@homeflare/alchemy 0.11.0 → 0.13.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -3
- package/dist/caddy/admin-guard.d.ts +1 -1
- package/dist/caddy/index.js.map +2 -2
- package/dist/cloudflare/client.d.ts +1 -1
- package/dist/cloudflare/index.js.map +2 -2
- package/dist/cloudflare/lock-rules.d.ts +1 -1
- package/dist/forgejo/branch-protection-form.d.ts +1 -1
- package/dist/forgejo/branch-protection.d.ts +1 -1
- package/dist/forgejo/index.js.map +10 -10
- package/dist/forgejo/org-actions-secrets.d.ts +1 -1
- package/dist/forgejo/org-label.d.ts +1 -1
- package/dist/forgejo/org-team.d.ts +1 -1
- package/dist/forgejo/repo-webhook.d.ts +1 -1
- package/dist/forgejo/repository.d.ts +2 -2
- package/dist/forgejo/repository.d.ts.map +1 -1
- package/dist/forgejo/resource.d.ts +2 -2
- package/dist/forgejo/team-member.d.ts +1 -1
- package/dist/openbao/auth-role.d.ts +1 -1
- package/dist/openbao/bao-http.d.ts +4 -4
- package/dist/openbao/cloudflare-permission-groups.d.ts +1 -1
- package/dist/openbao/cloudflare-role-form.d.ts +2 -2
- package/dist/openbao/cloudflare-role-form.d.ts.map +1 -1
- package/dist/openbao/cloudflare-roles-expand.d.ts +1 -1
- package/dist/openbao/digest.d.ts +1 -1
- package/dist/openbao/forgejo-bootstrap-parse.d.ts +2 -2
- package/dist/openbao/forgejo-bootstrap-parse.d.ts.map +1 -1
- package/dist/openbao/forgejo-bootstrap.d.ts +1 -1
- package/dist/openbao/index.js.map +14 -14
- package/dist/openbao/mount.d.ts +1 -1
- package/dist/openbao/pki-role.d.ts +1 -1
- package/dist/openbao/policy.d.ts +2 -2
- package/dist/openbao/proxmox-role-form.d.ts +2 -2
- package/dist/openbao/proxmox-role-form.d.ts.map +1 -1
- package/dist/openbao/proxmox-role.d.ts +10 -10
- package/dist/openbao/ssh-role.d.ts +3 -3
- package/dist/proxmox/acl.d.ts +2 -2
- package/dist/proxmox/acl.d.ts.map +1 -1
- package/dist/proxmox/alertmanager-body.d.ts +54 -0
- package/dist/proxmox/alertmanager-body.d.ts.map +1 -0
- package/dist/proxmox/api-token-form.d.ts +2 -2
- package/dist/proxmox/api-token.d.ts +11 -11
- package/dist/proxmox/ceph-daemon-form.d.ts +3 -3
- package/dist/proxmox/ceph-daemon.d.ts +19 -19
- package/dist/proxmox/ceph-daemon.d.ts.map +1 -1
- package/dist/proxmox/ceph-flag.d.ts +5 -5
- package/dist/proxmox/ceph-fs-wire.d.ts +5 -5
- package/dist/proxmox/ceph-fs.d.ts +16 -16
- package/dist/proxmox/ceph-osd-tree.d.ts +16 -16
- package/dist/proxmox/ceph-osd.d.ts +5 -5
- package/dist/proxmox/ceph-pool-form.d.ts +13 -13
- package/dist/proxmox/ceph-pool-form.d.ts.map +1 -1
- package/dist/proxmox/ceph-pool.d.ts +3 -3
- package/dist/proxmox/client.d.ts +2 -2
- package/dist/proxmox/credential-literals.d.ts +36 -0
- package/dist/proxmox/credential-literals.d.ts.map +1 -0
- package/dist/proxmox/credentials.d.ts +8 -8
- package/dist/proxmox/credentials.d.ts.map +1 -1
- package/dist/proxmox/fake-pbs-notify.d.ts +23 -0
- package/dist/proxmox/fake-pbs-notify.d.ts.map +1 -0
- package/dist/proxmox/fake-pve.d.ts +5 -0
- package/dist/proxmox/fake-pve.d.ts.map +1 -1
- package/dist/proxmox/firewall-alias-form.d.ts +1 -1
- package/dist/proxmox/firewall-alias.d.ts +1 -1
- package/dist/proxmox/generated/pbs.d.ts +279 -1
- package/dist/proxmox/generated/pbs.d.ts.map +1 -1
- package/dist/proxmox/generated/pve.d.ts +58 -1
- package/dist/proxmox/generated/pve.d.ts.map +1 -1
- package/dist/proxmox/group.d.ts +8 -8
- package/dist/proxmox/ha-resource.d.ts +3 -2
- package/dist/proxmox/ha-resource.d.ts.map +1 -1
- package/dist/proxmox/ha-rule-form.d.ts +5 -5
- package/dist/proxmox/ha-rule.d.ts +3 -3
- package/dist/proxmox/index.d.ts +14 -0
- package/dist/proxmox/index.d.ts.map +1 -1
- package/dist/proxmox/index.js +935 -223
- package/dist/proxmox/index.js.map +69 -56
- package/dist/proxmox/lease-cache.d.ts +4 -4
- package/dist/proxmox/lxc-harness.d.ts +1 -1
- package/dist/proxmox/lxc-props.d.ts +2 -2
- package/dist/proxmox/lxc.d.ts +3 -3
- package/dist/proxmox/members.d.ts +3 -3
- package/dist/proxmox/network-apply-read.d.ts +5 -5
- package/dist/proxmox/network-apply.d.ts +9 -9
- package/dist/proxmox/node-network-form.d.ts +6 -6
- package/dist/proxmox/node-network.d.ts +17 -17
- package/dist/proxmox/node-network.d.ts.map +1 -1
- package/dist/proxmox/notification-matcher-form.d.ts +100 -0
- package/dist/proxmox/notification-matcher-form.d.ts.map +1 -0
- package/dist/proxmox/notification-matcher.d.ts +46 -0
- package/dist/proxmox/notification-matcher.d.ts.map +1 -0
- package/dist/proxmox/notification-target.d.ts +3 -2
- package/dist/proxmox/notification-target.d.ts.map +1 -1
- package/dist/proxmox/pbs-datastore-guard.d.ts +1 -1
- package/dist/proxmox/pbs-datastore.d.ts +10 -10
- package/dist/proxmox/pbs-notification-matcher.d.ts +53 -0
- package/dist/proxmox/pbs-notification-matcher.d.ts.map +1 -0
- package/dist/proxmox/pbs-notification-target-form.d.ts +63 -0
- package/dist/proxmox/pbs-notification-target-form.d.ts.map +1 -0
- package/dist/proxmox/pbs-notification-target-lifecycle.d.ts +100 -0
- package/dist/proxmox/pbs-notification-target-lifecycle.d.ts.map +1 -0
- package/dist/proxmox/pbs-notification-target-wire.d.ts +30 -0
- package/dist/proxmox/pbs-notification-target-wire.d.ts.map +1 -0
- package/dist/proxmox/pbs-notification-target.d.ts +123 -0
- package/dist/proxmox/pbs-notification-target.d.ts.map +1 -0
- package/dist/proxmox/pbs-prune-job.d.ts +2 -2
- package/dist/proxmox/pbs-sync-job.d.ts +4 -4
- package/dist/proxmox/pbs-verify-job.d.ts +1 -1
- package/dist/proxmox/pool.d.ts +4 -4
- package/dist/proxmox/provision-baseline.d.ts +74 -0
- package/dist/proxmox/provision-baseline.d.ts.map +1 -0
- package/dist/proxmox/provision-bootstrap.d.ts +33 -0
- package/dist/proxmox/provision-bootstrap.d.ts.map +1 -0
- package/dist/proxmox/provision-cli-fake.d.ts +38 -0
- package/dist/proxmox/provision-cli-fake.d.ts.map +1 -0
- package/dist/proxmox/provision-declare.d.ts +25 -0
- package/dist/proxmox/provision-declare.d.ts.map +1 -0
- package/dist/proxmox/replication-job.d.ts +9 -8
- package/dist/proxmox/replication-job.d.ts.map +1 -1
- package/dist/proxmox/resource.d.ts +6 -5
- package/dist/proxmox/resource.d.ts.map +1 -1
- package/dist/proxmox/sdn-apply-read.d.ts +7 -7
- package/dist/proxmox/sdn-apply.d.ts +1 -1
- package/dist/proxmox/sdn-subnet-form.d.ts +1 -1
- package/dist/proxmox/sdn-subnet.d.ts +5 -5
- package/dist/proxmox/sdn-vnet.d.ts +5 -6
- package/dist/proxmox/sdn-vnet.d.ts.map +1 -1
- package/dist/proxmox/storage.d.ts +4 -3
- package/dist/proxmox/storage.d.ts.map +1 -1
- package/dist/proxmox/user.d.ts +3 -2
- package/dist/proxmox/user.d.ts.map +1 -1
- package/dist/proxmox/values.d.ts +1 -1
- package/dist/proxmox/write-only.d.ts +35 -0
- package/dist/proxmox/write-only.d.ts.map +1 -0
- package/dist/proxmox/zfs-pool-write.d.ts +1 -1
- package/dist/proxmox/zfs-pool.d.ts +5 -5
- package/dist/talos/credentials.d.ts +1 -1
- package/dist/talos/credentials.d.ts.map +1 -1
- package/dist/talos/index.js.map +1 -1
- package/dist/verify/fake-engine.d.ts +5 -0
- package/dist/verify/fake-engine.d.ts.map +1 -1
- package/docs/adopt-verify.md +21 -5
- package/docs/adopted-deploys.md +9 -1
- package/docs/ownership.md +26 -1
- package/docs/pbs-alertmanager-body.md +73 -0
- package/docs/pbs-notifications.md +163 -0
- package/docs/provision-baseline.md +106 -0
- package/docs/proxmox-lxc-adopt.md +2 -2
- package/docs/proxmox-lxc.md +5 -4
- package/docs/proxmox.md +9 -0
- package/package.json +1 -1
- package/src/caddy/admin-guard.ts +1 -1
- package/src/caddy/local-admin.ts +1 -1
- package/src/cloudflare/client.ts +1 -1
- package/src/cloudflare/lock-rules.ts +1 -1
- package/src/forgejo/branch-protection-form.ts +1 -1
- package/src/forgejo/branch-protection.ts +1 -1
- package/src/forgejo/client.ts +1 -1
- package/src/forgejo/org-actions-secrets.ts +1 -1
- package/src/forgejo/org-label.ts +1 -1
- package/src/forgejo/org-team.ts +1 -1
- package/src/forgejo/repo-webhook.ts +1 -1
- package/src/forgejo/repository.ts +2 -2
- package/src/forgejo/resource.ts +2 -2
- package/src/forgejo/team-member.ts +1 -1
- package/src/openbao/README.md +4 -4
- package/src/openbao/auth-role.ts +1 -1
- package/src/openbao/bao-http.test.ts +2 -2
- package/src/openbao/bao-http.ts +6 -6
- package/src/openbao/bao-status.test.ts +1 -1
- package/src/openbao/bao-status.ts +1 -1
- package/src/openbao/cloudflare-group-scope.test.ts +1 -1
- package/src/openbao/cloudflare-permission-groups.test.ts +1 -1
- package/src/openbao/cloudflare-permission-groups.ts +3 -3
- package/src/openbao/cloudflare-policy.ts +1 -1
- package/src/openbao/cloudflare-role-form.ts +2 -2
- package/src/openbao/cloudflare-roles-expand.ts +1 -1
- package/src/openbao/digest.ts +1 -1
- package/src/openbao/forgejo-bootstrap-parse.test.ts +3 -3
- package/src/openbao/forgejo-bootstrap-parse.ts +2 -2
- package/src/openbao/forgejo-bootstrap.ts +4 -4
- package/src/openbao/kubernetes-role-form.test.ts +5 -5
- package/src/openbao/mount.ts +1 -1
- package/src/openbao/pki-role.ts +1 -1
- package/src/openbao/policy-wire.test.ts +3 -3
- package/src/openbao/policy.ts +2 -2
- package/src/openbao/proxmox-role-form.ts +5 -5
- package/src/openbao/proxmox-role.ts +11 -11
- package/src/openbao/ssh-role.ts +3 -3
- package/src/proxmox/acl.ts +4 -4
- package/src/proxmox/adopt-noop.test.ts +6 -6
- package/src/proxmox/alertmanager-body.ts +125 -0
- package/src/proxmox/api-token-form.ts +4 -4
- package/src/proxmox/api-token.ts +13 -13
- package/src/proxmox/ceph-daemon-form.ts +3 -3
- package/src/proxmox/ceph-daemon.ts +20 -20
- package/src/proxmox/ceph-flag.ts +7 -7
- package/src/proxmox/ceph-fs-wire.ts +7 -7
- package/src/proxmox/ceph-fs.ts +18 -18
- package/src/proxmox/ceph-osd-tree.ts +16 -16
- package/src/proxmox/ceph-osd.ts +6 -6
- package/src/proxmox/ceph-pool-adopt.test.ts +14 -14
- package/src/proxmox/ceph-pool-form.ts +13 -13
- package/src/proxmox/ceph-pool.ts +6 -6
- package/src/proxmox/client.test.ts +3 -3
- package/src/proxmox/client.ts +3 -3
- package/src/proxmox/credential-literals.test.ts +148 -0
- package/src/proxmox/credential-literals.ts +74 -0
- package/src/proxmox/credentials.test.ts +6 -8
- package/src/proxmox/credentials.ts +8 -8
- package/src/proxmox/fake-pbs-notify.ts +108 -0
- package/src/proxmox/fake-pve.ts +12 -2
- package/src/proxmox/firewall-alias-form.ts +1 -1
- package/src/proxmox/firewall-alias.ts +1 -1
- package/src/proxmox/generated/pbs.ts +330 -1
- package/src/proxmox/generated/pve.ts +63 -1
- package/src/proxmox/group.ts +10 -10
- package/src/proxmox/ha-resource.ts +3 -2
- package/src/proxmox/ha-rule-form.ts +5 -5
- package/src/proxmox/ha-rule.ts +3 -3
- package/src/proxmox/index.test.ts +10 -0
- package/src/proxmox/index.ts +32 -0
- package/src/proxmox/lease-cache.test.ts +19 -19
- package/src/proxmox/lease-cache.ts +4 -4
- package/src/proxmox/lxc-adopt.test.ts +3 -3
- package/src/proxmox/lxc-create-form.ts +1 -1
- package/src/proxmox/lxc-guards.test.ts +4 -4
- package/src/proxmox/lxc-harness.ts +3 -3
- package/src/proxmox/lxc-judge.test.ts +5 -5
- package/src/proxmox/lxc-lifecycle.ts +1 -1
- package/src/proxmox/lxc-props.ts +2 -2
- package/src/proxmox/lxc-read.test.ts +3 -3
- package/src/proxmox/lxc-strict-adopt.test.ts +1 -1
- package/src/proxmox/lxc-volume.test.ts +9 -9
- package/src/proxmox/lxc-volume.ts +1 -1
- package/src/proxmox/lxc-wire.ts +1 -1
- package/src/proxmox/lxc.ts +3 -3
- package/src/proxmox/members.test.ts +1 -1
- package/src/proxmox/members.ts +3 -3
- package/src/proxmox/metric-server-otel.ts +2 -2
- package/src/proxmox/network-apply-read.ts +10 -10
- package/src/proxmox/network-apply.ts +10 -10
- package/src/proxmox/node-network-form.ts +7 -7
- package/src/proxmox/node-network.ts +18 -18
- package/src/proxmox/notification-matcher-form.ts +221 -0
- package/src/proxmox/notification-matcher.test.ts +234 -0
- package/src/proxmox/notification-matcher.ts +76 -0
- package/src/proxmox/notification-target.ts +3 -2
- package/src/proxmox/pbs-datastore-guard.ts +1 -1
- package/src/proxmox/pbs-datastore.ts +10 -10
- package/src/proxmox/pbs-notification-matcher.ts +81 -0
- package/src/proxmox/pbs-notification-target-drift.test.ts +83 -0
- package/src/proxmox/pbs-notification-target-form.ts +229 -0
- package/src/proxmox/pbs-notification-target-lifecycle.ts +177 -0
- package/src/proxmox/pbs-notification-target-state.test.ts +191 -0
- package/src/proxmox/pbs-notification-target-wire.ts +112 -0
- package/src/proxmox/pbs-notification-target.test.ts +226 -0
- package/src/proxmox/pbs-notification-target.ts +139 -0
- package/src/proxmox/pbs-notifications-stack.test.ts +94 -0
- package/src/proxmox/pbs-prune-job.ts +2 -2
- package/src/proxmox/pbs-sync-job.ts +4 -4
- package/src/proxmox/pbs-verify-job.ts +1 -1
- package/src/proxmox/pool.test.ts +2 -2
- package/src/proxmox/pool.ts +4 -4
- package/src/proxmox/provision-baseline.test.ts +87 -0
- package/src/proxmox/provision-baseline.ts +162 -0
- package/src/proxmox/provision-bootstrap.test.ts +132 -0
- package/src/proxmox/provision-bootstrap.ts +135 -0
- package/src/proxmox/provision-cli-fake.ts +217 -0
- package/src/proxmox/provision-declare.test.ts +111 -0
- package/src/proxmox/provision-declare.ts +103 -0
- package/src/proxmox/replication-job.ts +9 -8
- package/src/proxmox/resource.ts +9 -9
- package/src/proxmox/sdn-apply-read.test.ts +16 -16
- package/src/proxmox/sdn-apply-read.ts +7 -7
- package/src/proxmox/sdn-apply.ts +3 -3
- package/src/proxmox/sdn-subnet-form.ts +1 -1
- package/src/proxmox/sdn-subnet.ts +5 -5
- package/src/proxmox/sdn-vnet.ts +5 -6
- package/src/proxmox/storage.ts +4 -3
- package/src/proxmox/user.ts +3 -2
- package/src/proxmox/values.test.ts +2 -2
- package/src/proxmox/values.ts +1 -1
- package/src/proxmox/write-only.test.ts +75 -0
- package/src/proxmox/write-only.ts +106 -0
- package/src/proxmox/zfs-pool-write.ts +1 -1
- package/src/proxmox/zfs-pool.ts +6 -6
- package/src/talos/credentials.ts +3 -3
- package/src/talos/values.test.ts +9 -9
- package/src/verify/cli.test.ts +1 -1
- package/src/verify/fake-engine.ts +8 -1
package/dist/proxmox/group.d.ts
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* `Proxmox.Group` — a PVE group: a name, a comment, and the set of users PVE hangs off it.
|
|
3
3
|
*
|
|
4
|
-
* ★ DECLARING `hf-mint` IS THE WHOLE POINT OF THIS FAMILY. `
|
|
4
|
+
* ★ DECLARING `hf-mint` IS THE WHOLE POINT OF THIS FAMILY. `mint@pve` holds the `MintTokens` role
|
|
5
5
|
* ON THE PATH `/access/groups/hf-mint` — measured from `GET /access/acl`, 2026-09-13 — which is
|
|
6
6
|
* what confines the OpenBao proxmox engine to minting inside that one group. The group is the
|
|
7
7
|
* fence around the credential every other resource in this package runs on, and until now it was
|
|
@@ -17,7 +17,7 @@
|
|
|
17
17
|
* in this file could ever settle.
|
|
18
18
|
*
|
|
19
19
|
* ⛔ THE INDEX AND THE ITEM DISAGREE ABOUT BOTH THE NAME AND THE TYPE, and this file reads only the
|
|
20
|
-
* item. MEASURED against
|
|
20
|
+
* item. MEASURED against node-b, 2026-09-13:
|
|
21
21
|
* GET /access/groups -> [{"groupid":"hf-mint","comment":"…",
|
|
22
22
|
* "users":"hf-provision@pve,hf-read@pve"}, …]
|
|
23
23
|
* GET /access/groups/hf-mint -> {"comment":"…","members":["hf-provision@pve","hf-read@pve"]}
|
|
@@ -27,8 +27,8 @@
|
|
|
27
27
|
*
|
|
28
28
|
* ⛔ AND THE ITEM'S ORDER IS NOT STABLE BETWEEN TWO CONSECUTIVE CALLS. MEASURED, seconds apart, on
|
|
29
29
|
* the same endpoint:
|
|
30
|
-
* ["root@pam","
|
|
31
|
-
* ["
|
|
30
|
+
* ["root@pam","alice@pve","alice@pam","alice@example.com@corp"]
|
|
31
|
+
* ["alice@pam","alice@pve","alice@example.com@corp","root@pam"]
|
|
32
32
|
* `read_group` builds it as `[keys %{ $data->{users} }]` — a bare Perl hash key list, whose order
|
|
33
33
|
* is randomised per process — while the INDEX sorts (`join(',', sort keys …)`). So the array is
|
|
34
34
|
* sorted on the way into `attributes` as well as being kept out of `matches`: unsorted, Alchemy's
|
|
@@ -45,7 +45,7 @@
|
|
|
45
45
|
* So `readRole` is left at the default `read` — unlike storage/sdn-zone/sdn-vnet, whose ITEM
|
|
46
46
|
* reads PVE gates on an allocate privilege. See the ⛔ on `readRole` in `resource.ts`.
|
|
47
47
|
* · POST, PUT and DELETE each check `Group.Allocate` on `/access/groups`, and
|
|
48
|
-
* `hf-provision@pve` holds it via `
|
|
48
|
+
* `hf-provision@pve` holds it via the provision role (`PROVISION_PRIVILEGES`).
|
|
49
49
|
*
|
|
50
50
|
* ⛔ `retain` BY DEFAULT, BECAUSE DELETING A GROUP DESTROYS TWO THINGS THIS FILE CANNOT PUT BACK.
|
|
51
51
|
* Measured in `PVE::AccessControl` on the node:
|
|
@@ -53,8 +53,8 @@
|
|
|
53
53
|
* <comment>:`) and DERIVES each user's `groups` map from it at parse time. Deleting the group
|
|
54
54
|
* deletes the list, and this resource has no `members` prop to restore it from.
|
|
55
55
|
* · `delete_group_acl` then walks the whole ACL tree and drops every grant where the group is
|
|
56
|
-
* the SUBJECT. On this cluster that is `
|
|
57
|
-
* `
|
|
56
|
+
* the SUBJECT. On this cluster that is `admins -> Administrator on /` and
|
|
57
|
+
* `automation -> PVEAuditor on /`: whole populations of access, gone in one call, with no
|
|
58
58
|
* confirmation and nothing in the plan to suggest it.
|
|
59
59
|
* `delete` is FULLY IMPLEMENTED — `DELETE /access/groups/{groupid}` exists, unlike the ACL
|
|
60
60
|
* family's — so `.pipe(RemovalPolicy.destroy())` really removes the group. See the ★ in
|
|
@@ -95,7 +95,7 @@ export interface ProxmoxGroup extends Resource<'Proxmox.Group', GroupProps, Grou
|
|
|
95
95
|
export declare const ProxmoxGroup: import("alchemy").ResourceClass<ProxmoxGroup>;
|
|
96
96
|
/**
|
|
97
97
|
* ⛔ THE EMPTY `list` IS INHERITED FROM `pveHandlers` AND IT MATTERS HERE. `GET /access/groups`
|
|
98
|
-
* answers with every group on the cluster — on this one that is `
|
|
98
|
+
* answers with every group on the cluster — on this one that is `admins`, which grants
|
|
99
99
|
* `Administrator` on `/` to every human who logs in. Handing it to Alchemy would invite adoption,
|
|
100
100
|
* and therefore one day a delete that takes the whole admin group's access with it. Adoption
|
|
101
101
|
* stays an explicit act, here as everywhere else in this package.
|
|
@@ -35,10 +35,11 @@
|
|
|
35
35
|
* (node-affinity and resource-affinity) and that is the next family to add; do not port the old
|
|
36
36
|
* groups endpoint back just because the docs still describe it.
|
|
37
37
|
*
|
|
38
|
-
* ⚠️ RECONCILE NEEDS `Sys.Console` ON `/`, WHICH
|
|
38
|
+
* ⚠️ RECONCILE NEEDS `Sys.Console` ON `/`, WHICH THE PROVISION ROLE LACKED WHEN THIS WAS WRITTEN
|
|
39
|
+
* (`PROVISION_PRIVILEGES` carries it now — ha-rule.ts has the measurement). Read and diff are
|
|
39
40
|
* fine — `GET /cluster/ha/resources/{sid}` checks `Sys.Audit`, which the role already has — while
|
|
40
41
|
* POST, PUT and DELETE all check `Sys.Console` on `/` and will answer "Permission check failed
|
|
41
|
-
* (/, Sys.Console)"
|
|
42
|
+
* (/, Sys.Console)" on a role without it. Widen it knowingly: `Sys.Console` is also what
|
|
42
43
|
* opens a root shell on every node (`/nodes/{node}/vncshell`, `termproxy`), so granting it to the
|
|
43
44
|
* provision credential buys HA membership at the price of node console access. A separate role
|
|
44
45
|
* for HA writes is the narrower answer if that trade is not wanted.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ha-resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/ha-resource.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"ha-resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/ha-resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;GAOG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAErE,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,0FAA0F;IAC1F,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAAoD,CAAC;AAsDnF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yBAAyB,uIACuD,CAAC"}
|
|
@@ -14,21 +14,21 @@ import type { HaRuleProps } from './ha-rule.ts';
|
|
|
14
14
|
* A `<node>[:<pri>]` list, spelled the way PVE gives it back.
|
|
15
15
|
*
|
|
16
16
|
* ⛔ THIS IS NOT `csv`, AND THE DIFFERENCE IS A FOREVER-DIFF. MEASURED by reading
|
|
17
|
-
* `/usr/share/perl5/PVE/HA/Rules/NodeAffinity.pm` on
|
|
17
|
+
* `/usr/share/perl5/PVE/HA/Rules/NodeAffinity.pm` on node-b (2026-09-13): `decode_plugin_value`
|
|
18
18
|
* turns the list into a HASH keyed by node name, and `encode_plugin_value` rebuilds it with
|
|
19
19
|
* `for my $node (sort keys %$value)` — sorted by NODE NAME, never by the token — emitting the
|
|
20
20
|
* bare name whenever the priority is falsy, because `PVE::HA::Tools::parse_node_priority` reads
|
|
21
|
-
* a missing priority as 0. So a declared `
|
|
21
|
+
* a missing priority as 0. So a declared `node-c:1,node-b:0` is handed back as `node-b,node-c:1`: re-ordered AND
|
|
22
22
|
* re-spelled. Compare the raw strings and every plan reports an update, forever.
|
|
23
23
|
*
|
|
24
24
|
* ⚠️ SORTED BY NAME, NOT BY TOKEN, AND THE TWO GENUINELY DIVERGE. `csv` sorts whole tokens. Node
|
|
25
25
|
* names may contain `-` — `parse_node_priority`'s own regex is
|
|
26
|
-
* `[a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?` — and `-` (0x2D) sorts before `:` (0x3A), so `
|
|
27
|
-
* and `
|
|
26
|
+
* `[a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?` — and `-` (0x2D) sorts before `:` (0x3A), so `node-b-a`
|
|
27
|
+
* and `node-b:5` come out in one order by token and the other by name. PVE sorts by the name, so
|
|
28
28
|
* this does too.
|
|
29
29
|
*
|
|
30
30
|
* ⚠️ LAST ENTRY WINS FOR A REPEATED NODE, because PVE's decode is a hash assignment and a hash
|
|
31
|
-
* keeps one value per key. A declaration saying `
|
|
31
|
+
* keeps one value per key. A declaration saying `node-b:1,node-b:5` is stored as `node-b:5`; matching that
|
|
32
32
|
* is what a Map gives for free.
|
|
33
33
|
*/
|
|
34
34
|
export declare const nodeList: (value: readonly string[] | string | undefined) => string;
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* `Proxmox.HaRule` — where the CRM may place a guest, and which guests must not share a node.
|
|
3
3
|
*
|
|
4
|
-
* ★ THIS IS THE PVE 9 SUCCESSOR TO HA GROUPS, AND THE GROUPS ENDPOINT IS GONE. MEASURED on
|
|
4
|
+
* ★ THIS IS THE PVE 9 SUCCESSOR TO HA GROUPS, AND THE GROUPS ENDPOINT IS GONE. MEASURED on node-b
|
|
5
5
|
* (pve-manager/9.2.11, 2026-09-13): `pvesh get /cluster/ha/groups` answers `cannot index groups:
|
|
6
6
|
* ha groups have been migrated to rules`, and `/etc/pve/ha/` holds `rules.cfg` with no
|
|
7
7
|
* `groups.cfg` beside it. The published schema still documents groups and still offers a `group`
|
|
@@ -48,8 +48,8 @@
|
|
|
48
48
|
* ⚠️ BOTH LANES ALREADY HAVE THE PRIVILEGES, WHICH IS NEW. MEASURED 2026-09-13:
|
|
49
49
|
* GET (collection and item) checks `Sys.Audit` on `/` and the built-in `PVEAuditor` holds it, so
|
|
50
50
|
* `readRole` stays the default `read` lease — unlike storage.ts and the SDN families. POST, PUT
|
|
51
|
-
* and DELETE all check `Sys.Console` on `/`, and
|
|
52
|
-
*
|
|
51
|
+
* and DELETE all check `Sys.Console` on `/`, and the provision role now returns `Sys.Console` among
|
|
52
|
+
* its 27 privileges (`PROVISION_PRIVILEGES`, provision-baseline.ts). The warning in ha-resource.ts's header — that
|
|
53
53
|
* `Sys.Console` is missing — is stale; the role was widened, and the price it named still stands:
|
|
54
54
|
* `Sys.Console` is also what opens a root shell on every node.
|
|
55
55
|
*
|
package/dist/proxmox/index.d.ts
CHANGED
|
@@ -12,10 +12,17 @@
|
|
|
12
12
|
* The provider-only version diffed four fields and would have planned a create over any read
|
|
13
13
|
* failure. The Resource now adopts from the live config, refuses every change PVE cannot make
|
|
14
14
|
* in place, and retains on destroy (lxc.ts).
|
|
15
|
+
* ★ THE PROVISIONING BASELINE JOINED 2026-09-21: one privilege list (`PROVISION_PRIVILEGES`), the
|
|
16
|
+
* helper that declares it (`declareProvisionBaseline`) and the pure generator of the one-time
|
|
17
|
+
* root commands that bootstrap it (`provisionBootstrap`) — docs/provision-baseline.md.
|
|
18
|
+
* ★ THE NOTIFICATION FAMILIES JOINED 2026-09-22: PBS targets and matchers, the PVE matcher, the
|
|
19
|
+
* `FromEnv` shape their write-only values take, and the Alertmanager body template
|
|
20
|
+
* (docs/pbs-notifications.md; the template alone: docs/pbs-alertmanager-body.md).
|
|
15
21
|
* ★ Anything else unlisted is still reachable by path if you genuinely need
|
|
16
22
|
* it — that is a deliberate, visible act rather than an accident of barrelling.
|
|
17
23
|
*/
|
|
18
24
|
export { ProxmoxAcl, ProxmoxAclProvider } from './acl.ts';
|
|
25
|
+
export { type AlertmanagerBodyOptions, alertmanagerAlertBody } from './alertmanager-body.ts';
|
|
19
26
|
export { ProxmoxApiTokenProvider } from './api-token.ts';
|
|
20
27
|
export { ProxmoxBackupJob, ProxmoxBackupJobProvider } from './backup-job.ts';
|
|
21
28
|
export { ProxmoxCephDaemonProvider } from './ceph-daemon.ts';
|
|
@@ -31,12 +38,18 @@ export { type LxcAttributes, type LxcProps, ProxmoxLxc, ProxmoxLxcProvider } fro
|
|
|
31
38
|
export { ProxmoxMetricServer, ProxmoxMetricServerProvider } from './metric-server.ts';
|
|
32
39
|
export { ProxmoxNetworkApplyProvider } from './network-apply.ts';
|
|
33
40
|
export { ProxmoxNodeNetworkProvider } from './node-network.ts';
|
|
41
|
+
export { ProxmoxNotificationMatcher, ProxmoxNotificationMatcherProvider, } from './notification-matcher.ts';
|
|
34
42
|
export { ProxmoxNotificationTarget, ProxmoxNotificationTargetProvider, } from './notification-target.ts';
|
|
35
43
|
export { PbsDatastore, PbsDatastoreProvider } from './pbs-datastore.ts';
|
|
44
|
+
export { PbsNotificationMatcher, PbsNotificationMatcherProvider, } from './pbs-notification-matcher.ts';
|
|
45
|
+
export { PbsNotificationTarget, PbsNotificationTargetProvider, type PbsNotificationTargetProps, } from './pbs-notification-target.ts';
|
|
36
46
|
export { PbsPruneJob, PbsPruneJobProvider } from './pbs-prune-job.ts';
|
|
37
47
|
export { PbsSyncJob, PbsSyncJobProvider } from './pbs-sync-job.ts';
|
|
38
48
|
export { PbsVerifyJob, PbsVerifyJobProvider } from './pbs-verify-job.ts';
|
|
39
49
|
export { ProxmoxPool, ProxmoxPoolProvider } from './pool.ts';
|
|
50
|
+
export { PROVISION_DEFAULTS, PROVISION_PRIVILEGES, type ProvisionBaseline, type ProvisionLane, type ProvisionNames, type ResolvedProvisionNames, provisionBaseline, } from './provision-baseline.ts';
|
|
51
|
+
export { provisionBootstrap } from './provision-bootstrap.ts';
|
|
52
|
+
export { type DeclareProvisionOptions, declareProvisionBaseline } from './provision-declare.ts';
|
|
40
53
|
export { ProxmoxVmProvider } from './qemu.ts';
|
|
41
54
|
export { ProxmoxReplicationJobProvider } from './replication-job.ts';
|
|
42
55
|
export { ProxmoxRole, ProxmoxRoleProvider } from './role.ts';
|
|
@@ -46,5 +59,6 @@ export { ProxmoxSdnVnet, ProxmoxSdnVnetProvider } from './sdn-vnet.ts';
|
|
|
46
59
|
export { ProxmoxSdnZone, ProxmoxSdnZoneProvider } from './sdn-zone.ts';
|
|
47
60
|
export { ProxmoxStorage, ProxmoxStorageProvider } from './storage.ts';
|
|
48
61
|
export { ProxmoxUser, ProxmoxUserProvider } from './user.ts';
|
|
62
|
+
export { type FromEnv } from './write-only.ts';
|
|
49
63
|
export { ProxmoxZfsPoolProvider } from './zfs-pool.ts';
|
|
50
64
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxmox/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxmox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,KAAK,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,0BAA0B,GAChC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,KAAK,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC"}
|