@homeflare/alchemy 0.31.2 → 0.33.0

package/README.md

@@ -148,14 +148,16 @@ one is logged (argv only, never content) before it runs. A plan never calls sudo
 
 ## Linux hosts — `@homeflare/alchemy/linux`
 
-The same `HostRunner` seam, over ssh, plus the three families the launchd subpath had no Linux twin
+The same `HostRunner` seam, over ssh, plus the four families the launchd subpath had no Linux twin
 for: `HostDirectory` (because no file resource creates a parent), `RemoteFile` (a whole file, or one
-**managed block** inside a file somebody else owns) and `SystemdUnit` / `SystemdTimer`.
-`linuxProviders(await sshRunner({ host }))` provides all four.
+**managed block** inside a file somebody else owns), `SystemdUnit` / `SystemdTimer`, and
+`PodmanContainer` (one Quadlet `.container` file and the systemd unit its generator produces).
+`linuxProviders(await sshRunner({ host }))` provides all five.
 
 ```ts
 RemoteFile('block', { path: '/etc/example.conf', region: { name: 'homeflare' }, content: 'a line\n' });
 SystemdUnit('thing', { name: 'thing.service', sections: [...], restartOn: [config.sha256] });
+PodmanContainer('thing', { name: 'thing', container: { image: 'example/thing:1', network: 'host' } });
 ```
 
 - ⛔ **A deploy never mass-restarts.** A unit restarts only when its own file changed, when state or
@@ -166,7 +168,12 @@ SystemdUnit('thing', { name: 'thing.service', sections: [...], restartOn: [confi
   without its framing marker is an Error — never "nothing is there".
 - ⛔ **No silent sudo:** a root-owned path needs a root ssh destination or your own privileged runner.
 - ⛔ **The directive set is systemd's:** unit files render verbatim; nothing here invents a schema.
+- ⛔ **`PodmanContainer`'s `[Container]` section IS typed and doc-checked** (Podman 5.4,
+  `podman-systemd.unit(5)`) — Quadlet's own schema, unlike bare `systemd.unit(5)`. It has no
+  `enabled` prop and never calls `systemctl enable`: Quadlet applies `[Install]` itself at every
+  `daemon-reload`, and a generator failure is a typed `QuadletGeneratorError`, never "absent".
 - Guide, the measured `systemctl` shapes and the limits: [docs/linux-host.md](./docs/linux-host.md).
+  `PodmanContainer`'s own guide: [docs/quadlet-container.md](./docs/quadlet-container.md).
 
 ## Release binaries — `@homeflare/alchemy/release`
 
@@ -248,6 +255,17 @@ endpoint lives in ONE `general_settings` field (a whole-list read-modify-write),
 declared in `config.yaml` is refused rather than silently overridden, and a literal secret in a
 forwarded header is refused at plan: [docs/litellm.md](./docs/litellm.md).
 
+## OPNsense — `@homeflare/alchemy/opnsense`
+
+`Opnsense.Firewall.Alias`, `.Category` and `.Group` — READ-ONLY BY DESIGN, generated
+from `@distilled.cloud/opnsense` (an interim alias, like NetBox/Proxmox above — not a
+peer, `bun add` resolves it from the tarball). ⛔ `reconcile` and `delete` always
+refuse with a typed error; there is no flag that lifts it, and no write operation is
+reachable from any handler (`write-refusal.test.ts` proves it against a fake that
+fails on any non-GET). `read` answers `Unowned` on every match, `adopt(true)` is on
+by default, and a pure declaration renderer turns one live read into the props a
+noop declaration needs: [docs/opnsense.md](./docs/opnsense.md).
+
 ## Discord — `@homeflare/alchemy/discord`
 
 `Discord.ApplicationCommand` (global) and `Discord.GuildApplicationCommand` (guild-scoped)
@@ -270,6 +288,24 @@ export const help =
   });
 ```
 
+## UniFi Network — `@homeflare/alchemy/unifi`
+
+`Unifi.Network` and `Unifi.FirewallZone`, generated from Ubiquiti's own UniFi Network
+Integration API 10.4.57 via `@distilled.cloud/unifi-network`. ⛔ **READ-ONLY, by Tim's rule
+(2026-09-24):** `reconcile`/`delete` both fail with a typed `UnifiWriteRefused` naming the
+policy — this family never calls a write operation, only `getNetworkDetails`/`getFirewallZone`
+and their list counterparts. ⛔ `read` answers `Unowned` on every match (never a silent adopt —
+`adopt(true)` is on by default via the `network`/`firewallZone` constructors), and a UniFi
+**Console ID** (part of a cloud-connector base URL) is never logged, committed or written to
+state: [docs/unifi.md](./docs/unifi.md).
+
+```ts
+import { declareNetwork, network, providers } from '@homeflare/alchemy/unifi';
+
+// A later import script writes rows like this one from a live read:
+export const lan = network('lan', declareNetwork(liveNetworkDetails, 'site-id'));
+```
+
 ## Google Workspace — `@homeflare/alchemy/google-workspace`
 
 `Group`, `GroupMember`, `DomainAlias` and `OrgUnit` over the Admin SDK Directory API, generated

package/dist/grafana/dashboard-model.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Pure functions over a dashboard JSON model — no SDK call, no Effect. Split out of dashboard.ts
+ * so that file stays under the house's 250-line cap, and so `normalizeModel`'s no-change-is-noop
+ * behavior is exercised directly in dashboard-model.test.ts without a fake Grafana in the way.
+ */
+export type DashboardModel = Record<string, unknown>;
+/**
+ * ★ NORMALIZES BOTH SIDES THE SAME WAY, so a no-change plan is a true noop
+ *   (docs/grafana-folder-dashboard.md). Strips `id`/`version`/`iteration` (Grafana-managed, never
+ *   declared content) and forces `uid` to this resource's OWN canonical value, wherever — or
+ *   whether — the source object carried one. That second part is "uid placement": a dashboard
+ *   pasted from Grafana's own "Export as JSON" always embeds the OLD live uid (or none, for a
+ *   never-saved dashboard), while the live model this resource reads back always carries the
+ *   CURRENT one; forcing both to `props.uid` before comparing is what makes those two shapes equal
+ *   instead of permanently disagreeing on one field neither side is meant to declare independently
+ *   (`DashboardProps.uid` — see dashboard.ts — is the single source of truth).
+ *
+ * ⚠️ EVERY OTHER DECLARED FIELD COMPARES STRUCTURALLY, ARRAY ORDER INCLUDED — dashboard.ts's
+ *   `matches` runs this output through THIS FILE's own `declaredContentMatches` (below), which
+ *   never reorders an array. That is correct here: `panels` is position-significant (screen layout
+ *   via its own `gridPos`, but the array order also drives Grafana's internal panel indexing and
+ *   any `repeat` behavior) and each panel's `targets` is execution/legend order. Nothing in a
+ *   dashboard model is a genuinely unordered SET the way UniFi's `trustedDhcpServerIpAddresses` is
+ *   (unifi/network-form.ts's `sortedSet`) — this family has no field that needs one.
+ * ⚠️ `schemaVersion` IS DELIBERATELY **NOT** NORMALIZED — NOT MEASURED against a live instance (no
+ *   live calls in this PR). Community reports say Grafana can rewrite an old dashboard's
+ *   `schemaVersion` upward on load; IF that also happens on every plain save of an
+ *   already-current-schema dashboard, every plan against it would show a false `update` forever —
+ *   but silently normalizing it away on a guess would just as easily hide a genuine schema
+ *   mismatch. Left comparing until measured: add it to `VOLATILE_FIELDS` with a dated, measured
+ *   comment the day it is seen live, the same standard every other row in this file meets.
+ */
+export declare const normalizeModel: (model: DashboardModel, uid: string) => DashboardModel;
+/** The model's own declared title — reporting only. It is never compared on its own; the whole
+ *  normalized model is, in dashboard.ts's `matches`, so a title-only mismatch still shows `update`. */
+export declare const modelTitle: (model: DashboardModel) => string;
+/**
+ * ★ `declared` NEED ONLY BE A SUBSET OF `live` — an adversarial review of this PR (2026-09-24)
+ *   found that plain structural equality made an ordinary, never-edited dashboard show `update`
+ *   FOREVER: Grafana's own dashboard-save schema migration rewrites any panel or target whose
+ *   `datasource` is absent into an explicit `{type, uid}` reference to the resolved default
+ *   datasource — documented Grafana schema-migration behavior (not re-measured against a live
+ *   instance in this PR — no live calls). A declared panel that never sets `datasource` (the
+ *   common case: hand-authored JSON, or anything relying on the dashboard-level default) would,
+ *   after the FIRST create, read back with that field populated; plain `deepEqual` (this file used
+ *   `alchemy/Diff`'s before this fix) then disagreed with the declaration on every subsequent plan,
+ *   `update` sent the undecorated model back, and Grafana redecorated it again on the next read —
+ *   non-convergent.
+ *
+ * This function instead asks only "does every field the DECLARATION mentions, at any depth, still
+ * match what is live" — `live` may carry additional fields, at any depth, that `declared` never
+ * mentioned (the datasource auto-decoration above, or any future Grafana-injected default,
+ * `fieldConfig` defaults and `pluginVersion` included) without being compared at all. A field
+ * `declared` DOES mention that is missing, or different, in `live` still fails the match — real
+ * content drift is still caught exactly as before; only fields the declaration is silent about are
+ * now tolerated rather than compared.
+ *
+ * ⚠️ THE TRADE-OFF THIS ACCEPTS, DELIBERATELY: removing a field from the declaration (rather than
+ *   changing its value) can no longer force Grafana to drop it. If a panel once declared an
+ *   explicit `datasource` and a later declaration deletes that key entirely (rather than setting a
+ *   different one), `live` keeps whatever the last write set — the declaration is silent about that
+ *   key now, so nothing compares it, so no `update` ever fires to change it. This is the same
+ *   "undeclared means don't care, never means force-to-default" convention already used everywhere
+ *   else in this kit for a plain optional prop (e.g. `datasource.ts`'s `matches` never treats an
+ *   undeclared `access` as "must be unset"); it now also applies inside the JSON model, not just at
+ *   the props level. Declare an explicit replacement value to change a field; omission never clears
+ *   one that was set by a previous declaration or by Grafana itself.
+ *
+ * ⚠️ ARRAYS COMPARE BY LENGTH, THEN ELEMENT-WISE SUBSET — never by a looser "declared has fewer
+ *   items" rule. `panels`/`targets` are position-significant (see `normalizeModel`'s header); an
+ *   array Grafana pads or reorders on its own would still need normalizing here explicitly, the
+ *   same as any other newly-discovered auto-decoration — this function does not paper over that.
+ * ⚠️ `null` ON EITHER SIDE OF A LEAF NEVER MISMATCHES (mirrors `alchemy/Diff`'s `deepEqual` with
+ *   `stripNullish: true`, which this function replaces for the dashboard model specifically).
+ */
+export declare const declaredContentMatches: (declared: unknown, live: unknown) => boolean;
+//# sourceMappingURL=dashboard-model.d.ts.map

package/dist/grafana/dashboard-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-model.d.ts","sourceRoot":"","sources":["../../src/grafana/dashboard-model.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAKrD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,cAAc,UAAW,cAAc,OAAO,MAAM,KAAG,cASnE,CAAC;AAEF;uGACuG;AACvG,eAAO,MAAM,UAAU,UAAW,cAAc,KAAG,MACC,CAAC;AAKrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,sBAAsB,aAAc,OAAO,QAAQ,OAAO,KAAG,OAgBzE,CAAC"}

package/dist/grafana/dashboard.d.ts

@@ -0,0 +1,98 @@
+/**
+ * `Grafana.Dashboard` — one Grafana dashboard, keyed by `uid`. Same uid-required doctrine as
+ * `datasource.ts`/`folder.ts` (`getDashboard`/`postDashboard`/`deleteDashboard` are all UID-keyed
+ * on the wire — `postDashboard`'s own `uid` travels INSIDE the `dashboard` JSON body, not as a
+ * request field, because Grafana's classic dashboard-save API has never had one; see
+ * `dashboard-model.ts`'s `normalizeModel`, which is what puts it there).
+ *
+ * ★ THE DECLARED CONTENT IS THE DASHBOARD JSON MODEL — `DashboardProps.dashboard`, the same shape
+ *   Grafana's own "Export as JSON" produces. `dashboard-model.ts`'s `normalizeModel` strips the
+ *   volatile fields (`id`, `version`, `iteration`) and forces `uid` to this resource's own value
+ *   before ANY comparison, so a plan against an unchanged dashboard is a true noop despite those
+ *   fields moving on every live save — see that file for the full reasoning, including which
+ *   fields (`panels`, `targets`) are array-ORDER-significant and compared as such.
+ *
+ * ⛔ `matches` COMPARES "IS THE DECLARATION A SUBSET OF WHAT IS LIVE", NOT PLAIN EQUALITY —
+ *   `dashboard-model.ts`'s `declaredContentMatches`, added after an adversarial review of this PR
+ *   found plain `deepEqual` made an ordinary dashboard show `update` FOREVER: Grafana's own
+ *   schema-migration on save decorates any panel/target whose `datasource` is absent with an
+ *   explicit reference, so a declaration that never sets one would permanently disagree with what
+ *   it reads back. See that function's own header for the full reasoning and the trade-off it
+ *   accepts (an omitted field can no longer be used to CLEAR a previously-set one).
+ *
+ * ⛔ VERSION CONFLICTS (412) FAIL LOUDLY — NEVER OVERWRITTEN BLINDLY. `update` injects the
+ *   `version` this resource just read (`live.meta.version`, from the SAME `fetchLive` call
+ *   `resource.ts`'s `reconcile` already made before calling `update`) into the model it sends, and
+ *   `overwrite` is never set. If Grafana's own version check then still fails — someone else saved
+ *   in the gap between that read and this write — `postDashboard` answers `412` and
+ *   `PreconditionFailed` is left IN the error union below, uncaught: the whole reconcile fails, the
+ *   deploy stops, and nothing is written. The next run's `fetchLive` re-reads the new live version
+ *   fresh, which is the "re-read" half of "re-read and fail loudly" — there is no separate retry
+ *   loop in this file, because the next `plan`/`deploy` invocation already IS that re-read.
+ *
+ * ⛔ A PROVISIONED DASHBOARD (`meta.provisioned` — see provisioned.ts) REFUSES EVERY UPDATE AND
+ *   DESTROY, naming `meta.provisionedExternalId` (the file) when Grafana reports one. `matches`
+ *   still compares structurally regardless, so a mismatched declaration against a provisioned
+ *   dashboard shows `update` in a plan rather than a silent, permanently-hidden noop.
+ *
+ * ⚠️ NO RETAIN DEFAULT, UNLIKE `Grafana.Folder`. Deleting one dashboard is a single-object blast
+ *   radius — the same class `Grafana.Datasource` already accepts without a retain guard — not
+ *   folder.ts's multi-object cascade (a folder's delete takes its dashboards AND their alert rules
+ *   with it). See folder.ts's file header for the full contrast.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as grafana from '@distilled.cloud/grafana';
+import * as Effect from 'effect/Effect';
+import { type DashboardModel } from './dashboard-model.ts';
+import { type GrafanaProvisionedObjectError } from './provisioned.ts';
+import { type GrafanaSpec } from './resource.ts';
+export type { DashboardModel };
+export interface DashboardProps {
+    uid: string;
+    /** Omit for the General/root folder. */
+    folderUid?: string;
+    /** The dashboard JSON model — see the file header. `id`/`version`/`iteration`/`uid` inside it
+     *  are ignored; `uid` above is the single source of truth. */
+    dashboard: DashboardModel;
+}
+export interface DashboardAttributes {
+    uid: string;
+    title: string;
+    version: number;
+    folderUid: string;
+    url: string;
+    /** True when Grafana reports this dashboard as file-provisioned (read-only — see provisioned.ts). */
+    provisioned: boolean;
+    provisionedExternalId: string;
+    /** The live model, normalized the same way `matches` compares it. */
+    dashboard: DashboardModel;
+}
+export interface GrafanaDashboard extends Resource<'Grafana.Dashboard', DashboardProps, DashboardAttributes, never> {
+}
+export declare const GrafanaDashboard: import("alchemy").ResourceClass<GrafanaDashboard>;
+export declare const spec: GrafanaSpec<DashboardProps, grafana.DashboardFullWithMeta, DashboardAttributes, grafana.GetDashboardError | grafana.PostDashboardError | grafana.DeleteDashboardError | GrafanaProvisionedObjectError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: DashboardProps;
+    }) => Effect.Effect<DashboardAttributes | undefined, grafana.BadGateway | import("@distilled.cloud/caddy").BadRequest | grafana.BadRequest | grafana.ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | grafana.Forbidden | grafana.GatewayTimeout | GrafanaProvisionedObjectError | import("effect/unstable/http/HttpClientError").HttpClientError | grafana.InternalServerError | grafana.Locked | import("@distilled.cloud/caddy").NotFound | grafana.NotFound | grafana.PreconditionFailed | grafana.ServiceUnavailable | grafana.TooManyRequests | grafana.Unauthorized | grafana.UnknownGrafanaError | import("@distilled.cloud/caddy").UnprocessableEntity | grafana.UnprocessableEntity, grafana.GrafanaOpContext>;
+    diff: ({ news, output }: {
+        news: import("alchemy").Input<DashboardProps>;
+        output: DashboardAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | {
+        readonly action: 'replace';
+    } | undefined, grafana.BadGateway | import("@distilled.cloud/caddy").BadRequest | grafana.BadRequest | grafana.ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | grafana.Forbidden | grafana.GatewayTimeout | GrafanaProvisionedObjectError | import("effect/unstable/http/HttpClientError").HttpClientError | grafana.InternalServerError | grafana.Locked | import("@distilled.cloud/caddy").NotFound | grafana.NotFound | grafana.PreconditionFailed | grafana.ServiceUnavailable | grafana.TooManyRequests | grafana.Unauthorized | grafana.UnknownGrafanaError | import("@distilled.cloud/caddy").UnprocessableEntity | grafana.UnprocessableEntity, grafana.GrafanaOpContext>;
+    reconcile: ({ news }: {
+        news: DashboardProps;
+    }) => Effect.Effect<DashboardAttributes, grafana.BadGateway | import("@distilled.cloud/caddy").BadRequest | grafana.BadRequest | grafana.ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | grafana.Forbidden | grafana.GatewayTimeout | GrafanaProvisionedObjectError | import("effect/unstable/http/HttpClientError").HttpClientError | grafana.InternalServerError | grafana.Locked | import("@distilled.cloud/caddy").NotFound | grafana.NotFound | grafana.PreconditionFailed | grafana.ServiceUnavailable | grafana.TooManyRequests | grafana.Unauthorized | grafana.UnknownGrafanaError | import("@distilled.cloud/caddy").UnprocessableEntity | grafana.UnprocessableEntity, grafana.GrafanaOpContext>;
+    delete: ({ olds }: {
+        olds: DashboardProps;
+    }) => Effect.Effect<void, grafana.BadGateway | import("@distilled.cloud/caddy").BadRequest | grafana.BadRequest | grafana.ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | grafana.Forbidden | grafana.GatewayTimeout | GrafanaProvisionedObjectError | import("effect/unstable/http/HttpClientError").HttpClientError | grafana.InternalServerError | grafana.Locked | import("@distilled.cloud/caddy").NotFound | grafana.NotFound | grafana.PreconditionFailed | grafana.ServiceUnavailable | grafana.TooManyRequests | grafana.Unauthorized | grafana.UnknownGrafanaError | import("@distilled.cloud/caddy").UnprocessableEntity | grafana.UnprocessableEntity, grafana.GrafanaOpContext>;
+};
+export declare const GrafanaDashboardProvider: () => import("effect/Layer").Layer<Provider.Provider<GrafanaDashboard>, never, grafana.GrafanaOpContext>;
+//# sourceMappingURL=dashboard.d.ts.map

package/dist/grafana/dashboard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../src/grafana/dashboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC;AACpD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,cAAc,EAIpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,KAAK,6BAA6B,EAAuB,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,eAAe,CAAC;AAElE,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;kEAC8D;IAC9D,SAAS,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,qGAAqG;IACrG,WAAW,EAAE,OAAO,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,SAAS,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,KAAK,CACN;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAAkD,CAAC;AAOhF,eAAO,MAAM,IAAI,EAAE,WAAW,CAC5B,cAAc,EACd,OAAO,CAAC,qBAAqB,EAC7B,mBAAmB,EACjB,OAAO,CAAC,iBAAiB,GACzB,OAAO,CAAC,kBAAkB,GAC1B,OAAO,CAAC,oBAAoB,GAC5B,6BAA6B,CAuDhC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;CAAwB,CAAC;AAE9C,eAAO,MAAM,wBAAwB,0GACsD,CAAC"}

package/dist/grafana/folder.d.ts

@@ -0,0 +1,100 @@
+/**
+ * `Grafana.Folder` — one Grafana folder, keyed by `uid`. Mirrors `datasource.ts`'s shape and
+ * doctrine (uid required, not generated — same reasoning, `getFolderByUID`/`updateFolder`/
+ * `deleteFolder` are all UID-keyed and `getFolders` (list) has no per-uid filter).
+ *
+ * ⛔ `description` IS WRITE-ONLY — MEASURED against `@distilled.cloud/grafana`'s generated types
+ *   (`Folder` in services/grafana.ts has no `description` field at all, though
+ *   `CreateFolderRequest`/`UpdateFolderRequest` both accept one). Grafana's classic folder GET
+ *   never returns it, not even as an is-it-set flag the way `DataSource.secureJsonFields` reports
+ *   for a datasource's secure fields. So `description` is sent on every create/update that
+ *   declares it but is NEVER part of `matches` — this resource cannot detect drift in a value it
+ *   is never shown, the same treatment `datasource.ts` gives `secureJsonDataRefs`.
+ *
+ * ⚠️ NESTING (`parentUid`) IS CREATE-ONLY — MEASURED against the same generated types.
+ *   `CreateFolderRequest.parentUid` exists; `UpdateFolderRequest` has no `parentUid` field at all
+ *   (`folder_uid`, `description`, `overwrite`, `title`, `version` — reparenting is simply not a
+ *   thing `PUT /folders/{uid}` can do). A declaration whose `parentUid` no longer matches the live
+ *   folder therefore REFUSES with `GrafanaFolderReparentError` rather than either silently doing
+ *   nothing (which would lie about the declaration taking effect) or deleting and recreating the
+ *   folder under the new parent (which — see the ⛔ below — takes every dashboard and alert rule in
+ *   it with it). Move a folder by hand in Grafana, then adjust the declaration to match.
+ *
+ * ⛔ DELETE DEFAULTS TO `retain` — DELETING A FOLDER DELETES ITS DASHBOARDS AND ALERT RULES IN
+ *   GRAFANA, per `deleteFolder`'s own operation description ("along with all dashboards (and their
+ *   alerts) stored in the folder... cannot be reverted... also deletes all the subfolders"). That
+ *   is the same class of multi-object cascade `openbao/mount.ts` guards with
+ *   `defaultRemovalPolicy: 'retain'` ("disabling a mount destroys every secret under it") — VERIFIED
+ *   there against Alchemy's own `Apply.ts` (not re-verified here; same engine, same option). A
+ *   stack that explicitly wants the cascade opts in with `.pipe(RemovalPolicy.destroy())` on the
+ *   declared instance; `destroy` below still implements the real DELETE in full either way (S11).
+ *   `Grafana.Dashboard` does NOT default to retain — deleting one dashboard is the same
+ *   single-object blast radius `Grafana.Datasource` already accepts without a retain guard, not
+ *   this family's multi-object cascade.
+ *
+ * ⛔ A PROVISIONED FOLDER (`managedBy` set — see provisioned.ts) REFUSES EVERY UPDATE AND DESTROY.
+ *   `matches` still compares structurally either way, so a mismatched declaration against a
+ *   provisioned folder shows `update` in a plan (never a silent, permanently-hidden noop) and then
+ *   fails loudly, by design, when reconcile actually tries to write.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as grafana from '@distilled.cloud/grafana';
+import * as Effect from 'effect/Effect';
+import { type GrafanaProvisionedObjectError } from './provisioned.ts';
+import { type GrafanaSpec } from './resource.ts';
+export interface FolderProps {
+    uid: string;
+    title: string;
+    /** Write-only — see the file header. Sent on every create/update that declares it; never diffed. */
+    description?: string;
+    /** Parent folder UID, for nested folders. Create-only — see the file header. */
+    parentUid?: string;
+}
+export interface FolderAttributes {
+    uid: string;
+    id: number;
+    title: string;
+    parentUid: string;
+    /** Non-empty when Grafana reports this folder as externally managed (e.g. provisioning). */
+    managedBy: string;
+    url: string;
+    version: number;
+}
+export interface GrafanaFolder extends Resource<'Grafana.Folder', FolderProps, FolderAttributes, never> {
+}
+export declare const GrafanaFolder: import("alchemy").ResourceClass<GrafanaFolder>;
+declare const GrafanaFolderReparentError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "GrafanaFolderReparentError";
+} & Readonly<A>;
+/** A declared `parentUid` disagrees with the live folder's — `updateFolder` cannot reparent. */
+export declare class GrafanaFolderReparentError extends GrafanaFolderReparentError_base<{
+    readonly message: string;
+}> {
+}
+export declare const spec: GrafanaSpec<FolderProps, grafana.Folder, FolderAttributes, grafana.CreateFolderError | grafana.GetFolderByUIDError | grafana.UpdateFolderError | grafana.DeleteFolderError | GrafanaProvisionedObjectError | GrafanaFolderReparentError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: FolderProps;
+    }) => Effect.Effect<FolderAttributes | undefined, grafana.BadGateway | import("@distilled.cloud/caddy").BadRequest | grafana.BadRequest | grafana.ConfigError | import("@distilled.cloud/caddy").Conflict | grafana.Conflict | import("@distilled.cloud/caddy").Forbidden | grafana.Forbidden | grafana.GatewayTimeout | GrafanaFolderReparentError | GrafanaProvisionedObjectError | import("effect/unstable/http/HttpClientError").HttpClientError | grafana.InternalServerError | grafana.Locked | import("@distilled.cloud/caddy").NotFound | grafana.NotFound | grafana.ServiceUnavailable | grafana.TooManyRequests | grafana.Unauthorized | grafana.UnknownGrafanaError | import("@distilled.cloud/caddy").UnprocessableEntity, grafana.GrafanaOpContext>;
+    diff: ({ news, output }: {
+        news: import("alchemy").Input<FolderProps>;
+        output: FolderAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | {
+        readonly action: 'replace';
+    } | undefined, grafana.BadGateway | import("@distilled.cloud/caddy").BadRequest | grafana.BadRequest | grafana.ConfigError | import("@distilled.cloud/caddy").Conflict | grafana.Conflict | import("@distilled.cloud/caddy").Forbidden | grafana.Forbidden | grafana.GatewayTimeout | GrafanaFolderReparentError | GrafanaProvisionedObjectError | import("effect/unstable/http/HttpClientError").HttpClientError | grafana.InternalServerError | grafana.Locked | import("@distilled.cloud/caddy").NotFound | grafana.NotFound | grafana.ServiceUnavailable | grafana.TooManyRequests | grafana.Unauthorized | grafana.UnknownGrafanaError | import("@distilled.cloud/caddy").UnprocessableEntity, grafana.GrafanaOpContext>;
+    reconcile: ({ news }: {
+        news: FolderProps;
+    }) => Effect.Effect<FolderAttributes, grafana.BadGateway | import("@distilled.cloud/caddy").BadRequest | grafana.BadRequest | grafana.ConfigError | import("@distilled.cloud/caddy").Conflict | grafana.Conflict | import("@distilled.cloud/caddy").Forbidden | grafana.Forbidden | grafana.GatewayTimeout | GrafanaFolderReparentError | GrafanaProvisionedObjectError | import("effect/unstable/http/HttpClientError").HttpClientError | grafana.InternalServerError | grafana.Locked | import("@distilled.cloud/caddy").NotFound | grafana.NotFound | grafana.ServiceUnavailable | grafana.TooManyRequests | grafana.Unauthorized | grafana.UnknownGrafanaError | import("@distilled.cloud/caddy").UnprocessableEntity, grafana.GrafanaOpContext>;
+    delete: ({ olds }: {
+        olds: FolderProps;
+    }) => Effect.Effect<void, grafana.BadGateway | import("@distilled.cloud/caddy").BadRequest | grafana.BadRequest | grafana.ConfigError | import("@distilled.cloud/caddy").Conflict | grafana.Conflict | import("@distilled.cloud/caddy").Forbidden | grafana.Forbidden | grafana.GatewayTimeout | GrafanaFolderReparentError | GrafanaProvisionedObjectError | import("effect/unstable/http/HttpClientError").HttpClientError | grafana.InternalServerError | grafana.Locked | import("@distilled.cloud/caddy").NotFound | grafana.NotFound | grafana.ServiceUnavailable | grafana.TooManyRequests | grafana.Unauthorized | grafana.UnknownGrafanaError | import("@distilled.cloud/caddy").UnprocessableEntity, grafana.GrafanaOpContext>;
+};
+export declare const GrafanaFolderProvider: () => import("effect/Layer").Layer<Provider.Provider<GrafanaFolder>, never, grafana.GrafanaOpContext>;
+export {};
+//# sourceMappingURL=folder.d.ts.map

package/dist/grafana/folder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"folder.d.ts","sourceRoot":"","sources":["../../src/grafana/folder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC;AAEpD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,6BAA6B,EAAuB,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,eAAe,CAAC;AAElE,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,oGAAoG;IACpG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,KAAK,CACN;CAAG;AAEJ,eAAO,MAAM,aAAa,gDAExB,CAAC;;;;AAEH,gGAAgG;AAChG,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AAEL,eAAO,MAAM,IAAI,EAAE,WAAW,CAC5B,WAAW,EACX,OAAO,CAAC,MAAM,EACd,gBAAgB,EACd,OAAO,CAAC,iBAAiB,GACzB,OAAO,CAAC,mBAAmB,GAC3B,OAAO,CAAC,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,GACzB,6BAA6B,GAC7B,0BAA0B,CA+D7B,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;CAAwB,CAAC;AAE9C,eAAO,MAAM,qBAAqB,uGACmD,CAAC"}

package/dist/grafana/index.d.ts

@@ -2,17 +2,18 @@
  * Grafana providers for Alchemy.
  *
  * ⛔ THIS BARREL IS THE PUBLIC API, AND IT IS DELIBERATELY SMALLER THAN THE DIRECTORY. These are
- *   the symbols a real stack consumes; the rest of the files (resource.ts's engine, fake-grafana.ts)
- *   are internals a provider needs but a consumer should not depend on.
+ *   the symbols a real stack consumes; the rest of the files (resource.ts's engine, provisioned.ts,
+ *   dashboard-model.ts, fake-grafana.ts) are internals a provider needs but a consumer should not
+ *   depend on.
  *
- * ⛔ ONLY `Grafana.Datasource` SHIPS HERE. `@distilled.cloud/grafana` (aliased onto
- *   `@homeflare/distilled-grafana` — see docs/distilled-interim.md) now HAS folder, dashboard and
- *   alerting-provisioning CRUD operations — the SDK-level gap docs/grafana.md and
- *   docs/upstream-conformance.md recorded is fixed. Building `Grafana.Folder`, `Grafana.Dashboard`,
- *   `Grafana.AlertRule` etc. on top of them is follow-up work this PR deliberately does not do —
- *   see docs/grafana.md for what changed and what is still open.
+ * `Grafana.Datasource`, `Grafana.Folder` and `Grafana.Dashboard` ship here. `Grafana.AlertRule`
+ * and friends are still follow-up work on the same now-available SDK operations — see
+ * docs/grafana.md and docs/grafana-folder-dashboard.md for what shipped and what is still open.
  */
 export { type DatasourceAttributes, type DatasourceProps, GrafanaDatasource, GrafanaDatasourceProvider, GrafanaSecretRefUnsetError, } from './datasource.ts';
+export { type DashboardAttributes, type DashboardModel, type DashboardProps, GrafanaDashboard, GrafanaDashboardProvider, } from './dashboard.ts';
+export { type FolderAttributes, type FolderProps, GrafanaFolder, GrafanaFolderProvider, GrafanaFolderReparentError, } from './folder.ts';
+export { GrafanaProvisionedObjectError } from './provisioned.ts';
 export { type GrafanaTarget, grafanaCredentials } from './credentials.ts';
 export { grafanaProviders } from './providers.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/grafana/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/grafana/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,KAAK,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/grafana/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,KAAK,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/grafana/index.js

@@ -120,30 +120,182 @@ var spec = {
 };
 var handlers = grafanaHandlers(spec);
 var GrafanaDatasourceProvider = () => Provider.effect(GrafanaDatasource, Effect2.succeed(GrafanaDatasource.Provider.of(handlers)));
+// src/grafana/dashboard.ts
+import { Resource as Resource2 } from "alchemy";
+import * as Provider2 from "alchemy/Provider";
+import * as grafana2 from "@distilled.cloud/grafana";
+import * as Effect4 from "effect/Effect";
+
+// src/grafana/dashboard-model.ts
+var VOLATILE_FIELDS = ["id", "version", "iteration"];
+var normalizeModel = (model, uid) => {
+  const normalized = {};
+  for (const [key, value] of Object.entries(model)) {
+    if (key === "uid")
+      continue;
+    if (VOLATILE_FIELDS.includes(key))
+      continue;
+    normalized[key] = value;
+  }
+  normalized.uid = uid;
+  return normalized;
+};
+var modelTitle = (model) => typeof model.title === "string" ? model.title : "";
+var isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var declaredContentMatches = (declared, live) => {
+  if (declared == null)
+    return true;
+  if (Array.isArray(declared)) {
+    return Array.isArray(live) && declared.length === live.length && declared.every((item, index) => declaredContentMatches(item, live[index]));
+  }
+  if (isPlainObject(declared)) {
+    return isPlainObject(live) && Object.entries(declared).every(([key, value]) => declaredContentMatches(value, live[key]));
+  }
+  return declared === live;
+};
+
+// src/grafana/provisioned.ts
+import * as Data2 from "effect/Data";
+import * as Effect3 from "effect/Effect";
+
+class GrafanaProvisionedObjectError extends Data2.TaggedError("GrafanaProvisionedObjectError") {
+}
+var refuseIfProvisioned = (kind, uid, owner) => {
+  const ownerClause = owner === undefined || owner === "" ? `(this Grafana instance did not report an owning file)` : `by ${owner}`;
+  return Effect3.fail(new GrafanaProvisionedObjectError({
+    message: `${kind} '${uid}' is file-provisioned ${ownerClause} and read-only through the classic ` + `write API this family calls. Edit the provisioning file instead — declaring this ` + `object read-only (a declaration matching what is live) is safe and will never reach ` + `this refusal.`
+  }));
+};
+
+// src/grafana/dashboard.ts
+var GrafanaDashboard = Resource2("Grafana.Dashboard");
+var modelOf = (live) => live.dashboard !== null && typeof live.dashboard === "object" ? live.dashboard : {};
+var spec2 = {
+  attributes: (live, props) => {
+    const model = normalizeModel(modelOf(live), props.uid);
+    return {
+      dashboard: model,
+      folderUid: live.meta?.folderUid ?? "",
+      provisioned: live.meta?.provisioned ?? false,
+      provisionedExternalId: live.meta?.provisionedExternalId ?? "",
+      title: modelTitle(model),
+      uid: props.uid,
+      url: live.meta?.url ?? "",
+      version: live.meta?.version ?? 0
+    };
+  },
+  create: (props) => grafana2.postDashboard({
+    dashboard: normalizeModel(props.dashboard, props.uid),
+    ...props.folderUid === undefined ? {} : { folderUid: props.folderUid }
+  }),
+  destroy: (props, live) => Effect4.gen(function* () {
+    if (live.meta?.provisioned) {
+      return yield* refuseIfProvisioned("Grafana.Dashboard", props.uid, live.meta.provisionedExternalId);
+    }
+    yield* grafana2.deleteDashboard({ uid: props.uid });
+  }),
+  fetchLive: (props) => grafana2.getDashboard({ uid: props.uid }).pipe(Effect4.catchTag("NotFound", () => Effect4.succeed(undefined))),
+  matches: (attributes, props) => (props.folderUid === undefined || attributes.folderUid === props.folderUid) && declaredContentMatches(normalizeModel(props.dashboard, props.uid), attributes.dashboard),
+  update: (props, live) => Effect4.gen(function* () {
+    if (live.meta?.provisioned) {
+      return yield* refuseIfProvisioned("Grafana.Dashboard", props.uid, live.meta.provisionedExternalId);
+    }
+    return yield* grafana2.postDashboard({
+      dashboard: {
+        ...normalizeModel(props.dashboard, props.uid),
+        ...live.meta?.version === undefined ? {} : { version: live.meta.version }
+      },
+      ...props.folderUid === undefined ? {} : { folderUid: props.folderUid }
+    });
+  })
+};
+var handlers2 = grafanaHandlers(spec2);
+var GrafanaDashboardProvider = () => Provider2.effect(GrafanaDashboard, Effect4.succeed(GrafanaDashboard.Provider.of(handlers2)));
+// src/grafana/folder.ts
+import { Resource as Resource3 } from "alchemy";
+import * as Provider3 from "alchemy/Provider";
+import * as grafana3 from "@distilled.cloud/grafana";
+import * as Data3 from "effect/Data";
+import * as Effect5 from "effect/Effect";
+var GrafanaFolder = Resource3("Grafana.Folder", {
+  defaultRemovalPolicy: "retain"
+});
+
+class GrafanaFolderReparentError extends Data3.TaggedError("GrafanaFolderReparentError") {
+}
+var spec3 = {
+  attributes: (live) => ({
+    id: live.id ?? 0,
+    managedBy: live.managedBy ?? "",
+    parentUid: live.parentUid ?? "",
+    title: live.title ?? "",
+    uid: live.uid ?? "",
+    url: live.url ?? "",
+    version: live.version ?? 0
+  }),
+  create: (props) => grafana3.createFolder({
+    uid: props.uid,
+    title: props.title,
+    ...props.description === undefined ? {} : { description: props.description },
+    ...props.parentUid === undefined ? {} : { parentUid: props.parentUid }
+  }),
+  destroy: (props, live) => Effect5.gen(function* () {
+    if (live.managedBy) {
+      return yield* refuseIfProvisioned("Grafana.Folder", props.uid, live.managedBy);
+    }
+    yield* grafana3.deleteFolder({ folder_uid: props.uid });
+  }),
+  fetchLive: (props) => grafana3.getFolderByUID({ folder_uid: props.uid }).pipe(Effect5.catchTag("NotFound", () => Effect5.succeed(undefined))),
+  matches: (attributes, props) => attributes.title === props.title && (props.parentUid === undefined || attributes.parentUid === props.parentUid),
+  update: (props, live) => Effect5.gen(function* () {
+    if (live.managedBy) {
+      return yield* refuseIfProvisioned("Grafana.Folder", props.uid, live.managedBy);
+    }
+    if (props.parentUid !== undefined && props.parentUid !== (live.parentUid ?? undefined)) {
+      return yield* Effect5.fail(new GrafanaFolderReparentError({
+        message: `Grafana.Folder '${props.uid}' declares parentUid '${props.parentUid}' but is ` + `live under '${live.parentUid ?? "(root)"}'. PUT /folders/{uid} cannot reparent a ` + `folder — move it by hand in Grafana, then update the declaration to match.`
+      }));
+    }
+    return yield* grafana3.updateFolder({
+      folder_uid: props.uid,
+      title: props.title,
+      ...props.description === undefined ? {} : { description: props.description },
+      ...live.version === undefined ? {} : { version: live.version }
+    });
+  })
+};
+var handlers3 = grafanaHandlers(spec3);
+var GrafanaFolderProvider = () => Provider3.effect(GrafanaFolder, Effect5.succeed(GrafanaFolder.Provider.of(handlers3)));
 // src/grafana/credentials.ts
 import { Credentials } from "@distilled.cloud/grafana/Credentials";
 import { ConfigError } from "@distilled.cloud/grafana/Errors";
-import * as Effect3 from "effect/Effect";
+import * as Effect6 from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
-var resolve = (target) => Effect3.sync(() => process.env[target.tokenEnv]).pipe(Effect3.flatMap((raw) => raw === undefined || raw.trim() === "" ? Effect3.fail(new ConfigError({
+var resolve = (target) => Effect6.sync(() => process.env[target.tokenEnv]).pipe(Effect6.flatMap((raw) => raw === undefined || raw.trim() === "" ? Effect6.fail(new ConfigError({
   message: `${target.tokenEnv} is not set. Export the Grafana service-account token there ` + `— never as an Alchemy prop — before running a stack that declares a resource ` + `against ${target.baseUrl}.`
-})) : Effect3.succeed({
+})) : Effect6.succeed({
   apiBaseUrl: target.baseUrl.replace(/\/+$/, ""),
   token: Redacted.make(raw.trim()),
   ...target.orgId === undefined ? {} : { orgId: target.orgId }
-})), Effect3.orDie);
+})), Effect6.orDie);
 var grafanaCredentials = (target) => Layer.succeed(Credentials, resolve(target));
 // src/grafana/providers.ts
 import * as Layer2 from "effect/Layer";
-var grafanaProviders = (target) => GrafanaDatasourceProvider().pipe(Layer2.provide(grafanaCredentials(target)));
+var grafanaProviders = (target) => Layer2.mergeAll(GrafanaDatasourceProvider(), GrafanaFolderProvider(), GrafanaDashboardProvider()).pipe(Layer2.provide(grafanaCredentials(target)));
 export {
+  GrafanaDashboard,
+  GrafanaDashboardProvider,
   GrafanaDatasource,
   GrafanaDatasourceProvider,
+  GrafanaFolder,
+  GrafanaFolderProvider,
+  GrafanaFolderReparentError,
+  GrafanaProvisionedObjectError,
   GrafanaSecretRefUnsetError,
   grafanaCredentials,
   grafanaProviders
 };
 
-//# debugId=DA921F3915B68A6164756E2164756E21
+//# debugId=D031E5F2BA23E8BC64756E2164756E21
 //# sourceMappingURL=index.js.map