@homeflare/alchemy 0.35.0 → 0.37.0

package/src/proxmox/ceph-pool-wire.ts

@@ -0,0 +1,110 @@
+/**
+ * `Proxmox.CephPool`'s distilled wire lane: the status read, and the two request translations.
+ *
+ * ★ SPLIT OUT OF ceph-pool-form.ts FOR THE 250-LINE CAP (that file is already near it) — the seam
+ *   is "touches the cluster or not", the same one ceph-pool-form.ts itself draws against
+ *   ceph-pool.ts. Nothing in ceph-pool-form.ts changed: `createBody`/`updateBody` still build the
+ *   PVE form, unaware distilled exists: this file is the ONLY place that translates one into a
+ *   typed distilled request.
+ *
+ * ⛔ ONE READ FUNCTION, NOT THE readXOrFail/foldingX PAIR user.ts/group.ts/storage.ts/zfs-pool.ts/
+ *   node-network-wire.ts CARRY. THIS IS A DELIBERATE, MEASURED DIFFERENCE, NOT AN OVERSIGHT. Those
+ *   families were BUILT with (or later given, after the NodeNetwork adversarial review) the
+ *   dual-path pattern because their `diff`/`read` hooks needed to tell "genuinely absent" apart
+ *   from "a transient failure" at specific call sites. CephPool's PRE-MIGRATION behaviour never
+ *   had that distinction: `resource.ts`'s generic `pveOperations.read` — what `ops.read`/`ops.diff`
+ *   called before this PR — folds EVERY failure into `undefined` unconditionally
+ *   (`Effect.orElseSucceed(() => undefined)`, no `output`-branching, checked directly against
+ *   `resource.ts` 2026-09-24). This migration's own rule is that every existing refusal and guard
+ *   survives byte-for-byte — not that it gets upgraded on the way past. `readPoolStatus` below
+ *   reproduces that exact single-fold shape; it does not add the newer pattern.
+ * ⚠️ WORTH A LATER, SEPARATELY-SCOPED DECISION: this means CephPool (like CephDaemon) still folds
+ *   a refused OpenBao mint into "absent" too, same as every other pre-`unreadable-read.ts` family
+ *   — the cries-wolf class `Proxmox.NodeNetwork`/`Proxmox.ZfsPool`/`Proxmox.Storage` were fixed
+ *   against. Noted here rather than fixed here, since fixing it is a behaviour change this PR's
+ *   own rules do not ask for.
+ */
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import * as Effect from 'effect/Effect';
+import { runPve } from './distilled-pve.ts';
+import {
+  type CephPoolAttributes,
+  type CephPoolProps,
+  UNSET,
+  applications,
+  createBody,
+  updateBody,
+} from './ceph-pool-form.ts';
+import { bool, int, num, text } from './values.ts';
+
+/**
+ * One status answer as attributes, or `undefined` for the index-trap shape — the same defensive
+ * check ceph-pool.ts's pre-migration `attributes` carried, kept even though a well-formed
+ * distilled decode should never hand this function anything else: `GetNodeCephPoolStatusResponse`
+ * declares `name` required, so a response shaped like the INDEX (an array) fails the Schema decode
+ * before this runs at all. Left in as the same fail-safe rather than trusting that alone.
+ *
+ * ⚠️ `live` IS CAST PAST `GetNodeCephPoolStatusResponse`'s OWN TS TYPE, the same measured reason
+ *   node-network-wire.ts's `attributesOf` casts past `GetNodeNetworkResponse`: Effect Schema's
+ *   structural (non-exact) decode does not strip fields the declared type omits, and the live
+ *   probe below (2026-09-24) showed extra fields (`statistics`, `autoscale_status`) surviving.
+ */
+const attributesOf = (live: unknown, props: CephPoolProps): CephPoolAttributes | undefined => {
+  const row = live as Record<string, unknown>;
+  if (typeof row['name'] !== 'string') return undefined;
+  return {
+    applications: applications(row['application_list']),
+    crush_rule: text(row['crush_rule']),
+    id: int(row['id'], UNSET),
+    min_size: int(row['min_size'], UNSET),
+    name: props.name,
+    node: props.node,
+    nodelete: bool(row['nodelete']),
+    nopgchange: bool(row['nopgchange']),
+    nosizechange: bool(row['nosizechange']),
+    pg_autoscale_mode: text(row['pg_autoscale_mode']),
+    pg_num: int(row['pg_num'], UNSET),
+    pg_num_min: int(row['pg_num_min'], UNSET),
+    size: int(row['size'], UNSET),
+    target_size: int(row['target_size'], UNSET),
+    target_size_ratio: num(row['target_size_ratio'], UNSET),
+  };
+};
+
+/**
+ * The live pool, or `undefined` — folds every failure, exactly as `ops.read` did. Used by `read`,
+ * `diff` (via `ceph-pool.ts`'s own hand-written `reconcile`, which predates the factory) and
+ * `settle` (ceph-pool-settle.ts) alike, matching the ONE-function shape this family had before.
+ *
+ * ⛔ `verbose=1` IS WHAT MAKES `applications` VISIBLE AT ALL — ceph-pool.ts's own header has the
+ *   measured reason and the cost (two extra, unguarded mon commands PVE runs to answer it).
+ */
+export const readPoolStatus = (props: CephPoolProps) =>
+  runPve(
+    props.target,
+    'read',
+    false,
+    nodes.getNodeCephPoolStatus({ name: props.name, node: props.node, verbose: '1' }),
+  ).pipe(
+    Effect.map((live) => attributesOf(live, props)),
+    Effect.orElseSucceed(() => undefined),
+  );
+
+/** The two endpoints, as the keys `guardWrite` (distilled-guard.ts) checks both forms against. */
+export const CEPH_POOL_CREATE = 'pve:POST /nodes/{node}/ceph/pool';
+export const CEPH_POOL_UPDATE = 'pve:PUT /nodes/{node}/ceph/pool/{name}';
+
+/** The actual `createNodeCephPool` call body — `createBody`, translated. No field is renamed. */
+export const toDistilledCreate = (props: CephPoolProps): nodes.CreateNodeCephPoolRequest =>
+  ({
+    ...createBody(props),
+    node: props.node,
+  }) as unknown as nodes.CreateNodeCephPoolRequest;
+
+/** The actual `putNodeCephPool` call body — `updateBody`, translated. No field is renamed. */
+export const toDistilledUpdate = (props: CephPoolProps): nodes.PutNodeCephPoolRequest =>
+  ({
+    ...updateBody(props),
+    name: props.name,
+    node: props.node,
+  }) as unknown as nodes.PutNodeCephPoolRequest;

package/src/proxmox/ceph-pool-write.test.ts

@@ -0,0 +1,145 @@
+/**
+ * `Proxmox.CephPool`'s write paths, through Alchemy's own Plan and Apply over a fake cluster —
+ * the paths ceph-pool-adopt.test.ts does not reach: a genuine create, the PG-merge guard that
+ * stops a create over a pool the read could not confirm, and a real destroy.
+ *
+ * ★ THE ABSENCE SIGNAL IS THE MEASURED ONE. `GET .../pool/{name}/status` on a name with no pool
+ *   answers HTTP 500 (live TB4 `n2`, 2026-09-24, read-role, read-only probe:
+ *   `{"data":null,"message":"error with 'osd pool get': mon_cmd failed - unrecognized pool
+ *   '<name>'\n"}`) — a generic failure, not a parsed field like `Proxmox.NodeNetwork`'s 400. That
+ *   is why `readPoolStatus` (ceph-pool-wire.ts) folds every failure the same way `ops.read` always
+ *   did, and why `confirmAbsent` (ceph-pool-settle.ts) asks a SECOND, different question — does
+ *   the index list this name — before a create is allowed to run. `fakePve` (fake-pve.ts) cannot
+ *   answer anything but HTTP 200, so this file builds its own stub the way
+ *   zfs-pool-read-failure.test.ts does, to answer the measured 500 directly.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import { engineOver } from '../verify/fake-engine.ts';
+import { ProxmoxCephPool, ProxmoxCephPoolProvider } from './ceph-pool.ts';
+import { FAKE_TARGET, withoutBao } from './fake-pve.ts';
+
+const NODE = 'node-b';
+const NAME = 'newpool';
+const INDEX = `nodes/${NODE}/ceph/pool`;
+const OBJECT = `${INDEX}/${NAME}`;
+const STATUS = `${OBJECT}/status`;
+
+/** A generic 500 — the measured absence shape, indistinguishable from any other server error. */
+const absent = () =>
+  Response.json(
+    { data: null, message: `error with 'osd pool get': mon_cmd failed - unrecognized pool` },
+    { status: 500 },
+  );
+
+/**
+ * A cluster the test drives through three states: no pool at all, the pool listed but its status
+ * unreadable (the PG-merge guard's own case), and a real pool. `writes` records every non-GET
+ * call the same way `fakePve.writes()` does, for the same assertions.
+ */
+const cluster = () => {
+  const writes: string[] = [];
+  let indexRow: Record<string, unknown> | undefined;
+  let statusRow: Record<string, unknown> | undefined;
+  const stub = async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {
+    const request =
+      input instanceof Request ? new Request(input, init) : new Request(String(input), init);
+    const url = new URL(request.url);
+    if (url.pathname.includes('/creds/')) {
+      const data = { secret: 'fake-secret-not-real', token_id: 'hf-test@pve!fake' };
+      return Response.json({ data, lease_duration: 0 });
+    }
+    const wire = decodeURIComponent(url.pathname.replace(/^\/api2\/json\//, ''));
+    if (request.method !== 'GET') writes.push(`${request.method} ${wire}`);
+    if (wire === INDEX && request.method === 'GET') {
+      return Response.json({ data: indexRow === undefined ? [] : [indexRow] });
+    }
+    if (wire === INDEX && request.method === 'POST') {
+      indexRow = { pool_name: NAME };
+      statusRow = {
+        application_list: [],
+        crush_rule: 'replicated_rule',
+        id: 9,
+        min_size: 2,
+        name: NAME,
+        pg_autoscale_mode: 'on',
+        pg_num: 128,
+        size: 3,
+      };
+      return Response.json({ data: 'UPID:node-b:fake:createpool' });
+    }
+    if (wire === STATUS && request.method === 'GET') {
+      return statusRow === undefined ? absent() : Response.json({ data: statusRow });
+    }
+    if (wire === OBJECT && request.method === 'DELETE') {
+      indexRow = undefined;
+      statusRow = undefined;
+      return Response.json({ data: 'UPID:node-b:fake:destroypool' });
+    }
+    return Response.json({ data: null });
+  };
+  const fetchStub = Object.assign(stub, { preconnect: globalThis.fetch.preconnect });
+  return {
+    layer: FetchHttpClient.layer.pipe(
+      Layer.provideMerge(Layer.succeed(FetchHttpClient.Fetch, fetchStub as typeof fetch)),
+    ),
+    listAsIfPresent: () => {
+      indexRow = { pool_name: NAME };
+    },
+    writes,
+  };
+};
+
+const declared = () =>
+  ProxmoxCephPool(NAME, {
+    crush_rule: 'replicated_rule',
+    min_size: 2,
+    name: NAME,
+    node: NODE,
+    pg_autoscale_mode: 'on',
+    size: 3,
+    target: FAKE_TARGET,
+  });
+
+const engineFor = (fake: ReturnType<typeof cluster>) =>
+  engineOver(ProxmoxCephPoolProvider().pipe(Layer.provideMerge(fake.layer)));
+
+describe('a genuinely new pool', () => {
+  test('creates once confirmAbsent finds the index empty, and settle confirms the match', async () => {
+    const fake = cluster();
+    await withoutBao(async () => {
+      const engine = engineFor(fake);
+      expect(await engine.deploy(declared())).toEqual({ [NAME]: 'create' });
+    });
+    expect(fake.writes).toEqual([`POST ${INDEX}`]);
+  });
+});
+
+describe("the PG-merge guard: the index lists the pool but its status can't be read", () => {
+  test('refuses the create rather than risking a PG merge on a live pool', async () => {
+    const fake = cluster();
+    fake.listAsIfPresent(); // index says present; statusRow stays undefined -> every read 500s
+    await withoutBao(async () => {
+      const engine = engineFor(fake);
+      await expect(engine.deploy(declared())).rejects.toBeDefined();
+    });
+    // ⛔ THE ASSERTION THAT MATTERS: no POST ever reached the fake cluster.
+    expect(fake.writes).toEqual([]);
+  });
+});
+
+describe('destroying a pool', () => {
+  test('RemovalPolicy.destroy() then undeclaring sends exactly one DELETE', async () => {
+    const fake = cluster();
+    await withoutBao(async () => {
+      const engine = engineFor(fake);
+      expect(await engine.deploy(declared())).toEqual({ [NAME]: 'create' });
+      await engine.deploy(declared().pipe(RemovalPolicy.destroy()));
+      await engine.deploy(Effect.void);
+    });
+    expect(fake.writes).toEqual([`POST ${INDEX}`, `DELETE ${OBJECT}`]);
+  });
+});

package/src/proxmox/ceph-pool.ts

@@ -5,11 +5,16 @@
  * ⛔ IT DOES NOT USE `pveHandlers`, AND THE REASON IS MEASURED RATHER THAN STYLISTIC: THE READ AND
  *   THE WRITES SIT AT DIFFERENT PATHS. `GET /nodes/{node}/ceph/pool/{name}` is `poolindex` and
  *   answers `[{"name":"status"}]` — an INDEX OF CHILDREN, not the pool. The pool is one level
- *   further down, at `.../status` (`getpool`), which accepts no PUT and no DELETE. A `PveSpec`
- *   carries ONE `path` for read, update and delete, so this family cannot be spelled in it. `path`
- *   below is therefore the READ path and nothing else consumes it: `ops.reconcile` and
- *   `ops.destroy` go unused and the two write handlers name their own path. acl.ts is the
- *   precedent for hand-writing the five handlers over `pveOperations`.
+ *   further down, at `.../status` (`getpool`), which accepts no PUT and no DELETE. Every handler
+ *   below is hand-written for that reason, on `client.ts` and now on distilled alike — acl.ts is
+ *   the precedent for hand-writing over the factory.
+ *
+ * ★ MIGRATED OFF `client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s typed
+ *   `nodes.getNodeCephPoolStatus`/`createNodeCephPool`/`putNodeCephPool`/`deleteNodeCephPool`/
+ *   `listNodeCephPool` (2026-09-24, decision 43's walk-down, 2c). `distilled-pve.ts`'s `runPve`
+ *   replaces `pve()`; `readPoolStatus` (ceph-pool-wire.ts) keeps the SAME single-fold shape this
+ *   family always had — see that file's own header for why this migration does not also add the
+ *   newer dual-path pattern `Proxmox.NodeNetwork` carries.
  *
  * ⛔ A CREATE FIRED AT A POOL THAT ALREADY EXISTS IS NOT A NO-OP, IT IS A PG MERGE — the second ⛔
  *   in ceph-pool-form.ts has the evidence, and `confirmAbsent` below is the guard that stops it.
@@ -36,14 +41,13 @@
  *   deliberately, the way `Pool.Allocate` was widened for `Proxmox.Pool`.
  */
 import { Resource } from 'alchemy';
+import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
+import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
 import {
   type CephPoolAttributes,
   type CephPoolProps,
-  UNSET,
-  applications,
-  collection,
   createBody,
   hint,
   object,
@@ -51,10 +55,17 @@ import {
   updateBody,
 } from './ceph-pool-form.ts';
 import { confirmAbsent, settle } from './ceph-pool-settle.ts';
-import { pve } from './client.ts';
-import { type PveRequirements, type PveSpec, pveOperations } from './resource.ts';
+import {
+  CEPH_POOL_CREATE,
+  CEPH_POOL_UPDATE,
+  readPoolStatus,
+  toDistilledCreate,
+  toDistilledUpdate,
+} from './ceph-pool-wire.ts';
+import { guardWrite } from './distilled-guard.ts';
+import { runPve } from './distilled-pve.ts';
+import { type PveRequirements } from './resource.ts';
 import { formToSend } from './update-guard.ts';
-import { bool, int, num, text } from './values.ts';
 
 export type { CephPoolAttributes, CephPoolProps };
 
@@ -71,73 +82,24 @@ export const ProxmoxCephPool = Resource<ProxmoxCephPool>('Proxmox.CephPool', {
   defaultRemovalPolicy: 'retain',
 });
 
-const spec: PveSpec<CephPoolProps, CephPoolAttributes> = {
-  /**
-   * ⛔ `name` IS THE PRESENCE TEST, AND IT IS ALSO HOW THE INDEX TRAP FAILS SAFE. Pointed at
-   *   `.../pool/{name}` rather than `.../status`, the factory would hand this function an ARRAY:
-   *   every field would read absent and the plan would report an update no write can satisfy.
-   *   `getpool` always returns `name` for a real pool, so that shape answers "not there" instead
-   *   — and "not there" cannot reach a create unless `confirmAbsent` agrees.
-   */
-  attributes: (live, props) => {
-    if (typeof live['name'] !== 'string') return undefined;
-    return {
-      applications: applications(live['application_list']),
-      crush_rule: text(live['crush_rule']),
-      id: int(live['id'], UNSET),
-      min_size: int(live['min_size'], UNSET),
-      name: props.name,
-      node: props.node,
-      nodelete: bool(live['nodelete']),
-      nopgchange: bool(live['nopgchange']),
-      nosizechange: bool(live['nosizechange']),
-      pg_autoscale_mode: text(live['pg_autoscale_mode']),
-      pg_num: int(live['pg_num'], UNSET),
-      pg_num_min: int(live['pg_num_min'], UNSET),
-      size: int(live['size'], UNSET),
-      target_size: int(live['target_size'], UNSET),
-      target_size_ratio: num(live['target_size_ratio'], UNSET),
-    };
-  },
-  collection,
-  createForm: createBody,
-  /** The vendor rules both forms are checked against at plan time — resource-spec.ts. */
-  endpoint: {
-    create: 'pve:POST /nodes/{node}/ceph/pool',
-    update: 'pve:PUT /nodes/{node}/ceph/pool/{name}',
-  },
-  /**
-   * ⛔ DECLARING WHAT IS LIVE MUST PLAN noop, AND EVERY OMISSION HERE IS WHY. Out, each with its
-   *   reason on the prop it belongs to: `pg_num` (the autoscaler rewrites it), `application` (the
-   *   write only ever ADDS to a list), `target_size_ratio` (float equality), `id`, `applications`
-   *   and the three `no*` flags (PVE returns them and accepts none of them on write), `node` and
-   *   `name` (the address the read was made at — true by construction, never a diff). In, and each
-   *   measured to round-trip unchanged against C1's four pools on 2026-09-13: size 3, min_size 2,
-   *   pg_autoscale_mode `on`, crush_rule `replicated_rule`, pg_num_min where it is set (16 on
-   *   cephfs-c1_metadata, absent on rbd-c1), target_size in bytes — and each of the last two
-   *   through `hint`, which drops a declared zero for the reason given on it.
-   */
-  matches: (attributes, props) =>
-    same(props.size, attributes.size, attributes.nosizechange) &&
-    same(props.min_size, attributes.min_size, attributes.nosizechange) &&
-    same(props.pg_autoscale_mode, attributes.pg_autoscale_mode) &&
-    same(hint(props.pg_num_min), attributes.pg_num_min, attributes.nopgchange) &&
-    same(props.crush_rule, attributes.crush_rule, attributes.crush_rule === '') &&
-    same(hint(props.target_size), attributes.target_size),
-  /**
-   * ⛔ THE READ PATH, AND ONLY THE READ PATH.
-   * ⚠️ `?verbose=1` IS WHAT MAKES `applications` VISIBLE AT ALL — without it PVE omits the tags
-   *   entirely (MEASURED across all four pools; there is no `application` key either way, only
-   *   `application_list`, and only when verbose). The cost is that verbose adds two unguarded mon
-   *   commands, `df` and `osd pool application get`, so a degraded mgr can fail the read. That is
-   *   safe here rather than merely unlucky: a failed read is "absent", and "absent" cannot reach a
-   *   create unless `confirmAbsent` agrees.
-   */
-  path: (props) => `${object(props)}/status?verbose=1`,
-  updateForm: updateBody,
-};
-
-const ops = pveOperations(spec);
+/**
+ * ⛔ DECLARING WHAT IS LIVE MUST PLAN noop, AND EVERY OMISSION HERE IS WHY. Out, each with its
+ *   reason on the prop it belongs to: `pg_num` (the autoscaler rewrites it), `application` (the
+ *   write only ever ADDS to a list), `target_size_ratio` (float equality), `id`, `applications`
+ *   and the three `no*` flags (PVE returns them and accepts none of them on write), `node` and
+ *   `name` (the address the read was made at — true by construction, never a diff). In, and each
+ *   measured to round-trip unchanged against C1's four pools on 2026-09-13: size 3, min_size 2,
+ *   pg_autoscale_mode `on`, crush_rule `replicated_rule`, pg_num_min where it is set (16 on
+ *   cephfs-c1_metadata, absent on rbd-c1), target_size in bytes — and each of the last two
+ *   through `hint`, which drops a declared zero for the reason given on it.
+ */
+const matches = (attributes: CephPoolAttributes, props: CephPoolProps) =>
+  same(props.size, attributes.size, attributes.nosizechange) &&
+  same(props.min_size, attributes.min_size, attributes.nosizechange) &&
+  same(props.pg_autoscale_mode, attributes.pg_autoscale_mode) &&
+  same(hint(props.pg_num_min), attributes.pg_num_min, attributes.nopgchange) &&
+  same(props.crush_rule, attributes.crush_rule, attributes.crush_rule === '') &&
+  same(hint(props.target_size), attributes.target_size);
 
 export const ProxmoxCephPoolProvider = () =>
   Provider.effect(
@@ -146,28 +108,45 @@ export const ProxmoxCephPoolProvider = () =>
       ProxmoxCephPool.Provider.of({
         /** ⛔ Empty, and here it is what keeps `.mgr` and the two cephfs pools out — see the header. */
         list: () => Effect.succeed([]),
-        read: ({ olds }) => ops.read(olds),
-        diff: ({ news, output }) => ops.diff(news, output),
+        read: ({ olds }) => readPoolStatus(olds),
         /**
-         * ⚠️ NOT `ops.reconcile`: it POSTs the moment a read comes back empty, and reads back once,
-         *   immediately. Both are wrong for a family whose writes are forked workers and whose
+         * ★ HAND-WRITTEN, matching the pre-migration `ops.diff` shape exactly (resource.ts) — this
+         *   family never used the factory's own `diff`/`reconcile` (only its `read`), and the
+         *   factory itself cannot run a distilled operation, so both are inlined here now.
+         */
+        diff: Effect.fn(function* ({ news, output }) {
+          if (!isResolved(news)) return undefined;
+          yield* guardWrite(CEPH_POOL_CREATE, createBody(news), output === undefined);
+          yield* guardWrite(CEPH_POOL_UPDATE, updateBody(news), false);
+          if (output === undefined) return undefined;
+          const live = yield* readPoolStatus(news);
+          if (live === undefined) {
+            yield* guardWrite(CEPH_POOL_CREATE, createBody(news), true);
+            return { action: 'update' } as const;
+          }
+          return matches(live, news)
+            ? ({ action: 'noop' } as const)
+            : ({ action: 'update' } as const);
+        }),
+        /**
+         * ⚠️ NOT A GENERIC reconcile: it POSTs the moment a read comes back empty, and reads back
+         *   once, immediately. Both are wrong for a family whose writes are forked workers and whose
          *   create is destructive against a pool that is already there.
          */
         reconcile: Effect.fn(function* ({ news }) {
-          const live = yield* ops.read(news);
+          const live = yield* readPoolStatus(news);
           let upid: string | undefined;
           if (live === undefined) {
-            // ⛔ THE GUARD `ops.reconcile` WOULD HAVE RUN, RESTORED. This handler replaces it
+            // ⛔ THE GUARD A GENERIC reconcile WOULD HAVE RUN, RESTORED. This handler replaces it
             //   wholesale, so without these two calls an ADOPTED pool — whose diff answer Alchemy
             //   discards — would reach the cluster with nothing having checked its body.
-            yield* ops.guardCreate(news, true);
-            yield* confirmAbsent(news, spec.collection(news), object(news));
-            upid = yield* pve<string>(
+            yield* guardWrite(CEPH_POOL_CREATE, createBody(news), true);
+            yield* confirmAbsent(news, object(news));
+            upid = yield* runPve(
               news.target,
               'provision',
-              'POST',
-              collection(news),
-              createBody(news),
+              true,
+              nodes.createNodeCephPool(toDistilledCreate(news)),
             );
           } else {
             /**
@@ -177,18 +156,23 @@ export const ProxmoxCephPoolProvider = () =>
              *   settings (ceph-pool-form.ts) made it harmless to Ceph, not free: it is still a
              *   provision-lease write and a task in the cluster's list. update-guard.ts has the rest.
              */
-            const form = formToSend(spec.matches, live, news, updateBody(news));
+            const form = formToSend(matches, live, news, updateBody(news));
             if (form !== undefined) {
-              yield* ops.guardUpdate(news);
-              upid = yield* pve<string>(news.target, 'provision', 'PUT', object(news), form);
+              yield* guardWrite(CEPH_POOL_UPDATE, updateBody(news), false);
+              upid = yield* runPve(
+                news.target,
+                'provision',
+                true,
+                nodes.putNodeCephPool(toDistilledUpdate(news)),
+              );
             }
           }
           const after = yield* settle(
             news,
-            ops.read,
-            (row) => row !== undefined && spec.matches(row, news),
+            readPoolStatus,
+            (row) => row !== undefined && matches(row, news),
           );
-          if (after === undefined || !spec.matches(after, news)) {
+          if (after === undefined || !matches(after, news)) {
             return yield* Effect.die(
               new Error(
                 `${object(news)}: the write returned no error but the pool still does not match ` +
@@ -212,8 +196,13 @@ export const ProxmoxCephPoolProvider = () =>
          *   set in ceph.conf and the two sources disagree by design.
          */
         delete: Effect.fn(function* ({ olds }) {
-          yield* pve<string>(olds.target, 'provision', 'DELETE', object(olds));
-          const left = yield* settle(olds, ops.read, (row) => row === undefined);
+          yield* runPve(
+            olds.target,
+            'provision',
+            true,
+            nodes.deleteNodeCephPool({ name: olds.name, node: olds.node }),
+          );
+          const left = yield* settle(olds, readPoolStatus, (row) => row === undefined);
           if (left !== undefined) {
             return yield* Effect.die(
               new Error(

package/src/proxmox/distilled-task-await.test.ts

@@ -1,124 +0,0 @@
-/**
- * Exercises `@distilled.cloud/proxmox`'s `awaitTask` (the async-task
- * 200-trap — see that package's `src/protocol.ts` header) against a FAKE
- * `HttpClient`, no live PVE node involved.
- *
- * ⚠️ THIS PACKAGE IS CONSUMED VIA THE INTERIM-PACKAGE ALIAS
- *   (`packages/alchemy/package.json`'s `dependencies`:
- *   `"@distilled.cloud/proxmox": "npm:@homeflare/distilled-proxmox@0.2.0"`)
- *   — see `packages/alchemy/docs/distilled-interim.md`. Nothing in
- *   `packages/alchemy/src/proxmox/*` (the existing 98-resource family) is
- *   touched or migrated onto it here; this file is standalone proof the
- *   package works end to end, ahead of migrating any hand-written resource
- *   onto it (a later PR).
- */
-import { describe, expect, test } from 'bun:test';
-import * as Effect from 'effect/Effect';
-import * as Layer from 'effect/Layer';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
-import * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';
-import * as Proxmox from '@distilled.cloud/proxmox';
-
-const credentials = Proxmox.credentials({
-  tokenId: 'root@pam!test',
-  secret: 'test-secret',
-  baseUrl: 'https://pve.test:8006',
-});
-
-/** A fake PVE that answers `running` (no `exitstatus`) `pendingPolls` times, then `finalBody`. */
-const fakePve = (pendingPolls: number, finalBody: Record<string, unknown>) => {
-  let calls = 0;
-  return Layer.succeed(
-    HttpClient.HttpClient,
-    HttpClient.make((request) =>
-      Effect.sync(() => {
-        calls++;
-        const body =
-          calls <= pendingPolls
-            ? {
-                status: 'running',
-                id: 'qmstart',
-                node: 'pve1',
-                pid: 100,
-                pstart: 1,
-                starttime: 1,
-                type: 'qmstart',
-                upid: 'UPID:pve1:...',
-                user: 'root@pam',
-              }
-            : finalBody;
-        return HttpClientResponse.fromWeb(
-          request,
-          new Response(JSON.stringify({ data: body }), { status: 200 }),
-        );
-      }),
-    ),
-  );
-};
-
-const runAwaitTask = (pendingPolls: number, finalBody: Record<string, unknown>) =>
-  Effect.runPromise(
-    Proxmox.awaitTask(
-      { node: 'pve1', upid: 'UPID:pve1:00000001:00000001:00000001:qmstart:100:root@pam:' },
-      { pollInterval: '5 millis' },
-    ).pipe(Effect.provide(Layer.mergeAll(fakePve(pendingPolls, finalBody), credentials))),
-  );
-
-const OK_STATUS = {
-  status: 'stopped',
-  exitstatus: 'OK',
-  id: 'qmstart',
-  node: 'pve1',
-  pid: 100,
-  pstart: 1,
-  starttime: 1,
-  type: 'qmstart',
-  upid: 'UPID:pve1:...',
-  user: 'root@pam',
-};
-
-describe("awaitTask (against a fake PVE, per protocol.ts's async-task trap)", () => {
-  test("resolves once exitstatus is exactly OK, after polling through 'running'", async () => {
-    const result = await runAwaitTask(2, OK_STATUS);
-    expect(result.exitstatus).toBe('OK');
-    expect(result.status).toBe('stopped');
-  });
-
-  test('resolves immediately when the task is already done on the first poll', async () => {
-    const result = await runAwaitTask(0, OK_STATUS);
-    expect(result.exitstatus).toBe('OK');
-  });
-
-  test('fails with ProxmoxTaskFailed for any exitstatus other than exactly OK', async () => {
-    const failed = await Effect.runPromise(
-      Proxmox.awaitTask(
-        { node: 'pve1', upid: 'UPID:pve1:00000001:00000001:00000001:qmstart:100:root@pam:' },
-        { pollInterval: '5 millis' },
-      ).pipe(
-        Effect.provide(
-          Layer.mergeAll(fakePve(0, { ...OK_STATUS, exitstatus: 'job errors' }), credentials),
-        ),
-        Effect.flip,
-      ),
-    );
-    expect(failed).toBeInstanceOf(Proxmox.ProxmoxTaskFailed);
-    expect(failed).toMatchObject({ node: 'pve1', exitstatus: 'job errors' });
-  });
-
-  // ⛔ "OK (warnings)" is NOT a success — see task.ts's exact-equality note.
-  test("fails (does not swallow) 'OK (warnings)'", async () => {
-    const failed = await Effect.runPromise(
-      Proxmox.awaitTask(
-        { node: 'pve1', upid: 'UPID:pve1:00000001:00000001:00000001:qmstart:100:root@pam:' },
-        { pollInterval: '5 millis' },
-      ).pipe(
-        Effect.provide(
-          Layer.mergeAll(fakePve(0, { ...OK_STATUS, exitstatus: 'OK (warnings)' }), credentials),
-        ),
-        Effect.flip,
-      ),
-    );
-    expect(failed).toBeInstanceOf(Proxmox.ProxmoxTaskFailed);
-    expect(failed).toMatchObject({ exitstatus: 'OK (warnings)' });
-  });
-});