@homeflare/alchemy 0.37.1 → 0.37.3

package/src/proxmox/backup-job-distilled.ts

@@ -0,0 +1,86 @@
+/** Backup-job operations from distilled-proxmox, walked against pve-manager 9.2.11. */
+import * as cluster from '@distilled.cloud/proxmox/cluster';
+import * as Effect from 'effect/Effect';
+import * as Schema from 'effect/Schema';
+import { ProxmoxParseError } from '@distilled.cloud/proxmox/Errors';
+import { backupJobSpec } from './backup-job-config.ts';
+import type { BackupJobProps } from './backup-job.ts';
+import { runPve } from './distilled-pve.ts';
+
+/** SDK member names differ from the vendor's hyphenated form keys; omission stays omission. */
+export const backupJobRequest = (
+  props: BackupJobProps,
+  form = backupJobSpec.updateForm(props),
+): cluster.PutClusterBackupRequest => {
+  const {
+    'notes-template': notes_template,
+    'notification-mode': notification_mode,
+    'prune-backups': prune_backups,
+    'repeat-missed': repeat_missed,
+    ...fields
+  } = form;
+  return {
+    ...fields,
+    id: props.id,
+    notification_mode,
+    repeat_missed,
+    ...(notes_template === undefined ? {} : { notes_template }),
+    ...(prune_backups === undefined ? {} : { prune_backups }),
+  };
+};
+
+/**
+ * SDK decode also renames NESTED retention keys. Restore the vendor's property-string
+ * spelling before the existing canonical comparison, or keep_daily becomes perpetual drift.
+ * A property string from an older server remains a property string.
+ */
+export const readBackupJob = (props: BackupJobProps) =>
+  runPve(props.target, 'read', false, cluster.getClusterBackup({ id: props.id })).pipe(
+    // Legacy PVE emits these two properties as strings; current PVE expands objects.
+    // Validate the generated response's remaining fields without narrowing that compatibility.
+    Effect.flatMap((live) =>
+      Schema.decodeUnknownEffect(Schema.toType(cluster.GetClusterBackupResponse))({
+        ...live,
+        prune_backups: undefined,
+        fleecing: undefined,
+      }).pipe(
+        Effect.mapError(
+          () =>
+            new ProxmoxParseError({
+              body: undefined,
+              cause: 'Backup job response does not match its vendor schema',
+            }),
+        ),
+        Effect.as(live),
+      ),
+    ),
+    Effect.map((live) =>
+      backupJobSpec.attributes(
+        {
+          ...live,
+          'next-run': live.next_run,
+          'notes-template': live.notes_template,
+          'notification-mode': live.notification_mode,
+          'prune-backups':
+            typeof live.prune_backups === 'object' && live.prune_backups !== null
+              ? Object.fromEntries(
+                  Object.entries(live.prune_backups).map(([key, value]) => [
+                    key.replaceAll('_', '-'),
+                    value,
+                  ]),
+                )
+              : live.prune_backups,
+          'repeat-missed': live.repeat_missed,
+        },
+        props,
+      ),
+    ),
+    Effect.catchTag('BackupJobNotFound', () => Effect.succeed(undefined)),
+    Effect.catchTag('NotFound', () => Effect.succeed(undefined)),
+  );
+
+export const deleteBackupJob = (props: BackupJobProps) =>
+  runPve(props.target, 'provision', true, cluster.deleteClusterBackup({ id: props.id })).pipe(
+    Effect.catchTag('BackupJobNotFound', () => Effect.void),
+    Effect.catchTag('NotFound', () => Effect.void),
+  );

package/src/proxmox/backup-job.ts

@@ -13,14 +13,13 @@
  *   COULD CARRY. PVE's own API schema says so in one parenthesis — `id`: "Job ID (will be
  *   autogenerated)." — and a generated id looks like `backup-f56d8ab7-d524`. A resource that
  *   POSTed without an id would create a SECOND job beside the first on EVERY reconcile, and the
- *   read-back in `pveOperations` would still pass, because a job did appear: that check asks "is
- *   the object there", not "is it the one I meant". So `id` is a REQUIRED prop and is always sent
+ *   read-back could still pass, because a job did appear: that check asks "is the object there",
+ *   not "is it the one I meant". So `id` is a REQUIRED prop and is always sent
  *   on create. To adopt a job that already exists, declare its existing id; any other id is a new
  *   job beside it, not an adoption.
- *   ★ AN EXPLICIT id ALSO CLOSES A SECOND HOLE. `pveOperations.read` turns ANY failed GET into
- *     "absent" — an expired lease, a 403, a node that did not answer — and reconcile then POSTs.
- *     With an id, PVE refuses a duplicate section id and the deploy fails loudly; without one, that
- *     same swallowed error would have quietly doubled the cluster's backup jobs.
+ *   ★ FAILED READS NOW PROPAGATE THROUGH DISTILLED. Only a typed missing-job response means
+ *     absent. An expired lease, a 403 or an unrelated server error stops reconciliation before
+ *     any POST. The explicit id remains a second defense against accidentally duplicating jobs.
  *
  * ⚠️ `Sys.Modify` ON `/` IS THE GATE AND IT IS NOT A SMALL GRANT. PVE has no Backup.* privilege:
  *   create, update and delete of a vzdump job are all checked against `Sys.Modify` at `/` — the
@@ -30,17 +29,21 @@
  *   reaction to a 403.
  */
 import { Resource } from 'alchemy';
+import { isResolved } from 'alchemy/Diff';
+import * as cluster from '@distilled.cloud/proxmox/cluster';
+import { runPve } from './distilled-pve.ts';
+import { specGuards } from './resource-guard.ts';
+import { formToSend } from './update-guard.ts';
+import { backupJobSpec } from './backup-job-config.ts';
+import { backupJobRequest, deleteBackupJob, readBackupJob } from './backup-job-distilled.ts';
+
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';
-import { bool, guestList, propertyString, text } from './values.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 
 /**
- * ⚠️ THE PROPS ARE PVE'S OWN KEY NAMES, DASHES INCLUDED. `notes-template` rather than
- *   `notesTemplate` is deliberate: `createForm` is then a copy rather than a translation table,
- *   and a translation table is one more place for a key to be renamed and silently never sent. A
- *   field that is never sent reads back as whatever it already was, which is indistinguishable
- *   from "PVE ignored me".
+ * ★ Public props retain PVE's own dashed field names. The distilled transport maps those
+ *   existing forms to the SDK's generated identifiers; lifecycle tests check the actual wire.
  */
 export interface BackupJobProps extends WithTarget {
   /** ⛔ The primary key, REQUIRED. Never let PVE generate it — see the ⛔ above. */
@@ -107,109 +110,68 @@ export interface ProxmoxBackupJob extends Resource<
 export const ProxmoxBackupJob = Resource<ProxmoxBackupJob>('Proxmox.BackupJob');
 
 /**
- * The form for both create and update.
- *
- * ⛔ A FIELD THE DECLARATION LEAVES OUT IS NOT SENT, AND THAT IS LOAD BEARING. PVE's PUT can only
- *   SET a key; clearing one needs `delete=<key>`, which this resource deliberately never sends.
- *   `updateForm` is handed the props and nothing else, so a `delete` list could only be "every
- *   field you did not declare" — and on a job adopted out of the UI that would silently strip
- *   settings this resource does not even model, `compress`, `mailto` and `bwlimit` among them, on
- *   the first deploy. Leaving undeclared fields alone is the smaller lie, and `matches` tells the
- *   same lie consistently: it does not compare what it cannot change.
- *
- * ⚠️ THE FIVE FIELDS PVE DOCUMENTS A DEFAULT FOR ARE ALWAYS SENT AND ALWAYS COMPARED — `enabled`
- *   (1), `all` (0), `mode` (snapshot), `notification-mode` (auto), `repeat-missed` (0). That is
- *   what makes a hand-flipped `enabled 0` show up as drift rather than as silence, and it is also
- *   what stops those five looping: a field compared against a default must be sent as that
- *   default, or every plan reports an update the PUT never performs. The cost is worth reading
- *   before the first deploy against an adopted job — an omitted `all` is a declaration that this
- *   job backs up NOTHING, and PVE accepts a job that selects nothing without a word. Read that
- *   first plan; do not deploy it unseen.
+ * ⛔ Adoption stays explicit: listing every backup job could grant Alchemy deletion rights over
+ *   an undeclared schedule. Delete removes the schedule, not its stored archives; that still
+ *   stops future backups, so the plan line is a consequential warning.
  */
-const shape = (props: BackupJobProps) => ({
-  all: props.all === true ? '1' : '0',
-  enabled: props.enabled === false ? '0' : '1',
-  mode: props.mode ?? 'snapshot',
-  'notification-mode': props['notification-mode'] ?? 'auto',
-  'repeat-missed': props['repeat-missed'] === true ? '1' : '0',
-  schedule: props.schedule,
-  ...(props.comment === undefined ? {} : { comment: props.comment }),
-  ...(props.exclude === undefined ? {} : { exclude: guestList(props.exclude) }),
-  ...(props.fleecing === undefined ? {} : { fleecing: props.fleecing }),
-  ...(props['notes-template'] === undefined ? {} : { 'notes-template': props['notes-template'] }),
-  ...(props.pool === undefined ? {} : { pool: props.pool }),
-  ...(props['prune-backups'] === undefined ? {} : { 'prune-backups': props['prune-backups'] }),
-  ...(props.storage === undefined ? {} : { storage: props.storage }),
-  ...(props.vmid === undefined ? {} : { vmid: guestList(props.vmid) }),
-});
+const { guardCreate, guardUpdate } = specGuards(backupJobSpec);
 
-const handlers = pveHandlers<BackupJobProps, BackupJobAttributes>({
-  /**
-   * ⛔ NO "IS IT REALLY THERE" GUARD, ON PURPOSE. Returning undefined for a job whose JSON is
-   *   missing some key would be a guess about which keys PVE echoes back, and a wrong guess here
-   *   does not read as absent-and-harmless: `reconcile` would POST, and POST creates ANOTHER job.
-   *   Absence is decided by the API declining to answer, which `pveOperations.read` already
-   *   handles — not by a key being missing from an answer that did arrive.
-   */
-  attributes: (live, props) => ({
-    all: bool(live['all'], false),
-    comment: text(live['comment'], ''),
-    enabled: bool(live['enabled'], true),
-    exclude: guestList(live['exclude']),
-    fleecing: propertyString(live['fleecing'], 'enabled'),
-    id: props.id,
-    mode: text(live['mode'], 'snapshot'),
-    'next-run': typeof live['next-run'] === 'number' ? live['next-run'] : 0,
-    'notes-template': text(live['notes-template'], ''),
-    'notification-mode': text(live['notification-mode'], 'auto'),
-    pool: text(live['pool'], ''),
-    'prune-backups': propertyString(live['prune-backups']),
-    'repeat-missed': bool(live['repeat-missed'], false),
-    schedule: text(live['schedule'], ''),
-    storage: text(live['storage'], ''),
-    vmid: guestList(live['vmid']),
-  }),
-  collection: () => 'cluster/backup',
-  /** ⛔ `id` IS SENT AND IS NOT OPTIONAL. Everything above depends on PVE not inventing one. */
-  createForm: (props) => ({ ...shape(props), id: props.id }),
-  /** Each line reads "not declared, or equal"; the five defaulted fields have no undeclared case. */
-  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */
-  endpoint: { create: 'pve:POST /cluster/backup', update: 'pve:PUT /cluster/backup/{id}' },
-  matches: (attributes, props) =>
-    attributes.schedule === props.schedule &&
-    attributes.enabled === (props.enabled !== false) &&
-    attributes.all === (props.all === true) &&
-    attributes.mode === (props.mode ?? 'snapshot') &&
-    attributes['notification-mode'] === (props['notification-mode'] ?? 'auto') &&
-    attributes['repeat-missed'] === (props['repeat-missed'] === true) &&
-    (props.storage === undefined || attributes.storage === props.storage) &&
-    (props.pool === undefined || attributes.pool === props.pool) &&
-    (props.comment === undefined || attributes.comment === props.comment) &&
-    (props.vmid === undefined || attributes.vmid === guestList(props.vmid)) &&
-    (props.exclude === undefined || attributes.exclude === guestList(props.exclude)) &&
-    (props['notes-template'] === undefined ||
-      attributes['notes-template'] === props['notes-template']) &&
-    (props['prune-backups'] === undefined ||
-      attributes['prune-backups'] === propertyString(props['prune-backups'])) &&
-    (props.fleecing === undefined ||
-      attributes.fleecing === propertyString(props.fleecing, 'enabled')),
-  path: (props) => `cluster/backup/${props.id}`,
-  updateForm: shape,
-});
-
-/**
-* ⛔ Empty for the same reason as every other resource here: adoption must be explicit.
-*   `GET /cluster/backup` would hand back the job somebody made by hand, and adopting it
-*   implicitly would give Alchemy the right to DELETE a cluster's only backup schedule the
-*   first time a line left a stack file.
- 
- *
-* ⚠️ DELETING THE JOB DOES NOT DELETE THE BACKUPS, AND THAT CUTS BOTH WAYS. The archives
-*   stay on the storage, so this looks harmless today; it is destructive in six months,
-*   when the schedule that should have replaced them has not run since. PVE will not
-*   refuse this the way it refuses to delete a pool still holding guests — nothing depends
-*   on a backup job — so the plan line is the only warning anyone gets.
- 
- */
+/** SDK lifecycle walked against pve-manager 9.2.11; failed reads never imply create. */
 export const ProxmoxBackupJobProvider = () =>
-  Provider.effect(ProxmoxBackupJob, Effect.succeed(ProxmoxBackupJob.Provider.of(handlers)));
+  Provider.effect(
+    ProxmoxBackupJob,
+    Effect.succeed(
+      ProxmoxBackupJob.Provider.of({
+        list: () => Effect.succeed([]),
+        read: ({ olds }) => readBackupJob(olds),
+        diff: Effect.fn(function* ({ news, output }) {
+          if (!isResolved(news)) return undefined;
+          yield* guardCreate(news, output === undefined);
+          yield* guardUpdate(news);
+          if (output === undefined) return undefined;
+          const live = yield* readBackupJob(news);
+          if (live === undefined) {
+            yield* guardCreate(news, true);
+            return { action: 'update' } as const;
+          }
+          return { action: backupJobSpec.matches(live, news) ? 'noop' : 'update' } as const;
+        }),
+        reconcile: Effect.fn(function* ({ news }) {
+          const live = yield* readBackupJob(news);
+          yield* guardCreate(news, live === undefined);
+          yield* guardUpdate(news);
+          if (live === undefined) {
+            yield* runPve(
+              news.target,
+              'provision',
+              true,
+              cluster.createClusterBackup(backupJobRequest(news)),
+            );
+          } else {
+            const form = formToSend(
+              backupJobSpec.matches,
+              live,
+              news,
+              backupJobSpec.updateForm(news),
+            );
+            if (form !== undefined)
+              yield* runPve(
+                news.target,
+                'provision',
+                true,
+                cluster.putClusterBackup(backupJobRequest(news, form)),
+              );
+          }
+          const after = yield* readBackupJob(news);
+          if (after === undefined)
+            return yield* Effect.fail(
+              new Error(
+                `${backupJobSpec.path(news)}: write returned success but the resource is still absent`,
+              ),
+            );
+          return after;
+        }),
+        delete: ({ olds }) => deleteBackupJob(olds),
+      }),
+    ),
+  );

package/src/proxmox/ceph-fs-delete.test.ts

@@ -1,11 +1,8 @@
 /**
- * `Proxmox.CephFs`'s destroy path — the one place in this migration that composes a distilled
- * call (`readFs`, before and after) with a hand-client one (`destroyFs`, unmigrated — ceph-fs-
- * wire.ts's header has the measured protocol reason) inside a single handler. Flagged by
- * adversarial review as untested anywhere in the repo before this file: `readFs` alone is proven
- * by ceph-fs-write.test.ts and ceph-adopt.test.ts, `destroyFs` alone is unchanged from main, but
- * the two composed together — on a destructive, hard-to-reverse `RemovalPolicy.destroy()` — had
- * no coverage of the seam itself.
+ * The CephFS destroy lifecycle through the real SDK protocol and Alchemy engine.
+ * The original transport walk left DELETE on the hand client; SDK 0.3.0's query
+ * binding now permits the whole sequence to move. These tests keep the destructive
+ * read/delete/poll/read-back boundary covered without touching a real filesystem.
  */
 import { describe, expect, test } from 'bun:test';
 import * as RemovalPolicy from 'alchemy/RemovalPolicy';
@@ -27,7 +24,7 @@ const declared = () => ProxmoxCephFs(NAME, { name: NAME, node: NODE, target: FAK
 describe('destroying a CephFS', () => {
   test(
     'RemovalPolicy.destroy() then undeclaring: readFs (distilled) finds it, destroyFs ' +
-      '(client.ts) removes it, and the distilled read-back confirms it is gone',
+      '(distilled) removes it, and the distilled read-back confirms it is gone',
     async () => {
       let destroyed = false;
       const fake = fakePve((call: PveCall) => {

package/src/proxmox/ceph-fs-destroy-sdk.test.ts

@@ -0,0 +1,98 @@
+/** The real SDK must send destructive flags in the query and fold only its missing-FS tag. */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import { destroyFs } from './ceph-fs-distilled.ts';
+import { FAKE_TARGET, withoutBao } from './fake-pve.ts';
+
+const props = { name: 'oldfs', node: 'node-b', target: FAKE_TARGET };
+const UPID = 'UPID:node-b:fake:destroyfs';
+const fixture = (answer: () => Response) => {
+  const calls: { method: string; path: string; body: string }[] = [];
+  const stub = async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {
+    const request =
+      input instanceof Request ? new Request(input, init) : new Request(String(input), init);
+    const url = new URL(request.url);
+    if (url.pathname.includes('/creds/')) {
+      return Response.json({
+        data: { secret: 'fake-secret-not-real', token_id: 'hf-test@pve!fake' },
+        lease_duration: 0,
+      });
+    }
+    calls.push({
+      method: request.method,
+      path: url.pathname + url.search,
+      body: await request.text(),
+    });
+    return request.method === 'DELETE'
+      ? answer()
+      : Response.json({ data: { status: 'stopped', exitstatus: 'OK' } });
+  };
+  const layer = FetchHttpClient.layer.pipe(
+    Layer.provideMerge(
+      Layer.succeed(
+        FetchHttpClient.Fetch,
+        Object.assign(stub, { preconnect: globalThis.fetch.preconnect }) as typeof fetch,
+      ),
+    ),
+  );
+  return { calls, layer };
+};
+
+describe('CephFS distilled delete', () => {
+  test('destructive flags reach the query, never the DELETE body, and the worker is polled', async () => {
+    const fake = fixture(() => Response.json({ data: UPID }));
+    await withoutBao(() =>
+      Effect.runPromise(
+        destroyFs({ ...props, 'remove-pools': true, 'remove-storages': true }).pipe(
+          Effect.provide(fake.layer),
+        ),
+      ),
+    );
+    expect(fake.calls[0]).toEqual({
+      method: 'DELETE',
+      path: '/api2/json/nodes/node-b/ceph/fs/oldfs?remove-pools=1&remove-storages=1',
+      body: '',
+    });
+    expect(fake.calls[1]?.path).toBe(
+      `/api2/json/nodes/node-b/tasks/${encodeURIComponent(UPID)}/status`,
+    );
+  });
+
+  test('omitted or false flags preserve the safe defaults', async () => {
+    const fake = fixture(() => Response.json({ data: UPID }));
+    await withoutBao(() =>
+      Effect.runPromise(
+        destroyFs({ ...props, 'remove-pools': false }).pipe(Effect.provide(fake.layer)),
+      ),
+    );
+    expect(fake.calls[0]).toEqual({
+      method: 'DELETE',
+      path: '/api2/json/nodes/node-b/ceph/fs/oldfs',
+      body: '',
+    });
+  });
+
+  test('a race that already removed the filesystem is idempotent without a task poll', async () => {
+    const fake = fixture(() =>
+      Response.json({ data: null, message: "no such cephfs 'oldfs'\n" }, { status: 500 }),
+    );
+    await withoutBao(() => Effect.runPromise(destroyFs(props).pipe(Effect.provide(fake.layer))));
+    expect(fake.calls).toHaveLength(1);
+  });
+
+  for (const status of [401, 403, 500]) {
+    test(`an unrelated HTTP ${String(status)} fails instead of claiming deletion`, async () => {
+      const fake = fixture(() =>
+        Response.json({ data: null, message: 'refused or unavailable' }, { status }),
+      );
+      await withoutBao(async () => {
+        await expect(
+          Effect.runPromise(destroyFs(props).pipe(Effect.provide(fake.layer))),
+        ).rejects.toBeDefined();
+      });
+      expect(fake.calls).toHaveLength(1);
+    });
+  }
+});

package/src/proxmox/ceph-fs-distilled.ts

@@ -1,20 +1,16 @@
 /**
- * `Proxmox.CephFs`'s distilled half: the index read and the create — see ceph-fs-wire.ts's own
- * header for why `destroyFs` stays there, on `client.ts`, unmigrated.
+ * `Proxmox.CephFs`'s distilled transport: index, create, delete and task status.
+ * SDK 0.3.0 fixes DELETE query flags and supplies the measured CephFsNotFound tag.
  *
  * ⛔ `nodes.updateNodeCephFs` IS distilled's GENERATOR MISNAMING A CREATE, NOT A SECOND ENDPOINT.
  *   Checked directly against its schema (`T.Http({ method: "POST", uri:
  *   "/nodes/{node}/ceph/fs/{name}" })`) rather than trusted from the function name — it is the
  *   SAME single write PVE registers, `createfs`. Harmless once named here for what it is.
  *
- * ★ THE SETTLE POLL IS A SEPARATE FUNCTION FROM ceph-fs-wire.ts's, NOT A SHARED ONE, because it
- *   calls a different task-status operation on a different transport — `nodes.getNodeTaskStatus`
- *   here, `pve()` there — but the POLICY is identical on purpose: same cadence
- *   (`POLL_SECONDS`/`POLL_ATTEMPTS`, imported, not retyped), same "an unreadable status is not
- *   settled yet, not a failure" tolerance. That tolerance is why this calls the RAW distilled
- *   operation directly. The former SDK `Task.awaitTask` propagated poll failures; SDK PR #265
- *   removed that helper because polling policy belongs in the provider. This bounded wait
- *   still tolerates a missing `Sys.Audit` grant or a node mid-restart until its deadline.
+ * ★ CREATE AND DELETE SHARE THE SAME BOUNDED POLL POLICY. The raw getNodeTaskStatus
+ *   operation preserves this family's tolerance of a missing Sys.Audit grant or a node
+ *   mid-restart until the deadline. The former SDK Task.awaitTask propagated poll failures;
+ *   SDK PR #265 removed it because polling policy belongs in the provider.
  */
 import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
@@ -43,8 +39,11 @@ const toDistilledCreate = (props: CephFsProps): nodes.UpdateNodeCephFsRequest =>
     node: props.node,
   }) as unknown as nodes.UpdateNodeCephFsRequest;
 
-/** Wait for the create's forked task — the distilled twin of ceph-fs-wire.ts's `settle`. */
-const settleCreate = (props: CephFsProps, upid: string) =>
+/**
+ * Wait for a forked task. `exitstatus` is absent while running and exactly `OK` on success.
+ * ⚠️ T.Label encodes the colon-filled UPID as one path segment, as the hand client did.
+ */
+const settleTask = (props: CephFsProps, upid: string) =>
   Effect.gen(function* () {
     for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt += 1) {
       const status = yield* runPve(
@@ -96,5 +95,34 @@ export const createFs = (props: CephFsProps) =>
         ),
       );
     }
-    yield* settleCreate(props, upid);
+    yield* settleTask(props, upid);
+  });
+
+/**
+ * DELETE the filesystem, then wait for the worker.
+ *
+ * ⛔ WHAT THIS TAKES AWAY DEPENDS ENTIRELY ON `remove-pools`, AND THE DEFAULT IS THE SAFE ONE. With
+ *   it unset PVE removes the filesystem from the MDS map and LEAVES the two pools on disk: every
+ *   mount breaks, but the bytes are still there for an operator to recover. With it set the pools
+ *   go too and nothing is recoverable. Leaving it unset also means a later create of the SAME name
+ *   fails with "ceph pools '<name>_data' and/or '<name>_metadata' already exist" -- that refusal is
+ *   a BRAKE, not a bug, and it is the last thing standing between a mis-typed rename and the data.
+ */
+export const destroyFs = (props: CephFsProps) =>
+  Effect.gen(function* () {
+    const upid = yield* runPve(
+      props.target,
+      'provision',
+      true,
+      nodes.deleteNodeCephFs({
+        node: props.node,
+        name: props.name,
+        // ⛔ Query fields, never a DELETE body. Omitted/false retains PVE's safe default.
+        ...(props['remove-pools'] === true ? { remove_pools: '1' } : {}),
+        ...(props['remove-storages'] === true ? { remove_storages: '1' } : {}),
+      }),
+    ).pipe(Effect.catchTag('CephFsNotFound', () => Effect.succeed('')));
+    // ⚠️ Missing already is idempotent; every other SDK error propagates. The caller's
+    //   successful index read must still confirm absence after the DELETE or task.
+    if (upid !== '') yield* settleTask(props, upid);
   });

package/src/proxmox/ceph-fs-wire.ts

@@ -49,21 +49,13 @@
  *   Grant it on the `read` role, or every create burns the full cap below and reports the wrong
  *   cause.
  *
- * ★ AS OF 2026-09-24 (decision 43's walk-down, 2c) THIS FILE IS `client.ts`'s HALF ONLY. The read
- *   (`readRow`) moved to `ceph-fs-distilled.ts`, and so did the create — `nodes.updateNodeCephFs`
- *   (distilled's own misnamed POST, confirmed against its `T.Http` annotation) plus a SEPARATE
- *   distilled `settle`, using the raw `getNodeTaskStatus` operation in its own tolerant poll loop
- *   rather than `Task.awaitTask`, which does not tolerate a poll failure the way this family needs
- *   (network-apply-read.ts's own header has the fuller reasoning). `destroyFs` stays HERE,
- *   unmigrated: distilled types `remove_pools`/`remove_storages` as `T.Body` on a DELETE, and the
- *   ⛔ two paragraphs up is the MEASURED reason PVE would silently ignore both flags if sent that
- *   way — a real protocol gap, not a judgement call. `settle` below is still shared where it can
- *   be: `createForm`/`objectPath`/`destroyPath` are pure and reused by the distilled file too.
+ * ★ THE ORIGINAL DISTILLED WALK MOVED READ AND CREATE FIRST, leaving DELETE here because
+ *   SDK flags were annotated as body fields. Distilled Proxmox 0.3.0 fixes their query binding
+ *   and adds the measured CephFsNotFound tag. All calls now live in ceph-fs-distilled.ts;
+ *   this file keeps the pure forms, attributes and read-back failure messages. The protocol
+ *   history above remains load-bearing: moving a DELETE flag back into a body loses it silently.
  */
-import * as Effect from 'effect/Effect';
 import type { CephFsAttributes, CephFsProps } from './ceph-fs.ts';
-import { pve } from './client.ts';
-import type { PveTarget } from './credentials.ts';
 import { csv, flag, int, text } from './values.ts';
 
 /**
@@ -100,9 +92,6 @@ export const readRow = (
   };
 };
 
-/** ⚠️ `exitstatus` is ABSENT while a task runs, and is the exact string `OK` only on success. */
-type TaskStatus = { readonly status?: string; readonly exitstatus?: string };
-
 /**
  * ⚠️ SHORT POLLS, LOW CAP. Ninety seconds covers two pool creates plus the ten seconds `createfs`
  *   itself spends waiting for an MDS to go active, and is short enough that a stuck task fails the
@@ -131,83 +120,6 @@ export const createForm = (props: CephFsProps): Record<string, string> => ({
   ...field('pg_num', props.pg_num === undefined ? undefined : String(props.pg_num)),
 });
 
-/** The delete target with its flags in the query string — see the ⛔ in the header. */
-const destroyPath = (props: CephFsProps) => {
-  const query = [
-    props['remove-pools'] === true ? 'remove-pools=1' : undefined,
-    props['remove-storages'] === true ? 'remove-storages=1' : undefined,
-  ].filter((part) => part !== undefined);
-  return query.length === 0 ? objectPath(props) : `${objectPath(props)}?${query.join('&')}`;
-};
-
-/**
- * Wait for a forked PVE task, and fail loudly rather than quietly.
- *
- * ⚠️ THE UPID IS PERCENT-ENCODED BECAUSE IT IS FULL OF COLONS — `UPID:node-b:00396D3A:…:root@pam:`
- *   (MEASURED shape, from `GET /nodes/node-b/tasks`) is ONE path segment, not seven. Encoding is what
- *   guarantees it arrives as one; PVE's router decodes each segment before matching. REASONED from
- *   the URI handling rather than measured — no task of this provider's has been polled yet.
- */
-const settle = (target: PveTarget, node: string, upid: string, what: string) =>
-  Effect.gen(function* () {
-    for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt += 1) {
-      const status = yield* pve<TaskStatus>(
-        target,
-        'read',
-        'GET',
-        `nodes/${node}/tasks/${encodeURIComponent(upid)}/status`,
-      ).pipe(
-        // ⚠️ AN UNREADABLE STATUS IS "NOT SETTLED YET", NOT A FAILURE. It is a missing Sys.Audit
-        //   (see the header) or a node mid-restart; either way the task is still the cluster's
-        //   business, and the cap is what ends the wait rather than one unlucky GET.
-        Effect.orElseSucceed(() => undefined),
-      );
-      if (status?.status === 'stopped') {
-        const exit = text(status.exitstatus);
-        if (exit === 'OK') return;
-        return yield* Effect.die(
-          new Error(
-            `${what}: PVE task ${upid} finished with "${exit === '' ? 'no exit status' : exit}". ` +
-              'The write returned HTTP 200 because it only forked the worker -- the real error is ' +
-              `in \`pvesh get /nodes/${node}/tasks/${upid}/log\`.`,
-          ),
-        );
-      }
-      // ⚠️ A BARE NUMBER IS MILLISECONDS to Effect's Duration, not seconds. The cap in the
-      //   message below is derived from the same constant so the two cannot drift apart.
-      yield* Effect.sleep(POLL_SECONDS * 1000);
-    }
-    return yield* Effect.die(
-      new Error(
-        `${what}: PVE task ${upid} was still running after ` +
-          `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its ` +
-          'status could not be read. Check the task log, and check that the `read` role holds ' +
-          `Sys.Audit on /nodes/${node} -- each call mints a new token, so the poller is never the ` +
-          'task owner and is answered 403 rather than told to wait.',
-      ),
-    );
-  });
-
-/**
- * DELETE the filesystem, then wait for the worker.
- *
- * ⛔ WHAT THIS TAKES AWAY DEPENDS ENTIRELY ON `remove-pools`, AND THE DEFAULT IS THE SAFE ONE. With
- *   it unset PVE removes the filesystem from the MDS map and LEAVES the two pools on disk: every
- *   mount breaks, but the bytes are still there for an operator to recover. With it set the pools
- *   go too and nothing is recoverable. Leaving it unset also means a later create of the SAME name
- *   fails with "ceph pools '<name>_data' and/or '<name>_metadata' already exist" -- that refusal is
- *   a BRAKE, not a bug, and it is the last thing standing between a mis-typed rename and the data.
- */
-export const destroyFs = (props: CephFsProps) =>
-  Effect.gen(function* () {
-    const upid = text(yield* pve<string>(props.target, 'provision', 'DELETE', destroyPath(props)));
-    // ⚠️ A DESTROY THAT ANSWERS WITHOUT A UPID IS NOT REFUSED HERE. `destroyfs` dies synchronously
-    //   with "no such cephfs" when the filesystem is already gone, which surfaces as a failed
-    //   DELETE; an empty answer that is not an error is best treated as already-absent, and the
-    //   caller's read-back is what proves it either way.
-    if (upid !== '') yield* settle(props.target, props.node, upid, destroyPath(props));
-  });
-
 /**
  * The two read-back failures, as messages rather than as guesses.
  *