@homeflare/alchemy 0.10.1 → 0.12.0

package/dist/openbao/mount.d.ts

@@ -6,7 +6,7 @@
  *   in OpenBao, not Alchemy state.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — disabling a mount destroys every secret under it.
- *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  *
  * ★ REPLACE SEMANTICS (audited 2026-09-21, see src/openbao/REPLACE.md):
  *   · `type` changed → plans `replace`, and the APPLY FAILS, destroying nothing: the new

package/dist/openbao/pki-role.d.ts

@@ -36,7 +36,7 @@
  *   never a policy one — but neither is a measurement.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — see the delete comment below. Opt in with
- *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/policy.d.ts

@@ -15,8 +15,8 @@ import type * as HttpClient from 'effect/unstable/http/HttpClient';
  * ⛔ THERE IS NO `Bao.Secret`, AND THERE MUST NEVER BE ONE. Alchemy persists attributes to
  *   its state store and does NOT encrypt them: StateEncoding.ts unwraps `Redacted` to
  *   plaintext under a marker key, and nothing under alchemy/src/State encrypts. This
- *   estate's state store is the `alchemy` Postgres database, which pg-backup.sh dumps
- *   nightly (it enumerates EVERY non-template database), copies to CT100, and PBS backs up
+ *   estate's state store is the `alchemy` Postgres database, which a nightly job dumps
+ *   (it enumerates EVERY non-template database), copies to a backup guest, and PBS backs up
  *   from there. A KV value here would exist in four places, none of them OpenBao.
  *
  *   So this declares the SHAPE AROUND secrets. Every attribute it stores is a name, a

package/dist/openbao/proxmox-role-form.d.ts

@@ -1,5 +1,5 @@
 export interface BaoProxmoxRoleProps {
-    /** Mount path of the proxmox secrets engine, e.g. `proxmox-tb4`. A trailing slash is fine. */
+    /** Mount path of the proxmox secrets engine, e.g. `proxmox-c1`. A trailing slash is fine. */
     mount: string;
     /**
      * Role name, as `<mount>/roles/<name>` takes it.
@@ -61,7 +61,7 @@ export interface BaoProxmoxRoleAttributes {
     /** SHA-256 of the managed fields — safe to persist; see policy.ts. */
     digest: string;
 }
-/** `proxmox-tb4/roles/read` — read, write and delete all address the role here. */
+/** `proxmox-c1/roles/read` — read, write and delete all address the role here. */
 export declare const rolePath: (mount: string, name: string) => string;
 export declare const attributesOf: (props: Pick<BaoProxmoxRoleProps, 'mount' | 'name'>, live: Record<string, unknown>) => BaoProxmoxRoleAttributes;
 /**

package/dist/openbao/proxmox-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxmox-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role-form.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,mBAAmB;IAClC,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,mFAAmF;AACnF,eAAO,MAAM,QAAQ,UAAW,MAAM,QAAQ,MAAM,WAAwC,CAAC;AAE7F,eAAO,MAAM,YAAY,UAChB,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,CAAC,QAC5C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,wBAYF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,UACb,mBAAmB,KACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAWzE,CAAC;AAaF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,WACjB,MAAM,YACJ,MAAM,uBACK,MAAM,GAAG,SAAS,KACtC,MAAM,GAAG,SAIyF,CAAC;AAEtG,gGAAgG;AAChG,eAAO,MAAM,OAAO,eAAgB,wBAAwB,SAAS,mBAAmB,YAG9C,CAAC"}
+{"version":3,"file":"proxmox-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role-form.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,mBAAmB;IAClC,6FAA6F;IAC7F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,kFAAkF;AAClF,eAAO,MAAM,QAAQ,UAAW,MAAM,QAAQ,MAAM,WAAwC,CAAC;AAE7F,eAAO,MAAM,YAAY,UAChB,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,CAAC,QAC5C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,wBAYF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,UACb,mBAAmB,KACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAWzE,CAAC;AAaF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,WACjB,MAAM,YACJ,MAAM,uBACK,MAAM,GAAG,SAAS,KACtC,MAAM,GAAG,SAIyF,CAAC;AAEtG,gGAAgG;AAChG,eAAO,MAAM,OAAO,eAAgB,wBAAwB,SAAS,mBAAmB,YAG9C,CAAC"}

package/dist/openbao/proxmox-role.d.ts

@@ -3,20 +3,20 @@
  * mint user, plus the lease ceilings that consumer's tokens get. METADATA ONLY.
  *
  * ★ WHY THIS FAMILY MATTERS MORE THAN IT LOOKS. Declaring these roles is how the estate
- *   replaces HAND-MADE PERMANENT PVE TOKENS with short-lived minted ones. On TB4, SEVEN tokens
- *   carry expire=0 and privsep=0 — root@pam!proxbox-sync, mcp@pve!executor,
- *   monitoring@pve!exporter, sablier@pve!sablier, tofu@pve!ro, tofu@pve!apply and
- *   vaultmint@pve!engine. Six of those are one Bao.ProxmoxRole plus a scoped PVE user away from
+ *   replaces HAND-MADE PERMANENT PVE TOKENS with short-lived minted ones. On C1, SEVEN tokens
+ *   carry expire=0 and privsep=0 — root@pam!inventory-sync, agent@pve!executor,
+ *   metrics@pve!exporter, app@pve!app, iac@pve!ro, iac@pve!apply and
+ *   mint@pve!engine. Six of those are one Bao.ProxmoxRole plus a scoped PVE user away from
  *   being a 5-minute lease instead of a forever key.
  *
- *   The seventh cannot be. vaultmint@pve!engine is the credential the ENGINE ITSELF
+ *   The seventh cannot be. mint@pve!engine is the credential the ENGINE ITSELF
  *   authenticates with in order to mint anything at all: the thing that issues short-lived
  *   tokens needs a standing one, and no role can resolve that chicken-and-egg. It stays
  *   permanent, which makes it the single most valuable token on the cluster and the one whose
  *   rotation must be a deliberate, hand-run procedure rather than a plan.
  *
- *   MEASURED here: `bao read proxmox-tb4/config` returns parent_token_id
- *   `vaultmint@pve!engine`, parent_secret_set true, parent_secret_tail `…eb01` — the engine's
+ *   MEASURED here: `bao read proxmox-c1/config` returns parent_token_id
+ *   `mint@pve!engine`, parent_secret_set true, parent_secret_tail `…eb01` — the engine's
  *   own key, present and, by the schema's own "Write-only: never returned by a read", not
  *   retrievable. The seven-token inventory was handed to this change and NOT re-counted against
  *   the PVE API in this session.
@@ -27,13 +27,13 @@
  *
  * ⛔ ISSUANCE IS NOT THIS RESOURCE, AND MUST NEVER BECOME ONE. `<mount>/creds/<name>` returns a
  *   LIVE PVE TOKEN. Alchemy persists attributes unencrypted (StateEncoding.ts tags Redacted
- *   values rather than encrypting them) into the `alchemy` Postgres, which pg-backup.sh dumps
- *   nightly to CT100, from where PBS backs it up. A minted token declared as a resource would
+ *   values rather than encrypting them) into the `alchemy` Postgres, which a nightly job dumps
+ *   to a backup guest, from where PBS backs it up. A minted token declared as a resource would
  *   outlive its own lease in at least four places, none of them OpenBao. This resource declares
  *   the DOOR; walking through it is a runtime call, not a plan.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — deleting a role breaks every consumer that mints from
- *   it. Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   it. Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/ssh-role.d.ts

@@ -4,8 +4,8 @@
  * ⛔ THE SIGNING KEY IS OUT OF SCOPE AND MUST STAY OUT. `ssh/config/ca` holds (or generates)
  *   the CA private key and `ssh/sign/<role>` issues certificates. Neither is declarable
  *   here, for the reason policy.ts spells out: Alchemy persists attributes to its state
- *   store WITHOUT encrypting them, that store is the `alchemy` Postgres, and pg-backup.sh
- *   dumps it nightly to CT100. A CA key there would outlive the vault that guards it. This
+ *   store WITHOUT encrypting them, that store is the `alchemy` Postgres, and a nightly job
+ *   dumps it to a backup guest. A CA key there would outlive the vault that guards it. This
  *   resource declares the SHAPE a signature must satisfy — principals, extensions, TTLs.
  *
  * ⛔ THE ROLE WRITE IS A FULL REPLACE, NOT A PATCH. OpenBao rebuilds the role entry from the
@@ -29,7 +29,7 @@
  *
  * ★ `defaultRemovalPolicy: 'retain'`. Deleting this role locks every operator out of the
  *   estate — the memory note "operator SSH is homeflare-bot@<host>" is this CA. Opt in with
- *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/ownership/adopting.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Whether a `diff` or `reconcile` that holds attributes is looking at an ADOPTION — a live object
+ * that reached this stack's state by being FOUND, not by this resource's own create — so a family
+ * whose adoption must never change what it takes over (`Proxmox.Lxc`) can refuse any difference
+ * instead of writing it. adopt.ts and probe.ts decide WHETHER an object may be claimed; this says,
+ * once it is claimed, whether the claim is an adoption.
+ *
+ * ★ STATE ALREADY SAYS WHICH, AT BOTH HALVES OF A DEPLOY (alchemy 2.0.0-beta.79):
+ *   · PLAN, A COLD ADOPTION. The probe mints an instance id no row can hold (Plan.ts
+ *     `generateInstanceId()`), and `diff` then runs with that id and the attributes the probe
+ *     read. So no row holds the id.
+ *   · APPLY, THE SAME ADOPTION. Apply commits an `updating` row with `adopting: true` under that id
+ *     BEFORE it calls reconcile, and the flag stays until the update commits (Apply.ts). An
+ *     adoption whose apply was interrupted keeps it, so the next plan's `diff` sees it too.
+ *   · A RECOVERED CREATE. A `creating` row with no attributes, whose live object the recovery read
+ *     found. It is this resource's own create when the row proves it (probe.ts `provenOurs`, the
+ *     same proof the read asked). Otherwise the plan went on only because `--adopt` said so — an
+ *     adoption like any other.
+ *   · Any other row with attributes is state vouching for the object: not an adoption.
+ * ⚠️ OUTSIDE A STACK — no Stack or State in context, or a store that errors (rows.ts) — no row
+ *   holds anything, so every call is an adoption: the strict answer, never the permissive one. A
+ *   family then refuses an ordinary update's write as if it were an adoption's. `alchemy deploy`
+ *   and the Alchemist session provide both services.
+ */
+import * as Effect from 'effect/Effect';
+import type { Owner } from './adopt.ts';
+/**
+ * Whether `owner`'s call is an adoption (header). `settled` is the family's "live matches these
+ * props", asked only for a recovered create, with the props of the row that recorded it.
+ * ⛔ A CREATE IS NEVER ONE HERE. `output` undefined is reconcile's create path, which has its own
+ *   rule for a live object it finds (adopt.ts `refuseTakeover`).
+ */
+export declare const adopting: <E, R>(owner: Owner, settled: (recorded: unknown) => Effect.Effect<boolean, E, R>) => Effect.Effect<boolean, never, R>;
+//# sourceMappingURL=adopting.d.ts.map

package/dist/ownership/adopting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopting.d.ts","sourceRoot":"","sources":["../../src/ownership/adopting.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAIxC;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,CAAC,SACpB,KAAK,WACH,CAAC,QAAQ,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3D,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAO9B,CAAC"}

package/dist/ownership/probe.d.ts

@@ -1,13 +1,23 @@
 import * as Effect from 'effect/Effect';
 import type { Owner } from './adopt.ts';
 /**
- * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
- * or the recovery read (header): `found` is ours only when the state store records this instance
- * with its whole declaration AND `settled` — the family's own "live matches these props" — says so.
- * ⛔ `settled` NEVER FAILS THE READ. The recovery read runs with the INTERRUPTED deploy's props, so
+ * Whether the state store proves the live object this instance's own: a row records `ask.instanceId`
+ * with its whole declaration (whole.ts) AND `settled` — the family's own "live matches these props"
+ * — says so. The one proof ownership/ accepts for a live object state holds no attributes for; the
+ * recovery read (`ownedRead`) and an adoption check (adopting.ts) both ask it.
+ * ⛔ `settled` NEVER FAILS THE CALLER. The recovery read runs with the INTERRUPTED deploy's props, so
  *   a declaration that cannot be evaluated any more (a fragments directory since moved, a group
  *   name since renamed) would fail every later plan, the fix included. It reads as "not proven
- *   ours" instead — `Unowned`, which `--adopt` resolves — with the reason logged.
+ *   ours" instead, with the reason logged.
+ */
+export declare const provenOurs: <E, R>(ask: {
+    readonly fqn: string;
+    readonly instanceId: string;
+}, settled: Effect.Effect<boolean, E, R>) => Effect.Effect<boolean, never, R>;
+/**
+ * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
+ * or the recovery read (header): `found` is ours only when `provenOurs` says so, else `Unowned`,
+ * which `--adopt` resolves.
  */
 export declare const ownedRead: <A extends object, E, R>(ask: Owner, found: A | undefined, settled: Effect.Effect<boolean, E, R>) => Effect.Effect<A | undefined, never, R>;
 //# sourceMappingURL=probe.d.ts.map

package/dist/ownership/probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../src/ownership/probe.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGxC;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,OACzC,KAAK,SACH,CAAC,GAAG,SAAS,WACX,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KACpC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,CAsBpC,CAAC"}
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../src/ownership/probe.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGxC;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,OACxB;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,WACjD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KACpC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAoB9B,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,OACzC,KAAK,SACH,CAAC,GAAG,SAAS,WACX,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KACpC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,CAIpC,CAAC"}

package/dist/ownership/rows.d.ts

@@ -1,4 +1,16 @@
 import * as Effect from 'effect/Effect';
+/** One generation of a persisted row, as far as ownership/ reads it. */
+export type Generation = {
+    readonly instanceId?: unknown;
+    readonly status?: unknown;
+    readonly props?: unknown;
+    readonly attr?: unknown;
+    readonly old?: unknown;
+    /** Set by Apply on the `updating` row of an adoption, until that update commits (Apply.ts). */
+    readonly adopting?: unknown;
+};
+/** The generation `instanceId` names — at the FQN, or at a former FQN `renamedFrom` names. */
+export declare const recordedGeneration: (fqn: string, instanceId: string) => Effect.Effect<Generation | undefined>;
 /**
  * What the state store says of `instanceId` for this resource (at its FQN, or at a former FQN its
  * `renamedFrom` names — the planner migrates that row before it recovers it):

package/dist/ownership/rows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rows.d.ts","sourceRoot":"","sources":["../../src/ownership/rows.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAkDxC;;;;;;;;;GASG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtD,eAAO,MAAM,gBAAgB,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAKrF,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAI7E,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAUpF,CAAC"}
+{"version":3,"file":"rows.d.ts","sourceRoot":"","sources":["../../src/ownership/rows.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAmBxC,wEAAwE;AACxE,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAaF,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,QACxB,MAAM,cACC,MAAM,KACjB,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CASnC,CAAC;AAEL;;;;;;;;;GASG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtD,eAAO,MAAM,gBAAgB,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAKrF,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAI7E,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAUpF,CAAC"}

package/dist/ownership/store-fixture.d.ts

@@ -0,0 +1,10 @@
+import type { ResourceState } from 'alchemy/State/ResourceState';
+import * as Effect from 'effect/Effect';
+/** A row with no attributes: `creating`, or `replacing` when it carries an `old` generation. */
+export declare const row: (fqn: string, instanceId: string, old?: unknown, props?: unknown) => ResourceState;
+/**
+ * A stack `s` at stage `test` whose store holds `rows`: `A` and `B` declared with a `name`, and `Z`
+ * declared `renamedFrom('X')`.
+ */
+export declare const withStore: <A>(rows: Record<string, ResourceState>, effect: Effect.Effect<A>) => Promise<A>;
+//# sourceMappingURL=store-fixture.d.ts.map

package/dist/ownership/store-fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-fixture.d.ts","sourceRoot":"","sources":["../../src/ownership/store-fixture.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,gGAAgG;AAChG,eAAO,MAAM,GAAG,QACT,MAAM,cACC,MAAM,QACZ,OAAO,UACN,OAAO,KACb,aAO6B,CAAC;AAEjC;;;GAGG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,QACnB,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,UAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KACvB,OAAO,CAAC,CAAC,CAgBT,CAAC"}

package/dist/proxmox/acl.d.ts

@@ -36,14 +36,14 @@ import { type PveRequirements, type WithTarget } from './resource.ts';
 export type AclSubjectType = 'user' | 'group' | 'token';
 export interface AclProps extends WithTarget {
     /**
-     * The PVE object path the grant is ON — `/`, `/pool/house`, `/vms/101`, `/storage/local-zfs`.
+     * The PVE object path the grant is ON — `/`, `/pool/lab`, `/vms/101`, `/storage/local-zfs`.
      * ⚠️ NOT THE API PATH: `spec.path` below is the endpoint (`access/acl`). PVE's API overloads the
      *   word, so this file does too rather than renaming a field the cluster calls `path`.
      */
     path: string;
     /** Which kind of subject `ugid` names. Identity: changing it is a different grant. */
     type: AclSubjectType;
-    /** `tim@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */
+    /** `alice@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */
     ugid: string;
     /** The role bound here, e.g. `PVEAuditor`. ⚠️ It must exist — PVE refuses an unknown roleid. */
     roleid: string;

package/dist/proxmox/acl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAiB,MAAM,eAAe,CAAC;AAErF,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,cAAc,CAAC;IACrB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAmH9D,eAAO,MAAM,kBAAkB,gIAqE5B,CAAC"}
+{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAiB,MAAM,eAAe,CAAC;AAErF,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,cAAc,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAmH9D,eAAO,MAAM,kBAAkB,gIAqE5B,CAAC"}

package/dist/proxmox/api-token-form.d.ts

@@ -12,7 +12,7 @@ import type { ApiTokenAttributes, ApiTokenProps } from './api-token.ts';
  *
  * ⛔ THE WRITE SEMANTICS BELOW ARE READ FROM THE CLUSTER'S OWN PERL RATHER THAN INFERRED FROM THE
  *   API SCHEMA — `/usr/share/perl5/PVE/API2/User.pm`, subs `generate_token` and
- *   `update_token_info`, read over SSH on n2 on 2026-09-13. The two disagree in exactly the place
+ *   `update_token_info`, read over SSH on node-b on 2026-09-13. The two disagree in exactly the place
  *   that costs a forever-diff: the schema gives `expire` the default "same as user", and the code
  *   never implements it. api-token.ts records what that means.
  */
@@ -24,7 +24,7 @@ import type { PveSpec } from './resource.ts';
  *   `ugid`, so reporting it as an attribute is what lets a privilege-separated token be granted
  *   anything at all without somebody retyping the join by hand.
  *
- * ⚠️ DERIVED, NOT READ. MEASURED: `GET /access/users/monitoring@pve/token/exporter` answers
+ * ⚠️ DERIVED, NOT READ. MEASURED: `GET /access/users/metrics@pve/token/exporter` answers
  *   `{"expire":0,"privsep":0}` and echoes back neither half of its own identity. So this is built
  *   from props, cannot disagree with the path the read used, and is therefore true by
  *   construction — which is why it is reported and never compared.

package/dist/proxmox/api-token.d.ts

@@ -2,11 +2,11 @@
  * `Proxmox.ApiToken` — a PVE API token: the thing a service actually authenticates as.
  *
  * ⛔ THE SECRET EXISTS FOR ONE HTTP RESPONSE AND THEN NOWHERE. MEASURED from the cluster's own
- *   schema (`/usr/share/pve-docs/api-viewer/apidoc.js` on n2, 2026-09-13): POST returns
+ *   schema (`/usr/share/pve-docs/api-viewer/apidoc.js` on node-b, 2026-09-13): POST returns
  *   `["full-tokenid","info","value"]`; PUT returns `["comment","expire","full-tokenid","privsep",
  *   "value"]` with `value` present ONLY when `regenerate` was set; GET returns
  *   `["comment","expire","privsep"]` and never the secret. A live token agrees —
- *   `GET /access/users/monitoring@pve/token/exporter` answers `{"expire":0,"privsep":0}`. PVE says
+ *   `GET /access/users/metrics@pve/token/exporter` answers `{"expire":0,"privsep":0}`. PVE says
  *   it plainly on the POST: the value "needs to be stored as it cannot be retrieved afterwards".
  *
  * ⛔ SO A TOKEN THIS RESOURCE CREATES IS UNUSABLE, AND SAYING SO IS THE POINT OF THIS BLOCK. The
@@ -19,7 +19,7 @@
  *   ★ SO POINT THIS FAMILY AT TOKENS THAT ALREADY EXIST. `comment`, `expire` and `privsep` are the
  *     whole of a token's policy, and declaring them is real work: it is how `expire` stops being
  *     whatever somebody typed in 2024. Mint NEW tokens where the secret can be caught — OpenBao's
- *     `proxmox-tb4` mount, or a human at `pveum user token add`.
+ *     `proxmox-c1` mount, or a human at `pveum user token add`.
  *   ⚠️ THE CREATE PATH IS LEFT REACHABLE RATHER THAN STUBBED. A create that silently did nothing
  *     would be the same lie as the stubbed delete resource.ts's ★ refuses; the honest arrangement
  *     is a create that works and a header that says what it produces.
@@ -31,8 +31,8 @@
  *   that owns the lease, or to a human who is watching.
  *
  * ⚠️ THERE IS A SECOND WRITER TO THESE OBJECTS AND IT IS THE ONE THIS PROVIDER RUNS ON. OpenBao's
- *   `proxmox-tb4` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` — read from
- *   `house/platform/secrets/vault/plugin-proxmox/proxmox/`: `privsep=0` (client.go), `expire` set
+ *   `proxmox-c1` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` — read from
+ *   `<estate>/platform/secrets/vault/plugin-proxmox/proxmox/`: `privsep=0` (client.go), `expire` set
  *   to the lease deadline, and an id the plugin CHOOSES,
  *   `hf-<role>-<actor>-<entity6>-<stamp>-<nonce>` (tokenname.go). Revocation and WAL rollback look
  *   up that one exact id (wal.go); neither sweeps a prefix. So the two systems cannot collide on
@@ -59,7 +59,7 @@ import * as Provider from 'alchemy/Provider';
 import { type PveRequirements, type WithTarget } from './resource.ts';
 export interface ApiTokenProps extends WithTarget {
     /**
-     * The account that owns the token, realm-qualified: `tofu@pve`, `root@pam`. Identity.
+     * The account that owns the token, realm-qualified: `iac@pve`, `root@pam`. Identity.
      *
      * ⚠️ THE ACCOUNT MUST ALREADY EXIST. Every method here runs `check_user_exist` first, so a
      *   token named under a missing user fails the READ (folded to "absent") and then fails the
@@ -117,7 +117,7 @@ export interface ApiTokenProps extends WithTarget {
      *   — `$privsep = $privsep ? 1 : 0` (AccessControl.pm:1622), so there is no unset state to
      *   preserve. Were this optional, adopting a live token without mentioning `privsep` would plan
      *   an update to 1 and STRIP a working credential of every privilege it has, silently: PVE
-     *   returns 401/403 to the service, nothing errors here, and `tofu@pve!apply` simply stops
+     *   returns 401/403 to the service, nothing errors here, and `iac@pve!apply` simply stops
      *   working. Required, so adopting a token is a sentence that states what it is.
      * ⚠️ AND `false` IS NOT A SHRUG. It is a token with its owner's whole privilege set; under a
      *   provisioning account that is the account's full authority with a separate secret.
@@ -139,9 +139,9 @@ export interface ProxmoxApiToken extends Resource<'Proxmox.ApiToken', ApiTokenPr
  * ★ `retain` BY DEFAULT, AND THIS IS THE PLAINEST CASE FOR IT IN THE PACKAGE. A token's contents
  *   are one irreplaceable secret: delete it and the value is gone, a replacement is a DIFFERENT
  *   value, and every holder loses access the instant `cfs_write_file` returns — with no error
- *   raised anywhere near them. The live cluster's tokens are `monitoring@pve!exporter` (the PVE
- *   exporter feeding VictoriaMetrics), `mcp@pve!executor`, `tofu@pve!apply`, `tofu@pve!ro`,
- *   `sablier@pve!sablier` and `vaultmint@pve!engine` — the last being the parent credential the
+ *   raised anywhere near them. The live cluster's tokens are `metrics@pve!exporter` (the PVE
+ *   exporter feeding VictoriaMetrics), `agent@pve!executor`, `iac@pve!apply`, `iac@pve!ro`,
+ *   `app@pve!app` and `mint@pve!engine` — the last being the parent credential the
  *   OpenBao mount itself authenticates with, so orphaning that one would stop every plan in this
  *   package, this resource included. `delete` is FULLY IMPLEMENTED (DELETE is a real method on
  *   this path, measured) and runs the moment a caller opts in with `.pipe(RemovalPolicy.destroy())`.
@@ -150,7 +150,7 @@ export interface ProxmoxApiToken extends Resource<'Proxmox.ApiToken', ApiTokenPr
 export declare const ProxmoxApiToken: import("alchemy").ResourceClass<ProxmoxApiToken>;
 /**
  * ⛔ `list` IS EMPTY, AND FOR THIS FAMILY THAT MATTERS MORE THAN THE GENERIC ARGUMENT IN
- *   resource.ts. A token index handed to Alchemy would offer up `vaultmint@pve!engine` and every
+ *   resource.ts. A token index handed to Alchemy would offer up `mint@pve!engine` and every
  *   live OpenBao lease for adoption — and adoption is what makes a later plan willing to delete.
  *   The mount's leases in particular appear and vanish on their own; anything that adopted one
  *   would report drift against a credential that was never its to hold.

package/dist/proxmox/ceph-daemon-form.d.ts

@@ -9,7 +9,7 @@
  *   here decides a diff; `findRow` picks a row out of an answer its caller already fetched.
  *
  * ⛔ THE TWO PATHS ARE DIFFERENT AND THAT IS THE WHOLE REASON THIS FILE HAS TWO OF THEM. MEASURED
- *   on n2, 2026-09-13: there is no GET on the id path — `pvesh get /nodes/n2/ceph/mon/n2` answers
+ *   on node-b, 2026-09-13: there is no GET on the id path — `pvesh get /nodes/node-b/ceph/mon/node-b` answers
  *   "No 'get' handler defined" — while POST and DELETE are registered ONLY there. So the read uses
  *   `collectionPath` and the two writes use `daemonPath`, and swapping either one is a silent
  *   501: a create that never lands, or a destroy that reports failure while the daemon runs on.
@@ -38,8 +38,8 @@ import type { CephDaemonProps } from './ceph-daemon.ts';
 export declare const daemonId: (props: CephDaemonProps) => string;
 /**
  * The read path. ⚠️ `{node}` HERE IS ONLY THE NODE BEING ASKED, not a filter. MEASURED:
- *   `GET /nodes/n2/ceph/mon` returns n2, n3 AND n4, and `GET /nodes/n3/ceph/mon` returns the same
- *   three IN A DIFFERENT ORDER — [n4,n2,n3] from n2 against [n3,n2,n4] from n3. A caller that took
+ *   `GET /nodes/node-b/ceph/mon` returns node-b, node-c AND node-d, and `GET /nodes/node-c/ceph/mon` returns the same
+ *   three IN A DIFFERENT ORDER — [node-d,node-b,node-c] from node-b against [node-c,node-b,node-d] from node-c. A caller that took
  *   row zero, or assumed the list was this node's daemons, would be wrong on both counts.
  */
 export declare const collectionPath: (props: CephDaemonProps) => string;

package/dist/proxmox/ceph-daemon.d.ts

@@ -2,7 +2,7 @@
  * `Proxmox.CephDaemon` — a Ceph monitor, manager or metadata server on one node.
  *
  * ★ ONE RESOURCE FOR THREE KINDS, AND THE SCHEMAS WERE CHECKED BEFORE THAT WAS DECIDED. Parsed
- *   from `/usr/share/pve-docs/api-viewer/apidoc.js` on n2, 2026-09-13: mon, mgr and mds each
+ *   from `/usr/share/pve-docs/api-viewer/apidoc.js` on node-b, 2026-09-13: mon, mgr and mds each
  *   expose GET on the collection and POST + DELETE on the id below it, each returns
  *   name/host/state/addr/ceph_version*, and the only divergence is the create parameter
  *   (`mon-address` / none / `hotstandby`) and the read-only extras (mon: quorum, rank; mds: rank,
@@ -10,11 +10,11 @@
  *   times over and let them drift — the argument resource.ts already makes for the factory itself.
  *
  * ⛔ THE ONLY GET IS THE COLLECTION'S, AND IT ANSWERS FOR THE WHOLE CLUSTER. MEASURED:
- *   `GET /nodes/n2/ceph/mon` returns n2, n3 AND n4, and `GET /nodes/n3/ceph/mon` returns the same
- *   three IN A DIFFERENT ORDER — [n4,n2,n3] from n2, [n3,n2,n4] from n3 — so a row is found by
+ *   `GET /nodes/node-b/ceph/mon` returns node-b, node-c AND node-d, and `GET /nodes/node-c/ceph/mon` returns the same
+ *   three IN A DIFFERENT ORDER — [node-d,node-b,node-c] from node-b, [node-c,node-b,node-d] from node-c — so a row is found by
  *   `name` and NEVER by position, and the `{node}` in the path is only the node being ASKED.
- *   MEASURED too: there is no GET on the id path at all; `pvesh get /nodes/n2/ceph/mon/n2` answers
- *   "No 'get' handler defined for '/nodes/n2/ceph/mon/n2'", and mgr and mds answer the same.
+ *   MEASURED too: there is no GET on the id path at all; `pvesh get /nodes/node-b/ceph/mon/node-b` answers
+ *   "No 'get' handler defined for '/nodes/node-b/ceph/mon/node-b'", and mgr and mds answer the same.
  *   That is why `path()` below is the COLLECTION, and that in turn is why `delete` is the one
  *   handler this file writes by hand: `pveOperations.destroy` sends its DELETE to `spec.path`,
  *   which here would be the collection — a 501 reported as a failed destroy, with the daemon still
@@ -27,11 +27,11 @@
  *   strips its section from ceph.conf. THREE MONS TOLERATE ONE LOSS; TWO TOLERATE NONE. Removing
  *   two in one deploy — or removing the mon on the node whose API is serving the call — loses
  *   quorum, and a cluster without mon quorum BLOCKS every RBD and CephFS I/O rather than erroring
- *   it, so on this cluster every guest on `cephtb4` hangs.
+ *   it, so on this cluster every guest on `rbd-c1` hangs.
  *   `mds`: destroying a STANDBY is a non-event; destroying the ACTIVE one fails CephFS over,
- *   and with no standby left `cephfs-tb4` goes unavailable. `mgr`: no guest I/O depends on it, but
+ *   and with no standby left `cephfs-c1` goes unavailable. `mgr`: no guest I/O depends on it, but
  *   the last one takes the PG autoscaler, the dashboard and PVE's own Ceph status with it.
- *   Live on 2026-09-13: mon, mgr AND mds on each of n2, n3, n4.
+ *   Live on 2026-09-13: mon, mgr AND mds on each of node-b, node-c, node-d.
  *
  * ★ AND THE ONLY WAY TO REACH THAT DESTROY IS TO DELETE THE DECLARATION. `matches` is deliberately
  *   total (see its ⛔), so this resource CANNOT plan a `replace` — which is the one action that
@@ -41,7 +41,7 @@
  *   `Sys.Audit`/`Datastore.Audit` on `/`, and PVEAuditor holds both (MEASURED:
  *   `GET /access/roles/PVEAuditor`), so the mount's `read` role can see this family — unlike
  *   `Proxmox.Storage`, which 403s under that lease. POST and DELETE both check `Sys.Modify` on
- *   `/`, and MEASURED on this cluster `LXCProvisioner` already holds it, so the provision lane
+ *   `/`, and MEASURED on this cluster the provision role already held it (it is in `PROVISION_PRIVILEGES`), so the provision lane
  *   needs no widening for once. ⚠️ `Sys.Modify` on the ROOT path is broad — it also buys
  *   datacenter options and every other cluster-wide config write — so it is worth knowing that
  *   this credential already has it rather than discovering it the next time something is scoped.
@@ -80,9 +80,9 @@ export interface CephDaemonProps extends WithTarget {
     name?: string;
     /**
      * mon only. Overrides the autodetected monitor IP; must sit in Ceph's public network — on this
-     * cluster that is 10.20.11.0/24, carried by `vmbr1.11`.
+     * cluster that is 198.51.100.0/24, carried by `vmbr1.42`.
      * ⛔ CREATE-ONLY AND NEVER COMPARED. PVE takes a bare ip-list on write and hands back `addr` as
-     *   `10.20.11.12:6789/0` — an address, a port and a nonce. The two are not the same string and
+     *   `198.51.100.12:6789/0` — an address, a port and a nonce. The two are not the same string and
      *   never will be, so diffing them would report a mismatch on every plan; with no PUT on this
      *   family that mismatch becomes a REPLACE, and a replace of a mon is the quorum loss in the
      *   header. Left out of `matches` on purpose.
@@ -92,7 +92,7 @@ export interface CephDaemonProps extends WithTarget {
      * mds only. Makes this standby replay the active MDS's journal for a faster failover.
      * ⛔ CREATE-ONLY AND NEVER COMPARED, AND THE FIELD THAT LOOKS LIKE ITS READBACK IS NOT ONE.
      *   `standby_replay` in the list is the daemon's CURRENT state, not its configuration: MEASURED
-     *   2026-09-13, all three mds report `standby_replay: false`, n3 included — and n3 is the ACTIVE
+     *   2026-09-13, all three mds report `standby_replay: false`, node-c included — and node-c is the ACTIVE
      *   mds, which is not a standby at all and so can never report true however it was created.
      *   Comparing `hotstandby` to it would plan a replace against whichever mds Ceph happens to have
      *   elected, i.e. against a value no declaration controls.
@@ -121,22 +121,22 @@ export interface CephDaemonAttributes {
     host: string;
     /**
      * mon `running`/`stopped`/`unknown`, mgr `active`/`standby`, mds `up:active`/`up:standby`/…
-     * ⛔ CEPH ELECTS THIS AND REWRITES IT WITHOUT ANYONE DECLARING ANYTHING. MEASURED: mgr n2 is
-     *   `active` while n3 and n4 are `standby`; mds n3 is `up:active` while n2 and n4 are
+     * ⛔ CEPH ELECTS THIS AND REWRITES IT WITHOUT ANYONE DECLARING ANYTHING. MEASURED: mgr node-b is
+     *   `active` while node-c and node-d are `standby`; mds node-c is `up:active` while node-b and node-d are
      *   `up:standby`. Restart a daemon and the roles move. It is reported so a plan can show what is
      *   live and kept out of `matches` so that an election is never a diff.
      * ⚠️ IT ALSO MEANS THIS RESOURCE DOES NOT MANAGE WHETHER THE DAEMON IS RUNNING. A configured but
      *   stopped daemon is still a row in the list, so it reads as present and plans `noop`.
      */
     state: string;
-    /** Ceph-formatted, e.g. `10.20.11.12:6789/0`. Reported; see `mon-address` for why never compared. */
+    /** Ceph-formatted, e.g. `198.51.100.12:6789/0`. Reported; see `mon-address` for why never compared. */
     addr: string;
     /** `ceph_version_short`, e.g. `20.2.2`. Reported: a straggler after an upgrade is worth seeing. */
     version: string;
     /**
      * mon rank in the monmap, mds rank in the filesystem, `-1` when the daemon has neither.
-     * ⛔ CEPH ASSIGNS IT AND NOTHING DECLARES IT. MEASURED: the mons are ranked n4=0, n3=1, n2=2 —
-     *   monmap order, not declaration order — and the mds ranks are 0 for the active n3 and -1 for
+     * ⛔ CEPH ASSIGNS IT AND NOTHING DECLARES IT. MEASURED: the mons are ranked node-d=0, node-c=1, node-b=2 —
+     *   monmap order, not declaration order — and the mds ranks are 0 for the active node-c and -1 for
      *   the two standbys. Rank moves when a daemon is added, removed or restarted.
      */
     rank: number;
@@ -145,8 +145,8 @@ export interface CephDaemonAttributes {
     /** mds only, and NOT the readback of `hotstandby` — see the ⛔ on that prop. */
     standbyReplay: boolean;
     /**
-     * mds only: the CephFS this daemon currently serves — `cephfs-tb4` here.
-     * ⛔ PRESENT ONLY ON THE ACTIVE MDS. MEASURED: n3 carries `fs_name`, n2 and n4 have no such key
+     * mds only: the CephFS this daemon currently serves — `cephfs-c1` here.
+     * ⛔ PRESENT ONLY ON THE ACTIVE MDS. MEASURED: node-c carries `fs_name`, node-b and node-d have no such key
      *   at all. So it is empty for two of three identical declarations, and comparing it would
      *   report work on exactly the daemons that are healthy standbys.
      */

package/dist/proxmox/ceph-daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-daemon.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEnD,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,IAAI,EAAE,cAAc,CAAC;IACrB;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;IAChB,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AA+CH,eAAO,MAAM,yBAAyB,uIAoBnC,CAAC"}
+{"version":3,"file":"ceph-daemon.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEnD,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,IAAI,EAAE,cAAc,CAAC;IACrB;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;IAChB,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AA+CH,eAAO,MAAM,yBAAyB,uIAoBnC,CAAC"}

package/dist/proxmox/ceph-flag.d.ts

@@ -2,7 +2,7 @@
  * `Proxmox.CephFlag` — one cluster-wide Ceph OSD flag, declared: `noout`, `pause`, `norebalance`.
  *
  * ★ ONE RESOURCE PER FLAG, NOT ONE CARRYING ALL ELEVEN, AND THE CLUSTER'S OWN API DECIDED IT.
- *   MEASURED on TB4 2026-09-13 (pve-manager 9.2.11, ceph tentacle 20.2.2) by reading
+ *   MEASURED on C1 2026-09-13 (pve-manager 9.2.11, ceph tentacle 20.2.2) by reading
  *   `/usr/share/perl5/PVE/API2/Cluster/Ceph.pm` and the published schema in
  *   `/usr/share/pve-docs/api-viewer/apidoc.js`:
  *     · `PUT /cluster/ceph/flags` ends in `fork_worker('cephsetflags', ...)` and returns a STRING
@@ -30,7 +30,7 @@
  *     defaulting to false would make `CephFlag('noout', { flag: 'noout', target })` mean "clear
  *     it" — the dangerous direction, chosen by OMISSION. Here the dangerous sentence has to be
  *     typed out by a person. Do not add a default, and do not declare a flag merely to document
- *     that it is off: MEASURED 2026-09-13, all eleven flags on TB4 read 0, so eleven
+ *     that it is off: MEASURED 2026-09-13, all eleven flags on C1 read 0, so eleven
  *     `value: false` lines would plan green forever and do nothing except take the brake off
  *     whenever somebody happens to apply them.
  *
@@ -58,8 +58,8 @@
  *   and plans `noop` straight past it. It cannot express a half-pause, so never use it to prove
  *   one is gone; `ceph osd dump | head -1` can.
  *   ⛔ `pause` AND `noup` ARE ALSO THE TWO THAT TAKE THE CLUSTER DOWN FROM A TYPO. `pause: true`
- *     stops all reads and writes, so every guest on `cephtb4` — the cluster's only rbd pool,
- *     MEASURED 2026-09-13 — freezes on its root disk, and so does `cephfs-tb4`. `noup: true`
+ *     stops all reads and writes, so every guest on `rbd-c1` — the cluster's only rbd pool,
+ *     MEASURED 2026-09-13 — freezes on its root disk, and so does `cephfs-c1`. `noup: true`
  *     stops a rebooted OSD from ever rejoining. Neither is undone by deleting the line.
  *
  * ⚠️ PRIVILEGES, AND THE WRITE ONE IS A BIG ASK. Both GETs check `Sys.Audit` on `/`; both PUTs
@@ -80,7 +80,7 @@ import { type PveRequirements, type WithTarget } from './resource.ts';
  *
  * ⚠️ THE ENUM IS CLOSED AND A TYPO IS A 400, WHICH IS WHY THIS IS A UNION AND NOT `string`. Both
  *   the GET and the PUT declare `additionalProperties => 0` over exactly this list.
- * ⚠️ CEPH HAS FLAGS PVE DOES NOT MODEL, and four of them are always on. MEASURED on TB4:
+ * ⚠️ CEPH HAS FLAGS PVE DOES NOT MODEL, and four of them are always on. MEASURED on C1:
  *   `ceph osd dump` reports `flags sortbitwise,recovery_deletes,purged_snapdirs,pglog_hardlimit`.
  *   PVE reads that same string and answers only about its own eleven, so the others can neither
  *   leak in here nor be set from here — `noautoscale` and `nosnaptrim` included.

package/dist/proxmox/ceph-fs-wire.d.ts

@@ -16,7 +16,7 @@
  *
  * ⛔ POST AND DELETE ANSWER WITH A UPID, NOT A RESULT — THE WRITE IS ASYNCHRONOUS AND A FAILED ONE
  *   IS STILL HTTP 200. Read from the cluster's own source, /usr/share/perl5/PVE/API2/Ceph/FS.pm on
- *   n2: `createfs` and `destroyfs` both end `return $rpcenv->fork_worker(...)`. Two different lies
+ *   node-b: `createfs` and `destroyfs` both end `return $rpcenv->fork_worker(...)`. Two different lies
  *   come out of trusting that status code. A read-back straight after the POST reports "still
  *   absent" about a filesystem that is being built as it says so — which is precisely the message
  *   `pveOperations.reconcile` would print, pointing at the wrong cause. And a worker that dies
@@ -26,7 +26,7 @@
  *     has not been observed; only the `fork_worker` that guarantees it is there.
  *
  * ⛔ A DELETE BODY IS SILENTLY DISCARDED BY PVE, SO `remove-pools` GOES IN THE QUERY STRING.
- *   MEASURED in /usr/share/perl5/PVE/APIServer/AnyEvent.pm on n2: line 928 reads the request
+ *   MEASURED in /usr/share/perl5/PVE/APIServer/AnyEvent.pm on node-b: line 928 reads the request
  *   content into params only `if ($method eq 'PUT' || $method eq 'POST')`, and line 1653 sends
  *   every other method down a branch that parses `$request->url->query()` and nothing else. So
  *   `pve(target, role, 'DELETE', path, form)` would send a body PVE never looks at: the flags would
@@ -41,7 +41,7 @@
  * ⛔ THE POLLER IS NEVER THE TASK'S OWNER, WHICH COSTS A PRIVILEGE, AND THIS ONE IS MEASURED
  *   RATHER THAN FEARED. client.ts mints a fresh credential per call and the mount vends a NEW
  *   token id each time, so the token reading the status is never the token recorded in the UPID —
- *   and PVE compares them exactly. /usr/share/perl5/PVE/API2/Tasks.pm on n2, `$check_task_user`:
+ *   and PVE compares them exactly. /usr/share/perl5/PVE/API2/Tasks.pm on node-b, `$check_task_user`:
  *   `return $user eq $fulltoken || $user eq $task->{user};`, above it the comment "token only sees
  *   token tasks, user sees user + token tasks". Token B of the same user matches neither branch.
  *   So the fallback is the schema's other clause for `GET /nodes/{node}/tasks/{upid}/status`: "The
@@ -75,8 +75,8 @@ export declare const createForm: (props: CephFsProps) => Record<string, string>;
  *
  * ⚠️ A CREATE NEEDS A RUNNING *AND* A STANDBY MDS, and refuses BEFORE it forks -- "no running
  *   Metadata Server (MDS) found!" / "no standby Metadata Server (MDS) found!" are synchronous, so
- *   they surface as a failed POST rather than as a silent worker. TB4 has three (MEASURED: n3
- *   `up:active` for cephfs-tb4, n2 and n4 `up:standby`), so this is a note for a smaller cluster.
+ *   they surface as a failed POST rather than as a silent worker. C1 has three (MEASURED: node-c
+ *   `up:active` for cephfs-c1, node-b and node-d `up:standby`), so this is a note for a smaller cluster.
  * ⚠️ BOTH WRITES CHECK `Sys.Modify` ON `/` -- the root, with the breadth metric-server.ts warns
  *   about: granting it buys datacenter options and every other cluster-wide config write too.
  */