@celilo/cli 0.5.0-alpha.9 → 0.6.0

package/src/cli/commands/proxmox-vm-template-build.ts

@@ -25,7 +25,7 @@ import {
   deleteVm,
   downloadCloudImage,
   findFreeTemplateVmid,
-  findIsoStorage,
+  findImportStorage,
   listVmTemplates,
   pollTaskUntilDone,
 } from '../../api-clients/proxmox';
@@ -33,7 +33,12 @@ import { FuelGauge } from '../fuel-gauge';
 
 const UBUNTU_2404_AMD64_URL =
   'https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img';
-const UBUNTU_2404_AMD64_FILENAME = 'noble-server-cloudimg-amd64.img';
+// Stored under the storage's import/ namespace, so the filename must end in an
+// extension PVE accepts for `import` content (UPLOAD_IMPORT_EXT_RE_1 =
+// ova|qcow2|raw|vmdk) — a `.img` is rejected with "invalid filename or wrong
+// extension". Ubuntu's cloud image is qcow2 format despite the upstream `.img`
+// URL, so we download it under a `.qcow2` name. The URL above is unchanged.
+const UBUNTU_2404_AMD64_FILENAME = 'noble-server-cloudimg-amd64.qcow2';
 const DEFAULT_TEMPLATE_NAME = 'ubuntu-2404-cloudinit';
 
 export interface VmTemplateBuildParams {
@@ -69,21 +74,23 @@ export async function buildCloudInitTemplate(params: VmTemplateBuildParams): Pro
   let vmid: number | null = null;
 
   try {
-    // Step 1: find ISO storage
-    gauge.addOutput('Finding ISO-capable storage on the node…');
-    const isoStorageResult = await findIsoStorage(credentials, nodeName);
-    if (!isoStorageResult.success) {
-      throw new Error(`Could not list node storage: ${isoStorageResult.message}`);
+    // Step 1: find import-capable storage. The cloud image is consumed via the
+    // VM-create `import-from=`, which requires an `import`/`images` source — a
+    // `.img` in the `iso/` namespace is rejected (`has wrong type 'iso'`).
+    gauge.addOutput('Finding import-capable storage on the node…');
+    const importStorageResult = await findImportStorage(credentials, nodeName);
+    if (!importStorageResult.success) {
+      throw new Error(`Could not list node storage: ${importStorageResult.message}`);
     }
-    const isoStorage = isoStorageResult.data;
-    if (!isoStorage) {
+    const importStorage = importStorageResult.data;
+    if (!importStorage) {
       throw new Error(
-        'No ISO-capable storage found on the node. ' +
-          "Enable 'iso' content on a storage (typically 'local') in the Proxmox UI: " +
+        'No import-capable storage found on the node. ' +
+          "Enable 'import' content on a storage (typically 'local') in the Proxmox UI: " +
           'Datacenter → Storage → Edit → Content.',
       );
     }
-    gauge.addOutput(`ISO storage: ${isoStorage}`);
+    gauge.addOutput(`Import storage: ${importStorage}`);
 
     // Step 2: find a free template VMID
     gauge.addOutput('Finding a free template VMID (>= 9000)…');
@@ -92,21 +99,21 @@ export async function buildCloudInitTemplate(params: VmTemplateBuildParams): Pro
     vmid = vmidResult.data;
     gauge.addOutput(`Using VMID ${vmid}`);
 
-    // Step 3: download cloud image to ISO storage
+    // Step 3: download cloud image to import storage
     gauge.addOutput(
-      `Downloading Ubuntu 24.04 cloud image to '${isoStorage}' (~600 MB, may take several minutes)…`,
+      `Downloading Ubuntu 24.04 cloud image to '${importStorage}' (~600 MB, may take several minutes)…`,
     );
     const downloadResult = await downloadCloudImage(
       credentials,
       nodeName,
-      isoStorage,
+      importStorage,
       UBUNTU_2404_AMD64_URL,
       UBUNTU_2404_AMD64_FILENAME,
     );
     if (!downloadResult.success) {
       if (downloadResult.message.includes('403') || downloadResult.message.includes('not found')) {
         throw new Error(
-          `Proxmox storage download-url endpoint rejected the request. This endpoint requires Proxmox VE 7.2+. Error: ${downloadResult.message}`,
+          `Proxmox storage download-url endpoint rejected the request. Downloading to 'import' content requires Proxmox VE 8.2+. Error: ${downloadResult.message}`,
         );
       }
       throw new Error(`Cloud image download failed: ${downloadResult.message}`);
@@ -116,14 +123,14 @@ export async function buildCloudInitTemplate(params: VmTemplateBuildParams): Pro
     gauge.addOutput('Cloud image downloaded');
 
     // Step 4: create VM from cloud image
-    const isoVolid = buildCloudImageVolid(isoStorage, UBUNTU_2404_AMD64_FILENAME);
+    const imageVolid = buildCloudImageVolid(importStorage, UBUNTU_2404_AMD64_FILENAME);
     gauge.addOutput(`Creating VM ${vmid} '${DEFAULT_TEMPLATE_NAME}' (importing disk)…`);
     const createResult = await createVmFromCloudImage({
       credentials,
       nodeName,
       vmid,
       name: DEFAULT_TEMPLATE_NAME,
-      isoVolid,
+      imageVolid,
       diskStorage,
     });
     if (!createResult.success) {

package/src/cli/commands/system-update.ts

@@ -41,7 +41,7 @@ import {
 import type { SystemUpdateResult } from '../../services/update/types';
 import { getFlag, hasFlag } from '../parser';
 import type { CommandResult } from '../types';
-import { fetchAndUpgrade } from './module-upgrade';
+import { fetchAndUpdate } from './module-update';
 
 /**
  * Packages we manage via the global bun install. The self-update step
@@ -275,7 +275,7 @@ async function buildSnapshots(
  * - `backup` calls `createModuleBackup`. Modules without an
  *   `on_backup` hook return ok (nothing to back up; not an error).
  * - `upgrade` fetches the latest version from the registry and runs
- *   the in-place upgrade (`fetchAndUpgrade` from module-upgrade.ts).
+ *   the in-place upgrade (`fetchAndUpdate` from module-upgrade.ts).
  *   Same code path that `module update` uses for its sweep mode.
  * - `deploy` calls `deployModule`.
  * - `health` calls `runModuleHealthCheck`.
@@ -314,7 +314,7 @@ function buildOps(registry: RegistryClient, wasDeployed: Set<string>): Orchestra
         if (!latest) {
           return { ok: false, error: `${moduleId}: no non-yanked version` };
         }
-        const result = await fetchAndUpgrade(registry, moduleId, latest.vers, db, {});
+        const result = await fetchAndUpdate(registry, moduleId, latest.vers, db, {});
         if (result.status === 'success') return { ok: true };
         if (result.status === 'failed') return { ok: false, error: result.error };
         // 'skipped' isn't expected here (the module IS installed), but

package/src/cli/completion.ts

@@ -141,6 +141,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'remove',
       'search',
       'update',
+      'upgrade',
       'verify',
       'audit',
       'backup',

package/src/cli/index.ts

@@ -63,6 +63,7 @@ import { handleModuleShowConfig, handleModuleShowZone } from './commands/module-
 import { handleModuleStatus } from './commands/module-status';
 import { handleModuleTerraformUnlock } from './commands/module-terraform-unlock';
 import { handleModuleTypesCheck, handleModuleTypesGenerate } from './commands/module-types';
+import { handleModuleUpdate } from './commands/module-update';
 import { handleModuleUpgrade } from './commands/module-upgrade';
 import { moduleVerify } from './commands/module-verify';
 import { handlePackage } from './commands/package';
@@ -1266,6 +1267,8 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
       case 'remove':
         return handleModuleRemove(parsed.args, parsed.flags);
       case 'update':
+        return handleModuleUpdate(parsed.args, parsed.flags);
+      case 'upgrade':
         return handleModuleUpgrade(parsed.args, parsed.flags);
       case 'audit':
         return moduleAudit(parsed.args);

package/src/hooks/capability-loader.ts

@@ -63,9 +63,13 @@ const CAPABILITY_MODULE_MAP: Record<string, { script: string; legacyFactoryName:
     script: 'scripts/idp-functions.ts',
     legacyFactoryName: 'createIdp',
   },
-  git_forge: {
-    script: 'scripts/git-forge-functions.ts',
-    legacyFactoryName: 'createForgejoGitForge',
+  source_forge: {
+    script: 'scripts/source-forge-functions.ts',
+    legacyFactoryName: 'createForgejoSourceForge',
+  },
+  registry_publish: {
+    script: 'scripts/registry-publish-functions.ts',
+    legacyFactoryName: 'default',
   },
   dhcp_server: {
     script: 'scripts/dhcp-server-functions.ts',

package/src/manifest/schema.ts

@@ -237,7 +237,9 @@ export type ComputedField = z.infer<typeof ComputedFieldSchema>;
 export const CapabilityProviderSchema = z.object({
   name: z.string().min(1),
   version: z.string().min(1),
-  data: z.record(z.unknown()),
+  // A purely imperative capability (functions-only, no cross-module data —
+  // e.g. registry_publish) carries no `data` block; default to {}.
+  data: z.record(z.unknown()).default({}),
   /**
    * Computed fields, merged into the capability's data namespace at access
    * time. A consumer reads `$capability:<name>.<computed-field>` exactly like

package/src/services/deploy-posture.test.ts

@@ -0,0 +1,106 @@
+import { describe, expect, test } from 'bun:test';
+import { classifyVersionDelta, parseVersion, resolveDeployPosture } from './deploy-posture';
+
+describe('parseVersion', () => {
+  test('parses major.minor.patch+build', () => {
+    expect(parseVersion('1.2.3+28')).toEqual({
+      major: 1,
+      minor: 2,
+      patch: 3,
+      prerelease: '',
+      build: '28',
+    });
+  });
+
+  test('parses a prerelease', () => {
+    expect(parseVersion('0.5.0-alpha.9')).toEqual({
+      major: 0,
+      minor: 5,
+      patch: 0,
+      prerelease: 'alpha.9',
+      build: '',
+    });
+  });
+
+  test('tolerates a bare version', () => {
+    expect(parseVersion('2.0.0')).toEqual({
+      major: 2,
+      minor: 0,
+      patch: 0,
+      prerelease: '',
+      build: '',
+    });
+  });
+});
+
+describe('classifyVersionDelta (highest-order component that changed)', () => {
+  test('major / minor / patch', () => {
+    expect(classifyVersionDelta('1.0.0', '2.0.0')).toBe('major');
+    expect(classifyVersionDelta('1.0.0', '1.1.0')).toBe('minor');
+    expect(classifyVersionDelta('1.0.0', '1.0.1')).toBe('patch');
+  });
+
+  test('build-metadata-only change is a revision', () => {
+    expect(classifyVersionDelta('1.0.1+27', '1.0.1+28')).toBe('revision');
+  });
+
+  test('prerelease-only change counts as patch (still fast)', () => {
+    expect(classifyVersionDelta('0.5.0-alpha.8', '0.5.0-alpha.9')).toBe('patch');
+  });
+
+  test('identical versions → none', () => {
+    expect(classifyVersionDelta('1.0.1+28', '1.0.1+28')).toBe('none');
+  });
+
+  test('highest-order wins when several components differ', () => {
+    expect(classifyVersionDelta('1.0.1+5', '1.1.0+1')).toBe('minor');
+  });
+});
+
+describe('resolveDeployPosture (precedence)', () => {
+  test('default by-semver: revision + patch ⇒ fast', () => {
+    expect(resolveDeployPosture({ installed: '1.0.1+1', next: '1.0.1+2' }).posture).toBe('fast');
+    expect(resolveDeployPosture({ installed: '1.0.1', next: '1.0.2' }).posture).toBe('fast');
+  });
+
+  test('default by-semver: minor + major ⇒ safe', () => {
+    expect(resolveDeployPosture({ installed: '1.0.0', next: '1.1.0' }).posture).toBe('safe');
+    expect(resolveDeployPosture({ installed: '1.0.0', next: '2.0.0' }).posture).toBe('safe');
+  });
+
+  test('per-release deploy_posture overrides the semver default', () => {
+    // a minor bump would default to safe; the release pins fast.
+    const r = resolveDeployPosture({ installed: '1.0.0', next: '1.1.0', releasePosture: 'fast' });
+    expect(r.posture).toBe('fast');
+    expect(r.reason).toContain('release deploy_posture');
+  });
+
+  test('module always-safe is a hard floor — beats a per-release fast', () => {
+    const r = resolveDeployPosture({
+      installed: '1.0.1',
+      next: '1.0.2',
+      releasePosture: 'fast',
+      modulePolicy: 'always-safe',
+    });
+    expect(r.posture).toBe('safe');
+    expect(r.reason).toContain('always-safe');
+  });
+
+  test('module always-fast forces fast on a minor bump (when no release override)', () => {
+    expect(
+      resolveDeployPosture({ installed: '1.0.0', next: '1.1.0', modulePolicy: 'always-fast' })
+        .posture,
+    ).toBe('fast');
+  });
+
+  test('a per-release safe still beats always-fast (release intent wins below the floor)', () => {
+    expect(
+      resolveDeployPosture({
+        installed: '1.0.1',
+        next: '1.0.2',
+        releasePosture: 'safe',
+        modulePolicy: 'always-fast',
+      }).posture,
+    ).toBe('safe');
+  });
+});

package/src/services/deploy-posture.ts

@@ -0,0 +1,87 @@
+/**
+ * Deploy posture — fast vs. safe — for `celilo module upgrade` (ISS-0138,
+ * v2/BUILD_BUS.md).
+ *
+ * CD is CI-driven, so no operator is present to pass `--no-backup`. The posture
+ * (fast = skip backup + extended verify; safe = backup + full verify) is
+ * DERIVED, with this precedence:
+ *   1. per-module `upgrade_policy: always-safe` — a hard floor (always safe).
+ *   2. per-release `deploy_posture` stamped in the .netapp release metadata.
+ *   3. per-module `upgrade_policy: always-fast`.
+ *   4. default: the semver delta of installed → next (revision/patch = fast;
+ *      minor/major = safe).
+ *
+ * celilo reads version NUMBERS, never changesets — the default needs only the
+ * versions. All functions here are pure (Rule 10).
+ */
+
+export type DeployPosture = 'fast' | 'safe';
+export type VersionDelta = 'none' | 'revision' | 'patch' | 'minor' | 'major';
+export type UpgradePolicy = 'by-semver' | 'always-safe' | 'always-fast';
+
+export interface ParsedVersion {
+  major: number;
+  minor: number;
+  patch: number;
+  /** prerelease tag, e.g. "alpha.2"; '' when absent. */
+  prerelease: string;
+  /** build metadata — celilo's `+N` registry revision; '' when absent. */
+  build: string;
+}
+
+/** Parse a celilo module version: `major.minor.patch[-prerelease][+build]`. */
+export function parseVersion(version: string): ParsedVersion {
+  const [coreAndPre = '', build = ''] = version.split('+');
+  const [core = '', prerelease = ''] = coreAndPre.split('-');
+  const parts = core.split('.');
+  const num = (i: number) => Number.parseInt(parts[i] ?? '', 10) || 0;
+  return { major: num(0), minor: num(1), patch: num(2), prerelease, build };
+}
+
+/**
+ * Classify the delta between an installed version and the next one by the
+ * highest-order component that changed. Assumes `next` >= `installed` (the poll
+ * only upgrades). A prerelease-only change counts as `patch` (still fast); a
+ * build-metadata-only change (`+N`) is `revision`.
+ */
+export function classifyVersionDelta(installed: string, next: string): VersionDelta {
+  const a = parseVersion(installed);
+  const b = parseVersion(next);
+  if (a.major !== b.major) return 'major';
+  if (a.minor !== b.minor) return 'minor';
+  if (a.patch !== b.patch) return 'patch';
+  if (a.prerelease !== b.prerelease) return 'patch';
+  if (a.build !== b.build) return 'revision';
+  return 'none';
+}
+
+/**
+ * Resolve the deploy posture for an upgrade. Precedence: `always-safe` floor →
+ * per-release override → `always-fast` → semver-delta default. Returns the
+ * posture plus a short reason for operator-visible logging.
+ */
+export function resolveDeployPosture(opts: {
+  installed: string;
+  next: string;
+  releasePosture?: DeployPosture | null;
+  modulePolicy?: UpgradePolicy;
+}): { posture: DeployPosture; reason: string } {
+  const policy = opts.modulePolicy ?? 'by-semver';
+
+  if (policy === 'always-safe') {
+    return { posture: 'safe', reason: 'module upgrade_policy=always-safe' };
+  }
+  if (opts.releasePosture) {
+    return {
+      posture: opts.releasePosture,
+      reason: `release deploy_posture=${opts.releasePosture}`,
+    };
+  }
+  if (policy === 'always-fast') {
+    return { posture: 'fast', reason: 'module upgrade_policy=always-fast' };
+  }
+
+  const delta = classifyVersionDelta(opts.installed, opts.next);
+  const posture: DeployPosture = delta === 'minor' || delta === 'major' ? 'safe' : 'fast';
+  return { posture, reason: `semver delta=${delta}` };
+}

package/src/services/module-subscriptions.test.ts

@@ -1,9 +1,12 @@
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { defineEvents, openBus } from '@celilo/event-bus';
+import { parse as parseYaml } from 'yaml';
 import { closeDb, getDb } from '../db/client';
+import { ModuleManifestSchema } from '../manifest/schema';
 import { ModuleSubscriptionSchema } from '../manifest/schema';
 import type { ModuleManifest } from '../manifest/schema';
 import { setupTestDatabase as migrateDbFile } from '../test-utils/setup-test-db';
@@ -341,3 +344,30 @@ describe('resyncAllSubscriptions (ISS-0088)', () => {
     expect(subscriberNames()).toEqual(['caddy.reconcile']);
   });
 });
+
+describe('build-bus registry-poll wiring (ISS-0139)', () => {
+  // The CD poll is wired as a celilo-mgmt manifest subscription so it registers
+  // ONLY on the management host. Guard the exact handler/pattern against drift.
+  const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..');
+
+  it('celilo-mgmt subscribes the registry poll to timer.tick.15m', () => {
+    const manifestPath = join(REPO_ROOT, 'modules', 'celilo-mgmt', 'manifest.yml');
+    const manifest = ModuleManifestSchema.parse(parseYaml(readFileSync(manifestPath, 'utf-8')));
+
+    const poll = manifest.subscriptions?.find((s) => s.name === 'registry-poll');
+    expect(poll).toBeDefined();
+    expect(poll?.pattern).toBe('timer.tick.15m');
+    // A literal handler command (the CLI poll), not a hook — see manifest comment.
+    expect(poll?.handler).toBe('celilo module upgrade');
+    expect(poll?.hook).toBeUndefined();
+
+    const resolved = resolveSubscription(
+      // biome-ignore lint/style/noNonNullAssertion: asserted defined above
+      poll!,
+      'celilo-mgmt',
+      '/modules/celilo-mgmt',
+    );
+    expect(resolved.name).toBe('celilo-mgmt.registry-poll');
+    expect(resolved.handler).toBe('celilo module upgrade');
+  });
+});

package/src/services/proxmox-state-recovery.ts

@@ -23,14 +23,29 @@ interface TerraformState {
     instances?: Array<{
       attributes?: {
         vmid?: number;
+        // proxmox_lxc carries the IP here ("10.0.10.12/24" or "dhcp").
         network?: Array<{
           ip?: string;
         }>;
+        // proxmox_vm_qemu carries the cloud-init IP here ("ip=10.0.10.12/24,gw=…").
+        ipconfig0?: string;
       };
     }>;
   }>;
 }
 
+/**
+ * Extract the CIDR from a qemu cloud-init `ipconfig0` string
+ * ("ip=10.0.10.12/24,gw=10.0.10.1" → "10.0.10.12/24"). Returns undefined for a
+ * DHCP config or anything without an explicit `ip=`.
+ */
+function extractIpFromIpconfig(ipconfig0: string | undefined): string | undefined {
+  if (!ipconfig0) return undefined;
+  const match = ipconfig0.match(/(?:^|,)ip=([^,]+)/);
+  const value = match?.[1];
+  return value && value !== 'dhcp' ? value : undefined;
+}
+
 /**
  * Ensure module_configs has vmid and target_ip from Terraform state
  * This recovers from state drift scenarios where container was deleted/recreated
@@ -82,19 +97,23 @@ export async function ensureProxmoxConfigFromState(
     );
   }
 
-  // Find proxmox_lxc resource
-  const lxcResource = state.resources?.find((r) => r.type === 'proxmox_lxc');
-  if (!lxcResource || !lxcResource.instances || lxcResource.instances.length === 0) {
-    throw new Error('No proxmox_lxc resource found in Terraform state');
+  // Find the provisioned guest: an LXC (proxmox_lxc) or a VM (proxmox_vm_qemu).
+  const guest = state.resources?.find(
+    (r) => r.type === 'proxmox_lxc' || r.type === 'proxmox_vm_qemu',
+  );
+  if (!guest || !guest.instances || guest.instances.length === 0) {
+    throw new Error('No proxmox_lxc or proxmox_vm_qemu resource found in Terraform state');
   }
 
-  const attributes = lxcResource.instances[0].attributes;
+  const attributes = guest.instances[0].attributes;
   if (!attributes) {
-    throw new Error('No attributes found in proxmox_lxc resource');
+    throw new Error(`No attributes found in ${guest.type} resource`);
   }
 
   const vmid = attributes.vmid;
-  const containerIp = attributes.network?.[0]?.ip;
+  // LXC exposes the IP at network[0].ip; a qemu VM exposes it via the cloud-init
+  // ipconfig0 ("ip=<cidr>,gw=<gw>"). Use whichever the guest type provides.
+  const containerIp = attributes.network?.[0]?.ip ?? extractIpFromIpconfig(attributes.ipconfig0);
 
   if (!vmid) {
     throw new Error('vmid not found in Terraform state');

package/src/templates/generator.test.ts

@@ -790,7 +790,28 @@ describe("targetNodeFromTfState (ISS-0090 — terraform state is celilo's placem
     expect(targetNodeFromTfState(state)).toBe('node3');
   });
 
-  test('returns null when there is no proxmox_lxc resource (fresh/empty state)', () => {
+  test('reads the node from a proxmox_vm_qemu target_node attribute (type:vm)', () => {
+    const state = {
+      resources: [
+        {
+          type: 'proxmox_vm_qemu',
+          instances: [{ attributes: { target_node: 'node3', id: 'node3/qemu/208' } }],
+        },
+      ],
+    };
+    expect(targetNodeFromTfState(state)).toBe('node3');
+  });
+
+  test('parses the qemu resource id when target_node is absent (type:vm)', () => {
+    const state = {
+      resources: [
+        { type: 'proxmox_vm_qemu', instances: [{ attributes: { id: 'node3/qemu/208' } }] },
+      ],
+    };
+    expect(targetNodeFromTfState(state)).toBe('node3');
+  });
+
+  test('returns null when there is no proxmox_lxc/proxmox_vm_qemu resource (fresh/empty state)', () => {
     expect(targetNodeFromTfState({ resources: [] })).toBeNull();
     expect(targetNodeFromTfState({})).toBeNull();
   });

package/src/templates/generator.ts

@@ -216,10 +216,11 @@ export function injectProxmoxDns(content: string, hasNameserver: boolean): strin
 }
 
 /**
- * Extract the node a proxmox_lxc resource is deployed on from a parsed terraform
- * state object. Pure logic (Rule 10), split from the file read for testability.
- * Prefers the explicit `target_node` attribute; falls back to parsing the
- * resource id (`<node>/lxc/<vmid>`). Returns null when there's no proxmox_lxc
+ * Extract the node a Proxmox guest is deployed on from a parsed terraform state
+ * object — an LXC (proxmox_lxc) or a VM (proxmox_vm_qemu). Pure logic (Rule 10),
+ * split from the file read for testability. Prefers the explicit `target_node`
+ * attribute; falls back to parsing the resource id (`<node>/lxc/<vmid>` for an
+ * LXC, `<node>/qemu/<vmid>` for a VM). Returns null when there's no such
  * resource (e.g. an empty/fresh state).
  */
 export function targetNodeFromTfState(state: {
@@ -228,15 +229,17 @@ export function targetNodeFromTfState(state: {
     instances?: Array<{ attributes?: { target_node?: string; id?: string } }>;
   }>;
 }): string | null {
-  const lxc = state.resources?.find((r) => r.type === 'proxmox_lxc');
-  const attrs = lxc?.instances?.[0]?.attributes;
+  const guest = state.resources?.find(
+    (r) => r.type === 'proxmox_lxc' || r.type === 'proxmox_vm_qemu',
+  );
+  const attrs = guest?.instances?.[0]?.attributes;
   if (!attrs) {
     return null;
   }
   if (attrs.target_node) {
     return attrs.target_node;
   }
-  // id format: "<node>/lxc/<vmid>"
+  // id format: "<node>/lxc/<vmid>" (LXC) or "<node>/qemu/<vmid>" (VM)
   return attrs.id?.split('/')[0] || null;
 }
 
@@ -745,6 +748,10 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
         default_target_node: string;
         lxc_template: string;
         storage: string;
+        // Optional: only set once a cloud-init VM template has been built/selected
+        // for the service (see service reconfigure). Required by `type: vm` modules;
+        // absent for services that only deploy LXCs.
+        vm_template?: string;
       };
 
       // ISS-0090: deploy follows REALITY. Resolve the node from Proxmox (it sees
@@ -774,6 +781,13 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
       // any stale __infra_target_node a prior generate left behind.
       upsertModuleConfig(db, moduleId, '__infra_lxc_template', providerConfig.lxc_template);
       upsertModuleConfig(db, moduleId, '__infra_storage', providerConfig.storage);
+      // vm_template is only present once a VM template exists for the service.
+      // Persist it when set so `type: vm` modules can resolve $self:vm_template;
+      // a `type: vm` deploy against a service without one then fails loudly at
+      // variable resolution (the intended "no VM template configured" error).
+      if (providerConfig.vm_template) {
+        upsertModuleConfig(db, moduleId, '__infra_vm_template', providerConfig.vm_template);
+      }
       deleteModuleConfig(db, moduleId, '__infra_target_node');
 
       log.success(`Infrastructure resolved: target_node=${decision.node} (${decision.source})`);
@@ -816,7 +830,7 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
 
     // lxc_template / storage are provider config (intent, not drift-prone) — read
     // them back from the __infra_* rows persisted above.
-    const infraKeys = ['lxc_template', 'storage'];
+    const infraKeys = ['lxc_template', 'storage', 'vm_template'];
     for (const key of infraKeys) {
       const infraConfig = db
         .select()