@homeflare/alchemy 0.10.1 → 0.12.0

package/dist/proxmox/provision-baseline.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The provisioning baseline: the access every PVE cluster and node needs before a stack built on
+ * this package can manage it — one role, the users OpenBao mints tokens for, the group that fences
+ * the mint, and the grants that bind them. ONE description, read by both halves:
+ *   · provision-declare.ts turns it into `Proxmox.Role`/`Group`/`User`/`Acl` resources, so a stack
+ *     adopts the baseline and keeps it (drift is a plan, not a 403 weeks later);
+ *   · provision-bootstrap.ts turns it into the one-time root commands for a NEW cluster or node.
+ * The two cannot drift apart because neither holds a name or a privilege of its own.
+ *
+ * ⛔ THE PROVISION LANE CANNOT CREATE ITSELF. Every write here runs as a token OpenBao mints for the
+ *   provision user, and minting needs that user to exist, in the mint group, bound to this role.
+ *   So a new cluster is bootstrapped ONCE by root@pam with the generated commands, and the stack
+ *   then adopts what they made (docs/provision-baseline.md).
+ *
+ * ★ ONE PRIVILEGE LIST FOR EVERY FAMILY, NOT A ROLE PER RESOURCE. The list is what the families'
+ *   reconciles need, unioned — the set a hand-kept provision role reached one 403 at a time, each
+ *   step recorded where it was hit (pool.ts, sdn-vnet.ts, ha-rule.ts). It includes what the lane needs
+ *   to manage THIS baseline (`Sys.Modify` for the role, `Realm.AllocateUser`/`User.Modify` for the
+ *   users, `Group.Allocate`, `Permissions.Modify` for the grants), so declaring it can never narrow
+ *   the lane out of its own repair (role.ts: "A ROLE CAN LOCK ITS OWN PROVIDER OUT").
+ * ⚠️ NOT EVERY FAMILY: root@pam-only writes (device passthrough, bind mounts — lxc-judge.ts) and
+ *   privileges a family names as still missing (`VM.Replicate`, replication-job.ts) are outside it.
+ */
+/** The provision role's privileges, sorted — the exact set, never an addition to a live one. */
+export declare const PROVISION_PRIVILEGES: readonly string[];
+/** The names a baseline uses. Every field has a generic default (`PROVISION_DEFAULTS`). */
+export interface ProvisionNames {
+    /** The role holding `PROVISION_PRIVILEGES` on `/`. */
+    readonly role?: string | undefined;
+    /** The user OpenBao's `provision` role mints tokens for, realm-qualified. */
+    readonly provisionUser?: string | undefined;
+    /** The group whose members OpenBao may mint for — the fence around the mint. */
+    readonly mintGroup?: string | undefined;
+    /** The user OpenBao's `read` role mints for, or `null` for a baseline with no read lane. */
+    readonly readUser?: string | null | undefined;
+    /** The role the read user holds on `/`. ⛔ It must already exist: a built-in, or one you declare. */
+    readonly readRole?: string | undefined;
+    /** The comment on the group and both users — how a person on the node learns what they are. */
+    readonly comment?: string | undefined;
+}
+/** Every name, resolved: what `PROVISION_DEFAULTS` holds and what a baseline is built from. */
+export type ResolvedProvisionNames = {
+    readonly [K in keyof ProvisionNames]-?: Exclude<ProvisionNames[K], undefined>;
+};
+/** ★ Generic, kit-prefixed names: nothing here is any one estate's. */
+export declare const PROVISION_DEFAULTS: ResolvedProvisionNames;
+/** Which credential lane a user or a grant belongs to — the OpenBao role that mints for it. */
+export type ProvisionLane = 'provision' | 'read';
+/** A baseline, resolved: exactly what the declaration holds and the bootstrap makes. */
+export interface ProvisionBaseline {
+    readonly role: {
+        readonly roleid: string;
+        readonly privs: readonly string[];
+    };
+    readonly group: {
+        readonly groupid: string;
+        readonly comment: string;
+    };
+    readonly users: readonly {
+        readonly lane: ProvisionLane;
+        readonly userid: string;
+        readonly comment: string;
+        readonly groups: readonly string[];
+    }[];
+    /** Each binds one user to one role on `/`, with propagate — the only shape the lanes need. */
+    readonly grants: readonly {
+        readonly lane: ProvisionLane;
+        readonly userid: string;
+        readonly roleid: string;
+    }[];
+}
+/** Resolve `names` over the defaults and check them. Throws with every problem at once. */
+export declare const provisionBaseline: (names?: ProvisionNames) => ProvisionBaseline;
+//# sourceMappingURL=provision-baseline.d.ts.map

package/dist/proxmox/provision-baseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-baseline.d.ts","sourceRoot":"","sources":["../../src/proxmox/provision-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,gGAAgG;AAChG,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EA4BhD,CAAC;AAEH,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,gFAAgF;IAChF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9C,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,CAAC,IAAI,MAAM,cAAc,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;CAC9E,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,EAAE,sBAQ/B,CAAC;AAEH,+FAA+F;AAC/F,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,MAAM,CAAC;AAEjD,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC9E,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,QAAQ,CAAC,KAAK,EAAE,SAAS;QACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,EAAE,CAAC;IACJ,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,SAAS;QACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,EAAE,CAAC;CACL;AA8BD,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,WAAW,cAAc,KAAQ,iBAwB9D,CAAC"}

package/dist/proxmox/provision-bootstrap.d.ts

@@ -0,0 +1,33 @@
+/**
+ * `provisionBootstrap` — the provisioning baseline (provision-baseline.ts) as the one-time root
+ * commands for a NEW cluster or node: a POSIX `sh` script, printed, never run from here.
+ *
+ *     bun -e "import { provisionBootstrap } from '@homeflare/alchemy/proxmox';
+ *             process.stdout.write(provisionBootstrap())" | ssh root@<node> sh
+ *
+ * ⛔ WHY IT EXISTS: THE PROVISION LANE CANNOT CREATE ITSELF. Every resource in this package runs as a
+ *   token OpenBao mints for the provision user, and a cluster without that user, its group and its
+ *   grant has nothing to mint for — the plan that would create them cannot authenticate. So root
+ *   makes them once, and the stack adopts and keeps them (provision-declare.ts). This is the only
+ *   hand step, and it is generated from the same baseline the stack declares.
+ * ⛔ NEVER A TOKEN, NEVER A PASSWORD. The users are created with neither: OpenBao mints short-lived
+ *   tokens for them later, and an `@pve` user with no password cannot log in to the UI. Nothing
+ *   secret is in the script, so it can be read, reviewed and pasted.
+ * ★ CHECK, THEN CHANGE — IDEMPOTENT BY CONSTRUCTION. Each object is read first (`pvesh get … json`,
+ *   parsed with Perl's core JSON::PP, which every PVE node has), compared with the baseline, and
+ *   written only when it differs, naming what it does. A second run prints `ok` for everything and
+ *   writes nothing. It also CONVERGES: a role with other privileges is set to exactly the baseline,
+ *   as the stack's `Proxmox.Role` would set it (role.ts: a declaration replaces the set).
+ * ★ ONE NODE PER CLUSTER. Users, groups, roles and ACLs live in `/etc/pve/user.cfg`, which pmxcfs
+ *   shares across the cluster: a node joining a cluster that has the baseline needs nothing, and a
+ *   run there is all `ok`. A new standalone node or a new cluster is where it creates.
+ * ⚠️ NAMES ARE NOT QUOTED INTO SAFETY, THEY ARE REFUSED INTO IT: provision-baseline.ts admits only
+ *   characters that need no quoting in `sh` or in a Perl `q{}`.
+ */
+import { type ProvisionNames } from './provision-baseline.ts';
+/**
+ * The script for `names` (defaults: `PROVISION_DEFAULTS`). Pure: it reads nothing and runs nothing.
+ * Throws, like `provisionBaseline`, on a name the baseline refuses.
+ */
+export declare const provisionBootstrap: (names?: ProvisionNames) => string;
+//# sourceMappingURL=provision-bootstrap.d.ts.map

package/dist/proxmox/provision-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-bootstrap.d.ts","sourceRoot":"","sources":["../../src/proxmox/provision-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,yBAAyB,CAAC;AAsFjC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,WAAW,cAAc,KAAQ,MAc/D,CAAC"}

package/dist/proxmox/provision-cli-fake.d.ts

@@ -0,0 +1,38 @@
+export type CliUser = {
+    comment: string;
+    email: string;
+    enable: number;
+    expire: number;
+    firstname: string;
+    lastname: string;
+    groups: string[];
+};
+export type CliGrant = {
+    path: string;
+    type: string;
+    ugid: string;
+    roleid: string;
+    propagate: number;
+};
+export type CliState = {
+    roles: Record<string, string[]>;
+    groups: Record<string, {
+        comment: string;
+    }>;
+    users: Record<string, CliUser>;
+    acl: CliGrant[];
+};
+/** A cluster as PVE installs it: the built-in auditor role, and nothing of the baseline. */
+export declare const freshCluster: () => CliState;
+/** Every item GET the scripts and the providers make, keyed `access/…` without a leading slash. */
+export declare const apiView: (state: CliState) => Record<string, unknown>;
+export type ScriptRun = {
+    code: number;
+    stdout: string;
+    stderr: string;
+    writes: string[];
+    state: CliState;
+};
+/** Run `script` under `sh` against `state`, with the fakes first on PATH. */
+export declare const runScript: (script: string, state: CliState) => Promise<ScriptRun>;
+//# sourceMappingURL=provision-cli-fake.d.ts.map

package/dist/proxmox/provision-cli-fake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-cli-fake.d.ts","sourceRoot":"","sources":["../../src/proxmox/provision-cli-fake.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,OAAO,GAAG;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,EAAE,QAAQ,EAAE,CAAC;CACjB,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,YAAY,QAAO,QAc9B,CAAC;AAIH,mGAAmG;AACnG,eAAO,MAAM,OAAO,UAAW,QAAQ,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAsB/D,CAAC;AA0FF,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,QAAQ,CAAC;CACjB,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,SAAS,WAAkB,MAAM,SAAS,QAAQ,KAAG,OAAO,CAAC,SAAS,CAkClF,CAAC"}

package/dist/proxmox/provision-declare.d.ts

@@ -0,0 +1,25 @@
+import * as Effect from 'effect/Effect';
+import { ProxmoxAcl } from './acl.ts';
+import type { PveTarget } from './credentials.ts';
+import { ProxmoxGroup } from './group.ts';
+import { type ProvisionNames } from './provision-baseline.ts';
+import { ProxmoxRole } from './role.ts';
+import { ProxmoxUser } from './user.ts';
+export interface DeclareProvisionOptions {
+    /** `true`/`false` pipe `adopt(…)` onto every resource; omitted, the deploy's policy decides. */
+    readonly adopt?: boolean;
+}
+/**
+ * The baseline for one cluster. `id` prefixes every logical id (`<id>-role`, `<id>-mint-group`,
+ * `<id>-provision-user`, `<id>-provision-grant`, and the `read` pair), so one stack can declare a
+ * baseline per cluster. `users` and `grants` come back in `baseline.users` / `baseline.grants`
+ * order: provision, then read. Fails, before declaring anything, on a name the baseline refuses.
+ */
+export declare const declareProvisionBaseline: (id: string, target: PveTarget, names?: ProvisionNames, options?: DeclareProvisionOptions) => Effect.Effect<{
+    baseline: import("./provision-baseline.ts").ProvisionBaseline;
+    grants: ProxmoxAcl[];
+    group: ProxmoxGroup;
+    role: ProxmoxRole;
+    users: ProxmoxUser[];
+}, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=provision-declare.d.ts.map

package/dist/proxmox/provision-declare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-declare.d.ts","sourceRoot":"","sources":["../../src/proxmox/provision-declare.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,KAAK,cAAc,EAAqB,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,OAC/B,MAAM,UACF,SAAS,UACV,cAAc,YACZ,uBAAuB;;;;;;+DAgD9B,CAAC"}

package/dist/proxmox/replication-job.d.ts

@@ -1,15 +1,15 @@
 /**
  * `Proxmox.ReplicationJob` — a guest's ZFS storage replication to a second node, declared.
  *
- * ⛔ NOTHING ON TB4 CAN USE THIS FAMILY, AND THAT IS SAID HERE RATHER THAN FOUND OUT LATER. PVE
+ * ⛔ NOTHING ON C1 CAN USE THIS FAMILY, AND THAT IS SAID HERE RATHER THAN FOUND OUT LATER. PVE
  *   storage replication is ZFS-only: `POST /cluster/replication` calls `get_replicatable_volumes`
- *   and refuses a guest whose disks are anywhere else with "No replicatable volumes found". TB4 is
+ *   and refuses a guest whose disks are anywhere else with "No replicatable volumes found". C1 is
  *   Ceph/RBD-backed — shared storage, where replication means nothing because every node already
- *   sees the volume — so `GET /cluster/replication` answers `[]` (MEASURED on n2, 2026-09-13) and
- *   on this cluster always will. The file is written for a ZFS cluster; against TB4 a declaration
+ *   sees the volume — so `GET /cluster/replication` answers `[]` (MEASURED on node-b, 2026-09-13) and
+ *   on this cluster always will. The file is written for a ZFS cluster; against C1 a declaration
  *   is a create that fails with PVE's own sentence, not a plan that quietly does nothing.
  *
- * ★ WHAT IS MEASURED HERE AND WHAT IS REASONED. Measured on n2 (pve-manager 9.2.11), read-only:
+ * ★ WHAT IS MEASURED HERE AND WHAT IS REASONED. Measured on node-b (pve-manager 9.2.11), read-only:
  *   the published schema for all five methods; `PVE/ReplicationConfig.pm` and
  *   `PVE/API2/ReplicationConfig.pm` line by line; `GET /cluster/replication` -> `[]`; and the ACL
  *   row `{"path":"/","propagate":1,"roleid":"PVEAuditor","ugid":"hf-read@pve"}`. NOT measured: any
@@ -45,12 +45,13 @@
  *   declarations differing only in `jobnum` but naming the same target are not two jobs; the second
  *   is a create that fails.
  *
- * ⚠️ RECONCILE NEEDS `VM.Replicate` ON `/vms/<guest>`, WHICH `LXCProvisioner` DOES NOT HOLD. All
+ * ⚠️ RECONCILE NEEDS `VM.Replicate` ON `/vms/<guest>`, WHICH THE PROVISION ROLE DOES NOT HOLD. All
  *   three writes check it (MEASURED in API2/ReplicationConfig.pm: create, update and delete each
  *   call `$rpcenv->check($authuser, "/vms/$vmid", ['VM.Replicate'])`), and the role's 27 privileges
  *   include `VM.Allocate`, `VM.Audit`, `VM.Backup`, `VM.Config.*` and `VM.PowerMgmt` but not
- *   `VM.Replicate`. Widen it deliberately over SSH, preserving what is there, as `pool.ts` records:
- *   `pveum role modify LXCProvisioner --privs "<existing>,VM.Replicate"`.
+ *   `VM.Replicate` (`PROVISION_PRIVILEGES`). Do NOT widen it by hand: the baseline declares the
+ *   role's exact set, so a hand-added privilege is removed on the next deploy. Grant a second role
+ *   holding `VM.Replicate` on `/vms/<guest>` instead.
  *   ★ THE READ LANE NEEDS NOTHING EXTRA, which is why there is no `readRole` below. The ITEM read
  *     checks `VM.Audit` on `/vms/<guest>`, `hf-read@pve` holds the built-in `PVEAuditor` at `/`
  *     with propagate — both MEASURED — and `PVEAuditor` carries `VM.Audit`. This family is not a

package/dist/proxmox/replication-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replication-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/replication-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAsB,SAAQ,QAAQ,CACrD,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,qBAAqB,wDAA4D,CAAC;AAwE/F;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,2IAIvC,CAAC"}
+{"version":3,"file":"replication-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/replication-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAsB,SAAQ,QAAQ,CACrD,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,qBAAqB,wDAA4D,CAAC;AAwE/F;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,2IAIvC,CAAC"}

package/dist/proxmox/resource.d.ts

@@ -52,9 +52,9 @@ export type WithApiTarget = {
     target: ApiTarget;
 };
 export type PveSpec<Props extends WithApiTarget, Attributes> = {
-    /** `pools/house`, `nodes/n2/lxc/101` — where ONE object is read, updated and deleted. */
+    /** `pools/lab`, `nodes/node-b/lxc/101` — where ONE object is read, updated and deleted. */
     readonly path: (props: Props) => string;
-    /** `pools`, `nodes/n2/lxc` — where a NEW one is POSTed. */
+    /** `pools`, `nodes/node-b/lxc` — where a NEW one is POSTed. */
     readonly collection: (props: Props) => string;
     /** Live JSON to attributes. Returning undefined means "this is not really there". */
     readonly attributes: (live: Record<string, unknown>, props: Props) => Attributes | undefined;

package/dist/proxmox/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,UAAU,IAAI;IAC7D,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7F,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC7D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;kBAGX,KAAK;iBAiBX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBASZ,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;sBAIV,KAAK;IA4DvB;;;;OAIG;oBACa,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,SAAS,MAAM,QAC1E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAI9B,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAChC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBArHlC,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;IAmH5B,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,UAAU,IAAI;IAC7D,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7F,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC7D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;kBAGX,KAAK;iBAiBX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBASZ,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;sBAIV,KAAK;IA4DvB;;;;OAIG;oBACa,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,SAAS,MAAM,QAC1E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAI9B,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAChC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBArHlC,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;IAmH5B,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}

package/dist/proxmox/sdn-apply-read.d.ts

@@ -3,12 +3,12 @@
  * collections this package declares resources for.
  *
  * 🔴 THE GAP THIS FILE CLOSES, AND IT WAS FOUND BY ALMOST DECLARING THE APPLY. `pendingCount` in
- *   sdn-apply.ts counted `cluster/sdn/zones` and `cluster/sdn/vnets`. TB4 has zero of each — and a
- *   staged OSPF FABRIC that nothing counted. MEASURED 2026-09-13 on n2:
+ *   sdn-apply.ts counted `cluster/sdn/zones` and `cluster/sdn/vnets`. C1 has zero of each — and a
+ *   staged OSPF FABRIC that nothing counted. MEASURED 2026-09-13 on node-b:
  *
- *     /etc/pve/sdn/fabrics.cfg   ospf_fabric: tb4, area 1, ip_prefix 10.100.0.0/24
- *                                ospf_node: tb4_n2/n3/n4, interfaces en05 + en06,
- *                                ip 10.100.0.102 / .103 / .104
+ *     /etc/pve/sdn/fabrics.cfg   ospf_fabric: c1, area 1, ip_prefix 203.0.113.0/24
+ *                                ospf_node: c1_n2/node-c/node-d, interfaces tb0 + tb1,
+ *                                ip 203.0.113.102 / .103 / .104
  *     /etc/network/interfaces.d/sdn   the file PVE GENERATES from it, carrying those /32s
  *
  *   Those addresses are Ceph's `cluster_network`. So `diff` would have answered `noop` for ever
@@ -38,7 +38,7 @@ import type { PveTarget } from './credentials.ts';
  *
  * ⚠️ NAMED RATHER THAN SILENTLY SKIPPED. `ipams` and `dns` answer HTTP 400 to both `?pending=1` and
  *   `?running=1`, so there is no way to ask them what is staged. They are a REAL blind spot: an
- *   ipam edited by hand is published by the apply and cannot be seen from here. TB4 has one ipam
+ *   ipam edited by hand is published by the apply and cannot be seen from here. C1 has one ipam
  *   (`pve`, the built-in) and zero dns entries, so the blind spot is currently empty — which is a
  *   fact about today, not a property of the design.
  */
@@ -74,7 +74,7 @@ export declare const canonical: (value: unknown) => string;
  *
  * ⛔ ZERO HERE IS THE ONLY THING THAT MAKES DECLARING THE APPLY SAFE. `reconcile` runs on CREATE —
  *   Alchemy always calls it the first time a resource appears — and `PUT /cluster/sdn` regenerates
- *   `/etc/network/interfaces.d/sdn` on every node. On TB4 that file carries Ceph's cluster network.
+ *   `/etc/network/interfaces.d/sdn` on every node. On C1 that file carries Ceph's cluster network.
  */
 export declare const sdnPendingCount: (target: PveTarget) => Effect.Effect<number, Error, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=sdn-apply-read.d.ts.map

package/dist/proxmox/sdn-apply.d.ts

@@ -6,7 +6,7 @@
  *   is the apply, and it is CLUSTER-WIDE — it publishes every staged object at once, not the one
  *   that happened to reconcile.
  *
- * ★ MEASURED ON TB4 ON 2026-09-13, NOT INFERRED. A probe zone was created, inspected and removed:
+ * ★ MEASURED ON C1 ON 2026-09-13, NOT INFERRED. A probe zone was created, inspected and removed:
  *
  *     pvesh create /cluster/sdn/zones --zone zzprobe --type simple
  *     GET /cluster/sdn/zones/zzprobe              -> {"digest":"c438…","type":"simple","zone":"zzprobe"}

package/dist/proxmox/sdn-subnet-form.d.ts

@@ -22,7 +22,7 @@ export type DhcpRange = {
  *
  * ⛔ MEASURED from `/usr/share/perl5/PVE/API2/Network/SDN/Subnets.pm` on pve-manager 9.2.11, in
  *   the create handler: `my $id = $cidr =~ s/\//-/r; $id = "$zoneid-$id";`. So `subnet=10.0.0.0/24`
- *   goes out and `house-10.0.0.0-24` is what exists afterwards. A CIDR cannot be a path segment
+ *   goes out and `lab-10.0.0.0-24` is what exists afterwards. A CIDR cannot be a path segment
  *   anyway — it carries a slash — so there is no spelling of this endpoint that takes the CIDR.
  *
  * ⚠️ `.replace`, NOT `.replaceAll`, AND THE PARITY IS DELIBERATE. Perl's `s/\//-/r` has no `/g`, so

package/dist/proxmox/sdn-subnet.d.ts

@@ -11,7 +11,7 @@
  *   `vnet`; a literal buys no ordering, and here it also buys a wrong path.
  *
  * ⛔ THE ID PVE FILES A SUBNET UNDER IS NOT THE ONE YOU WRITE, AND IT IS THIS FAMILY'S SHARPEST
- *   EDGE. `POST` takes `subnet=10.0.0.0/24` while GET, PUT and DELETE address `house-10.0.0.0-24`.
+ *   EDGE. `POST` takes `subnet=10.0.0.0/24` while GET, PUT and DELETE address `lab-10.0.0.0-24`.
  *   One PVE parameter name, `subnet`, carrying two different values — so they are named APART here,
  *   `cidr` for the declared one and `subnetId` for the derived one, for the reason values.ts gives
  *   about `flag`: a name that means two things is a bug waiting for whoever reads one meaning. The
@@ -50,11 +50,11 @@
  *   seven privileges include SDN.Audit — at `/` with propagate=1. So the default 3600s auditor
  *   lease reads this family, and a `readRole: 'provision'` here would be privilege nobody needed.
  *   Writes are a different answer: POST, PUT and DELETE all require SDN.Allocate on
- *   `/sdn/zones/<zone>/<vnet>`, which `LXCProvisioner` gained on 2026-09-13.
+ *   `/sdn/zones/<zone>/<vnet>`, which the provision role gained on 2026-09-13 (`PROVISION_PRIVILEGES`).
  *
- * ⚠️ NO LIVE SUBNET EXISTS ON TB4 TO ROUND-TRIP AGAINST — there are no SDN zones and no vnets, so
+ * ⚠️ NO LIVE SUBNET EXISTS ON C1 TO ROUND-TRIP AGAINST — there are no SDN zones and no vnets, so
  *   there can be no subnets. Every claim above is read off PVE 9.2.11's own schema and Perl sources
- *   on n2, and the noop argument below rests on those rather than on a plan this file has watched.
+ *   on node-b, and the noop argument below rests on those rather than on a plan this file has watched.
  *
  * ⚠️ TWO REFUSALS TO EXPECT, both from `SubnetPlugin::on_update_hook`: PVE will not put a subnet on
  *   a vnet with `vlanaware` set ("you can't add a subnet on a vlanaware vnet"), and it rejects a
@@ -88,7 +88,7 @@ export interface SdnSubnetProps extends WithTarget {
     gateway?: string;
     /**
      * Masquerade this subnet. ⚠️ INERT UNTIL THE CLUSTER FIREWALL IS ON — PVE's own description is
-     *   "enable masquerade for this subnet if pve-firewall", and TB4's cluster firewall was empty and
+     *   "enable masquerade for this subnet if pve-firewall", and C1's cluster firewall was empty and
      *   disabled when this was written. It still round-trips, so declaring it does not diff.
      */
     snat?: boolean;

package/dist/proxmox/sdn-vnet.d.ts

@@ -35,12 +35,11 @@
  *   than an error — see the ⛔ in sdn-zone.ts and docs/privileges.md.
  *
  * ⚠️ PRIVILEGES, AND THE ESTATE'S CREDENTIAL HELD NONE OF THEM UNTIL 2026-09-13. reconcile and
- *   delete mint `provision` and need SDN.Allocate on `/sdn/zones`, or on the one zone if scoped. `LXCProvisioner` grants
- *   SDN.Use, which is what a GUEST needs in order to attach to a vnet and NOT what creating one
- *   needs, so a container declared on this vnet works today while the vnet itself 403s. Widen
- *   deliberately, the way Pool.Allocate was:
- *   `pveum role modify LXCProvisioner --privs "<existing>,SDN.Allocate,SDN.Audit"` over SSH,
- *   preserving every existing privilege.
+ *   delete mint `provision` and need SDN.Allocate on `/sdn/zones`, or on the one zone if scoped. The provision role granted
+ *   only SDN.Use then, which is what a GUEST needs in order to attach to a vnet and NOT what
+ *   creating one needs, so a container on a vnet worked while the vnet itself 403'd. It was widened
+ *   the way Pool.Allocate was, and `PROVISION_PRIVILEGES` (provision-baseline.ts) now carries
+ *   SDN.Allocate and SDN.Audit.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/proxmox/sdn-vnet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdn-vnet.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-vnet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAA8C,CAAC;AAyG1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}
+{"version":3,"file":"sdn-vnet.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-vnet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAA8C,CAAC;AAyG1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}

package/dist/proxmox/storage.d.ts

@@ -21,9 +21,10 @@
  *   messages point away from the cause.
  *   ★ SO WIDEN OR RE-POINT BEFORE THE FIRST PLAN, outside this file: give the credential mount's
  *     `read` role `Datastore.Allocate` on `/storage`, or read this family with `provision`. The
- *     provision role in the estate this was written for holds `Datastore.AllocateSpace` and
+ *     provision role in the estate this was written for held only `Datastore.AllocateSpace` and
  *     `Datastore.Audit`, and NEITHER IS IT — AllocateSpace writes volumes INTO a storage, Allocate
- *     DEFINES one — so it 403s here until widened the way `Pool.Allocate` was for `Proxmox.Pool`.
+ *     DEFINES one — so it 403'd here until widened the way `Pool.Allocate` was for `Proxmox.Pool`.
+ *     The provisioning baseline (`provision-baseline.ts`) carries `Datastore.Allocate`.
  *
  * ⛔ THERE IS NO `password` PROP AND THERE MUST NEVER BE ONE. PBS and CIFS storages take one at
  *   create time, and Alchemy persists attributes UNENCRYPTED — a secret in props is one careless
@@ -64,7 +65,7 @@ export interface StorageProps extends WithTarget {
     /** `images,rootdir,vztmpl,iso,backup,snippets`. PVE reports `none` for an empty set. */
     content?: string;
     /**
-     * Node restriction, e.g. `n1,n2`. ⚠️ A STORAGE WITH A `nodes` LIST DOES NOT EXIST ANYWHERE ELSE:
+     * Node restriction, e.g. `node-a,node-b`. ⚠️ A STORAGE WITH A `nodes` LIST DOES NOT EXIST ANYWHERE ELSE:
      * an LXC declared on a node outside it fails at create with "storage not available on node".
      */
     nodes?: string;

package/dist/proxmox/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IACpD,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,qGAAqG;AACrG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAgHH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IACpD,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,qGAAqG;AACrG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAgHH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}

package/dist/proxmox/user.d.ts

@@ -29,8 +29,9 @@
  *   can then say what a delete would take with it — and kept OUT of `matches`, exactly like
  *   `pool.members`. Reported, never declared.
  *
- * ⚠️ RECONCILE NEEDS PRIVILEGES `LXCProvisioner` DOES NOT HOLD, so state them rather than meet a
- *   403 in the middle of a deploy (pool.ts records how that went the last time):
+ * ⚠️ RECONCILE NEEDS PRIVILEGES A GUEST-ONLY ROLE DOES NOT HOLD, so they are stated rather than met
+ *   as a 403 in the middle of a deploy (pool.ts records how that went the last time).
+ *   `PROVISION_PRIVILEGES` (provision-baseline.ts) carries every one of them:
  *     · `Realm.AllocateUser` on `/access/realm/<realm>` — create and delete.
  *     · `User.Modify` on `/access/groups`, and on `/access/groups/<group>` for EVERY group named in
  *       `groups` — create, update and delete. PVE checks the groups you are granting, not just the

package/dist/proxmox/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAiGjE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAiGjE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}

package/dist/proxmox/values.d.ts

@@ -108,7 +108,7 @@ export declare const int: (value: unknown, fallback: number) => number;
  * A PVE update form with its clear-list attached, and the two guaranteed not to overlap.
  *
  * ⛔ PVE DIES IF A KEY IS SET AND DELETED IN ONE CALL, AND SIX FAMILIES HERE BUILT THAT FORM BY
- *   HAND. Measured in the shipped Perl on n2 — `PVE::SectionConfig::delete_from_config`, line 1860:
+ *   HAND. Measured in the shipped Perl on node-b — `PVE::SectionConfig::delete_from_config`, line 1860:
  *
  *     die "cannot set and delete property '$k' at the same time!\n"
  *         if defined($new_options->{$k});

package/dist/proxmox/zfs-pool-write.d.ts

@@ -37,7 +37,7 @@ export declare const createForm: (props: ZfsPoolProps) => Record<string, string>
 /**
  * Create the pool if it is absent, and otherwise leave it completely alone.
  *
- * ⛔ THE POST ONLY FORKS A WORKER. MEASURED in `/usr/share/perl5/PVE/API2/Disks/ZFS.pm` on n2: the
+ * ⛔ THE POST ONLY FORKS A WORKER. MEASURED in `/usr/share/perl5/PVE/API2/Disks/ZFS.pm` on node-b: the
  *   create handler ends in `$rpcenv->fork_worker('zfscreate', ...)` and its HTTP answer is a UPID
  *   returned the instant the worker is forked — before `zpool create` has run, let alone finished.
  *   A read-back taken immediately, as `pveOperations.reconcile` takes it, finds nothing and would

package/dist/proxmox/zfs-pool.d.ts

@@ -22,22 +22,22 @@
  *     that one line turns a text edit into an unrecoverable one.
  *
  * ⛔ THERE IS NO PUT ON THIS FAMILY AT ALL. MEASURED from the cluster's own published schema
- *   (`/usr/share/pve-docs/api-viewer/apidoc.js`, read on n2 2026-09-13): `/nodes/{node}/disks/zfs`
+ *   (`/usr/share/pve-docs/api-viewer/apidoc.js`, read on node-b 2026-09-13): `/nodes/{node}/disks/zfs`
  *   has GET and POST, `/nodes/{node}/disks/zfs/{name}` has GET and DELETE, and that is the whole
  *   surface. So `updateForm` is omitted — which, per `resource.ts`, makes any `matches` = false a
  *   REPLACE. A replace is a delete followed by a create, and on this family the delete is the
  *   thing above. Read the ⛔ on `matches` before adding anything to it.
  *
  * ⛔ NOT ONE CREATE PARAMETER COMES BACK ON READ, SO `matches` COMPARES NOTHING. MEASURED against
- *   the live cluster: `GET /nodes/n2/disks/zfs/rpool` answers exactly
+ *   the live cluster: `GET /nodes/node-b/disks/zfs/rpool` answers exactly
  *   `{action, children, errors, leaf, name, scan, state, status}` — no `ashift`, no `compression`,
  *   no `raidlevel`, no `devices`, no `add_storage`. Every create parameter is write-only. There is
  *   therefore no field a declaration and a live pool can both be asked about, and a `matches` that
  *   invented one would plan a replace — i.e. a `zpool destroy` — over a difference it could never
  *   verify in the first place.
  *
- * ⚠️ AND WHAT THE INDEX RETURNS IS LIVE TELEMETRY, NOT CONFIGURATION. `GET /nodes/n2/disks/zfs`
- *   gives `alloc`, `free`, `frag`, `dedup`, `size`, `health`. MEASURED: two reads of n2 seconds
+ * ⚠️ AND WHAT THE INDEX RETURNS IS LIVE TELEMETRY, NOT CONFIGURATION. `GET /nodes/node-b/disks/zfs`
+ *   gives `alloc`, `free`, `frag`, `dedup`, `size`, `health`. MEASURED: two reads of node-b seconds
  *   apart returned `alloc` 14474944512 then 14472740864 — it moves on its own, with no declaration
  *   anywhere near it. `scan` in the detail read moves the same way (it carries the last scrub), and
  *   `status`/`action` appear and vanish as ZFS feature flags and faults come and go. None of them
@@ -133,7 +133,7 @@ export interface ZfsPoolAttributes {
      *
      * ⚠️ THIS IS WHAT ZFS RESOLVED, NOT WHAT WAS DECLARED, and the two normally differ: PVE rewrites
      *   a `/dev/sdb` into a by-id link before creating, and ZFS reports partition paths (`…-part3`)
-     *   for a pool built on partitions — MEASURED, that is exactly what n2's `rpool` reports. Never
+     *   for a pool built on partitions — MEASURED, that is exactly what node-b's `rpool` reports. Never
      *   compare it with `props.devices`.
      */
     devices: string;

package/dist/talos/credentials.d.ts

@@ -2,7 +2,7 @@ import * as Effect from 'effect/Effect';
 import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
 /** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */
 export type TalosTarget = {
-    /** OpenBao KV mount holding Talos material, e.g. `talos-tb4`. */
+    /** OpenBao KV mount holding Talos material, e.g. `talos-c1`. */
     readonly mount: string;
     /** Logical cluster name — safe to persist and log. */
     readonly cluster: string;

package/dist/talos/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/talos/credentials.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF,+FAA+F;AAC/F,MAAM,MAAM,WAAW,GAAG;IACxB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAIF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAAY,WAAW;;iGAsFhD,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/talos/credentials.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF,+FAA+F;AAC/F,MAAM,MAAM,WAAW,GAAG;IACxB,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAIF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAAY,WAAW;;iGAsFhD,CAAC"}

package/dist/talos/index.js.map

@@ -3,7 +3,7 @@
   "sources": ["../src/talos/kubeconfig.ts", "../src/talos/credentials.ts", "../src/talos/talosctl.ts", "../src/talos/values.ts", "../src/talos/talos-bootstrap.ts", "../src/talos/talos-cluster-health.ts", "../src/talos/talos-machine-config.ts"],
   "sourcesContent": [
     "/**\n * `Talos.Kubeconfig` — fetch admin kubeconfig so `Kubernetes.*` workloads can connect.\n *\n * ★ REASONED FROM talosctl kubeconfig (Talos v1.13 CLI reference): writes a kubeconfig file;\n *   `--merge=false` keeps it isolated; `-f/--force` overwrites an existing file.\n *\n * ⛔ THE KUBECONFIG FILE CONTAINS A CLIENT CERTIFICATE — IT MUST NOT BE AN ATTRIBUTE. Alchemy\n *   persists attributes unencrypted. This resource:\n *     - writes the file to `runtimePath` at reconcile time (re-minted each deploy),\n *     - persists ONLY public metadata + fingerprints,\n *     - exposes a `connection` field referencing the runtime path for `Kubernetes.ClusterAdapter`.\n *\n * ⚠️ `runtimePath` IS PERSISTED AS A STRING, NOT AS FILE CONTENTS. The path is a contract between\n *   this resource and the host filesystem — same pattern as pointing Kubernetes.KubeConfig at\n *   `/opt/homeflare/...` rendered outside Postgres.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport type { Connection } from 'alchemy/Kubernetes/Connection';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { mintTalosconfig } from './credentials.ts';\nimport type { TalosRequirements, WithTarget } from './resource.ts';\nimport { talosctl } from './talosctl.ts';\nimport { kubeconfigMetadata, sha256 } from './values.ts';\n\nexport interface KubeconfigProps extends WithTarget {\n  /** Node that serves `talosctl kubeconfig`. */\n  node: string;\n  /** Context name inside the generated kubeconfig — not secret. */\n  context: string;\n  /**\n   * Host path where talosctl writes the kubeconfig each reconcile.\n   *\n   * ⛔ Must be outside Alchemy state and rotated by redeploy, never copied into attributes.\n   */\n  runtimePath: string;\n  after?: readonly unknown[];\n}\n\nexport interface KubeconfigAttributes {\n  context: string;\n  endpoint: string;\n  certificateAuthorityFingerprint: string;\n  clientCertificateFingerprint: string;\n  /** Digest of endpoint+context+fingerprints — detects credential rotation without storing PEM. */\n  credentialGeneration: string;\n  /**\n   * Serializable `Kubernetes.Connection` for downstream workloads.\n   *\n   * ★ auth.kind `kubeconfig` is the stock ClusterAdapter — provider-roadmap.md names this seam.\n   *   Only `path` and `context` appear here; the adapter reads credentials from disk at call time.\n   */\n  connection: Connection;\n}\n\nexport interface TalosKubeconfig extends Resource<\n  'Talos.Kubeconfig',\n  KubeconfigProps,\n  KubeconfigAttributes,\n  never,\n  TalosRequirements\n> {}\n\nexport const TalosKubeconfig = Resource<TalosKubeconfig>('Talos.Kubeconfig');\n\nconst generation = (meta: {\n  endpoint: string;\n  caFingerprint: string;\n  clientFingerprint: string;\n  context: string;\n}) => sha256(`${meta.context}\\n${meta.endpoint}\\n${meta.caFingerprint}\\n${meta.clientFingerprint}`);\n\nconst toConnection = (props: KubeconfigProps): Connection => ({\n  auth: { context: props.context, kind: 'kubeconfig', path: props.runtimePath },\n});\n\nconst readFileMeta = (props: KubeconfigProps) =>\n  Effect.gen(function* () {\n    const text = yield* Effect.tryPromise({\n      try: () => Bun.file(props.runtimePath).text(),\n      catch: (cause) => new Error(String(cause)),\n    }).pipe(Effect.orElseSucceed(() => undefined as string | undefined));\n    if (text === undefined) return undefined;\n    const meta = kubeconfigMetadata(text, props.context);\n    if (meta === undefined) return undefined;\n    return {\n      certificateAuthorityFingerprint: meta.caFingerprint,\n      clientCertificateFingerprint: meta.clientFingerprint,\n      connection: toConnection(props),\n      context: props.context,\n      credentialGeneration: generation({ ...meta, context: props.context }),\n      endpoint: meta.endpoint,\n    };\n  });\n\nconst read = (props: KubeconfigProps) =>\n  readFileMeta(props).pipe(\n    Effect.map((meta) =>\n      meta === undefined\n        ? {\n            certificateAuthorityFingerprint: '',\n            clientCertificateFingerprint: '',\n            connection: toConnection(props),\n            context: props.context,\n            credentialGeneration: '',\n            endpoint: '',\n          }\n        : meta,\n    ),\n  );\n\nconst diff = (news: Input<KubeconfigProps>, output: KubeconfigAttributes | undefined) =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    const live = yield* read(news);\n    if (\n      live.credentialGeneration !== '' &&\n      output.credentialGeneration === live.credentialGeneration &&\n      output.context === live.context &&\n      output.endpoint === live.endpoint\n    ) {\n      return { action: 'noop' } as const;\n    }\n    return { action: 'update' } as const;\n  });\n\nconst reconcile = (props: KubeconfigProps) =>\n  Effect.gen(function* () {\n    const credential = yield* mintTalosconfig(props.target);\n    yield* talosctl(\n      [\n        'kubeconfig',\n        props.runtimePath,\n        '--merge=false',\n        '--force',\n        '--force-context-name',\n        props.context,\n      ],\n      { nodes: [props.node], talosconfigPath: credential.talosconfigPath },\n    );\n    const meta = yield* readFileMeta(props);\n    if (meta === undefined) {\n      return yield* Effect.die(\n        new Error(\n          `${props.runtimePath}: talosctl kubeconfig returned no error but the file is missing ` +\n            'or unparsable. Read back rather than trusting the exit code alone.',\n        ),\n      );\n    }\n    return meta;\n  });\n\nconst handlers = {\n  delete: () => Effect.void,\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<KubeconfigProps>;\n    output: KubeconfigAttributes | undefined;\n  }) => diff(news, output),\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: KubeconfigProps }) => read(olds),\n  reconcile: ({ news }: { news: KubeconfigProps }) => reconcile(news),\n};\n\nexport const TalosKubeconfigProvider = () =>\n  Provider.effect(TalosKubeconfig, Effect.succeed(TalosKubeconfig.Provider.of(handlers)));\n",
-    "/**\n * The Talos client credential a reconcile runs with: minted from OpenBao, written to a temp file.\n *\n * ⛔ TALOSCONFIG AND secrets.yaml HOLD CLIENT CERTIFICATES AND CLUSTER CA PRIVATE KEYS. Alchemy\n *   persists resource attributes WITHOUT encryption — StateEncoding.ts writes `Redacted` as\n *   `{\"@redacted\": <plaintext>}` — and this estate's state store is the `alchemy` Postgres that\n *   pg-backup.sh dumps nightly. Neither file may be a prop, an attribute, or a log line.\n *\n * ★ MODELED ON house/proxmox/src/credentials.ts: mint at call time through `ChildProcessSpawner`,\n *   use the material to build a client, drop it when the scope ends. The difference is Talos wants a\n *   FILE (`--talosconfig` / `TALOSCONFIG`), so mint writes a temp path and registers cleanup.\n *\n * ⚠️ REASONED FROM THE PUBLISHED TALOS WORKFLOW, NOT MEASURED ON THIS ESTATE. There is no Talos\n *   cluster here yet; paths below follow the same `mount/data/…` shape other infra mounts use.\n */\nimport { closeSync, openSync, writeFileSync } from 'node:fs';\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/unstable/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';\n\n/** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */\nexport type TalosTarget = {\n  /** OpenBao KV mount holding Talos material, e.g. `talos-tb4`. */\n  readonly mount: string;\n  /** Logical cluster name — safe to persist and log. */\n  readonly cluster: string;\n  /**\n   * Path under the mount for the talosconfig YAML.\n   *\n   * ⚠️ DEFAULT IS REASONED. The first real deploy will confirm or correct the path; a wrong path\n   *   fails closed with a bao error rather than writing an empty talosconfig.\n   */\n  readonly talosconfigKey?: string;\n};\n\nexport type TalosCredential = {\n  /** Absolute path to a temp talosconfig. ⛔ NEVER PERSIST, NEVER LOG CONTENTS. */\n  readonly talosconfigPath: string;\n};\n\nconst defaultKey = (target: TalosTarget) => target.talosconfigKey ?? 'data/talosconfig';\n\n/**\n * Mint one talosconfig file for `target`.\n *\n * ★ SHELLS OUT TO `bao` RATHER THAN SPEAKING THE HTTP API — same reasoning as proxmox credentials.\n *   The estate's BAO_ADDR / BAO_NAMESPACE / approle contract already lives in that binary.\n */\nexport const mintTalosconfig = (target: TalosTarget) =>\n  Effect.scoped(\n    Effect.gen(function* () {\n      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n      const key = defaultKey(target);\n      const result = yield* ChildProcess.make(\n        'bao',\n        ['kv', 'get', '-format=json', `${target.mount}/${key}`],\n        { detached: false, extendEnv: true, stderr: 'pipe', stdin: 'ignore', stdout: 'pipe' },\n      ).pipe(\n        spawner.spawn,\n        Effect.flatMap((child) =>\n          Effect.all(\n            {\n              exitCode: child.exitCode,\n              stderr: child.stderr.pipe(\n                Stream.decodeText,\n                Stream.mkString,\n                Effect.map((text) => text.trim()),\n              ),\n              stdout: child.stdout.pipe(\n                Stream.decodeText,\n                Stream.mkString,\n                Effect.map((text) => text.trim()),\n              ),\n            },\n            { concurrency: 'unbounded' },\n          ),\n        ),\n        Effect.scoped,\n      );\n\n      if (result.exitCode !== 0) {\n        // ⛔ stderr ONLY — stdout may hold talosconfig YAML with client credentials.\n        return yield* Effect.fail(\n          new Error(\n            `bao kv get ${target.mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`,\n          ),\n        );\n      }\n\n      const parsed = JSON.parse(result.stdout) as { data?: { data?: Record<string, unknown> } };\n      const data = parsed.data?.data;\n      const raw = data?.['talosconfig'] ?? data?.['config'];\n      if (typeof raw !== 'string' || raw.trim() === '') {\n        return yield* Effect.fail(\n          new Error(\n            `${target.mount}/${key} returned no talosconfig field. Expected a KV key named 'talosconfig' or 'config' — never store the value in Alchemy props.`,\n          ),\n        );\n      }\n\n      const talosconfigPath = `${Bun.env['TMPDIR'] ?? '/tmp'}/hf-talos-${target.cluster}-${Bun.randomUUIDv7()}.yaml`;\n      /**\n       * ⛔ 0600, CREATED EXCLUSIVELY, AND `Bun.write` CANNOT DO EITHER. This file holds the\n       *   cluster's admin client certificate — everything talosctl needs to reconfigure or wipe a\n       *   node. `Bun.write` takes no mode, so it lands at the process umask, which on this estate\n       *   is 0644: world-readable, in a world-readable directory, for as long as the resource\n       *   runs. The name is unguessable, and \"unguessable\" is not a permission.\n       * ⚠️ `wx` IS THE OTHER HALF. Opening with O_EXCL means this cannot be made to write through\n       *   a path an attacker pre-created — the classic /tmp symlink race — and with a UUIDv7 name\n       *   a collision is a genuine error rather than something to paper over.\n       * ⚠️ THE FINALIZER BELOW REMOVES IT ON EVERY EXIT PATH, but a hard kill (SIGKILL, power\n       *   loss) leaves it behind. 0600 is what makes that survivable rather than a disclosure.\n       */\n      yield* Effect.try({\n        try: () => {\n          const fd = openSync(talosconfigPath, 'wx', 0o600);\n          try {\n            writeFileSync(fd, raw);\n          } finally {\n            closeSync(fd);\n          }\n        },\n        catch: (cause) => new Error(`writing temp talosconfig: ${String(cause)}`),\n      });\n\n      yield* Effect.addFinalizer(() =>\n        Effect.tryPromise({\n          try: () => Bun.file(talosconfigPath).delete(),\n          catch: () => undefined,\n        }).pipe(Effect.orElseSucceed(() => undefined)),\n      );\n\n      return { talosconfigPath } satisfies TalosCredential;\n    }),\n  );\n",
+    "/**\n * The Talos client credential a reconcile runs with: minted from OpenBao, written to a temp file.\n *\n * ⛔ TALOSCONFIG AND secrets.yaml HOLD CLIENT CERTIFICATES AND CLUSTER CA PRIVATE KEYS. Alchemy\n *   persists resource attributes WITHOUT encryption — StateEncoding.ts writes `Redacted` as\n *   `{\"@redacted\": <plaintext>}` — and this estate's state store is the `alchemy` Postgres that\n *   a nightly job dumps. Neither file may be a prop, an attribute, or a log line.\n *\n * ★ MODELED ON <estate>/proxmox/src/credentials.ts: mint at call time through `ChildProcessSpawner`,\n *   use the material to build a client, drop it when the scope ends. The difference is Talos wants a\n *   FILE (`--talosconfig` / `TALOSCONFIG`), so mint writes a temp path and registers cleanup.\n *\n * ⚠️ REASONED FROM THE PUBLISHED TALOS WORKFLOW, NOT MEASURED ON THIS ESTATE. There is no Talos\n *   cluster here yet; paths below follow the same `mount/data/…` shape other infra mounts use.\n */\nimport { closeSync, openSync, writeFileSync } from 'node:fs';\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/unstable/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';\n\n/** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */\nexport type TalosTarget = {\n  /** OpenBao KV mount holding Talos material, e.g. `talos-c1`. */\n  readonly mount: string;\n  /** Logical cluster name — safe to persist and log. */\n  readonly cluster: string;\n  /**\n   * Path under the mount for the talosconfig YAML.\n   *\n   * ⚠️ DEFAULT IS REASONED. The first real deploy will confirm or correct the path; a wrong path\n   *   fails closed with a bao error rather than writing an empty talosconfig.\n   */\n  readonly talosconfigKey?: string;\n};\n\nexport type TalosCredential = {\n  /** Absolute path to a temp talosconfig. ⛔ NEVER PERSIST, NEVER LOG CONTENTS. */\n  readonly talosconfigPath: string;\n};\n\nconst defaultKey = (target: TalosTarget) => target.talosconfigKey ?? 'data/talosconfig';\n\n/**\n * Mint one talosconfig file for `target`.\n *\n * ★ SHELLS OUT TO `bao` RATHER THAN SPEAKING THE HTTP API — same reasoning as proxmox credentials.\n *   The estate's BAO_ADDR / BAO_NAMESPACE / approle contract already lives in that binary.\n */\nexport const mintTalosconfig = (target: TalosTarget) =>\n  Effect.scoped(\n    Effect.gen(function* () {\n      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n      const key = defaultKey(target);\n      const result = yield* ChildProcess.make(\n        'bao',\n        ['kv', 'get', '-format=json', `${target.mount}/${key}`],\n        { detached: false, extendEnv: true, stderr: 'pipe', stdin: 'ignore', stdout: 'pipe' },\n      ).pipe(\n        spawner.spawn,\n        Effect.flatMap((child) =>\n          Effect.all(\n            {\n              exitCode: child.exitCode,\n              stderr: child.stderr.pipe(\n                Stream.decodeText,\n                Stream.mkString,\n                Effect.map((text) => text.trim()),\n              ),\n              stdout: child.stdout.pipe(\n                Stream.decodeText,\n                Stream.mkString,\n                Effect.map((text) => text.trim()),\n              ),\n            },\n            { concurrency: 'unbounded' },\n          ),\n        ),\n        Effect.scoped,\n      );\n\n      if (result.exitCode !== 0) {\n        // ⛔ stderr ONLY — stdout may hold talosconfig YAML with client credentials.\n        return yield* Effect.fail(\n          new Error(\n            `bao kv get ${target.mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`,\n          ),\n        );\n      }\n\n      const parsed = JSON.parse(result.stdout) as { data?: { data?: Record<string, unknown> } };\n      const data = parsed.data?.data;\n      const raw = data?.['talosconfig'] ?? data?.['config'];\n      if (typeof raw !== 'string' || raw.trim() === '') {\n        return yield* Effect.fail(\n          new Error(\n            `${target.mount}/${key} returned no talosconfig field. Expected a KV key named 'talosconfig' or 'config' — never store the value in Alchemy props.`,\n          ),\n        );\n      }\n\n      const talosconfigPath = `${Bun.env['TMPDIR'] ?? '/tmp'}/hf-talos-${target.cluster}-${Bun.randomUUIDv7()}.yaml`;\n      /**\n       * ⛔ 0600, CREATED EXCLUSIVELY, AND `Bun.write` CANNOT DO EITHER. This file holds the\n       *   cluster's admin client certificate — everything talosctl needs to reconfigure or wipe a\n       *   node. `Bun.write` takes no mode, so it lands at the process umask, which on this estate\n       *   is 0644: world-readable, in a world-readable directory, for as long as the resource\n       *   runs. The name is unguessable, and \"unguessable\" is not a permission.\n       * ⚠️ `wx` IS THE OTHER HALF. Opening with O_EXCL means this cannot be made to write through\n       *   a path an attacker pre-created — the classic /tmp symlink race — and with a UUIDv7 name\n       *   a collision is a genuine error rather than something to paper over.\n       * ⚠️ THE FINALIZER BELOW REMOVES IT ON EVERY EXIT PATH, but a hard kill (SIGKILL, power\n       *   loss) leaves it behind. 0600 is what makes that survivable rather than a disclosure.\n       */\n      yield* Effect.try({\n        try: () => {\n          const fd = openSync(talosconfigPath, 'wx', 0o600);\n          try {\n            writeFileSync(fd, raw);\n          } finally {\n            closeSync(fd);\n          }\n        },\n        catch: (cause) => new Error(`writing temp talosconfig: ${String(cause)}`),\n      });\n\n      yield* Effect.addFinalizer(() =>\n        Effect.tryPromise({\n          try: () => Bun.file(talosconfigPath).delete(),\n          catch: () => undefined,\n        }).pipe(Effect.orElseSucceed(() => undefined)),\n      );\n\n      return { talosconfigPath } satisfies TalosCredential;\n    }),\n  );\n",
     "/**\n * One `talosctl` invocation — stdout/stderr captured, secrets never echoed.\n *\n * ★ SHELL OUT LIKE ALCHEMY'S DOCKER PROVIDER (ChildProcessSpawner), NOT A SECOND SDK. Talos speaks\n *   gRPC; the published, stable surface for operators is `talosctl`. No Talos npm package is added.\n *\n * ⚠️ REASONED FROM docs.siderolabs.com/talos/v1.13/reference/cli — nothing here was measured on a\n *   live cluster in this session.\n *\n * ⛔ DO NOT LOG STDOUT ON FAILURE. `talosctl kubeconfig` and error paths have been observed in the\n *   wild to include credential material; stderr is the safe diagnostic channel.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/unstable/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';\n\nexport class TalosError extends Error {\n  constructor(\n    readonly command: string,\n    readonly exitCode: number,\n    detail: string,\n  ) {\n    super(`talosctl ${command} -> ${String(exitCode)}: ${detail}`);\n    this.name = 'TalosError';\n  }\n}\n\nexport type TalosRunOptions = {\n  readonly talosconfigPath: string;\n  readonly nodes?: readonly string[];\n  readonly endpoints?: readonly string[];\n};\n\n/** Run `talosctl <args…>`. Returns trimmed stdout, or '' when empty. */\nexport const talosctl = (args: readonly string[], options: TalosRunOptions) =>\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n    const argv = [\n      ...args,\n      '--talosconfig',\n      options.talosconfigPath,\n      ...(options.nodes === undefined ? [] : ['--nodes', options.nodes.join(',')]),\n      ...(options.endpoints === undefined ? [] : ['--endpoints', options.endpoints.join(',')]),\n    ];\n    const result = yield* ChildProcess.make('talosctl', argv, {\n      detached: false,\n      extendEnv: true,\n      stderr: 'pipe',\n      stdin: 'ignore',\n      stdout: 'pipe',\n    }).pipe(\n      spawner.spawn,\n      Effect.flatMap((child) =>\n        Effect.all(\n          {\n            exitCode: child.exitCode,\n            stderr: child.stderr.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n            stdout: child.stdout.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n          },\n          { concurrency: 'unbounded' },\n        ),\n      ),\n      Effect.scoped,\n    );\n\n    const command = args.join(' ');\n    if (result.exitCode !== 0) {\n      return yield* Effect.fail(\n        new TalosError(command, result.exitCode, result.stderr.slice(0, 300)),\n      );\n    }\n    return result.stdout;\n  });\n\n/** Like `talosctl`, but exit code 1 with \"already\" in stderr is treated as success. */\nexport const talosctlOrAlready = (args: readonly string[], options: TalosRunOptions) =>\n  talosctl(args, options).pipe(\n    Effect.catchIf(\n      (cause): cause is TalosError =>\n        cause instanceof TalosError &&\n        cause.exitCode !== 0 &&\n        /already|exists|bootstrapped/i.test(cause.message),\n      () => Effect.succeed(''),\n    ),\n  );\n",
     "/**\n * Coercions and digests for Talos resources — every function here exists because a trap does.\n *\n * ⚠️ NOTHING IN THIS FILE TOUCHES A LIVE CLUSTER. Digests are computed from repo files or from\n *   kubeconfig YAML already on disk at reconcile time; tests use fixtures only.\n */\nimport { createHash } from 'node:crypto';\n\n/** Trim trailing whitespace only — leading space in YAML is meaningful. */\nexport const canonicalText = (text: string) => text.trimEnd();\n\n/** SHA-256 hex digest of canonical text. Safe to persist — it is not reversible to the input. */\nexport const sha256 = (text: string) =>\n  createHash('sha256').update(canonicalText(text)).digest('hex');\n\n/** Digest of a machine config file read from the repo. ⛔ Never persist the file body itself. */\nexport const configDigest = (text: string) => sha256(text);\n\ntype KubeconfigDoc = {\n  clusters?: {\n    cluster?: { server?: string; 'certificate-authority-data'?: string };\n    name?: string;\n  }[];\n  contexts?: { context?: { cluster?: string; user?: string }; name?: string }[];\n  users?: {\n    name?: string;\n    user?: { 'client-certificate-data'?: string; 'client-key-data'?: string };\n  }[];\n  'current-context'?: string;\n};\n\n/**\n * Public metadata extracted from a kubeconfig file on disk.\n *\n * ⛔ RETURNS FINGERPRINTS ONLY. The admin kubeconfig contains a client certificate; Alchemy state\n *   may hold the API server URL and CA/client cert digests, never the PEM bytes.\n */\nexport const kubeconfigMetadata = (\n  yamlText: string,\n  contextName: string,\n): { endpoint: string; caFingerprint: string; clientFingerprint: string } | undefined => {\n  let doc: KubeconfigDoc;\n  try {\n    doc = Bun.YAML.parse(yamlText) as KubeconfigDoc;\n  } catch {\n    return undefined;\n  }\n\n  const ctx = doc.contexts?.find((row) => row.name === contextName)?.context;\n  const clusterName = ctx?.cluster;\n  const userName = ctx?.user;\n  if (clusterName === undefined || userName === undefined) return undefined;\n\n  const cluster = doc.clusters?.find((row) => row.name === clusterName)?.cluster;\n  const user = doc.users?.find((row) => row.name === userName)?.user;\n  const endpoint = cluster?.server;\n  const ca = cluster?.['certificate-authority-data'];\n  const cert = user?.['client-certificate-data'] ?? user?.['client-key-data'];\n  if (endpoint === undefined || ca === undefined || cert === undefined) return undefined;\n\n  return {\n    caFingerprint: sha256(ca),\n    clientFingerprint: sha256(cert),\n    endpoint,\n  };\n};\n\n/** Resolve a config file path relative to the declaring stack file. */\nexport const resolveConfigPath = (stackDir: string, configFile: string) =>\n  configFile.startsWith('/') ? configFile : `${stackDir}/${configFile}`;\n",
     "/**\n * `Talos.Bootstrap` — initialize etcd once on ONE control-plane node.\n *\n * ★ REASONED FROM talosctl bootstrap (Talos v1.13 CLI reference): one node aborts the etcd join\n *   loop and forms the initial cluster; other control-plane nodes join after Kubernetes starts on\n *   the bootstrap node. This command must run exactly once per cluster.\n *\n * ⛔ NOT A FACTORY RESOURCE — bootstrap cannot be deleted or updated in place; `delete` is a no-op.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { mintTalosconfig } from './credentials.ts';\nimport type { TalosRequirements, WithTarget } from './resource.ts';\nimport { talosctl, talosctlOrAlready } from './talosctl.ts';\n\nexport interface BootstrapProps extends WithTarget {\n  /** The ONE control-plane node that receives `talosctl bootstrap`. */\n  node: string;\n  /** Machine configs for this node (and peers) must be applied first. */\n  after?: readonly unknown[];\n}\n\nexport interface BootstrapAttributes {\n  node: string;\n  bootstrapped: boolean;\n}\n\nexport interface TalosBootstrap extends Resource<\n  'Talos.Bootstrap',\n  BootstrapProps,\n  BootstrapAttributes,\n  never,\n  TalosRequirements\n> {}\n\nexport const TalosBootstrap = Resource<TalosBootstrap>('Talos.Bootstrap', {\n  /** etcd data is irreplaceable — opt into destroy explicitly if Talos ever adds an undo. */\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * REASONED: `talosctl get etcdmembers -o json` should list members after bootstrap.\n * ⚠️ NOT MEASURED — first live deploy confirms the resource type name.\n */\nconst isBootstrapped = (props: BootstrapProps, talosconfigPath: string) =>\n  talosctl(['get', 'etcdmembers', '-o', 'json'], {\n    nodes: [props.node],\n    talosconfigPath,\n  }).pipe(\n    Effect.map((text) => text.includes('\"id\"') || text.includes('\"member\"')),\n    Effect.orElseSucceed(() => false),\n  );\n\nconst read = (props: BootstrapProps) =>\n  Effect.gen(function* () {\n    const credential = yield* mintTalosconfig(props.target);\n    const bootstrapped = yield* isBootstrapped(props, credential.talosconfigPath);\n    return { bootstrapped, node: props.node };\n  });\n\nconst diff = (news: Input<BootstrapProps>, output: BootstrapAttributes | undefined) =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    const live = yield* read(news);\n    if (live.bootstrapped) return { action: 'noop' } as const;\n    return { action: 'update' } as const;\n  });\n\nconst reconcile = (props: BootstrapProps) =>\n  Effect.gen(function* () {\n    const credential = yield* mintTalosconfig(props.target);\n    const before = yield* isBootstrapped(props, credential.talosconfigPath);\n    if (!before) {\n      yield* talosctlOrAlready(['bootstrap'], {\n        nodes: [props.node],\n        talosconfigPath: credential.talosconfigPath,\n      });\n    }\n    const after = yield* isBootstrapped(props, credential.talosconfigPath);\n    if (!after) {\n      return yield* Effect.die(\n        new Error(\n          `${props.node}: bootstrap returned no error but etcd members are still absent. ` +\n            'Read back rather than trusting the exit code alone.',\n        ),\n      );\n    }\n    return { bootstrapped: true, node: props.node };\n  });\n\nconst handlers = {\n  delete: () => Effect.void,\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<BootstrapProps>;\n    output: BootstrapAttributes | undefined;\n  }) => diff(news, output),\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: BootstrapProps }) => read(olds),\n  reconcile: ({ news }: { news: BootstrapProps }) => reconcile(news),\n};\n\nexport const TalosBootstrapProvider = () =>\n  Provider.effect(TalosBootstrap, Effect.succeed(TalosBootstrap.Provider.of(handlers)));\n",