@homeflare/alchemy 0.31.1 → 0.32.0

package/dist/proxmox/role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/proxmox/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAa7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAStE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAiBjE,eAAO,MAAM,mBAAmB,iIA+E7B,CAAC"}
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/proxmox/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAa7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAStE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAwBjE,eAAO,MAAM,mBAAmB,iIA+E7B,CAAC"}

package/dist/proxmox/storage-form.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `Proxmox.Storage`'s WRITE side: the locator bag, the create/update forms, and the translation
+ * into distilled's own typed request shape. Split out of storage-wire.ts (2026-09-24) to keep
+ * both files under the 250-line cap — the api-token.ts/api-token-form.ts seam, same reasoning.
+ */
+import type * as storage from '@distilled.cloud/proxmox/storage';
+import type { StorageProps } from './storage.ts';
+export declare const STORAGE_CREATE = "pve:POST /storage";
+export declare const STORAGE_UPDATE = "pve:PUT /storage/{storage}";
+/**
+ * The create-time, plugin-specific half of a storage: `dir` wants `path`, `nfs` `server`+`export`,
+ * `cifs` `server`+`share`, `pbs` `server`+`datastore`, `rbd` `pool`+`monhost`, `lvmthin`
+ * `vgname`+`thinpool`, `zfspool` `pool`. A bag rather than two dozen named fields, because PVE
+ * ships about that many plugins and each brings its own locator. ⚠️ Never diffed — see `matches`
+ * (storage-wire.ts).
+ *
+ * ⛔ `password`, `keyring` AND `encryption-key` ARE `never` ON PURPOSE — see the ⛔ in storage.ts's
+ *   header. POSITIVE-CONTROLLED rather than assumed: all three are a compile error, `TS2322: Type
+ *   'string' is not assignable to type 'undefined'`.
+ * ⚠️ EVERY KEY IN THIS BAG GOES THROUGH `underscored` (below) BEFORE IT REACHES DISTILLED — see
+ *   that function's own header. A caller writes PVE's own field names here (`fs-name`, matching
+ *   `pvesm`/pve-docs), never distilled's renamed ones.
+ */
+export type StorageLocator = Record<string, string> & {
+    password?: never;
+    keyring?: never;
+    'encryption-key'?: never;
+};
+/**
+ * ⚠️ THE BAG IS SPREAD FIRST SO NOTHING IN IT CAN SHADOW A FIELD THIS RESOURCE MANAGES. A stray
+ *   `storage` or `type` in a locator would otherwise rename the object being created, and PVE
+ *   would build the wrong thing under a name Alchemy then records as the declared one.
+ * ★ HYPHENATED, THE WIRE SHAPE — `guardWrite` (storage.ts) checks this form directly; see
+ *   `underscored`'s header for why translating it here would blind that check.
+ */
+export declare const createForm: (props: StorageProps) => Record<string, string>;
+/**
+ * ⚠️ `type` AND THE LOCATOR ARE NEVER SENT ON UPDATE — PVE's PUT refuses the create-only fields
+ *   (`PutStorageRequest` has no `type`, and the plugin locator fields it does carry are for a
+ *   different purpose: moving an existing volume, not re-pointing the definition), and comparing
+ *   either could only plan an update that no write can apply: a plan that reports work forever.
+ */
+export declare const updateForm: (props: StorageProps) => Record<string, string>;
+/**
+ * The actual `createStorage` call body — `createForm`, translated once. See `underscored`.
+ * ⚠️ `as unknown as` — same load-bearing cast as `locatorForm`'s own ⚠️: a plain
+ *   `Record<string,string>` does not structurally overlap a named-field interface enough for
+ *   TypeScript to accept a direct cast, even though every field it carries fits one of the
+ *   interface's own (all-optional-but-two) properties.
+ */
+export declare const toDistilledCreate: (props: StorageProps) => storage.CreateStorageRequest;
+/** The actual `putStorage` call body — `updateForm`, translated once. See `toDistilledCreate`. */
+export declare const toDistilledUpdate: (props: StorageProps) => storage.PutStorageRequest;
+//# sourceMappingURL=storage-form.d.ts.map

package/dist/proxmox/storage-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-form.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,KAAK,OAAO,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAClD,eAAO,MAAM,cAAc,+BAA+B,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IACpD,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,CAAC;AA4EF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,UAAW,YAAY,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAKpE,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,UAAU,UAAW,YAAY,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGpE,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,UAAW,YAAY,KAAG,OAAO,CAAC,oBACW,CAAC;AAE5E,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,UAAW,YAAY,KAAG,OAAO,CAAC,iBACQ,CAAC"}

package/dist/proxmox/storage-wire.d.ts

@@ -0,0 +1,56 @@
+import * as Effect from 'effect/Effect';
+import type { StorageProps } from './storage.ts';
+import { UNREADABLE, type Unreadable } from './unreadable-read.ts';
+export interface StorageAttributes {
+    storage: string;
+    /** Reported so a plan can show what it points at; never diffed — storage.ts's `type` doc. */
+    type: string;
+    content: string;
+    nodes: string;
+    disable: boolean;
+    shared: boolean;
+    preallocation: string;
+    'prune-backups': string;
+    comment: string;
+}
+export declare const sameList: (declared: string | undefined, live: string) => boolean;
+export declare const same: <T>(declared: T | undefined, live: T) => boolean;
+/**
+ * ★ Default `read` role WOULD READ 403 — see storage.ts's header on why this family reads with
+ *   `provision`, the same as acl.ts and unlike group.ts/user.ts.
+ * ⛔ `{ storage: props.storage }`, NEVER THE WHOLE `props` — user.ts/group.ts's own ⛔, the
+ *   kit 0.31.1 regression: `GetStorageRequest`'s schema declares only `storage` (a path label);
+ *   any OTHER key on the object passed to `storage.getStorage` is treated by distilled's
+ *   `buildRequest` as an "unknown key" and JSON-encoded onto this bodyless GET, which a stricter
+ *   fetch client refuses outright.
+ * ⛔ A MISSING STORAGE IS A 500, NOT A 404 — MEASURED against the live cluster (TB4, 2026-09-24,
+ *   admin lane, read-only probe): `GET /storage/hf-measure-nonexistent-probe` answers
+ *   `{"message":"storage 'hf-measure-nonexistent-probe' does not exist\n","data":null}` at HTTP
+ *   500 — the SAME shape as user.ts's and group.ts's own measured 500, not the clean
+ *   `{"data":null}` at 200 this file's pre-migration comment assumed for every read failure
+ *   (client.ts's `pveOperations.read` could not tell the two apart either way, folding both into
+ *   "absent"). `readStorage` below (used by `read`/`reconcile`) still folds it, exactly as
+ *   `readUser`/`readGroup` do, so a brand-new declaration can still be created; `readStorageOrFail`
+ *   (used by `diff`) does not.
+ */
+export declare const readStorageOrFail: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`/`reconcile` MAY USE IT —
+ *   user.ts's `readUser` has the full reasoning. Safe here because a wrongful fold costs at most a
+ *   redundant `createStorage` POST, which PVE refuses loudly ("storage ID already exists") rather
+ *   than silently corrupting anything.
+ * ⛔ `storage.ts`'s `diff` does **NOT** use this — the SAME bug class as the credential denial fix:
+ *   folding a TRANSIENT failure into "absent" at PLAN TIME is what forced a false `update` with
+ *   nothing compared (the ORIGINAL cries-wolf bug this family shipped with, per unreadable-read.ts's
+ *   own header). `diff` calls `readStorageOrFail` directly, so a genuine failure there propagates
+ *   and fails the whole plan loudly instead.
+ */
+export declare const readStorage: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
+export declare const dropUnreadable: (live: StorageAttributes | Unreadable | undefined) => StorageAttributes | undefined;
+/**
+ * ⚠️ `type` IS NEVER COMPARED — CREATE-ONLY (`storage.ts`'s own `StorageProps.type` doc), so a
+ *   changed declaration plans `noop` on it, same as before the migration.
+ */
+export declare const matches: (attributes: StorageAttributes, props: StorageProps) => boolean;
+//# sourceMappingURL=storage-wire.d.ts.map

package/dist/proxmox/storage-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-wire.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAmBD,eAAO,MAAM,QAAQ,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YACN,CAAC;AAE9D,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,YACX,CAAC;AAwB9C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,UAAW,YAAY,m2BAGyC,CAAC;AAE/F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,UAAW,YAAY,kIACuB,CAAC;AAEvE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,iBAAiB,GAAG,UAAU,GAAG,SAAS,kCACvC,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,iBAAiB,SAAS,YAAY,YAOjC,CAAC"}

package/dist/proxmox/storage.d.ts

@@ -12,19 +12,48 @@
  * ⛔ ONE PRIVILEGE COVERS THIS WHOLE FAMILY AND IT IS `Datastore.Allocate` ON `/storage`. Create,
  *   update, delete AND the single-object read all check it — `Datastore.Audit` is not enough for
  *   any of them. MEASURED: `GET /storage/local` under the auditor-scoped `read` lease answers 403
- *   "Permission check failed (/storage/local, Datastore.Allocate)". `pveOperations.read` folds
- *   every failure into `undefined`, i.e. "absent", because a 404 is a legitimate answer there and
- *   it cannot tell the two apart — so under that lease this resource NEVER CONVERGES, in two
- *   directions: reconcile reads "absent" and POSTs a create over a storage that is already defined,
- *   and where a create does land the read-back is 403 too, so reconcile dies with "the write
- *   returned no error but the object is still absent" about an object it has just built. Both
- *   messages point away from the cause.
- *   ★ SO WIDEN OR RE-POINT BEFORE THE FIRST PLAN, outside this file: give the credential mount's
- *     `read` role `Datastore.Allocate` on `/storage`, or read this family with `provision`. The
- *     provision role in the estate this was written for held only `Datastore.AllocateSpace` and
- *     `Datastore.Audit`, and NEITHER IS IT — AllocateSpace writes volumes INTO a storage, Allocate
- *     DEFINES one — so it 403'd here until widened the way `Pool.Allocate` was for `Proxmox.Pool`.
- *     The provisioning baseline (`provision-baseline.ts`) carries `Datastore.Allocate`.
+ *   "Permission check failed (/storage/local, Datastore.Allocate)". So this family reads with
+ *   `provision`, same as acl.ts and unlike group.ts/user.ts — `provision-baseline.ts` carries
+ *   `Datastore.Allocate`.
+ *
+ * ⛔ ON A LANE WHOSE CREDENTIAL CANNOT MINT `provision` (the agent's `read`-role lane), THIS
+ *   FAMILY SHIPPED WITH THE ORIGINAL CRIES-WOLF BUG — measured live, 2026-09-24: `bun run plan`
+ *   showed all 5 storages (`cephfs-tb4`, `cephtb4`, `local`, `local-zfs`, `pbs`) as `update`, with
+ *   no warning, because `client.ts`'s `pveOperations.read` folded the REFUSED mint into `undefined`
+ *   the same way it folds a genuine absence — `unreadable-read.ts`'s own header names this family
+ *   by name as one of the two the fix was written for. Migrated here the way acl.ts/group.ts/
+ *   user.ts were (kit 0.31.1/0.31.2): a refused `provision` mint now reports `noop` with a logged
+ *   warning instead of forcing `update` with nothing compared.
+ *
+ * ⛔ A MISSING STORAGE IS A 500, NOT A 404 — MEASURED against the live cluster (TB4, 2026-09-24,
+ *   admin lane, read-only `GET /storage/hf-measure-nonexistent-probe`): `{"message":"storage
+ *   '...' does not exist\n"}` at HTTP 500. `storage-wire.ts`'s `readStorageOrFail`/`readStorage`
+ *   carry the same dual-path split as user.ts/group.ts for exactly this reason — see that file.
+ *
+ * ⛔ `maxfiles` IS GONE — A MEASURED `@distilled.cloud/proxmox` SDK GAP, NOT A SCOPE TRIM. The
+ *   vendor's generated `CreateStorageRequest`/`PutStorageRequest` (storage-wire.ts's `mutable`)
+ *   have no `maxfiles` field at all — grepped across the whole package, not just this endpoint —
+ *   where `prune-backups`, its documented replacement, is present and correctly wired
+ *   (`T.Body("prune-backups")` on the generated `prune_backups` property). Silently dropping a
+ *   declared `maxfiles` value would have been the same class of bug this whole migration exists to
+ *   close: a write that looks like it landed and did not. So `maxfiles?: never` below, the same
+ *   COMPILE-ERROR treatment `StorageLocator`'s `password`/`keyring`/`encryption-key` already get —
+ *   a declaration that sets it is refused before a plan ever runs, not silently ignored by one.
+ *   None of this cluster's 5 live storages set it (measured, live response bodies below). If a
+ *   consumer genuinely needs it, the fix belongs in `@distilled.cloud/proxmox`'s generator, not a
+ *   hand-rolled bypass here — see the provider-walk-down doctrine on vendor gaps.
+ *
+ * ⛔ EVERY HYPHENATED PVE FIELD NAME BECOMES AN UNDERSCORE IN DISTILLED'S GENERATED TYPESCRIPT —
+ *   MEASURED across the WHOLE generated `CreateStorageRequest`/`PutStorageRequest`, not one field:
+ *   `prune-backups` -> `prune_backups`, `fs-name` -> `fs_name`, `max-protected-backups` ->
+ *   `max_protected_backups`, and so on for every plugin field `StorageLocator`'s free-form bag can
+ *   carry (`cephfs-tb4`'s own live locator uses `fs-name`, measured below). No other family
+ *   migrated so far has a hyphenated field at all, so this is new here. `storage-wire.ts`'s
+ *   `underscored` translates a form BUILT with PVE's own names into distilled's shape, but ONLY
+ *   for the actual SDK call (`toDistilledCreate`/`toDistilledUpdate`) — never for the form
+ *   `guardWrite` checks (`createForm`/`updateForm`), which the generated vendor-constraint tables
+ *   key by PVE's own hyphenated names. Running the translation before that check would make it
+ *   silently stop inspecting the very fields it exists to catch.
  *
  * ⛔ THERE IS NO `password` PROP AND THERE MUST NEVER BE ONE. PBS and CIFS storages take one at
  *   create time, and Alchemy persists attributes UNENCRYPTED — a secret in props is one careless
@@ -33,25 +62,20 @@
  *   a COMPILE ERROR rather than a leak somebody finds in a backup months later. Set it once out of
  *   band (`pvesm set <id> --password`); PVE never returns it on read, so nothing here could diff it
  *   anyway.
+ *
+ * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` (`resource.ts`) ONTO
+ *   `@distilled.cloud/proxmox`'s typed `storage.getStorage`/`createStorage`/`putStorage`/
+ *   `deleteStorage` (2026-09-24, decision 43's proxmox walk-down, nodes/storage sub-area, first
+ *   resource). `distilled-pve.ts`'s `runPve` replaces `pve()`; the cries-wolf fix is wired the
+ *   same way as acl.ts/group.ts/user.ts.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
-/**
- * The create-time, plugin-specific half of a storage: `dir` wants `path`, `nfs` `server`+`export`,
- * `cifs` `server`+`share`, `pbs` `server`+`datastore`, `rbd` `pool`+`monhost`, `lvmthin`
- * `vgname`+`thinpool`, `zfspool` `pool`. A bag rather than two dozen named fields, because PVE
- * ships about that many plugins and each brings its own locator. ⚠️ Never diffed — see `matches`.
- *
- * ⛔ `password`, `keyring` AND `encryption-key` ARE `never` ON PURPOSE — see the ⛔ in the header.
- *   POSITIVE-CONTROLLED rather than assumed: all three are a compile error, `TS2322: Type 'string'
- *   is not assignable to type 'undefined'`.
- */
-export type StorageLocator = Record<string, string> & {
-    password?: never;
-    keyring?: never;
-    'encryption-key'?: never;
-};
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
+import type { StorageAttributes } from './storage-wire.ts';
+import type { StorageLocator } from './storage-form.ts';
+/** Re-exported so a caller of this file still finds them here, unchanged by the split below. */
+export type { StorageAttributes, StorageLocator };
 export interface StorageProps extends WithTarget {
     /** PVE's primary key, cluster-wide — the string an LXC's `storage` and `ostemplate` name. */
     storage: string;
@@ -81,41 +105,12 @@ export interface StorageProps extends WithTarget {
      */
     'prune-backups'?: string;
     comment?: string;
-    /**
-     * ⚠️ THE DEPRECATED PREDECESSOR OF `prune-backups`, and the two do not mix — declare one or the
-     *   other. `0` means UNLIMITED to PVE rather than "unset", hence the `-1` in the attribute.
-     */
-    maxfiles?: number;
-}
-export interface StorageAttributes {
-    storage: string;
-    /** Reported so a plan can show what it points at; never diffed — see `type` above. */
-    type: string;
-    content: string;
-    nodes: string;
-    disable: boolean;
-    shared: boolean;
-    preallocation: string;
-    'prune-backups': string;
-    comment: string;
-    /** ⚠️ `-1` means "no maxfiles in storage.cfg". `0` is a real setting meaning unlimited. */
-    maxfiles: number;
+    /** ⛔ REMOVED — a measured `@distilled.cloud/proxmox` gap, not a scope trim. See the header. */
+    maxfiles?: never;
 }
 export interface ProxmoxStorage extends Resource<'Proxmox.Storage', StorageProps, StorageAttributes, never, PveRequirements> {
 }
 /** ★ `retain` by default — a storage holding volumes cannot be rebuilt. See the ★ in resource.ts. */
 export declare const ProxmoxStorage: import("alchemy").ResourceClass<ProxmoxStorage>;
-/**
-* ⛔ EMPTY, AND HERE IT MATTERS MORE THAN ANYWHERE ELSE IN THIS PACKAGE. `GET /storage`
-*   returns every definition on the cluster, `local` and `local-lvm`/`local-zfs` included:
-*   the installer's own, that every guest's rootfs sits on. Adopting those would put
-*   Alchemy one `delete` away from the cluster's disks. Adoption is explicit, always.
- 
- *
-* ⚠️ THIS REMOVES THE DEFINITION, NOT THE DATA. PVE drops the section from storage.cfg and
-*   leaves the volumes on disk untouched — so the loss is not the bytes, it is that guests
-*   whose config still names this storage can no longer resolve their own disks.
- 
- */
 export declare const ProxmoxStorageProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxStorage>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=storage.d.ts.map

package/dist/proxmox/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IACpD,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,qGAAqG;AACrG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAkHH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAYtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,gGAAgG;AAChG,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AAElD,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,qGAAqG;AACrG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,eAAO,MAAM,sBAAsB,oIAgGhC,CAAC"}

package/dist/proxmox/user-wire.d.ts

@@ -1,18 +1,47 @@
 /**
- * `Proxmox.User`'s wire shape: PVE's create/update forms and how a live item becomes
- * attributes. Split out of user.ts (2026-09-24, the distilled migration) to keep that file
- * under the 250-line cap — the api-token.ts/api-token-form.ts seam.
+ * `Proxmox.User`'s wire shape: PVE's create/update forms, how a live item becomes attributes,
+ * and the read itself. Split out of user.ts (2026-09-24, the distilled migration) to keep that
+ * file under the 250-line cap — the api-token.ts/api-token-form.ts seam.
  */
-import type * as access from '@distilled.cloud/proxmox/access';
+import * as access from '@distilled.cloud/proxmox/access';
+import * as Effect from 'effect/Effect';
 import type { UserAttributes, UserProps } from './user.ts';
+import { UNREADABLE, type Unreadable } from './unreadable-read.ts';
 export declare const USER_CREATE = "pve:POST /access/users";
 export declare const USER_UPDATE = "pve:PUT /access/users/{userid}";
 export declare const createForm: (props: UserProps) => access.CreateAccessUserRequest;
 export declare const updateForm: (props: UserProps) => access.PutAccessUserRequest;
-export declare const attributesOf: (live: access.GetAccessUserResponse, props: UserProps) => UserAttributes;
 /**
  * ⚠️ `tokens` IS NOT COMPARED, and neither is anything create-only. What is compared is exactly
  *   what a PUT can put back; a field PVE reports but will not accept is drift nobody can fix.
  */
 export declare const matches: (attributes: UserAttributes, props: UserProps) => boolean;
+/**
+ * ★ Default `read` role for this family — only the write side needs `provision`.
+ * ⛔ `{ userid: props.userid }`, NEVER THE WHOLE `props` — MEASURED 2026-09-24, the regression in
+ *   kit 0.31.1. `GetAccessUserRequest`'s schema declares only `userid` (a path label); any OTHER
+ *   key on the object passed to `access.getAccessUser` — `target`, `comment`, every field this
+ *   family's own props carry — is treated by distilled's `buildRequest` as an "unknown key" and
+ *   JSON-encoded onto the request as a BODY, on every one of these bodyless GETs. A stricter
+ *   fetch client than a bare `bun run` of this file refuses a GET carrying any body at all
+ *   (`TypeError [ERR_INVALID_ARG_VALUE]: fetch() request with GET/HEAD method cannot have body`),
+ *   which `runPveWith` retries across every member and exhausts identically —
+ *   `PveClusterExhausted`, then silently folded to "absent" by the old `orElseSucceed`, forcing a
+ *   false `update` on every account.
+ */
+export declare const readUserOrFail: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`/`reconcile` MAY USE IT. A
+ *   missing user is a thrown 500 (user.ts's own header), so `reconcile`'s create branch NEEDS
+ *   "absent" from a failure to ever run — without this fold, a brand-new account could never be
+ *   created. Safe here because a wrongful fold costs at most a redundant `createAccessUser` POST,
+ *   which PVE refuses loudly rather than silently corrupting anything.
+ * ⛔ `user.ts`'s `diff` does **NOT** use this — the SAME bug class as the credential denial fix:
+ *   folding a TRANSIENT failure into "absent" at PLAN TIME is what forced a false `update` with
+ *   nothing compared. `diff` calls `readUserOrFail` directly, so a genuine failure there
+ *   propagates and fails the whole plan loudly instead.
+ */
+export declare const readUser: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
+export declare const dropUnreadable: (live: UserAttributes | Unreadable | undefined) => UserAttributes | undefined;
 //# sourceMappingURL=user-wire.d.ts.map

package/dist/proxmox/user-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/user-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3D,eAAO,MAAM,WAAW,2BAA2B,CAAC;AACpD,eAAO,MAAM,WAAW,mCAAmC,CAAC;AA2D5D,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,uBAGnD,CAAC;AAEH,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,oBAGnD,CAAC;AAEH,eAAO,MAAM,YAAY,SACjB,MAAM,CAAC,qBAAqB,SAC3B,SAAS,KACf,cAgBD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,cAAc,SAAS,SAAS,YAOF,CAAC"}
+{"version":3,"file":"user-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/user-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,eAAO,MAAM,WAAW,2BAA2B,CAAC;AACpD,eAAO,MAAM,WAAW,mCAAmC,CAAC;AA2D5D,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,uBAGnD,CAAC;AAEH,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,oBAGnD,CAAC;AAoBH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,cAAc,SAAS,SAAS,YAOF,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,UAAW,SAAS,g2BAG+C,CAAC;AAE/F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,UAAW,SAAS,+HAC0B,CAAC;AAEpE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,cAAc,GAAG,UAAU,GAAG,SAAS,+BACpC,CAAC"}

package/dist/proxmox/user.d.ts

@@ -33,12 +33,12 @@
  *       user, so a role wide enough to edit the account can still be refused for one group.
  *     · `Sys.Audit` (or `User.Modify`) for the read, which the `read` role's auditor already has.
  *
- * ⚠️ A MISSING USER IS A 500, NOT A 404 — "no such user ('x@pve')". distilled turns that into an
- *   `UnknownProxmoxError` (protocol.ts), and `readOrUnreadable`'s own `orElseSucceed` folds it
- *   into "absent" same as the old hand-rolled client did. A 403 therefore also reads as absent
- *   UNLESS it is the one refusal `readOrUnreadable` catches (unreadable-read.ts): a REFUSED
- *   `provision` mint, the cries-wolf case. Any other refusal still reads as absent, and the
- *   honest error arrives one step later, from the create.
+ * ⚠️ A MISSING USER IS A 500, NOT A 404 — MEASURED against the live cluster, "no such user
+ *   ('x@pve')". distilled turns that into an `InternalServerError`, with no distinct "not found"
+ *   tag to catch. `user-wire.ts`'s `readUser` (used by `read`/`reconcile`, where the create
+ *   workflow needs "absent" from exactly this failure) still folds it; `readUserOrFail` (used by
+ *   `diff` below) does not — see that function's own header for why folding it there was the
+ *   cries-wolf bug all over again, just for a genuine PVE quirk instead of a permission denial.
  *
  * ⚠️ THE WIRE URL FOR THIS FAMILY CHANGED, THOUGH NOTHING A CALLER SEES DID. MEASURED
  *   (user.test.ts): distilled's `{userid}` label substitution percent-encodes it —

package/dist/proxmox/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAiBtE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAajE,eAAO,MAAM,mBAAmB,iIAgF7B,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AActE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAEjE,eAAO,MAAM,mBAAmB,iIAgG7B,CAAC"}

package/dist/unifi/fake-unifi.d.ts

@@ -0,0 +1,48 @@
+/**
+ * A minimal in-memory UniFi Network API for this family's tests — an in-memory `fetch` handed to
+ * Effect's real `FetchHttpClient` through its `Fetch` reference, mirroring `../netbox/fake-netbox.ts`
+ * (itself mirroring `../forgejo/fake-forgejo.ts`). Tests exercise distilled's REAL path assembly,
+ * JSON encode/decode and status→typed-error matching — nothing about that matching is
+ * re-implemented here, only the wire responses a scenario needs.
+ *
+ * ⛔ TEST-ONLY, AND NO NETWORK. No provider imports this file. The base URL is RFC 2606
+ *   `unifi.example.com` and the key is a placeholder — never a real console address: a cloud
+ *   connector's base URL embeds the account's Console ID, which must never appear in this repo
+ *   (`docs/unifi.md`).
+ */
+import { type Credentials } from '@distilled.cloud/unifi-network/Credentials';
+import * as Layer from 'effect/Layer';
+export declare const FAKE_BASE = "https://unifi.example.com/proxy/network/integration";
+export declare const FAKE_KEY = "placeholder-unifi-key";
+export type Seen = {
+    readonly method: string;
+    readonly path: string;
+};
+/** No documented failure envelope (see `protocol.ts`) — plain text is all a failure needs. */
+export declare const fakeFailure: (status: number, detail: string) => Response;
+/**
+ * `route` decides every response; this wrapper only records what was sent and adapts to
+ * `globalThis.fetch`'s signature.
+ *
+ * ★ THE WRITE-REFUSAL PROOF USES `seen` DIRECTLY, NOT A THROWING ROUTE. `resource.test.ts`'s
+ *   "no SDK write operation is reachable" test asserts `seen.every(s => s.method === 'GET')`
+ *   after driving every handler — a request this family's engine was never supposed to send
+ *   shows up in `seen` as a fact, rather than depending on an exception surviving Effect's own
+ *   error handling on its way back out of a fake `fetch`.
+ */
+export declare const fakeUnifi: (route: (method: string, url: URL) => Response) => {
+    fetch: typeof fetch;
+    seen: Seen[];
+};
+/**
+ * distilled Credentials + the real FetchHttpClient over the fake — `UnifiNetworkOpContext`, what
+ * every resource file's exported `spec.fetchLive` needs.
+ *
+ * ⚠️ NOT PAIRED WITH `handlers`. `handlers` (each resource file's `unifiHandlers(spec)` export)
+ *   bakes in `CredentialsFromEnv`, which resolves `UNIFI_NETWORK_API_KEY`/`_API_BASE_URL` through
+ *   Effect's `Config` — whose default provider snapshots `process.env` once and never re-reads it
+ *   (the same seam `netbox/fake-netbox.ts` documents). Tests call `spec.fetchLive`/`spec.attributes`
+ *   directly instead, with this explicit layer.
+ */
+export declare const fakeUnifiLayer: (fetchFn: typeof globalThis.fetch, creds?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/unstable/http/HttpClient").HttpClient, never, never>;
+//# sourceMappingURL=fake-unifi.d.ts.map

package/dist/unifi/fake-unifi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-unifi.d.ts","sourceRoot":"","sources":["../../src/unifi/fake-unifi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,WAAW,EAAe,MAAM,4CAA4C,CAAC;AAC3F,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,eAAO,MAAM,SAAS,wDAAwD,CAAC;AAC/E,eAAO,MAAM,QAAQ,0BAA0B,CAAC;AAEhD,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,8FAA8F;AAC9F,eAAO,MAAM,WAAW,WAAY,MAAM,UAAU,MAAM,aAAqC,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,UAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ;;;CAUtE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAChB,OAAO,UAAU,CAAC,KAAK,UACzB,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,kGAC+D,CAAC"}

package/dist/unifi/firewall-zone-form.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `Unifi.FirewallZone`'s wire shape — the declarable subset of `FirewallZone`, and how a live
+ * read becomes both plan attributes and a rendered declaration.
+ *
+ * ⚠️ ONLY `name` AND `networkIds` ARE DECLARABLE. `CreateFirewallZoneRequest`
+ *   (`firewall.ts`) accepts exactly those two beyond `siteId`; `metadata` (origin/source) and
+ *   `id` are server-derived, so — same split as `network-form.ts`'s `default`/`metadata` —
+ *   they are attributes-only, reported but never compared or declared.
+ *
+ * ⛔ `networkIds` ORDER IS NOT PART OF IDENTITY. The vendor document gives no indication the
+ *   list is ordered (it is a set of attached networks, not a sequence like the ordering
+ *   endpoints' rule lists), so `matches` compares it as a set — sorted before comparing —
+ *   the same reasoning `proxmox/user-wire.ts`'s `groupSet` gives for PVE's `groups`.
+ */
+import type * as firewall from '@distilled.cloud/unifi-network/firewall';
+export interface FirewallZoneProps {
+    siteId: string;
+    firewallZoneId: string;
+    /** Name of a firewall zone. */
+    name: string;
+    /** Network IDs attached to this zone — compared as a set, see the header. */
+    networkIds: string[];
+}
+export interface FirewallZoneAttributes {
+    siteId: string;
+    firewallZoneId: string;
+    name: string;
+    networkIds: string[];
+    /** `origin`/`source` (e.g. `SDWAN`) — server-derived, never declared. */
+    metadataOrigin: string;
+}
+export declare const attributesOf: (live: firewall.FirewallZone, props: FirewallZoneProps) => FirewallZoneAttributes;
+export declare const matches: (attributes: FirewallZoneAttributes, props: FirewallZoneProps) => boolean;
+/**
+ * The declaration renderer (task spec: "given one live object, return the props a declaration
+ * needs so its plan is noop"). `matches(attributesOf(live, props), declareFirewallZone(live,
+ * siteId))` is `true` by construction (`firewall-zone.test.ts` proves it).
+ */
+export declare const declareFirewallZone: (live: firewall.FirewallZone, siteId: string) => FirewallZoneProps;
+//# sourceMappingURL=firewall-zone-form.d.ts.map

package/dist/unifi/firewall-zone-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall-zone-form.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-zone-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;CACxB;AAID,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,YAAY,SACpB,iBAAiB,KACvB,sBAMD,CAAC;AAEH,eAAO,MAAM,OAAO,eAAgB,sBAAsB,SAAS,iBAAiB,KAAG,OAEZ,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,SACxB,QAAQ,CAAC,YAAY,UACnB,MAAM,KACb,iBAKD,CAAC"}

package/dist/unifi/firewall-zone.d.ts

@@ -0,0 +1,50 @@
+/**
+ * `Unifi.FirewallZone` — one firewall zone on a UniFi Network site, READ-ONLY (`policy.ts`).
+ *
+ * ★ WHY FIREWALL ZONE IS IN THE FIRST IMPORT SET AND `Unifi.FirewallPolicy` IS NOT.
+ *   `getFirewallZone`/`getFirewallZones` (`firewall.ts`) is a list+get pair over genuine,
+ *   simply-shaped configuration: `{id, metadata, name, networkIds}`, four fields, no nested
+ *   discriminated filter. `FirewallPolicy` (same file) is also list+get and also configuration,
+ *   but its `source`/`destination`/`ipProtocolScope` fields carry several of `docs/unifi-api-notes.md`'s
+ *   "converter-flattened discriminator variants" each, and `firewall/policies/ordering` replaces
+ *   the whole ordered list — modelling those correctly is a bigger, separate PR (`network.ts`'s
+ *   header note names it explicitly) rather than something to rush alongside this one.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as firewall from '@distilled.cloud/unifi-network/firewall';
+import * as Effect from 'effect/Effect';
+import { type FirewallZoneAttributes, type FirewallZoneProps } from './firewall-zone-form.ts';
+import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+export type { FirewallZoneAttributes, FirewallZoneProps } from './firewall-zone-form.ts';
+export { declareFirewallZone } from './firewall-zone-form.ts';
+export interface UnifiFirewallZone extends Resource<'Unifi.FirewallZone', FirewallZoneProps, FirewallZoneAttributes, never, UnifiRequirements> {
+}
+export declare const UnifiFirewallZone: import("alchemy").ResourceClass<UnifiFirewallZone>;
+/** `firewallZone('lan', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */
+export declare const firewallZone: (id: string, props: FirewallZoneProps) => Effect.Effect<UnifiFirewallZone, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
+export declare const spec: UnifiSpec<FirewallZoneProps, firewall.FirewallZone, FirewallZoneAttributes, firewall.GetFirewallZoneError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: (args: {
+        olds: FirewallZoneProps;
+        output: FirewallZoneAttributes | undefined;
+    }) => Effect.Effect<FirewallZoneAttributes | undefined, firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args: {
+        news: import("alchemy").Input<FirewallZoneProps>;
+        output: FirewallZoneAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args: {
+        news: FirewallZoneProps;
+    }) => Effect.Effect<FirewallZoneAttributes, import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: (args: {
+        olds: FirewallZoneProps;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const UnifiFirewallZoneProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiFirewallZone>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=firewall-zone.d.ts.map

package/dist/unifi/firewall-zone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall-zone.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-zone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAGvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,+FAA+F;AAC/F,eAAO,MAAM,YAAY,OAAQ,MAAM,SAAS,iBAAiB,kGACjB,CAAC;AAEjD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,iBAAiB,EACjB,QAAQ,CAAC,YAAY,EACrB,sBAAsB,EACtB,QAAQ,CAAC,oBAAoB,CAU9B,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,yBAAyB,uIACuD,CAAC"}

package/dist/unifi/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * UniFi Network providers for Alchemy — READ-ONLY, by Tim's rule (2026-09-24; `policy.ts`).
+ *
+ * ⛔ THIS BARREL IS THE PUBLIC API, SMALLER THAN THE DIRECTORY. `resource.ts`'s generic engine
+ *   and each `*-form.ts`'s wire helpers are internals a provider needs but a consumer should
+ *   not depend on — mirrors `../netbox/index.ts`.
+ */
+export { UNIFI_READ_ONLY_POLICY, UnifiWriteRefused, type UnifiWriteAction } from './policy.ts';
+export type { UnifiRequirements, UnifiSpec } from './resource.ts';
+export { UnifiNetwork, UnifiNetworkProvider, declareNetwork, network, type NetworkAttributes, type NetworkProps, } from './network.ts';
+export { UnifiFirewallZone, UnifiFirewallZoneProvider, declareFirewallZone, firewallZone, type FirewallZoneAttributes, type FirewallZoneProps, } from './firewall-zone.ts';
+export { providers } from './providers.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/unifi/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unifi/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/F,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,OAAO,EACP,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,YAAY,EACZ,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}