@homeflare/alchemy 0.37.5 → 0.37.7

package/dist/openbao/policy-identity.d.ts

@@ -0,0 +1,12 @@
+/** A policy is its name, keyed as OpenBao keys it (`policyKey`). */
+export declare const policyIdentity: import("./rename-identity.ts").Identity<{
+    readonly name: string;
+}>;
+/** The occupied-name guard must use the same SDK and refusal semantics as every other read. */
+export declare const judgePolicyRename: (olds: unknown, news: unknown, output: {
+    readonly name: string;
+} | undefined) => import("effect/Effect").Effect<{
+    from: string;
+    to: string;
+} | undefined, import("./bao-status.ts").BaoError | import("effect/Cause").TimeoutError | import("@distilled.cloud/openbao/Protocol").OpenBaoOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=policy-identity.d.ts.map

package/dist/openbao/policy-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-identity.d.ts","sourceRoot":"","sources":["../../src/openbao/policy-identity.ts"],"names":[],"mappings":"AAIA,oEAAoE;AACpE,eAAO,MAAM,cAAc;mBAAiC,MAAM;EAIjE,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,iBAAiB,SACtB,OAAO,QACP,OAAO,UACL;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS;;;2MAQ5C,CAAC"}

package/dist/openbao/policy-wire.d.ts

@@ -1,13 +1,9 @@
-/**
- * The three OpenBao calls Bao.Policy makes — read, write and delete of `sys/policies/acl/<name>`.
- * Split from policy.ts so the trailing-newline round trip can be tested against a fake server.
- */
 import * as Effect from 'effect/Effect';
 import { BaoError } from './bao-status.ts';
 /** The endpoint the CLI's policy commands used — openbao v2.6.2 api/sys_policy.go:60, :100, :122. */
 export declare const policyPath: (name: string) => string;
 /**
- * The live policy text, or '' when the policy is genuinely absent. Anything else FAILS.
+ * The live policy text, or undefined only when the SDK reports PolicyNotFound. Other errors FAIL.
  *
  * 🔴 THE ABSENCE WORDING WAS THE POLICY COMMAND'S OWN, AND ASSUMING OTHERWISE MADE A NEW POLICY
  *   UNCREATABLE. `No value found at` was measured for `bao read`; `bao policy read` never printed
@@ -29,13 +25,18 @@ export declare const policyPath: (name: string) => string;
  * ⚠️ `data.policy` IS THE TEXT, and a 200 without it is a failure, as it was in the CLI's client
  *   ("no policy found in response", api/sys_policy.go:81-85).
  */
-export declare const readPolicy: (name: string) => Effect.Effect<string, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readPolicy: (name: string) => Effect.Effect<string | undefined, BaoError | import("effect/Cause").TimeoutError | import("@distilled.cloud/openbao/Protocol").OpenBaoOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** Even a live empty policy occupies its name; rename guards must not overwrite it. */
+export declare const policyExists: (name: string) => Effect.Effect<boolean, BaoError | import("effect/Cause").TimeoutError | import("@distilled.cloud/openbao/Protocol").OpenBaoOpError, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ★ THE HCL TRAVELS IN THE REQUEST BODY (`{"policy": …}`, api/sys_policy.go:96-101). The CLI path
  *   needed a scoped temp file because passing HCL on argv would have put every grant in the process
  *   list; a JSON body never reaches argv, so the temp file is gone with it.
+ * ★ A FULL-REPLACE WRITE: the whole policy text is sent every time, so it is safe to retry a
+ *   transport failure through `runBaoWrite` — a replayed attempt converges on the same policy
+ *   rather than compounding a partial one.
  */
-export declare const writePolicy: (name: string, hcl: string) => Effect.Effect<void, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const writePolicy: (name: string, hcl: string) => Effect.Effect<void, BaoError | import("effect/Cause").TimeoutError | import("@distilled.cloud/openbao/Protocol").OpenBaoOpError, import("effect/unstable/http/HttpClient").HttpClient>;
 /** Deleting a policy that is already gone answers success (handlePoliciesDelete returns nothing). */
-export declare const deletePolicy: (name: string) => Effect.Effect<void, BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const deletePolicy: (name: string) => Effect.Effect<void, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | BaoError | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/caddy").UnprocessableEntity | import("@distilled.cloud/openbao/Errors").ClientErrors, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=policy-wire.d.ts.map

package/dist/openbao/policy-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/policy-wire.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,qGAAqG;AACrG,eAAO,MAAM,UAAU,SAAU,MAAM,WAA+B,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,UAAU,SAAU,MAAM,0FAOnC,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,WAAW,SAAU,MAAM,OAAO,MAAM,wFACD,CAAC;AAErD,qGAAqG;AACrG,eAAO,MAAM,YAAY,SAAU,MAAM,wFAAgC,CAAC"}
+{"version":3,"file":"policy-wire.d.ts","sourceRoot":"","sources":["../../src/openbao/policy-wire.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,qGAAqG;AACrG,eAAO,MAAM,UAAU,SAAU,MAAM,WAA+B,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,UAAU,SAAU,MAAM,yMAWpC,CAAC;AAEJ,uFAAuF;AACvF,eAAO,MAAM,YAAY,SAAU,MAAM,8LACuB,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,SAAU,MAAM,OAAO,MAAM,2LAC2B,CAAC;AAEjF,qGAAqG;AACrG,eAAO,MAAM,YAAY,SAAU,MAAM,+zBAItC,CAAC"}

package/dist/openbao/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAUnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAeH,eAAO,MAAM,iBAAiB,oIAiI3B,CAAC"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/openbao/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAUnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1D;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,SAAS,4CAEpB,CAAC;AAYH,eAAO,MAAM,iBAAiB,oIAiI3B,CAAC"}

package/dist/openbao/rename.d.ts

@@ -91,6 +91,11 @@ export declare const judgeMove: (family: string, tried: string | undefined, decl
     from: string;
     to: string;
 } | undefined, import("./bao-status.ts").BaoError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** SDK families supply their own typed read so a rename cannot fall back to raw HTTP. */
+export declare const judgeMoveWith: <E, R>(family: string, tried: string | undefined, declared: string | undefined, occupied: (identity: string) => Effect.Effect<boolean, E, R>, key?: (identity: string) => string) => Effect.Effect<{
+    from: string;
+    to: string;
+} | undefined, E, R>;
 /**
  * Reconcile's guard: an `update` whose prior attributes name another object.
  *

package/dist/openbao/rename.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rename.d.ts","sourceRoot":"","sources":["../../src/openbao/rename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,SAAU,OAAO,OAAO,MAAM,KAAG,OAI1D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,SAAU,OAAO,OAAO,MAAM,YAAY,MAAM,KAAG,MAAM,GAAG,SACH,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SACrB,OAAO,YACH,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,iBAClC,MAAM,KACpB,MAAM,GAAG,SAOX,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAmC,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,WACV,MAAM,YACJ,MAAM,GAAG,SAAS,QACvB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,KAChC,OAAO,GAAG,SAAiF,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,WACZ,MAAM,SACP,MAAM,GAAG,SAAS,YACf,MAAM,GAAG,SAAS,UACpB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,QAC/B,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM;;;wGAgB/B,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,WAAY,MAAM,QAAQ,MAAM,MAAM,MAAM,uCAOvE,CAAC"}
+{"version":3,"file":"rename.d.ts","sourceRoot":"","sources":["../../src/openbao/rename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,OAAO,MAAM,KAAG,MAAM,GAAG,SAIpE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,SAAU,OAAO,OAAO,MAAM,KAAG,OAI1D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,SAAU,OAAO,OAAO,MAAM,YAAY,MAAM,KAAG,MAAM,GAAG,SACH,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SACrB,OAAO,YACH,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,iBAClC,MAAM,KACpB,MAAM,GAAG,SAOX,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAmC,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,WACV,MAAM,YACJ,MAAM,GAAG,SAAS,QACvB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,KAChC,OAAO,GAAG,SAAiF,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,WACZ,MAAM,SACP,MAAM,GAAG,SAAS,YACf,MAAM,GAAG,SAAS,UACpB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,QAC/B,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM;;;wGAQhC,CAAC;AAEJ,yFAAyF;AACzF,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,CAAC,UACxB,MAAM,SACP,MAAM,GAAG,SAAS,YACf,MAAM,GAAG,SAAS,YAClB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,QACvD,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM;;;oBAgB/B,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,WAAY,MAAM,QAAQ,MAAM,MAAM,MAAM,uCAOvE,CAAC"}

package/dist/proxmox/firewall-alias-config.d.ts

@@ -0,0 +1,36 @@
+/** Existing alias normalization and forms, independent of the named SDK transport. */
+import type { FirewallAliasAttributes, FirewallAliasProps } from './firewall-alias.ts';
+import { body } from './firewall-alias-form.ts';
+export declare const firewallAliasSpec: {
+    /** The SDK read refuses malformed successful payloads before applying these normalizers. */
+    attributes: (live: Record<string, unknown>, props: FirewallAliasProps) => {
+        cidr: string;
+        comment: string;
+        ipversion: number;
+        /** The read checks identity; the stored spelling is preserved for display. */
+        name: string;
+    };
+    collection: () => string;
+    createForm: (props: FirewallAliasProps) => {
+        cidr: string;
+        name: string;
+    };
+    /**
+     * ⚠️ EXACTLY THE TWO FIELDS A PUT CAN PUT BACK, both sides through the same normalisers. `name`
+     *   is identity and case-only drift (see the header); `ipversion` is derived and unwritable.
+     *   Comparing either would report an update that no update can settle.
+     */
+    /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */
+    endpoint: {
+        create: string;
+        update: string;
+    };
+    matches: (attributes: FirewallAliasAttributes, props: FirewallAliasProps) => boolean;
+    /**
+     * ⚠️ UNESCAPED ON PURPOSE: `pve-fw-alias` admits only `[A-Za-z][A-Za-z0-9\-\_]+`, so there is no
+     *   character here that a URL would need to encode, and PVE lowercases the segment on arrival.
+     */
+    path: (props: FirewallAliasProps) => string;
+    updateForm: typeof body;
+};
+//# sourceMappingURL=firewall-alias-config.d.ts.map

package/dist/proxmox/firewall-alias-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall-alias-config.d.ts","sourceRoot":"","sources":["../../src/proxmox/firewall-alias-config.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEvF,OAAO,EAAE,IAAI,EAAiB,MAAM,0BAA0B,CAAC;AAG/D,eAAO,MAAM,iBAAiB;IAC5B,4FAA4F;;;;;QAOxF,8EAA8E;;;;;;;;IAMlF;;;;OAIG;IACH,wFAAwF;;QAEtF,MAAM;QACN,MAAM;;;IAIR;;;OAGG;;;CAG2D,CAAC"}

package/dist/proxmox/firewall-alias-form.d.ts

@@ -94,5 +94,7 @@ export declare const comment: (value: unknown) => string;
  *   this form would be a second, invisible identity for the object, set from a field the resource
  *   does not have.
  */
-export declare const body: (props: FirewallAliasProps) => Record<string, string>;
+export declare const body: (props: FirewallAliasProps) => Record<string, string> & {
+    cidr: string;
+};
 //# sourceMappingURL=firewall-alias-form.d.ts.map

package/dist/proxmox/firewall-alias-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-alias-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/firewall-alias-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9D;;;;;;;;GAQG;AACH,eAAO,MAAM,IAAI,SAAU,MAAM,WAA8B,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,UAAW,OAAO,WAIlC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,OAAO,UAAW,OAAO,WAGrC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,IAAI,UAAW,kBAAkB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGrE,CAAC"}
+{"version":3,"file":"firewall-alias-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/firewall-alias-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9D;;;;;;;;GAQG;AACH,eAAO,MAAM,IAAI,SAAU,MAAM,WAA8B,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,UAAW,OAAO,WAIlC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,OAAO,UAAW,OAAO,WAGrC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,IAAI,UAAW,kBAAkB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAGvF,CAAC"}

package/dist/proxmox/firewall-alias-lifecycle.d.ts

@@ -0,0 +1,43 @@
+import type { Input } from 'alchemy/Input';
+import * as cluster from '@distilled.cloud/proxmox/cluster';
+import * as Effect from 'effect/Effect';
+import type { FirewallAliasAttributes, FirewallAliasProps } from './firewall-alias.ts';
+export declare const readFirewallAlias: (props: FirewallAliasProps) => Effect.Effect<{
+    cidr: string;
+    comment: string;
+    ipversion: number;
+    name: string;
+} | undefined, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | cluster.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** Vendor deletion silently removes a missing key. All actual SDK failures still propagate. */
+export declare const deleteFirewallAlias: (props: FirewallAliasProps) => Effect.Effect<cluster.DeleteClusterFirewallAliasResponse, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | cluster.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const firewallAliasHandlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: FirewallAliasProps;
+    }) => Effect.Effect<{
+        cidr: string;
+        comment: string;
+        ipversion: number;
+        name: string;
+    } | undefined, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | cluster.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args_0: {
+        news: Input<FirewallAliasProps>;
+        output: FirewallAliasAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'replace';
+    } | {
+        readonly action: "noop" | "update";
+    } | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args_0: {
+        news: FirewallAliasProps;
+    }) => Effect.Effect<{
+        cidr: string;
+        comment: string;
+        ipversion: number;
+        name: string;
+    }, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds }: {
+        olds: FirewallAliasProps;
+    }) => Effect.Effect<cluster.DeleteClusterFirewallAliasResponse, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | cluster.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+//# sourceMappingURL=firewall-alias-lifecycle.d.ts.map

package/dist/proxmox/firewall-alias-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall-alias-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/firewall-alias-lifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,OAAO,MAAM,kCAAkC,CAAC;AAE5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASvF,eAAO,MAAM,iBAAiB,UAAW,kBAAkB;;;;;oPA0BxD,CAAC;AAEJ,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB,UAAW,kBAAkB,oSACsC,CAAC;AAEpG,eAAO,MAAM,qBAAqB;IAChC,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE;;;;;;IAC7C,IAAI;cAII,KAAK,CAAC,kBAAkB,CAAC;gBACvB,uBAAuB,GAAG,SAAS;;yBAOiB,SAAS;;;;IAQvE,SAAS;cAAyC,kBAAkB;;;;;;;IA4BpE,MAAM,aAAa;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE;CAChD,CAAC"}

package/dist/proxmox/firewall-alias.d.ts

@@ -94,7 +94,7 @@
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 export interface FirewallAliasProps extends WithTarget {
     /**
      * PVE's `pve-fw-alias`: a letter, then at least one more of letter/digit/`-`/`_`, to 64 chars.
@@ -130,12 +130,6 @@ export interface FirewallAliasAttributes {
 export interface ProxmoxFirewallAlias extends Resource<'Proxmox.FirewallAlias', FirewallAliasProps, FirewallAliasAttributes, never, PveRequirements> {
 }
 export declare const ProxmoxFirewallAlias: import("alchemy").ResourceClass<ProxmoxFirewallAlias>;
-/**
- * ⛔ ONE HANDLER IS OVERRIDDEN AND THE REST COME FROM THE FACTORY, for the reason `acl.ts` spells
- *   out at length: the factory answers `replace` only for an object with no update path, and this
- *   one has a PUT. Left to delegate, a changed `name` would read absent at the new path, plan as an
- *   update, and quietly leave the old alias behind. Everything else — the empty `list`, the read,
- *   the read-back-guarded reconcile, the delete — is the factory's, unchanged.
- */
+/** Named distilled operations preserve create-first identity replacement and explicit adoption. */
 export declare const ProxmoxFirewallAliasProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxFirewallAlias>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=firewall-alias.d.ts.map

package/dist/proxmox/firewall-alias.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-alias.d.ts","sourceRoot":"","sources":["../../src/proxmox/firewall-alias.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAqB,SAAQ,QAAQ,CACpD,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,oBAAoB,uDAA0D,CAAC;AA4C5F;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,0IAiBtC,CAAC"}
+{"version":3,"file":"firewall-alias.d.ts","sourceRoot":"","sources":["../../src/proxmox/firewall-alias.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGtE,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAqB,SAAQ,QAAQ,CACpD,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,oBAAoB,uDAA0D,CAAC;AAE5F,mGAAmG;AACnG,eAAO,MAAM,4BAA4B,0IAItC,CAAC"}