@homeflare/alchemy 0.11.0 → 0.13.0

package/src/proxmox/credentials.test.ts

@@ -29,9 +29,9 @@ const { Bun } = globalThis as unknown as {
 
 const TOKEN = 'hvs.FAKE-sentinel-never-a-real-token';
 const SECRET = 'fake-pve-secret-0000';
-const TB4: PveTarget = {
+const C1: PveTarget = {
   members: ['pve.example'],
-  mount: 'proxmox-tb4',
+  mount: 'proxmox-c1',
   scheme: 'pve',
 };
 
@@ -59,11 +59,9 @@ const withFake = async (
 };
 
 const minted = (env: BaoEnvironment) =>
-  Effect.runPromise(mint(TB4, 'read', env).pipe(Effect.provide(FetchHttpClient.layer)));
+  Effect.runPromise(mint(C1, 'read', env).pipe(Effect.provide(FetchHttpClient.layer)));
 const refused = (env: BaoEnvironment) =>
-  Effect.runPromise(
-    mint(TB4, 'read', env).pipe(Effect.flip, Effect.provide(FetchHttpClient.layer)),
-  );
+  Effect.runPromise(mint(C1, 'read', env).pipe(Effect.flip, Effect.provide(FetchHttpClient.layer)));
 
 const CREDENTIAL = {
   json: { data: { secret: SECRET, token_id: 'hf-read@pve!hf-read-1' }, lease_duration: 3600 },
@@ -79,7 +77,7 @@ describe('mint', () => {
         secret: SECRET,
         tokenId: 'hf-read@pve!hf-read-1',
       });
-      assert.equal(seen[0]?.path, '/v1/proxmox-tb4/creds/read');
+      assert.equal(seen[0]?.path, '/v1/proxmox-c1/creds/read');
       assert.equal(seen[0]?.headers.get('x-vault-token'), TOKEN);
       assert.equal(seen[0]?.headers.get('x-vault-namespace'), 'homeflare');
       assert.equal(seen[0]?.headers.get('x-vault-request'), 'true');
@@ -135,7 +133,7 @@ describe('mint', () => {
       CREDENTIAL,
       async (address, seen) => {
         assert.equal((await minted({ BAO_ADDR: address })).leaseSeconds, 3600);
-        assert.equal(seen[0]?.path, '/v1/proxmox-tb4/creds/read');
+        assert.equal(seen[0]?.path, '/v1/proxmox-c1/creds/read');
       },
       socket,
     );

package/src/proxmox/credentials.ts

@@ -2,13 +2,13 @@
  * The PVE credential a reconcile runs with: minted from OpenBao, alive for five minutes.
  *
  * ⛔ THERE IS NO STATIC WRITE TOKEN IN THIS ESTATE, AND THAT IS DELIBERATE. Every PVE token stored
- *   in `kv/infra/proxmox/*` is read-only — PVEAuditor on media/ops/tb4, Audit on pbs, all as
- *   `monitoring@pve`. The MCP proxmox client says why in its own header: the auditor token bounds
+ *   on the estate's static KV shelf is read-only — PVEAuditor on each cluster, Audit on PBS, all
+ *   as one metrics user. The MCP proxmox client says why in its own header: the auditor token bounds
  *   what a BUG can do, independently of what the code bounds. Adding a long-lived write token to
  *   that shelf would delete the outer lock for every reader of the shelf, not just for this
  *   provider.
  *
- * ★ SO WRITES COME FROM A DYNAMIC MOUNT INSTEAD, which the estate already built: `proxmox-tb4/`
+ * ★ SO WRITES COME FROM A DYNAMIC MOUNT INSTEAD, which the estate already built: `proxmox-c1/`
  *   exposes two roles — `read` (ttl 3600s) and `provision` (ttl 300s, max 1800s, NOT renewable).
  *   A mint returns a PVE API token of its own, `hf-provision@pve!hf-provision-…-<timestamp>-<id>`,
  *   which expires on its own whether or not anything cleans up. Same shape as
@@ -24,7 +24,7 @@
  *
  * ⛔ THE SECRET NEVER TOUCHES DISK, A LOG, OR ALCHEMY STATE. Alchemy persists resource attributes
  *   WITHOUT encryption — StateEncoding.ts writes `Redacted` as `{"@redacted": <plaintext>}` — and
- *   this estate's state store is the `alchemy` Postgres, which pg-backup.sh dumps nightly. A PVE
+ *   this estate's state store is the `alchemy` Postgres, which a nightly job dumps. A PVE
  *   secret that reached an attribute would outlive its 300s lease by months, in four places.
  *   Nothing here returns it to a resource; it is used to build a header and then dropped.
  */
@@ -60,10 +60,10 @@ export type PveRole = 'read' | 'provision';
  *   use this file unchanged; that is the whole difference between a provider and a script.
  */
 export type PveTarget = {
-  /** OpenBao mount that vends API tokens for this host, e.g. `proxmox-tb4`. */
+  /** OpenBao mount that vends API tokens for this host, e.g. `proxmox-c1`. */
   readonly mount: string;
   /**
-   * mgmt hostnames for cluster members, e.g. `n2.mgmt.example.com`. Any member's :8006 API
+   * mgmt hostnames for cluster members, e.g. `node-b.mgmt.example.com`. Any member's :8006 API
    * manages the whole cluster; `client.ts` failovers across them.
    */
   readonly members: readonly string[];
@@ -133,14 +133,14 @@ const baoVariable = (env: BaoEnvironment, name: string) =>
  * Mint one credential for `role`: `GET /v1/<mount>/creds/<role>` on OpenBao's HTTP API.
  *
  * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one
- *   client could not disagree with `bao kv get` about what this machine may do. house/openbao then
+ *   client could not disagree with `bao kv get` about what this machine may do. <estate>/openbao then
  *   learned twice what deciding by stderr costs — every failure read as absent, and two commands
  *   said "absent" in different words — so this reads STATUS CODES: 2xx is a credential, and 403
  *   (denied), 404 (no such role or mount — a mint has no "absent"), 503 (sealed) all fail.
  * ★ THE ENVIRONMENT CONTRACT IS STILL THE CLI's, READ THE CLI's WAY, which keeps the case above
  *   true (openbao v2.6.2 api/client.go:34-66, 370, 503-507, 761-762, 776-785): BAO_AGENT_ADDR over
  *   BAO_ADDR over https://127.0.0.1:8200; BAO_NAMESPACE as X-Vault-Namespace; BAO_TOKEN as
- *   X-Vault-Token; X-Vault-Request always. house/openbao/src/bao-address.ts has the long form.
+ *   X-Vault-Token; X-Vault-Request always. <estate>/openbao/src/bao-address.ts has the long form.
  * ★ AGENT MODE IS NO BAO_TOKEN AND NO TOKEN HEADER. An Agent or Proxy listener with
  *   `api_proxy { use_auto_auth_token = true }` (or the older `cache { … }`) substitutes its
  *   auto-auth token exactly when a request carries none — command/agentproxyshared/cache/handler.go

package/src/proxmox/fake-pbs-notify.ts

@@ -0,0 +1,108 @@
+/**
+ * A PBS (or PVE) notification config that remembers writes — enough of proxmox-notify's CRUD for
+ * a family's REAL provider to create, drift, rotate and adopt through Alchemy's engine.
+ *
+ * ★ STATEFUL, UNLIKE `fakePve`'s bare answer function, because the questions here are about the
+ *   SECOND deploy: whether a rotated secret is written, whether an unchanged one is not. That needs
+ *   a server that holds what the first deploy wrote.
+ * ★ IT KEEPS proxmox-notify's TWO RULES THAT MATTER HERE (api/webhook.rs, read at HEAD 2026-09-22):
+ *     1. a read returns secret NAMES only; values live in a separate private store;
+ *     2. a PUT that carries `secret` REPLACES the list, a name without a value keeping the old
+ *        one; a PUT without `secret` leaves the list alone. `delete` entries clear a field.
+ *   Repeated form keys arrive as arrays, as the real urlencoded decoder builds them.
+ * ⛔ TEST-ONLY. No provider imports this file.
+ */
+import { type FakePve, type PveCall, fakePve } from './fake-pve.ts';
+import { keyAndValue } from './pbs-notification-target-wire.ts';
+
+/** Keys the servers take as `type: array`. Everything else is a scalar. */
+const LISTS = new Set([
+  'header',
+  'mailto',
+  'mailto-user',
+  'match-calendar',
+  'match-field',
+  'match-severity',
+  'secret',
+  'target',
+]);
+
+export interface FakeNotify extends FakePve {
+  /** Public config by path, as a GET would see it apart from secrets. Mutable, for drift. */
+  readonly objects: Map<string, Record<string, unknown>>;
+  /** Secret items with values (`name=…,value=<base64>`), by path — the root-only file. */
+  readonly secrets: Map<string, string[]>;
+}
+
+const body = (call: PveCall) => {
+  const fields: Record<string, unknown> = {};
+  const deletes: string[] = [];
+  for (const [key, value] of call.pairs) {
+    if (key === 'delete') deletes.push(value);
+    else if (LISTS.has(key))
+      fields[key] = [...((fields[key] as string[] | undefined) ?? []), value];
+    // ⚠️ Scalars as the server's JSON reads them back: a flag as a boolean, a port as a number.
+    else if (key === 'disable' || key === 'invert-match') fields[key] = value === '1';
+    else if (key === 'port') fields[key] = Number(value);
+    else fields[key] = value;
+  }
+  return { deletes, fields };
+};
+
+const withSecretsBlanked = (
+  path: string,
+  object: Record<string, unknown>,
+  secrets: FakeNotify['secrets'],
+) => {
+  const held = secrets.get(path);
+  return held === undefined || held.length === 0
+    ? object
+    : { ...object, secret: held.map((item) => `name=${keyAndValue(item).name}`) };
+};
+
+export const fakeNotify = (
+  seed: Readonly<Record<string, Record<string, unknown>>> = {},
+): FakeNotify => {
+  const objects = new Map(Object.entries(seed).map(([path, object]) => [path, { ...object }]));
+  const secrets = new Map<string, string[]>();
+
+  const putSecrets = (path: string, items: readonly string[]) => {
+    const old = secrets.get(path) ?? [];
+    const next = items.map((item) => {
+      const { name, value } = keyAndValue(item);
+      if (value !== undefined) return item;
+      const kept = old.find((existing) => keyAndValue(existing).name === name);
+      if (kept === undefined) throw new Error(`secret '${name}' not known`);
+      return kept;
+    });
+    secrets.set(path, next);
+  };
+
+  const fake = fakePve((call) => {
+    const path = call.path.split('?')[0] ?? call.path;
+    const { deletes, fields } = body(call);
+    if (call.method === 'GET') {
+      const object = objects.get(path);
+      return object === undefined ? undefined : withSecretsBlanked(path, object, secrets);
+    }
+    if (call.method === 'DELETE') {
+      objects.delete(path);
+      secrets.delete(path);
+      return undefined;
+    }
+    const target = call.method === 'POST' ? `${path}/${String(fields['name'])}` : path;
+    const { secret, ...rest } = fields as { secret?: string[] } & Record<string, unknown>;
+    const next: Record<string, unknown> = {
+      ...(call.method === 'PUT' ? objects.get(target) : {}),
+      ...rest,
+    };
+    for (const key of deletes) {
+      if (key === 'secret') secrets.delete(target);
+      else delete next[key];
+    }
+    objects.set(target, next);
+    if (secret !== undefined) putSecrets(target, secret);
+    return undefined;
+  });
+  return { ...fake, objects, secrets };
+};

package/src/proxmox/fake-pve.ts

@@ -28,6 +28,11 @@ export interface PveCall {
   /** Relative to `/api2/json/`, query included — the string a family passes to `pve()`. */
   readonly path: string;
   readonly form: Readonly<Record<string, string>>;
+  /**
+   * Every key/value pair in wire order. ⚠️ `form` keeps only the LAST value of a repeated key, and
+   * a PBS list IS a repeated key (client.ts `encode`) — assert a list on `pairs`, never `form`.
+   */
+  readonly pairs: readonly (readonly [string, string])[];
 }
 
 /** Answers one call with its `data`; `undefined` is PVE's `{"data": null}`. */
@@ -56,8 +61,13 @@ export const fakePve = (answer: PveAnswer): FakePve => {
       return Response.json({ data, lease_duration: 0 });
     }
     const path = `${url.pathname.replace(/^\/api2\/json\//, '')}${url.search}`;
-    const form = Object.fromEntries(new URLSearchParams(await request.text()));
-    const call = { form, method: request.method, path };
+    const params = new URLSearchParams(await request.text());
+    const call = {
+      form: Object.fromEntries(params),
+      method: request.method,
+      pairs: [...params],
+      path,
+    };
     calls.push(call);
     return Response.json({ data: answer(call) ?? null });
   };

package/src/proxmox/firewall-alias-form.ts

@@ -36,7 +36,7 @@ export const fold = (name: string) => name.trim().toLowerCase();
 /**
  * A CIDR reduced to the one form PVE will hand back.
  *
- * ⛔ MEASURED by running the cluster's own `PVE::Firewall::parse_alias` on n2 (pve-manager 9.2.11,
+ * ⛔ MEASURED by running the cluster's own `PVE::Firewall::parse_alias` on node-b (pve-manager 9.2.11,
  *   2026-09-13) — a pure function over a string, no config read and none written:
  *     `10.1.1.5/32`     -> `10.1.1.5`        a /32 host suffix is STRIPPED
  *     `2001:0DB8::1/128`-> `2001:0DB8::1`    a /128 is stripped, and the case is NOT folded

package/src/proxmox/firewall-alias.ts

@@ -61,7 +61,7 @@
  * ⚠️ PRIVILEGES, AND FOR ONCE NOTHING NEEDS WIDENING. MEASURED 2026-09-13 from the cluster's own
  *   schema and its live ACL: the item GET checks `["perm","/",["Sys.Audit"]]`, POST/PUT/DELETE
  *   check `["perm","/",["Sys.Modify"]]`, `hf-read@pve` holds `PVEAuditor` at `/` with propagate and
- *   `hf-provision@pve` holds `LXCProvisioner` at `/` with propagate. Both privileges are already
+ *   `hf-provision@pve` holds the provision role (provision-baseline.ts) at `/` with propagate. Both privileges are already
  *   held, so `readRole` stays the default `read` lane — unlike storage/sdn-zone/sdn-vnet, whose
  *   ITEM reads are gated on an allocate privilege the auditor cannot have.
  *   ⚠️ `Sys.Modify` ON `/` IS STILL A BIG HAMMER — it is the same grant `metric-server.ts` warns

package/src/proxmox/generated/pbs.ts

@@ -2,7 +2,7 @@
  * Generated PBS API types — DO NOT EDIT BY HAND.
  *
  * Run: bun codegen/generate.ts
- * Source: house/proxmox/apidoc/ — see README there for provenance.
+ * Source: the cluster's own `apidoc.js` (pve-docs), extracted outside this repo.
  */
 
 /** GET /config/datastore — `data` payload after client unwrap. */
@@ -141,6 +141,335 @@ export type ConfigDatastoreNameDeleteParams = {
 /** DELETE /config/datastore/{name} — `data` payload after client unwrap. */
 export type ConfigDatastoreNameDeleteReturn = string;
 
+/** GET /config/notifications/endpoints — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsGetReturn = null;
+
+/** GET /config/notifications/endpoints/gotify — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsGotifyGetReturn = readonly {
+  comment?: string;
+  disable?: boolean | 0 | 1;
+  filter?: string;
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+  server: string;
+}[];
+
+/** POST /config/notifications/endpoints/gotify — form/query parameters (path segments omitted). */
+export type ConfigNotificationsEndpointsGotifyPostParams = {
+  comment?: string;
+  disable?: '0' | '1';
+  filter?: string;
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+  server: string;
+  token: string;
+};
+/** POST /config/notifications/endpoints/gotify — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsGotifyPostReturn = null;
+
+/** GET /config/notifications/endpoints/gotify/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsGotifyNameGetReturn = {
+  comment?: string;
+  disable?: boolean | 0 | 1;
+  filter?: string;
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+  server: string;
+};
+
+/** PUT /config/notifications/endpoints/gotify/{name} — form/query parameters (path segments omitted). */
+export type ConfigNotificationsEndpointsGotifyNamePutParams = {
+  comment?: string;
+  delete?: readonly ('comment' | 'disable')[];
+  digest?: string;
+  disable?: '0' | '1';
+  server?: string;
+  token?: string;
+};
+/** PUT /config/notifications/endpoints/gotify/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsGotifyNamePutReturn = null;
+
+/** DELETE /config/notifications/endpoints/gotify/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsGotifyNameDeleteReturn = null;
+
+/** GET /config/notifications/endpoints/sendmail — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsSendmailGetReturn = readonly {
+  author?: string;
+  comment?: string;
+  disable?: boolean | 0 | 1;
+  filter?: string;
+  'from-address'?: string;
+  mailto?: readonly string[];
+  'mailto-user'?: readonly string[];
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+}[];
+
+/** POST /config/notifications/endpoints/sendmail — form/query parameters (path segments omitted). */
+export type ConfigNotificationsEndpointsSendmailPostParams = {
+  author?: string;
+  comment?: string;
+  disable?: '0' | '1';
+  filter?: string;
+  'from-address'?: string;
+  mailto?: readonly string[];
+  'mailto-user'?: readonly string[];
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+};
+/** POST /config/notifications/endpoints/sendmail — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsSendmailPostReturn = null;
+
+/** GET /config/notifications/endpoints/sendmail/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsSendmailNameGetReturn = {
+  author?: string;
+  comment?: string;
+  disable?: boolean | 0 | 1;
+  filter?: string;
+  'from-address'?: string;
+  mailto?: readonly string[];
+  'mailto-user'?: readonly string[];
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+};
+
+/** PUT /config/notifications/endpoints/sendmail/{name} — form/query parameters (path segments omitted). */
+export type ConfigNotificationsEndpointsSendmailNamePutParams = {
+  author?: string;
+  comment?: string;
+  delete?: readonly (
+    | 'author'
+    | 'comment'
+    | 'disable'
+    | 'from-address'
+    | 'mailto'
+    | 'mailto-user'
+  )[];
+  digest?: string;
+  disable?: '0' | '1';
+  'from-address'?: string;
+  mailto?: readonly string[];
+  'mailto-user'?: readonly string[];
+};
+/** PUT /config/notifications/endpoints/sendmail/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsSendmailNamePutReturn = null;
+
+/** DELETE /config/notifications/endpoints/sendmail/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsSendmailNameDeleteReturn = null;
+
+/** GET /config/notifications/endpoints/smtp — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsSmtpGetReturn = readonly {
+  author?: string;
+  comment?: string;
+  disable?: boolean | 0 | 1;
+  'from-address': string;
+  mailto?: readonly string[];
+  'mailto-user'?: readonly string[];
+  mode?: 'insecure' | 'starttls' | 'tls';
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+  port?: number;
+  server: string;
+  username?: string;
+}[];
+
+/** POST /config/notifications/endpoints/smtp — form/query parameters (path segments omitted). */
+export type ConfigNotificationsEndpointsSmtpPostParams = {
+  author?: string;
+  comment?: string;
+  disable?: '0' | '1';
+  'from-address': string;
+  mailto?: readonly string[];
+  'mailto-user'?: readonly string[];
+  mode?: 'insecure' | 'starttls' | 'tls';
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+  password?: string;
+  port?: string;
+  server: string;
+  username?: string;
+};
+/** POST /config/notifications/endpoints/smtp — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsSmtpPostReturn = null;
+
+/** GET /config/notifications/endpoints/smtp/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsSmtpNameGetReturn = {
+  author?: string;
+  comment?: string;
+  disable?: boolean | 0 | 1;
+  'from-address': string;
+  mailto?: readonly string[];
+  'mailto-user'?: readonly string[];
+  mode?: 'insecure' | 'starttls' | 'tls';
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+  port?: number;
+  server: string;
+  username?: string;
+};
+
+/** PUT /config/notifications/endpoints/smtp/{name} — form/query parameters (path segments omitted). */
+export type ConfigNotificationsEndpointsSmtpNamePutParams = {
+  author?: string;
+  comment?: string;
+  delete?: readonly (
+    | 'author'
+    | 'comment'
+    | 'disable'
+    | 'mailto'
+    | 'mailto-user'
+    | 'password'
+    | 'port'
+    | 'username'
+  )[];
+  digest?: string;
+  disable?: '0' | '1';
+  'from-address'?: string;
+  mailto?: readonly string[];
+  'mailto-user'?: readonly string[];
+  mode?: 'insecure' | 'starttls' | 'tls';
+  password?: string;
+  port?: string;
+  server?: string;
+  username?: string;
+};
+/** PUT /config/notifications/endpoints/smtp/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsSmtpNamePutReturn = null;
+
+/** DELETE /config/notifications/endpoints/smtp/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsSmtpNameDeleteReturn = null;
+
+/** GET /config/notifications/endpoints/webhook — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsWebhookGetReturn = readonly {
+  body?: string;
+  comment?: string;
+  disable?: boolean | 0 | 1;
+  header?: readonly string[];
+  method: 'post' | 'put' | 'get';
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+  secret?: readonly string[];
+  url: string;
+}[];
+
+/** POST /config/notifications/endpoints/webhook — form/query parameters (path segments omitted). */
+export type ConfigNotificationsEndpointsWebhookPostParams = {
+  body?: string;
+  comment?: string;
+  disable?: '0' | '1';
+  header?: readonly string[];
+  method: 'post' | 'put' | 'get';
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+  secret?: readonly string[];
+  url: string;
+};
+/** POST /config/notifications/endpoints/webhook — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsWebhookPostReturn = null;
+
+/** GET /config/notifications/endpoints/webhook/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsWebhookNameGetReturn = {
+  body?: string;
+  comment?: string;
+  disable?: boolean | 0 | 1;
+  header?: readonly string[];
+  method: 'post' | 'put' | 'get';
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+  secret?: readonly string[];
+  url: string;
+};
+
+/** PUT /config/notifications/endpoints/webhook/{name} — form/query parameters (path segments omitted). */
+export type ConfigNotificationsEndpointsWebhookNamePutParams = {
+  body?: string;
+  comment?: string;
+  delete?: readonly ('comment' | 'disable' | 'header' | 'body' | 'secret')[];
+  digest?: string;
+  disable?: '0' | '1';
+  header?: readonly string[];
+  method?: 'post' | 'put' | 'get';
+  secret?: readonly string[];
+  url?: string;
+};
+/** PUT /config/notifications/endpoints/webhook/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsWebhookNamePutReturn = null;
+
+/** DELETE /config/notifications/endpoints/webhook/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsEndpointsWebhookNameDeleteReturn = null;
+
+/** GET /config/notifications/matchers — `data` payload after client unwrap. */
+export type ConfigNotificationsMatchersGetReturn = readonly {
+  comment?: string;
+  disable?: boolean | 0 | 1;
+  'invert-match'?: boolean | 0 | 1;
+  'match-calendar'?: readonly string[];
+  'match-field'?: readonly string[];
+  'match-severity'?: readonly string[];
+  mode?: 'all' | 'any';
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+  target?: readonly string[];
+}[];
+
+/** POST /config/notifications/matchers — form/query parameters (path segments omitted). */
+export type ConfigNotificationsMatchersPostParams = {
+  comment?: string;
+  disable?: '0' | '1';
+  'invert-match'?: '0' | '1';
+  'match-calendar'?: readonly string[];
+  'match-field'?: readonly string[];
+  'match-severity'?: readonly string[];
+  mode?: 'all' | 'any';
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+  target?: readonly string[];
+};
+/** POST /config/notifications/matchers — `data` payload after client unwrap. */
+export type ConfigNotificationsMatchersPostReturn = null;
+
+/** GET /config/notifications/matchers/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsMatchersNameGetReturn = {
+  comment?: string;
+  disable?: boolean | 0 | 1;
+  'invert-match'?: boolean | 0 | 1;
+  'match-calendar'?: readonly string[];
+  'match-field'?: readonly string[];
+  'match-severity'?: readonly string[];
+  mode?: 'all' | 'any';
+  name: string;
+  origin?: 'user-created' | 'builtin' | 'modified-builtin';
+  target?: readonly string[];
+};
+
+/** PUT /config/notifications/matchers/{name} — form/query parameters (path segments omitted). */
+export type ConfigNotificationsMatchersNamePutParams = {
+  comment?: string;
+  delete?: readonly (
+    | 'comment'
+    | 'disable'
+    | 'invert-match'
+    | 'match-calendar'
+    | 'match-field'
+    | 'match-severity'
+    | 'mode'
+    | 'target'
+  )[];
+  digest?: string;
+  disable?: '0' | '1';
+  'invert-match'?: '0' | '1';
+  'match-calendar'?: readonly string[];
+  'match-field'?: readonly string[];
+  'match-severity'?: readonly string[];
+  mode?: 'all' | 'any';
+  target?: readonly string[];
+};
+/** PUT /config/notifications/matchers/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsMatchersNamePutReturn = null;
+
+/** DELETE /config/notifications/matchers/{name} — `data` payload after client unwrap. */
+export type ConfigNotificationsMatchersNameDeleteReturn = null;
+
 /** GET /config/prune — `data` payload after client unwrap. */
 export type ConfigPruneGetReturn = readonly {
   comment?: string;