@homeflare/alchemy 0.12.0 → 0.13.0

package/dist/proxmox/notification-matcher-form.d.ts

@@ -0,0 +1,100 @@
+/**
+ * A notification matcher — the rule that routes a notification to its targets — as ONE shape
+ * shared by PVE (`Proxmox.NotificationMatcher`) and PBS (`Pbs.NotificationMatcher`).
+ *
+ * ★ ONE FILE FOR BOTH PRODUCTS BECAUSE IT IS ONE IMPLEMENTATION. Both servers run the same Rust
+ *   crate, `proxmox-notify` (matcher.rs), PVE through its Perl bindings; the schemas in
+ *   generated/pve.ts and generated/pbs.ts carry the same nine fields, and the forms below are
+ *   typed against BOTH, so a drift on either side fails `tsc` here rather than on a server.
+ *
+ * ⚠️ A MATCHER IS ITS WHOLE RULE, SO EVERY RULE FIELD IS COMPARED, DECLARED OR NOT. Most families
+ *   here leave an undeclared field alone (backup-job.ts's trade). A matcher cannot: an undeclared
+ *   `match-field` on a matcher that has one is a declaration claiming "route everything" over a
+ *   server that routes one job type — and `invert-match` flips the meaning of every other line.
+ *   So `match-*` default to empty, `mode` to `all`, `invert-match` and `disable` to false, all are
+ *   compared, and a PUT sends all of them (an emptied list as `delete`). Only `comment` keeps the
+ *   usual "undeclared is unmanaged" rule, because nothing routes on it.
+ *   ★ THE COST IS THAT ADOPTING A MATCHER MEANS DECLARING IT AS IT IS. PBS ships `default-matcher`
+ *     with `invert-match`, a `match-field` and a `match-severity` (measured on PBS 4.2, 2026-09-22),
+ *     so adopting it as-is means writing those three down. A declaration that leaves them out
+ *     plans an UPDATE, which is the plan telling the truth about what the deploy would do.
+ */
+import type { ClusterNotificationsMatchersNamePutParams, ClusterNotificationsMatchersPostParams } from './generated/pve.ts';
+import type { ConfigNotificationsMatchersNamePutParams, ConfigNotificationsMatchersPostParams } from './generated/pbs.ts';
+/** Everything a matcher declares except where it lives — the resource files add `target`. */
+export interface NotificationMatcherFields {
+    /** The primary key, a safe id (2–32 chars on PBS). Changing it is a replace. */
+    name: string;
+    /**
+     * ⛔ THE TARGETS, BY NAME, AND REQUIRED: a matcher that notifies nobody is a routing rule for
+     *   silence. `[]` is still declarable, and clears the list.
+     * ⚠️ `targets`, NOT THE SERVER'S `target`: every resource here already spends `target` on the
+     *   HOST (resource.ts `WithTarget`), and one key cannot mean both. The wire still says `target`.
+     */
+    targets: readonly string[];
+    /**
+     * Severity rules. EACH ITEM IS ITSELF A COMMA LIST: `'warning,error'` matches either.
+     * ⛔ `['warning', 'error']` IS NOT THE SAME RULE AND UNDER `mode: 'all'` NEVER MATCHES. Items are
+     *   combined with `mode`; the severities inside one item are always OR-ed (matcher.rs
+     *   `SeverityMatcher`). A notification has one severity, so two items under AND ask for a
+     *   notification that is both — and routing nothing is the quietest failure a matcher has.
+     * Severities: `info`, `notice`, `warning`, `error`, `unknown`.
+     */
+    'match-severity'?: readonly string[];
+    /**
+     * Metadata rules, `exact:<field>=<v1>,<v2>` or `regex:<field>=<re>`. ⚠️ THE PREFIX IS REQUIRED:
+     * the schema's pattern makes it optional and the parser then refuses it. A notification WITHOUT
+     * the field never matches its rule — so `exact:job-id=…` excludes every garbage collection.
+     */
+    'match-field'?: readonly string[];
+    /** Time windows, e.g. `mon-fri 9:00-17:00`. Compared as written; the server keeps the text. */
+    'match-calendar'?: readonly string[];
+    /** How the rule items combine. The server's default, and this package's, is `all`. */
+    mode?: 'all' | 'any';
+    /** Invert the whole rule. ⚠️ IGNORED WHEN THERE ARE NO RULES — an empty matcher always matches. */
+    'invert-match'?: boolean;
+    /** A disabled matcher routes nothing. */
+    disable?: boolean;
+    /** Free text. The one field left alone when undeclared; `''` clears it. */
+    comment?: string;
+}
+/** ⚠️ Lists are CANONICAL and SORTED, so a re-ordered declaration is not a diff. */
+export interface NotificationMatcherAttributes {
+    name: string;
+    /**
+     * `builtin`, `modified-builtin` or `user-created`. REPORTED, NEVER COMPARED.
+     * ⛔ ON A BUILT-IN A DELETE REVERTS RATHER THAN REMOVES, and reports success either way — Alchemy
+     *   drops the row while `default-matcher` goes on routing. Read this before destroying one.
+     * ★ MEASURED ON THE PER-OBJECT READ, which the published schema does not list: PVE 9.2.11 and
+     *   PBS 4.2 both return it from `…/matchers/default-matcher` (2026-09-22).
+     */
+    origin: string;
+    comment: string;
+    disable: boolean;
+    'invert-match': boolean;
+    mode: string;
+    targets: readonly string[];
+    'match-severity': readonly string[];
+    'match-field': readonly string[];
+    'match-calendar': readonly string[];
+}
+/** A declaration's lists, canonical and sorted — the form `matches` compares. */
+export declare const canonicalRules: (fields: NotificationMatcherFields) => {
+    'match-calendar': string[];
+    'match-field': string[];
+    'match-severity': string[];
+    targets: string[];
+};
+export declare const matcherAttributes: (live: Record<string, unknown>, name: string) => NotificationMatcherAttributes;
+export declare const matcherMatches: (attributes: NotificationMatcherAttributes, fields: NotificationMatcherFields) => boolean;
+export type MatcherCreateForm = ConfigNotificationsMatchersPostParams & ClusterNotificationsMatchersPostParams;
+export type MatcherUpdateForm = ConfigNotificationsMatchersNamePutParams & ClusterNotificationsMatchersNamePutParams;
+/** ⛔ `name` is create-only: the body carries it once and the path forever after. */
+export declare const matcherCreateForm: (fields: NotificationMatcherFields) => MatcherCreateForm;
+/**
+ * ⛔ AN EMPTIED LIST IS A `delete`, NOT AN EMPTY VALUE. A form cannot carry an empty array — no
+ *   key is sent at all — so without the `delete` entry a declaration of `'match-field': []`
+ *   would plan an update, PUT nothing for that field, and plan the same update forever.
+ */
+export declare const matcherUpdateForm: (fields: NotificationMatcherFields) => MatcherUpdateForm;
+//# sourceMappingURL=notification-matcher-form.d.ts.map

package/dist/proxmox/notification-matcher-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-matcher-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-matcher-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EACV,yCAAyC,EACzC,sCAAsC,EACvC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACV,wCAAwC,EACxC,qCAAqC,EACtC,MAAM,oBAAoB,CAAC;AAG5B,6FAA6F;AAC7F,MAAM,WAAW,yBAAyB;IACxC,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,sFAAsF;IACtF,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACrB,mGAAmG;IACnG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,oFAAoF;AACpF,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAiCD,iFAAiF;AACjF,eAAO,MAAM,cAAc,WAAY,yBAAyB;IAC9D,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,OAAO;CACP,CAAC;AAEH,eAAO,MAAM,iBAAiB,SACtB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QACvB,MAAM,KACX,6BAYD,CAAC;AAKH,eAAO,MAAM,cAAc,eACb,6BAA6B,UACjC,yBAAyB,KAChC,OAYF,CAAC;AA0BF,MAAM,MAAM,iBAAiB,GAAG,qCAAqC,GACnE,sCAAsC,CAAC;AACzC,MAAM,MAAM,iBAAiB,GAAG,wCAAwC,GACtE,yCAAyC,CAAC;AAE5C,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,WAAY,yBAAyB,KAAG,iBAKpE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,WAAY,yBAAyB,KAAG,iBAYrE,CAAC"}

package/dist/proxmox/notification-matcher.d.ts

@@ -0,0 +1,46 @@
+/**
+ * `Proxmox.NotificationMatcher` — which notifications a PVE cluster sends to which targets.
+ *
+ * ★ THE HALF OF THE NOTIFICATION SYSTEM notification-target.ts LEAVES OPEN. A target is where a
+ *   message CAN go; a matcher decides whether it DOES. A cluster ships one, `default-matcher`,
+ *   routing everything to `mail-to-root`, and a target no matcher names receives nothing — so a
+ *   declared webhook with no matcher is a delivery path that is never used, and looks finished.
+ *
+ * ★ ADOPTING THE BUILT-IN AS IT IS: declare what it holds and nothing more. MEASURED on PVE
+ *   9.2.11 (2026-09-22, `pvesh get /cluster/notifications/matchers/default-matcher`): mode `all`,
+ *   one target `mail-to-root`, no rules, the comment "Route all notifications to mail-to-root".
+ *   ```ts
+ *   ProxmoxNotificationMatcher('default-matcher', {
+ *     target: cluster, name: 'default-matcher', targets: ['mail-to-root'],
+ *   });
+ *   ```
+ *   That plans `noop` and deploys with no write (notification-matcher.test.ts). Leaving `comment`
+ *   out leaves it alone; every rule field is compared — notification-matcher-form.ts says why.
+ *
+ * ★ WHAT THIS NEEDS, READ OFF THE CLUSTER'S OWN SCHEMA (generated/pve.ts source, 9.2.11):
+ *     read      GET matchers/{name}   Mapping.Audit or Mapping.Modify on /mapping/notifications
+ *     write     POST, PUT, DELETE     Mapping.Modify on /mapping/notifications
+ *   The same pair as `Proxmox.NotificationTarget`, with that file's ⚠️ about granting it on `/`.
+ *   ⛔ `Mapping.Use` IS NOT ENOUGH, though the COLLECTION GET accepts it: the per-object read this
+ *     family makes lists only Audit and Modify (pve-manager API2/Cluster/Notifications.pm
+ *     `get_matcher`, read at HEAD 2026-09-22 — corrected here; PR 95 said Use sufficed).
+ *   ⛔ A MISSING READ PRIVILEGE LOOKS LIKE "ABSENT", not like a 403 — see the same file. For
+ *     `default-matcher` that turns an adoption into a planned CREATE that PVE refuses as a
+ *     duplicate: the noop below needs a read lease holding Mapping.Audit.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import { type NotificationMatcherAttributes, type NotificationMatcherFields } from './notification-matcher-form.ts';
+import { type PveRequirements, type WithTarget } from './resource.ts';
+export interface NotificationMatcherProps extends NotificationMatcherFields, WithTarget {
+}
+export interface ProxmoxNotificationMatcher extends Resource<'Proxmox.NotificationMatcher', NotificationMatcherProps, NotificationMatcherAttributes, never, PveRequirements> {
+}
+/**
+ * ⚠️ NO `defaultRemovalPolicy: 'retain'`, for notification-target.ts's reason: a matcher holds no
+ *   data, and a plan line is the only warning a delete gets. On `default-matcher` the delete
+ *   REVERTS it to the shipped rule instead — see `origin` on the attributes.
+ */
+export declare const ProxmoxNotificationMatcher: import("alchemy").ResourceClass<ProxmoxNotificationMatcher>;
+export declare const ProxmoxNotificationMatcherProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxNotificationMatcher>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=notification-matcher.d.ts.map

package/dist/proxmox/notification-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-matcher.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,yBAAyB,EAK/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB,EAAE,UAAU;CAAG;AAE1F,MAAM,WAAW,0BAA2B,SAAQ,QAAQ,CAC1D,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,6DAEtC,CAAC;AAWF,eAAO,MAAM,kCAAkC,gJAI5C,CAAC"}

package/dist/proxmox/pbs-notification-matcher.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `Pbs.NotificationMatcher` — which Proxmox Backup Server notifications reach which targets.
+ *
+ * ★ THIS IS WHERE A FAILED VERIFY, SYNC OR GARBAGE COLLECTION BECOMES A PAGE. pbs-verify-job.ts
+ *   explains why verification is the only thing that notices rotten chunks; a matcher is what
+ *   turns what it notices into a message. Route `match-severity: ['error']` to a webhook target
+ *   (pbs-notification-target.ts, docs/pbs-notifications.md) and a failure pages someone.
+ *
+ * ⛔ A DATASTORE IN `legacy-sendmail` MODE BYPASSES EVERY MATCHER. PBS reads the datastore's
+ *   `notification-mode` before it builds anything (src/server/notifications/mod.rs
+ *   `lookup_datastore_notify_settings`, read at HEAD 2026-09-22): `legacy-sendmail` mails the
+ *   `notify-user` directly and never consults a matcher. The default is `notification-system`
+ *   today (pbs-api-types `NotificationMode`), but a datastore created before PBS 3.2 may say
+ *   `legacy-sendmail` explicitly. `Pbs.Datastore` deliberately does not declare the mode (see
+ *   `notify` in pbs-datastore.ts), so check it by hand before trusting a matcher with a datastore:
+ *   `proxmox-backup-manager datastore show <name>`.
+ *
+ * ⚠️ THE EVENT `type` FOR A VERIFICATION JOB IS `verify`, NOT `verification`. PBS's own
+ *   notifications chapter lists `verification` in its event table and `verify` in its example,
+ *   and the source settles it: `send_verify_status` sets `("type", "verify")` (same file). A
+ *   `match-field: ['exact:type=verification']` rule matches nothing, silently.
+ *   Types at HEAD: `gc`, `prune`, `sync`, `verify`, `tape-backup`, `tape-load`,
+ *   `package-updates`, `acme`, `thresholds`, `system-mail`. GC carries `datastore` and `hostname`
+ *   but NO `job-id`; prune, sync and verify carry all three; the UI's "Test" carries no fields.
+ *
+ * ★ ADOPTING THE BUILT-IN AS IT IS. MEASURED on PBS 4.2 (2026-09-22, `proxmox-backup-manager
+ *   notification matcher show default-matcher`): it routes everything EXCEPT successful prune
+ *   jobs to `mail-to-root` — `invert-match` over `exact:type=prune` AND severity `info`:
+ *   ```ts
+ *   PbsNotificationMatcher('default-matcher', {
+ *     target: pbs, name: 'default-matcher', targets: ['mail-to-root'],
+ *     'invert-match': true, 'match-field': ['exact:type=prune'], 'match-severity': ['info'],
+ *   });
+ *   ```
+ *
+ * ★ WHAT THIS NEEDS, READ OFF THE SERVER'S SCHEMA (generated/pbs.ts source):
+ *     read      GET                 Sys.Audit  on /system/notifications
+ *     write     POST, PUT, DELETE   Sys.Modify on /system/notifications
+ *   ⚠️ NOT A DATASTORE PRIVILEGE. A PBS credential scoped to `/datastore/...` reads every matcher
+ *     as absent — the "absent, then already exists" signature notification-target.ts describes.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import { type NotificationMatcherAttributes, type NotificationMatcherFields } from './notification-matcher-form.ts';
+import { type PveRequirements, type WithPbsTarget } from './resource.ts';
+export interface PbsNotificationMatcherProps extends NotificationMatcherFields, WithPbsTarget {
+}
+export interface PbsNotificationMatcher extends Resource<'Pbs.NotificationMatcher', PbsNotificationMatcherProps, NotificationMatcherAttributes, never, PveRequirements> {
+}
+/** ⚠️ No `retain`, for notification-matcher.ts's reason; a built-in REVERTS on delete. */
+export declare const PbsNotificationMatcher: import("alchemy").ResourceClass<PbsNotificationMatcher>;
+export declare const PbsNotificationMatcherProvider: () => import("effect/Layer").Layer<Provider.Provider<PbsNotificationMatcher>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=pbs-notification-matcher.d.ts.map

package/dist/proxmox/pbs-notification-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-notification-matcher.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-notification-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,yBAAyB,EAK/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAe,MAAM,eAAe,CAAC;AAEtF,MAAM,WAAW,2BAA4B,SAAQ,yBAAyB,EAAE,aAAa;CAAG;AAEhG,MAAM,WAAW,sBAAuB,SAAQ,QAAQ,CACtD,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,yDAA8D,CAAC;AAWlG,eAAO,MAAM,8BAA8B,4IAIxC,CAAC"}

package/dist/proxmox/pbs-notification-target-form.d.ts

@@ -0,0 +1,63 @@
+/**
+ * When a PBS notification target has changed, and the forms that change it.
+ *
+ * ★ THREE QUESTIONS, NOT ONE, because the three kinds of field can be checked three ways:
+ *     plain   every field the server returns in full — compared by value, like any family here
+ *     header  names from the read, values by digest (pbs-notification-target-wire.ts)
+ *     sealed  secret values and the smtp password: the server returns names at best, so values
+ *             are checked against the seal of what this provider last wrote (write-only.ts)
+ *   Each answers `match`, `stale` or `unknown`; only `stale` writes. `unknown` is "the plan cannot
+ *   see it" — a variable missing from the plan's environment, or a secret this provider never
+ *   wrote (an adoption) — and it is PRESENCE-ONLY by design: a plan never invents drift it
+ *   cannot see, and adoption stays free.
+ *
+ * ⛔ A WRITE SENDS ONLY THE GROUPS THAT ARE STALE. Omitting `header` or `secret` from a PUT keeps
+ *   what the server holds (api/webhook.rs `update_endpoint`), so a changed comment is written
+ *   without reading a single secret — and a deploy environment without the secrets can still
+ *   repair the rest. A group that IS stale needs every value it holds; a missing one fails the
+ *   deploy by variable name before anything is sent.
+ */
+import type { PveForm } from './client.ts';
+import type { PbsNotificationTargetAttributes, PbsNotificationTargetProps } from './pbs-notification-target.ts';
+import { type Environment } from './write-only.ts';
+type Props = PbsNotificationTargetProps;
+/**
+ * Why this declaration cannot be written, or nothing. Checked at PLAN, so a webhook without a
+ * URL fails `alchemy plan` naming the field rather than a deploy failing on a 400.
+ * ⚠️ "AT PLAN" MEANS `diff` FOR A TARGET WITH STATE AND THE ADOPTION PROBE (`read`) FOR ONE
+ *   WITHOUT — pbs-notification-target-lifecycle.ts has why both are needed.
+ */
+export declare const refusals: (props: Props) => string[];
+/** Each group's values, resolved from `env`, plus the variables that were missing. */
+export declare const resolveGroups: (props: Props, env?: Environment) => {
+    header: {
+        missing: readonly string[];
+        values: {
+            [x: string]: string;
+        };
+    };
+    sealed: {
+        readonly values: Readonly<Record<string, string>>;
+        readonly missing: readonly string[];
+    };
+};
+export type Groups = ReturnType<typeof resolveGroups>;
+export type GroupState = 'match' | 'stale' | 'unknown';
+/** Every field the server returns in full. `disable` is the one with no undeclared case. */
+export declare const plainMatches: (live: PbsNotificationTargetAttributes, props: Props) => boolean;
+export declare const headerState: (live: PbsNotificationTargetAttributes, props: Props, groups: Groups) => GroupState;
+export declare const sealedState: (live: PbsNotificationTargetAttributes, props: Props, groups: Groups, sealed: string) => GroupState;
+/** Which write-only groups a write carries. A create carries every declared one. */
+export interface Carry {
+    readonly header: boolean;
+    readonly sealed: boolean;
+}
+/**
+ * The body of a create or an update — keys are the server's own, checked against generated/pbs.ts
+ * by pbs-notification-target.test.ts. ⛔ `disable` IS ALWAYS SENT, `0` included — the PVE family's
+ * reason: it is always compared, and "undeclared" and "false" must be one state, not a plan that
+ * asks for an update the PUT never performs.
+ */
+export declare const targetForm: (props: Props, groups: Groups, carry: Carry, mode: 'create' | 'update') => PveForm;
+export {};
+//# sourceMappingURL=pbs-notification-target-form.d.ts.map

package/dist/proxmox/pbs-notification-target-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-notification-target-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-notification-target-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC3B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,KAAK,WAAW,EAAyC,MAAM,iBAAiB,CAAC;AAE1F,KAAK,KAAK,GAAG,0BAA0B,CAAC;AAkCxC;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,UAAW,KAAK,KAAG,MAAM,EAsB7C,CAAC;AAIF,sFAAsF;AACtF,eAAO,MAAM,aAAa,UAAW,KAAK,QAAO,WAAW;;;;;;;;;;;CAgB3D,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AAKvD,4FAA4F;AAC5F,eAAO,MAAM,YAAY,SAAU,+BAA+B,SAAS,KAAK,KAAG,OAagB,CAAC;AAEpG,eAAO,MAAM,WAAW,SAChB,+BAA+B,SAC9B,KAAK,UACJ,MAAM,KACb,UAKF,CAAC;AAEF,eAAO,MAAM,WAAW,SAChB,+BAA+B,SAC9B,KAAK,UACJ,MAAM,UACN,MAAM,KACb,UAMF,CAAC;AAEF,oFAAoF;AACpF,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAmCD;;;;;GAKG;AACH,eAAO,MAAM,UAAU,UACd,KAAK,UACJ,MAAM,SACP,KAAK,QACN,QAAQ,GAAG,QAAQ,KACxB,OAkBF,CAAC"}

package/dist/proxmox/pbs-notification-target-lifecycle.d.ts

@@ -0,0 +1,100 @@
+import type { Input } from 'alchemy/Input';
+import * as Effect from 'effect/Effect';
+import type { PbsNotificationTargetAttributes, PbsNotificationTargetProps } from './pbs-notification-target.ts';
+type Props = PbsNotificationTargetProps;
+type Attributes = PbsNotificationTargetAttributes;
+export declare const handlers: {
+    /** ⛔ EMPTY: `mail-to-root` is on every host, and adoption stays an explicit act (resource.ts). */
+    list: () => Effect.Effect<never[], never, never>;
+    /**
+     * ⛔ WITH NO `output` THIS IS ALCHEMY'S ADOPTION PROBE, AND THE ONLY PLAN-TIME HOOK A NEW TARGET
+     *   GETS — so the refusals run here too. Measured on beta.79 (Plan.ts, the `oldState ===
+     *   undefined` branch): a declaration with no state row is `read` with `olds: news` and never
+     *   `diff`ed, and Apply then commits its props as `creating` BEFORE `reconcile` runs. A refusal
+     *   left to `reconcile` fired after the props — a literal token included — were in the store.
+     * ⚠️ ONLY WHEN THE PROPS ARE RESOLVED: Plan skips the probe while any prop is an unresolved
+     *   Output, and then `reconcile` is the first check. docs/pbs-notifications.md says so.
+     * ★ A DEFECT (`Effect.die`), NOT A FAILURE, AND THAT IS WHAT KEEPS IT FROM WEDGING A STAGE. The
+     *   same `read`-with-no-output shape is Alchemy's RECOVERY read of an interrupted create, at plan
+     *   and before a delete (Plan.ts, Apply.ts), with the STORED props — and both wrap it in
+     *   `catchDefect`, degrading to "nothing recovered". A typed failure would pass that catch and
+     *   block the plan or the delete on props the user already fixed. The cold-start probe has no
+     *   catch, so there the defect fails the plan, as intended. A refused create sent no request,
+     *   so "nothing recovered" is also the truth.
+     */
+    read: ({ olds, output }: {
+        olds: Props;
+        output: Attributes | undefined;
+    }) => Effect.Effect<{
+        sealed: string;
+        name: string;
+        type: import("./pbs-notification-target.ts").PbsNotificationTargetType;
+        origin: string;
+        comment: string;
+        disable: boolean;
+        mailto: string;
+        'mailto-user': string;
+        'from-address': string;
+        author: string;
+        server: string;
+        port: number;
+        mode: string;
+        username: string;
+        url: string;
+        method: string;
+        body: string;
+        header: string;
+        headerDigest: string;
+        secret: string;
+    } | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+    /**
+     * ⚠️ `Input<Props>` and `isResolved`, resource.ts's reason: at plan time a prop can still be an
+     *   unresolved Output, and comparing a placeholder to a live value reports a phantom update.
+     * ⛔ A NEW `type` UNDER THE SAME `name` REPLACES DELETE-FIRST: names are unique across every
+     *   family on the host (api `ensure_unique`), so creating the new one first would be refused.
+     */
+    diff: ({ news, olds, output, }: {
+        news: Input<Props>;
+        olds: Props;
+        output: Attributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'replace';
+        readonly deleteFirst: boolean;
+    } | {
+        readonly deleteFirst?: never;
+        readonly action: 'update';
+    } | {
+        readonly deleteFirst?: never;
+        readonly action: 'noop';
+    } | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: ({ news, output }: {
+        news: Props;
+        output: Attributes | undefined;
+    }) => Effect.Effect<{
+        sealed: string;
+        name: string;
+        type: import("./pbs-notification-target.ts").PbsNotificationTargetType;
+        origin: string;
+        comment: string;
+        disable: boolean;
+        mailto: string;
+        'mailto-user': string;
+        'from-address': string;
+        author: string;
+        server: string;
+        port: number;
+        mode: string;
+        username: string;
+        url: string;
+        method: string;
+        body: string;
+        header: string;
+        headerDigest: string;
+        secret: string;
+    }, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds }: {
+        olds: Props;
+    }) => Effect.Effect<unknown, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export {};
+//# sourceMappingURL=pbs-notification-target-lifecycle.d.ts.map

package/dist/proxmox/pbs-notification-target-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-notification-target-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-notification-target-lifecycle.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC3B,MAAM,8BAA8B,CAAC;AActC,KAAK,KAAK,GAAG,0BAA0B,CAAC;AACxC,KAAK,UAAU,GAAG,+BAA+B,CAAC;AA8ClD,eAAO,MAAM,QAAQ;IACnB,kGAAkG;IAClG,IAAI;IACJ;;;;;;;;;;;;;;;OAeG;IACH,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;IAOxE;;;;;OAKG;IACH,IAAI,4BAID;QACD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,CAAC;QACZ,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;KAChC;yBAIsB,SAAS;;;;yBAIa,QAAQ;;;yBAElC,MAAM;;IAGzB,SAAS,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;IAyC7E,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CACnC,CAAC"}

package/dist/proxmox/pbs-notification-target-wire.d.ts

@@ -0,0 +1,30 @@
+import type { PbsNotificationTargetAttributes, PbsNotificationTargetProps } from './pbs-notification-target.ts';
+export declare const base64: (value: string) => string;
+/** ⚠️ Node's decoder skips characters it does not know rather than throwing, so this never throws. */
+export declare const unbase64: (value: string) => string;
+/**
+ * One `KeyAndBase64Val` property string — `name=<name>,value=<base64>` — split into its halves.
+ * ⚠️ KEYED BY NAME, NOT BY POSITION: the server serialises `name` first today, and a parser that
+ *   relied on that would read a reordered item as a header called `value=…`.
+ * ★ A comma cannot occur inside either half: base64 has none, and `refusals` keeps names clean.
+ */
+export declare const keyAndValue: (item: string) => {
+    name: string;
+    value?: string;
+};
+/** The wire item for one header or secret. The value is base64 — the server decodes it to use it. */
+export declare const wireItem: (name: string, value: string) => string;
+/** Sorted, comma-joined names — presence, the only thing the store may know about the values. */
+export declare const names: (keys: readonly string[]) => string;
+/**
+ * ★ A FIXED SALT PER TARGET, SO AN UNCHANGED HEADER SET DIGESTS THE SAME ON EVERY READ. A random
+ *   one would rewrite the state row on every plan. The server shows these values to its auditors
+ *   anyway; what the salt and scrypt buy is that the STORE does not become a second, weaker copy.
+ */
+export declare const headerDigest: (target: string, pairs: Readonly<Record<string, string>>) => string;
+/**
+ * Live JSON to attributes. `sealed` is left empty here: it is not the server's to report, and the
+ * handlers in pbs-notification-target.ts carry it forward from the previous state.
+ */
+export declare const targetAttributes: (live: Record<string, unknown>, props: PbsNotificationTargetProps) => PbsNotificationTargetAttributes;
+//# sourceMappingURL=pbs-notification-target-wire.d.ts.map

package/dist/proxmox/pbs-notification-target-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-notification-target-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-notification-target-wire.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC3B,MAAM,8BAA8B,CAAC;AAItC,eAAO,MAAM,MAAM,UAAW,MAAM,KAAG,MAAuD,CAAC;AAE/F,sGAAsG;AACtG,eAAO,MAAM,QAAQ,UAAW,MAAM,KAAG,MAAuD,CAAC;AAEjG;;;;;GAKG;AACH,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAQxE,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,QAAQ,SAAU,MAAM,SAAS,MAAM,KAAG,MAChB,CAAC;AAKxC,iGAAiG;AACjG,eAAO,MAAM,KAAK,SAAU,SAAS,MAAM,EAAE,KAAG,MAIlC,CAAC;AAEf;;;;GAIG;AACH,eAAO,MAAM,YAAY,WAAY,MAAM,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAG,MAC3B,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,0BAA0B,KAChC,+BAkCF,CAAC"}

package/dist/proxmox/pbs-notification-target.d.ts

@@ -0,0 +1,123 @@
+/**
+ * `Pbs.NotificationTarget` — where a Proxmox Backup Server sends a notification: a `webhook`, or
+ * mail through `sendmail` or `smtp`.
+ *
+ * ★ THE WEBHOOK IS THE POINT. A failed verify, sync or garbage collection reaches a human through a
+ *   target a matcher names (pbs-notification-matcher.ts). Out of the box that is `mail-to-root`,
+ *   one mailbox on one host; a webhook can post an Alertmanager alert instead, and then the failure
+ *   pages like everything else. docs/pbs-alertmanager-body.md has the body template.
+ *
+ * ⛔ SECRETS ARE DECLARED BY THE NAME OF AN ENVIRONMENT VARIABLE, NEVER BY VALUE, and NO VALUE EVER
+ *   REACHES STATE — not as a prop, not as an attribute. write-only.ts has the whole argument; the
+ *   short form: Alchemy stores props and attributes unencrypted, so `secret`, `password` and any
+ *   header holding a credential take `{ fromEnv: 'NAME' }`, read by the deploying process at call
+ *   time. What the store keeps is presence (names) and digests, and the plan diffs on those.
+ *   ★ THIS IS WHERE THE PBS FAMILY PARTS FROM notification-target.ts (PVE), which refuses every
+ *     secret and so cannot create a signed webhook at all.
+ *
+ * ⛔ THE PER-OBJECT PATH CARRIES THE FAMILY: `config/notifications/endpoints/{type}/{name}`. `type`
+ *   is identity, and changing it or `name` plans a REPLACE here — `diff` compares them with the
+ *   recorded props. `/config/notifications/targets` is a read-only union view, as on PVE.
+ *
+ * ⚠️ A BUILT-IN TARGET REVERTS ON DELETE instead of disappearing (`origin: builtin`, measured on
+ *   PBS 4.2 for `mail-to-root`), and PBS reports success either way — notification-target.ts has
+ *   the consequence. Read `origin` before declaring a name you did not create.
+ *
+ * ★ WHAT THIS NEEDS (generated/pbs.ts source): Sys.Audit on /system/notifications to read,
+ *   Sys.Modify there to write. A datastore-scoped credential reads every target as absent.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type { PveRequirements, WithPbsTarget } from './resource.ts';
+import type { FromEnv } from './write-only.ts';
+export type PbsNotificationTargetType = 'sendmail' | 'smtp' | 'webhook';
+/**
+ * ⚠️ PBS'S OWN KEY NAMES, DASHES INCLUDED, for the reason backup-job.ts gives. A field outside its
+ *   family (a `url` on a sendmail target) is refused at plan by name, not sent for a 400.
+ * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED; `''` or `[]` (or `{}`) CLEARS ONE.
+ */
+export interface PbsNotificationTargetProps extends WithPbsTarget {
+    /** ⛔ IDENTITY: it picks the family and the URL. Changing it is a replace. */
+    type: PbsNotificationTargetType;
+    /** Unique across ALL families on the host: a webhook cannot be called `mail-to-root`. */
+    name: string;
+    comment?: string;
+    /** Configured but not delivering. Always sent and always compared. */
+    disable?: boolean;
+    /** sendmail, smtp: recipient addresses. Order is not meaning. */
+    mailto?: readonly string[];
+    /** sendmail, smtp: PBS users whose configured address receives the mail. */
+    'mailto-user'?: readonly string[];
+    /** smtp: required. sendmail: optional. */
+    'from-address'?: string;
+    author?: string;
+    /** smtp: the relay host. Required. */
+    server?: string;
+    /** smtp. Unset lets PBS pick from `mode`. */
+    port?: number;
+    /** smtp. PBS's default is `tls`. */
+    mode?: 'insecure' | 'starttls' | 'tls';
+    /** smtp. */
+    username?: string;
+    /** smtp: ⛔ WRITE-ONLY. The server never returns it; the plan compares its seal. */
+    password?: FromEnv;
+    /** webhook: required. Supports templating: `{{ secrets.<name> }}` keeps a token out of it. */
+    url?: string;
+    /** webhook: required. */
+    method?: 'get' | 'post' | 'put';
+    /**
+     * webhook: header name → template text, or `{ fromEnv }` for a value that is itself a secret.
+     * ⚠️ PLAIN VALUES ARE PROPS, AND PROPS ARE STORED: `Content-Type` is fine, a token is not. Put a
+     *   credential in `secret` and write `'Bearer {{ secrets.token }}'` here instead.
+     */
+    header?: Readonly<Record<string, FromEnv | string>>;
+    /**
+     * webhook: the body TEMPLATE, as text. ★ Declared DECODED — the wire is base64, and this family
+     *   encodes on write and decodes on read, so a plan shows a readable diff.
+     */
+    body?: string;
+    /** webhook: ⛔ WRITE-ONLY. Name → variable. Referenced as `{{ secrets.<name> }}`. */
+    secret?: Readonly<Record<string, FromEnv>>;
+}
+/** ⛔ NO VALUE OF A SECRET, PASSWORD OR HEADER — names and digests only. */
+export interface PbsNotificationTargetAttributes {
+    name: string;
+    type: PbsNotificationTargetType;
+    /** `builtin`, `modified-builtin`, `user-created` — reported, never compared. */
+    origin: string;
+    comment: string;
+    disable: boolean;
+    mailto: string;
+    'mailto-user': string;
+    'from-address': string;
+    author: string;
+    server: string;
+    /** 0 means PBS holds no port. */
+    port: number;
+    mode: string;
+    username: string;
+    url: string;
+    method: string;
+    /** The decoded body template. */
+    body: string;
+    /** Header NAMES, sorted — presence. */
+    header: string;
+    /** scrypt digest of the live header pairs, fixed salt per target. */
+    headerDigest: string;
+    /** Secret NAMES, sorted — all PBS will say. */
+    secret: string;
+    /**
+     * Seal of the secret values and password THIS PROVIDER LAST WROTE; `''` if it never wrote them
+     * (an adoption). ⚠️ `''` makes those values presence-only until the first write that carries them.
+     */
+    sealed: string;
+}
+export interface PbsNotificationTarget extends Resource<'Pbs.NotificationTarget', PbsNotificationTargetProps, PbsNotificationTargetAttributes, never, PveRequirements> {
+}
+export declare const PbsNotificationTarget: import("alchemy").ResourceClass<PbsNotificationTarget>;
+/**
+ * ⛔ `Provider.of` STAYS HERE, for resource.ts's reason: it is the one place the handlers are
+ *   checked against the concrete resource types, so the lifecycle file cannot drift from them.
+ */
+export declare const PbsNotificationTargetProvider: () => import("effect/Layer").Layer<Provider.Provider<PbsNotificationTarget>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=pbs-notification-target.d.ts.map

package/dist/proxmox/pbs-notification-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-notification-target.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-notification-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAExE;;;;GAIG;AACH,MAAM,WAAW,0BAA2B,SAAQ,aAAa;IAC/D,6EAA6E;IAC7E,IAAI,EAAE,yBAAyB,CAAC;IAChC,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iEAAiE;IACjE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;IACvC,YAAY;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC;IACpD;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC5C;AAED,2EAA2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,yBAAyB,CAAC;IAChC,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAsB,SAAQ,QAAQ,CACrD,wBAAwB,EACxB,0BAA0B,EAC1B,+BAA+B,EAC/B,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,qBAAqB,wDAA4D,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,6BAA6B,2IAIvC,CAAC"}

package/dist/proxmox/resource.d.ts

@@ -1,6 +1,7 @@
 import type { Input } from 'alchemy/Input';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type PveForm } from './client.ts';
 import type { ApiTarget, PbsTarget, PveRole, PveTarget } from './credentials.ts';
 /**
  * ★ WHY SEVERAL FAMILIES HERE DECLARE `defaultRemovalPolicy: 'retain'`, WRITTEN ONCE.
@@ -58,15 +59,15 @@ export type PveSpec<Props extends WithApiTarget, Attributes> = {
     readonly collection: (props: Props) => string;
     /** Live JSON to attributes. Returning undefined means "this is not really there". */
     readonly attributes: (live: Record<string, unknown>, props: Props) => Attributes | undefined;
-    /** The form PVE wants on create. ⚠️ PVE takes form encoding, not JSON. */
-    readonly createForm: (props: Props) => Record<string, string>;
+    /** The form PVE wants on create. ⚠️ PVE takes form encoding, not JSON. Arrays: client.ts. */
+    readonly createForm: (props: Props) => PveForm;
     /**
      * The form for an update, or undefined when the object has no mutable fields.
      *
      * ⚠️ SOME PVE OBJECTS CANNOT BE UPDATED AT ALL. Returning undefined makes a changed prop a
      *   REPLACE rather than a silent no-op, which is the honest answer for an immutable object.
      */
-    readonly updateForm?: (props: Props) => Record<string, string>;
+    readonly updateForm?: (props: Props) => PveForm;
     /** True when live already matches props. Decides noop vs update. */
     readonly matches: (attributes: Attributes, props: Props) => boolean;
     /**

package/dist/proxmox/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,UAAU,IAAI;IAC7D,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7F,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC7D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;kBAGX,KAAK;iBAiBX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBASZ,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;sBAIV,KAAK;IA4DvB;;;;OAIG;oBACa,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,SAAS,MAAM,QAC1E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAI9B,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAChC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBArHlC,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;IAmH5B,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,OAAO,EAAO,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,UAAU,IAAI;IAC7D,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7F,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IAChD,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC7D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;kBAGX,KAAK;iBAiBX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBASZ,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;sBAIV,KAAK;IA4DvB;;;;OAIG;oBACa,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,SAAS,MAAM,QAC1E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAI9B,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAChC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBArHlC,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;IAmH5B,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}

package/dist/proxmox/write-only.d.ts

@@ -0,0 +1,35 @@
+/** A write-only value, by the NAME of the environment variable holding it. Never the value. */
+export interface FromEnv {
+    readonly fromEnv: string;
+}
+/** Where a value is looked up. Defaults to `process.env`, read at call time, never at load. */
+export type Environment = Readonly<Record<string, string | undefined>>;
+/**
+ * Each `name → FromEnv` resolved, or the variable names that could not be.
+ *
+ * ⚠️ AN EMPTY VARIABLE IS A MISSING ONE. A secret renderer that failed writes `NAME=` rather than
+ *   omitting the line, and sending `''` would store an empty secret on the server — a webhook that
+ *   authenticates with nothing, reported as a successful deploy.
+ * ⚠️ THE VALUE IS NOT TRIMMED. A token with a trailing newline is a broken header either way, and
+ *   trimming here would make the seal disagree with a value written by any other tool.
+ */
+export declare const resolveAll: (refs: Readonly<Record<string, FromEnv>>, env?: Environment) => {
+    readonly values: Readonly<Record<string, string>>;
+    readonly missing: readonly string[];
+};
+/**
+ * `scrypt:<salt>:<digest>`, or `''` when there is nothing to seal.
+ *
+ * ★ A RANDOM SALT BY DEFAULT, FOR WHAT THIS PROVIDER WROTE. Pass a fixed one only for a value the
+ *   server returns anyway (a header), where a fresh salt per read would churn the state row on
+ *   every plan without protecting anything the server does not already show its auditors.
+ */
+export declare const seal: (values: Readonly<Record<string, string>>, salt?: string) => string;
+/**
+ * Whether `values` are the ones `sealed` was made from.
+ *
+ * ⚠️ A MALFORMED OR EMPTY SEAL ANSWERS FALSE, never throws: callers decide what "no evidence"
+ *   means, and every caller here treats it as "cannot tell" rather than as drift.
+ */
+export declare const sealMatches: (sealed: string, values: Readonly<Record<string, string>>) => boolean;
+//# sourceMappingURL=write-only.d.ts.map