@homeflare/alchemy 0.37.0 → 0.37.2

package/dist/proxmox/ceph-daemon-wire.d.ts

@@ -4,11 +4,9 @@
  * `{node,id}` / `{node,name}`) — the SAME reason `DAEMON_ENDPOINTS` (ceph-daemon-form.ts) is a
  * per-kind table rather than one templated string.
  *
- * ⛔ ONE READ FUNCTION, NOT THE readXOrFail/foldingX PAIR — the same deliberate, measured
- *   departure ceph-pool-wire.ts and ceph-fs-distilled.ts explain in full: this family's
- *   pre-migration `pveOperations.read` (resource.ts) already folded every failure unconditionally,
- *   with no `output`-branching, so `readDaemon` below reproduces that exact single-fold shape
- *   rather than gaining the newer dual-path pattern along the way.
+ * ⛔ ABSENCE IS A SUCCESSFUL INDEX WITH NO MATCHING ROW. The original transport swap
+ *   preserved `pveOperations.read`'s catch-all fold; the 2026-09-24 follow-up removes it. A failed
+ *   mon/mgr/mds list proves nothing about whether a daemon exists, so its SDK error propagates.
  *
  * ⚠️ `mon_address` IS THE ONE RENAME THIS FAMILY NEEDS — distilled's generator maps the wire name
  *   `mon-address` to `mon_address` on `UpdateNodeCephMonRequest` (`T.Body("mon-address")`,
@@ -18,8 +16,8 @@
 import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
 import type { CephDaemonKind, CephDaemonProps } from './ceph-daemon.ts';
-/** ⛔ FOLDS EVERY FAILURE TO `undefined` — see this file's own header for why. */
-export declare const readDaemon: (props: CephDaemonProps) => Effect.Effect<import("./ceph-daemon.ts").CephDaemonAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** A missing row is absent; a failed index read keeps its typed SDK error. */
+export declare const readDaemon: (props: CephDaemonProps) => Effect.Effect<import("./ceph-daemon.ts").CephDaemonAttributes | undefined, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
 /** POST — distilled's generator misnames it "update" (checked against `T.Http`); it is a create. */
 export declare const createDaemon: (props: CephDaemonProps) => Effect.Effect<string, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
 /** ⚠️ NO FLAGS ON ANY OF THE THREE — unlike CephFs/CephOsd, nothing here is at risk of a

package/dist/proxmox/ceph-daemon-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-daemon-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AA+BxE,iFAAiF;AACjF,eAAO,MAAM,UAAU,UAAW,eAAe,4IAI9C,CAAC;AAEJ,oGAAoG;AACpG,eAAO,MAAM,YAAY,UAAW,eAAe,8PA6BlD,CAAC;AAEF;wEACwE;AACxE,eAAO,MAAM,YAAY,UAAW,eAAe,8PAWlD,CAAC;AAEF,wGAAwG;AACxG,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;oGACoG;AACpG,eAAO,MAAM,UAAU,UAAW,eAAe,UAK9C,CAAC"}
+{"version":3,"file":"ceph-daemon-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AA+BxE,8EAA8E;AAC9E,eAAO,MAAM,UAAU,UAAW,eAAe,mTAG9C,CAAC;AAEJ,oGAAoG;AACpG,eAAO,MAAM,YAAY,UAAW,eAAe,8PA6BlD,CAAC;AAEF;wEACwE;AACxE,eAAO,MAAM,YAAY,UAAW,eAAe,8PAWlD,CAAC;AAEF,wGAAwG;AACxG,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;oGACoG;AACpG,eAAO,MAAM,UAAU,UAAW,eAAe,UAK9C,CAAC"}

package/dist/proxmox/ceph-daemon.d.ts

@@ -47,8 +47,8 @@
  *   this credential already has it rather than discovering it the next time something is scoped.
  *
  * ★ MIGRATED OFF `client.ts` (2026-09-24, decision 43, 2c) — ceph-daemon-wire.ts has the rename
- *   and why no protocol gap blocks any of the three kinds; `readDaemon` there keeps this family's
- *   pre-migration single-fold shape (ceph-pool-wire.ts explains why that is not left unfixed).
+ *   and why no protocol gap blocks any of the three kinds. The follow-up removes the preserved
+ *   catch-all read fold: only a successful index without this daemon proves absence.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
@@ -68,12 +68,11 @@ export interface CephDaemonProps extends WithTarget {
     /**
      * The node the daemon RUNS on. Identity — a daemon cannot be moved, only destroyed and rebuilt.
      * ⚠️ It is also the node whose API is asked, and the read is only as available as that node: a
-     *   node that is down — or has no Ceph installed, or answers 403 — reads as nothing at all,
-     *   because `pveOperations.read` folds EVERY failure into "absent" (a 404 is a legitimate answer
-     *   there and it cannot tell the two apart). Its daemons then plan as `update`, and reconcile
-     *   POSTs a create for a mon that already exists. PVE refuses that with "monitor already
-     *   exists", and the read-back refuses again — so it fails loudly rather than damaging anything,
-     *   but the message will point at the daemon rather than at the node that would not answer.
+     *   failed index now propagates its error. Before the typed-read follow-up, a down node,
+     *   missing Ceph installation or 403 was folded to "absent"; its daemons planned `update`
+     *   and reconcile POSTed a create for a mon that already existed. PVE refused with "monitor
+     *   already exists", then read-back failed again, obscuring the original node read error.
+     *   That incident is why collection failure can never prove a daemon is missing.
      */
     node: string;
     /**

package/dist/proxmox/ceph-daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-daemon.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEnD,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,IAAI,EAAE,cAAc,CAAC;IACrB;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;IAChB,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;UAA0C,eAAe;8NAQnF,CAAC;AAEH,eAAO,MAAM,yBAAyB,uIA8BnC,CAAC"}
+{"version":3,"file":"ceph-daemon.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEnD,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,IAAI,EAAE,cAAc,CAAC;IACrB;;;;;;;;OAQG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;IAChB,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;UAA0C,eAAe;8NAQnF,CAAC;AAEH,eAAO,MAAM,yBAAyB,uIA8BnC,CAAC"}

package/dist/proxmox/ceph-fs-distilled.d.ts

@@ -1,14 +1,40 @@
+/**
+ * `Proxmox.CephFs`'s distilled transport: index, create, delete and task status.
+ * SDK 0.3.0 fixes DELETE query flags and supplies the measured CephFsNotFound tag.
+ *
+ * ⛔ `nodes.updateNodeCephFs` IS distilled's GENERATOR MISNAMING A CREATE, NOT A SECOND ENDPOINT.
+ *   Checked directly against its schema (`T.Http({ method: "POST", uri:
+ *   "/nodes/{node}/ceph/fs/{name}" })`) rather than trusted from the function name — it is the
+ *   SAME single write PVE registers, `createfs`. Harmless once named here for what it is.
+ *
+ * ★ CREATE AND DELETE SHARE THE SAME BOUNDED POLL POLICY. The raw getNodeTaskStatus
+ *   operation preserves this family's tolerance of a missing Sys.Audit grant or a node
+ *   mid-restart until the deadline. The former SDK Task.awaitTask propagated poll failures;
+ *   SDK PR #265 removed it because polling policy belongs in the provider.
+ */
+import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
 import type { CephFsProps } from './ceph-fs.ts';
 /**
  * The index, read via distilled — the same shape `readRow` (ceph-fs-wire.ts) already narrows.
  *
- * ⛔ FOLDS EVERY FAILURE TO `undefined`, matching the pre-migration `pveOperations.read` this
- *   family used (`resource.ts`, `Effect.orElseSucceed`) — the same single-fold shape
- *   ceph-pool-wire.ts's `readPoolStatus` preserves and explains: this migration's own rule is
- *   behaviour surviving byte-for-byte, not the newer dual-path pattern gaining a new family.
+ * ⛔ ABSENCE IS A SUCCESSFUL INDEX WITH NO MATCHING FILESYSTEM. The transport swap
+ *   initially preserved the generic factory's catch-all fold. The 2026-09-24 follow-up removes it:
+ *   a failed list is not proof that a filesystem is missing. Task polling below retains its
+ *   separate bounded wait policy; it does not decide whether a resource exists.
  */
-export declare const readFs: (props: CephFsProps) => Effect.Effect<import("./ceph-fs.ts").CephFsAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readFs: (props: CephFsProps) => Effect.Effect<import("./ceph-fs.ts").CephFsAttributes | undefined, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
 /** POST the create, then wait for the worker. ⛔ The caller still reads back; see ceph-fs.ts. */
 export declare const createFs: (props: CephFsProps) => Effect.Effect<undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * DELETE the filesystem, then wait for the worker.
+ *
+ * ⛔ WHAT THIS TAKES AWAY DEPENDS ENTIRELY ON `remove-pools`, AND THE DEFAULT IS THE SAFE ONE. With
+ *   it unset PVE removes the filesystem from the MDS map and LEAVES the two pools on disk: every
+ *   mount breaks, but the bytes are still there for an operator to recover. With it set the pools
+ *   go too and nothing is recoverable. Leaving it unset also means a later create of the SAME name
+ *   fails with "ceph pools '<name>_data' and/or '<name>_metadata' already exist" -- that refusal is
+ *   a BRAKE, not a bug, and it is the last thing standing between a mis-typed rename and the data.
+ */
+export declare const destroyFs: (props: CephFsProps) => Effect.Effect<void, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=ceph-fs-distilled.d.ts.map

package/dist/proxmox/ceph-fs-distilled.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-fs-distilled.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-fs-distilled.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIhD;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,UAAW,WAAW,oIAItC,CAAC;AA2CJ,gGAAgG;AAChG,eAAO,MAAM,QAAQ,UAAW,WAAW,kNAoBvC,CAAC"}
+{"version":3,"file":"ceph-fs-distilled.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-fs-distilled.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIhD;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,UAAW,WAAW,2SAGtC,CAAC;AA8CJ,gGAAgG;AAChG,eAAO,MAAM,QAAQ,UAAW,WAAW,kNAoBvC,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,UAAW,WAAW,6MAiBxC,CAAC"}

package/dist/proxmox/ceph-fs-wire.d.ts

@@ -49,18 +49,12 @@
  *   Grant it on the `read` role, or every create burns the full cap below and reports the wrong
  *   cause.
  *
- * ★ AS OF 2026-09-24 (decision 43's walk-down, 2c) THIS FILE IS `client.ts`'s HALF ONLY. The read
- *   (`readRow`) moved to `ceph-fs-distilled.ts`, and so did the create — `nodes.updateNodeCephFs`
- *   (distilled's own misnamed POST, confirmed against its `T.Http` annotation) plus a SEPARATE
- *   distilled `settle`, using the raw `getNodeTaskStatus` operation in its own tolerant poll loop
- *   rather than `Task.awaitTask`, which does not tolerate a poll failure the way this family needs
- *   (network-apply-read.ts's own header has the fuller reasoning). `destroyFs` stays HERE,
- *   unmigrated: distilled types `remove_pools`/`remove_storages` as `T.Body` on a DELETE, and the
- *   ⛔ two paragraphs up is the MEASURED reason PVE would silently ignore both flags if sent that
- *   way — a real protocol gap, not a judgement call. `settle` below is still shared where it can
- *   be: `createForm`/`objectPath`/`destroyPath` are pure and reused by the distilled file too.
+ * ★ THE ORIGINAL DISTILLED WALK MOVED READ AND CREATE FIRST, leaving DELETE here because
+ *   SDK flags were annotated as body fields. Distilled Proxmox 0.3.0 fixes their query binding
+ *   and adds the measured CephFsNotFound tag. All calls now live in ceph-fs-distilled.ts;
+ *   this file keeps the pure forms, attributes and read-back failure messages. The protocol
+ *   history above remains load-bearing: moving a DELETE flag back into a body loses it silently.
  */
-import * as Effect from 'effect/Effect';
 import type { CephFsAttributes, CephFsProps } from './ceph-fs.ts';
 /**
  * This filesystem's row of the index, as attributes.
@@ -90,17 +84,6 @@ export declare const CEPH_FS_CREATE = "pve:POST /nodes/{node}/ceph/fs/{name}";
  *   POSTed to — the metric-server.ts case again — and a second copy can only ever disagree with it.
  */
 export declare const createForm: (props: CephFsProps) => Record<string, string>;
-/**
- * DELETE the filesystem, then wait for the worker.
- *
- * ⛔ WHAT THIS TAKES AWAY DEPENDS ENTIRELY ON `remove-pools`, AND THE DEFAULT IS THE SAFE ONE. With
- *   it unset PVE removes the filesystem from the MDS map and LEAVES the two pools on disk: every
- *   mount breaks, but the bytes are still there for an operator to recover. With it set the pools
- *   go too and nothing is recoverable. Leaving it unset also means a later create of the SAME name
- *   fails with "ceph pools '<name>_data' and/or '<name>_metadata' already exist" -- that refusal is
- *   a BRAKE, not a bug, and it is the last thing standing between a mis-typed rename and the data.
- */
-export declare const destroyFs: (props: CephFsProps) => Effect.Effect<void, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * The two read-back failures, as messages rather than as guesses.
  *

package/dist/proxmox/ceph-fs-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-fs-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-fs-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKlE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,OAAO,SACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,WAAW,KACjB,gBAAgB,GAAG,SAkBrB,CAAC;AAKF;;;;GAIG;AAEH,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,6FAA6F;AAC7F,eAAO,MAAM,UAAU,UAAW,WAAW,WAAgD,CAAC;AAE9F,2FAA2F;AAC3F,eAAO,MAAM,cAAc,0CAA0C,CAAC;AAMtE;;;GAGG;AACH,eAAO,MAAM,UAAU,UAAW,WAAW,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnE,CAAC;AA2DH;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,UAAW,WAAW,4IAQxC,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,UAAW,WAAW,UAK1C,CAAC;AAEJ,eAAO,MAAM,YAAY,UAAW,WAAW,UAK5C,CAAC"}
+{"version":3,"file":"ceph-fs-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-fs-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGlE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,OAAO,SACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,WAAW,KACjB,gBAAgB,GAAG,SAkBrB,CAAC;AAEF;;;;GAIG;AAEH,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,6FAA6F;AAC7F,eAAO,MAAM,UAAU,UAAW,WAAW,WAAgD,CAAC;AAE9F,2FAA2F;AAC3F,eAAO,MAAM,cAAc,0CAA0C,CAAC;AAMtE;;;GAGG;AACH,eAAO,MAAM,UAAU,UAAW,WAAW,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnE,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,UAAW,WAAW,UAK1C,CAAC;AAEJ,eAAO,MAAM,YAAY,UAAW,WAAW,UAK5C,CAAC"}

package/dist/proxmox/ceph-fs.d.ts

@@ -28,12 +28,11 @@
  *
  * ★ MIGRATED OFF `client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s typed
  *   `nodes.listNodeCephFs`/`updateNodeCephFs` for the READ and the CREATE (2026-09-24, decision
- *   43's walk-down, 2c — ceph-fs-distilled.ts). `destroyFs` STAYS on `client.ts`, unmigrated:
- *   distilled types the delete's `remove-pools`/`remove-storages` flags as a request BODY, and
- *   this file's own next ⛔ (unchanged from before this migration) is the measured reason PVE
- *   would silently ignore both on a DELETE sent that way — ceph-fs-wire.ts's header has the fuller
- *   evidence. `readFs`/`diff`/`reconcile` keep the SAME single-fold, present-is-settled shape this
- *   family always had; see ceph-pool-wire.ts's own header for why that is not a bug left unfixed.
+ *   43's walk-down, 2c — ceph-fs-distilled.ts). DELETE originally stayed on `client.ts`:
+ *   the SDK put its flags in a body that PVE discards (ceph-fs-wire.ts's history).
+ *   SDK 0.3.0 fixes the query binding; delete now uses it and catches only CephFsNotFound.
+ *   The typed-read follow-up removes the catch-all fold from `readFs`: a failed index must
+ *   fail read/diff/reconcile/delete, not report a missing filesystem or a successful destroy.
  *
  * ⛔ CREATING A CephFS CREATES TWO CEPH POOLS, AND A `Proxmox.CephPool` MUST NOT ALSO DECLARE THEM.
  *   `createfs` builds `<name>_data` and `<name>_metadata` itself and refuses outright if either

package/dist/proxmox/ceph-fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-fs.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAEtE,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+FAA+F;IAC/F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,qGAAqG;AACrG,eAAO,MAAM,aAAa,gDAExB,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB,mIAkF/B,CAAC"}
+{"version":3,"file":"ceph-fs.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAEtE,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+FAA+F;IAC/F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAC7C,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,qGAAqG;AACrG,eAAO,MAAM,aAAa,gDAExB,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB,mIAiF/B,CAAC"}

package/dist/proxmox/ceph-pool-settle.d.ts

@@ -15,15 +15,16 @@ import type { PveRequirements } from './resource.ts';
  *   separable at all. `ops.read` — now `readPoolStatus` (ceph-pool-wire.ts) — is a module-level
  *   binding in ceph-pool.ts; importing it back would be a runtime cycle, and duplicating it would
  *   be two definitions of one path. Passing it is the pattern zfs-pool-write.ts already uses.
+ *   The error parameter preserves the reader's typed failures through settle; it is not `never`.
  */
-export type PoolRead = (props: CephPoolProps) => Effect.Effect<CephPoolAttributes | undefined, never, PveRequirements>;
+export type PoolRead<E> = (props: CephPoolProps) => Effect.Effect<CephPoolAttributes | undefined, E, PveRequirements>;
 /**
- * ⛔ THE GUARD ON THE CREATE. `read` folds a 403, a timeout and a node that is down into the same
- *   `undefined` as a pool that is genuinely missing — so "absent" is not evidence. This asks a
- *   second, different question: does the cluster LIST this pool? A failure is left to propagate
- *   rather than folded, so "I could not ask" fails the deploy instead of creating over live data.
- *   An empty list is trusted: the collection 403s when the role is too narrow rather than
- *   filtering, so `[]` really does mean a cluster with no pools.
+ * ⛔ THE GUARD ON THE CREATE. The original read folded 403s/timeouts into absence, so this
+ *   independent index check prevented creating over a live pool. The typed reader now
+ *   propagates those failures, but a `CephPoolNotFound` must still not override a listed pool:
+ *   the measured PG-merge risk warrants keeping both observations. Failed index reads also
+ *   propagate. An empty list is trusted: the collection refuses a narrow role with 403 rather
+ *   than filtering, so `[]` really does mean a cluster with no pools.
  *
  * ⚠️ `describe` IS STILL A PLAIN STRING (ceph-pool.ts builds it from `object`/`collection` in
  *   ceph-pool-form.ts) — this function no longer takes a `collection` PATH, since
@@ -41,5 +42,5 @@ export declare const confirmAbsent: (props: CephPoolProps, describe: string) =>
  * ⚠️ SHORT POLLS, LOW CAP: 2s apart, 30 tries, about a minute. A pool create takes seconds; one
  *   still unsettled after a minute is a fault to surface, not a wait to lengthen.
  */
-export declare const settle: (props: CephPoolProps, read: PoolRead, done: (live: CephPoolAttributes | undefined) => boolean) => Effect.Effect<CephPoolAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const settle: <E>(props: CephPoolProps, read: PoolRead<E>, done: (live: CephPoolAttributes | undefined) => boolean) => Effect.Effect<CephPoolAttributes | undefined, E, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=ceph-pool-settle.d.ts.map

package/dist/proxmox/ceph-pool-settle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-pool-settle.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool-settle.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,CACrB,KAAK,EAAE,aAAa,KACjB,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;AAE3E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,UAAW,aAAa,YAAY,MAAM,4PAcjE,CAAC;AAEJ;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,UACV,aAAa,QACd,QAAQ,QACR,CAAC,IAAI,EAAE,kBAAkB,GAAG,SAAS,KAAK,OAAO,+GASrD,CAAC"}
+{"version":3,"file":"ceph-pool-settle.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool-settle.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI,CACxB,KAAK,EAAE,aAAa,KACjB,MAAM,CAAC,MAAM,CAAC,kBAAkB,GAAG,SAAS,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,UAAW,aAAa,YAAY,MAAM,4PAcjE,CAAC;AAEJ;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,GAAI,CAAC,SACf,aAAa,QACd,QAAQ,CAAC,CAAC,CAAC,QACX,CAAC,IAAI,EAAE,kBAAkB,GAAG,SAAS,KAAK,OAAO,2GASrD,CAAC"}

package/dist/proxmox/ceph-pool-wire.d.ts

@@ -7,35 +7,26 @@
  *   PVE form, unaware distilled exists: this file is the ONLY place that translates one into a
  *   typed distilled request.
  *
- * ⛔ ONE READ FUNCTION, NOT THE readXOrFail/foldingX PAIR user.ts/group.ts/storage.ts/zfs-pool.ts/
- *   node-network-wire.ts CARRY. THIS IS A DELIBERATE, MEASURED DIFFERENCE, NOT AN OVERSIGHT. Those
- *   families were BUILT with (or later given, after the NodeNetwork adversarial review) the
- *   dual-path pattern because their `diff`/`read` hooks needed to tell "genuinely absent" apart
- *   from "a transient failure" at specific call sites. CephPool's PRE-MIGRATION behaviour never
- *   had that distinction: `resource.ts`'s generic `pveOperations.read` — what `ops.read`/`ops.diff`
- *   called before this PR — folds EVERY failure into `undefined` unconditionally
- *   (`Effect.orElseSucceed(() => undefined)`, no `output`-branching, checked directly against
- *   `resource.ts` 2026-09-24). This migration's own rule is that every existing refusal and guard
- *   survives byte-for-byte — not that it gets upgraded on the way past. `readPoolStatus` below
- *   reproduces that exact single-fold shape; it does not add the newer pattern.
- * ⚠️ WORTH A LATER, SEPARATELY-SCOPED DECISION: this means CephPool (like CephDaemon) still folds
- *   a refused OpenBao mint into "absent" too, same as every other pre-`unreadable-read.ts` family
- *   — the cries-wolf class `Proxmox.NodeNetwork`/`Proxmox.ZfsPool`/`Proxmox.Storage` were fixed
- *   against. Noted here rather than fixed here, since fixing it is a behaviour change this PR's
- *   own rules do not ask for.
+ * ⛔ ONLY TYPED ABSENCE MAY REACH A CREATE. The transport migration deliberately preserved
+ *   `pveOperations.read`'s catch-all `Effect.orElseSucceed(() => undefined)` to avoid changing
+ *   behavior during the swap. That also hid refused credentials and transient failures, risking
+ *   a false update/create. SDK PR #265 added the measured `CephPoolNotFound` tag; the follow-up
+ *   now catches only it. One reader serves read/diff/reconcile/settle, so all propagate other
+ *   failures. `confirmAbsent` still checks the index before create: a missing status alone must
+ *   never override a pool that the index lists (the PG-merge incident, ceph-pool-settle.ts).
  */
 import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
 import { type CephPoolAttributes, type CephPoolProps } from './ceph-pool-form.ts';
 /**
- * The live pool, or `undefined` — folds every failure, exactly as `ops.read` did. Used by `read`,
- * `diff` (via `ceph-pool.ts`'s own hand-written `reconcile`, which predates the factory) and
- * `settle` (ceph-pool-settle.ts) alike, matching the ONE-function shape this family had before.
+ * The live pool, or `undefined` only for the SDK's measured `CephPoolNotFound`. The initial
+ * transport swap preserved `ops.read`'s catch-all fold; the 2026-09-24 follow-up removes that ambiguity.
+ * Read, reconcile and settle now propagate every other failure instead of assuming absence.
  *
  * ⛔ `verbose=1` IS WHAT MAKES `applications` VISIBLE AT ALL — ceph-pool.ts's own header has the
  *   measured reason and the cost (two extra, unguarded mon commands PVE runs to answer it).
  */
-export declare const readPoolStatus: (props: CephPoolProps) => Effect.Effect<CephPoolAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readPoolStatus: (props: CephPoolProps) => Effect.Effect<CephPoolAttributes | undefined, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
 /** The two endpoints, as the keys `guardWrite` (distilled-guard.ts) checks both forms against. */
 export declare const CEPH_POOL_CREATE = "pve:POST /nodes/{node}/ceph/pool";
 export declare const CEPH_POOL_UPDATE = "pve:PUT /nodes/{node}/ceph/pool/{name}";

package/dist/proxmox/ceph-pool-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-pool-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAKnB,MAAM,qBAAqB,CAAC;AAqC7B;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAAW,aAAa,+GAShD,CAAC;AAEJ,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,qCAAqC,CAAC;AACnE,eAAO,MAAM,gBAAgB,2CAA2C,CAAC;AAEzE,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,UAAW,aAAa,KAAG,KAAK,CAAC,yBAIb,CAAC;AAEnD,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,UAAW,aAAa,KAAG,KAAK,CAAC,sBAKhB,CAAC"}
+{"version":3,"file":"ceph-pool-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAKnB,MAAM,qBAAqB,CAAC;AAqC7B;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAAW,aAAa,sRAShD,CAAC;AAEJ,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,qCAAqC,CAAC;AACnE,eAAO,MAAM,gBAAgB,2CAA2C,CAAC;AAEzE,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,UAAW,aAAa,KAAG,KAAK,CAAC,yBAIb,CAAC;AAEnD,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,UAAW,aAAa,KAAG,KAAK,CAAC,sBAKhB,CAAC"}

package/dist/proxmox/group-wire.d.ts

@@ -48,21 +48,16 @@ export declare const matches: (attributes: GroupAttributes, props: GroupProps) =
  *   release that does answer `{}`, but this function is what actually carries the "not found"
  *   case, as a thrown error — `readGroup` below is the one that folds it.
  */
-export declare const readGroupOrFail: (props: GroupProps) => Effect.Effect<typeof UNREADABLE | GroupAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | access.GroupNotFound | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readGroupOrFail: (props: GroupProps) => Effect.Effect<typeof UNREADABLE | GroupAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | access.GroupNotFound | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
- * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`/`reconcile` MAY USE IT.
- *   PVE's OWN missing-group answer is a thrown 500 (the ⛔ above), so `reconcile`'s create branch
- *   NEEDS "absent" from a failure to ever run at all — without this fold, a brand-new group could
- *   never be created, because its very-first read would always fail loudly. Safe here because a
- *   wrongful fold costs at most a redundant `createAccessGroup` POST, which PVE refuses loudly
- *   ("group already exists") rather than silently corrupting anything.
- * ⛔ `group.ts`'s `diff` does **NOT** use this — found 2026-09-24, the SAME bug class as the
- *   credential denial fix: folding a TRANSIENT failure (a `PveClusterExhausted`, the encoding bug
- *   above) into "absent" at PLAN TIME is exactly what forced a false `update` with nothing
- *   compared. `diff` calls `readGroupOrFail` directly instead, so a genuine failure there
- *   propagates and fails the whole plan loudly — never silently misreports one row.
+ * ⛔ ONLY `GroupNotFound` MEANS ABSENT. The initial distilled transport swap preserved a
+ *   catch-all fold because PVE reports missing objects as HTTP 500. SDK PR 265 now types that
+ *   measured message, so permission errors, unrelated 500s and exhausted transports propagate
+ *   instead of triggering a speculative create (decision 49 follow-up, 2026-09-24).
+ * ★ `readGroupOrFail` remains the strict path used for an already-confirmed state row. This
+ *   change narrows cold reads/reconcile without changing that existing drift/diff contract.
  */
-export declare const readGroup: (props: GroupProps) => Effect.Effect<typeof UNREADABLE | GroupAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readGroup: (props: GroupProps) => Effect.Effect<typeof UNREADABLE | GroupAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/unstable/http/HttpClient").HttpClient>;
 /** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
 export declare const dropUnreadable: (live: GroupAttributes | Unreadable | undefined) => GroupAttributes | undefined;
 //# sourceMappingURL=group-wire.d.ts.map

package/dist/proxmox/group-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"group-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/group-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,eAAO,MAAM,YAAY,4BAA4B,CAAC;AACtD,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAE/D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,YAAa,MAAM,GAAG,SAAS,WAGxD,CAAC;AAQF,eAAO,MAAM,UAAU,UAAW,UAAU,KAAG,MAAM,CAAC,wBAGpD,CAAC;AAEH,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAW,UAAU,KAAG,MAAM,CAAC,qBAGpD,CAAC;AAaH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,eAAe,SAAS,UAAU,YACjB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,eAAe,UAAW,UAAU,o4BAW9C,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,UAAW,UAAU,gIACyB,CAAC;AAErE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,eAAe,GAAG,UAAU,GAAG,SAAS,gCACrC,CAAC"}
+{"version":3,"file":"group-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/group-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,eAAO,MAAM,YAAY,4BAA4B,CAAC;AACtD,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAE/D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,YAAa,MAAM,GAAG,SAAS,WAGxD,CAAC;AAQF,eAAO,MAAM,UAAU,UAAW,UAAU,KAAG,MAAM,CAAC,wBAGpD,CAAC;AAEH,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAW,UAAU,KAAG,MAAM,CAAC,qBAGpD,CAAC;AAaH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,eAAe,SAAS,UAAU,YACjB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,eAAe,UAAW,UAAU,0mCAW9C,CAAC;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,UAAW,UAAU,mlCACqD,CAAC;AAEjG,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,eAAe,GAAG,UAAU,GAAG,SAAS,gCACrC,CAAC"}