rework sambrs as an opinionated Windows SMB client

.github/workflows/ci.yml

@@ -0,0 +1,69 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  test:
+    name: Integration tests (Windows, real SMB share)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # 2026-07
+        with:
+          toolchain: stable
+
+      - name: Provision a local user and SMB share
+        shell: pwsh
+        run: |
+          $password = ConvertTo-SecureString 'Sambrs-CI-Pass-1!' -AsPlainText -Force
+          New-LocalUser -Name 'smbtest' -Password $password -PasswordNeverExpires | Out-Null
+          New-Item -ItemType Directory -Path 'C:\sambrs-share' | Out-Null
+          New-SmbShare -Name 'sambrs-test' -Path 'C:\sambrs-share' -FullAccess 'smbtest' | Out-Null
+          icacls 'C:\sambrs-share' /grant 'smbtest:(OI)(CI)F' | Out-Null
+          "SAMBRS_TEST_USERNAME=$env:COMPUTERNAME\smbtest" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+
+      - name: Unit + integration tests
+        run: cargo test -- --include-ignored --test-threads=1
+        env:
+          SAMBRS_TEST_SHARE: \\localhost\sambrs-test
+          SAMBRS_TEST_PASSWORD: Sambrs-CI-Pass-1!
+
+  msrv:
+    name: MSRV check (Rust 1.85, Windows target)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # 2026-07
+        with:
+          toolchain: '1.85'
+          targets: x86_64-pc-windows-msvc
+
+      - name: crate (incl. tests) compiles on the declared MSRV
+        run: cargo check --target x86_64-pc-windows-msvc --all-targets
+
+  lint:
+    name: Lint and docs (Windows target)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # 2026-07
+        with:
+          toolchain: stable
+          targets: x86_64-pc-windows-msvc
+
+      - name: rustfmt
+        run: cargo fmt --check
+
+      - name: clippy (pedantic is enforced in the crate root)
+        run: cargo clippy --target x86_64-pc-windows-msvc --all-targets -- -D warnings
+
+      - name: rustdoc
+        run: cargo doc --target x86_64-pc-windows-msvc --no-deps
+        env:
+          RUSTDOCFLAGS: -D warnings

AGENTS.md

@@ -0,0 +1,9 @@
+## Agent skills
+
+### Issue tracker
+
+Issues and PRDs are tracked in GitHub Issues. See `docs/agents/issue-tracker.md`.
+
+### Domain docs
+
+This is a single-context repository. See `docs/agents/domain.md`.

CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog
+
+## 0.2.0 (unreleased)
+
+A breaking rework into a safe, opinionated Windows client for existing SMB
+disk shares.
+
+### Added
+
+- `SmbTarget` connections using the logged-on identity, paired credentials, or
+  partial username/password credentials.
+- Deviceless, explicit-drive, and automatically assigned connections.
+- Persistent drive mappings and explicit `force`/`forget` disconnect options.
+- `ConnectOptions::require_integrity` for SMB signing and
+  `require_privacy` for SMB encryption.
+- RAII `Connection` guards for temporary drive mappings, with explicit
+  disconnection.
+- Focused queries for mapped-drive targets, connection users, and universal
+  UNC paths.
+- Disk-focused enumeration of active connections, remembered mappings, and a
+  server's existing shares.
+- Provider-specific extended errors from `WNetGetLastErrorW`.
+- Unconditional detailed `tracing` events. Usernames and targets are logged;
+  passwords never are.
+- Unconditional zeroization of stored and transient UTF-16 password buffers.
+
+### Changed
+
+- All Windows calls use Unicode (`W`) APIs.
+- Windows statuses are preserved as `Error::Windows(code)` while
+  crate-originated validation and provider-specific errors remain typed.
+- Persistence requires a drive mapping; guarded connections cannot persist;
+  forgetting requires a drive mapping. Invalid combinations fail before a
+  Windows call.
+- Deviceless connections are kept out of Windows' recent-connections list.
+- Dependencies and API are Windows-only; cross-platform consumers must gate
+  the dependency and usage with `cfg(windows)`.
+- `windows-sys` 0.52 → 0.60; MSRV is Rust 1.85.
+
+### Removed
+
+- Server administration and share creation.
+- Printer resources, arbitrary local devices, and custom provider selection.
+- Raw WNet enumeration and metadata.
+- Interactive authentication, connection-wide write-through, and other raw
+  `CONNECT_*` controls outside persistence, signing, and encryption.
+- `Error::raw_os_error` and conversion into `std::io::Error`.
+
+## 0.1.2
+
+- Description and examples; edition 2024; initial `WNetAddConnection2A` /
+  `WNetCancelConnection2A` wrapper with typed errors.

CONTEXT.md

@@ -0,0 +1,29 @@
+# Existing SMB Resource Access
+
+This context describes client-side access to existing SMB shares: authenticating, mapping drives, remembering mappings, and inspecting available or active resources.
+
+## Language
+
+**SMB target**:
+A reusable description of an existing remote SMB resource, its credentials, and an optional desired drive letter. It exists independently of whether access is active.
+_Avoid_: New share, connection
+
+**Deviceless connection**:
+Active authenticated access to an SMB target through its UNC path, without assigning a local drive letter.
+_Avoid_: Drive mapping
+
+**Drive mapping**:
+An active association between a Windows drive letter and an SMB target. It may be temporary or remembered.
+_Avoid_: Share, deviceless connection
+
+**Remembered mapping**:
+A drive mapping recorded in the Windows user profile so Windows can restore it at logon.
+_Avoid_: Active connection, recent connection
+
+**Connection**:
+An owned temporary drive mapping whose lifetime controls when the mapping is disconnected.
+_Avoid_: SMB target, remembered mapping
+
+**Server share**:
+An existing disk resource exposed by an SMB server for clients to inspect or access.
+_Avoid_: Local directory, newly created share