@homeflare/alchemy 0.1.0

package/dist/proxmox/lease-cache.d.ts

@@ -0,0 +1,98 @@
+/**
+ * One credential per (target, role) for the life of a run, instead of one per API call.
+ *
+ * 🔴 THE MEASUREMENT THAT MADE THIS NECESSARY. A single `alchemy plan` plus `deploy` of the TB4
+ *   stack — 98 resources — left **760 API token entries in `/etc/pve/user.cfg`**, counted on n2
+ *   immediately afterwards. `mint()` asked OpenBao for a new credential on EVERY call, and each
+ *   mint creates a real Proxmox token: read, diff, reconcile and read-back each got their own. They
+ *   drain as the leases expire (760 down to 712 over five minutes), so nothing was broken — but
+ *   `/etc/pve` is pmxcfs, a REPLICATED cluster filesystem, and every one of those mints is a write
+ *   to it that all three nodes must agree on. Two plans in quick succession stack thousands.
+ *
+ * ⛔ AND ON PBS THE COST IS SECONDS, NOT BYTES. `pbs_grant.go` waits for PBS to honour a freshly
+ *   granted ACL before handing the credential over — measured at about 4.5s, and unavoidable,
+ *   because PBS caches its parsed ACL config. Per mint. The ten PBS resources in pbs.ts would pay
+ *   that ten times over for credentials identical to each other.
+ *
+ * ★ SO THE FIX IS TO STOP THROWING AWAY A CREDENTIAL THAT IS STILL VALID. This is strictly FEWER
+ *   credentials in existence at once, not more: the lease TTL is untouched, and a token that would
+ *   have been minted and abandoned is simply never minted. It is the same reasoning
+ *   `network-apply.ts` already applies by hand when it threads one lease through `pveWith` for its
+ *   apply and its task poll.
+ *
+ * ⚠️ THE CACHE IS PROCESS-SCOPED AND THAT IS THE INTENDED LIFETIME. A plan or a deploy is one
+ *   process; the next one starts cold. Nothing is written to disk, and a credential never outlives
+ *   the run that minted it.
+ *
+ * ⛔ IT IS NOT A PERFORMANCE CACHE, SO IT MUST NEVER SERVE A CREDENTIAL THAT COULD DIE MID-CALL.
+ *   The provision lease is 300s and a deploy can run longer than that. A credential handed out at
+ *   t+299 would fail the call it was handed to, and the failure surfaces as a 401 — which `read`
+ *   folds into "absent", which is how a plan comes to say CREATE for an object that exists. That is
+ *   the exact class of bug this package found three times in one day, so the margin below is
+ *   deliberately generous rather than tuned.
+ *
+ * ★ THE MECHANISM IS EFFECT'S OWN `Cache`, AND THE HAND-WRITTEN ONE IT REPLACED WAS WRONG IN
+ *   EXACTLY THE PLACE A LIBRARY IS NOT. A TTL map alone still minted 89 credentials for 98
+ *   resources, because Alchemy plans concurrently and every resource missed in the same instant;
+ *   the in-flight map added to fix that got the first miss right and the failure path wrong. A
+ *   waiter woken by a FAILED or uncacheable mint claimed the slot without looking again, the
+ *   waiters overwrote each other's claims, and each one's cleanup deleted somebody else's — the
+ *   thundering herd back through the error door (found in review 2026-09-14, confirmed by
+ *   reading). `Cache.get` shares one pending lookup among concurrent callers by design. MEASURED
+ *   with a probe before this was written: ten concurrent gets on equal-but-distinct key objects ran
+ *   the lookup once; a zero time-to-live ran it again for the next caller; a failure reached all
+ *   ten waiters and was not kept.
+ */
+import * as Cache from 'effect/Cache';
+import * as Duration from 'effect/Duration';
+import * as Effect from 'effect/Effect';
+import * as Exit from 'effect/Exit';
+import { type ApiTarget, type PveCredential, type PveRole } from './credentials.ts';
+/**
+ * What a credential is cached under.
+ *
+ * ⛔ KEYED ON THE OPENBAO MOUNT AND ROLE, NOT ON A MEMBER HOSTNAME. A PVE API token is
+ *   cluster-wide — `user.cfg` is replicated — so n2, n3 and n4 share one credential. Keying on
+ *   `api` would mint three identical tokens when failover rotates members.
+ * ★ THE MOUNT CANNOT COLLIDE ACROSS CLUSTERS: `proxmox-tb4`, `proxmox-ops` and `pbs-tb4` are
+ *   distinct OpenBao mounts with distinct policies; two estates never share a mount name.
+ * ★ A PLAIN OBJECT IS A SAFE KEY BECAUSE EFFECT COMPARES KEYS STRUCTURALLY — two separately built
+ *   literals with the same fields are one entry, which the probe above measured.
+ */
+export type LeaseKey = {
+    readonly mount: string;
+    readonly role: PveRole;
+    readonly scheme: ApiTarget['scheme'];
+};
+/**
+ * How long a freshly minted credential may be handed out again.
+ *
+ * ⛔ ZERO FOR A FAILURE, FOR AN UNKNOWN LIFETIME AND FOR A LEASE INSIDE THE MARGIN. Zero means "do
+ *   not keep": the callers already waiting on THIS mint still receive its result, and the next
+ *   caller mints again. Keeping a failure would turn one refused mint into a refused run.
+ * ⚠️ EXPORTED FOR THE TEST. The margin is the whole safety property, so it is pinned from both
+ *   sides of its edge without waiting four minutes of wall clock.
+ */
+export declare const timeToLive: (exit: Exit.Exit<PveCredential, unknown>) => Duration.Duration;
+/**
+ * A lease cache over any mint.
+ *
+ * ⚠️ ONE BEHAVIOUR CHANGED WITH THE MOVE TO `Cache`, DELIBERATELY. Callers waiting on a mint that
+ *   FAILS now receive that failure, where the hand-written version had each of them mint again.
+ *   They asked in the same instant for the same credential, and a plan with one failed resource
+ *   fails either way — so the change is in how many errors the output lists, not in the outcome,
+ *   and a sealed vault is asked once rather than ninety-eight times.
+ * ★ `requireServicesAt: 'lookup'` IS WHAT LETS IT BE BUILT ONCE, AT IMPORT. The mint needs an
+ *   `HttpClient`; that requirement moves to each `get`, where every caller already has one.
+ * ⚠️ EXPORTED FOR THE TEST, which hands it a counting mint instead of calling OpenBao.
+ */
+export declare const makeLeases: <E, R>(mintFor: (key: LeaseKey) => Effect.Effect<PveCredential, E, R>) => Effect.Effect<Cache.Cache<LeaseKey, PveCredential, E, R>, never, never>;
+/**
+ * A credential for `role` on `target`: a still-valid lease when one is kept, one shared mint when
+ * not.
+ *
+ * ★ client.ts is the one place that decides to use the cache. `mint` stays exported and unchanged
+ *   for the caller that reasons about identity rather than cost — network-apply.ts.
+ */
+export declare const leased: (target: ApiTarget, role: PveRole) => Effect.Effect<PveCredential, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=lease-cache.d.ts.map

package/dist/proxmox/lease-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-cache.d.ts","sourceRoot":"","sources":["../../src/proxmox/lease-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,KAAK,OAAO,EAAQ,MAAM,kBAAkB,CAAC;AAe1F;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;CACtC,CAAC;AAQF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,SAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,KAAG,QAAQ,CAAC,QAG3D,CAAC;AAEpB;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,4EACX,CAAC;AASrF;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,WAAY,SAAS,QAAQ,OAAO,8FAA2C,CAAC"}

package/dist/proxmox/lxc.d.ts

@@ -0,0 +1,59 @@
+/**
+ * `Proxmox.Lxc` — a container, declared. This is what the estate's provision credential exists for.
+ *
+ * ★ `hf-provision@pve` HOLDS EXACTLY THE ROLE THIS NEEDS, and nothing more: `LXCProvisioner` on `/`
+ *   grants VM.Allocate, VM.Audit, VM.Config.{CPU,Disk,HWType,Memory,Network,Options},
+ *   VM.PowerMgmt, Datastore.AllocateSpace, Datastore.Audit, SDN.Use, Sys.Audit. Read that list as a
+ *   specification: the credential was scoped to provision containers and to do nothing else.
+ *
+ * ⛔ `vmid` IS THE PRIMARY KEY AND IT IS CLUSTER-WIDE, not per node. Two resources declaring the
+ *   same vmid on different nodes are the same object, and PVE will refuse the second with
+ *   "already exists". It is required rather than allocated here: letting the provider pick the next
+ *   free id would make the identity of a container depend on the order plans happened to run in.
+ *
+ * ⚠️ MOST FIELDS ARE CREATE-TIME. `ostemplate` and `storage` are consumed when the rootfs is built
+ *   and are not readable back afterwards, so they are deliberately NOT compared in `matches` --
+ *   a provider that diffed them would report an update on every plan, forever. What is compared is
+ *   what PVE will actually tell you about a running container.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import { type PveRequirements, type WithTarget } from './resource.ts';
+export interface LxcProps extends WithTarget {
+    /** Which node hosts it. Moving a container between nodes is a migration, not an update. */
+    node: string;
+    /** ⛔ CLUSTER-WIDE primary key. Required, never auto-allocated — see the ⛔ above. */
+    vmid: number;
+    /** e.g. `local:vztmpl/debian-13-standard_13.0-1_amd64.tar.zst`. Create-time only. */
+    ostemplate: string;
+    /** Storage for the rootfs, e.g. `local-zfs`. Create-time only. */
+    storage: string;
+    hostname?: string;
+    /** MiB. Mutable. */
+    memory?: number;
+    cores?: number;
+    /** e.g. `name=eth0,bridge=vmbr0,ip=dhcp`. Mutable. */
+    net0?: string;
+    /** Start on boot. Mutable. */
+    onboot?: boolean;
+}
+export interface LxcAttributes {
+    vmid: number;
+    node: string;
+    hostname: string;
+    memory: number;
+    cores: number;
+    onboot: boolean;
+    /** `running` | `stopped`. Reported, never declared — power state is not configuration. */
+    status: string;
+}
+export interface ProxmoxLxc extends Resource<'Proxmox.Lxc', LxcProps, LxcAttributes, never, PveRequirements> {
+}
+export declare const ProxmoxLxc: import("alchemy").ResourceClass<ProxmoxLxc>;
+/**
+ * ⛔ PVE REFUSES TO DELETE A RUNNING CONTAINER, and that refusal is kept — `handlers.delete`
+ *   passes it straight through. Stopping a guest so that a `destroy` can proceed is a decision an
+ *   operator makes, not one a plan makes on their behalf while they are reading the diff.
+ */
+export declare const ProxmoxLxcProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxLxc>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=lxc.d.ts.map

package/dist/proxmox/lxc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8BAA8B;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAgD9D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gIACgD,CAAC"}

package/dist/proxmox/members.d.ts

@@ -0,0 +1,56 @@
+/**
+ * TB4 cluster members: ordered failover, last-good preference, transport classification.
+ *
+ * ★ ANY MEMBER'S :8006 API MANAGES THE WHOLE CLUSTER — PVE proxies node paths itself — so the
+ *   provider reaches the cluster through whichever member is up, not through one pinned node.
+ *
+ * ⛔ NEVER cluster-tb4.example.com: it resolves to 10.20.10.250, which nothing serves.
+ */
+import * as Effect from 'effect/Effect';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';
+import type * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';
+import type { PveTarget } from './credentials.ts';
+export declare const PVE_API_PORT = 8006;
+/** Strict TLS, always :8006 — each node's certificate carries its mgmt name as a SAN. */
+export declare const pveApiBase: (member: string) => string;
+/** ⚠️ TESTS ONLY — resets sticky member choice between cases. */
+export declare const resetLastGoodForTest: () => void;
+export declare const noteGoodMember: (target: PveTarget, member: string) => void;
+/** Last-good first, then the rest in configuration order. */
+export declare const orderedMembers: (target: PveTarget) => readonly string[];
+/**
+ * Effect HttpClientError.reason._tag — see effect HttpClientError.ts RequestError vs ResponseError.
+ * ★ TransportError | InvalidUrlError | EncodeError occur before a response exists; StatusCodeError
+ *   and kin include a response. client.execute does NOT filter status, so HTTP answers are never
+ *   TransportError — only the transport layer is.
+ */
+export declare const isTransportFailure: (cause: unknown) => boolean;
+/** Pre-send only: connection refused, DNS, a certificate refused — never a timeout after connect. */
+export declare const isPreSendTransport: (cause: unknown) => boolean;
+export declare const describeTransport: (cause: unknown) => string;
+export type MemberAttempt = {
+    readonly member: string;
+    readonly why: string;
+};
+export type PveMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';
+/**
+ * Run one request against cluster members with failover.
+ *
+ * ⛔ A POST/PUT/DELETE WHOSE REQUEST MAY HAVE REACHED A MEMBER MUST NOT BE SENT AGAIN TO ANOTHER.
+ *   Only fail over a write on a provably pre-send transport failure — connection refused, DNS or a
+ *   refused certificate. A timeout after sending is NOT pre-send: fail it, never repeat it. An HTTP
+ *   status of any kind, including 5xx and PVE's 596, is the answer from a live member — retrying
+ *   elsewhere can repeat a write.
+ *
+ * ★ Reads fail over on any transport failure, including timeout — no side effect to duplicate.
+ *   MEASURED 2026-09-14: full TB4 plans stayed all-noop with the first member refused (127.0.0.1)
+ *   and with it unresolvable (n9.invalid).
+ */
+export declare const executeOnCluster: (target: PveTarget, method: PveMethod, path: string, build: (apiBase: string) => HttpClientRequest.HttpClientRequest) => Effect.Effect<HttpClientResponse.HttpClientResponse, {
+    readonly tag: 'cluster';
+    readonly method: PveMethod;
+    readonly path: string;
+    readonly attempts: readonly MemberAttempt[];
+}, HttpClient.HttpClient>;
+//# sourceMappingURL=members.d.ts.map

package/dist/proxmox/members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.d.ts","sourceRoot":"","sources":["../../src/proxmox/members.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAE9D,OAAO,KAAK,KAAK,iBAAiB,MAAM,wCAAwC,CAAC;AACjF,OAAO,KAAK,KAAK,kBAAkB,MAAM,yCAAyC,CAAC;AACnF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,eAAO,MAAM,YAAY,OAAO,CAAC;AAEjC,yFAAyF;AACzF,eAAO,MAAM,UAAU,WAAY,MAAM,WAA0D,CAAC;AAKpG,iEAAiE;AACjE,eAAO,MAAM,oBAAoB,YAAgC,CAAC;AAElE,eAAO,MAAM,cAAc,WAAY,SAAS,UAAU,MAAM,SAE/D,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,cAAc,WAAY,SAAS,KAAG,SAAS,MAAM,EAIjE,CAAC;AA2CF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,UAAW,OAAO,KAAG,OAInD,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,kBAAkB,UAAW,OAAO,KAAG,OASnD,CAAC;AAEF,eAAO,MAAM,iBAAiB,UAAW,OAAO,KAAG,MAGlD,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9E,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB,WACnB,SAAS,UACT,SAAS,QACX,MAAM,SACL,CAAC,OAAO,EAAE,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,KAC9D,MAAM,CAAC,MAAM,CACd,kBAAkB,CAAC,kBAAkB,EACrC;IACE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C,EACD,UAAU,CAAC,UAAU,CAmCnB,CAAC"}

package/dist/proxmox/metric-server-form.d.ts

@@ -0,0 +1,53 @@
+/**
+ * A metric server's props, as the form PVE wants.
+ *
+ * ★ SPLIT OUT OF metric-server.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a
+ *   real one rather than a convenient line number: this file answers "how does a declaration
+ *   become a PVE form", and metric-server.ts answers "what is a metric server and when has it
+ *   changed". Nothing here reads the cluster and nothing here decides a diff.
+ *
+ * ⚠️ THE `import type` BACK TO metric-server.ts IS A CYCLE ON PAPER ONLY. It is type-only, so it
+ *   is erased before anything runs — `MetricServerProps` stays the resource's public shape, in the
+ *   file that declares the resource, rather than being moved somewhere odd to dodge the arrow.
+ *   metric-server-otel.ts imports `UNSET` from here and this file imports nothing back from it,
+ *   so no runtime cycle exists either.
+ */
+import type { MetricServerProps } from './metric-server.ts';
+/**
+ * ⚠️ "NOT SET" CANNOT BE 0 HERE, WHICH IS WHY IT IS -1. `timeout` has a minimum of 0 in PVE's
+ *   schema, so a deliberate `timeout 0` exists; a provider using 0 as its absent-marker reads that
+ *   zero as "unset" and never clears it. -1 is outside every one of these fields' ranges.
+ */
+export declare const UNSET = -1;
+/**
+ * Every managed optional, per type: the value to send, or undefined for "clear it".
+ *
+ * ⛔ ONE TABLE FEEDS BOTH HALVES OF AN UPDATE, AND THAT IS THE POINT. A PUT THAT OMITS A FIELD DOES
+ *   NOT CLEAR IT — PVE merges the form into the existing section — so a managed optional needs a
+ *   matching `delete=` the moment its prop goes away, or `matches` reports an update on every plan
+ *   forever. Deriving the form and the delete list from one map makes "managed but not clearable"
+ *   impossible to write here, which a separate clear-list would not.
+ * ⛔ NOTHING SET OUT OF BAND MAY BE LISTED HERE, `token` FIRST AMONG THEM: a field in this map is
+ *   CLEARED whenever it is undeclared, so adding the token would strip a working target's
+ *   credential on the next plan — metrics stop, nothing errors, the graph goes flat. `otel-headers`
+ *   is absent for the same reason: it is where an OTLP server's bearer token lives.
+ * ⚠️ AND THE BRANCHES CANNOT BE ONE SHARED MAP. PVE validates a section against that plugin's own
+ *   option set, so `path` on an influxdb server is a hard 400 and `delete=path` there answers "no
+ *   such option" — neither is an ignored hint. The opentelemetry plugin has no `mtu` and no
+ *   `timeout` at all (its option list is `server`, `port`, `disable` and the `otel-*` family), so
+ *   that branch carries neither.
+ * ⚠️ graphite's `proto` (udp or tcp) is deliberately absent: a transport chosen by hand stays put
+ *   and no plan diffs it. Managing it means adding it HERE, where it is clearable by construction.
+ *   `otel-resource-attributes` is absent for the reason metric-server-otel.ts gives.
+ */
+export declare const optional: (props: MetricServerProps) => Record<string, string | undefined>;
+export declare const body: (props: MetricServerProps) => Record<string, string>;
+/**
+ * An update's form: everything `body` sends, plus a `delete=` naming each managed optional that is
+ * no longer declared.
+ *
+ * ★ MOVED HERE FROM metric-server.ts UNCHANGED, so the test beside this file can reach the form an
+ *   update really sends instead of re-deriving it and testing its own copy.
+ */
+export declare const update: (props: MetricServerProps) => Record<string, string>;
+//# sourceMappingURL=metric-server-form.d.ts.map

package/dist/proxmox/metric-server-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metric-server-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/metric-server-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAG5D;;;;GAIG;AACH,eAAO,MAAM,KAAK,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,QAAQ,UAAW,iBAAiB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAuBpF,CAAC;AAqCF,eAAO,MAAM,IAAI,UAAW,iBAAiB,2BAM5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,UAAW,iBAAiB,2BAK9C,CAAC"}

package/dist/proxmox/metric-server-otel.d.ts

@@ -0,0 +1,49 @@
+export interface MetricServerOtelProps {
+    /**
+     * ⚠️ PVE'S DEFAULT IS `https`. `http` is for a receiver on the node itself, where the plaintext
+     *   never leaves the host; anything further away belongs on `https`.
+     */
+    'otel-protocol'?: 'http' | 'https';
+    /** Unset is PVE's `/v1/metrics`. */
+    'otel-path'?: string;
+    /** Unset is PVE's `gzip`, sent as `Content-Encoding: gzip`. */
+    'otel-compression'?: 'none' | 'gzip';
+    /**
+     * Per-request HTTP timeout, 1-10 seconds; unset is PVE's 5.
+     * ⚠️ pvestatd WAITS THIS LONG, PER REQUEST, AGAINST A RECEIVER THAT HANGS — the send is inline in
+     *   its update loop (`send`, line 635) — so this is also how long a broken receiver can stretch
+     *   one status cycle.
+     */
+    'otel-timeout'?: number;
+    /** Minimum 1024; unset is PVE's 10000000. pvestatd splits one flush into requests under it. */
+    'otel-max-body-size'?: number;
+    /** ⚠️ An unset `otel-verify-ssl` means VERIFY — PVE's default, and the safe one. */
+    'otel-verify-ssl'?: boolean;
+    /** ⛔ `never` ON PURPOSE — see the ⛔ in the header. The compile error is the feature. */
+    'otel-headers'?: never;
+}
+/**
+ * ⚠️ THE SAME RULES AS THE REST OF `MetricServerAttributes`. The strings report `''` when the
+ *   section carries none — PVE's default is then what the target uses — the numbers report `UNSET`
+ *   for the same reason, and `otel-verify-ssl` reports its default directly, because "absent"
+ *   there means the target verifies.
+ */
+export interface MetricServerOtelAttributes {
+    'otel-compression': string;
+    'otel-max-body-size': number;
+    'otel-path': string;
+    'otel-protocol': string;
+    'otel-timeout': number;
+    'otel-verify-ssl': boolean;
+}
+/** The `otel-*` half of a live section. Read for every type; compared only for this one. */
+export declare const otelAttributes: (live: Record<string, unknown>) => MetricServerOtelAttributes;
+/**
+ * True when every managed `otel-*` field already says what the declaration says.
+ *
+ * ⛔ EVERY FIELD `optional` SENDS OR CLEARS IS COMPARED HERE, AND NOTHING ELSE IS. A field sent but
+ *   not compared is drift a plan can never show; a field compared but not sent is an update the
+ *   PUT it triggers can never satisfy, reported forever.
+ */
+export declare const otelMatches: (attributes: MetricServerOtelAttributes, props: MetricServerOtelProps) => boolean;
+//# sourceMappingURL=metric-server-otel.d.ts.map

package/dist/proxmox/metric-server-otel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metric-server-otel.d.ts","sourceRoot":"","sources":["../../src/proxmox/metric-server-otel.ts"],"names":[],"mappings":"AAgCA,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,wFAAwF;IACxF,cAAc,CAAC,EAAE,KAAK,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,4FAA4F;AAC5F,eAAO,MAAM,cAAc,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,0BAO7D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,eACV,0BAA0B,SAC/B,qBAAqB,KAC3B,OAMqE,CAAC"}

package/dist/proxmox/metric-server.d.ts

@@ -0,0 +1,123 @@
+/**
+ * `Proxmox.MetricServer` — where the cluster ships its metrics, declared.
+ *
+ * ★ THE FAILURE THIS PREVENTS IS A SILENT ONE, WHICH IS THE WHOLE ARGUMENT FOR DECLARING IT.
+ *   Undeclared, the target exists only as a section of `/etc/pve/status.cfg`: rebuild a node,
+ *   re-add one to the cluster, or restore a config from before it was configured, and the cluster
+ *   stops shipping. Nothing fails, no task errors, no alert fires — the graphs go flat, and the
+ *   first to find out is whoever went looking for a number that was not there.
+ *
+ * ⛔ CREATE IS `POST cluster/metrics/server/{id}` — THE OBJECT'S OWN PATH — SO `collection()`
+ *   RETURNS THE SAME STRING AS `path()`, AND THAT IS NOT A TYPO. MEASURED: a POST to the
+ *   collection answers "Method 'POST /cluster/metrics/server' not implemented", while the id path
+ *   gets as far as a permission check (`/`, Sys.Modify); the published schema agrees, giving the
+ *   collection a GET and nothing else. `createForm` omits `id` for the same reason — it is already
+ *   the last segment of the path being POSTed to, and a second copy can only disagree with it.
+ *
+ * ⛔ THE `token` IS WRITE-ONLY AND MUST NEVER BECOME AN ATTRIBUTE. Alchemy persists attributes
+ *   UNENCRYPTED, so one that reached state would outlive the change that set it, in the state
+ *   store and in every backup of it. It is `never` in the props below — declaring one is a COMPILE
+ *   ERROR rather than a leak found months later — and absent from `optional`, for the reason
+ *   given there. Set it out of band; PVE never returns it on a read anyway. `otel-headers`, where an
+ *   opentelemetry server's bearer token lives, gets the same treatment in metric-server-otel.ts.
+ *
+ * ⚠️ PRIVILEGES, AND THIS IS A BIGGER ASK THAN IT LOOKS. Read and diff are fine under an auditor
+ *   lease — the single-object GET checks `Sys.Audit` on `/` — while create, update and delete all
+ *   check `Sys.Modify` on `/` and answer "Permission check failed (/, Sys.Modify)" until the role
+ *   is widened. Widen it knowingly: the ACL path is the ROOT and there is no `/metrics` object to
+ *   scope to, so `Sys.Modify` also buys datacenter options, notification targets and every other
+ *   cluster-wide config write. A separate role for metric writes is the narrower answer.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import { type MetricServerOtelAttributes, type MetricServerOtelProps } from './metric-server-otel.ts';
+import { type PveRequirements, type WithTarget } from './resource.ts';
+/**
+ * PVE's status plugins. Which one a server is decides which fields it will even accept.
+ *
+ * ★ `opentelemetry` IS OFFERED SINCE 2026-09-14, AND THE REASON IT WAS NOT STILL HOLDS FOR ANY FIELD
+ *   LEFT OUT. Its whole configuration is the `otel-*` family; declared without managing that family
+ *   it would build a target whose every meaningful setting sat outside the graph, and report `noop`
+ *   over it. metric-server-otel.ts manages every `otel-*` field but two, and says why for each.
+ */
+export type MetricServerType = 'graphite' | 'influxdb' | 'opentelemetry';
+export interface MetricServerProps extends WithTarget, MetricServerOtelProps {
+    /** ⚠️ A `pve-configid` — a letter, then letters, digits, `-` and `_`. A rejected one fails with
+     *   "invalid configuration ID", which reads as a broken request rather than as a naming rule. */
+    id: string;
+    /**
+     * ⛔ CREATE-TIME ONLY. The PUT schema has no `type` parameter at all: a section's type is fixed
+     *   when it is written, so the ⛔ in `attributes` turns a changed type into a refusal rather than
+     *   a silent no-op over the wrong target.
+     */
+    type: MetricServerType;
+    /** ⚠️ REQUIRED ON EVERY WRITE, UPDATE INCLUDED — see `required`. */
+    server: string;
+    port: number;
+    /** Keep the section but stop shipping. Unset is an ENABLED target, not an absent one. */
+    disable?: boolean;
+    /**
+     * graphite and influxdb only: UDP MTU (512-65536) and socket/HTTP timeout. Unset leaves PVE's
+     * defaults, 1500 and 1. ⚠️ opentelemetry has neither; its timeout is `otel-timeout`.
+     */
+    mtu?: number;
+    timeout?: number;
+    /** graphite only: the root path metrics are published under, e.g. `proxmox.mycluster`. */
+    path?: string;
+    /**
+     * influxdb only. `udp` is PVE's default and writes line protocol; `http`/`https` use the v2 API,
+     * the only place `organization` and `bucket` mean anything. An unset `verify-certificate` means
+     * VERIFY — PVE's default, and the safe one.
+     * ⚠️ PVE's hyphenated names are kept rather than camelCased, so nothing between here and the form
+     *   body has to remember a mapping.
+     */
+    influxdbproto?: 'udp' | 'http' | 'https';
+    organization?: string;
+    bucket?: string;
+    'api-path-prefix'?: string;
+    'max-body-size'?: number;
+    'verify-certificate'?: boolean;
+    /** ⛔ `never` ON PURPOSE — see the ⛔ in the header. The compile error is the feature. */
+    token?: never;
+}
+/**
+ * ⛔ NO `digest`, ON PURPOSE. PVE returns one with every read, but it is the digest of the WHOLE
+ *   `status.cfg` rather than of this section — declaring a SECOND metric server would rewrite this
+ *   one's stored attributes, and comparing it would report an update on a target nobody touched.
+ *   ⛔ And no `token`, for the reason the header gives at length.
+ * ⚠️ `mtu`, `timeout` and `max-body-size` report `UNSET` when the section carries none, i.e. when
+ *   PVE's own default is what the target will use; `verify-certificate` reports that default
+ *   directly, because "absent" there means the target verifies. `port` reports 0 only for a
+ *   malformed section — PVE requires a port — so a plan should say so loudly. The `otel-*` half
+ *   follows the same rules; see metric-server-otel.ts.
+ */
+export interface MetricServerAttributes extends MetricServerOtelAttributes {
+    id: string;
+    type: MetricServerType;
+    server: string;
+    port: number;
+    disable: boolean;
+    mtu: number;
+    timeout: number;
+    path: string;
+    influxdbproto: string;
+    organization: string;
+    bucket: string;
+    'api-path-prefix': string;
+    'max-body-size': number;
+    'verify-certificate': boolean;
+}
+export interface ProxmoxMetricServer extends Resource<'Proxmox.MetricServer', MetricServerProps, MetricServerAttributes, never, PveRequirements> {
+}
+export declare const ProxmoxMetricServer: import("alchemy").ResourceClass<ProxmoxMetricServer>;
+/**
+ * ⛔ THE EMPTY `list` FROM `pveHandlers` EARNS ITS KEEP HERE. `GET cluster/metrics/server` answers
+ *   with every target the cluster already ships to, including the one somebody configured by hand
+ *   years ago; adopting that is how a later `alchemy destroy` silences a graph nobody declared.
+ * ⚠️ AND NOTHING BRAKES THIS DESTROY. A pool refuses while it holds guests, a container while it
+ *   runs; a metric server just leaves `status.cfg`, the cluster stops shipping on the next
+ *   interval, and no guest or task is affected. The plan diff is the only warning anyone gets —
+ *   the top of this file again, this time caused by a deploy.
+ */
+export declare const ProxmoxMetricServerProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxMetricServer>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=metric-server.d.ts.map

package/dist/proxmox/metric-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metric-server.d.ts","sourceRoot":"","sources":["../../src/proxmox/metric-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAG3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;AAEzE,MAAM,WAAW,iBAAkB,SAAQ,UAAU,EAAE,qBAAqB;IAC1E;qGACiG;IACjG,EAAE,EAAE,MAAM,CAAC;IACX;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,wFAAwF;IACxF,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAuB,SAAQ,0BAA0B;IACxE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAAwD,CAAC;AA0EzF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,yIACyD,CAAC"}

package/dist/proxmox/network-apply-read.d.ts

@@ -0,0 +1,93 @@
+/**
+ * How this package finds out what a node has STAGED, and whether the cluster survived an apply.
+ *
+ * ★ SPLIT OUT OF network-apply.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a real
+ *   one rather than a convenient line number: this file answers "what is true on the cluster right
+ *   now", network-apply.ts answers "what does the resource do about it". Nothing here decides a
+ *   diff, and the only write in either file is the apply itself.
+ *
+ * ⛔ THE PENDING STATE IS NOT IN `data`, WHICH IS WHY THIS FILE DOES ITS OWN FETCH. MEASURED in the
+ *   cluster's own source on n2, 2026-09-13 — not inferred from documentation:
+ *     PVE/API2/Network.pm   my $tmp = PVE::INotify::read_file('interfaces', 1);
+ *                           $rpcenv->set_result_attrib('changes', $changes) if $changes;
+ *     PVE/HTTPServer.pm     if (my $diff = $rpcenv->get_result_attrib('changes')) {
+ *                               $resp->{changes} = $diff;
+ *                           }
+ *   So the answer is `{"data":[…interfaces…],"changes":"<unified diff>"}`: `changes` is a SIBLING
+ *   of `data`, set only when the diff is non-empty. `client.ts`'s `pve()` returns `body.data` and
+ *   drops the envelope, so the one readable pending signal is invisible to every other resource in
+ *   this package. Without the fetch below, `Proxmox.NetworkApply` could not diff honestly at all.
+ *   ★ `pveEnvelopeWith` in client.ts now carries the same member failover as every other call.
+ *
+ * ⛔ AND THE INTERFACE ROWS CANNOT TELL YOU EITHER. MEASURED in PVE/INotify.pm `read_file`: when
+ *   `/etc/network/interfaces.new` exists, THAT is the file that gets parsed, so
+ *   `GET /nodes/{node}/network` answers with the STAGED config and a node about to be reconfigured
+ *   looks identical to one already running it. Same trap `sdn-apply.ts` documents for `?running=1`.
+ *
+ * ⚠️ `active` IS NOT A PENDING SIGNAL, AND THE OBVIOUS SHORTCUT IS MEASURABLY WRONG. On n2 and n3,
+ *   with nothing staged anywhere (VERIFIED 2026-09-13: `/etc/network/interfaces.new` absent on n2,
+ *   n3 and n4), `wlp91s0` already comes back with no `active` key at all. Counting interfaces that
+ *   are not up as "pending" would report an update on two of the three nodes forever.
+ *
+ * ⚠️ ONE THING GENUINELY CANNOT BE SEEN FROM HERE, AND IT IS SMALL. The diff is computed as
+ *   `diff -b -N -u`, so a staged file differing from the live one ONLY in whitespace produces no
+ *   `changes` at all. This module reports that node as settled while `interfaces.new` still sits
+ *   there waiting for the next reload anybody triggers. The file's existence is not exposed by the
+ *   API in any other form, so the alternative is not a better read — it is SSH.
+ */
+import * as Effect from 'effect/Effect';
+import { type PveCredential, type PveTarget } from './credentials.ts';
+/** What the cluster looked like the moment it was asked. Never persisted — see network-apply.ts. */
+export type ClusterHealth = {
+    quorate: boolean;
+    offline: readonly string[];
+};
+/**
+ * Changed lines in a unified diff.
+ *
+ * ⚠️ A NON-EMPTY DIFF IS NEVER REPORTED AS ZERO, WHICH IS WHAT `Math.max` IS FOR. The `+++`/`---`
+ *   headers have to be skipped, and a removed line whose own text starts with `---` is skipped with
+ *   them; a staged change consisting of nothing else would otherwise count 0 and be reported as
+ *   "settled", which is the exact lie this resource exists to prevent. The count is informational —
+ *   the resource only ever compares it to zero — so an occasional undercount of 1 is harmless while
+ *   an undercount to zero is not.
+ */
+export declare const pendingLines: (diff: string) => number;
+/** How many staged lines this node is carrying. Zero is the only settled value. */
+export declare const pendingCount: (target: PveTarget, node: string) => Effect.Effect<number, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * Why the cluster is not healthy, or `undefined` when it is.
+ *
+ * ★ A REASON RATHER THAN A BOOLEAN, BECAUSE THE CALLER'S ONLY USE FOR IT IS A REFUSAL MESSAGE.
+ *   "The deploy stopped because the cluster was degraded" is not actionable at three in the
+ *   morning; "quorate=true offline=[n3]" is. The two callers in network-apply.ts ask this before
+ *   the reload and again after it, and the second answer is the one that stops the chain from
+ *   reaching the next node.
+ *
+ * ⚠️ A MEMBER OFFLINE FOR AN UNRELATED REASON BLOCKS EVERY APPLY, AND THAT IS THE INTENDED
+ *   BEHAVIOUR RATHER THAN AN OVERSIGHT. A node down for maintenance is one failure away from the
+ *   pools losing min_size; reloading another node's networking while it is out is the move that
+ *   completes the outage. Bring it back, or apply by hand with the cluster in front of you.
+ */
+export declare const degradedReason: (target: PveTarget) => Effect.Effect<string | undefined, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * ⛔ NOT AN EXITSTATUS PVE CAN RETURN, AND THAT IS THE POINT. The caller compares against `'OK'`;
+ *   these two say WHY the answer is not OK without needing a second branch for "we do not know".
+ */
+export declare const UNREACHABLE = "the task could not be read -- the node stopped answering, or this lease cannot see it";
+/**
+ * Wait for one `srvreload` task and answer its exitstatus.
+ *
+ * ⛔ THE APPLY IS ASYNCHRONOUS AND ITS 200 MEANS NOTHING. MEASURED: `reload_network_config` ends
+ *   `return $rpcenv->fork_worker('srvreload', 'networking', $authuser, $worker)`, so the PUT
+ *   returns a UPID the instant the worker is forked — before `ifreload -a` has run, let alone
+ *   succeeded. Waiting for the task is the only way to learn the outcome.
+ *
+ * ⛔ AND IT MUST BE POLLED WITH THE CREDENTIAL THAT STARTED IT. The task-status schema says
+ *   `"user": "all"` with the note "needs 'Sys.Audit' on '/nodes/<node>' if they are not the owner
+ *   of the task". Every mint returns a NEW token id, so a second mint is a different identity and
+ *   is not the owner — which is why this takes a `PveCredential` and the caller keeps one lease
+ *   across both calls, instead of widening the provisioning role to read its own tasks.
+ */
+export declare const awaitTask: (target: PveTarget, credential: PveCredential, node: string, upid: string) => Effect.Effect<string, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=network-apply-read.d.ts.map

package/dist/proxmox/network-apply-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-apply-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAatE,oGAAoG;AACpG,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AA0B7E;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,WAWxC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,WAAY,SAAS,QAAQ,MAAM,uFACH,CAAC;AAiC1D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,WAAY,SAAS,mGAO7C,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,0FACiE,CAAC;AAY1F;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS,WACZ,SAAS,cACL,aAAa,QACnB,MAAM,QACN,MAAM,uFAgCV,CAAC"}