | Cause.TimeoutError | PveClusterExhausted | PveCredentialDenied | Error, HttpClient.HttpClient>;
 //# sourceMappingURL=distilled-pve.d.ts.map

package/dist/proxmox/distilled-pve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distilled-pve.d.ts","sourceRoot":"","sources":["../../src/proxmox/distilled-pve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EAEL,KAAK,aAAa,EAOnB,MAAM,cAAc,CAAC;AAEtB,uGAAuG;AACvG,qBAAa,mBAAoB,SAAQ,KAAK;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE;IAAvD,YAAqB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAGtD;CACF;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,UACrB,SAAS,cACL,aAAa,WAChB,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,YAChC,QAAQ,CAAC,KAAK,KACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,EAAE,UAAU,CAAC,UAAU,CA0BnF,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,CAAC,UACjB,SAAS,QACX,OAAO,WACJ,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,KACxC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,GAAG,KAAK,EAAE,UAAU,CAAC,UAAU,CAI3F,CAAC"}
+{"version":3,"file":"distilled-pve.d.ts","sourceRoot":"","sources":["../../src/proxmox/distilled-pve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EAEL,KAAK,aAAa,EAOnB,MAAM,cAAc,CAAC;AAEtB,uGAAuG;AACvG,qBAAa,mBAAoB,SAAQ,KAAK;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE;IAAvD,YAAqB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAGtD;CACF;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,UACrB,SAAS,cACL,aAAa,WAChB,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,YAChC,QAAQ,CAAC,KAAK,KACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,EAAE,UAAU,CAAC,UAAU,CA0BnF,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,CAAC,UACjB,SAAS,QACX,OAAO,WACJ,OAAO,MACZ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,KACxC,MAAM,CAAC,MAAM,CACd,CAAC,EACD,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,KAAK,EAC1E,UAAU,CAAC,UAAU,CAKnB,CAAC"}

package/dist/proxmox/generated/constraints/index.d.ts

@@ -15,5 +15,5 @@ export declare const PROXMOX_CONSTRAINTS: Readonly<Record<string, EndpointConstr
  * ★ A DIGEST OF THE DATA, NOT OF THE FILE TEXT, so reformatting is not a stale generation while
  *   changing a 128 to a 129 by hand is. `tests/schema-manifest.test.ts` recomputes it.
  */
-export declare const PROXMOX_CONSTRAINTS_DIGEST = "33b42b52d396c9e0";
+export declare const PROXMOX_CONSTRAINTS_DIGEST = "56eba80750ddb1d2";
 //# sourceMappingURL=index.d.ts.map

package/dist/proxmox/generated/constraints/pve-access.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pve-access.d.ts","sourceRoot":"","sources":["../../../../src/proxmox/generated/constraints/pve-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CA8ChF,CAAC"}
+{"version":3,"file":"pve-access.d.ts","sourceRoot":"","sources":["../../../../src/proxmox/generated/constraints/pve-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CA2ChF,CAAC"}

package/dist/proxmox/generated/constraints/pve-cluster-backup.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-ceph.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-firewall.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-ha.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-metrics.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-notifications.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-replication.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-sdn.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-ceph.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-disks.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-lxc.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-network.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-qemu.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-pools.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-storage.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/group-wire.d.ts

@@ -0,0 +1,68 @@
+/**
+ * `Proxmox.Group`'s wire shape: PVE's create/update forms, how a live item becomes attributes,
+ * and the read itself. Split out of group.ts (2026-09-24) to keep that file under the 250-line
+ * cap — the api-token.ts/api-token-form.ts seam, same reasoning as acl.ts/acl-wire.ts.
+ */
+import * as access from '@distilled.cloud/proxmox/access';
+import * as Effect from 'effect/Effect';
+import type { GroupAttributes, GroupProps } from './group.ts';
+import { UNREADABLE, type Unreadable } from './unreadable-read.ts';
+export declare const GROUP_CREATE = "pve:POST /access/groups";
+export declare const GROUP_UPDATE = "pve:PUT /access/groups/{groupid}";
+/**
+ * The comment PVE will actually END UP HOLDING for a given declaration.
+ *
+ * ⛔ PVE CANNOT STORE THE COMMENT `'0'`, AND A PROVIDER THAT DOES NOT MODEL THAT DIFFS FOREVER.
+ *   `create_group`/`write_user_config`/the config parser all test the comment for TRUTH, and in
+ *   Perl the one-character string `'0'` is false. So a declared `comment: '0'` is accepted by the
+ *   API, dropped on the way to `user.cfg`, and read back as absent. Normalising BOTH sides is how
+ *   `values.ts` already treats `''` as the absence of a boolean rather than as `false`.
+ */
+export declare const storedComment: (comment: string | undefined) => string;
+export declare const createForm: (props: GroupProps) => access.CreateAccessGroupRequest;
+/** ⚠️ ALWAYS SENT, EVEN EMPTY — that is how a comment is CLEARED (see group.ts's own header). */
+export declare const updateForm: (props: GroupProps) => access.PutAccessGroupRequest;
+/**
+ * ⚠️ `members` IS NOT COMPARED, AND NOTHING ELSE IS LEFT TO COMPARE. `comment` is the only field
+ *   a PUT here accepts, so it is the only field whose drift this provider can repair.
+ */
+export declare const matches: (attributes: GroupAttributes, props: GroupProps) => boolean;
+/**
+ * ★ Default `read` role — nothing widened for this family, see group.ts's header privileges note.
+ * ⛔ `{ groupid: props.groupid }`, NEVER THE WHOLE `props` — MEASURED 2026-09-24, the regression
+ *   in kit 0.31.1. `GetAccessGroupRequest`'s schema declares only `groupid` (a path label); any
+ *   OTHER key on the object passed to `access.getAccessGroup` — `target`, `comment`, every field
+ *   this family's own props carry — is treated by distilled's `buildRequest` as an "unknown key"
+ *   and JSON-encoded onto the request as a BODY, on every one of these bodyless GETs. A stricter
+ *   fetch client than a bare `bun run` of this file refuses a GET carrying any body at all
+ *   (`TypeError [ERR_INVALID_ARG_VALUE]: fetch() request with GET/HEAD method cannot have body`),
+ *   which `runPveWith` retries across every member and exhausts identically —
+ *   `PveClusterExhausted`, then silently folded to "absent" by the old `orElseSucceed`, forcing a
+ *   false `update` on every group. `role.ts`'s list call and acl.ts's `listAccessAcl({})` were
+ *   never at risk: both are always called with a literal `{}`.
+ * ⛔ `live.members === undefined` IS DEFENSIVE, NOT THE ABSENCE SIGNAL — CORRECTED 2026-09-24.
+ *   This file previously claimed a missing group answers 200 with `{"data":null}`, unwrapped to
+ *   `{}`. MEASURED against the live cluster: `GET /access/groups/{missing}` answers a genuine 500
+ *   ("group '…' does not exist"), the SAME shape as user.ts's own measured 500 — there is no
+ *   success-path absence signal here at all. The check stays as insurance against a future PVE
+ *   release that does answer `{}`, but this function is what actually carries the "not found"
+ *   case, as a thrown error — `readGroup` below is the one that folds it.
+ */
+export declare const readGroupOrFail: (props: GroupProps) => Effect.Effect<typeof UNREADABLE | GroupAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`/`reconcile` MAY USE IT.
+ *   PVE's OWN missing-group answer is a thrown 500 (the ⛔ above), so `reconcile`'s create branch
+ *   NEEDS "absent" from a failure to ever run at all — without this fold, a brand-new group could
+ *   never be created, because its very-first read would always fail loudly. Safe here because a
+ *   wrongful fold costs at most a redundant `createAccessGroup` POST, which PVE refuses loudly
+ *   ("group already exists") rather than silently corrupting anything.
+ * ⛔ `group.ts`'s `diff` does **NOT** use this — found 2026-09-24, the SAME bug class as the
+ *   credential denial fix: folding a TRANSIENT failure (a `PveClusterExhausted`, the encoding bug
+ *   above) into "absent" at PLAN TIME is exactly what forced a false `update` with nothing
+ *   compared. `diff` calls `readGroupOrFail` directly instead, so a genuine failure there
+ *   propagates and fails the whole plan loudly — never silently misreports one row.
+ */
+export declare const readGroup: (props: GroupProps) => Effect.Effect<typeof UNREADABLE | GroupAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
+export declare const dropUnreadable: (live: GroupAttributes | Unreadable | undefined) => GroupAttributes | undefined;
+//# sourceMappingURL=group-wire.d.ts.map

package/dist/proxmox/group-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/group-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,eAAO,MAAM,YAAY,4BAA4B,CAAC;AACtD,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAE/D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,YAAa,MAAM,GAAG,SAAS,WAGxD,CAAC;AAQF,eAAO,MAAM,UAAU,UAAW,UAAU,KAAG,MAAM,CAAC,wBAGpD,CAAC;AAEH,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAW,UAAU,KAAG,MAAM,CAAC,qBAGpD,CAAC;AAaH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,eAAe,SAAS,UAAU,YACjB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,eAAe,UAAW,UAAU,62BAW9C,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,UAAW,UAAU,gIACyB,CAAC;AAErE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,eAAe,GAAG,UAAU,GAAG,SAAS,gCACrC,CAAC"}

package/dist/proxmox/group.d.ts

@@ -22,8 +22,9 @@
  *                                     "users":"hf-provision@pve,hf-read@pve"}, …]
  *     GET /access/groups/hf-mint -> {"comment":"…","members":["hf-provision@pve","hf-read@pve"]}
  *   The index says `users` and hands back a COMMA STRING; the item says `members` and hands back an
- *   ARRAY. A reader that looked for `users` on the item path would find nothing, report an empty
- *   group, and quietly show a delete as harmless.
+ *   ARRAY. distilled's generator reflects the SAME split (`GetAccessGroupResponse.members: string[]`
+ *   vs `ListAccessGroupsResponseBodyItem.users?: string`), so reading the item is what keeps this
+ *   file on the array shape it already normalises.
  *
  * ⛔ AND THE ITEM'S ORDER IS NOT STABLE BETWEEN TWO CONSECUTIVE CALLS. MEASURED, seconds apart, on
  *   the same endpoint:
@@ -38,35 +39,37 @@
  *   exactly `comment` and `members`, so the id comes from props — the same arrangement, and the
  *   same reason, as `user.ts`.
  *
- * ★ PRIVILEGES: NOTHING HAD TO BE WIDENED, WHICH MAKES THIS THE FIRST FAMILY HERE THAT COST
- *   NOTHING. Measured with `pveum user permissions`, 2026-09-13:
+ * ★ PRIVILEGES: NOTHING HAD TO BE WIDENED. Measured with `pveum user permissions`, 2026-09-13:
  *     · item GET checks `['perm','/access/groups',['Sys.Audit','Group.Allocate'], any => 1]`, and
- *       `hf-read@pve` already holds `Sys.Audit` there (propagated from `/` by `PVEAuditor`).
- *       So `readRole` is left at the default `read` — unlike storage/sdn-zone/sdn-vnet, whose ITEM
- *       reads PVE gates on an allocate privilege. See the ⛔ on `readRole` in `resource.ts`.
+ *       `hf-read@pve` already holds `Sys.Audit` there. So `readAttributes` below reads with the
+ *       default `read` role — unlike acl.ts, user.ts and api-token.ts, whose item/list reads PVE
+ *       gates on an allocate privilege the 3600s read lease does not hold.
  *     · POST, PUT and DELETE each check `Group.Allocate` on `/access/groups`, and
  *       `hf-provision@pve` holds it via the provision role (`PROVISION_PRIVILEGES`).
  *
  * ⛔ `retain` BY DEFAULT, BECAUSE DELETING A GROUP DESTROYS TWO THINGS THIS FILE CANNOT PUT BACK.
  *   Measured in `PVE::AccessControl` on the node:
- *     · The member list IS the group. `user.cfg` stores it on the GROUP line (`group:<id>:<users>:
- *       <comment>:`) and DERIVES each user's `groups` map from it at parse time. Deleting the group
- *       deletes the list, and this resource has no `members` prop to restore it from.
+ *     · The member list IS the group. `user.cfg` stores it on the GROUP line and DERIVES each
+ *       user's `groups` map from it at parse time. Deleting the group deletes the list, and this
+ *       resource has no `members` prop to restore it from.
  *     · `delete_group_acl` then walks the whole ACL tree and drops every grant where the group is
  *       the SUBJECT. On this cluster that is `admins -> Administrator on /` and
  *       `automation -> PVEAuditor on /`: whole populations of access, gone in one call, with no
  *       confirmation and nothing in the plan to suggest it.
- *   `delete` is FULLY IMPLEMENTED — `DELETE /access/groups/{groupid}` exists, unlike the ACL
- *   family's — so `.pipe(RemovalPolicy.destroy())` really removes the group. See the ★ in
- *   `resource.ts` for why the policy is a guard rather than a stubbed-out operation.
+ *   `delete` is FULLY IMPLEMENTED — `DELETE /access/groups/{groupid}` exists — so
+ *   `.pipe(RemovalPolicy.destroy())` really removes the group.
  *
- * ⛔ NO SECRET REACHES STATE. A group holds a comment and a list of userids; there is no password,
- *   no token and no key anywhere on these endpoints. `user.ts`'s ⛔ about unencrypted state applies
- *   to this package, and this family simply has nothing to trip it.
+ * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s
+ *   typed `access.getAccessGroup`/`createAccessGroup`/`putAccessGroup`/`deleteAccessGroup`
+ *   (2026-09-24, decision 43's proxmox walk-down, access sub-area, second resource after Acl).
+ *   `distilled-pve.ts`'s `runPve` replaces `pve()` as in acl.ts; the CRIES-WOLF FIX
+ *   (unreadable-read.ts) is wired the same way: a refused `provision` mint on the WRITE-side
+ *   guard, or a refused `read` mint on the plain read, reports `noop` with a warning rather than
+ *   forcing `update` with nothing compared.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 export interface GroupProps extends WithTarget {
     /**
      * PVE's primary key for a group.
@@ -93,12 +96,5 @@ export interface ProxmoxGroup extends Resource<'Proxmox.Group', GroupProps, Grou
 }
 /** ★ `retain` by default — a delete takes the membership and the group's grants. See the header. */
 export declare const ProxmoxGroup: import("alchemy").ResourceClass<ProxmoxGroup>;
-/**
- * ⛔ THE EMPTY `list` IS INHERITED FROM `pveHandlers` AND IT MATTERS HERE. `GET /access/groups`
- *   answers with every group on the cluster — on this one that is `admins`, which grants
- *   `Administrator` on `/` to every human who logs in. Handing it to Alchemy would invite adoption,
- *   and therefore one day a delete that takes the whole admin group's access with it. Adoption
- *   stays an explicit act, here as everywhere else in this package.
- */
 export declare const ProxmoxGroupProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxGroup>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=group.d.ts.map

package/dist/proxmox/group.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/proxmox/group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,UAAU,EACV,eAAe,EACf,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,oGAAoG;AACpG,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAqFH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,kIACkD,CAAC"}
+{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/proxmox/group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAc7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAItE,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,UAAU,EACV,eAAe,EACf,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,oGAAoG;AACpG,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH,eAAO,MAAM,oBAAoB,kIA4F9B,CAAC"}