@homeflare/alchemy 0.11.0 → 0.12.0

package/dist/proxmox/ceph-osd.d.ts

@@ -11,7 +11,7 @@
  *
  *   A PVE method with no permissions block is refused to every identity except `root@pam`, so an
  *   OpenBao-minted `hf-provision@pve!…` token is answered 403 however wide its role — widening
- *   `LXCProvisioner` cannot fix it. Compare the sibling families, which DO carry a check and
+ *   the provision role cannot fix it. Compare the sibling families, which DO carry a check and
  *   therefore do work with a token: `ceph/fs`, `ceph/mon` and `disks/zfs` all want `Sys.Modify`.
  *
  * ⚠️ SO THE WRITE PATH IS HONEST RATHER THAN USEFUL. It is written out properly in
@@ -19,7 +19,7 @@
  *   operator running as root@pam. Through this package's credential it will 403, and a 403 is a
  *   better answer than a `delete` that silently does nothing while the plan claims otherwise.
  *
- * ★ WHAT IT IS ACTUALLY FOR, THEN: ASSERTION. It turns "n2, n3 and n4 each hold two ssd OSDs"
+ * ★ WHAT IT IS ACTUALLY FOR, THEN: ASSERTION. It turns "node-b, node-c and node-d each hold two ssd OSDs"
  *   into a line a plan checks, and it gives Ceph-backed resources something real to depend on —
  *   read `osd.osdid` into an `rbd` storage's props and Alchemy orders that storage after the
  *   assertion, so a stack can no longer report a healthy Ceph storage on a cluster whose OSDs are
@@ -46,8 +46,8 @@ import type { WithTarget } from './resource.ts';
 export type { CephOsdAttributes };
 export interface CephOsdProps extends WithTarget {
     /**
-     * Which node ANSWERS the read — not where the OSD lives. MEASURED: the tree n2 returns and the
-     * tree n3 returns are the same six leaves, n4's included. Point this at any node that is up;
+     * Which node ANSWERS the read — not where the OSD lives. MEASURED: the tree node-b returns and the
+     * tree node-c returns are the same six leaves, node-d's included. Point this at any node that is up;
      * `host` is the field that says where the disk is.
      */
     node: string;
@@ -56,7 +56,7 @@ export interface CephOsdProps extends WithTarget {
     /**
      * The CRUSH host bucket this OSD must sit in. Undeclared means unmanaged, as in storage.ts.
      *
-     * ⚠️ DECLARING IT IS AN ASSERTION WITH NO REPAIR. If osd.2 turns up under n3, the plan reports
+     * ⚠️ DECLARING IT IS AN ASSERTION WITH NO REPAIR. If osd.2 turns up under node-c, the plan reports
      *   work every time and the deploy fails, because moving an OSD between failure domains is a
      *   `ceph osd crush move` this provider will not perform. That is the intent: a replica in the
      *   wrong failure domain is not something to converge quietly past.

package/dist/proxmox/ceph-pool-form.d.ts

@@ -4,34 +4,34 @@
  * ★ SPLIT OUT OF ceph-pool.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is
  *   "does this touch the cluster" — the same one metric-server-form.ts draws, just with more on
  *   this side because this family needs it. Here: the declared shape, the reported shape, and the
- *   coercions that turn one into the other. There: reading TB4, deciding a diff, and the four
+ *   coercions that turn one into the other. There: reading C1, deciding a diff, and the four
  *   handlers. Nothing in this file makes a call or decides an action.
  * ⚠️ THE PROPS LIVE HERE RATHER THAN IN THE RESOURCE FILE, which is the one place this pair
  *   differs from metric-server / notification-target. There is no `import type` cycle back as a
  *   result; ceph-pool.ts re-exports both interfaces so the public surface is unchanged.
  *
  * ⛔ POST AND PUT DO NOT TAKE THE SAME PARAMETERS, AND BOTH EXTRAS ARE DESTRUCTIVE. MEASURED from
- *   the cluster's own schema (/usr/share/pve-docs/api-viewer/apidoc.js on n2, pve-manager 9.2.11,
+ *   the cluster's own schema (/usr/share/pve-docs/api-viewer/apidoc.js on node-b, pve-manager 9.2.11,
  *   2026-09-13): POST adds `add_storages` and `erasure-coding` to the shared set, PUT takes
  *   neither. Both are refused below, so what is left between the two bodies is `name`, which PUT
  *   reads from the path, and `pg_num`.
  *
  * ⛔ `pg_num` IS IN THE CREATE BODY AND NOT IN THE UPDATE BODY, AND THAT IS THE MOST IMPORTANT
- *   LINE IN THIS FILE. MEASURED in PVE::API2::Ceph::Pool::createpool on n2: a POST carrying no
+ *   LINE IN THIS FILE. MEASURED in PVE::API2::Ceph::Pool::createpool on node-b: a POST carrying no
  *   `pg_num` gets 128 substituted (`$param->{pg_num} //= 128`), and PVE::Ceph::Tools::create_pool
  *   then runs `osd pool create` — which Ceph answers with SUCCESS for a pool that already exists,
  *   before applying the rest of the body to it. So a create fired at a live pool SETS its pg_num,
  *   and lowering pg_num starts a PG MERGE: hours of backfill across every OSD, on a cluster whose
- *   Ceph traffic shares vmbr1.11 with everything else. ceph-pool.ts guards the create for exactly
+ *   Ceph traffic shares vmbr1.42 with everything else. ceph-pool.ts guards the create for exactly
  *   that reason; this half simply never offers pg_num to an update.
  */
 import type { WithTarget } from './resource.ts';
 export interface CephPoolProps extends WithTarget {
     /**
-     * ⚠️ WHICH NODE THE CALL GOES THROUGH, NOT WHERE THE POOL LIVES. A pool is cluster-wide: n2 and
-     *   n3 answer byte-identically for `cephtb4` (measured). The endpoint is node-scoped only
+     * ⚠️ WHICH NODE THE CALL GOES THROUGH, NOT WHERE THE POOL LIVES. A pool is cluster-wide: node-b and
+     *   node-c answer byte-identically for `rbd-c1` (measured). The endpoint is node-scoped only
      *   because PVE talks to the local RADOS socket, so this is a door, not a location — it is never
-     *   compared, and moving a declaration from n2 to n3 plans noop. Point it at a node you expect
+     *   compared, and moving a declaration from node-b to node-c plans noop. Point it at a node you expect
      *   to be up: a node that is down makes the read fail, and a failed read reads as "absent".
      */
     node: string;
@@ -49,7 +49,7 @@ export interface CephPoolProps extends WithTarget {
     min_size?: number;
     /**
      * ⛔ CREATE-TIME ONLY, AND NEVER COMPARED — the single biggest noop hazard in this family. With
-     *   `pg_autoscale_mode` on or warn the autoscaler owns this number: MEASURED on TB4, `cephtb4`
+     *   `pg_autoscale_mode` on or warn the autoscaler owns this number: MEASURED on C1, `rbd-c1`
      *   sits at pg_num 128 while the autoscaler's own `pg_num_final` is 256, so a declaration
      *   diffing it reports an update the moment Ceph decides to act. A split is gradual even with
      *   the autoscaler off, and `nopgchange` can refuse the write outright — which kills the WHOLE
@@ -59,7 +59,7 @@ export interface CephPoolProps extends WithTarget {
     pg_num?: number;
     /** The floor the autoscaler may not go below. Operator-owned and stable, so it IS compared. */
     pg_num_min?: number;
-    /** ⚠️ PVE's create default is `warn`; Ceph's own is `on`, which is what all four TB4 pools have. */
+    /** ⚠️ PVE's create default is `warn`; Ceph's own is `on`, which is what all four C1 pools have. */
     pg_autoscale_mode?: 'off' | 'on' | 'warn';
     /**
      * The CRUSH rule BY NAME, e.g. `replicated_rule`.
@@ -105,7 +105,7 @@ export interface CephPoolProps extends WithTarget {
  *   size or its PG shape, and `set_pool` dies on the whole PUT when any one parameter will not
  *   apply (Tools.pm:310). `matches` refuses to diff the fields they freeze, so these attributes
  *   are the only place a plan can show WHY a declared size is not being enforced. All three read
- *   false on all four TB4 pools.
+ *   false on all four C1 pools.
  * ⚠️ `pg_num`, `id` AND `applications` ARE REPORTED AND NEVER COMPARED — see the props above.
  * ⛔ NO `statistics` AND NO `autoscale_status`, though the verbose read returns both. They change
  *   every few seconds; persisting them would rewrite this resource's state on every deploy and
@@ -160,7 +160,7 @@ export declare const same: <T>(declared: T | undefined, live: T, frozen?: boolea
  * A declared autoscaler hint, or nothing when it is zero.
  *
  * ⚠️ A DECLARED ZERO IS "NO FLOOR, NO HINT", AND IT IS DELIBERATELY LEFT UNCOMPARED. REASONED, NOT
- *   MEASURED: all four TB4 pools carry null for both `pg_num_min` and `target_size`, and finding
+ *   MEASURED: all four C1 pools carry null for both `pg_num_min` and `target_size`, and finding
  *   out for certain would mean writing to the cluster. Ceph CLEARS both when they are set to 0 and
  *   `osd pool get all` then omits the key, which PVE reports as null and this pair reads as UNSET
  *   — so a declared 0 would compare 0 against -1 on every plan, forever. Mapping 0 to UNSET
@@ -185,7 +185,7 @@ export declare const hint: (value: number | undefined) => number | undefined;
  * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — storage.ts's rule, and the opposite of
  *   Proxmox.Pool's. Undeclared means UNMANAGED here, because a pool has no one set of defaults to
  *   fall back on: PVE's POST fills in size 3, min_size 2, application rbd and pg_autoscale_mode
- *   'warn' (MEASURED in createpool), while Ceph's own defaults — which is what every pool on TB4
+ *   'warn' (MEASURED in createpool), while Ceph's own defaults — which is what every pool on C1
  *   was actually born with — put pg_autoscale_mode at 'on'. Guessing either set would rewrite a
  *   pool somebody tuned by hand.
  *
@@ -198,7 +198,7 @@ export declare const hint: (value: number | undefined) => number | undefined;
  *   NOT PVE's `1T` STRING. MEASURED: the API parses the string with PVE::JSONSchema::parse_size
  *   and stores Ceph's `target_size_bytes` (Pool.pm:474-477 for POST, 683-686 for PUT), and
  *   `GET .../status` hands that integer back under the name `target_size` (Pool.pm:878). Run on
- *   n2, `parse_size('1099511627776')` returns 1099511627776 — bare digits are bytes, no
+ *   node-b, `parse_size('1099511627776')` returns 1099511627776 — bare digits are bytes, no
  *   multiplier — so a byte count survives the round trip exactly, while a declared `1T` would read
  *   back as 1099511627776 and diff against itself on every plan, forever.
  */

package/dist/proxmox/ceph-pool-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-pool-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oGAAoG;IACpG,iBAAiB,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC;IAC1C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,CAAC;IACvC,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,KAAK,CAAC;IACzB,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oGAAoG;IACpG,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,UAAW,aAAa,WAAkD,CAAC;AAC9F,eAAO,MAAM,UAAU,UAAW,aAAa,WAAoC,CAAC;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,KAAK,KAAK,CAAC;AAExB,qGAAqG;AACrG,eAAO,MAAM,YAAY,UAAW,OAAO,WACoC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,8BACD,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,UAAW,MAAM,GAAG,SAAS,uBAAsC,CAAC;AASrF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAQrE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMrE,CAAC"}
+{"version":3,"file":"ceph-pool-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,iBAAiB,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC;IAC1C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,CAAC;IACvC,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,KAAK,CAAC;IACzB,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oGAAoG;IACpG,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,UAAW,aAAa,WAAkD,CAAC;AAC9F,eAAO,MAAM,UAAU,UAAW,aAAa,WAAoC,CAAC;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,KAAK,KAAK,CAAC;AAExB,qGAAqG;AACrG,eAAO,MAAM,YAAY,UAAW,OAAO,WACoC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,8BACD,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,UAAW,MAAM,GAAG,SAAS,uBAAsC,CAAC;AASrF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAQrE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMrE,CAAC"}

package/dist/proxmox/ceph-pool.d.ts

@@ -18,10 +18,10 @@
  *   string, so HTTP 200 means "the task started" — an immediate read-back can see a pool that does
  *   not exist yet, or values that have not landed. `settle` waits for the cluster to agree.
  *
- * ⛔ THE FOUR POOLS ON TB4 INCLUDE CEPH'S OWN, AND NONE OF THEM MAY BE ADOPTED. Measured
+ * ⛔ THE FOUR POOLS ON C1 INCLUDE CEPH'S OWN, AND NONE OF THEM MAY BE ADOPTED. Measured
  *   2026-09-13: `.mgr` (application `mgr`, created and owned by the manager daemons),
- *   `cephfs-tb4_data` and `cephfs-tb4_metadata` (the two halves of the `cephfs-tb4` filesystem —
- *   destroying either destroys the filesystem), and `cephtb4`, the rbd pool the guests sit on.
+ *   `cephfs-c1_data` and `cephfs-c1_metadata` (the two halves of the `cephfs-c1` filesystem —
+ *   destroying either destroys the filesystem), and `rbd-c1`, the rbd pool the guests sit on.
  *   `list` answers empty like every resource in this package, so adoption stays an explicit act;
  *   the `applications` attribute is reported so that a plan SHOWS which of those a declaration hit.
  *

package/dist/proxmox/client.d.ts

@@ -4,7 +4,7 @@
  * ★ PLAIN `fetch`, NO TLS ESCAPE HATCH, AND THAT IS A MEASURED CHOICE RATHER THAN AN OMISSION.
  *   Proxmox is usually met with `curl -k` because a fresh install serves its own self-signed
  *   certificate — I reached for `-k` myself before checking. This cluster serves a real Let's
- *   Encrypt certificate (`CN=cluster-tb4.example.com`), and strict TLS answers 401, i.e. the
+ *   Encrypt certificate (`CN=cluster-c1.example.com`), and strict TLS answers 401, i.e. the
  *   handshake succeeds and only the credential is missing. So there is no `rejectUnauthorized`
  *   option here to be left switched on by accident in somebody else's estate.
  *
@@ -46,7 +46,7 @@ export declare const pveEnvelopeWith: (target: PveTarget, credential: PveCredent
  * Make one call on a credential for `role`, REUSING a still-valid lease rather than minting one.
  *
  * 🔴 IT USED TO MINT PER CALL, AND AT 98 RESOURCES THAT STOPPED BEING FREE. One plan plus deploy
- *   of the TB4 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the
+ *   of the C1 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the
  *   read-back each minted their own, and `/etc/pve` is a replicated cluster filesystem every node
  *   has to agree on. src/lease-cache.ts carries the measurement and the safety argument.
  *

package/dist/proxmox/credentials.d.ts

@@ -2,13 +2,13 @@
  * The PVE credential a reconcile runs with: minted from OpenBao, alive for five minutes.
  *
  * ⛔ THERE IS NO STATIC WRITE TOKEN IN THIS ESTATE, AND THAT IS DELIBERATE. Every PVE token stored
- *   in `kv/infra/proxmox/*` is read-only — PVEAuditor on media/ops/tb4, Audit on pbs, all as
- *   `monitoring@pve`. The MCP proxmox client says why in its own header: the auditor token bounds
+ *   on the estate's static KV shelf is read-only — PVEAuditor on each cluster, Audit on PBS, all
+ *   as one metrics user. The MCP proxmox client says why in its own header: the auditor token bounds
  *   what a BUG can do, independently of what the code bounds. Adding a long-lived write token to
  *   that shelf would delete the outer lock for every reader of the shelf, not just for this
  *   provider.
  *
- * ★ SO WRITES COME FROM A DYNAMIC MOUNT INSTEAD, which the estate already built: `proxmox-tb4/`
+ * ★ SO WRITES COME FROM A DYNAMIC MOUNT INSTEAD, which the estate already built: `proxmox-c1/`
  *   exposes two roles — `read` (ttl 3600s) and `provision` (ttl 300s, max 1800s, NOT renewable).
  *   A mint returns a PVE API token of its own, `hf-provision@pve!hf-provision-…-<timestamp>-<id>`,
  *   which expires on its own whether or not anything cleans up. Same shape as
@@ -24,7 +24,7 @@
  *
  * ⛔ THE SECRET NEVER TOUCHES DISK, A LOG, OR ALCHEMY STATE. Alchemy persists resource attributes
  *   WITHOUT encryption — StateEncoding.ts writes `Redacted` as `{"@redacted": <plaintext>}` — and
- *   this estate's state store is the `alchemy` Postgres, which pg-backup.sh dumps nightly. A PVE
+ *   this estate's state store is the `alchemy` Postgres, which a nightly job dumps. A PVE
  *   secret that reached an attribute would outlive its 300s lease by months, in four places.
  *   Nothing here returns it to a resource; it is used to build a header and then dropped.
  */
@@ -54,10 +54,10 @@ export type PveRole = 'read' | 'provision';
  *   use this file unchanged; that is the whole difference between a provider and a script.
  */
 export type PveTarget = {
-    /** OpenBao mount that vends API tokens for this host, e.g. `proxmox-tb4`. */
+    /** OpenBao mount that vends API tokens for this host, e.g. `proxmox-c1`. */
     readonly mount: string;
     /**
-     * mgmt hostnames for cluster members, e.g. `n2.mgmt.example.com`. Any member's :8006 API
+     * mgmt hostnames for cluster members, e.g. `node-b.mgmt.example.com`. Any member's :8006 API
      * manages the whole cluster; `client.ts` failovers across them.
      */
     readonly members: readonly string[];
@@ -118,14 +118,14 @@ export type BaoEnvironment = Readonly<Record<string, string | undefined>>;
  * Mint one credential for `role`: `GET /v1/<mount>/creds/<role>` on OpenBao's HTTP API.
  *
  * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one
- *   client could not disagree with `bao kv get` about what this machine may do. house/openbao then
+ *   client could not disagree with `bao kv get` about what this machine may do. <estate>/openbao then
  *   learned twice what deciding by stderr costs — every failure read as absent, and two commands
  *   said "absent" in different words — so this reads STATUS CODES: 2xx is a credential, and 403
  *   (denied), 404 (no such role or mount — a mint has no "absent"), 503 (sealed) all fail.
  * ★ THE ENVIRONMENT CONTRACT IS STILL THE CLI's, READ THE CLI's WAY, which keeps the case above
  *   true (openbao v2.6.2 api/client.go:34-66, 370, 503-507, 761-762, 776-785): BAO_AGENT_ADDR over
  *   BAO_ADDR over https://127.0.0.1:8200; BAO_NAMESPACE as X-Vault-Namespace; BAO_TOKEN as
- *   X-Vault-Token; X-Vault-Request always. house/openbao/src/bao-address.ts has the long form.
+ *   X-Vault-Token; X-Vault-Request always. <estate>/openbao/src/bao-address.ts has the long form.
  * ★ AGENT MODE IS NO BAO_TOKEN AND NO TOKEN HEADER. An Agent or Proxy listener with
  *   `api_proxy { use_auto_auth_token = true }` (or the older `cache { … }`) substitutes its
  *   auto-auth token exactly when a request carries none — command/agentproxyshared/cache/handler.go

package/dist/proxmox/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/proxmox/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D;;;;;;;;;;;;GAYG;AACH,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAM1E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,IAAI,WAAY,SAAS,QAAQ,OAAO,QAAO,cAAc;;;;gCAuFtE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,aAAa,eAAgB,aAAa,UAAU,SAAS,KAAG,MAGf,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/proxmox/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D;;;;;;;;;;;;GAYG;AACH,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAM1E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,IAAI,WAAY,SAAS,QAAQ,OAAO,QAAO,cAAc;;;;gCAuFtE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,aAAa,eAAgB,aAAa,UAAU,SAAS,KAAG,MAGf,CAAC"}

package/dist/proxmox/firewall-alias-form.d.ts

@@ -33,7 +33,7 @@ export declare const fold: (name: string) => string;
 /**
  * A CIDR reduced to the one form PVE will hand back.
  *
- * ⛔ MEASURED by running the cluster's own `PVE::Firewall::parse_alias` on n2 (pve-manager 9.2.11,
+ * ⛔ MEASURED by running the cluster's own `PVE::Firewall::parse_alias` on node-b (pve-manager 9.2.11,
  *   2026-09-13) — a pure function over a string, no config read and none written:
  *     `10.1.1.5/32`     -> `10.1.1.5`        a /32 host suffix is STRIPPED
  *     `2001:0DB8::1/128`-> `2001:0DB8::1`    a /128 is stripped, and the case is NOT folded

package/dist/proxmox/firewall-alias.d.ts

@@ -61,7 +61,7 @@
  * ⚠️ PRIVILEGES, AND FOR ONCE NOTHING NEEDS WIDENING. MEASURED 2026-09-13 from the cluster's own
  *   schema and its live ACL: the item GET checks `["perm","/",["Sys.Audit"]]`, POST/PUT/DELETE
  *   check `["perm","/",["Sys.Modify"]]`, `hf-read@pve` holds `PVEAuditor` at `/` with propagate and
- *   `hf-provision@pve` holds `LXCProvisioner` at `/` with propagate. Both privileges are already
+ *   `hf-provision@pve` holds the provision role (provision-baseline.ts) at `/` with propagate. Both privileges are already
  *   held, so `readRole` stays the default `read` lane — unlike storage/sdn-zone/sdn-vnet, whose
  *   ITEM reads are gated on an allocate privilege the auditor cannot have.
  *   ⚠️ `Sys.Modify` ON `/` IS STILL A BIG HAMMER — it is the same grant `metric-server.ts` warns

package/dist/proxmox/generated/pbs.d.ts

@@ -2,7 +2,7 @@
  * Generated PBS API types — DO NOT EDIT BY HAND.
  *
  * Run: bun codegen/generate.ts
- * Source: house/proxmox/apidoc/ — see README there for provenance.
+ * Source: the cluster's own `apidoc.js` (pve-docs), extracted outside this repo.
  */
 /** GET /config/datastore — `data` payload after client unwrap. */
 export type ConfigDatastoreGetReturn = readonly {

package/dist/proxmox/generated/pve.d.ts

@@ -2,7 +2,7 @@
  * Generated PVE API types — DO NOT EDIT BY HAND.
  *
  * Run: bun codegen/generate.ts
- * Source: house/proxmox/apidoc/ — see README there for provenance.
+ * Source: the cluster's own `apidoc.js` (pve-docs), extracted outside this repo.
  */
 /** GET /cluster/replication — `data` payload after client unwrap. */
 export type ClusterReplicationGetReturn = readonly ({

package/dist/proxmox/group.d.ts

@@ -1,7 +1,7 @@
 /**
  * `Proxmox.Group` — a PVE group: a name, a comment, and the set of users PVE hangs off it.
  *
- * ★ DECLARING `hf-mint` IS THE WHOLE POINT OF THIS FAMILY. `vaultmint@pve` holds the `HFMint` role
+ * ★ DECLARING `hf-mint` IS THE WHOLE POINT OF THIS FAMILY. `mint@pve` holds the `MintTokens` role
  *   ON THE PATH `/access/groups/hf-mint` — measured from `GET /access/acl`, 2026-09-13 — which is
  *   what confines the OpenBao proxmox engine to minting inside that one group. The group is the
  *   fence around the credential every other resource in this package runs on, and until now it was
@@ -17,7 +17,7 @@
  *   in this file could ever settle.
  *
  * ⛔ THE INDEX AND THE ITEM DISAGREE ABOUT BOTH THE NAME AND THE TYPE, and this file reads only the
- *   item. MEASURED against n2, 2026-09-13:
+ *   item. MEASURED against node-b, 2026-09-13:
  *     GET /access/groups         -> [{"groupid":"hf-mint","comment":"…",
  *                                     "users":"hf-provision@pve,hf-read@pve"}, …]
  *     GET /access/groups/hf-mint -> {"comment":"…","members":["hf-provision@pve","hf-read@pve"]}
@@ -27,8 +27,8 @@
  *
  * ⛔ AND THE ITEM'S ORDER IS NOT STABLE BETWEEN TWO CONSECUTIVE CALLS. MEASURED, seconds apart, on
  *   the same endpoint:
- *     ["root@pam","tim@pve","tim@pam","tim@<account>.com@Schenanigans"]
- *     ["tim@pam","tim@pve","tim@<account>.com@Schenanigans","root@pam"]
+ *     ["root@pam","alice@pve","alice@pam","alice@example.com@corp"]
+ *     ["alice@pam","alice@pve","alice@example.com@corp","root@pam"]
  *   `read_group` builds it as `[keys %{ $data->{users} }]` — a bare Perl hash key list, whose order
  *   is randomised per process — while the INDEX sorts (`join(',', sort keys …)`). So the array is
  *   sorted on the way into `attributes` as well as being kept out of `matches`: unsorted, Alchemy's
@@ -45,7 +45,7 @@
  *       So `readRole` is left at the default `read` — unlike storage/sdn-zone/sdn-vnet, whose ITEM
  *       reads PVE gates on an allocate privilege. See the ⛔ on `readRole` in `resource.ts`.
  *     · POST, PUT and DELETE each check `Group.Allocate` on `/access/groups`, and
- *       `hf-provision@pve` holds it via `LXCProvisioner`.
+ *       `hf-provision@pve` holds it via the provision role (`PROVISION_PRIVILEGES`).
  *
  * ⛔ `retain` BY DEFAULT, BECAUSE DELETING A GROUP DESTROYS TWO THINGS THIS FILE CANNOT PUT BACK.
  *   Measured in `PVE::AccessControl` on the node:
@@ -53,8 +53,8 @@
  *       <comment>:`) and DERIVES each user's `groups` map from it at parse time. Deleting the group
  *       deletes the list, and this resource has no `members` prop to restore it from.
  *     · `delete_group_acl` then walks the whole ACL tree and drops every grant where the group is
- *       the SUBJECT. On this cluster that is `Schenanigans -> Administrator on /` and
- *       `HomeAssistant -> PVEAuditor on /`: whole populations of access, gone in one call, with no
+ *       the SUBJECT. On this cluster that is `admins -> Administrator on /` and
+ *       `automation -> PVEAuditor on /`: whole populations of access, gone in one call, with no
  *       confirmation and nothing in the plan to suggest it.
  *   `delete` is FULLY IMPLEMENTED — `DELETE /access/groups/{groupid}` exists, unlike the ACL
  *   family's — so `.pipe(RemovalPolicy.destroy())` really removes the group. See the ★ in
@@ -95,7 +95,7 @@ export interface ProxmoxGroup extends Resource<'Proxmox.Group', GroupProps, Grou
 export declare const ProxmoxGroup: import("alchemy").ResourceClass<ProxmoxGroup>;
 /**
  * ⛔ THE EMPTY `list` IS INHERITED FROM `pveHandlers` AND IT MATTERS HERE. `GET /access/groups`
- *   answers with every group on the cluster — on this one that is `Schenanigans`, which grants
+ *   answers with every group on the cluster — on this one that is `admins`, which grants
  *   `Administrator` on `/` to every human who logs in. Handing it to Alchemy would invite adoption,
  *   and therefore one day a delete that takes the whole admin group's access with it. Adoption
  *   stays an explicit act, here as everywhere else in this package.

package/dist/proxmox/ha-resource.d.ts

@@ -35,10 +35,11 @@
  *   (node-affinity and resource-affinity) and that is the next family to add; do not port the old
  *   groups endpoint back just because the docs still describe it.
  *
- * ⚠️ RECONCILE NEEDS `Sys.Console` ON `/`, WHICH `LXCProvisioner` DOES NOT HOLD. Read and diff are
+ * ⚠️ RECONCILE NEEDS `Sys.Console` ON `/`, WHICH THE PROVISION ROLE LACKED WHEN THIS WAS WRITTEN
+ *   (`PROVISION_PRIVILEGES` carries it now — ha-rule.ts has the measurement). Read and diff are
  *   fine — `GET /cluster/ha/resources/{sid}` checks `Sys.Audit`, which the role already has — while
  *   POST, PUT and DELETE all check `Sys.Console` on `/` and will answer "Permission check failed
- *   (/, Sys.Console)" until the role is widened. Widen it knowingly: `Sys.Console` is also what
+ *   (/, Sys.Console)" on a role without it. Widen it knowingly: `Sys.Console` is also what
  *   opens a root shell on every node (`/nodes/{node}/vncshell`, `termproxy`), so granting it to the
  *   provision credential buys HA membership at the price of node console access. A separate role
  *   for HA writes is the narrower answer if that trade is not wanted.

package/dist/proxmox/ha-resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ha-resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/ha-resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;GAOG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAErE,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,0FAA0F;IAC1F,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAAoD,CAAC;AAsDnF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yBAAyB,uIACuD,CAAC"}
+{"version":3,"file":"ha-resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/ha-resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;GAOG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAErE,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,0FAA0F;IAC1F,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAAoD,CAAC;AAsDnF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yBAAyB,uIACuD,CAAC"}

package/dist/proxmox/ha-rule-form.d.ts

@@ -14,21 +14,21 @@ import type { HaRuleProps } from './ha-rule.ts';
  * A `<node>[:<pri>]` list, spelled the way PVE gives it back.
  *
  * ⛔ THIS IS NOT `csv`, AND THE DIFFERENCE IS A FOREVER-DIFF. MEASURED by reading
- *   `/usr/share/perl5/PVE/HA/Rules/NodeAffinity.pm` on n2 (2026-09-13): `decode_plugin_value`
+ *   `/usr/share/perl5/PVE/HA/Rules/NodeAffinity.pm` on node-b (2026-09-13): `decode_plugin_value`
  *   turns the list into a HASH keyed by node name, and `encode_plugin_value` rebuilds it with
  *   `for my $node (sort keys %$value)` — sorted by NODE NAME, never by the token — emitting the
  *   bare name whenever the priority is falsy, because `PVE::HA::Tools::parse_node_priority` reads
- *   a missing priority as 0. So a declared `n3:1,n2:0` is handed back as `n2,n3:1`: re-ordered AND
+ *   a missing priority as 0. So a declared `node-c:1,node-b:0` is handed back as `node-b,node-c:1`: re-ordered AND
  *   re-spelled. Compare the raw strings and every plan reports an update, forever.
  *
  * ⚠️ SORTED BY NAME, NOT BY TOKEN, AND THE TWO GENUINELY DIVERGE. `csv` sorts whole tokens. Node
  *   names may contain `-` — `parse_node_priority`'s own regex is
- *   `[a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?` — and `-` (0x2D) sorts before `:` (0x3A), so `n2-a`
- *   and `n2:5` come out in one order by token and the other by name. PVE sorts by the name, so
+ *   `[a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?` — and `-` (0x2D) sorts before `:` (0x3A), so `node-b-a`
+ *   and `node-b:5` come out in one order by token and the other by name. PVE sorts by the name, so
  *   this does too.
  *
  * ⚠️ LAST ENTRY WINS FOR A REPEATED NODE, because PVE's decode is a hash assignment and a hash
- *   keeps one value per key. A declaration saying `n2:1,n2:5` is stored as `n2:5`; matching that
+ *   keeps one value per key. A declaration saying `node-b:1,node-b:5` is stored as `node-b:5`; matching that
  *   is what a Map gives for free.
  */
 export declare const nodeList: (value: readonly string[] | string | undefined) => string;

package/dist/proxmox/ha-rule.d.ts

@@ -1,7 +1,7 @@
 /**
  * `Proxmox.HaRule` — where the CRM may place a guest, and which guests must not share a node.
  *
- * ★ THIS IS THE PVE 9 SUCCESSOR TO HA GROUPS, AND THE GROUPS ENDPOINT IS GONE. MEASURED on n2
+ * ★ THIS IS THE PVE 9 SUCCESSOR TO HA GROUPS, AND THE GROUPS ENDPOINT IS GONE. MEASURED on node-b
  *   (pve-manager/9.2.11, 2026-09-13): `pvesh get /cluster/ha/groups` answers `cannot index groups:
  *   ha groups have been migrated to rules`, and `/etc/pve/ha/` holds `rules.cfg` with no
  *   `groups.cfg` beside it. The published schema still documents groups and still offers a `group`
@@ -48,8 +48,8 @@
  * ⚠️ BOTH LANES ALREADY HAVE THE PRIVILEGES, WHICH IS NEW. MEASURED 2026-09-13:
  *   GET (collection and item) checks `Sys.Audit` on `/` and the built-in `PVEAuditor` holds it, so
  *   `readRole` stays the default `read` lease — unlike storage.ts and the SDN families. POST, PUT
- *   and DELETE all check `Sys.Console` on `/`, and `pvesh get /access/roles/LXCProvisioner` now
- *   returns `Sys.Console` among its 27 privileges. The warning in ha-resource.ts's header — that
+ *   and DELETE all check `Sys.Console` on `/`, and the provision role now returns `Sys.Console` among
+ *   its 27 privileges (`PROVISION_PRIVILEGES`, provision-baseline.ts). The warning in ha-resource.ts's header — that
  *   `Sys.Console` is missing — is stale; the role was widened, and the price it named still stands:
  *   `Sys.Console` is also what opens a root shell on every node.
  *

package/dist/proxmox/index.d.ts

@@ -12,6 +12,9 @@
  *   The provider-only version diffed four fields and would have planned a create over any read
  *   failure. The Resource now adopts from the live config, refuses every change PVE cannot make
  *   in place, and retains on destroy (lxc.ts).
+ * ★ THE PROVISIONING BASELINE JOINED 2026-09-21: one privilege list (`PROVISION_PRIVILEGES`), the
+ *   helper that declares it (`declareProvisionBaseline`) and the pure generator of the one-time
+ *   root commands that bootstrap it (`provisionBootstrap`) — docs/provision-baseline.md.
  * ★ Anything else unlisted is still reachable by path if you genuinely need
  *   it — that is a deliberate, visible act rather than an accident of barrelling.
  */
@@ -37,6 +40,9 @@ export { PbsPruneJob, PbsPruneJobProvider } from './pbs-prune-job.ts';
 export { PbsSyncJob, PbsSyncJobProvider } from './pbs-sync-job.ts';
 export { PbsVerifyJob, PbsVerifyJobProvider } from './pbs-verify-job.ts';
 export { ProxmoxPool, ProxmoxPoolProvider } from './pool.ts';
+export { PROVISION_DEFAULTS, PROVISION_PRIVILEGES, type ProvisionBaseline, type ProvisionLane, type ProvisionNames, type ResolvedProvisionNames, provisionBaseline, } from './provision-baseline.ts';
+export { provisionBootstrap } from './provision-bootstrap.ts';
+export { type DeclareProvisionOptions, declareProvisionBaseline } from './provision-declare.ts';
 export { ProxmoxVmProvider } from './qemu.ts';
 export { ProxmoxReplicationJobProvider } from './replication-job.ts';
 export { ProxmoxRole, ProxmoxRoleProvider } from './role.ts';

package/dist/proxmox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxmox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxmox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,KAAK,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC"}