@celilo/cli 0.8.1 → 0.9.0

package/src/cli/commands/proxmox-instance-list.test.ts

@@ -0,0 +1,77 @@
+import { describe, expect, test } from 'bun:test';
+import type { ProxmoxClusterResource } from '../../api-clients/proxmox';
+import type { ProvisionedSystem } from '../../services/deployed-systems';
+import { joinInstanceRows } from './proxmox-instance-list';
+
+const GB = 1024 * 1024 * 1024;
+const MB = 1024 * 1024;
+
+function sys(p: Partial<ProvisionedSystem> & { vmid: number }): ProvisionedSystem {
+  return {
+    moduleId: 'forgejo-builder',
+    name: 'main',
+    hostname: 'forgejo-builder',
+    ipv4Address: '10.0.10.20',
+    zone: 'dmz',
+    serviceId: 'svc',
+    cpu: 4,
+    memory: 8192,
+    disk: 80,
+    ...p,
+  };
+}
+
+describe('joinInstanceRows (ISS-0150)', () => {
+  test('joins a VM: desired from system, actual from the qemu guest', () => {
+    const systems = [sys({ vmid: 208 })];
+    const resources: ProxmoxClusterResource[] = [
+      {
+        type: 'qemu',
+        vmid: 208,
+        node: 'node3',
+        status: 'running',
+        maxcpu: 4,
+        maxmem: 16 * GB,
+        maxdisk: 100 * GB,
+      },
+    ];
+    const rows = joinInstanceRows(systems, resources, 'vm');
+    expect(rows).toHaveLength(1);
+    expect(rows[0].desired).toEqual({ cpu: 4, memMb: 8192, diskGb: 80 });
+    expect(rows[0].actual).toEqual({ cpu: 4, memMb: 16384, diskGb: 100 });
+    expect(rows[0].node).toBe('node3');
+  });
+
+  test('kind filters by Proxmox guest type — a qemu guest never shows under ct', () => {
+    const systems = [sys({ vmid: 208 })];
+    const resources: ProxmoxClusterResource[] = [
+      { type: 'qemu', vmid: 208, node: 'node3', maxcpu: 4, maxmem: 8 * GB },
+    ];
+    expect(joinInstanceRows(systems, resources, 'ct')).toHaveLength(0);
+    expect(joinInstanceRows(systems, resources, 'vm')).toHaveLength(1);
+  });
+
+  test('an lxc system shows under ct', () => {
+    const systems = [sys({ moduleId: 'caddy', vmid: 202 })];
+    const resources: ProxmoxClusterResource[] = [
+      {
+        type: 'lxc',
+        vmid: 202,
+        node: 'node2',
+        status: 'running',
+        maxcpu: 1,
+        maxmem: 512 * MB,
+        maxdisk: 10 * GB,
+      },
+    ];
+    const rows = joinInstanceRows(systems, resources, 'ct');
+    expect(rows).toHaveLength(1);
+    expect(rows[0].module).toBe('caddy');
+    expect(rows[0].actual).toEqual({ cpu: 1, memMb: 512, diskGb: 10 });
+  });
+
+  test('a system absent from the cluster is omitted', () => {
+    const systems = [sys({ vmid: 999 })];
+    expect(joinInstanceRows(systems, [], 'vm')).toHaveLength(0);
+  });
+});

package/src/cli/commands/proxmox-instance-list.ts

@@ -0,0 +1,140 @@
+/**
+ * `celilo proxmox vm list` / `celilo proxmox ct list` — celilo-provisioned
+ * Proxmox instances with their **desired** size (canonical `module_systems`
+ * state, ISS-0150) next to their **actual** size (live from the Proxmox API). A
+ * desired≠actual row means a resize is pending a reconcile/redeploy.
+ *
+ * Read-only sibling of `proxmox node list`; the foundation the `resize` verb
+ * (ISS-0150 P2) builds on. See apps/celilo/designs/PROXMOX_INSTANCE_SIZING.md.
+ */
+
+import {
+  ProxmoxClient,
+  type ProxmoxClusterResource,
+  type ProxmoxCredentials,
+} from '../../api-clients/proxmox';
+import { getDb } from '../../db/client';
+import { getServiceCredentials, listContainerServices } from '../../services/container-service';
+import { type ProvisionedSystem, getProvisionedSystems } from '../../services/deployed-systems';
+import { celiloIntro } from '../prompts';
+import type { CommandResult } from '../types';
+import { resolveProxmoxService } from './proxmox-service';
+
+const BYTES_PER_MB = 1024 * 1024;
+const BYTES_PER_GB = 1024 * 1024 * 1024;
+
+export type InstanceKind = 'vm' | 'ct';
+
+/** Proxmox `type` for each celilo instance kind. */
+const PROXMOX_TYPE: Record<InstanceKind, string> = { vm: 'qemu', ct: 'lxc' };
+
+export interface InstanceRow {
+  module: string;
+  name: string;
+  vmid: number;
+  node: string;
+  status: string;
+  desired: { cpu: number | null; memMb: number | null; diskGb: number | null };
+  /** null when the instance is in module_systems but not (yet) on the cluster. */
+  actual: { cpu: number; memMb: number; diskGb: number } | null;
+}
+
+/**
+ * Pure join of celilo's provisioned systems against live Proxmox guests, for one
+ * instance kind. Keyed by vmid; the Proxmox guest `type` decides vm vs ct
+ * membership (a celilo system row doesn't itself record the kind).
+ */
+export function joinInstanceRows(
+  systems: ProvisionedSystem[],
+  resources: ProxmoxClusterResource[],
+  kind: InstanceKind,
+): InstanceRow[] {
+  const wantType = PROXMOX_TYPE[kind];
+  const byVmid = new Map<number, ProxmoxClusterResource>();
+  for (const r of resources) {
+    if (r.type === wantType && typeof r.vmid === 'number') byVmid.set(r.vmid, r);
+  }
+  const rows: InstanceRow[] = [];
+  for (const s of systems) {
+    if (s.vmid == null) continue;
+    const guest = byVmid.get(s.vmid);
+    if (!guest) continue; // not a guest of this kind (other kind, or gone from cluster)
+    rows.push({
+      module: s.moduleId,
+      name: s.name,
+      vmid: s.vmid,
+      node: guest.node ?? '—',
+      status: guest.status ?? '—',
+      desired: { cpu: s.cpu, memMb: s.memory, diskGb: s.disk },
+      actual:
+        guest.maxcpu != null && guest.maxmem != null
+          ? {
+              cpu: guest.maxcpu,
+              memMb: Math.round(guest.maxmem / BYTES_PER_MB),
+              diskGb: guest.maxdisk != null ? Math.round(guest.maxdisk / BYTES_PER_GB) : 0,
+            }
+          : null,
+    });
+  }
+  return rows;
+}
+
+function fmtSize(cpu: number | null, memMb: number | null, diskGb: number | null): string {
+  const c = cpu != null ? `${cpu}c` : '—';
+  const m = memMb != null ? `${(memMb / 1024).toFixed(0)}G` : '—';
+  const d = diskGb != null ? `${diskGb}G` : '—';
+  return `${c}/${m}/${d}`;
+}
+
+export async function handleProxmoxInstanceList(
+  kind: InstanceKind,
+  args: string[],
+): Promise<CommandResult> {
+  celiloIntro(kind === 'vm' ? 'Proxmox VMs' : 'Proxmox containers');
+
+  const resolved = resolveProxmoxService(await listContainerServices(), args[0]);
+  if ('error' in resolved) {
+    console.log(`✗ ${resolved.error}`);
+    return { success: false, error: resolved.error };
+  }
+  const { service } = resolved;
+
+  const creds = (await getServiceCredentials(service.id)) as ProxmoxCredentials;
+  const result = await new ProxmoxClient(creds).clusterResources();
+  if (!result.success) {
+    console.log(`✗ Could not reach Proxmox (${service.serviceId}): ${result.message}`);
+    return { success: false, error: result.message };
+  }
+
+  const rows = joinInstanceRows(getProvisionedSystems(getDb()), result.data, kind);
+  if (rows.length === 0) {
+    console.log(`No celilo-provisioned ${kind === 'vm' ? 'VMs' : 'containers'} found.`);
+    return { success: true, message: 'none' };
+  }
+
+  console.log(`Service: ${service.serviceId} (${service.name})\n`);
+  console.log(
+    'MODULE              VMID   NODE     STATUS    DESIRED(c/m/d)   ACTUAL(c/m/d)   DRIFT',
+  );
+  console.log(
+    '────────────────────────────────────────────────────────────────────────────────────',
+  );
+  for (const r of rows) {
+    const desired = fmtSize(r.desired.cpu, r.desired.memMb, r.desired.diskGb);
+    const actual = r.actual ? fmtSize(r.actual.cpu, r.actual.memMb, r.actual.diskGb) : '—';
+    // Only flag drift on a real mismatch — a null desired dimension means
+    // "unset / not yet seeded", not a pending resize.
+    const drift =
+      r.actual &&
+      ((r.desired.cpu != null && r.desired.cpu !== r.actual.cpu) ||
+        (r.desired.memMb != null && r.desired.memMb !== r.actual.memMb) ||
+        (r.desired.diskGb != null && r.desired.diskGb !== r.actual.diskGb))
+        ? '⚠ resize pending'
+        : '';
+    console.log(
+      `${r.module.padEnd(19)} ${String(r.vmid).padEnd(6)} ${r.node.padEnd(8)} ${r.status.padEnd(9)} ${desired.padEnd(16)} ${actual.padEnd(15)} ${drift}`,
+    );
+  }
+  console.log('');
+  return { success: true, message: `${rows.length} ${kind}(s)` };
+}

package/src/cli/commands/proxmox-instance-resize.ts

@@ -0,0 +1,235 @@
+/**
+ * `celilo proxmox vm resize <name> --memory <MB> [--cpu <n>]` (and `ct resize`) —
+ * the canonical resize for a celilo-provisioned instance (ISS-0150 P2). Updates
+ * the SYSTEM's canonical size in module_systems, then reconciles declaratively by
+ * redeploying the owning module (its Terraform now reads the system size).
+ *
+ * Guardrails (proxmox-resize-guards.ts): floor = max(requires.system) across
+ * co-hosted modules (hard); node capacity (overridable with --force). Reboot +
+ * pre-resize backup are confirmed via the event-bus interview (CLAUDE.md: no
+ * direct CLI prompts) — flags win: --allow-reboot / --skip-backup / --yes.
+ */
+
+import { and, eq } from 'drizzle-orm';
+import { ProxmoxClient, type ProxmoxCredentials } from '../../api-clients/proxmox';
+import { getDb } from '../../db/client';
+import { moduleSystems, modules } from '../../db/schema';
+import { type ModuleManifest, getSingularSystemSpec } from '../../manifest/schema';
+import { createModuleBackup } from '../../services/backup-create';
+import { askConfirm, withInterviewSession } from '../../services/bus-interview';
+import { getServiceCredentials, listContainerServices } from '../../services/container-service';
+import { getProvisionedSystems } from '../../services/deployed-systems';
+import { deployModule } from '../../services/module-deploy';
+import { celiloIntro } from '../prompts';
+import type { CommandResult } from '../types';
+import type { InstanceKind } from './proxmox-instance-list';
+import { computeFloor, validateResize } from './proxmox-resize-guards';
+import { resolveProxmoxService } from './proxmox-service';
+
+const PROXMOX_TYPE: Record<InstanceKind, string> = { vm: 'qemu', ct: 'lxc' };
+
+function numFlag(v: string | boolean | undefined): number | undefined {
+  if (typeof v !== 'string') return undefined;
+  const n = Number.parseInt(v, 10);
+  return Number.isNaN(n) ? undefined : n;
+}
+
+export async function handleProxmoxInstanceResize(
+  kind: InstanceKind,
+  args: string[],
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  celiloIntro(`Resize ${kind === 'vm' ? 'VM' : 'container'}`);
+
+  const name = args[0];
+  if (!name) {
+    const e = `Instance name required: celilo proxmox ${kind} resize <name> --memory <MB> [--cpu <n>]`;
+    console.log(`✗ ${e}`);
+    return { success: false, error: e };
+  }
+
+  if (numFlag(flags.disk) != null) {
+    const e = 'Disk resize is deferred (ISS-0150 D4). Use --memory / --cpu for now.';
+    console.log(`✗ ${e}`);
+    return { success: false, error: e };
+  }
+  const reqCpu = numFlag(flags.cpu);
+  const reqMemory = numFlag(flags.memory);
+  if (reqCpu == null && reqMemory == null) {
+    const e = 'Specify at least one of --memory <MB> or --cpu <n>.';
+    console.log(`✗ ${e}`);
+    return { success: false, error: e };
+  }
+
+  const resolved = resolveProxmoxService(await listContainerServices(), undefined);
+  if ('error' in resolved) {
+    console.log(`✗ ${resolved.error}`);
+    return { success: false, error: resolved.error };
+  }
+  const { service } = resolved;
+  const creds = (await getServiceCredentials(service.id)) as ProxmoxCredentials;
+  const client = new ProxmoxClient(creds);
+
+  const cluster = await client.clusterResources();
+  if (!cluster.success) {
+    console.log(`✗ Could not reach Proxmox: ${cluster.message}`);
+    return { success: false, error: cluster.message };
+  }
+  const wantType = PROXMOX_TYPE[kind];
+  const guestByVmid = new Map<number, (typeof cluster.data)[number]>();
+  for (const r of cluster.data) {
+    if (r.type === wantType && typeof r.vmid === 'number') guestByVmid.set(r.vmid, r);
+  }
+
+  const db = getDb();
+  const systems = getProvisionedSystems(db);
+  const matches = systems.filter(
+    (s) =>
+      s.vmid != null &&
+      guestByVmid.has(s.vmid) &&
+      (s.hostname === name || s.name === name || s.moduleId === name),
+  );
+  if (matches.length === 0) {
+    const e = `No celilo-provisioned ${kind} named '${name}'. Try: celilo proxmox ${kind} list`;
+    console.log(`✗ ${e}`);
+    return { success: false, error: e };
+  }
+  if (matches.length > 1) {
+    const e = `Ambiguous '${name}' — matches ${matches.map((m) => m.moduleId).join(', ')}`;
+    console.log(`✗ ${e}`);
+    return { success: false, error: e };
+  }
+  const target = matches[0];
+  const vmid = target.vmid as number;
+  const guest = guestByVmid.get(vmid);
+  const node = guest?.node;
+
+  // Co-hosted = every module recorded on the same physical instance (vmid).
+  const coHosted = systems.filter((s) => s.vmid === vmid);
+  const mins = coHosted.map((s) => {
+    const mod = db.select().from(modules).where(eq(modules.id, s.moduleId)).get();
+    const spec = mod ? getSingularSystemSpec(mod.manifestData as ModuleManifest) : undefined;
+    return { cpu: spec?.cpu, memory: spec?.memory, disk: spec?.disk };
+  });
+  const floor = computeFloor(mins);
+
+  const nodeCaps = await client.nodeCapacities();
+  const nodeCap = nodeCaps.success ? nodeCaps.data.find((n) => n.node === node) : undefined;
+
+  const decision = validateResize(
+    { cpu: reqCpu, memory: reqMemory },
+    {
+      current: { cpu: target.cpu, memory: target.memory, disk: target.disk },
+      floor,
+      nodeFreeMemMb: nodeCap?.memFreeMb ?? Number.POSITIVE_INFINITY,
+      nodeTotalCores: nodeCap?.cpuCores ?? Number.POSITIVE_INFINITY,
+    },
+    { force: flags.force === true },
+  );
+
+  if (decision.errors.length > 0) {
+    console.log('✗ Resize rejected:');
+    for (const err of decision.errors) console.log(`   - ${err}`);
+    if (decision.capacityOnly) console.log('   (pass --force to override the capacity check)');
+    return { success: false, error: decision.errors.join('; ') };
+  }
+
+  const yes = flags.yes === true;
+  const coHostedIds = coHosted.map((s) => s.moduleId);
+
+  // Pre-resize backup — ON by default; --skip-backup opts out; otherwise the
+  // skip decision is an event-bus interview question (never a direct CLI prompt).
+  let doBackup: boolean;
+  if (flags['skip-backup'] === true) doBackup = false;
+  else if (yes) doBackup = true;
+  else
+    doBackup = await withInterviewSession(() =>
+      askConfirm({
+        scope: 'proxmox-resize',
+        key: 'backup',
+        message: `Take a pre-resize backup of ${coHostedIds.join(', ')} first?`,
+        defaultValue: true,
+      }),
+    );
+
+  if (doBackup) {
+    for (const s of coHosted) {
+      const mod = db.select().from(modules).where(eq(modules.id, s.moduleId)).get();
+      const manifest = mod?.manifestData as ModuleManifest | undefined;
+      if (!manifest?.hooks?.on_backup) {
+        console.log(`  ⚠ ${s.moduleId} has no on_backup hook — skipping its backup`);
+        continue;
+      }
+      const backup = await createModuleBackup(s.moduleId);
+      if (!backup.success) {
+        const e = `Pre-resize backup failed for ${s.moduleId}: ${backup.error}`;
+        console.log(`✗ ${e}`);
+        return { success: false, error: e };
+      }
+      console.log(`  ✓ Backed up ${s.moduleId}`);
+    }
+  }
+
+  // Reboot confirmation — a cpu/memory change needs a Proxmox stop/start.
+  if (decision.needsReboot) {
+    let allowReboot: boolean;
+    if (flags['allow-reboot'] === true || yes) allowReboot = true;
+    else
+      allowReboot = await withInterviewSession(() =>
+        askConfirm({
+          scope: 'proxmox-resize',
+          key: 'reboot',
+          message: `Resizing ${name} (vmid ${vmid}) requires a stop/start — brief downtime. Proceed?`,
+          defaultValue: false,
+        }),
+      );
+    if (!allowReboot) {
+      const e = 'Resize aborted — reboot not approved (re-run with --allow-reboot).';
+      console.log(`✗ ${e}`);
+      return { success: false, error: e };
+    }
+  }
+
+  // Update the canonical size on every module_systems row for this instance.
+  for (const s of coHosted) {
+    const set: { cpu?: number; memory?: number; updatedAt: Date } = { updatedAt: new Date() };
+    if (reqCpu != null) set.cpu = reqCpu;
+    if (reqMemory != null) set.memory = reqMemory;
+    db.update(moduleSystems)
+      .set(set)
+      .where(and(eq(moduleSystems.moduleId, s.moduleId), eq(moduleSystems.name, s.name)))
+      .run();
+  }
+  const effCpu = reqCpu ?? target.cpu;
+  const effMem = reqMemory ?? target.memory;
+  console.log(`✓ Canonical size updated: ${name} → ${effCpu ?? '?'}c / ${effMem ?? '?'}MB`);
+
+  // Reconcile declaratively: redeploy the owning module — its Terraform now reads
+  // the updated system size and writes it to the Proxmox VM config. The proxmox
+  // provider itself stop/starts the VM to apply a cpu/memory change (the reboot
+  // the operator approved above), so no explicit power-cycle is needed here.
+  console.log(`▸ Reconciling ${target.moduleId} (Terraform apply + VM restart)…`);
+  const deployed = await deployModule(target.moduleId, db, {});
+  if (!deployed.success) {
+    // The provider's restart-on-resize can surface a non-fatal "VM already
+    // running" and exit non-zero even though the deploy reached VERIFIED (the
+    // same deploy-over-SSH pattern noted in CLAUDE.md). Trust the module STATE
+    // over the exit code: VERIFIED means the resize landed.
+    const state = db
+      .select({ state: modules.state })
+      .from(modules)
+      .where(eq(modules.id, target.moduleId))
+      .get()?.state;
+    if (state !== 'VERIFIED') {
+      const e = `Size updated but reconcile failed: ${deployed.error}. Re-run: celilo module deploy ${target.moduleId}`;
+      console.log(`✗ ${e}`);
+      return { success: false, error: e };
+    }
+    console.log(
+      `  ⚠ reconcile exited non-zero but ${target.moduleId} is VERIFIED — treating as success`,
+    );
+  }
+
+  console.log(`✓ Resized ${name} and reconciled ${target.moduleId} (new size live).`);
+  return { success: true, message: `resized ${name}` };
+}

package/src/cli/commands/proxmox-node-list.ts

@@ -11,6 +11,7 @@ import { ProxmoxClient, type ProxmoxCredentials } from '../../api-clients/proxmo
 import { getServiceCredentials, listContainerServices } from '../../services/container-service';
 import { celiloIntro } from '../prompts';
 import type { CommandResult } from '../types';
+import { resolveProxmoxService } from './proxmox-service';
 
 function formatUptime(sec: number): string {
   if (sec <= 0) return '—';
@@ -19,40 +20,6 @@ function formatUptime(sec: number): string {
   return days > 0 ? `${days}d${hours}h` : `${hours}h`;
 }
 
-/**
- * Resolve which Proxmox service to introspect: an explicit service-id arg, else
- * the sole Proxmox service. Returns an error message when the choice is
- * ambiguous or the named service doesn't exist.
- */
-function resolveProxmoxService(
-  services: Awaited<ReturnType<typeof listContainerServices>>,
-  requested: string | undefined,
-): { service: (typeof services)[number] } | { error: string } {
-  const proxmox = services.filter((s) => s.providerName === 'proxmox');
-  if (proxmox.length === 0) {
-    return {
-      error: 'No Proxmox container service configured. Add one: celilo service add proxmox',
-    };
-  }
-  if (requested) {
-    const match = proxmox.find((s) => s.serviceId === requested);
-    if (!match) {
-      return {
-        error: `No Proxmox service '${requested}'. Known: ${proxmox.map((s) => s.serviceId).join(', ')}`,
-      };
-    }
-    return { service: match };
-  }
-  if (proxmox.length > 1) {
-    return {
-      error: `Multiple Proxmox services — specify one: celilo proxmox node list <service-id>\n  ${proxmox
-        .map((s) => s.serviceId)
-        .join('\n  ')}`,
-    };
-  }
-  return { service: proxmox[0] };
-}
-
 export async function handleProxmoxNodeList(
   args: string[],
   _flags: Record<string, boolean | string> = {},

package/src/cli/commands/proxmox-resize-guards.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, test } from 'bun:test';
+import { type ResizeContext, computeFloor, validateResize } from './proxmox-resize-guards';
+
+const ctx = (over: Partial<ResizeContext> = {}): ResizeContext => ({
+  current: { cpu: 4, memory: 8192, disk: 80 },
+  floor: { cpu: 4, memory: 8192, disk: 80 },
+  nodeFreeMemMb: 20000,
+  nodeTotalCores: 6,
+  ...over,
+});
+
+describe('validateResize (ISS-0150)', () => {
+  test('a valid memory bump within headroom passes and needs a reboot', () => {
+    const d = validateResize({ memory: 16384 }, ctx());
+    expect(d.errors).toEqual([]);
+    expect(d.needsReboot).toBe(true);
+    expect(d.effective).toEqual({ cpu: 4, memory: 16384, disk: 80 });
+  });
+
+  test('below the floor is rejected (hard, not overridable)', () => {
+    const d = validateResize({ memory: 4096 }, ctx(), { force: true });
+    expect(d.errors.length).toBe(1);
+    expect(d.errors[0]).toContain('below the module minimum');
+  });
+
+  test('memory growth beyond node free RAM is a capacity error, overridable with --force', () => {
+    const tight = ctx({ nodeFreeMemMb: 1000 }); // only 1 GB free; +8 GB requested
+    const blocked = validateResize({ memory: 16384 }, tight, { force: false });
+    expect(blocked.errors.length).toBe(1);
+    expect(blocked.capacityOnly).toBe(true);
+    const forced = validateResize({ memory: 16384 }, tight, { force: true });
+    expect(forced.errors).toEqual([]);
+  });
+
+  test('cpu above physical cores is a capacity error', () => {
+    const d = validateResize({ cpu: 8 }, ctx(), { force: false });
+    expect(d.errors[0]).toContain('exceeds node physical cores');
+    expect(validateResize({ cpu: 8 }, ctx(), { force: true }).errors).toEqual([]);
+  });
+});
+
+describe('computeFloor', () => {
+  test('takes the max of each field across co-hosted modules', () => {
+    expect(
+      computeFloor([
+        { cpu: 2, memory: 4096, disk: 40 },
+        { cpu: 4, memory: 2048, disk: 80 },
+      ]),
+    ).toEqual({ cpu: 4, memory: 4096, disk: 80 });
+  });
+
+  test('treats missing minimums as 0', () => {
+    expect(computeFloor([{ memory: 8192 }, {}])).toEqual({ cpu: 0, memory: 8192, disk: 0 });
+  });
+});

package/src/cli/commands/proxmox-resize-guards.ts

@@ -0,0 +1,102 @@
+/**
+ * Pure guardrails for `celilo proxmox … resize` (ISS-0150 D4). Kept separate from
+ * the command so the floor + capacity logic is unit-testable without Proxmox or a
+ * DB. See apps/celilo/designs/PROXMOX_INSTANCE_SIZING.md.
+ */
+
+export interface ResizeRequest {
+  cpu?: number;
+  memory?: number; // MB
+  disk?: number; // GB
+}
+
+export interface ResizeContext {
+  /** Current canonical size of the system (null where unknown). */
+  current: { cpu: number | null; memory: number | null; disk: number | null };
+  /**
+   * Minimum floor — `max(requires.system.<field>)` across every module co-hosted
+   * on this system. A resize may never drop below any tenant's minimum.
+   */
+  floor: { cpu: number; memory: number; disk: number };
+  /** Free RAM on the target node — memory growth must fit (delta check). */
+  nodeFreeMemMb: number;
+  /** Physical cores on the target node — a VM's vCPU can't exceed this (absolute). */
+  nodeTotalCores: number;
+}
+
+export interface ResizeDecision {
+  /** Hard errors that block the resize (unless overridden where noted). */
+  errors: string[];
+  /** The size that would be applied (requested fields merged over current). */
+  effective: { cpu: number | null; memory: number | null; disk: number | null };
+  /** cpu/memory changes need a Proxmox stop/start; disk-only growth does not. */
+  needsReboot: boolean;
+  /** True when the only blocker is capacity (so `--force` can override). */
+  capacityOnly: boolean;
+}
+
+/**
+ * Validate a resize request against the floor and node capacity. Disk shrink is
+ * rejected (qemu can't shrink safely); disk resize is otherwise deferred
+ * (D4) — callers should reject a disk change until that lands, but the floor/grow
+ * checks are here for when it does.
+ */
+export function validateResize(
+  req: ResizeRequest,
+  ctx: ResizeContext,
+  opts: { force: boolean } = { force: false },
+): ResizeDecision {
+  const effective = {
+    cpu: req.cpu ?? ctx.current.cpu,
+    memory: req.memory ?? ctx.current.memory,
+    disk: req.disk ?? ctx.current.disk,
+  };
+
+  const floorErrors: string[] = [];
+  if (req.cpu != null && req.cpu < ctx.floor.cpu) {
+    floorErrors.push(`cpu ${req.cpu} is below the module minimum (${ctx.floor.cpu})`);
+  }
+  if (req.memory != null && req.memory < ctx.floor.memory) {
+    floorErrors.push(`memory ${req.memory}MB is below the module minimum (${ctx.floor.memory}MB)`);
+  }
+  if (req.disk != null && req.disk < ctx.floor.disk) {
+    floorErrors.push(`disk ${req.disk}GB is below the module minimum (${ctx.floor.disk}GB)`);
+  }
+
+  const capErrors: string[] = [];
+  // cpu: a single VM's vCPU can't usefully exceed the node's physical cores.
+  if (req.cpu != null && req.cpu > ctx.nodeTotalCores) {
+    capErrors.push(`cpu ${req.cpu} exceeds node physical cores (${ctx.nodeTotalCores})`);
+  }
+  // memory: only the GROWTH beyond the current size draws on free RAM.
+  if (req.memory != null && ctx.current.memory != null) {
+    const addedMb = req.memory - ctx.current.memory;
+    if (addedMb > ctx.nodeFreeMemMb) {
+      capErrors.push(`+${addedMb}MB exceeds node free RAM (${ctx.nodeFreeMemMb}MB)`);
+    }
+  }
+
+  const capacityOnly = floorErrors.length === 0 && capErrors.length > 0;
+  // Floor is a hard floor (never overridable). Capacity is overridable with --force.
+  const errors = [...floorErrors, ...(opts.force ? [] : capErrors)];
+
+  const needsReboot = req.cpu != null || req.memory != null;
+
+  return { errors, effective, needsReboot, capacityOnly };
+}
+
+/**
+ * Compute the floor for a system from the requires.system minimums of every
+ * module co-hosted on it. Pure over the extracted minimums.
+ */
+export function computeFloor(
+  mins: Array<{ cpu?: number | null; memory?: number | null; disk?: number | null }>,
+): { cpu: number; memory: number; disk: number } {
+  const maxOf = (pick: (m: (typeof mins)[number]) => number | null | undefined): number =>
+    mins.reduce((acc, m) => Math.max(acc, pick(m) ?? 0), 0);
+  return {
+    cpu: maxOf((m) => m.cpu),
+    memory: maxOf((m) => m.memory),
+    disk: maxOf((m) => m.disk),
+  };
+}