@homeflare/alchemy 0.37.1 → 0.37.3

package/dist/proxmox/pbs-sync-job-wire.d.ts

@@ -0,0 +1,11 @@
+/** PBS 4.2.6-1 operations through @distilled.cloud/proxmox-backup. */
+import * as config from '@distilled.cloud/proxmox-backup/config';
+import * as Effect from 'effect/Effect';
+import type { SyncJobProps } from './pbs-sync-job.ts';
+/** ⛔ Only the SDK SyncJobNotFound is absence; permission, transport and malformed replies propagate. */
+export declare const readOne: (props: SyncJobProps) => Effect.Effect<import("./pbs-sync-job-attributes.ts").SyncJobAttributes | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | config.ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const createOne: (props: SyncJobProps) => Effect.Effect<config.SyncConfigResponse, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | config.ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const updateOne: (props: SyncJobProps) => Effect.Effect<config.PutConfigSyncResponse, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | config.ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** Deleting the schedule never deletes backups; already missing is a successful deletion. */
+export declare const deleteOne: (props: SyncJobProps) => Effect.Effect<config.DeleteConfigSyncResponse | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | config.ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=pbs-sync-job-wire.d.ts.map

package/dist/proxmox/pbs-sync-job-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-sync-job-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-sync-job-wire.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,KAAK,MAAM,MAAM,wCAAwC,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AA+CtD,wGAAwG;AACxG,eAAO,MAAM,OAAO,UAAW,YAAY,gRAIxC,CAAC;AAEJ,eAAO,MAAM,SAAS,UAAW,YAAY,qOAC+B,CAAC;AAE7E,eAAO,MAAM,SAAS,UAAW,YAAY,wOACkC,CAAC;AAEhF,6FAA6F;AAC7F,eAAO,MAAM,SAAS,UAAW,YAAY,uPAKzC,CAAC"}

package/dist/proxmox/pbs-sync-job.d.ts

@@ -35,8 +35,8 @@
  *     `/api2/json/config/sync` is not even evidence that the endpoint exists. THE FIRST PLAN
  *     AGAINST A LIVE PBS IS THE MEASUREMENT. Read it; do not deploy it unseen.
  *   ⚠️ AN ERROR BODY IS NOT WRAPPED: the 401 body is the bare text `authentication failed`, not
- *     JSON. `pve()` checks `response.ok` before it parses, so a `pbs()` copied from it is safe —
- *     provided the check stays in that order.
+ *     JSON. The original `pve()` checked status before decoding success data. The distilled PBS
+ *     protocol preserves this distinction and classifies error text through SDK patches.
  *
  * ⚠️ `Proxmox.BackupJob` AND `Pbs.SyncJob` ARE NOT THE SAME FAMILY AND THE NAMES NEARLY COLLIDE.
  *   The first is a PVE vzdump schedule; this is a Proxmox Backup SERVER sync job, on a different
@@ -54,6 +54,8 @@
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
+import type { SyncJobAttributes } from './pbs-sync-job-attributes.ts';
+export type { SyncJobAttributes } from './pbs-sync-job-attributes.ts';
 import type { PveRequirements } from './resource.ts';
 import type { WithPbsTarget } from './resource.ts';
 /**
@@ -155,10 +157,10 @@ export interface SyncJobProps extends WithPbsTarget {
     'transfer-last'?: number;
     /**
      * ⛔ NOT DECLARABLE, AND A COMPILE ERROR RATHER THAN A PROP THAT HALF WORKS — the storage.ts
-     *   `password` idiom, for two independent reasons, either of which alone would be enough.
+     *   `password` idiom. Two barriers originally applied; the second remains unresolved.
      *   1. THE WIRE FORM IS AN ARRAY. PBS takes `group-filter` as a repeated parameter
-     *      (`group-filter=type:ct&group-filter=regex:^web`), and `pve()`'s form is
-     *      `Record<string, string>` — one value per key — so a list cannot be expressed at all.
+     *      (`group-filter=type:ct&group-filter=regex:^web`). The old single-value form could not
+     *      express it; the distilled PBS protocol now supports repeated keys.
      *   2. NARROWING A FILTER MAY BE A DELETE. Whether `remove-vanished` skips the groups a filter
      *      excludes is NOT something I could measure without a credential. If it does not, then
      *      editing this field on a job with `remove-vanished` set removes every local group the new
@@ -166,8 +168,8 @@ export interface SyncJobProps extends WithPbsTarget {
      *      half-working prop.
      *   ★ IT IS STILL REPORTED in the attributes, so a plan shows the filters a hand-made job carries
      *     and this resource never strips them: undeclared is unmanaged, and PBS's update assigns only
-     *     what it was sent. To make it declarable, fix both halves — a form type that can repeat a
-     *     key, and a MEASURED answer to (2) — in that order.
+     *     what it was sent. Making it declarable still needs a MEASURED answer to (2), even though
+     *     the SDK now supplies the necessary repeated-key transport.
      */
     'group-filter'?: never;
     /**
@@ -192,38 +194,6 @@ export interface SyncJobProps extends WithPbsTarget {
      */
     'verified-only'?: boolean;
 }
-export interface SyncJobAttributes {
-    /** From the props — it is the path this object was read by. */
-    id: string;
-    store: string;
-    /** `''` is the root namespace, which is also how PBS spells it. */
-    ns: string;
-    /** `''` means a LOCAL sync — datastore to datastore on this PBS. */
-    remote: string;
-    'remote-store': string;
-    'remote-ns': string;
-    /** `''` means the job runs only when somebody starts it. */
-    schedule: string;
-    comment: string;
-    'remove-vanished': boolean;
-    /** ⚠️ Absent on the wire means `false`, PBS's own default. */
-    'verified-only': boolean;
-    /** `''` means no owner in the config, i.e. `root@pam` at runtime. An identifier, never a secret. */
-    owner: string;
-    /** Bytes per second, or `UNSET` (-1). See `bytes()`. */
-    'rate-in': number;
-    /** `UNSET` (-1) means unset, which means full recursion. `0` is a real value meaning none. */
-    'max-depth': number;
-    /** `UNSET` (-1) means all snapshots. */
-    'transfer-last': number;
-    /**
-     * ⚠️ REPORTED, NEVER SENT, NEVER COMPARED — the live filter list joined for display only. See the
-     *   ⛔ on the prop for why it is not declarable.
-     */
-    'group-filter': string;
-    /** `pull` or `push`. Reported, never compared — create-only here. */
-    'sync-direction': string;
-}
 export interface PbsSyncJob extends Resource<'Pbs.SyncJob', SyncJobProps, SyncJobAttributes, never, PveRequirements> {
 }
 /**

package/dist/proxmox/pbs-sync-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pbs-sync-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-sync-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD;;;;;;;OAOG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,eAAe,EAAE,OAAO,CAAC;IACzB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,gIACgD,CAAC"}
+{"version":3,"file":"pbs-sync-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-sync-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD;;;;;;;OAOG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,gIACgD,CAAC"}

package/dist/proxmox/pbs-verify-job-lifecycle.d.ts

@@ -0,0 +1,22 @@
+import type { Input } from 'alchemy/Input';
+import * as Effect from 'effect/Effect';
+import type { PbsVerifyJobAttributes, PbsVerifyJobProps } from './pbs-verify-job.ts';
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: PbsVerifyJobProps;
+    }) => Effect.Effect<PbsVerifyJobAttributes | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | import("@distilled.cloud/proxmox-backup/Protocol").ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: ({ news, output, }: {
+        news: Input<PbsVerifyJobProps>;
+        output: PbsVerifyJobAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: "noop" | "update";
+    } | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: ({ news }: {
+        news: PbsVerifyJobProps;
+    }) => Effect.Effect<PbsVerifyJobAttributes, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds }: {
+        olds: PbsVerifyJobProps;
+    }) => Effect.Effect<import("@distilled.cloud/proxmox-backup/config").DeleteConfigVerifyResponse | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | import("@distilled.cloud/proxmox-backup/Protocol").ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+//# sourceMappingURL=pbs-verify-job-lifecycle.d.ts.map

package/dist/proxmox/pbs-verify-job-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-verify-job-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-verify-job-lifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAMrF,eAAO,MAAM,QAAQ;IAEnB,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,iBAAiB,CAAA;KAAE;IAC5C,IAAI,sBAGD;QACD,IAAI,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC/B,MAAM,EAAE,sBAAsB,GAAG,SAAS,CAAC;KAC5C;;;IAaD,SAAS,aAAa;QAAE,IAAI,EAAE,iBAAiB,CAAA;KAAE;IAgBjD,MAAM,aAAa;QAAE,IAAI,EAAE,iBAAiB,CAAA;KAAE;CAC/C,CAAC"}

package/dist/proxmox/pbs-verify-job-spec.d.ts

@@ -0,0 +1,16 @@
+/** PBS 4.2.6-1 values and vendor form guards; SDK transport is in pbs-verify-job-wire.ts. */
+import type { PbsVerifyJobAttributes, PbsVerifyJobProps } from './pbs-verify-job.ts';
+import type { PveSpec } from './resource-spec.ts';
+/**
+ * ⚠️ EVERY FIELD IS READ THROUGH `values.ts` THOUGH PBS RETURNS REAL JSON TYPES. Unlike PVE's
+ *   SectionConfig round-trip, `GET /config/verify/{id}` serialises a Rust struct, so
+ *   `ignore-verified` arrives as a JSON boolean and `max-depth` as a JSON number. `bool` and `int`
+ *   accept both spellings, and using them costs nothing while covering the version that does not.
+ * ⚠️ `digest` IS NOT AN ATTRIBUTE AND CANNOT BECOME ONE BY ACCIDENT. PBS puts it on the rpcenv, and
+ *   the JSON formatter adds rpcenv attributes as SIBLINGS of `data` — `{"data":{…},"digest":"…"}` —
+ *   so both the old client and the SDK expose only the resource data. Attributes deliberately
+ *   exclude it: the digest covers verification.cfg as a FILE, so keeping it would churn state
+ *   whenever an unrelated verify job was edited.
+ */
+export declare const spec: PveSpec<PbsVerifyJobProps, PbsVerifyJobAttributes>;
+//# sourceMappingURL=pbs-verify-job-spec.d.ts.map

package/dist/proxmox/pbs-verify-job-spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-verify-job-spec.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-verify-job-spec.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACrF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAIlD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,IAAI,EAAE,OAAO,CAAC,iBAAiB,EAAE,sBAAsB,CA0DnE,CAAC"}

package/dist/proxmox/pbs-verify-job-wire.d.ts

@@ -0,0 +1,11 @@
+/** PBS 4.2.6-1 operations through @distilled.cloud/proxmox-backup. */
+import * as config from '@distilled.cloud/proxmox-backup/config';
+import * as Effect from 'effect/Effect';
+import type { PbsVerifyJobProps } from './pbs-verify-job.ts';
+/** ⛔ Only the SDK VerifyJobNotFound is absence; permission, transport and malformed replies propagate. */
+export declare const readOne: (props: PbsVerifyJobProps) => Effect.Effect<import("./pbs-verify-job.ts").PbsVerifyJobAttributes | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | config.ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const createOne: (props: PbsVerifyJobProps) => Effect.Effect<config.VerifyConfigResponse, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | config.ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const updateOne: (props: PbsVerifyJobProps) => Effect.Effect<config.PutConfigVerifyResponse, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | config.ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** Deleting the schedule never deletes backups; already missing is a successful deletion. */
+export declare const deleteOne: (props: PbsVerifyJobProps) => Effect.Effect<config.DeleteConfigVerifyResponse | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | config.ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=pbs-verify-job-wire.d.ts.map

package/dist/proxmox/pbs-verify-job-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-verify-job-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-verify-job-wire.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,KAAK,MAAM,MAAM,wCAAwC,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAkC7D,0GAA0G;AAC1G,eAAO,MAAM,OAAO,UAAW,iBAAiB,4QAI7C,CAAC;AAEJ,eAAO,MAAM,SAAS,UAAW,iBAAiB,uOAC4B,CAAC;AAE/E,eAAO,MAAM,SAAS,UAAW,iBAAiB,0OAC+B,CAAC;AAElF,6FAA6F;AAC7F,eAAO,MAAM,SAAS,UAAW,iBAAiB,yPAK9C,CAAC"}

package/dist/proxmox/pbs-verify-job.d.ts

@@ -9,22 +9,22 @@
  *   green `Proxmox.BackupJob` makes it worse rather than better, because a vzdump job that says
  *   "OK" every night is exactly the evidence people stop at.
  *
- * ⛔ THIS FILE CANNOT AUTHENTICATE UNTIL TWO THINGS OUTSIDE IT CHANGE, AND IT IS SHIPPED SAYING SO
- *   RATHER THAN SHIPPED LOOKING FINISHED. Both are recorded on `PbsTarget` below:
+ * ⚠️ HISTORICAL BOOTSTRAP BLOCKER, 2026-09-13: TWO THINGS OUTSIDE THIS FILE WERE MISSING
+ *   before PBS could authenticate. Both are now resolved by the PBS lane and SDK:
  *     1. `credentials.ts` has no PBS mint. MEASURED 2026-09-13 from this Mac: the agent's
  *        approle is refused `sys/mounts`, `kv/infra/proxmox` and `proxmox-pbs/creds/read` alike —
  *        403 permission denied on all three — so there is no mount to name and none is invented.
  *     2. `client.ts`'s `authorization()` builds a PVE header, and PBS will not accept it. See the
  *        ⛔ on `PbsTarget`.
- *   Until both land, every call 401s, `pveOperations.read` folds that into "absent", and the plan
- *   reports `create` for a job that is plainly there. The deploy then FAILS at the POST rather
+ *   Before both landed, every call 401'd, `pveOperations.read` folded that into "absent", and the plan
+ *   reported `create` for a job that was plainly there. The deploy then FAILED at the POST rather
  *   than clobbering anything — an unauthenticated POST 401s, and an authenticated one is refused
  *   because PBS will not take a duplicate section id — so the cost is a LYING PLAN and a broken
  *   run, not a lost job. That is still reason enough not to wire it into a stack yet: a plan
  *   nobody can trust is its own outage.
  *
- * ⚠️ THE SHAPES BELOW ARE READ FROM PUBLISHED SOURCE, NOT MEASURED ON THIS ESTATE. Everything is
- *   taken from `pbs-api-types/src/jobs.rs`, `src/api2/config/verify.rs`, `src/server/verify_job.rs`
+ * ⚠️ THE ORIGINAL SHAPES WERE READ FROM PUBLISHED SOURCE, NOT MEASURED ON THIS ESTATE. Everything is
+ *   originally taken from `pbs-api-types/src/jobs.rs`, `src/api2/config/verify.rs`, `src/server/verify_job.rs`
  *   and `src/backup/verify.rs` at HEAD of the Proxmox git mirrors on 2026-09-13. What WAS measured
  *   here: `pbs.example.com:8007` and `pbs.mgmt.example.com:8007` both answer HTTP 401 under
  *   STRICT TLS (curl `ssl_verify_result=0`), so no `-k` is needed and `client.ts`'s plain `fetch`
@@ -34,7 +34,7 @@
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import type { PbsTarget } from './credentials.ts';
-import { type PveRequirements } from './resource.ts';
+import type { PveRequirements } from './resource-spec.ts';
 export interface PbsVerifyJobProps {
     /** ⛔ A PBS host, never a PVE cluster. See `PbsTarget`. */
     target: PbsTarget;
@@ -128,7 +128,7 @@ export interface PbsVerifyJob extends Resource<'Pbs.VerifyJob', PbsVerifyJobProp
  */
 export declare const PbsVerifyJob: import("alchemy").ResourceClass<PbsVerifyJob>;
 /**
- * ⛔ `list` IS EMPTY, INHERITED FROM `pveHandlers`, AND THE REASON IS SHARPER HERE THAN ELSEWHERE.
+ * ⛔ `list` STAYS EXPLICITLY EMPTY, AND THE REASON IS SHARPER HERE THAN ELSEWHERE.
  *   `GET /config/verify` returns every verification job the caller can see, including the
  *   ones the PBS installer and a human made. Adopting those would put Alchemy one dropped line
  *   away from DELETING a datastore's only verification schedule — and deleting it destroys nothing
@@ -136,10 +136,10 @@ export declare const PbsVerifyJob: import("alchemy").ResourceClass<PbsVerifyJob>
  *   to say when the rot started. Adoption stays explicit: declare the existing id.
  *
  * ⚠️ NO `digest` IS SENT ON UPDATE OR DELETE, SO THIS IS LAST-WRITER-WINS. PBS accepts an optional
- *   `digest` on both and would refuse a write made against a stale read. Sending one would need a
- *   read-then-write window this provider does not have — `pveOperations` reads and writes in two
- *   separate calls with two separate mints — so a concurrent edit from the PBS UI is overwritten
- *   rather than refused. Same behaviour as every PVE family here; stated because PBS offers better.
+ *   `digest` on both and would refuse a write made against a stale read. This migration preserves
+ *   the existing forms, which omit it; the SDK runner reuses leased credentials but does not add
+ *   an optimistic-lock check. A concurrent edit from the PBS UI may therefore be overwritten
+ *   rather than refused. PBS offers that stronger guarantee as a separate provider change.
  */
 export declare const PbsVerifyJobProvider: () => import("effect/Layer").Layer<Provider.Provider<PbsVerifyJob>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=pbs-verify-job.d.ts.map

package/dist/proxmox/pbs-verify-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pbs-verify-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-verify-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAE,KAAK,eAAe,EAAe,MAAM,eAAe,CAAC;AAGlE,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,MAAM,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,+CAA0C,CAAC;AAyEpE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,kIACkD,CAAC"}
+{"version":3,"file":"pbs-verify-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-verify-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,MAAM,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,+CAA0C,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,kIACkD,CAAC"}

package/dist/proxmox/pool.d.ts

@@ -17,8 +17,10 @@
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
+import * as pools from '@distilled.cloud/proxmox/pools';
+import * as Effect from 'effect/Effect';
 import type { PoolsPoolidPutParams, PoolsPostParams } from './generated/pve.ts';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 export interface PoolProps extends WithTarget {
     /** PVE's primary key for a pool. Changing it is a replace, not an update. */
     poolid: string;
@@ -38,5 +40,12 @@ export declare const ProxmoxPool: import("alchemy").ResourceClass<ProxmoxPool>;
 export declare const poolCreateForm: (props: PoolProps) => PoolsPostParams;
 /** PUT body — only `comment`; path carries `poolid`. Matches deprecated `/pools/{poolid}`. */
 export declare const poolUpdateForm: (props: PoolProps) => Pick<PoolsPoolidPutParams, 'comment'>;
+/** Pool absence is PVE's typed 500, not a catch-all; pve-manager 9.2.11. */
+export declare const readPool: (props: PoolProps) => Effect.Effect<{
+    comment: string;
+    members: number;
+    poolid: string;
+} | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/caddy").UnprocessableEntity | import("@distilled.cloud/proxmox/Errors").ClientErrors, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const deletePool: (props: PoolProps) => Effect.Effect<void | pools.DeletePoolResponse, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/caddy").UnprocessableEntity | import("@distilled.cloud/proxmox/Errors").ClientErrors, import("effect/unstable/http/HttpClient").HttpClient>;
 export declare const ProxmoxPoolProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxPool>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=pool.d.ts.map

package/dist/proxmox/pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAEV,oBAAoB,EACpB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAEjE,mFAAmF;AACnF,eAAO,MAAM,cAAc,UAAW,SAAS,KAAG,eAGhD,CAAC;AAEH,8FAA8F;AAC9F,eAAO,MAAM,cAAc,UAAW,SAAS,KAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAEpF,CAAC;AAoBH,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}
+{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AAGxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAW,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAK/E,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAEjE,mFAAmF;AACnF,eAAO,MAAM,cAAc,UAAW,SAAS,KAAG,eAGhD,CAAC;AAEH,8FAA8F;AAC9F,eAAO,MAAM,cAAc,UAAW,SAAS,KAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAEpF,CAAC;AAsBH,4EAA4E;AAC5E,eAAO,MAAM,QAAQ,UAAW,SAAS;;;;o+BAiBtC,CAAC;AAEJ,eAAO,MAAM,UAAU,UAAW,SAAS,ygCAIxC,CAAC;AAEJ,eAAO,MAAM,mBAAmB,iIAoD7B,CAAC"}

package/dist/proxmox/storage-wire.d.ts

@@ -40,7 +40,7 @@ export declare const same: <T>(declared: T | undefined, live: T) => boolean;
  *   `readUser`/`readGroup` do, so a brand-new declaration can still be created; `readStorageOrFail`
  *   (used by `diff`) does not.
  */
-export declare const readStorageOrFail: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | storage.StorageNotFound | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readStorageOrFail: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | storage.StorageNotFound | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ⛔ ONLY `StorageNotFound` MEANS ABSENT. The initial distilled transport swap preserved a
  *   catch-all fold because PVE reports missing objects as HTTP 500. SDK PR 265 now types that
@@ -49,7 +49,7 @@ export declare const readStorageOrFail: (props: StorageProps) => Effect.Effect<t
  * ★ `readStorageOrFail` remains the strict path used for an already-confirmed state row. This
  *   change narrows cold reads/reconcile without changing that existing drift/diff contract.
  */
-export declare const readStorage: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readStorage: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/unstable/http/HttpClient").HttpClient>;
 /** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
 export declare const dropUnreadable: (live: StorageAttributes | Unreadable | undefined) => StorageAttributes | undefined;
 /**

package/dist/proxmox/storage-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-wire.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,OAAO,MAAM,kCAAkC,CAAC;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAmBD,eAAO,MAAM,QAAQ,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YACN,CAAC;AAE9D,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,YACX,CAAC;AAwB9C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,UAAW,YAAY,63BAGyC,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,UAAW,YAAY,+2BAG5C,CAAC;AAEJ,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,iBAAiB,GAAG,UAAU,GAAG,SAAS,kCACvC,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,iBAAiB,SAAS,YAAY,YAOjC,CAAC"}
+{"version":3,"file":"storage-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-wire.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,OAAO,MAAM,kCAAkC,CAAC;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAmBD,eAAO,MAAM,QAAQ,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YACN,CAAC;AAE9D,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,YACX,CAAC;AAwB9C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,UAAW,YAAY,mmCAGyC,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,UAAW,YAAY,qlCAG5C,CAAC;AAEJ,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,iBAAiB,GAAG,UAAU,GAAG,SAAS,kCACvC,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,iBAAiB,SAAS,YAAY,YAOjC,CAAC"}

package/dist/proxmox/user-wire.d.ts

@@ -29,7 +29,7 @@ export declare const matches: (attributes: UserAttributes, props: UserProps) =>
  *   `PveClusterExhausted`, then silently folded to "absent" by the old `orElseSucceed`, forcing a
  *   false `update` on every account.
  */
-export declare const readUserOrFail: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | access.UserNotFound, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readUserOrFail: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity | access.UserNotFound, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ⛔ ONLY `UserNotFound` MEANS ABSENT. The initial distilled transport swap preserved a
  *   catch-all fold because PVE reports missing objects as HTTP 500. SDK PR 265 now types that
@@ -38,7 +38,7 @@ export declare const readUserOrFail: (props: UserProps) => Effect.Effect<typeof
  * ★ `readUserOrFail` remains the strict path used for an already-confirmed state row. This
  *   change narrows cold reads/reconcile without changing that existing drift/diff contract.
  */
-export declare const readUser: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readUser: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/unstable/http/HttpClient").HttpClient>;
 /** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
 export declare const dropUnreadable: (live: UserAttributes | Unreadable | undefined) => UserAttributes | undefined;
 //# sourceMappingURL=user-wire.d.ts.map

package/dist/proxmox/user-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/user-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,eAAO,MAAM,WAAW,2BAA2B,CAAC;AACpD,eAAO,MAAM,WAAW,mCAAmC,CAAC;AA2D5D,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,uBAGnD,CAAC;AAEH,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,oBAGnD,CAAC;AAoBH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,cAAc,SAAS,SAAS,YAOF,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,UAAW,SAAS,s3BAG+C,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,UAAW,SAAS,42BACqD,CAAC;AAE/F,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,cAAc,GAAG,UAAU,GAAG,SAAS,+BACpC,CAAC"}
+{"version":3,"file":"user-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/user-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,eAAO,MAAM,WAAW,2BAA2B,CAAC;AACpD,eAAO,MAAM,WAAW,mCAAmC,CAAC;AA2D5D,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,uBAGnD,CAAC;AAEH,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,oBAGnD,CAAC;AAoBH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,cAAc,SAAS,SAAS,YAOF,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,UAAW,SAAS,4lCAG+C,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,UAAW,SAAS,klCACqD,CAAC;AAE/F,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,cAAc,GAAG,UAAU,GAAG,SAAS,+BACpC,CAAC"}

package/dist/proxmox/zfs-pool-wire.d.ts

@@ -51,7 +51,7 @@ export declare const leafDevices: (children: unknown) => string[];
  *   `SETTLE_ATTEMPTS` (zfs-pool-form.ts's own ⚠️ on that); `readPoolOrFail` (used by `diff`) does
  *   not fold it, so a genuine transient failure there propagates and fails the plan loudly instead.
  */
-export declare const readPoolOrFail: (props: ZfsPoolProps) => Effect.Effect<typeof UNREADABLE | ZfsPoolAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readPoolOrFail: (props: ZfsPoolProps) => Effect.Effect<typeof UNREADABLE | ZfsPoolAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `createPool`'s settle-poll AND
  *   `read`/`reconcile` MAY USE IT — user.ts's `readUser` has the full reasoning. Safe here because

package/dist/proxmox/zfs-pool-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zfs-pool-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool-wire.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,aAAc,OAAO,KAAG,MAAM,EAO9C,CAAC;AAmBT;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,UAAW,YAAY,+2BAe/C,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,UAAW,YAAY,kIACuB,CAAC;AAEpE,sGAAsG;AACtG,eAAO,MAAM,cAAc,SAAU,iBAAiB,GAAG,UAAU,GAAG,SAAS,kCACvC,CAAC;AAEzC;;;;;;;;GAQG"}
+{"version":3,"file":"zfs-pool-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool-wire.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,aAAc,OAAO,KAAG,MAAM,EAO9C,CAAC;AAmBT;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,UAAW,YAAY,qlCAe/C,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,UAAW,YAAY,kIACuB,CAAC;AAEpE,sGAAsG;AACtG,eAAO,MAAM,cAAc,SAAU,iBAAiB,GAAG,UAAU,GAAG,SAAS,kCACvC,CAAC;AAEzC;;;;;;;;GAQG"}

package/docs/changelog/README.md

@@ -0,0 +1,22 @@
+# Alchemy changelog archive
+
+Release history before 0.37.1, preserved in order. See the [current changelog](../../CHANGELOG.md).
+
+- [0.37.0](./archive-01.md)
+- [0.37.0 to 0.35.0](./archive-02.md)
+- [0.35.0 to 0.34.0](./archive-03.md)
+- [0.34.0 to 0.33.0](./archive-04.md)
+- [0.33.0 to 0.32.0](./archive-05.md)
+- [0.32.0 to 0.31.1](./archive-06.md)
+- [0.31.1 to 0.29.1](./archive-07.md)
+- [0.29.1 to 0.29.0](./archive-08.md)
+- [0.29.0 to 0.27.3](./archive-09.md)
+- [0.27.3 to 0.24.0](./archive-10.md)
+- [0.24.0 to 0.20.0](./archive-11.md)
+- [0.20.0 to 0.16.1](./archive-12.md)
+- [0.16.1 to 0.15.0](./archive-13.md)
+- [0.15.0 to 0.14.0](./archive-14.md)
+- [0.14.0 to 0.10.0](./archive-15.md)
+- [0.10.0 to 0.6.0](./archive-16.md)
+- [0.6.0 to 0.1.1](./archive-17.md)
+- [0.1.1 to 0.1.0](./archive-18.md)

package/docs/changelog/archive-01.md

@@ -0,0 +1,176 @@
+# Alchemy changelog archive 1
+
+[Current changelog](../../CHANGELOG.md) · [Archive index](./README.md)
+
+## 0.37.0
+
+### Minor Changes
+
+- [#262](https://github.com/taslabs-net/homeflare-kit/pull/262) [`ca1a558`](https://github.com/taslabs-net/homeflare-kit/commit/ca1a558db9101a8381dff57ba80f4aafcd01ae61) Thanks [@taslabs-net](https://github.com/taslabs-net)! - New `argocd/*` family — `Argocd.Repository`, `Argocd.RepoCreds` and `Argocd.Cluster`, on
+  `@distilled.cloud/argocd@1.0.0-rc.12` (measured published, matching the kit's own `effect`/core
+  pins — added as a direct peer dependency, the same shape as `forgejo`/`discord`). Built ahead of
+  need, per Tim's "we are using talos on pve once we get things settled ... i thought we are using
+  argocd, i wanted it on the radar" and "even if we don't use it yet but we know we will" — **no
+  Talos-on-PVE cluster and no Argo CD instance exist on the estate yet**; every test runs against a
+  fake, never a real server.
+
+  **Upstream check first (decision 49).** `alchemy-run/alchemy` v2.0.0-beta.79 ships no ArgoCD
+  provider at all — the only two `argocd` hits in the whole repo are an unrelated AWS EKS add-on
+  capability name in a JSDoc example. So there is nothing upstream to duplicate.
+
+  **The REST-vs-CRD split is the actual design decision, and it is why `Application`/`AppProject`
+  are deliberately NOT in this family.** Both are real Kubernetes CRDs (`argoproj.io/v1alpha1`,
+  their own versioned OpenAPI schema, listable with plain `kubectl`) — the upstream-correct owner is
+  Alchemy's own `Kubernetes.Manifest` (`src/Kubernetes/Manifest.ts`, which already documents a
+  "Custom resource (CRD)" example), not a house REST wrapper around the same object. Repository,
+  RepoCreds and Cluster are different: Argo CD's own storage for them is a `Secret` labeled with its
+  own private convention (`argocd.argoproj.io/secret-type: repository|repo-creds|cluster`) — not a
+  published Kubernetes API type, so the REST SDK is the only correct owner. Full reasoning, citations
+  and worked `Kubernetes.Manifest` examples for `Application`/`AppProject`:
+  `packages/alchemy/docs/argocd.md` and `docs/argocd-kubernetes.md`.
+
+  **A real, measured SDK-gap check that came back clean, unlike Discord's.** No `patches/` directory
+  exists for `packages/argocd` in distilled (homeflare/base) — every generated operation's own
+  declared `errors` array is just `[UnknownArgocdError]`. That looks like Discord's documented gap
+  (`docs/discord.md#sdk-gaps`) at first read. It is not: `protocol.ts` types every operation's shared
+  error channel from `API_ERRORS` (the full `HTTP_STATUS_MAP` set, not the narrower
+  `DEFAULT_ERRORS` Discord's channel is built from), and `core/protocol-rest.ts#decode` maps any
+  4xx status through `HTTP_STATUS_MAP` unconditionally after the per-op typed matchers, regardless
+  of what the operation itself declared. `catchTag('NotFound', ...)` works correctly today — proven
+  against the real protocol and a fake 404/401/403 in `repository.test.ts`, `repo-creds.test.ts` and
+  `cluster.test.ts`, not asserted by reading the source alone. No distilled patch was needed.
+
+  **Secrets never in state.** Every credential field (a repo's password/SSH key/bearer token/TLS
+  client key, a cluster's password/bearer token/TLS client key) is a prop typed `FromEnv`
+  (`../secrets/write-only.ts`), resolved from the deploying process's own environment at call time
+  and refused with a typed domain error when unset — never a literal value on a stack file, an
+  attribute, or in Alchemy's state store. No drift detection on those fields, the same
+  simplification `forgejo/org-actions-secrets.ts` already makes for the identical problem (Argo CD's
+  `Get`/`List` never returns them back): written once on create, rotated by destroy-then-create.
+
+  **Shape.** One shared engine (`resource.ts`) — a near-verbatim copy of `forgejo/resource.ts`, since
+  both SDKs are plain bearer-REST with a genuine typed `NotFound`. `reconcile` is a single upsert
+  call (every `Create*` operation this family calls takes `upsert: true` as a query parameter,
+  converging create-or-update in one request — no separate `Update*` path to wire). No `adopt(true)`/
+  `Unowned` wrapping, mirroring forgejo's own choice rather than discord's/netbox's marker.
+
+  **Tests**: 20 cases across the three resources, covering a live decode, a 404 folding to absent, a
+  401/403 propagating (never folded), idempotent delete (no DELETE call against an already-absent
+  object), and the write-only credential refusal/resolution path — all against `fake-argocd.ts`, a
+  loopback fake exercising the real distilled protocol, never a real Argo CD server.
+
+### Patch Changes
+
+- [#259](https://github.com/taslabs-net/homeflare-kit/pull/259) [`4302d28`](https://github.com/taslabs-net/homeflare-kit/commit/4302d28be200a04aa7b367a8a579134f864cd414) Thanks [@taslabs-net](https://github.com/taslabs-net)! - The `proxmox/*` family's Ceph sub-area, second of two PRs for 2c (decision 43's walk-down): migrates
+  `Proxmox.CephDaemon` (mon/mgr/mds) and `Proxmox.CephOsd` fully onto `@distilled.cloud/proxmox`.
+  Neither family had a forked-worker settle loop or an envelope-stripping dependency, so unlike
+  `Proxmox.NetworkApply`/`Proxmox.CephFs`'s delete, there is no protocol-level reason to leave either
+  on `client.ts` — both move completely.
+
+  **`Proxmox.CephDaemon`** replaces the generic `pveOperations`/`pveHandlers` factory (which cannot
+  run a distilled typed operation) with hand-written `read`/`diff`/`reconcile`/`delete`, matching the
+  factory's own pre-migration shape exactly: `matches` was always `() => true` and there is no PUT
+  for any of the three kinds, so a live daemon is always `noop` and drift is always `update`, never a
+  diff no write could satisfy. `nodes.updateNodeCephMon`/`Mgr`/`Mds` are distilled's generator
+  misnaming the create a POST "update" (checked against each one's `T.Http` annotation before
+  trusting the name); `nodes.listNodeCephMon`/`Mgr`/`Mds` and `nodes.deleteNodeCephMon`/`Mgr`/`Mds`
+  are the read and delete. One field rename: mon's `mon-address` maps to distilled's `mon_address`
+  (`T.Body("mon-address")`, confirmed against the schema) — the same one-key pattern
+  node-network-form.ts's `RENAMED` table carries for three fields.
+
+  **`Proxmox.CephOsd`** keeps its own pre-migration read behaviour exactly: `readOsd` (ceph-osd-tree.ts)
+  still has NO `Effect.orElseSucceed` — the tree endpoint is a collection that always exists while
+  Ceph is installed, so a read failure is never "the OSD is gone" and must propagate, never fold. This
+  is the one migrated Ceph family that does NOT match the single-fold shape `Proxmox.CephPool`/
+  `Proxmox.CephDaemon` carry, because it never had it before this PR either. `nodes.getNodeCephOsd`
+  (the tree), `nodes.createNodeCephOsd` and `nodes.deleteNodeCephOsd` map 1:1 to the existing forms.
+
+  **Both families keep every existing refusal byte-for-byte.** `Proxmox.CephOsd`'s create and delete
+  remain unreachable through this package's own credential — PVE registers `createosd`/`destroyosd`
+  with NO permissions block at all (root@pam only), confirmed again against distilled's own generated
+  schema, which changes nothing about that restriction. `Proxmox.CephDaemon`'s destroy still runs
+  against the daemon's own id path, never the collection `read` uses, avoiding the 501-that-looks-
+  like-a-permission-problem the pre-migration header already warned about.
+
+  **One pre-existing, out-of-scope finding, carried forward exactly rather than fixed here:**
+  `Proxmox.CephOsd`'s `destroyOsd` sends its `cleanup` flag as a request BODY on a DELETE, on
+  `client.ts` before this PR and on distilled after it alike — `client.ts`'s own `buildRequest` puts
+  `form` in the body for every HTTP method, and distilled's generated `DeleteNodeCephOsdRequest`
+  carries no `T.Query()` annotation on `cleanup` either, so it defaults to the same place. PVE's own
+  server (measured from `AnyEvent.pm`, the same fact `Proxmox.CephFs`'s delete was kept off distilled
+  for) never reads a body on DELETE — so `cleanup=1` was ALREADY silently ignored by the live cluster
+  before this migration. This is not a new regression, so it is not a reason to keep `destroyOsd` off
+  distilled the way `Proxmox.CephFs`'s delete was — but it is a real bug, unrelated to this PR, flagged
+  separately for its own fix (move `cleanup` into the query string, the way `destroyPath` in
+  ceph-fs-wire.ts already does for CephFs's own flags). It has zero live impact today either way,
+  since the whole DELETE 403s for this package's credential regardless of `cleanup`.
+
+  **One adversarial-review finding, fixed.** The hand-written `reconcile` returned early on
+  `if (live !== undefined) return live;` BEFORE calling `guardWrite` — the pre-migration factory
+  (`pveOperations.reconcile`, resource.ts) ran its create/update guard unconditionally right after
+  the read, because `reconcile` also runs for an ADOPTED row with no fresh `diff` first (Plan.ts
+  forces it after the probe even when `diff` said noop). Inert today, since `diff` guards every
+  normal plan — but a real gap for any caller that invokes `reconcile` directly (a resumed apply
+  from persisted state, a verify/adopt harness). Fixed to match `node-network.ts`'s own `reconcile`:
+  `guardWrite` now runs immediately after the read, unconditionally. `reconcileDaemon` is exported
+  so a test can call it directly, bypassing `diff` the same way the gap would have been reached.
+
+  **A related, separate finding, NOT fixed here — recorded to `decisions.md`'s open items.** Proving
+  the guard fix with an actual refused value turned up that `constraints.ts`'s `violations()` never
+  checks a bare `format` rule: `mon-address`'s own vendor entry is `{"format":"ip-list",
+"type":"string"}` with no `pattern`, and checked directly, `formViolations` returns `[]` for a
+  malformed address. `mds`/`mgr`'s create endpoints carry EMPTY constraint tables too. About 105
+  parameters across this whole package declare a `format`; none are enforced. This is a real,
+  pre-existing gap unrelated to distilled or this migration — the new test instead proves the
+  STRUCTURAL property (`guardWrite`, and the `createForm` it must evaluate, still run on the
+  adopted-row path, via a field getter that only `createForm` reads on that path), confirmed to fail
+  without the ordering fix by temporarily reverting it and re-running.
+
+  **New tests**, proven against a deliberately broken implementation before landing:
+  `ceph-daemon-write.test.ts` (a new mon POSTs `mon-address` as `mon_address` and reads the collection
+  back; a new mds POSTs `hotstandby`; `RemovalPolicy.destroy()` then undeclaring a mgr sends exactly
+  one DELETE — confirmed to fail without the real `deleteDaemon` call by temporarily stubbing it out)
+  and `ceph-osd-write.test.ts` (a new OSD POSTs `dev` and `crush-device-class` correctly and reads the
+  new leaf back by id — this test can never run against the real cluster, since the write it drives is
+  root-only, but it is the only way to catch a wire-translation bug a real deploy would never reach far
+  enough to expose).
+
+  **Expected after this releases and the consumer bumps:** no live plan change for either family — C1's
+  read-role lease could always read the live Ceph daemons and OSDs cleanly, so this is a transport
+  migration on tested paths, not a behaviour change.
+
+- [#257](https://github.com/taslabs-net/homeflare-kit/pull/257) [`5e1e1b7`](https://github.com/taslabs-net/homeflare-kit/commit/5e1e1b7dfd51cff7664c74284287e44e9caa9f3c) Thanks [@taslabs-net](https://github.com/taslabs-net)! - The `proxmox/*` family's Ceph sub-area, first PR of two (decision 43's serial proxmox walk-down,
+  2c — the four Ceph families, split pool+fs first, daemon+osd after): migrates `Proxmox.CephPool`
+  fully onto `@distilled.cloud/proxmox`, and migrates `Proxmox.CephFs`'s READ and CREATE onto it
+  while its DELETE stays on `client.ts` for a measured protocol reason.
+
+  **Every existing refusal and guard survives byte-for-byte — this is a transport swap, not a
+  redesign.** Both families keep the exact single-fold read shape they always had
+  (`Effect.orElseSucceed` after every failure, no `output`-branching): that is NOT the newer
+  dual-path pattern `Proxmox.NodeNetwork`/`Proxmox.ZfsPool`/`Proxmox.Storage` carry, and it is not
+  upgraded to it here — this PR's own rule is behaviour surviving unchanged, not gaining the newer
+  pattern along the way. Both `ceph-pool-wire.ts` and `ceph-fs-distilled.ts` say so in their own
+  headers, including the same-day latent gap this leaves (a refused OpenBao mint still folds to
+  "absent" on both families, the cries-wolf class already fixed elsewhere) — noted, not fixed, since
+  fixing it is a behaviour change this PR's rules do not ask for.
+
+  **`Proxmox.CephPool`: the PG-merge guard, and the absence signal, both measured live.** `GET
+/nodes/{node}/ceph/pool/{name}/status` on a name with no pool answers a generic HTTP 500 (measured
+  against TB4 `n2`, 2026-09-24, read-role, read-only probe:
+  `{"data":null,"message":"error with 'osd pool get': mon_cmd failed - unrecognized pool
+'<name>'\n"}`) — not a parsed field like `Proxmox.NodeNetwork`'s 400, so `confirmAbsent`
+  (ceph-pool-settle.ts) still asks the SECOND question — does the index list this name — before a
+  create is allowed to run, exactly as before. `confirmAbsent` now calls distilled's
+  `listNodeCephPool`; the settle loop (waiting out a forked worker) never used PVE's task-status
+  endpoint at all — it re-polls the pool's own status, so it needed no `Task.awaitTask` and carries
+  no NEW protocol risk. `createNodeCephPool`/`putNodeCephPool`/`deleteNodeCephPool` map 1:1 to the
+  existing form (no field renames this family needed).
+
+  **`Proxmox.CephFs`: reads and create move; delete does not, for a measured reason.** Distilled
+  types `DeleteNodeCephFsRequest`'s `remove_pools`/`remove_storages` as request-BODY fields
+  (`T.Body`) — checked directly against its generated schema. This family's own header already
+  carries the measured fact (from PVE's own `AnyEvent.pm`) that PVE's server reads a request body
+  only on PUT/POST; a DELETE's body is silently discarded, no error raised anywhere. Sending those
+  two safety flags through distilled's generated delete op as-is would silently drop them — the same
+  class of protocol gap `Proxmox.NetworkApply` was kept off distilled for. `destroyFs` therefore
+  stays on `client.ts`, unmigrated, in `ceph-fs-wire.ts`.