@homeflare/alchemy 0.11.0 → 0.13.0

package/dist/proxmox/lease-cache.d.ts

@@ -1,8 +1,8 @@
 /**
  * One credential per (target, role) for the life of a run, instead of one per API call.
  *
- * 🔴 THE MEASUREMENT THAT MADE THIS NECESSARY. A single `alchemy plan` plus `deploy` of the TB4
- *   stack — 98 resources — left **760 API token entries in `/etc/pve/user.cfg`**, counted on n2
+ * 🔴 THE MEASUREMENT THAT MADE THIS NECESSARY. A single `alchemy plan` plus `deploy` of the C1
+ *   stack — 98 resources — left **760 API token entries in `/etc/pve/user.cfg`**, counted on node-b
  *   immediately afterwards. `mint()` asked OpenBao for a new credential on EVERY call, and each
  *   mint creates a real Proxmox token: read, diff, reconcile and read-back each got their own. They
  *   drain as the leases expire (760 down to 712 over five minutes), so nothing was broken — but
@@ -52,9 +52,9 @@ import { type ApiTarget, type PveCredential, type PveRole } from './credentials.
  * What a credential is cached under.
  *
  * ⛔ KEYED ON THE OPENBAO MOUNT AND ROLE, NOT ON A MEMBER HOSTNAME. A PVE API token is
- *   cluster-wide — `user.cfg` is replicated — so n2, n3 and n4 share one credential. Keying on
+ *   cluster-wide — `user.cfg` is replicated — so node-b, node-c and node-d share one credential. Keying on
  *   `api` would mint three identical tokens when failover rotates members.
- * ★ THE MOUNT CANNOT COLLIDE ACROSS CLUSTERS: `proxmox-tb4`, `proxmox-ops` and `pbs-tb4` are
+ * ★ THE MOUNT CANNOT COLLIDE ACROSS CLUSTERS: `proxmox-c1`, `proxmox-c2` and `pbs-c1` are
  *   distinct OpenBao mounts with distinct policies; two estates never share a mount name.
  * ★ A PLAIN OBJECT IS A SAFE KEY BECAUSE EFFECT COMPARES KEYS STRUCTURALLY — two separately built
  *   literals with the same fields are one entry, which the probe above measured.

package/dist/proxmox/lxc-harness.d.ts

@@ -13,7 +13,7 @@ export declare const TARGET: PveTarget;
 export declare const LIVE: Readonly<Record<string, unknown>>;
 /** Where `seed` puts the production-shaped guest by default, and its `node/vmid` key. */
 export declare const NODE = "pve1";
-export declare const VMID = 100;
+export declare const VMID = 900;
 export declare const KEY: string;
 /** The live config as a declaration: every key, minus what pvesh adds that is not a prop. */
 export declare const pasted: (over?: Partial<LxcProps>) => LxcProps;

package/dist/proxmox/lxc-props.d.ts

@@ -35,7 +35,7 @@ export interface LxcProps extends WithTarget {
     /** MiB. */
     swap?: number;
     /**
-     * `local-zfs:subvol-100-disk-0,size=40G` as read, or `local-zfs:40` (40 GiB, new volume) to
+     * `local-zfs:subvol-900-disk-0,size=40G` as read, or `local-zfs:40` (40 GiB, new volume) to
      * create. See lxc-volume.ts for what may change: options in place, size up only.
      */
     rootfs?: string;
@@ -56,7 +56,7 @@ export interface LxcProps extends WithTarget {
     console?: PveFlag;
     tty?: number;
     cmode?: string;
-    /** `tank:subvol-100-disk-1,mp=/data,backup=1,size=100G`, or `tank:100,mp=/data` to create. */
+    /** `tank:subvol-900-disk-1,mp=/data,backup=1,size=100G`, or `tank:100,mp=/data` to create. */
     [mount: `mp${number}`]: string | undefined;
     /** `name=eth0,bridge=vmbr0,ip=dhcp`. ⚠️ An undeclared `hwaddr` keeps the live MAC. */
     [nic: `net${number}`]: string | undefined;

package/dist/proxmox/lxc.d.ts

@@ -1,9 +1,9 @@
 /**
  * `Proxmox.Lxc` — a container, declared: adopted as it runs, or created from a template.
  *
- * ★ `hf-provision@pve` HOLDS EXACTLY THE ROLE THIS NEEDS: `LXCProvisioner` on `/` grants
- *   VM.Allocate, VM.Audit, VM.Config.{CPU,Disk,HWType,Memory,Network,Options}, VM.PowerMgmt,
- *   Datastore.AllocateSpace, Datastore.Audit, SDN.Use, Sys.Audit. What that role cannot do — device
+ * ★ THE PROVISIONING BASELINE HOLDS WHAT THIS NEEDS (provision-baseline.ts): on `/`, VM.Allocate,
+ *   VM.Audit, VM.Config.{CPU,Disk,HWType,Memory,Network,Options}, VM.PowerMgmt,
+ *   Datastore.AllocateSpace, Datastore.Audit, SDN.Use, Sys.Audit. What no token can do — device
  *   passthrough, bind mounts, features beyond nesting — PVE keeps for root@pam, and lxc-judge.ts
  *   refuses at plan with the `pct set` to run instead.
  *

package/dist/proxmox/members.d.ts

@@ -1,10 +1,10 @@
 /**
- * TB4 cluster members: ordered failover, last-good preference, transport classification.
+ * C1 cluster members: ordered failover, last-good preference, transport classification.
  *
  * ★ ANY MEMBER'S :8006 API MANAGES THE WHOLE CLUSTER — PVE proxies node paths itself — so the
  *   provider reaches the cluster through whichever member is up, not through one pinned node.
  *
- * ⛔ NEVER cluster-tb4.example.com: it resolves to 10.20.10.250, which nothing serves.
+ * ⛔ NEVER cluster-c1.example.com: it resolves to 192.0.2.250, which nothing serves.
  */
 import * as Effect from 'effect/Effect';
 import * as HttpClient from 'effect/unstable/http/HttpClient';
@@ -44,7 +44,7 @@ export type PveMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';
  *   elsewhere can repeat a write.
  *
  * ★ Reads fail over on any transport failure, including timeout — no side effect to duplicate.
- *   MEASURED 2026-09-14: full TB4 plans stayed all-noop with the first member refused (127.0.0.1)
+ *   MEASURED 2026-09-14: full C1 plans stayed all-noop with the first member refused (127.0.0.1)
  *   and with it unresolvable (n9.invalid).
  */
 export declare const executeOnCluster: (target: PveTarget, method: PveMethod, path: string, build: (apiBase: string) => HttpClientRequest.HttpClientRequest) => Effect.Effect<HttpClientResponse.HttpClientResponse, {

package/dist/proxmox/network-apply-read.d.ts

@@ -7,7 +7,7 @@
  *   diff, and the only write in either file is the apply itself.
  *
  * ⛔ THE PENDING STATE IS NOT IN `data`, WHICH IS WHY THIS FILE DOES ITS OWN FETCH. MEASURED in the
- *   cluster's own source on n2, 2026-09-13 — not inferred from documentation:
+ *   cluster's own source on node-b, 2026-09-13 — not inferred from documentation:
  *     PVE/API2/Network.pm   my $tmp = PVE::INotify::read_file('interfaces', 1);
  *                           $rpcenv->set_result_attrib('changes', $changes) if $changes;
  *     PVE/HTTPServer.pm     if (my $diff = $rpcenv->get_result_attrib('changes')) {
@@ -24,9 +24,9 @@
  *   `GET /nodes/{node}/network` answers with the STAGED config and a node about to be reconfigured
  *   looks identical to one already running it. Same trap `sdn-apply.ts` documents for `?running=1`.
  *
- * ⚠️ `active` IS NOT A PENDING SIGNAL, AND THE OBVIOUS SHORTCUT IS MEASURABLY WRONG. On n2 and n3,
- *   with nothing staged anywhere (VERIFIED 2026-09-13: `/etc/network/interfaces.new` absent on n2,
- *   n3 and n4), `wlp91s0` already comes back with no `active` key at all. Counting interfaces that
+ * ⚠️ `active` IS NOT A PENDING SIGNAL, AND THE OBVIOUS SHORTCUT IS MEASURABLY WRONG. On node-b and node-c,
+ *   with nothing staged anywhere (VERIFIED 2026-09-13: `/etc/network/interfaces.new` absent on node-b,
+ *   node-c and node-d), `wlan0` already comes back with no `active` key at all. Counting interfaces that
  *   are not up as "pending" would report an update on two of the three nodes forever.
  *
  * ⚠️ ONE THING GENUINELY CANNOT BE SEEN FROM HERE, AND IT IS SMALL. The diff is computed as
@@ -60,7 +60,7 @@ export declare const pendingCount: (target: PveTarget, node: string) => Effect.E
  *
  * ★ A REASON RATHER THAN A BOOLEAN, BECAUSE THE CALLER'S ONLY USE FOR IT IS A REFUSAL MESSAGE.
  *   "The deploy stopped because the cluster was degraded" is not actionable at three in the
- *   morning; "quorate=true offline=[n3]" is. The two callers in network-apply.ts ask this before
+ *   morning; "quorate=true offline=[node-c]" is. The two callers in network-apply.ts ask this before
  *   the reload and again after it, and the second answer is the one that stops the chain from
  *   reaching the next node.
  *

package/dist/proxmox/network-apply.d.ts

@@ -4,23 +4,23 @@
  * ⛔ WITHOUT IT EVERY NETWORK DECLARATION IS A GREEN PLAN THAT CHANGES NO NETWORK; WITH IT A GREEN
  *   PLAN CAN TAKE A NODE OFF THE NETWORK. Writes under `nodes/{node}/network/{iface}` edit
  *   `/etc/network/interfaces.new` and touch no interface. `PUT /nodes/{node}/network` is the apply.
- *   MEASURED in the cluster's own source on n2, 2026-09-13 — `PVE/API2/Network.pm`:
+ *   MEASURED in the cluster's own source on node-b, 2026-09-13 — `PVE/API2/Network.pm`:
  *       rename($new_config_file, $current_config_file) if -e $new_config_file;
  *       PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err);
  *       return $rpcenv->fork_worker('srvreload', 'networking', $authuser, $worker);
  *
- * ⛔ THIS IS THE MOST DANGEROUS RESOURCE IN THE PACKAGE, AND ON TB4 THE DANGER IS NOT ABSTRACT.
- *   Ceph runs over `vmbr1.11` on n2, n3 AND n4 (MEASURED 2026-09-13: four pools, size 3 /
+ * ⛔ THIS IS THE MOST DANGEROUS RESOURCE IN THE PACKAGE, AND ON C1 THE DANGER IS NOT ABSTRACT.
+ *   Ceph runs over `vmbr1.42` on node-b, node-c AND node-d (MEASURED 2026-09-13: four pools, size 3 /
  *   min_size 2, mon+mgr+mds on all three). `ifreload -a` takes that node's OSDs, mons and MDS off
  *   the cluster network for the length of the reload; two nodes at once puts every pool below
  *   min_size and blocks IO for every guest with an RBD disk. The management address the API is
- *   reached on, `vmbr0.10`, is reloaded by the same call.
+ *   reached on, `vmbr0.41`, is reloaded by the same call.
  *
  * ⛔ AND UNLIKE `SdnApply` IT IS PER NODE, SO A HALF-RECONFIGURED CLUSTER IS THE DEFAULT FAILURE
  *   MODE, NOT AN EDGE CASE. `PUT /cluster/sdn` publishes the whole cluster in one call; this
- *   publishes exactly one node, so a stack holding three of these can apply n2, fail, and leave n3
- *   and n4 on the old layout with Ceph spanning all three. Four things here exist only for that:
- *     1. `after` SERIALISES THEM — chain n3 after n2 and n4 after n3, so at most one node is ever
+ *   publishes exactly one node, so a stack holding three of these can apply node-b, fail, and leave node-c
+ *   and node-d on the old layout with Ceph spanning all three. Four things here exist only for that:
+ *     1. `after` SERIALISES THEM — chain node-c after node-b and node-d after node-c, so at most one node is ever
  *        mid-reload. Three declared in parallel is the outage, and nothing in Alchemy stops you.
  *     2. `reconcile` REFUSES TO START on a cluster that is already degraded.
  *     3. `reconcile` RE-CHECKS quorum and every member's `online` flag AFTER the reload and dies if
@@ -51,7 +51,7 @@ import type { PveRequirements } from './resource.ts';
 import type { WithTarget } from './resource.ts';
 export interface NetworkApplyProps extends WithTarget {
     /**
-     * The node whose staged interfaces file this applies — `n2`.
+     * The node whose staged interfaces file this applies — `node-b`.
      *
      * ⚠️ ONE APPLY PER NODE, AND NEVER TWO FOR THE SAME NODE. Two would each publish the other's
      *   staged half, and both would run `ifreload` on a file the other had not finished writing.
@@ -89,7 +89,7 @@ export interface NetworkApplyAttributes {
      *   `active`, `exists`, `families`, `method`, `method6`, `options`, `priority`, `link-type` and
      *   ten more; `altnames` is returned and is not even in the schema. `priority` is the worst of
      *   them: PVE ASSIGNS it from the order of the interfaces file, so the same logical layout
-     *   carries different numbers on different nodes (MEASURED: n4's differ from n2/n3's by one).
+     *   carries different numbers on different nodes (MEASURED: node-d's differ from node-b/node-c's by one).
      *   Every one of those is a forever-diff waiting for whoever writes `Proxmox.NetworkInterface`.
      *   This resource compares a single integer against zero and never looks at a row at all.
      */

package/dist/proxmox/node-network-form.d.ts

@@ -14,14 +14,14 @@
  *
  * * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED, AND EACH ONE IS A MEASURED FOREVER-DIFF.
  *   `priority` is assigned by PVE FROM FILE ORDER — `my $priority = 2; ... $d->{priority} =
- *   $priority++` — and it is not a POST or PUT parameter at all. MEASURED ACROSS TB4: vmbr1.11 is
- *   priority 16 on n2 and n3 and 15 on n4, because n4 has no `wlp91s0` above it. One declaration
+ *   $priority++` — and it is not a POST or PUT parameter at all. MEASURED ACROSS C1: vmbr1.42 is
+ *   priority 16 on node-b and node-c and 15 on node-d, because node-d has no `wlan0` above it. One declaration
  *   reused across three nodes would diff on exactly one of them, forever, over nothing.
  *   `method` is RECOMPUTED on every write from whether the form carried an address, `families` is
  *   recomputed the same way and never written to the file, `active` and `exists` describe the
  *   kernel rather than the config, and `bond_miimon`, `bridge_stp` and `bridge_fd` are emitted by
  *   PVE's writer with defaults (100, `off`, 0) while appearing in NEITHER write schema —
- *   `additionalProperties => 0` means sending one is a 400. Live proof of all three: n2's bond0
+ *   `additionalProperties => 0` means sending one is a 400. Live proof of all three: node-b's bond0
  *   returns `bond_miimon "100"` and vmbr1 returns `bridge_stp "off"`, `bridge_fd "0"`, none of
  *   which any declaration can set.
  */
@@ -65,7 +65,7 @@ export declare const ifaceList: (value: unknown) => string;
  *   `ceph transport` comes back as `ceph transport\n` and the two never compare equal.
  * ⚠️ AND THE READER FOLDS `comments6` INTO `comments` (`$d->{comments} .= $comments6`), so on an
  *   interface that carries an IPv6 comment a declared `comments` CANNOT match what comes back.
- *   TB4 has none; on an interface that does, leave `comments` undeclared rather than fighting it.
+ *   C1 has none; on an interface that does, leave `comments` undeclared rather than fighting it.
  */
 export declare const comment: (value: unknown) => string;
 /** Undeclared is unmanaged: neither sent nor compared. See the ⚠️ on `body`. */
@@ -92,7 +92,7 @@ export declare const sameComment: (declared: string | undefined, live: string) =
  *
  * ⚠️ `netmask` IS A WRITABLE PARAMETER AND IS DELIBERATELY NOT OFFERED. PVE raises
  *   "netmask conflicts with cidr" when both are sent, and the reader rewrites whatever was written
- *   into prefix form — MEASURED: n2's vmbr1.11 reports `"netmask":"24"`, never `255.255.255.0`.
+ *   into prefix form — MEASURED: node-b's vmbr1.42 reports `"netmask":"24"`, never `255.255.255.0`.
  *   A resource accepting both spellings would let a declaration diff against its own value.
  */
 export declare const body: (props: NodeNetworkProps) => Record<string, string>;
@@ -108,7 +108,7 @@ export declare const body: (props: NodeNetworkProps) => Record<string, string>;
  *   `ifreload -a` I did NOT measure. Clearing cidr explicitly at least produces a clean, honest
  *   manual interface — and `matches` compares `cidr` UNCONDITIONALLY, so the plan says so first.
  *
- * ⛔ ON vmbr1.11 THAT IS THE CEPH TRANSPORT. A declaration of that interface without its `cidr` is
+ * ⛔ ON vmbr1.42 THAT IS THE CEPH TRANSPORT. A declaration of that interface without its `cidr` is
  *   a declaration that it should have no address, applied across three nodes. The plan will read
  *   `1 to update` rather than `noop`; do not wave it through.
  *

package/dist/proxmox/node-network.d.ts

@@ -11,23 +11,23 @@
  *   that apply — this one never calls it, exactly as `Proxmox.SdnZone` never calls
  *   `Proxmox.SdnApply`.
  *
- * ⛔ CEPH ON TB4 RIDES TWO NETWORKS AND THIS API ONLY SEES ONE OF THEM. Measured from
+ * ⛔ CEPH ON C1 RIDES TWO NETWORKS AND THIS API ONLY SEES ONE OF THEM. Measured from
  *   `/etc/pve/ceph.conf` on 2026-09-13:
  *
- *     public_network  = 10.20.11.0/24     -> vmbr1.11, which this resource DOES see
- *     cluster_network = 10.100.0.0/24     -> every OSD's cluster_addr: .102 / .103 / .104
+ *     public_network  = 198.51.100.0/24     -> vmbr1.42, which this resource DOES see
+ *     cluster_network = 203.0.113.0/24     -> every OSD's cluster_addr: .102 / .103 / .104
  *
  *   The cluster network — OSD REPLICATION, the traffic that rebuilds a lost replica — lives on
- *   `10.100.0.10X/32` addresses carried by `en05`, `en06` and `dummy_tb4`: the Thunderbolt mesh.
+ *   `203.0.113.10X/32` addresses carried by `tb0`, `tb1` and `dummy_c1`: the Thunderbolt mesh.
  *
  * ⛔ AND THOSE ADDRESSES ARE INVISIBLE HERE, WHICH IS THE TRAP. They are declared in
  *   `/etc/network/interfaces.d/sdn`, and PVE's network API does not parse that directory.
- *   MEASURED: `GET /nodes/n2/network/en05` answers `{"method":"manual","type":"eth",…}` with NO
- *   address, while `ip -br -4 addr` shows `en05  UP  10.100.0.102/32`. So this resource reports
- *   en05 and en06 as address-less manual ports and will plan `noop` over them — implicitly
+ *   MEASURED: `GET /nodes/node-b/network/tb0` answers `{"method":"manual","type":"eth",…}` with NO
+ *   address, while `ip -br -4 addr` shows `tb0  UP  203.0.113.102/32`. So this resource reports
+ *   tb0 and tb1 as address-less manual ports and will plan `noop` over them — implicitly
  *   asserting they carry no address, which is FALSE.
  *
- *   The consequence, stated plainly: declaring en05/en06 from what this API reports and then
+ *   The consequence, stated plainly: declaring tb0/tb1 from what this API reports and then
  *   DESTROYING or applying over them takes out OSD replication on a cluster whose pools are
  *   size 3 / min_size 2. They read as the most boring interfaces on the node and are the two most
  *   dangerous. Leave them undeclared; if they must be managed, manage the file that actually
@@ -55,7 +55,7 @@
  *   interface a node already has would otherwise leave it holding a pending network change.
  *
  * ⚠️ WHAT IS STILL TRUE: when `matches` is false the PUT rewrites the whole stanza, and that can
- *   ADD lines the file did not have — a `vlan-raw-device vmbr1` under `vmbr1.11`, where PVE had
+ *   ADD lines the file did not have — a `vlan-raw-device vmbr1` under `vmbr1.42`, where PVE had
  *   been deriving it from the name. Harmless in content, and it costs nothing until somebody
  *   applies; one more reason the apply is a separate resource.
  *
@@ -69,10 +69,10 @@ import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import { type PveRequirements, type WithTarget } from './resource.ts';
 /**
- * PVE's interface types. `unknown` is what a NIC it does not manage reports — n2 and n3 both
- * report `wlp91s0` that way, and n4 has no such interface at all.
+ * PVE's interface types. `unknown` is what a NIC it does not manage reports — node-b and node-c both
+ * report `wlan0` that way, and node-d has no such interface at all.
  *
- * ⚠️ THAT ASYMMETRY IS A TRAP FOR A DECLARATION SHARED ACROSS NODES. On n4 the read answers 404,
+ * ⚠️ THAT ASYMMETRY IS A TRAP FOR A DECLARATION SHARED ACROSS NODES. On node-d the read answers 404,
  *   which this provider cannot tell from "deleted", so reconcile POSTs — writing a stanza for a
  *   card that is not in the machine. Declare per node what each node actually has; a physical
  *   interface is discovered, not decided.
@@ -81,24 +81,24 @@ export type NodeNetworkType = 'OVSBond' | 'OVSBridge' | 'OVSIntPort' | 'OVSPort'
 export interface NodeNetworkProps extends WithTarget {
     /** Which node's file this stanza lives in. Interfaces are per node, never cluster-wide. */
     node: string;
-    /** `vmbr0`, `bond0`, `vmbr1.11`. 2-20 characters, PVE's `pve-iface` format. */
+    /** `vmbr0`, `bond0`, `vmbr1.42`. 2-20 characters, PVE's `pve-iface` format. */
     iface: string;
     /** ⛔ REQUIRED ON EVERY WRITE, update included, never used to retype — see `readAttributes`. */
     type: NodeNetworkType;
     /**
-     * `10.20.11.12/24`. ⛔ THE ONE FIELD WITH NO UNMANAGED MODE: leaving it out is an instruction
+     * `198.51.100.12/24`. ⛔ THE ONE FIELD WITH NO UNMANAGED MODE: leaving it out is an instruction
      * to make the interface `manual`, not an instruction to leave its address alone. The ⛔ on
      * `updateBody` in node-network-form.ts has the measurement and the consequence.
      */
     cidr?: string;
     /** ⚠️ PVE allows exactly ONE default gateway per node and refuses a second with "Default
-     *  gateway already exists on interface '<other>'". On TB4 it is vmbr0.10's. */
+     *  gateway already exists on interface '<other>'". On C1 it is vmbr0.41's. */
     gateway?: string;
     /**
      * `auto <iface>` in the file. Absent on read means off, which is why `bool`'s fallback is used.
      * ⚠️ UNDECLARED IS UNMANAGED ON AN UPDATE AND OFF ON A CREATE — the same asymmetry storage.ts
      *   has, and it bites harder here: an interface created without `autostart` is one the node
-     *   will not bring up at boot. Every TB4 bridge, bond and vlan carries it.
+     *   will not bring up at boot. Every C1 bridge, bond and vlan carries it.
      */
     autostart?: boolean;
     /** 1280-65520. Unset leaves the file without an `mtu` line and the kernel default in force. */
@@ -122,7 +122,7 @@ export interface NodeNetworkProps extends WithTarget {
     bond_xmit_hash_policy?: string;
     /** active-backup only. Kept hyphenated because that is the wire name. */
     'bond-primary'?: string;
-    /** ⚠️ DERIVED FROM A DOTTED NAME. `vmbr1.11` reports `vlan-id` 11 with no such line in the file;
+    /** ⚠️ DERIVED FROM A DOTTED NAME. `vmbr1.42` reports `vlan-id` 42 with no such line in the file;
      *  declaring it there is harmless but adds a line the file did not have. */
     'vlan-id'?: number;
     'vlan-raw-device'?: string;

package/dist/proxmox/node-network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-network.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAU7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,CAAC;AAEX,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,IAAI,EAAE,eAAe,CAAC;IACtB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;mFAC+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;gFAC4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAsCH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wIACwD,CAAC"}
+{"version":3,"file":"node-network.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAU7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,CAAC;AAEX,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,IAAI,EAAE,eAAe,CAAC;IACtB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;kFAC8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;gFAC4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAsCH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wIACwD,CAAC"}

package/dist/proxmox/notification-matcher-form.d.ts

@@ -0,0 +1,100 @@
+/**
+ * A notification matcher — the rule that routes a notification to its targets — as ONE shape
+ * shared by PVE (`Proxmox.NotificationMatcher`) and PBS (`Pbs.NotificationMatcher`).
+ *
+ * ★ ONE FILE FOR BOTH PRODUCTS BECAUSE IT IS ONE IMPLEMENTATION. Both servers run the same Rust
+ *   crate, `proxmox-notify` (matcher.rs), PVE through its Perl bindings; the schemas in
+ *   generated/pve.ts and generated/pbs.ts carry the same nine fields, and the forms below are
+ *   typed against BOTH, so a drift on either side fails `tsc` here rather than on a server.
+ *
+ * ⚠️ A MATCHER IS ITS WHOLE RULE, SO EVERY RULE FIELD IS COMPARED, DECLARED OR NOT. Most families
+ *   here leave an undeclared field alone (backup-job.ts's trade). A matcher cannot: an undeclared
+ *   `match-field` on a matcher that has one is a declaration claiming "route everything" over a
+ *   server that routes one job type — and `invert-match` flips the meaning of every other line.
+ *   So `match-*` default to empty, `mode` to `all`, `invert-match` and `disable` to false, all are
+ *   compared, and a PUT sends all of them (an emptied list as `delete`). Only `comment` keeps the
+ *   usual "undeclared is unmanaged" rule, because nothing routes on it.
+ *   ★ THE COST IS THAT ADOPTING A MATCHER MEANS DECLARING IT AS IT IS. PBS ships `default-matcher`
+ *     with `invert-match`, a `match-field` and a `match-severity` (measured on PBS 4.2, 2026-09-22),
+ *     so adopting it as-is means writing those three down. A declaration that leaves them out
+ *     plans an UPDATE, which is the plan telling the truth about what the deploy would do.
+ */
+import type { ClusterNotificationsMatchersNamePutParams, ClusterNotificationsMatchersPostParams } from './generated/pve.ts';
+import type { ConfigNotificationsMatchersNamePutParams, ConfigNotificationsMatchersPostParams } from './generated/pbs.ts';
+/** Everything a matcher declares except where it lives — the resource files add `target`. */
+export interface NotificationMatcherFields {
+    /** The primary key, a safe id (2–32 chars on PBS). Changing it is a replace. */
+    name: string;
+    /**
+     * ⛔ THE TARGETS, BY NAME, AND REQUIRED: a matcher that notifies nobody is a routing rule for
+     *   silence. `[]` is still declarable, and clears the list.
+     * ⚠️ `targets`, NOT THE SERVER'S `target`: every resource here already spends `target` on the
+     *   HOST (resource.ts `WithTarget`), and one key cannot mean both. The wire still says `target`.
+     */
+    targets: readonly string[];
+    /**
+     * Severity rules. EACH ITEM IS ITSELF A COMMA LIST: `'warning,error'` matches either.
+     * ⛔ `['warning', 'error']` IS NOT THE SAME RULE AND UNDER `mode: 'all'` NEVER MATCHES. Items are
+     *   combined with `mode`; the severities inside one item are always OR-ed (matcher.rs
+     *   `SeverityMatcher`). A notification has one severity, so two items under AND ask for a
+     *   notification that is both — and routing nothing is the quietest failure a matcher has.
+     * Severities: `info`, `notice`, `warning`, `error`, `unknown`.
+     */
+    'match-severity'?: readonly string[];
+    /**
+     * Metadata rules, `exact:<field>=<v1>,<v2>` or `regex:<field>=<re>`. ⚠️ THE PREFIX IS REQUIRED:
+     * the schema's pattern makes it optional and the parser then refuses it. A notification WITHOUT
+     * the field never matches its rule — so `exact:job-id=…` excludes every garbage collection.
+     */
+    'match-field'?: readonly string[];
+    /** Time windows, e.g. `mon-fri 9:00-17:00`. Compared as written; the server keeps the text. */
+    'match-calendar'?: readonly string[];
+    /** How the rule items combine. The server's default, and this package's, is `all`. */
+    mode?: 'all' | 'any';
+    /** Invert the whole rule. ⚠️ IGNORED WHEN THERE ARE NO RULES — an empty matcher always matches. */
+    'invert-match'?: boolean;
+    /** A disabled matcher routes nothing. */
+    disable?: boolean;
+    /** Free text. The one field left alone when undeclared; `''` clears it. */
+    comment?: string;
+}
+/** ⚠️ Lists are CANONICAL and SORTED, so a re-ordered declaration is not a diff. */
+export interface NotificationMatcherAttributes {
+    name: string;
+    /**
+     * `builtin`, `modified-builtin` or `user-created`. REPORTED, NEVER COMPARED.
+     * ⛔ ON A BUILT-IN A DELETE REVERTS RATHER THAN REMOVES, and reports success either way — Alchemy
+     *   drops the row while `default-matcher` goes on routing. Read this before destroying one.
+     * ★ MEASURED ON THE PER-OBJECT READ, which the published schema does not list: PVE 9.2.11 and
+     *   PBS 4.2 both return it from `…/matchers/default-matcher` (2026-09-22).
+     */
+    origin: string;
+    comment: string;
+    disable: boolean;
+    'invert-match': boolean;
+    mode: string;
+    targets: readonly string[];
+    'match-severity': readonly string[];
+    'match-field': readonly string[];
+    'match-calendar': readonly string[];
+}
+/** A declaration's lists, canonical and sorted — the form `matches` compares. */
+export declare const canonicalRules: (fields: NotificationMatcherFields) => {
+    'match-calendar': string[];
+    'match-field': string[];
+    'match-severity': string[];
+    targets: string[];
+};
+export declare const matcherAttributes: (live: Record<string, unknown>, name: string) => NotificationMatcherAttributes;
+export declare const matcherMatches: (attributes: NotificationMatcherAttributes, fields: NotificationMatcherFields) => boolean;
+export type MatcherCreateForm = ConfigNotificationsMatchersPostParams & ClusterNotificationsMatchersPostParams;
+export type MatcherUpdateForm = ConfigNotificationsMatchersNamePutParams & ClusterNotificationsMatchersNamePutParams;
+/** ⛔ `name` is create-only: the body carries it once and the path forever after. */
+export declare const matcherCreateForm: (fields: NotificationMatcherFields) => MatcherCreateForm;
+/**
+ * ⛔ AN EMPTIED LIST IS A `delete`, NOT AN EMPTY VALUE. A form cannot carry an empty array — no
+ *   key is sent at all — so without the `delete` entry a declaration of `'match-field': []`
+ *   would plan an update, PUT nothing for that field, and plan the same update forever.
+ */
+export declare const matcherUpdateForm: (fields: NotificationMatcherFields) => MatcherUpdateForm;
+//# sourceMappingURL=notification-matcher-form.d.ts.map

package/dist/proxmox/notification-matcher-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-matcher-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-matcher-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EACV,yCAAyC,EACzC,sCAAsC,EACvC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACV,wCAAwC,EACxC,qCAAqC,EACtC,MAAM,oBAAoB,CAAC;AAG5B,6FAA6F;AAC7F,MAAM,WAAW,yBAAyB;IACxC,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,sFAAsF;IACtF,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACrB,mGAAmG;IACnG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,oFAAoF;AACpF,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAiCD,iFAAiF;AACjF,eAAO,MAAM,cAAc,WAAY,yBAAyB;IAC9D,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,OAAO;CACP,CAAC;AAEH,eAAO,MAAM,iBAAiB,SACtB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QACvB,MAAM,KACX,6BAYD,CAAC;AAKH,eAAO,MAAM,cAAc,eACb,6BAA6B,UACjC,yBAAyB,KAChC,OAYF,CAAC;AA0BF,MAAM,MAAM,iBAAiB,GAAG,qCAAqC,GACnE,sCAAsC,CAAC;AACzC,MAAM,MAAM,iBAAiB,GAAG,wCAAwC,GACtE,yCAAyC,CAAC;AAE5C,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,WAAY,yBAAyB,KAAG,iBAKpE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,WAAY,yBAAyB,KAAG,iBAYrE,CAAC"}

package/dist/proxmox/notification-matcher.d.ts

@@ -0,0 +1,46 @@
+/**
+ * `Proxmox.NotificationMatcher` — which notifications a PVE cluster sends to which targets.
+ *
+ * ★ THE HALF OF THE NOTIFICATION SYSTEM notification-target.ts LEAVES OPEN. A target is where a
+ *   message CAN go; a matcher decides whether it DOES. A cluster ships one, `default-matcher`,
+ *   routing everything to `mail-to-root`, and a target no matcher names receives nothing — so a
+ *   declared webhook with no matcher is a delivery path that is never used, and looks finished.
+ *
+ * ★ ADOPTING THE BUILT-IN AS IT IS: declare what it holds and nothing more. MEASURED on PVE
+ *   9.2.11 (2026-09-22, `pvesh get /cluster/notifications/matchers/default-matcher`): mode `all`,
+ *   one target `mail-to-root`, no rules, the comment "Route all notifications to mail-to-root".
+ *   ```ts
+ *   ProxmoxNotificationMatcher('default-matcher', {
+ *     target: cluster, name: 'default-matcher', targets: ['mail-to-root'],
+ *   });
+ *   ```
+ *   That plans `noop` and deploys with no write (notification-matcher.test.ts). Leaving `comment`
+ *   out leaves it alone; every rule field is compared — notification-matcher-form.ts says why.
+ *
+ * ★ WHAT THIS NEEDS, READ OFF THE CLUSTER'S OWN SCHEMA (generated/pve.ts source, 9.2.11):
+ *     read      GET matchers/{name}   Mapping.Audit or Mapping.Modify on /mapping/notifications
+ *     write     POST, PUT, DELETE     Mapping.Modify on /mapping/notifications
+ *   The same pair as `Proxmox.NotificationTarget`, with that file's ⚠️ about granting it on `/`.
+ *   ⛔ `Mapping.Use` IS NOT ENOUGH, though the COLLECTION GET accepts it: the per-object read this
+ *     family makes lists only Audit and Modify (pve-manager API2/Cluster/Notifications.pm
+ *     `get_matcher`, read at HEAD 2026-09-22 — corrected here; PR 95 said Use sufficed).
+ *   ⛔ A MISSING READ PRIVILEGE LOOKS LIKE "ABSENT", not like a 403 — see the same file. For
+ *     `default-matcher` that turns an adoption into a planned CREATE that PVE refuses as a
+ *     duplicate: the noop below needs a read lease holding Mapping.Audit.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import { type NotificationMatcherAttributes, type NotificationMatcherFields } from './notification-matcher-form.ts';
+import { type PveRequirements, type WithTarget } from './resource.ts';
+export interface NotificationMatcherProps extends NotificationMatcherFields, WithTarget {
+}
+export interface ProxmoxNotificationMatcher extends Resource<'Proxmox.NotificationMatcher', NotificationMatcherProps, NotificationMatcherAttributes, never, PveRequirements> {
+}
+/**
+ * ⚠️ NO `defaultRemovalPolicy: 'retain'`, for notification-target.ts's reason: a matcher holds no
+ *   data, and a plan line is the only warning a delete gets. On `default-matcher` the delete
+ *   REVERTS it to the shipped rule instead — see `origin` on the attributes.
+ */
+export declare const ProxmoxNotificationMatcher: import("alchemy").ResourceClass<ProxmoxNotificationMatcher>;
+export declare const ProxmoxNotificationMatcherProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxNotificationMatcher>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=notification-matcher.d.ts.map

package/dist/proxmox/notification-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-matcher.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,yBAAyB,EAK/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB,EAAE,UAAU;CAAG;AAE1F,MAAM,WAAW,0BAA2B,SAAQ,QAAQ,CAC1D,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,6DAEtC,CAAC;AAWF,eAAO,MAAM,kCAAkC,gJAI5C,CAAC"}

package/dist/proxmox/notification-target.d.ts

@@ -39,8 +39,9 @@
  *     reconcile  POST + PUT                   Mapping.Modify on /mapping/notifications AND one of
  *                                             Sys.Audit / Sys.Modify / Sys.AccessNetwork on /
  *     delete     DELETE                       Mapping.Modify on /mapping/notifications
- *   `LXCProvisioner` already carries Sys.Audit on `/` (see lxc.ts), so the delta is the two Mapping
- *   privileges — notably NOT the `Sys.Modify` a backup job costs.
+ *   The provision role already carried Sys.Audit on `/` (see lxc.ts), so the delta was the two
+ *   Mapping privileges — notably NOT the `Sys.Modify` a backup job costs. `PROVISION_PRIVILEGES`
+ *   carries both on `/`: the baseline took the trade below knowingly.
  *   ⚠️ PREFER A SECOND ROLE GRANTED AT `/mapping/notifications` OVER WIDENING THE PROVISIONING ROLE
  *     ON `/`. `/mapping` also holds the PCI and USB passthrough maps, so Mapping.Modify at the root
  *     lets a credential scoped to make containers rewire somebody's hardware.

package/dist/proxmox/notification-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notification-target.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,gFAAgF;IAChF,IAAI,EAAE,sBAAsB,CAAC;IAC7B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,iFAAiF;IACjF,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,yBAA0B,SAAQ,QAAQ,CACzD,4BAA4B,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,yBAAyB,4DAErC,CAAC;AA2DF;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,+IAI3C,CAAC"}
+{"version":3,"file":"notification-target.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,gFAAgF;IAChF,IAAI,EAAE,sBAAsB,CAAC;IAC7B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,iFAAiF;IACjF,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,yBAA0B,SAAQ,QAAQ,CACzD,4BAA4B,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,yBAAyB,4DAErC,CAAC;AA2DF;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,+IAI3C,CAAC"}

package/dist/proxmox/pbs-datastore-guard.d.ts

@@ -24,7 +24,7 @@ export declare const guardPath: (live: PbsDatastoreAttributes, props: PbsDatasto
  *
  * ⚠️ AN UNDECLARED `backend` IS NOT A DIVERGENCE. Undeclared is unmanaged everywhere in this
  *   family, and this guard keeps that rule: it fires only when the declaration says something and
- *   PBS says something else. Adopting `r2-offsite` without mentioning `backend` still plans noop.
+ *   PBS says something else. Adopting `offsite` without mentioning `backend` still plans noop.
  *
  * ⚠️ COMPARED AS A CANONICAL PROPERTY STRING, so `bucket=x,type=s3` and `type=s3,bucket=x` are the
  *   same backend and key order cannot deadlock a plan — the reason `samePath` trims a slash.

package/dist/proxmox/pbs-datastore.d.ts

@@ -10,7 +10,7 @@
  *   `{"data":{"pong":true}}` against a Let's Encrypt certificate for CN=pbs.example.com;
  *   `/version` and `/config/datastore` answer 401 "authentication failed";
  *   `pbs.mgmt.example.com:8007` answers 401 and its certificate verifies too; and
- *   `/access/domains` lists the realms `pbs`, `pam` and an openid realm `Schenanigans`. So the
+ *   `/access/domains` lists the realms `pbs`, `pam` and an openid realm. So the
  *   prefix, the `{"data": …}` envelope and the strict-TLS story are PVE's exactly — and only the
  *   credential differs. There is no `pve` realm here; a PVE token cannot authenticate at all.
  *   The header differs too, which is why `pve()` exists rather than `pve()` being reused — see the
@@ -18,18 +18,18 @@
  *
  * ⛔ THERE IS NO OPENBAO MOUNT FOR PBS TODAY, SO NOTHING HERE CAN DEPLOY YET. `PbsTarget.mount` is
  *   a parameter for the reason `PveTarget.mount` is — the provider must be able to leave this
- *   estate — but the estate has nothing to put in it. MEASURED: under the `claude-code` approle,
- *   `bao token capabilities` answers `deny` for `proxmox-tb4/creds/{read,provision}`,
- *   `proxmox-ops/creds/read` and every `…pbs…` path tried, and `sys/mounts` is 403 — so I could
+ *   estate — but the estate has nothing to put in it. MEASURED: under the agent's approle,
+ *   `bao token capabilities` answers `deny` for `proxmox-c1/creds/{read,provision}`,
+ *   `proxmox-c2/creds/read` and every `…pbs…` path tried, and `sys/mounts` is 403 — so I could
  *   not enumerate the mounts to PROVE a PBS one is absent. That it is absent is the brief's
  *   statement, not my measurement.
  *   ★ WHAT THE MOUNT MUST VEND, so `mint()` is reused unchanged: `bao read -format=json
  *     <mount>/creds/<role>` answering `{"data":{"token_id":…,"secret":…}}`, where `token_id` is a
  *     PBS token id `user@realm!tokenname` — `hf-read@pbs!…` and `hf-provision@pbs!…`. Same short,
- *     non-renewable lease contract as `proxmox-tb4`.
+ *     non-renewable lease contract as `proxmox-c1`.
  *   ⚠️ PBS HAS NO DYNAMIC-SECRETS PLUGIN OF ITS OWN — OpenBao's Proxmox support is a PVE thing — so
  *     the mount is a small custom vendor against `POST /access/users/{id}/token/{name}`. Say which
- *     mount and role you needed rather than reaching for the read-only `monitoring@pbs` token on
+ *     mount and role you needed rather than reaching for the read-only `metrics@pbs` token on
  *     the kv shelf: widening that would delete the outer lock for every reader of the shelf.
  *
  * ⛔ A DATASTORE HOLDS THE BACKUPS, SO `retain` IS THE DEFAULT AND `delete` IS FULLY IMPLEMENTED —
@@ -47,7 +47,7 @@
  * ⛔ NO SECRET IS A PROP OR AN ATTRIBUTE, AND THIS FAMILY IS CLEAN BY CONSTRUCTION: a datastore
  *   section holds no password, token or key — encryption keys belong to the backup CLIENT. Every
  *   field below is a name, a path, a schedule, a count or a policy string, all of which are safe in
- *   a state store Alchemy writes UNENCRYPTED and this estate dumps to CT100 nightly.
+ *   a state store Alchemy writes UNENCRYPTED and this estate copies to a backup guest nightly.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
@@ -116,11 +116,11 @@ export interface PbsDatastoreProps {
      *   `datastore create --help` offers `--backend`, `datastore update --help` does NOT, and
      *   `backend` is absent from update's `--delete` enum. PBS will not move a datastore between
      *   local disk and object storage, ever.
-     * ★ IT IS A PROP AT ALL BECAUSE THE ESTATE HAS ONE. `r2-offsite` holds
-     *   `type=s3,client=cloudflare-r2,bucket=homeflare-pbs`. Leaving it undeclared would still plan
+     * ★ IT IS A PROP AT ALL BECAUSE THE ESTATE HAS ONE. `offsite` holds
+     *   `type=s3,client=cloudflare-r2,bucket=example-pbs`. Leaving it undeclared would still plan
      *   noop — undeclared is unmanaged here — but the declaration would then describe a LOCAL
      *   datastore, and anyone recreating from it would get exactly that: an empty directory on the
-     *   mini's disk where the offsite copy used to be, behind a green plan the whole way.
+     *   host's disk where the offsite copy used to be, behind a green plan the whole way.
      * ⚠️ A property string. Compared canonically, so key order is never a diff.
      */
     backend?: string;