@homeflare/alchemy 0.15.0 → 0.19.1

package/dist/proxmox/lxc-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lxc-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,SAAS,EAAQ,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK9D,0FAA0F;AAC1F,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAkB,IAAI,qBAAqB;CAC5C;AAED,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG,eAAO,MAAM,SAAS,UAAW,QAAQ,WAAoD,CAAC;AAY9F,2FAA2F;AAC3F,eAAO,MAAM,QAAQ,UAAW,QAAQ,sIAqCpC,CAAC;AAEL,eAAO,MAAM,YAAY,UAAW,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,aAK5E,CAAC;AAgCH,iGAAiG;AACjG,eAAO,MAAM,WAAW,UAAW,QAAQ,4GAQxC,CAAC;AAEJ;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,UAAW,QAAQ,UAAU,SAAS,UAAU,MAAM,uGAmB1E,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,UAAW,QAAQ,YAAY,QAAQ,4GAe5D,CAAC"}
+{"version":3,"file":"lxc-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,EAAE,KAAK,SAAS,EAAQ,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK9D,0FAA0F;AAC1F,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAkB,IAAI,qBAAqB;CAC5C;AAED,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG,eAAO,MAAM,SAAS,UAAW,QAAQ,WAAoD,CAAC;AAgC9F,2FAA2F;AAC3F,eAAO,MAAM,QAAQ,UAAW,QAAQ,sIAqCpC,CAAC;AAEL,eAAO,MAAM,YAAY,UAAW,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,aAK5E,CAAC;AAgCH,iGAAiG;AACjG,eAAO,MAAM,WAAW,UAAW,QAAQ,4GAmBvC,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,UAAW,QAAQ,UAAU,SAAS,UAAU,MAAM,uGAyB1E,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,UAAW,QAAQ,YAAY,QAAQ,4GAe5D,CAAC"}

package/dist/proxmox/metric-server-form.d.ts

@@ -50,4 +50,15 @@ export declare const body: (props: MetricServerProps) => Record<string, string>;
  *   update really sends instead of re-deriving it and testing its own copy.
  */
 export declare const update: (props: MetricServerProps) => Record<string, string>;
+/**
+ * The create form: `body` plus the one field only a POST takes.
+ *
+ * ★ EXPORTED SO THE CONSTRAINT PROOF CAN RUN THE REAL FORM. `metric-server.ts` built this inline
+ *   in its spec, which meant the only way to check it against PVE's table was to retype it in a
+ *   test — and a retyped form proves the test, not the provider.
+ * ⚠️ `type` IS REQUIRED ON CREATE AND REFUSED ON UPDATE; `id` is the path, never the body.
+ */
+export declare const createBody: (props: MetricServerProps) => {
+    type: import("./metric-server.ts").MetricServerType;
+};
 //# sourceMappingURL=metric-server-form.d.ts.map

package/dist/proxmox/metric-server-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metric-server-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/metric-server-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAG5D;;;;GAIG;AACH,eAAO,MAAM,KAAK,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,QAAQ,UAAW,iBAAiB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAuBpF,CAAC;AAqCF,eAAO,MAAM,IAAI,UAAW,iBAAiB,2BAM5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,UAAW,iBAAiB,2BAK9C,CAAC"}
+{"version":3,"file":"metric-server-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/metric-server-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAG5D;;;;GAIG;AACH,eAAO,MAAM,KAAK,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,QAAQ,UAAW,iBAAiB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAuBpF,CAAC;AAqCF,eAAO,MAAM,IAAI,UAAW,iBAAiB,2BAM5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,UAAW,iBAAiB,2BAK9C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,UAAW,iBAAiB;;CAA2C,CAAC"}

package/dist/proxmox/metric-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metric-server.d.ts","sourceRoot":"","sources":["../../src/proxmox/metric-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAG3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;AAEzE,MAAM,WAAW,iBAAkB,SAAQ,UAAU,EAAE,qBAAqB;IAC1E;qGACiG;IACjG,EAAE,EAAE,MAAM,CAAC;IACX;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,wFAAwF;IACxF,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAuB,SAAQ,0BAA0B;IACxE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAAwD,CAAC;AA0EzF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,yIACyD,CAAC"}
+{"version":3,"file":"metric-server.d.ts","sourceRoot":"","sources":["../../src/proxmox/metric-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAG3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;AAEzE,MAAM,WAAW,iBAAkB,SAAQ,UAAU,EAAE,qBAAqB;IAC1E;qGACiG;IACjG,EAAE,EAAE,MAAM,CAAC;IACX;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,wFAAwF;IACxF,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAuB,SAAQ,0BAA0B;IACxE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAAwD,CAAC;AAmFzF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,yIACyD,CAAC"}

package/dist/proxmox/network-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-apply.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAAwD,CAAC;AA8HzF,eAAO,MAAM,2BAA2B,yIACyD,CAAC"}
+{"version":3,"file":"network-apply.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAM7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAAwD,CAAC;AAiIzF,eAAO,MAAM,2BAA2B,yIACyD,CAAC"}

package/dist/proxmox/node-network-form.d.ts

@@ -96,6 +96,21 @@ export declare const sameComment: (declared: string | undefined, live: string) =
  *   A resource accepting both spellings would let a declaration diff against its own value.
  */
 export declare const body: (props: NodeNetworkProps) => Record<string, string>;
+/**
+ * The create form: `body` plus the name of the interface being created.
+ *
+ * 🔴 `iface` WAS MISSING UNTIL 2026-09-22, AND EVERY CREATE THIS FAMILY HAS EVER PLANNED WOULD
+ *   HAVE 400ed. `POST /nodes/{node}/network` declares `iface` REQUIRED (`pve-iface`, 2..20) and
+ *   `{node}` is its only path parameter, so the name has to travel in the BODY — unlike the PUT,
+ *   where `/network/{iface}` carries it and `updateBody` is right to leave it out. Nothing caught
+ *   it because no NodeNetwork has been created from a declaration yet: C1's three nodes were all
+ *   adopted, which takes the PUT path. Found by wiring this family to the vendor's own table,
+ *   which is exactly the 128-character comment again with a different parameter.
+ *
+ * ⚠️ NOT ADDED TO `body`, BECAUSE THE PUT MUST NOT CARRY IT. `additionalProperties => 0` on the
+ *   update schema makes a second copy of the name a 400 rather than an ignored hint.
+ */
+export declare const createBody: (props: NodeNetworkProps) => Record<string, string>;
 /**
  * The update form: `body` plus the two fields that can only be cleared explicitly.
  *

package/dist/proxmox/node-network-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-network-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGjF;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,UAAW,OAAO,WAK1B,CAAC;AAEf;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,UAAW,OAAO,WAAoC,CAAC;AAE3E,gFAAgF;AAChF,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,YACX,CAAC;AAE9C,eAAO,MAAM,QAAQ,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YACX,CAAC;AAEzD,eAAO,MAAM,WAAW,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YAChB,CAAC;AAKvD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAgBlE,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,UAAU,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAOzE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,SACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,gBAAgB,KACtB,qBAAqB,GAAG,SAuC1B,CAAC"}
+{"version":3,"file":"node-network-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGjF;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,UAAW,OAAO,WAK1B,CAAC;AAEf;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,UAAW,OAAO,WAAoC,CAAC;AAE3E,gFAAgF;AAChF,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,YACX,CAAC;AAE9C,eAAO,MAAM,QAAQ,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YACX,CAAC;AAEzD,eAAO,MAAM,WAAW,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YAChB,CAAC;AAKvD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAgBlE,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGxE,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,UAAU,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAOzE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,SACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,gBAAgB,KACtB,qBAAqB,GAAG,SAuC1B,CAAC"}

package/dist/proxmox/node-network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-network.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAU7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,CAAC;AAEX,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,IAAI,EAAE,eAAe,CAAC;IACtB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;kFAC8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;gFAC4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAsCH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wIACwD,CAAC"}
+{"version":3,"file":"node-network.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAU7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,CAAC;AAEX,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,IAAI,EAAE,eAAe,CAAC;IACtB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;kFAC8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;gFAC4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AA4CH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wIACwD,CAAC"}

package/dist/proxmox/notification-target-endpoint.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `Proxmox.NotificationTarget`'s eight vendor endpoints — one create and one update per family.
+ *
+ * ⛔ PVE REGISTERS ONE PATH PER TYPE, NOT A `{type}` PARAMETER, AND THE FOUR SCHEMAS DIFFER IN
+ *   WHAT THEY REQUIRE: gotify wants `server` and `token`, smtp `server` and `from-address`,
+ *   webhook `url` and `method`, sendmail nothing but its name. One key for all four would enforce
+ *   gotify's rules on a sendmail target and let three families through unchecked, which is why
+ *   `PveSpec['endpoint']` admits a function of props.
+ *
+ * ⛔ THE STRINGS ARE LITERALS AND MUST STAY LITERALS. `codegen/constraints.ts` finds the endpoints
+ *   to table by SCANNING THIS PACKAGE'S TEXT, so `` `pve:POST …/${props.type}` `` would be tabled
+ *   by nothing and `constraintsFor` would throw on the first deploy that reached it.
+ *
+ * ⚠️ GOTIFY'S CREATE CAN NEVER SATISFY ITS OWN TABLE, AND THAT IS THE TRUTH RATHER THAN A BUG
+ *   HERE. `token` is required by PVE and is a write-only secret, so it is not a prop — props are
+ *   persisted to the state store unencrypted (the third ⛔ in notification-target.ts). A gotify
+ *   target is created out of band and then DECLARED, which is an adopt followed by updates; the
+ *   shared guard only demands the create form's required parameters when a create is really about
+ *   to happen (`resource-guard.ts`), so declaring an existing gotify target still plans clean and
+ *   asking to CREATE one is refused at plan time with `token: required` instead of by a 400.
+ */
+import type { NotificationTargetProps } from './notification-target.ts';
+import type { EndpointPair } from './resource-spec.ts';
+/** The pair this declaration writes. ⚠️ `type` is identity here, so it never changes under a row. */
+export declare const targetEndpoint: (props: NotificationTargetProps) => EndpointPair;
+//# sourceMappingURL=notification-target-endpoint.d.ts.map

package/dist/proxmox/notification-target-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-target-endpoint.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-target-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAqBvD,qGAAqG;AACrG,eAAO,MAAM,cAAc,UAAW,uBAAuB,KAAG,YACzC,CAAC"}

package/dist/proxmox/notification-target-form.d.ts

@@ -41,4 +41,11 @@ export declare const headerList: (value: unknown) => string;
  *   like a healthy cluster.
  */
 export declare const shape: (props: NotificationTargetProps) => Record<string, string>;
+/**
+ * The create form: `shape` plus the name PVE takes in the body exactly once.
+ *
+ * ★ EXPORTED SO THE CONSTRAINT PROOF CAN RUN THE REAL FORM rather than a retyped copy of it.
+ * ⛔ `name` IS CREATE-ONLY: PVE takes it in the body on the POST and in the path forever after.
+ */
+export declare const createShape: (props: NotificationTargetProps) => Record<string, string>;
 //# sourceMappingURL=notification-target-form.d.ts.map

package/dist/proxmox/notification-target-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notification-target-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-target-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAoBxE,kGAAkG;AAClG,eAAO,MAAM,MAAM,UAAW,OAAO,KAAG,MAGvC,CAAC;AASF;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,UAAW,OAAO,KAAG,MAO1C,CAAC;AAEJ,mGAAmG;AACnG,eAAO,MAAM,UAAU,UAAW,OAAO,KAAG,MAC+C,CAAC;AAK5F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,KAAK,UAAW,uBAAuB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAkB1E,CAAC"}
+{"version":3,"file":"notification-target-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-target-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAoBxE,kGAAkG;AAClG,eAAO,MAAM,MAAM,UAAW,OAAO,KAAG,MAGvC,CAAC;AASF;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,UAAW,OAAO,KAAG,MAO1C,CAAC;AAEJ,mGAAmG;AACnG,eAAO,MAAM,UAAU,UAAW,OAAO,KAAG,MAC+C,CAAC;AAK5F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,KAAK,UAAW,uBAAuB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAkB1E,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,WAAW,UAAW,uBAAuB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGhF,CAAC"}

package/dist/proxmox/notification-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notification-target.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,gFAAgF;IAChF,IAAI,EAAE,sBAAsB,CAAC;IAC7B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,iFAAiF;IACjF,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,yBAA0B,SAAQ,QAAQ,CACzD,4BAA4B,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,yBAAyB,4DAErC,CAAC;AA2DF;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,+IAI3C,CAAC"}
+{"version":3,"file":"notification-target.d.ts","sourceRoot":"","sources":["../../src/proxmox/notification-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,gFAAgF;IAChF,IAAI,EAAE,sBAAsB,CAAC;IAC7B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,iFAAiF;IACjF,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,yBAA0B,SAAQ,QAAQ,CACzD,4BAA4B,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,yBAAyB,4DAErC,CAAC;AA6DF;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,+IAI3C,CAAC"}

package/dist/proxmox/pbs-notification-target-endpoint.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `Pbs.NotificationTarget`'s six vendor endpoints — one create and one update per family.
+ *
+ * 🔴 THIS FAMILY WAS THE ONE THE 2026-09-22 SWEEP NEARLY MISSED, and it carries the very
+ *   parameter the incident was about: `comment` is `maxLength: 128` with a no-control-characters
+ *   pattern on all three PBS creates, exactly as it is on `POST /config/verify`. A 129-character
+ *   comment on a notification target would have failed the same way, half a deploy in, on the
+ *   family whose whole purpose is to make failures visible.
+ *
+ * ⛔ PBS REGISTERS ONE PATH PER TYPE, NOT A `{type}` PARAMETER, and the three schemas differ:
+ *   smtp requires `server` and `from-address`, webhook `url` and `method`, sendmail nothing but
+ *   its name. One key would enforce one family's rules on all three.
+ * ⛔ THE STRINGS MUST STAY LITERALS. `codegen/constraints.ts` finds the endpoints to table by
+ *   SCANNING THIS PACKAGE'S TEXT, so a key built from `props.type` would be tabled by nothing.
+ *
+ * ⚠️ NO GOTIFY KEY, BECAUSE THIS RESOURCE HAS NO GOTIFY TYPE. `PbsNotificationTargetType` is
+ *   sendmail | smtp | webhook; PBS 4.2 does publish a gotify endpoint, and nothing here writes to
+ *   it. ⛔ `scripts/proxmox-ownership-pbs.ts` says otherwise — it claims all four families
+ *   through the shared `notificationEndpoints` helper — so `docs/api-coverage.md` credits this
+ *   resource with twelve write endpoints where it really makes nine. That is an overclaim in the
+ *   hand-written ownership ledger, recorded here rather than fixed in passing: correcting it
+ *   regenerates a report built from a DIFFERENT (older, 9.2.4) schema manifest, which is its own
+ *   change with its own diff.
+ */
+import type { PbsNotificationTargetProps } from './pbs-notification-target.ts';
+import type { EndpointPair } from './resource-spec.ts';
+/** The pair this declaration writes. ⚠️ `type` is identity here — changing it is a replace. */
+export declare const pbsTargetEndpoint: (props: PbsNotificationTargetProps) => EndpointPair;
+//# sourceMappingURL=pbs-notification-target-endpoint.d.ts.map

package/dist/proxmox/pbs-notification-target-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-notification-target-endpoint.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-notification-target-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAiBvD,+FAA+F;AAC/F,eAAO,MAAM,iBAAiB,UAAW,0BAA0B,KAAG,YAC/C,CAAC"}

package/dist/proxmox/pbs-notification-target-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pbs-notification-target-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-notification-target-lifecycle.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC3B,MAAM,8BAA8B,CAAC;AActC,KAAK,KAAK,GAAG,0BAA0B,CAAC;AACxC,KAAK,UAAU,GAAG,+BAA+B,CAAC;AA8ClD,eAAO,MAAM,QAAQ;IACnB,kGAAkG;IAClG,IAAI;IACJ;;;;;;;;;;;;;;;OAeG;IACH,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;IAOxE;;;;;OAKG;IACH,IAAI,4BAID;QACD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,CAAC;QACZ,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;KAChC;yBAIsB,SAAS;;;;yBAIa,QAAQ;;;yBAElC,MAAM;;IAGzB,SAAS,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;IAyC7E,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CACnC,CAAC"}
+{"version":3,"file":"pbs-notification-target-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-notification-target-lifecycle.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC3B,MAAM,8BAA8B,CAAC;AActC,KAAK,KAAK,GAAG,0BAA0B,CAAC;AACxC,KAAK,UAAU,GAAG,+BAA+B,CAAC;AA8ClD,eAAO,MAAM,QAAQ;IACnB,kGAAkG;IAClG,IAAI;IACJ;;;;;;;;;;;;;;;OAeG;IACH,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;IAOxE;;;;;OAKG;IACH,IAAI,4BAID;QACD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,CAAC;QACZ,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;KAChC;yBAIsB,SAAS;;;;yBAIa,QAAQ;;;yBAElC,MAAM;;IAGzB,SAAS,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;IAyC7E,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CACnC,CAAC"}

package/dist/proxmox/qemu.d.ts

@@ -42,5 +42,15 @@ export interface VmAttributes {
 export interface ProxmoxVm extends Resource<'Proxmox.Vm', VmProps, VmAttributes, never, PveRequirements> {
 }
 export declare const ProxmoxVm: import("alchemy").ResourceClass<ProxmoxVm>;
+/** ★ Exported so the constraint proof can run the REAL create form, not a retyped copy of it. */
+export declare const createForm: (props: VmProps) => {
+    vmid: string;
+    cores: string;
+    memory: string;
+    name: string;
+    onboot: string;
+    sockets: string;
+    net0?: string;
+};
 export declare const ProxmoxVmProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxVm>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=qemu.d.ts.map

package/dist/proxmox/qemu.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qemu.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,OAAO,EACP,YAAY,EACZ,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,SAAS,4CAAoC,CAAC;AAiC3D,eAAO,MAAM,iBAAiB,+HAC+C,CAAC"}
+{"version":3,"file":"qemu.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,OAAO,EACP,YAAY,EACZ,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,SAAS,4CAAoC,CAAC;AAE3D,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAW,OAAO;;;;;;;;CAAoD,CAAC;AAsC9F,eAAO,MAAM,iBAAiB,+HAC+C,CAAC"}

package/dist/proxmox/resource-guard.d.ts

@@ -0,0 +1,15 @@
+/**
+ * A spec's two forms, checked against the vendor's own tables before either goes on the wire.
+ *
+ * ★ A FILE OF ITS OWN BECAUSE resource.ts REACHED THE 250-LINE CAP, and the seam is the same one
+ *   resource-spec.ts cuts on: that file says what a PVE object DECLARES, resource.ts says how one
+ *   is read and written, and this one says what makes a declaration legal. `constraint-guard.ts`
+ *   is the layer below — it owns the lookup and the refusal; this owns which form to check when.
+ */
+import * as Effect from 'effect/Effect';
+import type { PveSpec, WithApiTarget } from './resource-spec.ts';
+export declare const specGuards: <Props extends WithApiTarget, Attributes>(spec: PveSpec<Props, Attributes>) => {
+    guardCreate: (props: Props, presence: boolean) => Effect.Effect<void>;
+    guardUpdate: (props: Props) => Effect.Effect<void>;
+};
+//# sourceMappingURL=resource-guard.d.ts.map

package/dist/proxmox/resource-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-guard.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEjE,eAAO,MAAM,UAAU,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC1D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;yBAyBJ,KAAK,YAAY,OAAO,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;yBAa9C,KAAK,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;CASxD,CAAC"}

package/dist/proxmox/resource-spec.d.ts

@@ -111,10 +111,21 @@ export type PveSpec<Props extends WithApiTarget, Attributes> = {
      *   names an endpoint the vendor does not have stops the GENERATOR rather than a deploy.
      * ⚠️ The spelling is the vendor's own path TEMPLATE, braces and all — not `spec.path(props)`,
      *   which has the ids substituted in.
+     *
+     * ⚠️ A FUNCTION FOR THE TWO FAMILIES WHOSE ENDPOINT IS CHOSEN BY A PROP, AND FOR NO OTHER
+     *   REASON. `Proxmox.NotificationTarget` POSTs to one of four `endpoints/{type}` paths and
+     *   `Proxmox.CephDaemon` to one of `ceph/mds|mgr|mon`, each with its own parameter schema, so a
+     *   single key would table the wrong rules for three declarations out of four.
+     *   ⛔ EVERY KEY THE FUNCTION CAN RETURN STILL HAS TO EXIST AS A LITERAL IN THIS PACKAGE'S
+     *     SOURCE. `codegen/constraints.ts` finds keys by scanning text, so a key assembled from a
+     *     template literal is tabled by nothing and `constraintsFor` throws on the deploy that first
+     *     reaches it. Write the keys out in a record and index it — see `ceph-endpoints.ts`.
      */
-    readonly endpoint?: {
-        readonly create?: EndpointKey;
-        readonly update?: EndpointKey;
-    };
+    readonly endpoint?: EndpointPair | ((props: Props) => EndpointPair);
+};
+/** The two endpoints a family writes. Either may be absent — see `PveSpec['endpoint']`. */
+export type EndpointPair = {
+    readonly create?: EndpointKey;
+    readonly update?: EndpointKey;
 };
 //# sourceMappingURL=resource-spec.d.ts.map

package/dist/proxmox/resource-spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-spec.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource-spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,UAAU,IAAI;IAC7D,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7F,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IAChD,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;KAC/B,CAAC;CACH,CAAC"}
+{"version":3,"file":"resource-spec.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource-spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,UAAU,IAAI;IAC7D,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7F,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IAChD,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC,CAAC;CACrE,CAAC;AAEF,2FAA2F;AAC3F,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B,CAAC"}

package/dist/proxmox/resource.d.ts

@@ -3,6 +3,14 @@ import * as Effect from 'effect/Effect';
 import type { PveSpec, WithApiTarget } from './resource-spec.ts';
 export type { PveRequirements, PveSpec, WithApiTarget, WithPbsTarget, WithTarget, } from './resource-spec.ts';
 export declare const pveOperations: <Props extends WithApiTarget, Attributes>(spec: PveSpec<Props, Attributes>) => {
+    /**
+     * ★ EXPORTED SO A FAMILY THAT WRITES ITS OWN `reconcile` REACHES THE SAME CHECK BY THE SAME
+     *   NAME. CephPool, CephFs and ZfsPool all bypass the reconcile below — forked workers, a
+     *   settle loop, a destructive create — and without these two they would be checked at plan
+     *   time and not at apply time, which is exactly the gap an ADOPTED row falls through.
+     */
+    guardCreate: (props: Props, presence: boolean) => Effect.Effect<void>;
+    guardUpdate: (props: Props) => Effect.Effect<void>;
     read: (props: Props) => Effect.Effect<Attributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
     diff: (news: Input<Props>, output: Attributes | undefined) => Effect.Effect<{
         readonly action: 'update';

package/dist/proxmox/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGjE,YAAY,EACV,eAAe,EACf,OAAO,EACP,aAAa,EACb,aAAa,EACb,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC7D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;kBA0BX,KAAK;iBAiBX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAiBZ,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;sBAIV,KAAK;IAgEvB;;;;OAIG;oBACa,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,SAAS,MAAM,QAC1E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAI9B,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAChC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBAzHlC,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;IAuH5B,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGjE,YAAY,EACV,eAAe,EACf,OAAO,EACP,aAAa,EACb,aAAa,EACb,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC7D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAiB9B;;;;;OAKG;;;kBAjBgB,KAAK;iBA0BX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAyBlC,QAAQ;;yBAEoB,MAAM;;yBAGtC,SAAS;;sBAIV,KAAK;IAmEvB;;;;OAIG;oBACa,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,SAAS,MAAM,QAC1E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAI9B,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAChC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBA7HxD,QAAQ;;yBAEoB,MAAM;;yBAGtC,SAAS;;IA0H5B,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}

package/dist/proxmox/sdn-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdn-apply.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,eAAe,kDAAgD,CAAC;AAK7E,eAAO,MAAM,uBAAuB,qIA0EjC,CAAC"}
+{"version":3,"file":"sdn-apply.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,eAAe,kDAAgD,CAAC;AAK7E,eAAO,MAAM,uBAAuB,qIA6EjC,CAAC"}

package/dist/proxmox/sdn-subnet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdn-subnet.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-subnet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AACnF,OAAO,EACL,KAAK,SAAS,EAMf,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD;;;;;;;;;;OAUG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,mDAAkD,CAAC;AA4DhF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,sIACsD,CAAC"}
+{"version":3,"file":"sdn-subnet.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-subnet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AACnF,OAAO,EACL,KAAK,SAAS,EAMf,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD;;;;;;;;;;OAUG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,mDAAkD,CAAC;AAiEhF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,sIACsD,CAAC"}

package/dist/proxmox/zfs-pool-write.d.ts

@@ -18,6 +18,7 @@
  *   already built means this file cannot accidentally read the cluster differently from `diff`.
  */
 import * as Effect from 'effect/Effect';
+import type { EndpointPair } from './resource-spec.ts';
 import type { ZfsPoolAttributes, ZfsPoolProps } from './zfs-pool.ts';
 /**
  * The POST body. Every field in it is write-only — nothing here is ever read back.
@@ -33,6 +34,16 @@ import type { ZfsPoolAttributes, ZfsPoolProps } from './zfs-pool.ts';
  *   are unreadable afterwards either way — but it would put a number in the request that no
  *   declaration asked for, and this is the one call that writes to physical disks.
  */
+/**
+ * The vendor rules the create form is checked against at plan time.
+ *
+ * ⛔ HERE RATHER THAN INLINE IN zfs-pool.ts BECAUSE THAT FILE IS ALREADY OVER THE 250-LINE CAP,
+ *   and a `pve:POST …` literal has to live in a non-test source file for the generator to table
+ *   it at all. The spec imports it on the line it already imports `createForm` from.
+ * ⚠️ NO UPDATE KEY: PVE registers no PUT under `/nodes/{node}/disks/zfs`, which is exactly why
+ *   the spec declares no `updateForm` and a changed prop is a REPLACE.
+ */
+export declare const ZFS_POOL_ENDPOINT: EndpointPair;
 export declare const createForm: (props: ZfsPoolProps) => Record<string, string>;
 /**
  * Create the pool if it is absent, and otherwise leave it completely alone.

package/dist/proxmox/zfs-pool-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zfs-pool-write.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU,UAAW,YAAY,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAOpE,CAAC;AAKH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,SACtB,YAAY,cACP,MAAM,QACZ,MAAM,QACN,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,iBAAiB,GAAG,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,0GAmC/E,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,SAAU,YAAY,QAAQ,MAAM,wFACb,CAAC"}
+{"version":3,"file":"zfs-pool-write.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,EAAE,YAA6D,CAAC;AAE9F,eAAO,MAAM,UAAU,UAAW,YAAY,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAOpE,CAAC;AAKH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,SACtB,YAAY,cACP,MAAM,QACZ,MAAM,QACN,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,iBAAiB,GAAG,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,0GAmC/E,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,SAAU,YAAY,QAAQ,MAAM,wFACb,CAAC"}

package/dist/proxmox/zfs-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zfs-pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,UAAU,EAGhB,MAAM,eAAe,CAAC;AAIvB,oGAAoG;AACpG,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,QAAQ,CAAC;AAEb,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;AAErF;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,YAAY,CAAC;IACxB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,mGAAmG;AACnG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AA6EH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}
+{"version":3,"file":"zfs-pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,UAAU,EAGhB,MAAM,eAAe,CAAC;AAIvB,oGAAoG;AACpG,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,QAAQ,CAAC;AAEb,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;AAErF;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,YAAY,CAAC;IACxB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,mGAAmG;AACnG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AA8EH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}

package/docs/linux-host-measured.md

@@ -0,0 +1,56 @@
+# Linux host shapes — the measurements
+
+Status: active
+Verified: 2026-09-22
+
+The evidence behind [linux-host.md](./linux-host.md). Debian 13, systemd 257
+(257.13-1~deb13u1), kernel 7.0.14-pve, `LANG=C`, over ssh as an unprivileged
+user. ⛔ **Read-only: nothing was enabled, started, reloaded or written.**
+
+## systemd and coreutils, as observed
+
+- ⛔ `systemctl show -p … <unknown>` **exits 0** and answers
+  `LoadState=not-found`. The exit code is not the answer; `LoadState` is.
+- Properties come back in systemd's order, not the order asked for.
+- `is-enabled`/`is-active` of an unknown unit exit **4** with `not-found` /
+  `inactive` — answers, not errors.
+- `/etc/systemd/system` is `root:root 0755`.
+- `systemd-analyze unit-paths`, minus per-user and generator directories:
+  `/etc/systemd/system`, `/run/systemd/system`, `/usr/local/lib/systemd/system`,
+  `/usr/lib/systemd/system`. `/lib/systemd/system` is the same directory before
+  the /usr merge, which the measured host does not have separately.
+- `stat -c '%f %a %u %g %s' /etc/hostname` → `81a4 644 0 0 4`; a missing path
+  exits 1. GNU `stat` does not follow symlinks without `-L`, which is what makes
+  it the lstat the seam requires.
+
+⚠️ The write subcommands were **never run** for this document: `daemon-reload`,
+`enable`, `disable`, `start`, `stop` and `restart` are reasoned, checked for
+exit 0, and their effect read back with `show` rather than assumed.
+
+## The runner itself, exercised end to end
+
+★ Read-only against the same host, with the runner from `src/linux/`:
+
+- `stat` of a file, of a missing path, and of a **symlink** — reported
+  `symlink`, so the lstat contract holds over the wire and a write can refuse it.
+- `readFile` of a present path (bytes round-tripped) and of an absent one
+  (`undefined`, not an error).
+- `getent` user and group lookups through the shared `host-lookup` parsers.
+- A failing `exec` (exit 1, not a thrown transport error).
+- An argument containing a space, a `$`, a backtick and a `;` arriving
+  **verbatim** on the far side — the quoting proven rather than argued.
+- `systemctl show` of a known and an unknown unit, and `readUnit` of the unknown
+  one answering `undefined`.
+
+🔴 **That run is what found the framing bug.** The remote scripts end a branch
+with `exit <code>` to mean "nothing was there"; at the top level that exit leaves
+the shell before the status marker prints, so `stat` of a missing path came back
+as _"the remote command did not report a status (ssh exit 66)"_ — a transport
+failure, correctly, for a script that never finished. The frame now runs the
+script inside `( … )`, and a test drives the real frame through a real `/bin/sh`.
+
+⚠️ **What is still unverified.** Every write path: `daemon-reload`, `enable`,
+`disable`, `start`, `stop`, `restart`, the atomic file write and `mkdir` /
+`chmod` / `chown` / `rmdir`. Running them would have changed a live host. They
+are reasoned, checked for exit 0, and their effect read back with a read command
+— never assumed.

package/docs/linux-host.md

@@ -0,0 +1,192 @@
+# Linux hosts — `@homeflare/alchemy/linux`
+
+Status: active
+Verified: 2026-09-22
+
+The same `HostRunner` seam the [launchd subpath](./launchd.md) drives a Mac
+through, pointed at a Linux host over ssh — plus the three resource families
+that seam was missing: a directory, a file (whole, or one **managed block**
+inside a file somebody else owns) and systemd units.
+
+★ **What it unblocks.** A guest could be declared; nothing inside it could.
+That one gap is what stood between Alchemy and a host's services.
+
+## The seam
+
+```ts
+import { linuxProviders, sshRunner } from '@homeflare/alchemy/linux';
+
+const runner = await sshRunner({ host: 'the-destination' });
+Layer.mergeAll(linuxProviders(runner) /* the stack's other providers */);
+```
+
+- The destination is whatever the operator's own `~/.ssh/config` calls it.
+- ⛔ **`BatchMode=yes`, always.** A deploy never stops to ask for a passphrase.
+- ⛔ **Host verification is never weakened.** No `StrictHostKeyChecking`, no
+  `UserKnownHostsFile`: a changed host key stays a refusal.
+- ⛔ **Fail closed.** ssh exits 255 for its own failures _and_ passes remote
+  codes through, so every remote script ends by printing its status behind a
+  per-runner random nonce. A result without that line is an **Error**, never a
+  "nothing is there". This is the rule that stops a dropped link reading as a
+  deleted config.
+- ⛔ **No silent sudo.** `privileged` is `false` and nothing here calls `sudo`.
+  A root-owned path needs a destination whose ssh **user is root**, or a
+  privileged runner of your own. The Linux twin of `sudoRunner()` — with its
+  own argv allowlist — is deliberately a separate, later change.
+- The probe at construction (`uname -s`, `id -u`) refuses anything that is not
+  Linux: the scripts use GNU/BusyBox spellings (`stat -c`, `base64`, `mv -f`).
+
+★ **Exercised read-only against a live host, 2026-09-22** (Debian 13, ssh user
+uid 1001, nothing written): `stat` of a file, a missing path and a symlink — the
+symlink reported as `symlink`, so the lstat contract holds over the wire —
+`readFile` of a present and an absent path, `getent` user and group lookups, a
+failing `exec`, and an argument containing a space, a `$`, a backtick and a `;`
+arriving verbatim on the far side. That run is also what found the framing bug
+below.
+
+⛔ **The framing runs the script in a subshell, and that is not cosmetic.** The
+scripts end a branch with `exit <code>` to say "nothing was there"; at the top
+level that exit leaves the shell before the marker prints, and the caller
+correctly reads a frameless result as a transport failure. 🔴 Measured: `stat` of
+a missing path came back as "the remote command did not report a status (ssh exit
+66)" instead of "nothing is at this path". A test now runs the real frame through
+a real `/bin/sh`.
+
+⚠️ One ssh connection per call. Pass `sshArgs: ['-o', 'ControlMaster=auto', …]`
+to opt into your own multiplexing socket; the kit does not create one behind
+your back, because a stale socket outliving the deploy is a surprise nobody
+declared.
+
+## `Host.Directory`
+
+Every file resource refuses to create a parent, on purpose — creating one would
+invent an owner and a mode nobody declared. This is the declaration that was
+missing.
+
+```ts
+HostDirectory('app-etc', { path: '/opt/app/etc', mode: 0o750, owner: 'app' });
+```
+
+- ⛔ **One directory, never a chain.** A missing parent is a refusal that names
+  it, so a tree is a chain of declarations whose modes are all in the plan.
+- ⛔ **Delete is `rmdir`.** A directory that still holds files is a refusal;
+  removing a declaration must not remove data the declaration never mentioned.
+- `mkdir -m` carries the mode, so a umask never masks a declared bit.
+
+## `Remote.File`
+
+Whole-file mode is `Host.File` on Linux: content, mode, owner, group, an atomic
+write (stage beside the target, chown, chmod, rename) and a read-back.
+
+### Managed regions
+
+```ts
+RemoteFile('ssh-block', {
+  path: '/etc/example.conf',
+  region: { name: 'homeflare-example' }, // comment defaults to '#'
+  content: 'one declared line\n',
+});
+```
+
+produces, at the end of a file this resource does **not** own:
+
+```
+# BEGIN homeflare-example
+one declared line
+# END homeflare-example
+```
+
+- ⛔ **Every byte outside the markers is identical.** Not re-indented, not
+  re-terminated. That is the whole reason the file's real owner tolerates this,
+  and it is what `region.test.ts` asserts.
+- ⛔ **Drift means the region, and nothing else.** A change elsewhere in the
+  file is not this resource's business and never plans an update — otherwise
+  the two owners fight on every deploy.
+- ⛔ **The file's own mode and owner are copied back**, never re-declared.
+  `mode`/`owner`/`group` are refused unless `create: true`.
+- ⛔ **Ambiguity is a refusal.** Two BEGIN markers, an END before its BEGIN, or
+  a BEGIN with no END each name the line rather than guess.
+- **Delete removes only the block**, leaving the rest byte-identical.
+- ⚠️ A file with no final newline gains exactly one when the block is appended.
+  That is the only byte added outside the block, and it is not taken back.
+
+⚠️ The write replaces the inode in both modes. A process holding the old file
+keeps reading it until it reopens, and a hard link stops tracking — the price of
+never leaving a torn file.
+
+## `Systemd.Unit` and `Systemd.Timer`
+
+```ts
+SystemdUnit('thing', {
+  name: 'thing.service',
+  sections: [
+    { name: 'Unit', lines: [['Description', 'a thing']] },
+    { name: 'Service', lines: [['ExecStart', '/usr/bin/thing']] },
+    { name: 'Install', lines: [['WantedBy', 'multi-user.target']] },
+  ],
+  restartOn: [config.sha256],
+});
+```
+
+### What a deploy does NOT do
+
+⛔ **It never mass-restarts.** A unit is restarted only when
+
+1. its own unit file's bytes changed, or
+2. state holds an older digest than the file does (a previous write landed and
+   its reload never ran), or
+3. systemd itself says `NeedDaemonReload=yes`, or
+4. a digest the declaration listed in `restartOn` changed.
+
+Nothing else. A re-run restarts nothing; an **adopted** unit that already
+matches is not restarted, reloaded or even started. That is what lets this
+family reach a host holding a vault, a clock or a UPS handler.
+
+⚠️ **The limit, stated plainly:** a hand edit of a file named in `restartOn` is
+_not_ noticed. The digest in state still matches what the stack declared, so the
+unit reads converged — the same limit the Mac side records.
+
+### The rest of the contract
+
+- Order is **write, `daemon-reload`, enable/disable, then start/stop/restart**.
+  systemd reads the unit file at reload, so a failed write leaves the old unit
+  running rather than leaving nothing running.
+- A failed start on a **create** removes the file this deploy wrote and reloads
+  again, so the next deploy starts clean; on an **update** the file stays and
+  state keeps the previous digest, so the next deploy retries.
+- ⛔ A **masked** unit is someone's decision, not drift: refused, never unmasked.
+- ⛔ Deleting the declaration **stops the service** — stop, disable, remove the
+  file, reload. A unit that must outlive its declaration is adopted, not deleted.
+- A name or directory change is a **delete-first replace**: two unit files for
+  one name cannot both be the one systemd reads. The new identity is checked
+  at plan time, read-only — valid, writable, not masked, unclaimed, and the
+  runner's own check on the new path — and the old unit must be deletable,
+  before that swap is promised. A file byte-identical to this render is the
+  declaration's own leftover, not someone else's unit. A rename the plan could
+  not see (a name still an Output) gets the same checks at apply, before the
+  old unit is stopped.
+
+### The directive set is systemd's, not the kit's
+
+There is no machine-readable schema of `systemd.unit(5)` directives to generate
+from, so `renderUnit` renders **sections and lines verbatim** and claims to know
+nothing about what the keys mean. What is validated is what an INI file must be
+true of, plus two structural rules proved by systemd's own output:
+
+- `enabled: true` needs an `[Install]` section — systemd's name for a unit file
+  without one is `UnitFileState=static`;
+- `enabled: true` needs a `directory` systemd searches by name. `systemctl
+enable <name>` looks the unit up by name, so a file in `/opt` is invisible to
+  it and the deploy would write, reload, and only then fail. The list is
+  `systemd-analyze unit-paths`, measured below;
+- a `.timer` needs a `[Timer]` section.
+
+⛔ **Enablement is read back, never claimed.** After `enable` the state is taken
+from `systemctl show`; a unit systemd still calls `static` or `disabled` is a
+refusal, not an `enabled: true` written into state. Otherwise the next plan would
+compare the declaration against itself.
+
+★ Run `systemd-analyze verify` on the host for the deep check.
+
+★ The exact commands, their output and what was **not** measured:
+[linux-host-measured.md](./linux-host-measured.md).