@homeflare/alchemy 0.1.0

package/dist/proxmox/network-apply.d.ts

@@ -0,0 +1,102 @@
+/**
+ * `Proxmox.NetworkApply` — the call that makes a declared interfaces file real, ON ONE NODE.
+ *
+ * ⛔ WITHOUT IT EVERY NETWORK DECLARATION IS A GREEN PLAN THAT CHANGES NO NETWORK; WITH IT A GREEN
+ *   PLAN CAN TAKE A NODE OFF THE NETWORK. Writes under `nodes/{node}/network/{iface}` edit
+ *   `/etc/network/interfaces.new` and touch no interface. `PUT /nodes/{node}/network` is the apply.
+ *   MEASURED in the cluster's own source on n2, 2026-09-13 — `PVE/API2/Network.pm`:
+ *       rename($new_config_file, $current_config_file) if -e $new_config_file;
+ *       PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err);
+ *       return $rpcenv->fork_worker('srvreload', 'networking', $authuser, $worker);
+ *
+ * ⛔ THIS IS THE MOST DANGEROUS RESOURCE IN THE PACKAGE, AND ON TB4 THE DANGER IS NOT ABSTRACT.
+ *   Ceph runs over `vmbr1.11` on n2, n3 AND n4 (MEASURED 2026-09-13: four pools, size 3 /
+ *   min_size 2, mon+mgr+mds on all three). `ifreload -a` takes that node's OSDs, mons and MDS off
+ *   the cluster network for the length of the reload; two nodes at once puts every pool below
+ *   min_size and blocks IO for every guest with an RBD disk. The management address the API is
+ *   reached on, `vmbr0.10`, is reloaded by the same call.
+ *
+ * ⛔ AND UNLIKE `SdnApply` IT IS PER NODE, SO A HALF-RECONFIGURED CLUSTER IS THE DEFAULT FAILURE
+ *   MODE, NOT AN EDGE CASE. `PUT /cluster/sdn` publishes the whole cluster in one call; this
+ *   publishes exactly one node, so a stack holding three of these can apply n2, fail, and leave n3
+ *   and n4 on the old layout with Ceph spanning all three. Four things here exist only for that:
+ *     1. `after` SERIALISES THEM — chain n3 after n2 and n4 after n3, so at most one node is ever
+ *        mid-reload. Three declared in parallel is the outage, and nothing in Alchemy stops you.
+ *     2. `reconcile` REFUSES TO START on a cluster that is already degraded.
+ *     3. `reconcile` RE-CHECKS quorum and every member's `online` flag AFTER the reload and dies if
+ *        the cluster came back worse — which stops the chain before it reaches the second node.
+ *     4. NOTHING IS EVER APPLIED WITH NOTHING STAGED. See the first branch of `apply`.
+ *
+ * ⚠️ IF THE MEMBER SERVING THE POLL IS THE NODE BEING RELOADED, the reload can drop the connection
+ *   carrying its own status poll — see network-apply-read.ts. Every endpoint is `proxyto =>
+ *   'node'`, so any cluster member can serve any other node's paths; failover in client.ts picks
+ *   whichever member is up, not necessarily one you are not applying.
+ *
+ * ⚠️ `DELETE /nodes/{node}/network` IS THE REVERT, AND IT IS DELIBERATELY NOT WIRED TO `delete`.
+ *   MEASURED: the whole body of `revert_network_changes` is `unlink "/etc/network/interfaces.new"`.
+ *   It discards STAGED edits and cannot undo an APPLIED one, so pointing `delete` at it would throw
+ *   away whatever happened to be staged the moment somebody removed a line from a stack file — the
+ *   worst possible time to do it. Revert by hand, deliberately: `pvesh delete /nodes/<node>/network`.
+ *
+ * ⚠️ PRIVILEGES, so widening stays a deliberate act: the `read` role needs nothing for the pending
+ *   read (`GET /nodes/{node}/network` is `"user": "all"`) and `Sys.Audit` on `/` for the health
+ *   gate; the `provision` role needs `Sys.Modify` on `/nodes/{node}` for the apply, and owns the
+ *   task it starts so it can poll it without `Sys.Audit`. ⛔ `Sys.Modify` ON A NODE IS NOT A SMALL
+ *   GRANT — it also carries that node's DNS, hosts file, time and service configuration. Granting
+ *   it cluster-wide to run this resource widens the provisioning role well beyond networking.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type { PveRequirements } from './resource.ts';
+import type { WithTarget } from './resource.ts';
+export interface NetworkApplyProps extends WithTarget {
+    /**
+     * The node whose staged interfaces file this applies — `n2`.
+     *
+     * ⚠️ ONE APPLY PER NODE, AND NEVER TWO FOR THE SAME NODE. Two would each publish the other's
+     *   staged half, and both would run `ifreload` on a file the other had not finished writing.
+     */
+    node: string;
+    /**
+     * The staged interface changes this apply publishes, and the apply that must go before it.
+     *
+     * ⚠️ IT IS NEVER READ, AND IT IS NOT DECORATION — the same contract as `SdnApply.after`. Alchemy
+     *   orders resources by DATA FLOW, so consuming an attribute is the only way to say "after".
+     *   Pass the interfaces this node declares AND the previous node's apply:
+     *   `after: [vmbr1.iface, n2Apply.pending]`. Leave the previous apply out and the three nodes
+     *   reload in parallel, which is the one thing this resource is built to prevent.
+     */
+    after?: readonly unknown[];
+}
+export interface NetworkApplyAttributes {
+    /** The node this applies. Identity, echoed so a plan line says which member it will reload. */
+    node: string;
+    /**
+     * Changed lines still staged on this node.
+     *
+     * ⚠️ LINES OF A UNIFIED DIFF, NOT INTERFACES, and the number is reported rather than trusted —
+     *   `pendingLines` explains why it can undercount by one and never to zero. Zero is the only
+     *   settled value: anything above it means the running config and the staged config disagree,
+     *   whether this stack staged it or somebody edited the node in the UI and walked away.
+     *
+     * ⛔ THE DIFF ITSELF IS NEVER AN ATTRIBUTE. Alchemy writes attributes to its state store
+     *   UNENCRYPTED, and `/etc/network/interfaces` can carry a `wpa-psk` or a `pre-up` command. Only
+     *   the count leaves `network-apply-read.ts`.
+     *
+     * ⚠️ AND NOTHING OUT OF THE INTERFACE ROWS IS AN ATTRIBUTE EITHER, WHICH IS WHAT KEEPS THIS
+     *   FAMILY NOOP. `GET /nodes/{node}/network` returns eighteen fields it will not accept on write
+     *   — MEASURED by differencing the schema's GET return properties against its POST parameters:
+     *   `active`, `exists`, `families`, `method`, `method6`, `options`, `priority`, `link-type` and
+     *   ten more; `altnames` is returned and is not even in the schema. `priority` is the worst of
+     *   them: PVE ASSIGNS it from the order of the interfaces file, so the same logical layout
+     *   carries different numbers on different nodes (MEASURED: n4's differ from n2/n3's by one).
+     *   Every one of those is a forever-diff waiting for whoever writes `Proxmox.NetworkInterface`.
+     *   This resource compares a single integer against zero and never looks at a row at all.
+     */
+    pending: number;
+}
+export interface ProxmoxNetworkApply extends Resource<'Proxmox.NetworkApply', NetworkApplyProps, NetworkApplyAttributes, never, PveRequirements> {
+}
+export declare const ProxmoxNetworkApply: import("alchemy").ResourceClass<ProxmoxNetworkApply>;
+export declare const ProxmoxNetworkApplyProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxNetworkApply>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=network-apply.d.ts.map

package/dist/proxmox/network-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-apply.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAAwD,CAAC;AA8HzF,eAAO,MAAM,2BAA2B,yIACyD,CAAC"}

package/dist/proxmox/node-network-form.d.ts

@@ -0,0 +1,128 @@
+/**
+ * How a node interface crosses the wire in both directions — props to a PVE form, a PVE answer to
+ * a comparable attribute — and when two of those values count as the same value.
+ *
+ * ★ SPLIT OUT OF node-network.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the
+ *   same one metric-server-form.ts uses, one field wider: this file owns the COERCIONS, in both
+ *   directions, because a read that normalises differently from the write that produced it is
+ *   exactly how a forever-diff is born — keeping `ifaceList` next to both ends is what stops that.
+ *   node-network.ts answers "what is an interface, and which of its fields are safe to compare at
+ *   all". Nothing here calls the cluster.
+ *
+ * ⚠️ THE `import type` BACK TO node-network.ts IS A CYCLE ON PAPER ONLY — type-only, erased before
+ *   anything runs, so `NodeNetworkProps` stays in the file that declares the resource.
+ *
+ * * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED, AND EACH ONE IS A MEASURED FOREVER-DIFF.
+ *   `priority` is assigned by PVE FROM FILE ORDER — `my $priority = 2; ... $d->{priority} =
+ *   $priority++` — and it is not a POST or PUT parameter at all. MEASURED ACROSS TB4: vmbr1.11 is
+ *   priority 16 on n2 and n3 and 15 on n4, because n4 has no `wlp91s0` above it. One declaration
+ *   reused across three nodes would diff on exactly one of them, forever, over nothing.
+ *   `method` is RECOMPUTED on every write from whether the form carried an address, `families` is
+ *   recomputed the same way and never written to the file, `active` and `exists` describe the
+ *   kernel rather than the config, and `bond_miimon`, `bridge_stp` and `bridge_fd` are emitted by
+ *   PVE's writer with defaults (100, `off`, 0) while appearing in NEITHER write schema —
+ *   `additionalProperties => 0` means sending one is a 400. Live proof of all three: n2's bond0
+ *   returns `bond_miimon "100"` and vmbr1 returns `bridge_stp "off"`, `bridge_fd "0"`, none of
+ *   which any declaration can set.
+ */
+import type { NodeNetworkAttributes, NodeNetworkProps } from './node-network.ts';
+/**
+ * "Not set", for the three integers this family reports.
+ *
+ * ⚠️ 0 CANNOT BE THE ABSENT-MARKER AND -1 CAN. `mtu` is 1280-65520, `vlan-id` 1-4094 and PVE's
+ *   `priority` starts at 1 (1 is reserved for `lo`), so -1 is outside every one of their ranges
+ *   while 0 is merely outside today's. metric-server-form.ts keeps its own constant for the same
+ *   reason and against different ranges; one shared UNSET would have to be right for both.
+ */
+export declare const UNSET = -1;
+/**
+ * A space-separated interface list, flattened to one comparable form.
+ *
+ * ⚠️ `bridge_ports` AND `slaves` ARE SETS, AND PVE NORMALISES THEIR SEPARATORS BUT NOT THEIR ORDER.
+ *   MEASURED in PVE::Network::Interfaces: the writer does `s/[;,\s]+/ /g` on both before emitting
+ *   them, and the reader hands the resulting string straight back — so `enp2s0f1np1 enp2s0f0np0`
+ *   survives a round trip in the order it was written. Order carries no meaning for a bridge's
+ *   ports or a bond's slaves, so a declaration that lists them the other way round is the SAME
+ *   declaration; comparing raw strings would report an update that rewrites the file to say
+ *   exactly what it already said. Both sides are sorted here and only then compared.
+ *
+ * ⚠️ IT IS NOT `csv` FROM values.ts. That one joins with commas, and a comma in
+ *   `/etc/network/interfaces` is not a separator — PVE's own comment above the writer says the
+ *   list "must be space separated! other separators will cause problems". Sending a comma-joined
+ *   value would be accepted by `split_list` and then written back as spaces, which is a second
+ *   spelling of one value and therefore a second chance to diff.
+ *
+ * ⚠️ `bridge_vids` GOES THROUGH THE SAME FUNNEL and its sort is LEXICAL, which is correct only
+ *   because a vid list is a set: `2-4094` is one token, and `100-200 2` and `2 100-200` allow the
+ *   same VLANs. Nothing here should be reused for a list whose order is meaning.
+ */
+export declare const ifaceList: (value: unknown) => string;
+/**
+ * A comment off the wire, with the newline PVE adds taken back off.
+ *
+ * ⛔ `comments` NEVER ROUND-TRIPS RAW, AND THAT IS A FOREVER-DIFF IF IT IS NOT NORMALISED.
+ *   MEASURED in the reader: each `#...` line is appended as `$comment . "\n"`, so a declared
+ *   `ceph transport` comes back as `ceph transport\n` and the two never compare equal.
+ * ⚠️ AND THE READER FOLDS `comments6` INTO `comments` (`$d->{comments} .= $comments6`), so on an
+ *   interface that carries an IPv6 comment a declared `comments` CANNOT match what comes back.
+ *   TB4 has none; on an interface that does, leave `comments` undeclared rather than fighting it.
+ */
+export declare const comment: (value: unknown) => string;
+/** Undeclared is unmanaged: neither sent nor compared. See the ⚠️ on `body`. */
+export declare const same: <T>(declared: T | undefined, live: T) => boolean;
+export declare const sameList: (declared: string | undefined, live: string) => boolean;
+export declare const sameComment: (declared: string | undefined, live: string) => boolean;
+/**
+ * The fields sent on EVERY write, create and update alike.
+ *
+ * ⚠️ UNDECLARED IS UNMANAGED — not sent, and not compared either. PVE's PUT MERGES the form into
+ *   the existing stanza (`foreach my $k (keys %$param) { $ifaces->{$iface}->{$k} = $param->{$k} }`),
+ *   so an omitted parameter is left exactly as it was. `cidr` is the one exception and it is not
+ *   a small one — see the ⛔ in node-network.ts.
+ *
+ * ⛔ `type` IS REQUIRED ON THE PUT, NOT ONLY ON THE POST. It carries no `optional` in either
+ *   schema, and the merge above writes it straight into the stanza — so a PUT naming the wrong
+ *   type would RETYPE A LIVE INTERFACE in the file and the writer would then emit a bridge stanza
+ *   for what is really a vlan. node-network.ts refuses that case before it can reach here.
+ *
+ * ⛔ `bridge_vlan_aware` IS SENT ONLY WHEN TRUE, AND A FALSE ONE IS A `delete=`. MEASURED in the
+ *   writer: the test is `if (defined($d->{bridge_vlan_aware}))`, not a truth test, so `0` is
+ *   defined and PVE writes `bridge-vlan-aware yes` anyway. Sending `0` would therefore turn the
+ *   flag ON, read back as `1`, and diff forever while lying about which way it went.
+ *
+ * ⚠️ `netmask` IS A WRITABLE PARAMETER AND IS DELIBERATELY NOT OFFERED. PVE raises
+ *   "netmask conflicts with cidr" when both are sent, and the reader rewrites whatever was written
+ *   into prefix form — MEASURED: n2's vmbr1.11 reports `"netmask":"24"`, never `255.255.255.0`.
+ *   A resource accepting both spellings would let a declaration diff against its own value.
+ */
+export declare const body: (props: NodeNetworkProps) => Record<string, string>;
+/**
+ * The update form: `body` plus the two fields that can only be cleared explicitly.
+ *
+ * ⛔ `delete=cidr` IS SENT WHENEVER `cidr` IS UNDECLARED, AND IT IS THE LESSER OF TWO EVILS RATHER
+ *   THAN A GOOD OUTCOME. PVE recomputes the method on every write from the form alone —
+ *   `$param->{method} = $param->{address} ? 'static' : 'manual'` — so a PUT WITHOUT an address
+ *   makes the interface manual no matter what the caller intended. Left at that, the merge would
+ *   leave the old `address` and `netmask` in the hash and the writer would emit an `address` line
+ *   under `iface … inet manual`: a stanza PVE's own UI cannot produce, whose behaviour under
+ *   `ifreload -a` I did NOT measure. Clearing cidr explicitly at least produces a clean, honest
+ *   manual interface — and `matches` compares `cidr` UNCONDITIONALLY, so the plan says so first.
+ *
+ * ⛔ ON vmbr1.11 THAT IS THE CEPH TRANSPORT. A declaration of that interface without its `cidr` is
+ *   a declaration that it should have no address, applied across three nodes. The plan will read
+ *   `1 to update` rather than `noop`; do not wave it through.
+ *
+ * ⚠️ `delete` IS A PUT-ONLY PARAMETER. The POST schema is `additionalProperties => 0` and has no
+ *   `delete`, so sending it on a create is a 400 — which is why `createForm` calls `body` directly.
+ */
+export declare const updateBody: (props: NodeNetworkProps) => Record<string, string>;
+/**
+ * One live interface as attributes, or `undefined` — "this is not really there".
+ *
+ * ⚠️ EVERY FIELD PVE REPORTS IS CARRIED HERE, INCLUDING THE SEVEN NO DECLARATION CAN SET. A plan
+ *   that cannot show `priority`, `method` or `bond_miimon` cannot explain why it is ignoring them,
+ *   and the next person to read a forever-diff would start by adding them to `matches`. They are
+ *   reported precisely so that they are visibly OUT of it — see the ⛔ above the attribute type.
+ */
+export declare const readAttributes: (live: Record<string, unknown>, props: NodeNetworkProps) => NodeNetworkAttributes | undefined;
+//# sourceMappingURL=node-network-form.d.ts.map

package/dist/proxmox/node-network-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-network-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGjF;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,UAAW,OAAO,WAK1B,CAAC;AAEf;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,UAAW,OAAO,WAAoC,CAAC;AAE3E,gFAAgF;AAChF,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,YACX,CAAC;AAE9C,eAAO,MAAM,QAAQ,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YACX,CAAC;AAEzD,eAAO,MAAM,WAAW,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YAChB,CAAC;AAKvD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAgBlE,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,UAAU,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAOzE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,SACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,gBAAgB,KACtB,qBAAqB,GAAG,SAuC1B,CAAC"}

package/dist/proxmox/node-network.d.ts

@@ -0,0 +1,173 @@
+/**
+ * `Proxmox.NodeNetwork` — one stanza of a node's `/etc/network/interfaces`, declared.
+ *
+ * ⛔ DECLARING THIS RESOURCE IS SAFE. APPLYING IT IS A SEPARATE, DELIBERATE ACT, AND IT IS NOT
+ *   PERFORMED HERE. Every write under `/nodes/{node}/network/{iface}` lands in
+ *   `/etc/network/interfaces.new` and changes no running interface. MEASURED, from PVE::INotify:
+ *   `$shadowfiles = { '/etc/network/interfaces' => '/etc/network/interfaces.new' }`, and
+ *   `read_file` reads the SHADOW when it exists. The apply is `PUT /nodes/{node}/network`, which
+ *   renames the shadow over the real file and runs `ifreload -a`; the revert is
+ *   `DELETE /nodes/{node}/network`, which simply unlinks the shadow. A sibling resource models
+ *   that apply — this one never calls it, exactly as `Proxmox.SdnZone` never calls
+ *   `Proxmox.SdnApply`.
+ *
+ * ⛔ CEPH ON TB4 RIDES TWO NETWORKS AND THIS API ONLY SEES ONE OF THEM. Measured from
+ *   `/etc/pve/ceph.conf` on 2026-09-13:
+ *
+ *     public_network  = 10.20.11.0/24     -> vmbr1.11, which this resource DOES see
+ *     cluster_network = 10.100.0.0/24     -> every OSD's cluster_addr: .102 / .103 / .104
+ *
+ *   The cluster network — OSD REPLICATION, the traffic that rebuilds a lost replica — lives on
+ *   `10.100.0.10X/32` addresses carried by `en05`, `en06` and `dummy_tb4`: the Thunderbolt mesh.
+ *
+ * ⛔ AND THOSE ADDRESSES ARE INVISIBLE HERE, WHICH IS THE TRAP. They are declared in
+ *   `/etc/network/interfaces.d/sdn`, and PVE's network API does not parse that directory.
+ *   MEASURED: `GET /nodes/n2/network/en05` answers `{"method":"manual","type":"eth",…}` with NO
+ *   address, while `ip -br -4 addr` shows `en05  UP  10.100.0.102/32`. So this resource reports
+ *   en05 and en06 as address-less manual ports and will plan `noop` over them — implicitly
+ *   asserting they carry no address, which is FALSE.
+ *
+ *   The consequence, stated plainly: declaring en05/en06 from what this API reports and then
+ *   DESTROYING or applying over them takes out OSD replication on a cluster whose pools are
+ *   size 3 / min_size 2. They read as the most boring interfaces on the node and are the two most
+ *   dangerous. Leave them undeclared; if they must be managed, manage the file that actually
+ *   owns them, not this resource.
+ *
+ * ⚠️ Two ways this file limits the damage on the interfaces it CAN see: `cidr` is compared
+ *   unconditionally (the ⛔ on `matches`), and a live interface whose `type` disagrees with the
+ *   declaration is reported ABSENT rather than retyped (the ⛔ in `attributes`).
+ *
+ * ★ THE REASON IT EXISTS IS THAT THE STAGED READ CANNOT TELL YOU THE NETWORK IS RIGHT — it can
+ *   only tell you the FILE is. Once anything is staged, `GET /nodes/{node}/network/{iface}`
+ *   answers from `interfaces.new`, so `matches` compares a declaration against a pending file and
+ *   reports `noop` over a node whose running config has not moved. The apply resource is what
+ *   closes that gap; this resource's `noop` means "the file says what you said", no more.
+ *
+ * ⚠️ PRIVILEGES ARE COARSER HERE THAN ANYWHERE ELSE IN THE PACKAGE: reads want `Sys.Audit` on
+ *   `/nodes/{node}`, every write `Sys.Modify` on it — and there is no `/nodes/{node}/network` ACL
+ *   object to scope to, so that also buys the node's services, certificates, DNS and time.
+ *   Collected with every other family in docs/privileges.md.
+ *
+ * ★ A RECONCILE OVER A MATCHING INTERFACE IS A NO-WRITE, AND AN EARLIER DRAFT OF THIS COMMENT
+ *   SAID THE OPPOSITE. `pveOperations.reconcile` gates on `matches` BEFORE the PUT
+ *   (`resource.ts`: `else if (spec.updateForm !== undefined && !spec.matches(live, news))`), and
+ *   the ⛔ above that line names THIS family as the reason the guard was added — adopting an
+ *   interface a node already has would otherwise leave it holding a pending network change.
+ *
+ * ⚠️ WHAT IS STILL TRUE: when `matches` is false the PUT rewrites the whole stanza, and that can
+ *   ADD lines the file did not have — a `vlan-raw-device vmbr1` under `vmbr1.11`, where PVE had
+ *   been deriving it from the name. Harmless in content, and it costs nothing until somebody
+ *   applies; one more reason the apply is a separate resource.
+ *
+ * ⚠️ `list` IS EMPTY, AND HERE THAT MATTERS MORE THAN ANYWHERE ELSE IN THIS PACKAGE. The index
+ *   returns every interface the node has, `vmbr0`, `bond0` and the Ceph vlan included. Adopting
+ *   them would put Alchemy one `destroy` away from staging the removal of a node's uplink — and
+ *   `delete_network` has NO in-use check at all: MEASURED, it deletes the hash entry and writes
+ *   the file. Adoption stays explicit.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import { type PveRequirements, type WithTarget } from './resource.ts';
+/**
+ * PVE's interface types. `unknown` is what a NIC it does not manage reports — n2 and n3 both
+ * report `wlp91s0` that way, and n4 has no such interface at all.
+ *
+ * ⚠️ THAT ASYMMETRY IS A TRAP FOR A DECLARATION SHARED ACROSS NODES. On n4 the read answers 404,
+ *   which this provider cannot tell from "deleted", so reconcile POSTs — writing a stanza for a
+ *   card that is not in the machine. Declare per node what each node actually has; a physical
+ *   interface is discovered, not decided.
+ */
+export type NodeNetworkType = 'OVSBond' | 'OVSBridge' | 'OVSIntPort' | 'OVSPort' | 'alias' | 'bond' | 'bridge' | 'eth' | 'fabric' | 'unknown' | 'vlan' | 'vnet';
+export interface NodeNetworkProps extends WithTarget {
+    /** Which node's file this stanza lives in. Interfaces are per node, never cluster-wide. */
+    node: string;
+    /** `vmbr0`, `bond0`, `vmbr1.11`. 2-20 characters, PVE's `pve-iface` format. */
+    iface: string;
+    /** ⛔ REQUIRED ON EVERY WRITE, update included, never used to retype — see `readAttributes`. */
+    type: NodeNetworkType;
+    /**
+     * `10.20.11.12/24`. ⛔ THE ONE FIELD WITH NO UNMANAGED MODE: leaving it out is an instruction
+     * to make the interface `manual`, not an instruction to leave its address alone. The ⛔ on
+     * `updateBody` in node-network-form.ts has the measurement and the consequence.
+     */
+    cidr?: string;
+    /** ⚠️ PVE allows exactly ONE default gateway per node and refuses a second with "Default
+     *  gateway already exists on interface '<other>'". On TB4 it is vmbr0.10's. */
+    gateway?: string;
+    /**
+     * `auto <iface>` in the file. Absent on read means off, which is why `bool`'s fallback is used.
+     * ⚠️ UNDECLARED IS UNMANAGED ON AN UPDATE AND OFF ON A CREATE — the same asymmetry storage.ts
+     *   has, and it bites harder here: an interface created without `autostart` is one the node
+     *   will not bring up at boot. Every TB4 bridge, bond and vlan carries it.
+     */
+    autostart?: boolean;
+    /** 1280-65520. Unset leaves the file without an `mtu` line and the kernel default in force. */
+    mtu?: number;
+    /** ⚠️ Round-trips only after normalisation — see `comment` in node-network-form.ts. */
+    comments?: string;
+    /** Space-separated, a SET: `enp87s0`, or `bond0`. ⚠️ PVE refuses a port already used elsewhere. */
+    bridge_ports?: string;
+    /** `2-4094`, or `2 100-200`. Only written when `bridge_vlan_aware` is on. */
+    bridge_vids?: string;
+    /** ⛔ A `false` here is sent as `delete=`, never as `0` — the ⛔ on `body` says why. */
+    bridge_vlan_aware?: boolean;
+    /**
+     * A bond's members, space separated. ⚠️ THE PARAMETER IS `slaves`, NOT `bond_slaves`, in BOTH
+     * directions on this PVE: MEASURED, the POST/PUT schema names only `slaves` and the GET returns
+     * `"slaves":"enp2s0f0np0 enp2s0f1np1"`. `bond_slaves` appears nowhere in Network.pm here.
+     */
+    slaves?: string;
+    bond_mode?: string;
+    /** ⚠️ Only written when `bond_mode` is `balance-xor` or `802.3ad`; ignored otherwise. */
+    bond_xmit_hash_policy?: string;
+    /** active-backup only. Kept hyphenated because that is the wire name. */
+    'bond-primary'?: string;
+    /** ⚠️ DERIVED FROM A DOTTED NAME. `vmbr1.11` reports `vlan-id` 11 with no such line in the file;
+     *  declaring it there is harmless but adds a line the file did not have. */
+    'vlan-id'?: number;
+    'vlan-raw-device'?: string;
+}
+/**
+ * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED — each is a MEASURED forever-diff, and the
+ *   evidence for every one of them is in node-network-form.ts, beside the code that reads them.
+ */
+export interface NodeNetworkAttributes {
+    node: string;
+    iface: string;
+    type: string;
+    cidr: string;
+    gateway: string;
+    autostart: boolean;
+    mtu: number;
+    comments: string;
+    bridge_ports: string;
+    bridge_vids: string;
+    bridge_vlan_aware: boolean;
+    slaves: string;
+    bond_mode: string;
+    bond_xmit_hash_policy: string;
+    'bond-primary': string;
+    'vlan-id': number;
+    'vlan-raw-device': string;
+    priority: number;
+    method: string;
+    families: string;
+    active: boolean;
+    exists: boolean;
+    bond_miimon: string;
+    bridge_stp: string;
+    bridge_fd: string;
+}
+export interface ProxmoxNodeNetwork extends Resource<'Proxmox.NodeNetwork', NodeNetworkProps, NodeNetworkAttributes, never, PveRequirements> {
+}
+/** ★ `retain` by default — a node's only uplink cannot be rebuilt. See the ★ in resource.ts. */
+export declare const ProxmoxNodeNetwork: import("alchemy").ResourceClass<ProxmoxNodeNetwork>;
+/**
+ * ⚠️ THE DESTROY IS STAGED LIKE EVERY OTHER WRITE, WHICH MAKES IT THE ONE RECOVERABLE DESTROY IN
+ *   THIS PACKAGE. It removes the stanza from `interfaces.new` and nothing else;
+ *   `DELETE /nodes/{node}/network` puts the node back by unlinking that file. It becomes
+ *   irreversible the moment somebody applies — and PVE performs NO in-use check before removing
+ *   an interface other bridges or Ceph still stand on.
+ */
+export declare const ProxmoxNodeNetworkProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxNodeNetwork>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=node-network.d.ts.map

package/dist/proxmox/node-network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-network.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAU7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,CAAC;AAEX,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,IAAI,EAAE,eAAe,CAAC;IACtB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;mFAC+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;gFAC4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAsCH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wIACwD,CAAC"}

package/dist/proxmox/notification-target-form.d.ts

@@ -0,0 +1,44 @@
+/**
+ * A notification target's props, as the form PVE wants — including the one field in this package
+ * that cannot be spelled as a comma list.
+ *
+ * ★ SPLIT OUT OF notification-target.ts TO KEEP BOTH UNDER THE 250-LINE CAP. The seam is the same
+ *   one metric-server uses: this file turns a declaration into a form, and the resource file says
+ *   what a target IS and when it has changed. The `import type` back is erased, so it is a cycle
+ *   on paper only.
+ */
+import type { NotificationTargetProps } from './notification-target.ts';
+/** ⚠️ `0` is "PVE holds no port". Integers have come back as strings elsewhere, so parse both. */
+export declare const portOf: (value: unknown) => number;
+/**
+ * ⚠️ ORDER IS NOT MEANING IN A RECIPIENT LIST, SO IT MUST NOT BE A DIFF — backup-job.ts's reasoning
+ *   about guest ids, applied to addresses. Both sides are sorted before they meet.
+ *
+ * ⚠️ PVE ANSWERS WITH AN ARRAY AND ACCEPTS A DELIMITED STRING, and this package has already been
+ *   bitten by a list coming back flattened on one version and structured on another (`groups` in
+ *   user.ts). PVE's UI calls `mailto` "separated by spaces, commas or semicolons", so all three are
+ *   split here and both shapes funnel into one comparable value.
+ */
+export declare const addressList: (value: unknown) => string;
+/** ⛔ NEVER SPLIT ON A COMMA: a header item contains one. A lone string is one item, not a list. */
+export declare const headerList: (value: unknown) => string;
+/**
+ * The form for both create and update.
+ *
+ * ⛔ A FIELD THE DECLARATION LEAVES OUT IS NOT SENT AND NOT COMPARED — backup-job.ts's rule rather
+ *   than sdn-vnet.ts's `delete` list, and here the choice is not close. That list would have to
+ *   name `mailto`, so a target adopted from the UI and declared without its recipients would have
+ *   them stripped on the first deploy: the one object that makes failures visible, turned back into
+ *   silence. `delete` on this family is also `type: array` rather than the comma string every other
+ *   endpoint takes, so sdn-vnet's encoding would not even carry.
+ *   ⚠️ THE PRICE IS THAT REMOVING A LINE DOES NOT CLEAR A FIELD. Declare it as `''` to clear it,
+ *     which IS sent: an empty string is a value, an absent prop is no request at all.
+ *
+ * ⚠️ `disable` IS ALWAYS SENT AND ALWAYS COMPARED, `0` INCLUDED. PVE documents the default as 0, so
+ *   sending it explicitly is what makes "not declared" and "declared false" one state instead of a
+ *   plan that asks for an update the PUT never performs. It is also the drift that matters most
+ *   here: a target disabled by hand during a maintenance window and never re-enabled looks exactly
+ *   like a healthy cluster.
+ */
+export declare const shape: (props: NotificationTargetProps) => Record<string, string>;
+//# sourceMappingURL=notification-target-form.d.ts.map

package/dist/proxmox/notification-target-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-target-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-target-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAoBxE,kGAAkG;AAClG,eAAO,MAAM,MAAM,UAAW,OAAO,KAAG,MAGvC,CAAC;AASF;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,UAAW,OAAO,KAAG,MAO1C,CAAC;AAEJ,mGAAmG;AACnG,eAAO,MAAM,UAAU,UAAW,OAAO,KAAG,MAC+C,CAAC;AAK5F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,KAAK,UAAW,uBAAuB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAkB1E,CAAC"}

package/dist/proxmox/notification-target.d.ts

@@ -0,0 +1,146 @@
+/**
+ * `Proxmox.NotificationTarget` — where a failed backup goes to be seen.
+ *
+ * ★ THE FAILURE MODE THIS REMOVES IS SILENCE. A failed vzdump, a lost HA service and a broken
+ *   replication job all reach a human through one mechanism: a notification target. Out of the box
+ *   a cluster has exactly one, the built-in `mail-to-root` — one mailbox, on one node, delivered by
+ *   that node's local MTA. Declared, a failure becomes visible; undeclared, nothing looks wrong
+ *   until somebody goes looking for a backup that was never taken. Every other resource in this
+ *   package fails loudly. This is the one whose absence fails quietly.
+ *
+ * ⛔ THE PER-OBJECT READ GOES THROUGH `endpoints/{type}/{name}`, NEVER `targets/{name}`.
+ *   `GET /cluster/notifications/targets/{name}` answers "Method not implemented" — MEASURED, and
+ *   corroborated by the cluster's own apidoc, where that path node carries no methods at all.
+ *   `/targets` is a READ-ONLY UNION VIEW implementing the collection GET and `{name}/test` and
+ *   nothing else. So `type` is IDENTITY here, not a setting: it appears in both `path()` and
+ *   `collection()`, and changing it is a replace rather than an update.
+ *
+ * ⚠️ A BUILT-IN TARGET CAN BE ADOPTED AND STILL NOT BE OWNED. The shipped entries report
+ *   `origin: builtin` or `modified-builtin`, and a DELETE on one REVERTS it to shipped defaults
+ *   instead of removing it: Alchemy drops the resource from state while the target is still on the
+ *   cluster delivering mail. Check `origin` on `/cluster/notifications/targets` before declaring a
+ *   name you did not create. ⚠️ `origin` IS DELIBERATELY NOT AN ATTRIBUTE — the schema returns it
+ *   on the collection view only, never on the per-object read, so an attribute would read "unknown"
+ *   for every object forever, and an attribute that always lies is worse than a true comment.
+ *
+ * ⛔ NO SECRET IS A PROP, LET ALONE AN ATTRIBUTE. smtp `password`, gotify `token` and webhook
+ *   `secret` are write-only and none is declarable here. Props are persisted too, not just
+ *   attributes — `delete` is handed `olds`, which can only have come from the state store — so a
+ *   secret prop would sit unencrypted in the state Postgres for as long as the resource exists.
+ *   ⚠️ THE COST IS REAL: `token` is REQUIRED on a gotify create, so a gotify target cannot be
+ *     created from here at all. Create one out of band with its secret and then declare it — the
+ *     read finds it, reconcile takes the PUT path, and PVE leaves any field the body does not
+ *     mention alone. The secret half stays a human's; the rest is declared. Same for an
+ *     authenticated smtp target and a signed webhook.
+ *
+ * ★ WHAT THIS NEEDS, READ OFF THE CLUSTER'S OWN SCHEMA:
+ *     read/diff  GET endpoints/{type}/{name}  Mapping.Audit (or Mapping.Modify) on
+ *                                             /mapping/notifications
+ *     reconcile  POST + PUT                   Mapping.Modify on /mapping/notifications AND one of
+ *                                             Sys.Audit / Sys.Modify / Sys.AccessNetwork on /
+ *     delete     DELETE                       Mapping.Modify on /mapping/notifications
+ *   `LXCProvisioner` already carries Sys.Audit on `/` (see lxc.ts), so the delta is the two Mapping
+ *   privileges — notably NOT the `Sys.Modify` a backup job costs.
+ *   ⚠️ PREFER A SECOND ROLE GRANTED AT `/mapping/notifications` OVER WIDENING THE PROVISIONING ROLE
+ *     ON `/`. `/mapping` also holds the PCI and USB passthrough maps, so Mapping.Modify at the root
+ *     lets a credential scoped to make containers rewire somebody's hardware.
+ *   ⛔ A MISSING READ PRIVILEGE DOES NOT LOOK LIKE A 403. `pveOperations.read` ends in
+ *     `orElseSucceed(() => undefined)`, so a 403 on the GET is indistinguishable from "absent": the
+ *     plan says create, PVE answers "already exists", and the fault was an ACL all along. That pair
+ *     is the signature — grant Mapping.Audit to the READ role before changing anything else.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import { type PveRequirements, type WithTarget } from './resource.ts';
+/** The four families PVE ships. `GET /cluster/notifications/endpoints` lists exactly these. */
+export type NotificationTargetType = 'gotify' | 'sendmail' | 'smtp' | 'webhook';
+/**
+ * ⚠️ PVE'S OWN KEY NAMES, DASHES INCLUDED, for the reason backup-job.ts gives: the form is then a
+ *   copy rather than a translation table, and a translation table is one more place for a key to be
+ *   renamed and silently never sent.
+ *
+ * ⚠️ A FIELD THAT DOES NOT BELONG TO `type` IS STILL SENT, and PVE refuses it by name. That 400
+ *   beats this file quietly dropping a `mailto` somebody wrote on a webhook.
+ */
+export interface NotificationTargetProps extends WithTarget {
+    /** ⛔ IDENTITY: it picks the family AND the URL, so changing it is a replace. */
+    type: NotificationTargetType;
+    /**
+     * PVE's primary key, unique ACROSS ALL FOUR FAMILIES: a webhook cannot be called `mail-to-root`,
+     * because a sendmail target already is. Format `pve-configid`.
+     */
+    name: string;
+    /** Free text in the UI. */
+    comment?: string;
+    /** Configured but not delivering. Always sent and always compared — see `shape`. */
+    disable?: boolean;
+    /** sendmail, smtp: recipients. ⚠️ Order is not meaning — see `addressList`. */
+    mailto?: readonly string[];
+    /** sendmail, smtp: PVE users, whose own configured address receives the mail. */
+    'mailto-user'?: readonly string[];
+    /** smtp: the SMTP host. gotify: the server URL. PVE requires it on create for both. */
+    server?: string;
+    /** smtp only. Unset lets PVE pick from `mode`: 465 tls, 587 starttls, 25 insecure. */
+    port?: number;
+    /** smtp only. PVE's schema default is `tls`. */
+    mode?: 'insecure' | 'starttls' | 'tls';
+    /** smtp only. ⛔ The matching `password` is not declarable — see the header. */
+    username?: string;
+    /** smtp: PVE requires it on create. sendmail: optional. */
+    'from-address'?: string;
+    /** Display name on the mail. PVE's smtp schema defaults it to `Proxmox VE`. */
+    author?: string;
+    /** webhook: PVE requires it on create. */
+    url?: string;
+    /** webhook: PVE requires it on create. Lower case — PVE's enum is `post|put|get`. */
+    method?: 'get' | 'post' | 'put';
+    /**
+     * webhook: `name=<name>,value=<base64 of value>` property strings, as PVE stores them.
+     * ⚠️ MORE THAN ONE HEADER IS THE ONE THING HERE NOT PROVEN ON A WIRE — see `REPEATED_KEY`.
+     */
+    header?: readonly string[];
+    /**
+     * webhook: the request body, base64, as PVE stores it.
+     * ⚠️ THE UI SHOWS THE DECODED BODY AND THIS DOES NOT. Declaring the base64 is what keeps
+     *   `matches` symmetric with the read; decoding for display would mean encoding on write, and a
+     *   round trip PVE normalises differently is a forever-update. The cost is an unreadable diff.
+     */
+    body?: string;
+}
+/**
+ * ⚠️ EVERY FIELD IS PRESENT FOR EVERY FAMILY, with `''` / `0` meaning "PVE holds nothing". A
+ *   webhook reads back an empty `mailto`, which is also what a webhook declares, so the
+ *   cross-family fields cost one comparison each and never a false update.
+ */
+export interface NotificationTargetAttributes {
+    name: string;
+    type: NotificationTargetType;
+    comment: string;
+    disable: boolean;
+    /** Sorted and comma-joined, so re-ordering a declaration is not a diff. See `addressList`. */
+    mailto: string;
+    'mailto-user': string;
+    server: string;
+    /** 0 means PVE holds no port and will pick one from `mode`. */
+    port: number;
+    mode: string;
+    username: string;
+    'from-address': string;
+    author: string;
+    url: string;
+    method: string;
+    /** Sorted and comma-joined for COMPARISON only; the wire form differs. See `headerList`. */
+    header: string;
+    body: string;
+}
+export interface ProxmoxNotificationTarget extends Resource<'Proxmox.NotificationTarget', NotificationTargetProps, NotificationTargetAttributes, never, PveRequirements> {
+}
+export declare const ProxmoxNotificationTarget: import("alchemy").ResourceClass<ProxmoxNotificationTarget>;
+/**
+ * ⚠️ ON A BUILT-IN TARGET A DELETE REVERTS RATHER THAN REMOVES, and PVE reports success either way.
+ *   It is passed through unguarded because everywhere else in this package the cluster's answer is
+ *   the answer — but this is the one case where a green plan and the cluster disagree, and the
+ *   object left standing is the one carrying the estate's failure mail.
+ */
+export declare const ProxmoxNotificationTargetProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxNotificationTarget>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=notification-target.d.ts.map

package/dist/proxmox/notification-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-target.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,gFAAgF;IAChF,IAAI,EAAE,sBAAsB,CAAC;IAC7B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,iFAAiF;IACjF,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,yBAA0B,SAAQ,QAAQ,CACzD,4BAA4B,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,yBAAyB,4DAErC,CAAC;AA2DF;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,+IAI3C,CAAC"}