@homeflare/alchemy 0.14.0 → 0.19.0

package/dist/proxmox/resource.d.ts

@@ -1,104 +1,31 @@
 import type { Input } from 'alchemy/Input';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
-import { type PveForm } from './client.ts';
-import type { ApiTarget, PbsTarget, PveRole, PveTarget } from './credentials.ts';
-/**
- * ★ WHY SEVERAL FAMILIES HERE DECLARE `defaultRemovalPolicy: 'retain'`, WRITTEN ONCE.
- *
- *   Alchemy's own convention: a few resource types default to retain "because their contents are
- *   irreplaceable" — `GitHub.Repository` and `Cloudflare.Zone` do — and those opt into deletion
- *   with `destroy()`. `retain` means the engine SKIPS `provider.delete` entirely when a resource
- *   is orphaned or destroyed: the state row is dropped, the cluster object lives on.
- *
- *   So the PVE families whose contents cannot be rebuilt from a line of TypeScript — CephOsd,
- *   CephPool, CephFs, CephDaemon, ZfsPool, Storage, NodeNetwork — carry that default. Their
- *   `delete` is FULLY IMPLEMENTED and runs the moment a caller opts in with
- *   `.pipe(RemovalPolicy.destroy())`. This is deliberately the Terraform `prevent_destroy` shape
- *   rather than a stubbed-out operation: a `delete` that silently does nothing lies to whoever is
- *   reading the plan, and the lie is discovered at the worst possible time.
- *
- * ⚠️ THE POLICY IS A DECORATION, NOT A PROP, so changing it produces NO DIFF — the resource plans
- *   as a noop and the deploy re-commits the row's policy in place. A policy change therefore takes
- *   effect from the very next deploy even though the plan shows nothing.
- */
-/**
- * ⛔ A RESOURCE IS PINNED TO ITS PRODUCT; ONLY THE FACTORY TAKES EITHER. The two hosts are the same
- *   two strings, so without a required discriminant TypeScript would accept a PBS host wherever a
- *   PVE one belongs — silently, with every call 401ing and `read` folding that into "absent". The
- *   whole argument is on `scheme` in credentials.ts.
- */
-/**
- * ★ WHAT EVERY OPERATION IN THIS PACKAGE NEEDS FROM THE RUNTIME, NAMED ONCE.
- *
- *   `HttpClient`, for both halves of every call: the credential is minted from OpenBao's HTTP API
- *   and the PVE call goes through the same client. That is what Alchemy's own providers do
- *   (src/Hetzner/Providers.ts builds on `FetchHttpClient.layer`, and there is no bare `fetch` in
- *   its Docker, Kubernetes or GitHub providers).
- * ★ `ChildProcessSpawner` WAS HERE UNTIL 2026-09-14, while the mint shelled out to `bao`. The HTTP
- *   client replaced that (credentials.ts), so the requirement went with it.
- *
- * ⚠️ SPELLED OUT AT EACH OF THE FORTY-ODD RESOURCES this would be a union nobody keeps in step —
- *   one file left on the old shape is a type error at the stack, far from the cause. Named here,
- *   adding a third service later is one edit.
- */
-export type PveRequirements = HttpClient.HttpClient;
-export type WithTarget = {
-    target: PveTarget;
-};
-export type WithPbsTarget = {
-    target: PbsTarget;
-};
-export type WithApiTarget = {
-    target: ApiTarget;
-};
-export type PveSpec<Props extends WithApiTarget, Attributes> = {
-    /** `pools/lab`, `nodes/node-b/lxc/101` — where ONE object is read, updated and deleted. */
-    readonly path: (props: Props) => string;
-    /** `pools`, `nodes/node-b/lxc` — where a NEW one is POSTed. */
-    readonly collection: (props: Props) => string;
-    /** Live JSON to attributes. Returning undefined means "this is not really there". */
-    readonly attributes: (live: Record<string, unknown>, props: Props) => Attributes | undefined;
-    /** The form PVE wants on create. ⚠️ PVE takes form encoding, not JSON. Arrays: client.ts. */
-    readonly createForm: (props: Props) => PveForm;
-    /**
-     * The form for an update, or undefined when the object has no mutable fields.
-     *
-     * ⚠️ SOME PVE OBJECTS CANNOT BE UPDATED AT ALL. Returning undefined makes a changed prop a
-     *   REPLACE rather than a silent no-op, which is the honest answer for an immutable object.
-     */
-    readonly updateForm?: (props: Props) => PveForm;
-    /** True when live already matches props. Decides noop vs update. */
-    readonly matches: (attributes: Attributes, props: Props) => boolean;
+import type { PveSpec, WithApiTarget } from './resource-spec.ts';
+export type { PveRequirements, PveSpec, WithApiTarget, WithPbsTarget, WithTarget, } from './resource-spec.ts';
+export declare const pveOperations: <Props extends WithApiTarget, Attributes>(spec: PveSpec<Props, Attributes>) => {
     /**
-     * Which lease reads this family. Defaults to `read`, the 3600s auditor-shaped one.
-     *
-     * ⛔ THREE FAMILIES SET THIS TO `provision`, AND THE FAILURE IT AVOIDS IS SILENT. PVE gates some
-     *   SINGLE-OBJECT reads on the allocate privilege rather than the audit one — `/storage/{id}`,
-     *   `/cluster/sdn/zones/{zone}`, `/cluster/sdn/vnets/{vnet}` — while their COLLECTION reads
-     *   accept audit, so nothing looks wrong until a resource reads one object. `read` below folds
-     *   every failure into `undefined`, right for a 404 and wrong for a 403, so the plan says create
-     *   and PVE answers that the object already exists. Measured both ways on `local`, and written
-     *   up with the alternative that was rejected, in docs/privileges.md.
+     * ★ EXPORTED SO A FAMILY THAT WRITES ITS OWN `reconcile` REACHES THE SAME CHECK BY THE SAME
+     *   NAME. CephPool, CephFs and ZfsPool all bypass the reconcile below — forked workers, a
+     *   settle loop, a destructive create — and without these two they would be checked at plan
+     *   time and not at apply time, which is exactly the gap an ADOPTED row falls through.
      */
-    readonly readRole?: PveRole;
-};
-export declare const pveOperations: <Props extends WithApiTarget, Attributes>(spec: PveSpec<Props, Attributes>) => {
-    read: (props: Props) => Effect.Effect<Attributes | undefined, never, HttpClient.HttpClient>;
+    guardCreate: (props: Props, presence: boolean) => Effect.Effect<void>;
+    guardUpdate: (props: Props) => Effect.Effect<void>;
+    read: (props: Props) => Effect.Effect<Attributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
     diff: (news: Input<Props>, output: Attributes | undefined) => Effect.Effect<{
         readonly action: 'update';
     } | {
         readonly action: 'noop';
     } | {
         readonly action: 'replace';
-    } | undefined, never, HttpClient.HttpClient>;
-    reconcile: (news: Props) => Effect.Effect<Attributes & ({} | null), Error, HttpClient.HttpClient>;
+    } | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (news: Props) => Effect.Effect<Attributes & ({} | null), Error, import("effect/unstable/http/HttpClient").HttpClient>;
     /**
      * ⚠️ PVE REFUSES TO DELETE THINGS THAT ARE STILL IN USE — a pool holding guests, a storage with
      *   volumes. That refusal is the cluster declining to orphan something because a line left a
      *   file, so it is surfaced as-is rather than retried with a force flag.
      */
-    destroy: (olds: Props) => Effect.Effect<unknown, Error, HttpClient.HttpClient>;
+    destroy: (olds: Props) => Effect.Effect<unknown, Error, import("effect/unstable/http/HttpClient").HttpClient>;
 };
 /**
  * The five provider handlers for a spec'd PVE object, wired once.
@@ -137,7 +64,7 @@ export declare const pveHandlers: <Props extends WithApiTarget, Attributes exten
     list: () => Effect.Effect<never[], never, never>;
     read: ({ olds }: {
         olds: Props;
-    }) => Effect.Effect<Attributes | undefined, never, HttpClient.HttpClient>;
+    }) => Effect.Effect<Attributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
     diff: ({ news, output }: {
         news: Input<Props>;
         output: Attributes | undefined;
@@ -147,12 +74,12 @@ export declare const pveHandlers: <Props extends WithApiTarget, Attributes exten
         readonly action: 'noop';
     } | {
         readonly action: 'replace';
-    } | undefined, never, HttpClient.HttpClient>;
+    } | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
     reconcile: ({ news }: {
         news: Props;
-    }) => Effect.Effect<Attributes, Error, HttpClient.HttpClient>;
+    }) => Effect.Effect<Attributes, Error, import("effect/unstable/http/HttpClient").HttpClient>;
     delete: ({ olds }: {
         olds: Props;
-    }) => Effect.Effect<unknown, Error, HttpClient.HttpClient>;
+    }) => Effect.Effect<unknown, Error, import("effect/unstable/http/HttpClient").HttpClient>;
 };
 //# sourceMappingURL=resource.d.ts.map

package/dist/proxmox/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,KAAK,OAAO,EAAO,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,UAAU,IAAI;IAC7D,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7F,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IAChD,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC7D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;kBAGX,KAAK;iBAiBX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBASZ,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;sBAIV,KAAK;IA4DvB;;;;OAIG;oBACa,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,SAAS,MAAM,QAC1E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAI9B,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAChC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBArHlC,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;IAmH5B,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGjE,YAAY,EACV,eAAe,EACf,OAAO,EACP,aAAa,EACb,aAAa,EACb,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC7D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAiB9B;;;;;OAKG;;;kBAjBgB,KAAK;iBA0BX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAyBlC,QAAQ;;yBAEoB,MAAM;;yBAGtC,SAAS;;sBAIV,KAAK;IAmEvB;;;;OAIG;oBACa,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,SAAS,MAAM,QAC1E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAI9B,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAChC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBA7HxD,QAAQ;;yBAEoB,MAAM;;yBAGtC,SAAS;;IA0H5B,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}

package/dist/proxmox/role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/proxmox/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAuDjE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/proxmox/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAyDjE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}

package/dist/proxmox/sdn-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdn-apply.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,eAAe,kDAAgD,CAAC;AAK7E,eAAO,MAAM,uBAAuB,qIA0EjC,CAAC"}
+{"version":3,"file":"sdn-apply.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,eAAe,kDAAgD,CAAC;AAK7E,eAAO,MAAM,uBAAuB,qIA6EjC,CAAC"}

package/dist/proxmox/sdn-subnet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdn-subnet.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-subnet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AACnF,OAAO,EACL,KAAK,SAAS,EAMf,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD;;;;;;;;;;OAUG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,mDAAkD,CAAC;AA4DhF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,sIACsD,CAAC"}
+{"version":3,"file":"sdn-subnet.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-subnet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AACnF,OAAO,EACL,KAAK,SAAS,EAMf,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD;;;;;;;;;;OAUG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,mDAAkD,CAAC;AAiEhF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,sIACsD,CAAC"}

package/dist/proxmox/sdn-vnet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdn-vnet.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-vnet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAA8C,CAAC;AAyG1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}
+{"version":3,"file":"sdn-vnet.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-vnet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAA8C,CAAC;AA2G1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}

package/dist/proxmox/sdn-zone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdn-zone.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-zone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,8FAA8F;AAC9F,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAExE,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,WAAW,CAAC;IAClB,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,8FAA8F;IAC9F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ,6FAA6F;IAC7F,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,kGAAkG;IAClG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAA8C,CAAC;AA6G1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}
+{"version":3,"file":"sdn-zone.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-zone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,8FAA8F;AAC9F,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAExE,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,WAAW,CAAC;IAClB,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,8FAA8F;IAC9F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ,6FAA6F;IAC7F,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,kGAAkG;IAClG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAA8C,CAAC;AA+G1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}

package/dist/proxmox/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IACpD,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,qGAAqG;AACrG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAgHH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IACpD,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,qGAAqG;AACrG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAkHH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}

package/dist/proxmox/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAiGjE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAmGjE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}

package/dist/proxmox/zfs-pool-write.d.ts

@@ -18,6 +18,7 @@
  *   already built means this file cannot accidentally read the cluster differently from `diff`.
  */
 import * as Effect from 'effect/Effect';
+import type { EndpointPair } from './resource-spec.ts';
 import type { ZfsPoolAttributes, ZfsPoolProps } from './zfs-pool.ts';
 /**
  * The POST body. Every field in it is write-only — nothing here is ever read back.
@@ -33,6 +34,16 @@ import type { ZfsPoolAttributes, ZfsPoolProps } from './zfs-pool.ts';
  *   are unreadable afterwards either way — but it would put a number in the request that no
  *   declaration asked for, and this is the one call that writes to physical disks.
  */
+/**
+ * The vendor rules the create form is checked against at plan time.
+ *
+ * ⛔ HERE RATHER THAN INLINE IN zfs-pool.ts BECAUSE THAT FILE IS ALREADY OVER THE 250-LINE CAP,
+ *   and a `pve:POST …` literal has to live in a non-test source file for the generator to table
+ *   it at all. The spec imports it on the line it already imports `createForm` from.
+ * ⚠️ NO UPDATE KEY: PVE registers no PUT under `/nodes/{node}/disks/zfs`, which is exactly why
+ *   the spec declares no `updateForm` and a changed prop is a REPLACE.
+ */
+export declare const ZFS_POOL_ENDPOINT: EndpointPair;
 export declare const createForm: (props: ZfsPoolProps) => Record<string, string>;
 /**
  * Create the pool if it is absent, and otherwise leave it completely alone.

package/dist/proxmox/zfs-pool-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zfs-pool-write.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU,UAAW,YAAY,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAOpE,CAAC;AAKH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,SACtB,YAAY,cACP,MAAM,QACZ,MAAM,QACN,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,iBAAiB,GAAG,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,0GAmC/E,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,SAAU,YAAY,QAAQ,MAAM,wFACb,CAAC"}
+{"version":3,"file":"zfs-pool-write.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,EAAE,YAA6D,CAAC;AAE9F,eAAO,MAAM,UAAU,UAAW,YAAY,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAOpE,CAAC;AAKH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,SACtB,YAAY,cACP,MAAM,QACZ,MAAM,QACN,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,iBAAiB,GAAG,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,0GAmC/E,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,SAAU,YAAY,QAAQ,MAAM,wFACb,CAAC"}

package/dist/proxmox/zfs-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zfs-pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,UAAU,EAGhB,MAAM,eAAe,CAAC;AAIvB,oGAAoG;AACpG,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,QAAQ,CAAC;AAEb,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;AAErF;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,YAAY,CAAC;IACxB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,mGAAmG;AACnG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AA6EH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}
+{"version":3,"file":"zfs-pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,UAAU,EAGhB,MAAM,eAAe,CAAC;AAIvB,oGAAoG;AACpG,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,QAAQ,CAAC;AAEb,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;AAErF;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,YAAY,CAAC;IACxB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,mGAAmG;AACnG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AA8EH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}

package/docs/linux-host-measured.md

@@ -0,0 +1,56 @@
+# Linux host shapes — the measurements
+
+Status: active
+Verified: 2026-09-22
+
+The evidence behind [linux-host.md](./linux-host.md). Debian 13, systemd 257
+(257.13-1~deb13u1), kernel 7.0.14-pve, `LANG=C`, over ssh as an unprivileged
+user. ⛔ **Read-only: nothing was enabled, started, reloaded or written.**
+
+## systemd and coreutils, as observed
+
+- ⛔ `systemctl show -p … <unknown>` **exits 0** and answers
+  `LoadState=not-found`. The exit code is not the answer; `LoadState` is.
+- Properties come back in systemd's order, not the order asked for.
+- `is-enabled`/`is-active` of an unknown unit exit **4** with `not-found` /
+  `inactive` — answers, not errors.
+- `/etc/systemd/system` is `root:root 0755`.
+- `systemd-analyze unit-paths`, minus per-user and generator directories:
+  `/etc/systemd/system`, `/run/systemd/system`, `/usr/local/lib/systemd/system`,
+  `/usr/lib/systemd/system`. `/lib/systemd/system` is the same directory before
+  the /usr merge, which the measured host does not have separately.
+- `stat -c '%f %a %u %g %s' /etc/hostname` → `81a4 644 0 0 4`; a missing path
+  exits 1. GNU `stat` does not follow symlinks without `-L`, which is what makes
+  it the lstat the seam requires.
+
+⚠️ The write subcommands were **never run** for this document: `daemon-reload`,
+`enable`, `disable`, `start`, `stop` and `restart` are reasoned, checked for
+exit 0, and their effect read back with `show` rather than assumed.
+
+## The runner itself, exercised end to end
+
+★ Read-only against the same host, with the runner from `src/linux/`:
+
+- `stat` of a file, of a missing path, and of a **symlink** — reported
+  `symlink`, so the lstat contract holds over the wire and a write can refuse it.
+- `readFile` of a present path (bytes round-tripped) and of an absent one
+  (`undefined`, not an error).
+- `getent` user and group lookups through the shared `host-lookup` parsers.
+- A failing `exec` (exit 1, not a thrown transport error).
+- An argument containing a space, a `$`, a backtick and a `;` arriving
+  **verbatim** on the far side — the quoting proven rather than argued.
+- `systemctl show` of a known and an unknown unit, and `readUnit` of the unknown
+  one answering `undefined`.
+
+🔴 **That run is what found the framing bug.** The remote scripts end a branch
+with `exit <code>` to mean "nothing was there"; at the top level that exit leaves
+the shell before the status marker prints, so `stat` of a missing path came back
+as _"the remote command did not report a status (ssh exit 66)"_ — a transport
+failure, correctly, for a script that never finished. The frame now runs the
+script inside `( … )`, and a test drives the real frame through a real `/bin/sh`.
+
+⚠️ **What is still unverified.** Every write path: `daemon-reload`, `enable`,
+`disable`, `start`, `stop`, `restart`, the atomic file write and `mkdir` /
+`chmod` / `chown` / `rmdir`. Running them would have changed a live host. They
+are reasoned, checked for exit 0, and their effect read back with a read command
+— never assumed.

package/docs/linux-host.md

@@ -0,0 +1,186 @@
+# Linux hosts — `@homeflare/alchemy/linux`
+
+Status: active
+Verified: 2026-09-22
+
+The same `HostRunner` seam the [launchd subpath](./launchd.md) drives a Mac
+through, pointed at a Linux host over ssh — plus the three resource families
+that seam was missing: a directory, a file (whole, or one **managed block**
+inside a file somebody else owns) and systemd units.
+
+★ **What it unblocks.** A guest could be declared; nothing inside it could.
+That one gap is what stood between Alchemy and a host's services.
+
+## The seam
+
+```ts
+import { linuxProviders, sshRunner } from '@homeflare/alchemy/linux';
+
+const runner = await sshRunner({ host: 'the-destination' });
+Layer.mergeAll(linuxProviders(runner) /* the stack's other providers */);
+```
+
+- The destination is whatever the operator's own `~/.ssh/config` calls it.
+- ⛔ **`BatchMode=yes`, always.** A deploy never stops to ask for a passphrase.
+- ⛔ **Host verification is never weakened.** No `StrictHostKeyChecking`, no
+  `UserKnownHostsFile`: a changed host key stays a refusal.
+- ⛔ **Fail closed.** ssh exits 255 for its own failures _and_ passes remote
+  codes through, so every remote script ends by printing its status behind a
+  per-runner random nonce. A result without that line is an **Error**, never a
+  "nothing is there". This is the rule that stops a dropped link reading as a
+  deleted config.
+- ⛔ **No silent sudo.** `privileged` is `false` and nothing here calls `sudo`.
+  A root-owned path needs a destination whose ssh **user is root**, or a
+  privileged runner of your own. The Linux twin of `sudoRunner()` — with its
+  own argv allowlist — is deliberately a separate, later change.
+- The probe at construction (`uname -s`, `id -u`) refuses anything that is not
+  Linux: the scripts use GNU/BusyBox spellings (`stat -c`, `base64`, `mv -f`).
+
+★ **Exercised read-only against a live host, 2026-09-22** (Debian 13, ssh user
+uid 1001, nothing written): `stat` of a file, a missing path and a symlink — the
+symlink reported as `symlink`, so the lstat contract holds over the wire —
+`readFile` of a present and an absent path, `getent` user and group lookups, a
+failing `exec`, and an argument containing a space, a `$`, a backtick and a `;`
+arriving verbatim on the far side. That run is also what found the framing bug
+below.
+
+⛔ **The framing runs the script in a subshell, and that is not cosmetic.** The
+scripts end a branch with `exit <code>` to say "nothing was there"; at the top
+level that exit leaves the shell before the marker prints, and the caller
+correctly reads a frameless result as a transport failure. 🔴 Measured: `stat` of
+a missing path came back as "the remote command did not report a status (ssh exit
+66)" instead of "nothing is at this path". A test now runs the real frame through
+a real `/bin/sh`.
+
+⚠️ One ssh connection per call. Pass `sshArgs: ['-o', 'ControlMaster=auto', …]`
+to opt into your own multiplexing socket; the kit does not create one behind
+your back, because a stale socket outliving the deploy is a surprise nobody
+declared.
+
+## `Host.Directory`
+
+Every file resource refuses to create a parent, on purpose — creating one would
+invent an owner and a mode nobody declared. This is the declaration that was
+missing.
+
+```ts
+HostDirectory('app-etc', { path: '/opt/app/etc', mode: 0o750, owner: 'app' });
+```
+
+- ⛔ **One directory, never a chain.** A missing parent is a refusal that names
+  it, so a tree is a chain of declarations whose modes are all in the plan.
+- ⛔ **Delete is `rmdir`.** A directory that still holds files is a refusal;
+  removing a declaration must not remove data the declaration never mentioned.
+- `mkdir -m` carries the mode, so a umask never masks a declared bit.
+
+## `Remote.File`
+
+Whole-file mode is `Host.File` on Linux: content, mode, owner, group, an atomic
+write (stage beside the target, chown, chmod, rename) and a read-back.
+
+### Managed regions
+
+```ts
+RemoteFile('ssh-block', {
+  path: '/etc/example.conf',
+  region: { name: 'homeflare-example' }, // comment defaults to '#'
+  content: 'one declared line\n',
+});
+```
+
+produces, at the end of a file this resource does **not** own:
+
+```
+# BEGIN homeflare-example
+one declared line
+# END homeflare-example
+```
+
+- ⛔ **Every byte outside the markers is identical.** Not re-indented, not
+  re-terminated. That is the whole reason the file's real owner tolerates this,
+  and it is what `region.test.ts` asserts.
+- ⛔ **Drift means the region, and nothing else.** A change elsewhere in the
+  file is not this resource's business and never plans an update — otherwise
+  the two owners fight on every deploy.
+- ⛔ **The file's own mode and owner are copied back**, never re-declared.
+  `mode`/`owner`/`group` are refused unless `create: true`.
+- ⛔ **Ambiguity is a refusal.** Two BEGIN markers, an END before its BEGIN, or
+  a BEGIN with no END each name the line rather than guess.
+- **Delete removes only the block**, leaving the rest byte-identical.
+- ⚠️ A file with no final newline gains exactly one when the block is appended.
+  That is the only byte added outside the block, and it is not taken back.
+
+⚠️ The write replaces the inode in both modes. A process holding the old file
+keeps reading it until it reopens, and a hard link stops tracking — the price of
+never leaving a torn file.
+
+## `Systemd.Unit` and `Systemd.Timer`
+
+```ts
+SystemdUnit('thing', {
+  name: 'thing.service',
+  sections: [
+    { name: 'Unit', lines: [['Description', 'a thing']] },
+    { name: 'Service', lines: [['ExecStart', '/usr/bin/thing']] },
+    { name: 'Install', lines: [['WantedBy', 'multi-user.target']] },
+  ],
+  restartOn: [config.sha256],
+});
+```
+
+### What a deploy does NOT do
+
+⛔ **It never mass-restarts.** A unit is restarted only when
+
+1. its own unit file's bytes changed, or
+2. state holds an older digest than the file does (a previous write landed and
+   its reload never ran), or
+3. systemd itself says `NeedDaemonReload=yes`, or
+4. a digest the declaration listed in `restartOn` changed.
+
+Nothing else. A re-run restarts nothing; an **adopted** unit that already
+matches is not restarted, reloaded or even started. That is what lets this
+family reach a host holding a vault, a clock or a UPS handler.
+
+⚠️ **The limit, stated plainly:** a hand edit of a file named in `restartOn` is
+_not_ noticed. The digest in state still matches what the stack declared, so the
+unit reads converged — the same limit the Mac side records.
+
+### The rest of the contract
+
+- Order is **write, `daemon-reload`, enable/disable, then start/stop/restart**.
+  systemd reads the unit file at reload, so a failed write leaves the old unit
+  running rather than leaving nothing running.
+- A failed start on a **create** removes the file this deploy wrote and reloads
+  again, so the next deploy starts clean; on an **update** the file stays and
+  state keeps the previous digest, so the next deploy retries.
+- ⛔ A **masked** unit is someone's decision, not drift: refused, never unmasked.
+- ⛔ Deleting the declaration **stops the service** — stop, disable, remove the
+  file, reload. A unit that must outlive its declaration is adopted, not deleted.
+- A name or directory change is a **delete-first replace**: two unit files for
+  one name cannot both be the one systemd reads.
+
+### The directive set is systemd's, not the kit's
+
+There is no machine-readable schema of `systemd.unit(5)` directives to generate
+from, so `renderUnit` renders **sections and lines verbatim** and claims to know
+nothing about what the keys mean. What is validated is what an INI file must be
+true of, plus two structural rules proved by systemd's own output:
+
+- `enabled: true` needs an `[Install]` section — systemd's name for a unit file
+  without one is `UnitFileState=static`;
+- `enabled: true` needs a `directory` systemd searches by name. `systemctl
+enable <name>` looks the unit up by name, so a file in `/opt` is invisible to
+  it and the deploy would write, reload, and only then fail. The list is
+  `systemd-analyze unit-paths`, measured below;
+- a `.timer` needs a `[Timer]` section.
+
+⛔ **Enablement is read back, never claimed.** After `enable` the state is taken
+from `systemctl show`; a unit systemd still calls `static` or `disabled` is a
+refusal, not an `enabled: true` written into state. Otherwise the next plan would
+compare the declaration against itself.
+
+★ Run `systemd-analyze verify` on the host for the deep check.
+
+★ The exact commands, their output and what was **not** measured:
+[linux-host-measured.md](./linux-host-measured.md).

package/docs/netbox.md

@@ -0,0 +1,103 @@
+# NetBox — `@homeflare/alchemy/netbox`
+
+NetBox is a record of decisions, not a controller. Nothing here reboots anything; the worst a
+mistake does is write the wrong intent into the source of truth everything else is checked against.
+That shapes every posture below.
+
+## Credentials
+
+Two environment variables, read **at call time**, never props:
+
+| variable       | holds                                                  |
+| -------------- | ------------------------------------------------------ |
+| `NETBOX_URL`   | the instance origin, e.g. `https://netbox.example.com` |
+| `NETBOX_TOKEN` | a scoped NetBox API token                              |
+
+⛔ **Neither has a default.** A package that fell back to a loopback address would let a consumer
+who forgot the variable watch every call fail against a machine that is not theirs, instead of
+being told which variable is missing.
+
+⚠️ **`Authorization: Token <value>`, not `Bearer`.** NetBox is Django REST Framework using DRF's
+own `TokenAuthentication`. Measured: `Bearer` returns 401 and `Token` returns 200 — and a wrong
+scheme and a wrong credential are indistinguishable in the response.
+
+⛔ **Mint a short-lived, scoped token.** A NetBox token can be given an expiry, a source-IP
+restriction and `write_enabled: false`; a plan-only run wants the last of those.
+
+## Adopt is the default posture
+
+`reconcile` LOCATES before it writes. An object the instance already holds is bound, not
+duplicated — NetBox predates this code by years on any real estate, and a provider that created a
+second `10.0.0.0/24` on first deploy would be worse than no provider.
+
+⛔ **An ambiguous identity FAILS.** `soleMatch` refuses more than one candidate rather than taking
+the first: binding to "whichever NetBox ordered first" would make the next plan bind to the other
+row and report drift that is not there.
+
+★ **Narrowing is split: a filter the schema declares, then a rule in this process.** `locate`
+sends only filters the vendor document states; `identifies` picks the one row among the candidates.
+
+⚠️ **`Netbox.Prefix` uses that split for the VRF, and the reason is a guess that was caught.** A
+prefix is unique per-VRF, so the CIDR alone can match several rows. The obvious server-side
+narrowing is `vrf_id=null` for the global table — NetBox does define `FILTERS_NULL_CHOICE_VALUE =
+'null'`. ⛔ But measured in the vendor's own source at v4.7.0, `PrefixFilterSet.vrf_id` is a plain
+`ModelMultipleChoiceFilter` with no `null_value`: it does not opt in, so `'null'` fails queryset
+validation and NetBox answers **400 on every plan for every global prefix**. The VRF is compared
+here instead, where the rule is readable and testable without a server.
+
+## Removal is `retain`
+
+⛔ **Deleting a NetBox row deletes history.** Child prefixes reparent, IP assignments detach, and
+the change log is the only trace left. Every family here defaults to `retain`, so dropping a
+declaration does not delete the object unless the caller opts into `.pipe(RemovalPolicy.destroy())`.
+The `delete` handler is fully implemented anyway — a stub that silently does nothing lies to
+whoever reads the plan.
+
+## An undeclared field is not an instruction to clear it
+
+🔴 **This shipped wrong once, and the shape of the mistake is worth keeping.** `Netbox.Prefix`
+sent `description: ''` whenever the prop was absent. On a create that is invisible — the field was
+empty anyway. ⛔ **On an adopt it is data loss**: a prefix's description is usually the only written
+trace of why that range exists, and the first deploy that adopted one would have PATCHed it to
+empty, with a plan that read `update`.
+
+★ **So the line is drawn at what the vendor itself defaults.** `status`, `is_pool` and
+`mark_utilized` have defaults in the schema, so omitting one genuinely means "the default" and
+settling it says what NetBox would have done anyway. `description`, `comments` and every optional
+foreign key have no such default — the schema's `''` is the absence of a value, not a decision —
+so they are **omitted from the body and uncompared** until you declare them.
+
+⚠️ **The cost, stated:** prose cannot be cleared by omission. Clearing it is `description: ''`,
+written on purpose, which is the readable way to say a destructive thing.
+
+⛔ **Whatever `matches` compares, `body` must send.** A field compared but never written produces
+a plan that says `update` forever: the PATCH omits it, so the next read is unchanged. The two move
+together, and `prefix-form.test.ts` asserts it.
+
+## Read and write are different shapes
+
+⛔ **This is the bug that makes a resource never converge, and it is handled in `values.ts`.** A
+prefix is WRITTEN with `status: "active"` and READ BACK as `{value: "active", label: "Active"}`; a
+foreign key is written as `4` and read back as `{id: 4, url: …, display: …}`. A `matches` that
+compared those directly would report drift on every plan, for every object, forever — and each
+"update" would PATCH the same value back.
+
+## Vendor constraints, checked before the request
+
+Every write is checked against a table **generated from NetBox's own OpenAPI document** — not from
+hand-typed limits. A declaration the vendor would reject dies at plan time with the endpoint named,
+rather than half-way through a deploy that has already adopted ten objects.
+
+```ts
+import { bodyViolations, constraintsFor } from '@homeflare/alchemy/netbox';
+
+constraintsFor('netbox:POST /api/ipam/prefixes/')['description']?.maxLength; // 200
+```
+
+⚠️ **What it deliberately does NOT enforce**, so a green plan is not read as more than it is: a
+`format` name DRF validates server-side; a pattern whose Python `\w` is Unicode where JavaScript's
+is ASCII (recorded as `patternSource` with no `pattern`); and uniqueness, VRF containment and
+custom-field validators, which live in Django rather than in the schema and still arrive as a 400.
+
+Provenance, the re-fetch recipe and the coverage report: [`codegen/netbox.md`](../../../codegen/netbox.md)
+and [`docs/netbox-coverage.md`](../../../docs/netbox-coverage.md).