@homeflare/alchemy 0.37.8 → 0.39.0

package/src/caddy/admin.ts

@@ -10,12 +10,25 @@
  *   caddyconfig/load.go and admin.go, and in the API docs (caddyserver.com/docs/api).
  * ★ `CaddyAdminService` CARRIES ONLY MESSAGE/GUARD METADATA (endpoint, listener) — never a
  *   credential, and never the transport itself. The transport is `@distilled.cloud/caddy`'s own
- *   `Credentials` and `HttpClient.HttpClient` services, provided alongside it by `caddyAdminLayer`,
- *   so admin-calls.ts calls the SDK's operations directly rather than through a house-specific
- *   `.request()` seam. A consumer plugs in another route to the API (an SSH-forwarded socket today;
- *   a remote runner later) by providing a different `CaddyTransport` to `caddyAdminLayer`.
+ *   `Credentials` and `HttpClient.HttpClient` services — admin-calls.ts calls the SDK's operations
+ *   directly rather than through a house-specific `.request()` seam. A consumer plugs in another
+ *   route to the API (an SSH-forwarded socket today; a remote runner later) by providing a different
+ *   `CaddyTransport` to `caddyAdminLayer`.
  * ⛔ THE ADMIN API HAS NO AUTHENTICATION. Anyone who reaches it can replace every site. It stays on
  *   loopback or a unix socket; localCaddyAdmin() refuses anything else (local-admin.ts).
+ * ⛔ `caddyAdminLayer`'s OWN OUTPUT NEVER CARRIES `Credentials`/`HttpClient.HttpClient` DIRECTLY —
+ *   MEASURED 2026-09-26: it used to (`Layer.mergeAll(CaddyAdminService-layer, transport.layer)`,
+ *   what `caddyProviders()` then `provideMerge`d into a stack), and a stack that applies its own
+ *   ambient client OUTSIDE the providers' merge — `Layer.mergeAll(providers…).pipe(Layer.provide
+ *   (ambient))`, the shape `argocd`/`discord`/`opnsense`/`unifi`'s own `providers.ts` document —
+ *   never got it back: `Layer.provide(A, B)`'s result outputs only `A`'s own services, so once `A`
+ *   (the merged providers) already carries `HttpClient.HttpClient` from Caddy, no outer `B` overrides
+ *   it. Every OTHER fetch-based provider merged alongside `caddyProviders()` (homeflare-mini's
+ *   Forgejo, LiteLLM) then dialled Caddy's admin API instead of its own target — reproduced in
+ *   admin-transport-scope.test.ts. `caddyAdminLayer` now stores `transport.layer` itself as a plain
+ *   VALUE, under `CaddyAdminTransport` — a house-only tag nothing outside caddy/ ever reads — and
+ *   config.ts is the one place that `Effect.provide`s it, scoped to exactly the effects that call
+ *   `@distilled.cloud/caddy`'s operations.
  */
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
 import * as Context from 'effect/Context';
@@ -43,7 +56,16 @@ export interface CaddyTarget {
 
 /** What `localCaddyAdmin()` (or a consumer's own transport) hands `caddyAdminLayer`. */
 export interface CaddyTransport extends CaddyTarget {
-  /** Provides the SDK's own `Credentials` and `HttpClient.HttpClient` — see local-admin.ts. */
+  /**
+   * Provides the SDK's own `Credentials` and `HttpClient.HttpClient` — see local-admin.ts.
+   * ⚠️ BUILT AND TORN DOWN ON EVERY `read`/`diff`/`reconcile` CALL — config.ts's `Effect.provide
+   *   (transportLayer)` runs fresh each time, scoped to that one call (the scoping fix this file's
+   *   own ⛔ documents). `localCaddyAdmin()`'s layer is three plain `Layer.succeed` values, so this
+   *   costs nothing; a transport that opens something stateful (an SSH forward, a connection pool)
+   *   would open and close it per call instead of once per stack. No such transport exists in the
+   *   tray today (2026-09-26) — keep `layer` cheap and stateless, or build once and hand config.ts a
+   *   pre-built `Context` instead, if that changes.
+   */
   readonly layer: Layer.Layer<Credentials | HttpClient.HttpClient>;
 }
 
@@ -52,19 +74,33 @@ export class CaddyAdminService extends Context.Service<CaddyAdminService, CaddyT
   'homeflare/caddy/CaddyAdmin',
 ) {}
 
+/**
+ * `transport.layer` ITSELF, carried as a plain value rather than merged into the ambient context —
+ * the scoping fix (see the file header's ⛔). Only config.ts reads this tag, and only to
+ * `Effect.provide` it locally around the handful of effects that actually call
+ * `@distilled.cloud/caddy`'s operations; nothing else in this directory, and nothing outside it,
+ * has a reason to.
+ */
+export class CaddyAdminTransport extends Context.Service<
+  CaddyAdminTransport,
+  Layer.Layer<Credentials | HttpClient.HttpClient>
+>()('homeflare/caddy/CaddyAdminTransport') {}
+
 /**
  * Provide a transport to the provider: `CaddyConfigProvider().pipe(Layer.provideMerge(caddyAdminLayer(localCaddyAdmin())))`
  * — never plain `Layer.provide` here (see providers.ts's own ⚠️): `CaddyConfigProvider()`'s handlers
- * keep needing these services every time the engine calls them, not just once while it is built. Merges
- * the target metadata with the SDK's `Credentials`/`HttpClient` layers `transport.layer` carries.
+ * keep needing `CaddyAdminService`/`CaddyAdminTransport` every time the engine calls them, not just
+ * once while it is built. Neither tag is a generic platform service, so merging them into a stack's
+ * ambient context (unlike the raw `Credentials`/`HttpClient.HttpClient` this used to carry — the
+ * file header's ⛔) is safe: nothing outside this directory looks either up.
  */
 export const caddyAdminLayer = (
   transport: CaddyTransport,
-): Layer.Layer<CaddyAdminService | Credentials | HttpClient.HttpClient> =>
+): Layer.Layer<CaddyAdminService | CaddyAdminTransport> =>
   Layer.mergeAll(
     Layer.succeed(CaddyAdminService, {
       endpoint: transport.endpoint,
       listener: transport.listener,
     }),
-    transport.layer,
+    Layer.succeed(CaddyAdminTransport, transport.layer),
   );

package/src/caddy/config-adopt-provider.test.ts

@@ -9,7 +9,6 @@ import { AdoptPolicy, Unowned } from 'alchemy/AdoptPolicy';
 import { AlchemyContext } from 'alchemy/AlchemyContext';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import type * as Caddy from '@distilled.cloud/caddy';
 import { type CaddyAdminService, type CaddyTransport, caddyAdminLayer } from './admin.ts';
 import { CaddyConfig, CaddyConfigProvider } from './config.ts';
 import { configDigest } from './digest.ts';
@@ -40,9 +39,10 @@ type Deploy = { readonly adopt?: boolean; readonly contextAdopt?: boolean };
 const withProvider = <A>(
   admin: CaddyTransport,
   deploy: Deploy,
+  // ★ `CaddyAdminService` ONLY — see providers.test.ts's own `withProvider` for why.
   use: (
     p: Effect.Success<typeof CaddyConfig.Provider>,
-  ) => Effect.Effect<A, unknown, CaddyAdminService | Caddy.CaddyOpContext>,
+  ) => Effect.Effect<A, unknown, CaddyAdminService>,
 ) => {
   // ⚠️ `Layer.provideMerge`, not `Layer.provide` — providers.ts's own doc on `caddyAdminLayer` says
   //   why: `CaddyConfigProvider()`'s handlers still need these services every time they run, not

package/src/caddy/config-format-warning.test.ts

@@ -13,7 +13,7 @@ import { AdoptPolicy } from 'alchemy/AdoptPolicy';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
 import * as Logger from 'effect/Logger';
-import { caddyAdminLayer } from './admin.ts';
+import { type CaddyTransport, caddyAdminLayer } from './admin.ts';
 import { CaddyConfig, CaddyConfigProvider } from './config.ts';
 import { diffConfig } from './config-reconcile.ts';
 import { type FakeCaddy, fakeDefaultCaddy } from './fake-caddy.ts';
@@ -34,6 +34,12 @@ const setup = () => {
   return made;
 };
 
+/** `diffConfig` still needs the raw `Credentials`/`HttpClient` directly — `caddyAdminLayer` alone
+ * (admin.ts's own scoping fix) only carries `CaddyAdminService`/`CaddyAdminTransport`; merge
+ * `admin.layer` in too, the same fix `fake-caddy.ts`'s `runCaddy` makes for this exact shape. */
+const withTransport = (admin: CaddyTransport) =>
+  Layer.mergeAll(caddyAdminLayer(admin), admin.layer);
+
 /** Runs `effect` and returns its result plus every `Effect.logWarning` line it emitted. */
 const withWarnings = async <A>(effect: Effect.Effect<A, unknown, never>) => {
   const warnings: string[] = [];
@@ -49,7 +55,7 @@ describe('the formatting warning is surfaced distinctly', () => {
     const { admin } = setup();
     const output = { configSha256: 'stub', endpoint: admin.endpoint };
     const { value, warnings } = await withWarnings(
-      diffConfig({ caddyfile: UNFORMATTED }, output).pipe(Effect.provide(caddyAdminLayer(admin))),
+      diffConfig({ caddyfile: UNFORMATTED }, output).pipe(Effect.provide(withTransport(admin))),
     );
     expect(value).toEqual({ action: 'update' });
     expect(warnings).toHaveLength(1);
@@ -61,7 +67,7 @@ describe('the formatting warning is surfaced distinctly', () => {
     const { admin } = setup();
     const output = { configSha256: 'stub', endpoint: admin.endpoint };
     const { warnings } = await withWarnings(
-      diffConfig({ caddyfile: SITE }, output).pipe(Effect.provide(caddyAdminLayer(admin))),
+      diffConfig({ caddyfile: SITE }, output).pipe(Effect.provide(withTransport(admin))),
     );
     expect(warnings).toEqual([]);
   });

package/src/caddy/config.ts

@@ -21,7 +21,13 @@
  *   engine skips that probe, reconcile refuses the same takeover (config-lifecycle.ts).
  * ⛔ `caddyfile` IS NEVER A SECRET — see config-form.ts; refused before anything is sent.
  * ⚠️ WHICH CADDY is the transport's (providers.ts): `CaddyAdminService` plus the `Credentials`/
- *   `HttpClient` layers `caddyAdminLayer` merges — one per stack, not a prop.
+ *   `HttpClient` layer `CaddyAdminTransport` carries — one per stack, not a prop.
+ * ⚠️ `transportLayer` IS `Effect.provide`D LOCALLY IN EACH HANDLER BELOW, NEVER MERGED AHEAD OF
+ *   TIME. `caddyAdminLayer` (admin.ts) stores it under `CaddyAdminTransport` rather than merging its
+ *   `Credentials`/`HttpClient.HttpClient` into the ambient context precisely so this file is the ONE
+ *   place that discharges them — scoped to the handful of effects that actually call
+ *   `@distilled.cloud/caddy`'s operations, never leaking into a sibling fetch-based provider merged
+ *   into the same stack (admin.ts's own ⛔; MEASURED 2026-09-26, admin-transport-scope.test.ts).
  */
 import { Resource } from 'alchemy';
 import { Unowned } from 'alchemy/AdoptPolicy';
@@ -30,7 +36,7 @@ import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import { resolvedString } from '../launchd/host-effect.ts';
 import { adoptEnabled } from '../ownership/adopt.ts';
-import { CaddyAdminService } from './admin.ts';
+import { CaddyAdminService, CaddyAdminTransport } from './admin.ts';
 import { isUnreachable } from './caddy-http-client.ts';
 import type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';
 import { probeLive, readLive } from './config-lifecycle.ts';
@@ -72,6 +78,7 @@ export const CaddyConfigProvider = () =>
     CaddyConfig,
     Effect.gen(function* () {
       const admin = yield* CaddyAdminService;
+      const transportLayer = yield* CaddyAdminTransport;
       /** The probe, branded for the engine: plain when ours, `Unowned` otherwise. */
       const probe = (caddyfile: string | undefined, sourceFile: string | undefined) =>
         Effect.flatMap(probeLive(caddyfile, sourceFile), (found) => {
@@ -104,6 +111,9 @@ export const CaddyConfigProvider = () =>
               ? yield* probe(resolvedString(olds, 'caddyfile'), resolvedString(olds, 'sourceFile'))
               : yield* readLive(resolvedString(olds, 'sourceFile'));
           }).pipe(
+            // ★ Scoped to Caddy's own transport — see the file header's ⚠️ — before the catch below,
+            //   so `isUnreachable` still narrows the SAME raw error this always raised.
+            Effect.provide(transportLayer),
             // ★ Nothing to adopt from a Caddy that is down: plan a create, which is the same load.
             Effect.catchIf(isUnreachable, planWithoutCaddy(admin, undefined)),
           ),
@@ -112,7 +122,10 @@ export const CaddyConfigProvider = () =>
           if (output === undefined) return Effect.succeed(undefined);
           const update = planWithoutCaddy(admin, { action: 'update' as const });
           if (isResolved(news)) {
-            return diffConfig(news, output).pipe(Effect.catchIf(isUnreachable, update));
+            return diffConfig(news, output).pipe(
+              Effect.provide(transportLayer),
+              Effect.catchIf(isUnreachable, update),
+            );
           }
           /**
            * ⚠️ `sourceFile` is an Output while its HostFile changes in the same deploy
@@ -123,6 +136,7 @@ export const CaddyConfigProvider = () =>
           const caddyfile = resolvedString(news, 'caddyfile');
           if (caddyfile === undefined) return Effect.succeed(undefined);
           return Effect.as(diffConfig({ caddyfile }, output), { action: 'update' as const }).pipe(
+            Effect.provide(transportLayer),
             Effect.catchIf(isUnreachable, update),
           );
         },
@@ -136,7 +150,9 @@ export const CaddyConfigProvider = () =>
             const sameCaddy = output !== undefined && output.endpoint === admin.endpoint;
             const takeOver = sameCaddy || (yield* adoptEnabled(fqn));
             const stored = output === undefined ? {} : { stored: output.configSha256 };
-            const applied = yield* reconcileConfig(news, { takeOver, ...stored });
+            const applied = yield* reconcileConfig(news, { takeOver, ...stored }).pipe(
+              Effect.provide(transportLayer),
+            );
             // ★ THE FORMATTING WARNING GETS ITS OWN LINE, NAMING THE FIX — separate from the rest,
             //   which keep logging exactly as before (format-warnings.ts).
             const { formatting, rest } = splitFormattingWarning(applied.warnings);

package/src/caddy/fake-caddy.ts

@@ -18,6 +18,7 @@
  *   fake really listens on an ephemeral one: a Caddy on its default :2019 behind a forward.
  */
 import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
 import type * as Caddy from '@distilled.cloud/caddy';
 import { type CaddyAdminService, type CaddyTransport, caddyAdminLayer } from './admin.ts';
 import { localCaddyAdmin } from './local-admin.ts';
@@ -190,8 +191,16 @@ export const fakeDefaultCaddy = (
  * Runs an Effect that needs `CaddyAdminService` and `@distilled.cloud/caddy`'s own `Credentials`/
  * `HttpClient` against one transport — the one line every test in this directory used to spend on
  * `Effect.provide(caddyAdminLayer(admin))` before this helper existed.
+ * ⚠️ TWO LAYERS, NOT ONE: `caddyAdminLayer(admin)` only carries `CaddyAdminService` and the
+ *   `CaddyAdminTransport`-wrapped VALUE of `admin.layer` (admin.ts's own scoping fix) — the
+ *   lifecycle functions this helper drives (`probeLive`, `reconcileConfig`, …) still need the raw
+ *   `Credentials`/`HttpClient.HttpClient` directly in context, so `admin.layer` is provided again,
+ *   built this time, alongside it.
  */
 export const runCaddy = <A, E>(
   effect: Effect.Effect<A, E, CaddyAdminService | Caddy.CaddyOpContext>,
   admin: CaddyTransport,
-): Promise<A> => Effect.runPromise(effect.pipe(Effect.provide(caddyAdminLayer(admin))));
+): Promise<A> =>
+  Effect.runPromise(
+    effect.pipe(Effect.provide(Layer.mergeAll(caddyAdminLayer(admin), admin.layer))),
+  );

package/src/caddy/providers.test.ts

@@ -7,7 +7,6 @@ import * as Output from 'alchemy/Output';
 import { Stack } from 'alchemy/Stack';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import type * as Caddy from '@distilled.cloud/caddy';
 import { type CaddyAdminService, caddyAdminLayer } from './admin.ts';
 import { CaddyConfig, CaddyConfigProvider } from './config.ts';
 import { type FakeCaddy, fakeCaddy } from './fake-caddy.ts';
@@ -31,9 +30,11 @@ const handler = <F>(name: string, fn: F | undefined): F => {
 };
 
 const withProvider = <A>(
+  // ★ `CaddyAdminService` ONLY — `read`/`diff`/`reconcile` no longer need the admin transport from
+  //   OUTSIDE post-fix: config.ts's handlers `Effect.provide` it locally now (admin.ts's own ⛔).
   use: (
     p: Effect.Success<typeof CaddyConfig.Provider>,
-  ) => Effect.Effect<A, unknown, CaddyAdminService | Caddy.CaddyOpContext>,
+  ) => Effect.Effect<A, unknown, CaddyAdminService>,
   address?: string,
 ) => {
   // ★ A Caddy on its default :2019 behind a forward, as in config-lifecycle.test.ts.

package/src/caddy/providers.ts

@@ -12,17 +12,24 @@
  *   and `HttpClient.HttpClient`.
  *
  * ⚠️ `Layer.provideMerge`, NEVER PLAIN `Layer.provide`, for `caddyAdminLayer`. `CaddyConfigProvider()`'s
- *   `read`/`diff`/`reconcile` handlers each still need `CaddyAdminService` and
- *   `@distilled.cloud/caddy`'s `Credentials`/`HttpClient` — Alchemy's own `Provider.effect` types
- *   those as part of the LAYER's overall requirement (`ProviderService`'s per-handler `Req` type
- *   parameters, `alchemy/Provider.ts`), for exactly this reason. Plain `Layer.provide` SEALS a
- *   layer — it satisfies `CaddyConfigProvider()`'s requirement only for BUILDING the `Provider`
- *   value (the `admin` in its outer `Effect.gen`), then hides those services from anything that
- *   runs LATER, when the returned `read`/`diff`/`reconcile` FUNCTIONS actually execute. MEASURED
- *   2026-09-23: with plain `Layer.provide`, `caddyProviders()`'s own `reconcile` handler dies with
- *   "Service not found: homeflare/caddy/CaddyAdmin" the moment the ENGINE calls it. `provideMerge`
- *   feeds `caddyAdminLayer`'s output into `CaddyConfigProvider()`'s requirement AND keeps that same
- *   output live in the result, so every later handler call still runs with it in context.
+ *   `read`/`diff`/`reconcile` handlers each still need `CaddyAdminService` and `CaddyAdminTransport`
+ *   — Alchemy's own `Provider.effect` types those as part of the LAYER's overall requirement
+ *   (`ProviderService`'s per-handler `Req` type parameters, `alchemy/Provider.ts`), for exactly this
+ *   reason. Plain `Layer.provide` SEALS a layer — it satisfies `CaddyConfigProvider()`'s requirement
+ *   only for BUILDING the `Provider` value (the `admin`/`transportLayer` in its outer `Effect.gen`),
+ *   then hides those services from anything that runs LATER, when the returned `read`/`diff`/
+ *   `reconcile` FUNCTIONS actually execute. MEASURED 2026-09-23: with plain `Layer.provide`,
+ *   `caddyProviders()`'s own `reconcile` handler dies with "Service not found: homeflare/caddy/
+ *   CaddyAdmin" the moment the ENGINE calls it. `provideMerge` feeds `caddyAdminLayer`'s output into
+ *   `CaddyConfigProvider()`'s requirement AND keeps that same output live in the result, so every
+ *   later handler call still runs with it in context.
+ * ⛔ THIS `caddyProviders()` LAYER NEVER CARRIES `Credentials`/`HttpClient.HttpClient` ITSELF (fixed
+ *   2026-09-26 — admin.ts's own ⛔ has the mechanism and the measured leak). `caddyAdminLayer`'s
+ *   output is `CaddyAdminService | CaddyAdminTransport`, both house-only tags safe to `provideMerge`
+ *   into any host stack; the SDK's own `Credentials`/`HttpClient.HttpClient` stay inside
+ *   `CaddyAdminTransport`'s stored value, `Effect.provide`d locally by config.ts around exactly the
+ *   effects that need them. A stack merging `caddyProviders()` with any other fetch-based provider
+ *   (`forgejoProviders()`, `litellmProviders()`, …) is safe from this file's own composition alone.
  */
 import * as Layer from 'effect/Layer';
 import { type CaddyTransport, caddyAdminLayer } from './admin.ts';

package/src/forgejo/team-member.test.ts

@@ -4,6 +4,7 @@
  * alongside the SDK's own `NotFound`. Proves the two stay distinct: only the SDK's tag folds.
  */
 import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
 import * as organization from '@distilled.cloud/forgejo/organization';
 import * as Effect from 'effect/Effect';
 import { fakeFailure, fakeForgejo, fakeForgejoLayer } from './fake-forgejo.ts';
@@ -95,3 +96,16 @@ describe('Forgejo.TeamMember spec — the actual exported production functions',
     expect(await readThrough(fake.fetch)).toBeUndefined();
   });
 });
+
+test('ForgejoTeamMember declares defaultRemovalPolicy: retain on the Resource() call itself', () => {
+  // ⛔ Anchored on the `Resource<ForgejoTeamMember>(...)` CALL, not on the substring appearing
+  //   anywhere in the file — team-member.ts's own header comment also says the phrase in prose, so
+  //   a plain `source.toContain(...)` (database-refusals.test.ts's simpler version, safe there
+  //   because database.ts's header never repeats the phrase) would pass here even if the option
+  //   were dropped from the actual call. mini PR 82's red team (970e8be) had to pipe
+  //   `RemovalPolicy.retain()` onto every call site because the kit resource had no default; this
+  //   proves the kit default carries the fix so a caller no longer has to remember its own.
+  const source = readFileSync(new URL('./team-member.ts', import.meta.url), 'utf8');
+  const call = source.match(/Resource<ForgejoTeamMember>\([\s\S]*?\);/);
+  expect(call?.[0]).toContain("defaultRemovalPolicy: 'retain'");
+});

package/src/forgejo/team-member.ts

@@ -22,6 +22,31 @@
  *   cannot create a team.
  *
  * ⛔ TOKEN NEEDS `write:organization` TO ADD OR REMOVE, and an identity allowed to manage the team.
+ *
+ * ⛔ `defaultRemovalPolicy: 'retain'` — FOUND 2026-09-25 by reading the source, not by measuring
+ *   anything (mini PR 82's red team, `homeflare-mini` 970e8be): before this, `ForgejoRepository`/
+ *   `ForgejoOrgLabel` defaulted to retain in the kit itself but this family did not, so alchemy's
+ *   own engine fallback (`destroy`) applied to it — every caller had to remember its own
+ *   `.pipe(RemovalPolicy.retain())`, the way mini's `src/forgejo/declare.ts` did for
+ *   `forgejo-provision`'s row. Dropping a `TeamMember` declaration — toggling a feature gate off,
+ *   renaming the resource id — must not silently call `organization.orgRemoveTeamMember` and
+ *   revoke a real membership; that is the same "removal from the stack is not removal from
+ *   Forgejo" posture `ForgejoOrgLabel` and `ForgejoBranchProtection` already take, this family
+ *   exists to attach a stack's identity to a team it never creates or destroys (`teamIdOf` below
+ *   only ever locates the team, never manages it), and the same trade-off alchemy's own
+ *   `GitHub.Collaborator` and `GitHub.TeamAccess` make for the identical reason — "preventing
+ *   accidental lockout" (`GitHub/Collaborator.ts:127`, `GitHub/TeamAccess.ts:145` in the pinned
+ *   alchemy source). The trade-off, stated plainly: removing a declaration no longer revokes
+ *   access on its own — the plan shows that row as `orphaned`, not `delete`. Opt into a real
+ *   revoke with `.pipe(RemovalPolicy.destroy())`; `destroy` below is fully implemented.
+ *
+ * ⚠️ THE DEFAULT ONLY PROTECTS A ROW ALREADY IN STATE ONCE THIS RELEASE IS DEPLOYED. Alchemy's
+ *   plan reads `removalPolicy` off the *persisted row* (`Plan.ts`'s delete-node builder), not off
+ *   this default; the default only reaches an existing row's state on a deploy where the resource
+ *   plans as a no-op (`Apply.ts`'s noop path rewrites it and logs "removal policy destroy →
+ *   retain"). A consumer that bumps to this release and drops a `TeamMember` declaration in the
+ *   SAME deploy still gets `delete`, not `orphaned` — see the changeset for the two-deploy shape
+ *   this implies for both adopting retain and opting back into destroy.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
@@ -52,7 +77,9 @@ export interface ForgejoTeamMember extends Resource<
   ForgejoRequirements
 > {}
 
-export const ForgejoTeamMember = Resource<ForgejoTeamMember>('Forgejo.TeamMember');
+export const ForgejoTeamMember = Resource<ForgejoTeamMember>('Forgejo.TeamMember', {
+  defaultRemovalPolicy: 'retain',
+});
 
 export class ForgejoTeamNotFoundError extends Data.TaggedError('ForgejoTeamNotFoundError')<{
   readonly message: string;

package/src/proxmox/constraints-required.test.ts

@@ -80,6 +80,7 @@ describe('every create this package makes, and what the vendor requires of it',
       'pve:POST /nodes/{node}/lxc': ['ostemplate', 'vmid'],
       'pve:POST /nodes/{node}/network': ['iface', 'type'],
       'pve:POST /nodes/{node}/qemu': ['vmid'],
+      'pve:POST /nodes/{node}/storage/{storage}/download-url': ['content', 'filename', 'url'],
       'pve:POST /pools': ['poolid'],
       'pve:POST /storage': ['storage', 'type'],
     });

package/src/proxmox/generated/constraints/index.ts

@@ -22,6 +22,7 @@ import { PVE_NODES_DISKS_CONSTRAINTS } from './pve-nodes-disks.ts';
 import { PVE_NODES_LXC_CONSTRAINTS } from './pve-nodes-lxc.ts';
 import { PVE_NODES_NETWORK_CONSTRAINTS } from './pve-nodes-network.ts';
 import { PVE_NODES_QEMU_CONSTRAINTS } from './pve-nodes-qemu.ts';
+import { PVE_NODES_STORAGE_CONSTRAINTS } from './pve-nodes-storage.ts';
 import { PVE_POOLS_CONSTRAINTS } from './pve-pools.ts';
 import { PVE_STORAGE_CONSTRAINTS } from './pve-storage.ts';
 import { PBS_CONFIG_CONSTRAINTS } from './pbs-config.ts';
@@ -41,6 +42,7 @@ export const PROXMOX_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>>
   ...PVE_NODES_LXC_CONSTRAINTS,
   ...PVE_NODES_NETWORK_CONSTRAINTS,
   ...PVE_NODES_QEMU_CONSTRAINTS,
+  ...PVE_NODES_STORAGE_CONSTRAINTS,
   ...PVE_POOLS_CONSTRAINTS,
   ...PVE_STORAGE_CONSTRAINTS,
   ...PBS_CONFIG_CONSTRAINTS,
@@ -52,4 +54,4 @@ export const PROXMOX_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>>
  * ★ A DIGEST OF THE DATA, NOT OF THE FILE TEXT, so reformatting is not a stale generation while
  *   changing a 128 to a 129 by hand is. `tests/schema-manifest.test.ts` recomputes it.
  */
-export const PROXMOX_CONSTRAINTS_DIGEST = '56eba80750ddb1d2';
+export const PROXMOX_CONSTRAINTS_DIGEST = '8b6745a471839974';

package/src/proxmox/generated/constraints/pve-access.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-backup.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-ceph.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-firewall.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-ha.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-metrics.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-notifications.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-replication.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-sdn.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-ceph.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-disks.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-lxc.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-network.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-qemu.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-storage.ts

@@ -0,0 +1,30 @@
+/**
+ * Generated pve-manager parameter constraints for `/nodes/{node}/storage` — DO NOT EDIT BY HAND.
+ *
+ * Run: bun codegen/constraints.ts
+ * Manifest entry: `pve-apidoc` — pve-manager 9.2.11/f6997e698c7933ea
+ *   sha256 9def8f13611184ee, read on a PVE cluster node from
+ *   /usr/share/pve-docs/api-viewer/apidoc.js
+ *
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
+ * and therefore unchecked at plan time.
+ *
+ * ⚠️ A `patternSource` with no `pattern` beside it is a rule that could NOT be carried into a
+ *   JavaScript RegExp faithfully (codegen/pattern.ts). It is recorded and NOT enforced.
+ * ⚠️ `pattern` IS NOT THE VENDOR'S SPELLING. For PVE it is anchored, because PVE applies
+ *   `m/^$pattern$/` itself (JSONSchema.pm); for PBS it is the vendor's own, which already
+ *   carries its anchors. `patternSource` is the spelling to quote at a human — param-rules.ts.
+ * ⚠️ `each: true` means the value rules describe every ELEMENT of a repeated key, because the
+ *   parameter is an array and stated its limits on `items`.
+ */
+import type { EndpointConstraints } from '../../constraints.ts';
+
+export const PVE_NODES_STORAGE_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>> = {
+  "pve:POST /nodes/{node}/storage/{storage}/download-url": {
+    "checksum-algorithm": {"enum":["md5","sha1","sha224","sha256","sha384","sha512"],"type":"string"},
+    "content": {"enum":["iso","vztmpl","import"],"format":"pve-storage-content","required":true,"type":"string"},
+    "filename": {"maxLength":255,"required":true,"type":"string"},
+    "url": {"pattern":"^https?://.*\\n?$","patternSource":"https?://.*","required":true,"type":"string"},
+  },
+};

package/src/proxmox/generated/constraints/pve-pools.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-storage.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 58 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *