@homeflare/alchemy 0.11.0 → 0.13.0

package/dist/proxmox/ceph-osd-tree.d.ts

@@ -11,13 +11,13 @@
  *   `CephOsdProps` is a cycle on paper only: it is erased before anything runs.
  *
  * ⛔ `GET /nodes/{node}/ceph/osd` ANSWERS A TREE, NOT A LIST, AND IT IS THE WHOLE CLUSTER'S TREE.
- *   MEASURED 2026-09-13: asked of n2 it answers `{"flags":…,"root":{"children":[…]}}` whose
- *   leaves include osd.0 and osd.5 on n4; asked of n3 it answers the identical six leaves. The
+ *   MEASURED 2026-09-13: asked of node-b it answers `{"flags":…,"root":{"children":[…]}}` whose
+ *   leaves include osd.0 and osd.5 on node-d; asked of node-c it answers the identical six leaves. The
  *   `{node}` in the path chooses WHO ANSWERS, not what is listed. A provider that read it as "the
- *   OSDs on this node" would find osd.0 through n2 and then report it as living there.
+ *   OSDs on this node" would find osd.0 through node-b and then report it as living there.
  *
  * ⛔ AND THE SINGLE-OBJECT PATH CANNOT BE USED INSTEAD — THIS WALK EXISTS BECAUSE IT LIES.
- *   MEASURED: `GET /nodes/n2/ceph/osd/99`, an id with no OSD behind it, answers HTTP 200 with
+ *   MEASURED: `GET /nodes/node-b/ceph/osd/99`, an id with no OSD behind it, answers HTTP 200 with
  *   `[{"name":"metadata"},{"name":"lv-info"}]` — byte for byte what `…/osd/2` answers for a real
  *   one. It is a directory index (its schema says `permissions: {"user":"all"}`), not a read of
  *   the OSD. Point `PveSpec.path` at it and every declared OSD is "present": `diff` reports
@@ -25,18 +25,18 @@
  *   stops this package recording objects that do not exist — passes on an OSD that was never
  *   built. The only endpoint that can tell present from absent is the tree.
  *
- * ★ MEASURED ON TB4 ON 2026-09-13, `GET /nodes/n2/ceph/osd`. Six leaves, all `up` and `in`, Ceph
+ * ★ MEASURED ON C1 ON 2026-09-13, `GET /nodes/node-b/ceph/osd`. Six leaves, all `up` and `in`, Ceph
  *   20.2.2 tentacle:
  *
- *     id  name   host  device_class  crush_weight      reweight  pgs  status
- *     0   osd.0  n4    ssd           1.86299133300781  1          99  up
- *     5   osd.5  n4    ssd           1.86299133300781  1          94  up
- *     1   osd.1  n3    ssd           1.86299133300781  1          96  up
- *     4   osd.4  n3    ssd           1.81939697265625  1          97  up
- *     2   osd.2  n2    ssd           1.81939697265625  1          88  up
- *     3   osd.3  n2    ssd           1.81939697265625  1         105  up
+ *     id  name   host    device_class  crush_weight      reweight  pgs  status
+ *     0   osd.0  node-d  ssd           1.86299133300781  1          99  up
+ *     5   osd.5  node-d  ssd           1.86299133300781  1          94  up
+ *     1   osd.1  node-c  ssd           1.86299133300781  1          96  up
+ *     4   osd.4  node-c  ssd           1.81939697265625  1          97  up
+ *     2   osd.2  node-b  ssd           1.81939697265625  1          88  up
+ *     3   osd.3  node-b  ssd           1.81939697265625  1         105  up
  *
- *   `{ node: 'n2', osdid: 2, host: 'n2', device_class: 'ssd' }` plans `noop` against that row.
+ *   `{ node: 'node-b', osdid: 2, host: 'node-b', device_class: 'ssd' }` plans `noop` against that row.
  *   That is the acceptance test this file was written to pass.
  *
  * ⚠️ EVERY OTHER COLUMN IS REPORTED AND NEVER COMPARED, FOR FOUR DIFFERENT REASONS. `pgs` is the
@@ -63,8 +63,8 @@ type CrushNode = Record<string, unknown>;
 /**
  * Every OSD leaf under the tree root, at any depth.
  *
- * ⚠️ RECURSIVE BECAUSE THE TREE IS NOT THREE LEVELS DEEP BY LAW. TB4 measures as
- *   root(`default`) -> host(n2|n3|n4) -> osd, but CRUSH admits datacenter, rack and chassis
+ * ⚠️ RECURSIVE BECAUSE THE TREE IS NOT THREE LEVELS DEEP BY LAW. C1 measures as
+ *   root(`default`) -> host(node-b|node-c|node-d) -> osd, but CRUSH admits datacenter, rack and chassis
  *   buckets between them, and an OSD created outside a host bucket hangs off the root. Reaching
  *   in as `root.children[].children[]` would read this cluster correctly and answer "absent" —
  *   i.e. "the replica is gone" — on the first cluster that has a rack in it.
@@ -128,7 +128,7 @@ export interface CephOsdAttributes {
  * ⚠️ THE TELEMETRY IS DELIBERATELY DROPPED, NOT FORGOTTEN. The leaf also carries `bytes_used`,
  *   `percent_used`, `apply_latency_ms` and `commit_latency_ms`. MEASURED, AND THE MEASUREMENT SAYS
  *   THE OPPOSITE OF WHAT YOU WOULD EXPECT: across two reads minutes apart, all four were identical
- *   on every OSD, and both latencies read 0 — TB4 was idle, so nothing was caught in the act. That
+ *   on every OSD, and both latencies read 0 — C1 was idle, so nothing was caught in the act. That
  *   these move is therefore REASONED, from what they count, not observed. Alchemy persists
  *   attributes; on a cluster doing work, keeping them would rewrite all six resources' state on
  *   every deploy and record a number that is stale by the time anybody reads it. What is kept is

package/dist/proxmox/ceph-osd.d.ts

@@ -11,7 +11,7 @@
  *
  *   A PVE method with no permissions block is refused to every identity except `root@pam`, so an
  *   OpenBao-minted `hf-provision@pve!…` token is answered 403 however wide its role — widening
- *   `LXCProvisioner` cannot fix it. Compare the sibling families, which DO carry a check and
+ *   the provision role cannot fix it. Compare the sibling families, which DO carry a check and
  *   therefore do work with a token: `ceph/fs`, `ceph/mon` and `disks/zfs` all want `Sys.Modify`.
  *
  * ⚠️ SO THE WRITE PATH IS HONEST RATHER THAN USEFUL. It is written out properly in
@@ -19,7 +19,7 @@
  *   operator running as root@pam. Through this package's credential it will 403, and a 403 is a
  *   better answer than a `delete` that silently does nothing while the plan claims otherwise.
  *
- * ★ WHAT IT IS ACTUALLY FOR, THEN: ASSERTION. It turns "n2, n3 and n4 each hold two ssd OSDs"
+ * ★ WHAT IT IS ACTUALLY FOR, THEN: ASSERTION. It turns "node-b, node-c and node-d each hold two ssd OSDs"
  *   into a line a plan checks, and it gives Ceph-backed resources something real to depend on —
  *   read `osd.osdid` into an `rbd` storage's props and Alchemy orders that storage after the
  *   assertion, so a stack can no longer report a healthy Ceph storage on a cluster whose OSDs are
@@ -46,8 +46,8 @@ import type { WithTarget } from './resource.ts';
 export type { CephOsdAttributes };
 export interface CephOsdProps extends WithTarget {
     /**
-     * Which node ANSWERS the read — not where the OSD lives. MEASURED: the tree n2 returns and the
-     * tree n3 returns are the same six leaves, n4's included. Point this at any node that is up;
+     * Which node ANSWERS the read — not where the OSD lives. MEASURED: the tree node-b returns and the
+     * tree node-c returns are the same six leaves, node-d's included. Point this at any node that is up;
      * `host` is the field that says where the disk is.
      */
     node: string;
@@ -56,7 +56,7 @@ export interface CephOsdProps extends WithTarget {
     /**
      * The CRUSH host bucket this OSD must sit in. Undeclared means unmanaged, as in storage.ts.
      *
-     * ⚠️ DECLARING IT IS AN ASSERTION WITH NO REPAIR. If osd.2 turns up under n3, the plan reports
+     * ⚠️ DECLARING IT IS AN ASSERTION WITH NO REPAIR. If osd.2 turns up under node-c, the plan reports
      *   work every time and the deploy fails, because moving an OSD between failure domains is a
      *   `ceph osd crush move` this provider will not perform. That is the intent: a replica in the
      *   wrong failure domain is not something to converge quietly past.

package/dist/proxmox/ceph-pool-form.d.ts

@@ -4,34 +4,34 @@
  * ★ SPLIT OUT OF ceph-pool.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is
  *   "does this touch the cluster" — the same one metric-server-form.ts draws, just with more on
  *   this side because this family needs it. Here: the declared shape, the reported shape, and the
- *   coercions that turn one into the other. There: reading TB4, deciding a diff, and the four
+ *   coercions that turn one into the other. There: reading C1, deciding a diff, and the four
  *   handlers. Nothing in this file makes a call or decides an action.
  * ⚠️ THE PROPS LIVE HERE RATHER THAN IN THE RESOURCE FILE, which is the one place this pair
  *   differs from metric-server / notification-target. There is no `import type` cycle back as a
  *   result; ceph-pool.ts re-exports both interfaces so the public surface is unchanged.
  *
  * ⛔ POST AND PUT DO NOT TAKE THE SAME PARAMETERS, AND BOTH EXTRAS ARE DESTRUCTIVE. MEASURED from
- *   the cluster's own schema (/usr/share/pve-docs/api-viewer/apidoc.js on n2, pve-manager 9.2.11,
+ *   the cluster's own schema (/usr/share/pve-docs/api-viewer/apidoc.js on node-b, pve-manager 9.2.11,
  *   2026-09-13): POST adds `add_storages` and `erasure-coding` to the shared set, PUT takes
  *   neither. Both are refused below, so what is left between the two bodies is `name`, which PUT
  *   reads from the path, and `pg_num`.
  *
  * ⛔ `pg_num` IS IN THE CREATE BODY AND NOT IN THE UPDATE BODY, AND THAT IS THE MOST IMPORTANT
- *   LINE IN THIS FILE. MEASURED in PVE::API2::Ceph::Pool::createpool on n2: a POST carrying no
+ *   LINE IN THIS FILE. MEASURED in PVE::API2::Ceph::Pool::createpool on node-b: a POST carrying no
  *   `pg_num` gets 128 substituted (`$param->{pg_num} //= 128`), and PVE::Ceph::Tools::create_pool
  *   then runs `osd pool create` — which Ceph answers with SUCCESS for a pool that already exists,
  *   before applying the rest of the body to it. So a create fired at a live pool SETS its pg_num,
  *   and lowering pg_num starts a PG MERGE: hours of backfill across every OSD, on a cluster whose
- *   Ceph traffic shares vmbr1.11 with everything else. ceph-pool.ts guards the create for exactly
+ *   Ceph traffic shares vmbr1.42 with everything else. ceph-pool.ts guards the create for exactly
  *   that reason; this half simply never offers pg_num to an update.
  */
 import type { WithTarget } from './resource.ts';
 export interface CephPoolProps extends WithTarget {
     /**
-     * ⚠️ WHICH NODE THE CALL GOES THROUGH, NOT WHERE THE POOL LIVES. A pool is cluster-wide: n2 and
-     *   n3 answer byte-identically for `cephtb4` (measured). The endpoint is node-scoped only
+     * ⚠️ WHICH NODE THE CALL GOES THROUGH, NOT WHERE THE POOL LIVES. A pool is cluster-wide: node-b and
+     *   node-c answer byte-identically for `rbd-c1` (measured). The endpoint is node-scoped only
      *   because PVE talks to the local RADOS socket, so this is a door, not a location — it is never
-     *   compared, and moving a declaration from n2 to n3 plans noop. Point it at a node you expect
+     *   compared, and moving a declaration from node-b to node-c plans noop. Point it at a node you expect
      *   to be up: a node that is down makes the read fail, and a failed read reads as "absent".
      */
     node: string;
@@ -49,7 +49,7 @@ export interface CephPoolProps extends WithTarget {
     min_size?: number;
     /**
      * ⛔ CREATE-TIME ONLY, AND NEVER COMPARED — the single biggest noop hazard in this family. With
-     *   `pg_autoscale_mode` on or warn the autoscaler owns this number: MEASURED on TB4, `cephtb4`
+     *   `pg_autoscale_mode` on or warn the autoscaler owns this number: MEASURED on C1, `rbd-c1`
      *   sits at pg_num 128 while the autoscaler's own `pg_num_final` is 256, so a declaration
      *   diffing it reports an update the moment Ceph decides to act. A split is gradual even with
      *   the autoscaler off, and `nopgchange` can refuse the write outright — which kills the WHOLE
@@ -59,7 +59,7 @@ export interface CephPoolProps extends WithTarget {
     pg_num?: number;
     /** The floor the autoscaler may not go below. Operator-owned and stable, so it IS compared. */
     pg_num_min?: number;
-    /** ⚠️ PVE's create default is `warn`; Ceph's own is `on`, which is what all four TB4 pools have. */
+    /** ⚠️ PVE's create default is `warn`; Ceph's own is `on`, which is what all four C1 pools have. */
     pg_autoscale_mode?: 'off' | 'on' | 'warn';
     /**
      * The CRUSH rule BY NAME, e.g. `replicated_rule`.
@@ -105,7 +105,7 @@ export interface CephPoolProps extends WithTarget {
  *   size or its PG shape, and `set_pool` dies on the whole PUT when any one parameter will not
  *   apply (Tools.pm:310). `matches` refuses to diff the fields they freeze, so these attributes
  *   are the only place a plan can show WHY a declared size is not being enforced. All three read
- *   false on all four TB4 pools.
+ *   false on all four C1 pools.
  * ⚠️ `pg_num`, `id` AND `applications` ARE REPORTED AND NEVER COMPARED — see the props above.
  * ⛔ NO `statistics` AND NO `autoscale_status`, though the verbose read returns both. They change
  *   every few seconds; persisting them would rewrite this resource's state on every deploy and
@@ -160,7 +160,7 @@ export declare const same: <T>(declared: T | undefined, live: T, frozen?: boolea
  * A declared autoscaler hint, or nothing when it is zero.
  *
  * ⚠️ A DECLARED ZERO IS "NO FLOOR, NO HINT", AND IT IS DELIBERATELY LEFT UNCOMPARED. REASONED, NOT
- *   MEASURED: all four TB4 pools carry null for both `pg_num_min` and `target_size`, and finding
+ *   MEASURED: all four C1 pools carry null for both `pg_num_min` and `target_size`, and finding
  *   out for certain would mean writing to the cluster. Ceph CLEARS both when they are set to 0 and
  *   `osd pool get all` then omits the key, which PVE reports as null and this pair reads as UNSET
  *   — so a declared 0 would compare 0 against -1 on every plan, forever. Mapping 0 to UNSET
@@ -185,7 +185,7 @@ export declare const hint: (value: number | undefined) => number | undefined;
  * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — storage.ts's rule, and the opposite of
  *   Proxmox.Pool's. Undeclared means UNMANAGED here, because a pool has no one set of defaults to
  *   fall back on: PVE's POST fills in size 3, min_size 2, application rbd and pg_autoscale_mode
- *   'warn' (MEASURED in createpool), while Ceph's own defaults — which is what every pool on TB4
+ *   'warn' (MEASURED in createpool), while Ceph's own defaults — which is what every pool on C1
  *   was actually born with — put pg_autoscale_mode at 'on'. Guessing either set would rewrite a
  *   pool somebody tuned by hand.
  *
@@ -198,7 +198,7 @@ export declare const hint: (value: number | undefined) => number | undefined;
  *   NOT PVE's `1T` STRING. MEASURED: the API parses the string with PVE::JSONSchema::parse_size
  *   and stores Ceph's `target_size_bytes` (Pool.pm:474-477 for POST, 683-686 for PUT), and
  *   `GET .../status` hands that integer back under the name `target_size` (Pool.pm:878). Run on
- *   n2, `parse_size('1099511627776')` returns 1099511627776 — bare digits are bytes, no
+ *   node-b, `parse_size('1099511627776')` returns 1099511627776 — bare digits are bytes, no
  *   multiplier — so a byte count survives the round trip exactly, while a declared `1T` would read
  *   back as 1099511627776 and diff against itself on every plan, forever.
  */

package/dist/proxmox/ceph-pool-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-pool-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oGAAoG;IACpG,iBAAiB,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC;IAC1C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,CAAC;IACvC,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,KAAK,CAAC;IACzB,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oGAAoG;IACpG,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,UAAW,aAAa,WAAkD,CAAC;AAC9F,eAAO,MAAM,UAAU,UAAW,aAAa,WAAoC,CAAC;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,KAAK,KAAK,CAAC;AAExB,qGAAqG;AACrG,eAAO,MAAM,YAAY,UAAW,OAAO,WACoC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,8BACD,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,UAAW,MAAM,GAAG,SAAS,uBAAsC,CAAC;AASrF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAQrE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMrE,CAAC"}
+{"version":3,"file":"ceph-pool-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-pool-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,iBAAiB,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC;IAC1C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,CAAC;IACvC,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,KAAK,CAAC;IACzB,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oGAAoG;IACpG,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,UAAW,aAAa,WAAkD,CAAC;AAC9F,eAAO,MAAM,UAAU,UAAW,aAAa,WAAoC,CAAC;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,KAAK,KAAK,CAAC;AAExB,qGAAqG;AACrG,eAAO,MAAM,YAAY,UAAW,OAAO,WACoC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,8BACD,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,UAAW,MAAM,GAAG,SAAS,uBAAsC,CAAC;AASrF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAQrE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMrE,CAAC"}

package/dist/proxmox/ceph-pool.d.ts

@@ -18,10 +18,10 @@
  *   string, so HTTP 200 means "the task started" — an immediate read-back can see a pool that does
  *   not exist yet, or values that have not landed. `settle` waits for the cluster to agree.
  *
- * ⛔ THE FOUR POOLS ON TB4 INCLUDE CEPH'S OWN, AND NONE OF THEM MAY BE ADOPTED. Measured
+ * ⛔ THE FOUR POOLS ON C1 INCLUDE CEPH'S OWN, AND NONE OF THEM MAY BE ADOPTED. Measured
  *   2026-09-13: `.mgr` (application `mgr`, created and owned by the manager daemons),
- *   `cephfs-tb4_data` and `cephfs-tb4_metadata` (the two halves of the `cephfs-tb4` filesystem —
- *   destroying either destroys the filesystem), and `cephtb4`, the rbd pool the guests sit on.
+ *   `cephfs-c1_data` and `cephfs-c1_metadata` (the two halves of the `cephfs-c1` filesystem —
+ *   destroying either destroys the filesystem), and `rbd-c1`, the rbd pool the guests sit on.
  *   `list` answers empty like every resource in this package, so adoption stays an explicit act;
  *   the `applications` attribute is reported so that a plan SHOWS which of those a declaration hit.
  *

package/dist/proxmox/client.d.ts

@@ -4,7 +4,7 @@
  * ★ PLAIN `fetch`, NO TLS ESCAPE HATCH, AND THAT IS A MEASURED CHOICE RATHER THAN AN OMISSION.
  *   Proxmox is usually met with `curl -k` because a fresh install serves its own self-signed
  *   certificate — I reached for `-k` myself before checking. This cluster serves a real Let's
- *   Encrypt certificate (`CN=cluster-tb4.example.com`), and strict TLS answers 401, i.e. the
+ *   Encrypt certificate (`CN=cluster-c1.example.com`), and strict TLS answers 401, i.e. the
  *   handshake succeeds and only the credential is missing. So there is no `rejectUnauthorized`
  *   option here to be left switched on by accident in somebody else's estate.
  *
@@ -46,7 +46,7 @@ export declare const pveEnvelopeWith: (target: PveTarget, credential: PveCredent
  * Make one call on a credential for `role`, REUSING a still-valid lease rather than minting one.
  *
  * 🔴 IT USED TO MINT PER CALL, AND AT 98 RESOURCES THAT STOPPED BEING FREE. One plan plus deploy
- *   of the TB4 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the
+ *   of the C1 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the
  *   read-back each minted their own, and `/etc/pve` is a replicated cluster filesystem every node
  *   has to agree on. src/lease-cache.ts carries the measurement and the safety argument.
  *

package/dist/proxmox/credential-literals.d.ts

@@ -0,0 +1,36 @@
+/**
+ * A credential written as a LITERAL in a plain prop — refused, because a plain prop is a value in
+ * the state store.
+ *
+ * ⛔ THE HOLE THIS CLOSES, MEASURED 2026-09-22 (adversarial review of PR 95). write-only.ts keeps
+ *   every `{ fromEnv }` value out of state, and the doc WARNED that a plain header value is a prop.
+ *   A warning is not a guard: `header: { Authorization: 'Bearer <token>' }` planned, deployed, and
+ *   left the token in the dumped state store — and so did `url: 'https://…?token=<token>'`. Alchemy
+ *   stores props unencrypted (write-only.ts has the StateEncoding reading), so the only safe
+ *   literal is one that is not a credential.
+ *
+ * ★ WHAT COUNTS AS A CREDENTIAL IS A NAME, NOT A VALUE. A value cannot be recognised — a token is
+ *   any string — but where it sits can: an `Authorization`/`Cookie` header, a header or query
+ *   parameter whose name has a word like `token`, `key`, `secret`, `password` or `signature`, and a
+ *   password in the URL's userinfo. A false positive costs one edit (declare it `{ fromEnv }`, or
+ *   hold it in `secret` and write `{{ secrets.<name> }}`); a false negative costs a leaked token.
+ * ★ A TEMPLATE THAT READS A SECRET IS NOT A LITERAL. `Bearer {{ secrets.token }}`, and
+ *   `{{ url-encode secrets.token }}` in a query, render on PBS from the root-only secret store —
+ *   the prop holds the reference, not the value.
+ *
+ * ⚠️ WHAT THIS CANNOT SEE: a token in a URL PATH (a Slack-style `/services/T…/B…/<token>`), in the
+ *   `body`, or in a `comment`. Those are plain props too; put the token in `secret` and reference
+ *   it from the template. docs/pbs-notifications.md says the same to the reader.
+ * ⛔ A REFUSAL NAMES THE FIELD, NEVER THE VALUE — the message lands in a terminal and a CI log.
+ */
+import type { FromEnv } from './write-only.ts';
+export declare const isCredentialName: (name: string) => boolean;
+/** Plain header values that are credentials by their header's name. `{ fromEnv }` is never one. */
+export declare const literalCredentialHeaders: (header: Readonly<Record<string, FromEnv | string>> | undefined) => string[];
+/**
+ * Where a URL carries a literal credential: `userinfo` (a password before the `@`), or the names
+ * of credential-shaped query (or fragment) parameters. Parsed by hand, not with `new URL`: a URL here is a
+ * TEMPLATE, and `{{ … }}` in the host or the userinfo is not a URL `new URL` will accept.
+ */
+export declare const literalCredentialsInUrl: (url: string | undefined) => string[];
+//# sourceMappingURL=credential-literals.d.ts.map

package/dist/proxmox/credential-literals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-literals.d.ts","sourceRoot":"","sources":["../../src/proxmox/credential-literals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAU/C,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,OACY,CAAC;AAI7D,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,WAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,KAC7D,MAAM,EAKE,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAAS,MAAM,GAAG,SAAS,KAAG,MAAM,EAkBvE,CAAC"}

package/dist/proxmox/credentials.d.ts

@@ -2,13 +2,13 @@
  * The PVE credential a reconcile runs with: minted from OpenBao, alive for five minutes.
  *
  * ⛔ THERE IS NO STATIC WRITE TOKEN IN THIS ESTATE, AND THAT IS DELIBERATE. Every PVE token stored
- *   in `kv/infra/proxmox/*` is read-only — PVEAuditor on media/ops/tb4, Audit on pbs, all as
- *   `monitoring@pve`. The MCP proxmox client says why in its own header: the auditor token bounds
+ *   on the estate's static KV shelf is read-only — PVEAuditor on each cluster, Audit on PBS, all
+ *   as one metrics user. The MCP proxmox client says why in its own header: the auditor token bounds
  *   what a BUG can do, independently of what the code bounds. Adding a long-lived write token to
  *   that shelf would delete the outer lock for every reader of the shelf, not just for this
  *   provider.
  *
- * ★ SO WRITES COME FROM A DYNAMIC MOUNT INSTEAD, which the estate already built: `proxmox-tb4/`
+ * ★ SO WRITES COME FROM A DYNAMIC MOUNT INSTEAD, which the estate already built: `proxmox-c1/`
  *   exposes two roles — `read` (ttl 3600s) and `provision` (ttl 300s, max 1800s, NOT renewable).
  *   A mint returns a PVE API token of its own, `hf-provision@pve!hf-provision-…-<timestamp>-<id>`,
  *   which expires on its own whether or not anything cleans up. Same shape as
@@ -24,7 +24,7 @@
  *
  * ⛔ THE SECRET NEVER TOUCHES DISK, A LOG, OR ALCHEMY STATE. Alchemy persists resource attributes
  *   WITHOUT encryption — StateEncoding.ts writes `Redacted` as `{"@redacted": <plaintext>}` — and
- *   this estate's state store is the `alchemy` Postgres, which pg-backup.sh dumps nightly. A PVE
+ *   this estate's state store is the `alchemy` Postgres, which a nightly job dumps. A PVE
  *   secret that reached an attribute would outlive its 300s lease by months, in four places.
  *   Nothing here returns it to a resource; it is used to build a header and then dropped.
  */
@@ -54,10 +54,10 @@ export type PveRole = 'read' | 'provision';
  *   use this file unchanged; that is the whole difference between a provider and a script.
  */
 export type PveTarget = {
-    /** OpenBao mount that vends API tokens for this host, e.g. `proxmox-tb4`. */
+    /** OpenBao mount that vends API tokens for this host, e.g. `proxmox-c1`. */
     readonly mount: string;
     /**
-     * mgmt hostnames for cluster members, e.g. `n2.mgmt.example.com`. Any member's :8006 API
+     * mgmt hostnames for cluster members, e.g. `node-b.mgmt.example.com`. Any member's :8006 API
      * manages the whole cluster; `client.ts` failovers across them.
      */
     readonly members: readonly string[];
@@ -118,14 +118,14 @@ export type BaoEnvironment = Readonly<Record<string, string | undefined>>;
  * Mint one credential for `role`: `GET /v1/<mount>/creds/<role>` on OpenBao's HTTP API.
  *
  * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one
- *   client could not disagree with `bao kv get` about what this machine may do. house/openbao then
+ *   client could not disagree with `bao kv get` about what this machine may do. <estate>/openbao then
  *   learned twice what deciding by stderr costs — every failure read as absent, and two commands
  *   said "absent" in different words — so this reads STATUS CODES: 2xx is a credential, and 403
  *   (denied), 404 (no such role or mount — a mint has no "absent"), 503 (sealed) all fail.
  * ★ THE ENVIRONMENT CONTRACT IS STILL THE CLI's, READ THE CLI's WAY, which keeps the case above
  *   true (openbao v2.6.2 api/client.go:34-66, 370, 503-507, 761-762, 776-785): BAO_AGENT_ADDR over
  *   BAO_ADDR over https://127.0.0.1:8200; BAO_NAMESPACE as X-Vault-Namespace; BAO_TOKEN as
- *   X-Vault-Token; X-Vault-Request always. house/openbao/src/bao-address.ts has the long form.
+ *   X-Vault-Token; X-Vault-Request always. <estate>/openbao/src/bao-address.ts has the long form.
  * ★ AGENT MODE IS NO BAO_TOKEN AND NO TOKEN HEADER. An Agent or Proxy listener with
  *   `api_proxy { use_auto_auth_token = true }` (or the older `cache { … }`) substitutes its
  *   auto-auth token exactly when a request carries none — command/agentproxyshared/cache/handler.go

package/dist/proxmox/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/proxmox/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D;;;;;;;;;;;;GAYG;AACH,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAM1E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,IAAI,WAAY,SAAS,QAAQ,OAAO,QAAO,cAAc;;;;gCAuFtE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,aAAa,eAAgB,aAAa,UAAU,SAAS,KAAG,MAGf,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/proxmox/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D;;;;;;;;;;;;GAYG;AACH,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAM1E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,IAAI,WAAY,SAAS,QAAQ,OAAO,QAAO,cAAc;;;;gCAuFtE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,aAAa,eAAgB,aAAa,UAAU,SAAS,KAAG,MAGf,CAAC"}

package/dist/proxmox/fake-pbs-notify.d.ts

@@ -0,0 +1,23 @@
+/**
+ * A PBS (or PVE) notification config that remembers writes — enough of proxmox-notify's CRUD for
+ * a family's REAL provider to create, drift, rotate and adopt through Alchemy's engine.
+ *
+ * ★ STATEFUL, UNLIKE `fakePve`'s bare answer function, because the questions here are about the
+ *   SECOND deploy: whether a rotated secret is written, whether an unchanged one is not. That needs
+ *   a server that holds what the first deploy wrote.
+ * ★ IT KEEPS proxmox-notify's TWO RULES THAT MATTER HERE (api/webhook.rs, read at HEAD 2026-09-22):
+ *     1. a read returns secret NAMES only; values live in a separate private store;
+ *     2. a PUT that carries `secret` REPLACES the list, a name without a value keeping the old
+ *        one; a PUT without `secret` leaves the list alone. `delete` entries clear a field.
+ *   Repeated form keys arrive as arrays, as the real urlencoded decoder builds them.
+ * ⛔ TEST-ONLY. No provider imports this file.
+ */
+import { type FakePve } from './fake-pve.ts';
+export interface FakeNotify extends FakePve {
+    /** Public config by path, as a GET would see it apart from secrets. Mutable, for drift. */
+    readonly objects: Map<string, Record<string, unknown>>;
+    /** Secret items with values (`name=…,value=<base64>`), by path — the root-only file. */
+    readonly secrets: Map<string, string[]>;
+}
+export declare const fakeNotify: (seed?: Readonly<Record<string, Record<string, unknown>>>) => FakeNotify;
+//# sourceMappingURL=fake-pbs-notify.d.ts.map

package/dist/proxmox/fake-pbs-notify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-pbs-notify.d.ts","sourceRoot":"","sources":["../../src/proxmox/fake-pbs-notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,OAAO,EAAyB,MAAM,eAAe,CAAC;AAepE,MAAM,WAAW,UAAW,SAAQ,OAAO;IACzC,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC;AA4BD,eAAO,MAAM,UAAU,UACf,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KACtD,UA2CF,CAAC"}

package/dist/proxmox/fake-pve.d.ts

@@ -19,6 +19,11 @@ export interface PveCall {
     /** Relative to `/api2/json/`, query included — the string a family passes to `pve()`. */
     readonly path: string;
     readonly form: Readonly<Record<string, string>>;
+    /**
+     * Every key/value pair in wire order. ⚠️ `form` keeps only the LAST value of a repeated key, and
+     * a PBS list IS a repeated key (client.ts `encode`) — assert a list on `pairs`, never `form`.
+     */
+    readonly pairs: readonly (readonly [string, string])[];
 }
 /** Answers one call with its `data`; `undefined` is PVE's `{"data": null}`. */
 export type PveAnswer = (call: PveCall) => unknown;

package/dist/proxmox/fake-pve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-pve.d.ts","sourceRoot":"","sources":["../../src/proxmox/fake-pve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIlD,eAAO,MAAM,WAAW,EAAE,SAIzB,CAAC;AAEF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAED,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;AAEnD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,EAAE,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;CAC9C;AAED,0FAA0F;AAC1F,QAAA,MAAM,SAAS,SAAU,OAAO,KAAK,oFACuD,CAAC;AAE7F,eAAO,MAAM,OAAO,WAAY,SAAS,KAAG,OAuB3C,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,UAAU,GAAI,CAAC,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,CACO,CAAC"}
+{"version":3,"file":"fake-pve.d.ts","sourceRoot":"","sources":["../../src/proxmox/fake-pve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIlD,eAAO,MAAM,WAAW,EAAE,SAIzB,CAAC;AAEF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;CACxD;AAED,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;AAEnD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,EAAE,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;CAC9C;AAED,0FAA0F;AAC1F,QAAA,MAAM,SAAS,SAAU,OAAO,KAAK,oFACuD,CAAC;AAE7F,eAAO,MAAM,OAAO,WAAY,SAAS,KAAG,OA4B3C,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,UAAU,GAAI,CAAC,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,CACO,CAAC"}

package/dist/proxmox/firewall-alias-form.d.ts

@@ -33,7 +33,7 @@ export declare const fold: (name: string) => string;
 /**
  * A CIDR reduced to the one form PVE will hand back.
  *
- * ⛔ MEASURED by running the cluster's own `PVE::Firewall::parse_alias` on n2 (pve-manager 9.2.11,
+ * ⛔ MEASURED by running the cluster's own `PVE::Firewall::parse_alias` on node-b (pve-manager 9.2.11,
  *   2026-09-13) — a pure function over a string, no config read and none written:
  *     `10.1.1.5/32`     -> `10.1.1.5`        a /32 host suffix is STRIPPED
  *     `2001:0DB8::1/128`-> `2001:0DB8::1`    a /128 is stripped, and the case is NOT folded

package/dist/proxmox/firewall-alias.d.ts

@@ -61,7 +61,7 @@
  * ⚠️ PRIVILEGES, AND FOR ONCE NOTHING NEEDS WIDENING. MEASURED 2026-09-13 from the cluster's own
  *   schema and its live ACL: the item GET checks `["perm","/",["Sys.Audit"]]`, POST/PUT/DELETE
  *   check `["perm","/",["Sys.Modify"]]`, `hf-read@pve` holds `PVEAuditor` at `/` with propagate and
- *   `hf-provision@pve` holds `LXCProvisioner` at `/` with propagate. Both privileges are already
+ *   `hf-provision@pve` holds the provision role (provision-baseline.ts) at `/` with propagate. Both privileges are already
  *   held, so `readRole` stays the default `read` lane — unlike storage/sdn-zone/sdn-vnet, whose
  *   ITEM reads are gated on an allocate privilege the auditor cannot have.
  *   ⚠️ `Sys.Modify` ON `/` IS STILL A BIG HAMMER — it is the same grant `metric-server.ts` warns