@homeflare/alchemy 0.15.0 → 0.19.1

package/src/proxmox/constraints.test.ts

@@ -14,13 +14,11 @@
 import { describe, expect, test } from 'bun:test';
 import * as Layer from 'effect/Layer';
 import { engineOver } from '../verify/fake-engine.ts';
+// ⚠️ The estate's own declarations live in constraints-live.test.ts — split at the 250-line cap.
 import { constraintsFor, formViolations } from './constraint-guard.ts';
 import { type EndpointConstraints, refusal, violations } from './constraints.ts';
 import type { PbsTarget } from './credentials.ts';
 import { fakePve, withoutBao } from './fake-pve.ts';
-import { createForm as datastoreCreateForm } from './pbs-datastore-form.ts';
-import { createBody as pruneCreateBody } from './pbs-prune-job-form.ts';
-import { createBody as syncCreateBody } from './pbs-sync-job-form.ts';
 import { PROXMOX_CONSTRAINTS, PROXMOX_CONSTRAINTS_DIGEST } from './generated/constraints/index.ts';
 import { PbsVerifyJob, PbsVerifyJobProvider } from './pbs-verify-job.ts';
 
@@ -71,11 +69,14 @@ describe('the v-r2-offsite failure, refused at plan instead of by the server', (
     // ⛔ THE ASSERTION THE INCIDENT IS ABOUT. A refusal after the POST is the server's own 400.
     expect(writes).toEqual([]);
     /**
-     * ⚠️ ONE CALL IS MADE, AND IT IS A GET. Measured 2026-09-22: Alchemy runs the provider's
-     *   `read` handler before `diff`, so the plan has already asked PBS whether the job exists by
-     *   the time the constraint is checked. Every call is a read; nothing is created or changed.
+     * ⚠️ EVERY CALL IS A READ, AND THERE ARE NOW TWO OF THEM. Measured 2026-09-22: Alchemy runs
+     *   the provider's `read` handler first, and `reconcile` reads again — the guard moved to
+     *   AFTER that second read the same day, because the read is the only thing that says whether
+     *   a create or an update is about to be made, and demanding the create form's required
+     *   parameters on an update refuses edits that were always legal (resource-guard.ts).
+     *   ⛔ THE COUNT IS NOT THE ASSERTION; THE METHOD IS. Nothing is created or changed.
      */
-    expect(calls.map((call) => call.method)).toEqual(['GET']);
+    expect(calls.map((call) => call.method)).toEqual(['GET', 'GET']);
   });
 
   test('128 characters is accepted and the create goes through', async () => {
@@ -202,59 +203,3 @@ describe('every rule kind, at and past its boundary', () => {
     expect(refusal(VERIFY, ['comment: at most 128 characters'])).toContain('generated/constraints');
   });
 });
-
-/**
- * ★ THE OTHER THREE PBS FAMILIES, WITH THE ESTATE'S OWN DECLARATIONS, AGAINST THEIR CREATE TABLE.
- *   The risk this feature carries is not the one it fixes: a table that refuses a declaration the
- *   vendor would have ACCEPTED blocks a deploy that was always legal, and the operator cannot tell
- *   that from a genuine violation. These are the jobs `homeflare-proxmox` actually declares
- *   (`prune-cluster-all`, `sync-all-to-r2`, the `r2-offsite` datastore), so a false positive in the
- *   presence check or a mistranslated pattern fails here rather than on a Sunday morning.
- */
-describe('the live PBS declarations pass their own create tables', () => {
-  test('prune, sync and datastore create forms have no violations', () => {
-    expect(
-      formViolations(
-        'pbs:POST /config/prune',
-        pruneCreateBody({
-          comment: 'cluster retention',
-          id: 'prune-cluster-all',
-          'keep-daily': 7,
-          'keep-last': 3,
-          'keep-monthly': 6,
-          'keep-weekly': 4,
-          schedule: 'sat 03:00',
-          store: 'cluster',
-          target: PBS,
-        }),
-        true,
-      ),
-    ).toEqual([]);
-    expect(
-      formViolations(
-        'pbs:POST /config/sync',
-        syncCreateBody({
-          comment: 'offsite copy to R2',
-          id: 'sync-all-to-r2',
-          'remote-store': 'r2-offsite',
-          schedule: 'mon 08:30',
-          store: 'cluster',
-          target: PBS,
-        }),
-        true,
-      ),
-    ).toEqual([]);
-    expect(
-      formViolations(
-        'pbs:POST /config/datastore',
-        datastoreCreateForm({
-          comment: 'offsite',
-          name: 'r2-offsite',
-          path: '/mnt/datastore/r2-offsite',
-          target: PBS,
-        }),
-        true,
-      ),
-    ).toEqual([]);
-  });
-});

package/src/proxmox/constraints.ts

@@ -18,13 +18,20 @@
  *   field. A props-level check would pass values the form then mangles, and would have to be
  *   written once per family — which is how the copy that forgets a field gets written.
  *
- * ⚠️ WHAT IT DELIBERATELY DOES NOT ENFORCE, so nobody reads a green plan as more than it is:
- *   - a `format` NAME (PVE's `pve-calendar-event`, `pve-node`, 216 of them): the name is a
+ * ⚠️ WHAT IT DELIBERATELY DOES NOT ENFORCE, so nobody reads a green plan as more than it is. The
+ *   full kind-by-kind table, with the counts measured over the 37 tabled endpoints, is in
+ *   codegen/README.md. The short version:
+ *   - a `format` NAME (PVE's `pve-calendar-event`, `pve-node`; 105 parameters here): the name is a
  *     validator PVE implements server-side and publishes nothing about. Recorded, never checked.
+ *   - a `format` OBJECT — PBS's `notify`, `tuning`, `maintenance-mode`, PVE's `bwlimit`; 10
+ *     parameters. It is a sub-schema for the inside of a PROPERTY STRING, and the packed keys
+ *     carry their own limits. Not flattened, because a rule about `notify` is not a rule about
+ *     `notify.gc`. ⛔ This is the largest remaining gap and it is a gap on purpose.
+ *   - `requires` (8 parameters): "this one needs that one". A dependency, not a value rule.
+ *   - `typetext` with nothing else, such as PBS `schedule`'s `<calendar-event>` (21 parameters).
+ *     The schema states a syntax it does not describe; a malformed schedule still reaches PBS.
  *   - a pattern the generator could not translate faithfully (codegen/pattern.ts). Recorded
  *     verbatim as `patternSource`, never checked.
- *   - PBS `schedule`, which carries `typetext: <calendar-event>` and NO pattern and NO maxLength.
- *     The schema cannot help there; a malformed schedule still reaches PBS.
  *   Each of those is a fact in the table rather than a guess, which is the rule this follows:
  *   if the vendor did not state it, it is not enforced and the table says so.
  */
@@ -39,13 +46,29 @@ export interface ParamConstraint {
   readonly minimum?: number;
   readonly maximum?: number;
   readonly enum?: readonly string[];
-  /** A JavaScript-safe translation. Absent when the vendor's dialect could not be carried over. */
+  /**
+   * A JavaScript-safe EQUIVALENT. Absent when the vendor's dialect could not be carried over.
+   *
+   * ⛔ NOT THE VENDOR'S SPELLING, AND FOR PVE NOT EVEN THE SAME SHAPE. PVE publishes the inside of
+   *   an anchored match and applies `m/^$pattern$/` itself (MEASURED in JSONSchema.pm), so the
+   *   generator anchors it here. Quote `patternSource` at a human, never this.
+   */
   readonly pattern?: string;
+  /** `m` when the vendor asked for multi-line. ⚠️ Dropping it enforces the wrong semantics. */
+  readonly patternFlags?: string;
   /** The vendor's own spelling, always — what a violation message quotes, and the audit trail. */
   readonly patternSource?: string;
   /** PVE's server-side validator name. Recorded so a reader knows what is NOT checked here. */
   readonly format?: string;
   readonly default?: string;
+  /**
+   * The value rules describe each ELEMENT of a repeated key, not one joined string.
+   *
+   * ⚠️ RECORDED, NOT BRANCHED ON. `violations` already checks every element of an array value, so
+   *   this changes no behaviour — it tells a reader of the generated table why a `maxLength` of 32
+   *   sits on a parameter that carries a list.
+   */
+  readonly each?: true;
 }
 
 export type EndpointConstraints = Readonly<Record<string, ParamConstraint>>;
@@ -82,7 +105,9 @@ const checkValue = (name: string, value: string, rule: ParamConstraint): string[
   if (rule.enum !== undefined && !rule.enum.includes(value)) {
     out.push(`${name}: must be one of ${rule.enum.join(', ')}`);
   }
-  if (rule.pattern !== undefined && !new RegExp(rule.pattern).test(value)) {
+  // ⚠️ `patternFlags` IS PASSED, NOT IGNORED. It carries the vendor's own `(?m)`; enforcing a
+  //   multi-line rule with single-line semantics refuses values the vendor accepts.
+  if (rule.pattern !== undefined && !new RegExp(rule.pattern, rule.patternFlags).test(value)) {
     out.push(`${name}: must match ${rule.patternSource ?? rule.pattern}`);
   }
   // ⚠️ NUMBER-NESS IS NOT CHECKED, ONLY THE BOUND. The form is strings by construction and a

package/src/proxmox/generated/constraints/index.ts

@@ -9,14 +9,38 @@
  */
 import type { EndpointConstraints } from '../../constraints.ts';
 import { PVE_ACCESS_CONSTRAINTS } from './pve-access.ts';
-import { PVE_CLUSTER_CONSTRAINTS } from './pve-cluster.ts';
+import { PVE_CLUSTER_BACKUP_CONSTRAINTS } from './pve-cluster-backup.ts';
+import { PVE_CLUSTER_CEPH_CONSTRAINTS } from './pve-cluster-ceph.ts';
+import { PVE_CLUSTER_FIREWALL_CONSTRAINTS } from './pve-cluster-firewall.ts';
+import { PVE_CLUSTER_HA_CONSTRAINTS } from './pve-cluster-ha.ts';
+import { PVE_CLUSTER_METRICS_CONSTRAINTS } from './pve-cluster-metrics.ts';
+import { PVE_CLUSTER_NOTIFICATIONS_CONSTRAINTS } from './pve-cluster-notifications.ts';
+import { PVE_CLUSTER_REPLICATION_CONSTRAINTS } from './pve-cluster-replication.ts';
+import { PVE_CLUSTER_SDN_CONSTRAINTS } from './pve-cluster-sdn.ts';
+import { PVE_NODES_CEPH_CONSTRAINTS } from './pve-nodes-ceph.ts';
+import { PVE_NODES_DISKS_CONSTRAINTS } from './pve-nodes-disks.ts';
+import { PVE_NODES_LXC_CONSTRAINTS } from './pve-nodes-lxc.ts';
+import { PVE_NODES_NETWORK_CONSTRAINTS } from './pve-nodes-network.ts';
+import { PVE_NODES_QEMU_CONSTRAINTS } from './pve-nodes-qemu.ts';
 import { PVE_POOLS_CONSTRAINTS } from './pve-pools.ts';
 import { PVE_STORAGE_CONSTRAINTS } from './pve-storage.ts';
 import { PBS_CONFIG_CONSTRAINTS } from './pbs-config.ts';
 
 export const PROXMOX_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>> = {
   ...PVE_ACCESS_CONSTRAINTS,
-  ...PVE_CLUSTER_CONSTRAINTS,
+  ...PVE_CLUSTER_BACKUP_CONSTRAINTS,
+  ...PVE_CLUSTER_CEPH_CONSTRAINTS,
+  ...PVE_CLUSTER_FIREWALL_CONSTRAINTS,
+  ...PVE_CLUSTER_HA_CONSTRAINTS,
+  ...PVE_CLUSTER_METRICS_CONSTRAINTS,
+  ...PVE_CLUSTER_NOTIFICATIONS_CONSTRAINTS,
+  ...PVE_CLUSTER_REPLICATION_CONSTRAINTS,
+  ...PVE_CLUSTER_SDN_CONSTRAINTS,
+  ...PVE_NODES_CEPH_CONSTRAINTS,
+  ...PVE_NODES_DISKS_CONSTRAINTS,
+  ...PVE_NODES_LXC_CONSTRAINTS,
+  ...PVE_NODES_NETWORK_CONSTRAINTS,
+  ...PVE_NODES_QEMU_CONSTRAINTS,
   ...PVE_POOLS_CONSTRAINTS,
   ...PVE_STORAGE_CONSTRAINTS,
   ...PBS_CONFIG_CONSTRAINTS,
@@ -28,4 +52,4 @@ export const PROXMOX_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>>
  * ★ A DIGEST OF THE DATA, NOT OF THE FILE TEXT, so reformatting is not a stale generation while
  *   changing a 128 to a 129 by hand is. `tests/schema-manifest.test.ts` recomputes it.
  */
-export const PROXMOX_CONSTRAINTS_DIGEST = '03f403e0c6b3cf7d';
+export const PROXMOX_CONSTRAINTS_DIGEST = '33b42b52d396c9e0';

package/src/proxmox/generated/constraints/pbs-config.ts

@@ -6,12 +6,17 @@
  *   sha256 274ab9f6fc075aea, read on a PBS host from
  *   /usr/share/doc/proxmox-backup/html/api-viewer/apidoc.js
  *
- * 10 of this product's 144 POST/PUT endpoints are tabled across all areas: the ones
+ * 16 of this product's 144 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *
  * ⚠️ A `patternSource` with no `pattern` beside it is a rule that could NOT be carried into a
  *   JavaScript RegExp faithfully (codegen/pattern.ts). It is recorded and NOT enforced.
+ * ⚠️ `pattern` IS NOT THE VENDOR'S SPELLING. For PVE it is anchored, because PVE applies
+ *   `m/^$pattern$/` itself (JSONSchema.pm); for PBS it is the vendor's own, which already
+ *   carries its anchors. `patternSource` is the spelling to quote at a human — param-rules.ts.
+ * ⚠️ `each: true` means the value rules describe every ELEMENT of a repeated key, because the
+ *   parameter is an array and stated its limits on `items`.
  */
 import type { EndpointConstraints } from '../../constraints.ts';
 
@@ -30,11 +35,37 @@ export const PBS_CONFIG_CONSTRAINTS: Readonly<Record<string, EndpointConstraints
     "notify-user": {"maxLength":64,"minLength":3,"pattern":"^(?:[^\\s:/\\x00-\\x1f\\x7f]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$","patternSource":"/^(?:[^\\s:/[:cntrl:]]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/","type":"string"},
     "path": {"maxLength":4096,"minLength":1,"required":true,"type":"string"},
   },
+  "pbs:POST /config/notifications/endpoints/sendmail": {
+    "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
+    "mailto": {"each":true,"maxLength":64,"minLength":2,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"array"},
+    "mailto-user": {"each":true,"maxLength":64,"minLength":2,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"array"},
+    "name": {"maxLength":32,"minLength":2,"pattern":"^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$","patternSource":"/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/","required":true,"type":"string"},
+    "origin": {"enum":["user-created","builtin","modified-builtin"],"type":"string"},
+  },
+  "pbs:POST /config/notifications/endpoints/smtp": {
+    "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
+    "from-address": {"required":true,"type":"string"},
+    "mailto": {"each":true,"maxLength":64,"minLength":2,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"array"},
+    "mailto-user": {"each":true,"maxLength":64,"minLength":2,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"array"},
+    "mode": {"default":"tls","enum":["insecure","starttls","tls"],"type":"string"},
+    "name": {"maxLength":32,"minLength":2,"pattern":"^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$","patternSource":"/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/","required":true,"type":"string"},
+    "origin": {"enum":["user-created","builtin","modified-builtin"],"type":"string"},
+    "port": {"maximum":65535,"minimum":0,"type":"integer"},
+    "server": {"required":true,"type":"string"},
+  },
+  "pbs:POST /config/notifications/endpoints/webhook": {
+    "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
+    "method": {"default":"post","enum":["post","put","get"],"required":true,"type":"string"},
+    "name": {"maxLength":32,"minLength":2,"pattern":"^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$","patternSource":"/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/","required":true,"type":"string"},
+    "origin": {"enum":["user-created","builtin","modified-builtin"],"type":"string"},
+    "url": {"pattern":"^https?://(?:(?:(?:(?:(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?)\\.)*(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?))|(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|\\[(?:(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))\\]))(?::(?:[0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?)|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))(?:/[^\u0000-\u001f]*)?$","patternSource":"/^https?://(?:(?:(?:(?:(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?)\\.)*(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?))|(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|\\[(?:(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))\\]))(?::(?:[0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?)|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))(?:/[^\u0000-\u001f]*)?$/","required":true,"type":"string"},
+  },
   "pbs:POST /config/notifications/matchers": {
     "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
     "mode": {"default":"all","enum":["all","any"],"type":"string"},
     "name": {"maxLength":32,"minLength":2,"pattern":"^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$","patternSource":"/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/","required":true,"type":"string"},
     "origin": {"enum":["user-created","builtin","modified-builtin"],"type":"string"},
+    "target": {"each":true,"maxLength":32,"minLength":2,"pattern":"^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$","patternSource":"/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/","type":"array"},
   },
   "pbs:POST /config/prune": {
     "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
@@ -52,6 +83,7 @@ export const PBS_CONFIG_CONSTRAINTS: Readonly<Record<string, EndpointConstraints
   },
   "pbs:POST /config/sync": {
     "active-encryption-key": {"maxLength":32,"minLength":3,"pattern":"^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$","patternSource":"/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/","type":"string"},
+    "associated-key": {"each":true,"maxLength":32,"minLength":3,"pattern":"^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$","patternSource":"/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/","type":"array"},
     "burst-in": {"maxLength":64,"minLength":1,"type":"string"},
     "burst-out": {"maxLength":64,"minLength":1,"type":"string"},
     "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
@@ -81,6 +113,7 @@ export const PBS_CONFIG_CONSTRAINTS: Readonly<Record<string, EndpointConstraints
   },
   "pbs:PUT /config/datastore/{name}": {
     "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
+    "delete": {"each":true,"enum":["comment","gc-schedule","gc-on-unmount","prune-schedule","keep-last","keep-hourly","keep-daily","keep-weekly","keep-monthly","keep-yearly","verify-new","notify-user","notify","notification-mode","tuning","maintenance-mode","notification-thresholds","counter-reset-schedule"],"type":"array"},
     "digest": {"pattern":"^[a-f0-9]{64}$","patternSource":"/^[a-f0-9]{64}$/","type":"string"},
     "keep-daily": {"minimum":1,"type":"integer"},
     "keep-hourly": {"minimum":1,"type":"integer"},
@@ -91,13 +124,39 @@ export const PBS_CONFIG_CONSTRAINTS: Readonly<Record<string, EndpointConstraints
     "notification-mode": {"default":"notification-system","enum":["legacy-sendmail","notification-system"],"type":"string"},
     "notify-user": {"maxLength":64,"minLength":3,"pattern":"^(?:[^\\s:/\\x00-\\x1f\\x7f]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$","patternSource":"/^(?:[^\\s:/[:cntrl:]]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/","type":"string"},
   },
+  "pbs:PUT /config/notifications/endpoints/sendmail/{name}": {
+    "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
+    "delete": {"each":true,"enum":["author","comment","disable","from-address","mailto","mailto-user"],"type":"array"},
+    "digest": {"pattern":"^[a-f0-9]{64}$","patternSource":"/^[a-f0-9]{64}$/","type":"string"},
+    "mailto": {"each":true,"maxLength":64,"minLength":2,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"array"},
+    "mailto-user": {"each":true,"maxLength":64,"minLength":2,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"array"},
+  },
+  "pbs:PUT /config/notifications/endpoints/smtp/{name}": {
+    "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
+    "delete": {"each":true,"enum":["author","comment","disable","mailto","mailto-user","password","port","username"],"type":"array"},
+    "digest": {"pattern":"^[a-f0-9]{64}$","patternSource":"/^[a-f0-9]{64}$/","type":"string"},
+    "mailto": {"each":true,"maxLength":64,"minLength":2,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"array"},
+    "mailto-user": {"each":true,"maxLength":64,"minLength":2,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"array"},
+    "mode": {"default":"tls","enum":["insecure","starttls","tls"],"type":"string"},
+    "port": {"maximum":65535,"minimum":0,"type":"integer"},
+  },
+  "pbs:PUT /config/notifications/endpoints/webhook/{name}": {
+    "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
+    "delete": {"each":true,"enum":["comment","disable","header","body","secret"],"type":"array"},
+    "digest": {"pattern":"^[a-f0-9]{64}$","patternSource":"/^[a-f0-9]{64}$/","type":"string"},
+    "method": {"default":"post","enum":["post","put","get"],"type":"string"},
+    "url": {"pattern":"^https?://(?:(?:(?:(?:(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?)\\.)*(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?))|(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|\\[(?:(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))\\]))(?::(?:[0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?)|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))(?:/[^\u0000-\u001f]*)?$","patternSource":"/^https?://(?:(?:(?:(?:(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?)\\.)*(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?))|(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|\\[(?:(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))\\]))(?::(?:[0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?)|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))(?:/[^\u0000-\u001f]*)?$/","type":"string"},
+  },
   "pbs:PUT /config/notifications/matchers/{name}": {
     "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
+    "delete": {"each":true,"enum":["comment","disable","invert-match","match-calendar","match-field","match-severity","mode","target"],"type":"array"},
     "digest": {"pattern":"^[a-f0-9]{64}$","patternSource":"/^[a-f0-9]{64}$/","type":"string"},
     "mode": {"default":"all","enum":["all","any"],"type":"string"},
+    "target": {"each":true,"maxLength":32,"minLength":2,"pattern":"^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$","patternSource":"/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/","type":"array"},
   },
   "pbs:PUT /config/prune/{id}": {
     "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
+    "delete": {"each":true,"enum":["comment","disable","ns","max-depth","keep-last","keep-hourly","keep-daily","keep-weekly","keep-monthly","keep-yearly"],"type":"array"},
     "digest": {"pattern":"^[a-f0-9]{64}$","patternSource":"/^[a-f0-9]{64}$/","type":"string"},
     "keep-daily": {"minimum":1,"type":"integer"},
     "keep-hourly": {"minimum":1,"type":"integer"},
@@ -111,9 +170,11 @@ export const PBS_CONFIG_CONSTRAINTS: Readonly<Record<string, EndpointConstraints
   },
   "pbs:PUT /config/sync/{id}": {
     "active-encryption-key": {"maxLength":32,"minLength":3,"pattern":"^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$","patternSource":"/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/","type":"string"},
+    "associated-key": {"each":true,"maxLength":32,"minLength":3,"pattern":"^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$","patternSource":"/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/","type":"array"},
     "burst-in": {"maxLength":64,"minLength":1,"type":"string"},
     "burst-out": {"maxLength":64,"minLength":1,"type":"string"},
     "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
+    "delete": {"each":true,"enum":["remote","owner","comment","schedule","remove-vanished","group-filter","rate-in","burst-in","rate-out","burst-out","ns","remote-ns","max-depth","transfer-last","encrypted-only","verified-only","run-on-mount","unmount-on-done","sync-direction","worker-threads","active-encryption-key","associated-key"],"type":"array"},
     "digest": {"pattern":"^[a-f0-9]{64}$","patternSource":"/^[a-f0-9]{64}$/","type":"string"},
     "max-depth": {"maximum":7,"minimum":0,"type":"integer"},
     "ns": {"maxLength":256,"pattern":"^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$","patternSource":"/^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$/","type":"string"},
@@ -130,6 +191,7 @@ export const PBS_CONFIG_CONSTRAINTS: Readonly<Record<string, EndpointConstraints
   },
   "pbs:PUT /config/verify/{id}": {
     "comment": {"maxLength":128,"pattern":"^[^\\x00-\\x1f\\x7f]*$","patternSource":"/^[[:^cntrl:]]*$/","type":"string"},
+    "delete": {"each":true,"enum":["ignore-verified","comment","schedule","outdated-after","ns","max-depth","read-threads","verify-threads"],"type":"array"},
     "digest": {"pattern":"^[a-f0-9]{64}$","patternSource":"/^[a-f0-9]{64}$/","type":"string"},
     "max-depth": {"default":"7","maximum":7,"minimum":0,"type":"integer"},
     "ns": {"maxLength":256,"pattern":"^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$","patternSource":"/^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$/","type":"string"},

package/src/proxmox/generated/constraints/pve-access.ts

@@ -6,12 +6,17 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 27 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *
  * ⚠️ A `patternSource` with no `pattern` beside it is a rule that could NOT be carried into a
  *   JavaScript RegExp faithfully (codegen/pattern.ts). It is recorded and NOT enforced.
+ * ⚠️ `pattern` IS NOT THE VENDOR'S SPELLING. For PVE it is anchored, because PVE applies
+ *   `m/^$pattern$/` itself (JSONSchema.pm); for PBS it is the vendor's own, which already
+ *   carries its anchors. `patternSource` is the spelling to quote at a human — param-rules.ts.
+ * ⚠️ `each: true` means the value rules describe every ELEMENT of a repeated key, because the
+ *   parameter is an array and stated its limits on `items`.
  */
 import type { EndpointConstraints } from '../../constraints.ts';
 
@@ -29,11 +34,14 @@ export const PVE_ACCESS_CONSTRAINTS: Readonly<Record<string, EndpointConstraints
     "expire": {"minimum":0,"type":"integer"},
     "firstname": {"maxLength":1024,"type":"string"},
     "groups": {"format":"pve-groupid-list","type":"string"},
-    "keys": {"pattern":"[0-9a-zA-Z!=]{0,4096}","patternSource":"[0-9a-zA-Z!=]{0,4096}","type":"string"},
+    "keys": {"pattern":"^[0-9a-zA-Z!=]{0,4096}\\n?$","patternSource":"[0-9a-zA-Z!=]{0,4096}","type":"string"},
     "lastname": {"maxLength":1024,"type":"string"},
     "password": {"maxLength":64,"minLength":8,"type":"string"},
     "userid": {"format":"pve-userid","maxLength":64,"required":true,"type":"string"},
   },
+  "pve:POST /access/users/{userid}/token/{tokenid}": {
+    "expire": {"default":"same as user","minimum":0,"type":"integer"},
+  },
   "pve:PUT /access/acl": {
     "groups": {"format":"pve-groupid-list","type":"string"},
     "path": {"required":true,"type":"string"},
@@ -51,7 +59,11 @@ export const PVE_ACCESS_CONSTRAINTS: Readonly<Record<string, EndpointConstraints
     "expire": {"minimum":0,"type":"integer"},
     "firstname": {"maxLength":1024,"type":"string"},
     "groups": {"format":"pve-groupid-list","type":"string"},
-    "keys": {"pattern":"[0-9a-zA-Z!=]{0,4096}","patternSource":"[0-9a-zA-Z!=]{0,4096}","type":"string"},
+    "keys": {"pattern":"^[0-9a-zA-Z!=]{0,4096}\\n?$","patternSource":"[0-9a-zA-Z!=]{0,4096}","type":"string"},
     "lastname": {"maxLength":1024,"type":"string"},
   },
+  "pve:PUT /access/users/{userid}/token/{tokenid}": {
+    "delete": {"format":"pve-configid-list","type":"string"},
+    "expire": {"default":"same as user","minimum":0,"type":"integer"},
+  },
 };

package/src/proxmox/generated/constraints/pve-cluster-backup.ts

@@ -0,0 +1,74 @@
+/**
+ * Generated pve-manager parameter constraints for `/cluster/backup` — DO NOT EDIT BY HAND.
+ *
+ * Run: bun codegen/constraints.ts
+ * Manifest entry: `pve-apidoc` — pve-manager 9.2.11/f6997e698c7933ea
+ *   sha256 9def8f13611184ee, read on a PVE cluster node from
+ *   /usr/share/pve-docs/api-viewer/apidoc.js
+ *
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
+ * and therefore unchecked at plan time.
+ *
+ * ⚠️ A `patternSource` with no `pattern` beside it is a rule that could NOT be carried into a
+ *   JavaScript RegExp faithfully (codegen/pattern.ts). It is recorded and NOT enforced.
+ * ⚠️ `pattern` IS NOT THE VENDOR'S SPELLING. For PVE it is anchored, because PVE applies
+ *   `m/^$pattern$/` itself (JSONSchema.pm); for PBS it is the vendor's own, which already
+ *   carries its anchors. `patternSource` is the spelling to quote at a human — param-rules.ts.
+ * ⚠️ `each: true` means the value rules describe every ELEMENT of a repeated key, because the
+ *   parameter is an array and stated its limits on `items`.
+ */
+import type { EndpointConstraints } from '../../constraints.ts';
+
+export const PVE_CLUSTER_BACKUP_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>> = {
+  "pve:POST /cluster/backup": {
+    "bwlimit": {"default":"0","minimum":0,"type":"integer"},
+    "comment": {"maxLength":512,"type":"string"},
+    "compress": {"default":"0","enum":["0","1","gzip","lzo","zstd"],"type":"string"},
+    "dow": {"default":"mon,tue,wed,thu,fri,sat,sun","format":"pve-day-of-week-list","type":"string"},
+    "exclude": {"format":"pve-vmid-list","type":"string"},
+    "fleecing": {"format":"backup-fleecing","type":"string"},
+    "id": {"format":"pve-configid","type":"string"},
+    "ionice": {"default":"7","maximum":8,"minimum":0,"type":"integer"},
+    "lockwait": {"default":"180","minimum":0,"type":"integer"},
+    "mailnotification": {"default":"always","enum":["always","failure"],"type":"string"},
+    "mailto": {"format":"email-or-username-list","type":"string"},
+    "mode": {"default":"snapshot","enum":["snapshot","suspend","stop"],"type":"string"},
+    "node": {"format":"pve-node","type":"string"},
+    "notes-template": {"maxLength":1024,"type":"string"},
+    "notification-mode": {"default":"auto","enum":["auto","legacy-sendmail","notification-system"],"type":"string"},
+    "pbs-change-detection-mode": {"enum":["legacy","data","metadata"],"type":"string"},
+    "performance": {"format":"backup-performance","type":"string"},
+    "prune-backups": {"default":"keep-all=1","format":"prune-backups","type":"string"},
+    "schedule": {"format":"pve-calendar-event","maxLength":128,"type":"string"},
+    "starttime": {"pattern":"^\\d{1,2}:\\d{1,2}\\n?$","patternSource":"\\d{1,2}:\\d{1,2}","type":"string"},
+    "stopwait": {"default":"10","minimum":0,"type":"integer"},
+    "storage": {"format":"pve-storage-id","type":"string"},
+    "vmid": {"format":"pve-vmid-list","type":"string"},
+  },
+  "pve:PUT /cluster/backup/{id}": {
+    "bwlimit": {"default":"0","minimum":0,"type":"integer"},
+    "comment": {"maxLength":512,"type":"string"},
+    "compress": {"default":"0","enum":["0","1","gzip","lzo","zstd"],"type":"string"},
+    "delete": {"format":"pve-configid-list","type":"string"},
+    "dow": {"format":"pve-day-of-week-list","type":"string"},
+    "exclude": {"format":"pve-vmid-list","type":"string"},
+    "fleecing": {"format":"backup-fleecing","type":"string"},
+    "ionice": {"default":"7","maximum":8,"minimum":0,"type":"integer"},
+    "lockwait": {"default":"180","minimum":0,"type":"integer"},
+    "mailnotification": {"default":"always","enum":["always","failure"],"type":"string"},
+    "mailto": {"format":"email-or-username-list","type":"string"},
+    "mode": {"default":"snapshot","enum":["snapshot","suspend","stop"],"type":"string"},
+    "node": {"format":"pve-node","type":"string"},
+    "notes-template": {"maxLength":1024,"type":"string"},
+    "notification-mode": {"default":"auto","enum":["auto","legacy-sendmail","notification-system"],"type":"string"},
+    "pbs-change-detection-mode": {"enum":["legacy","data","metadata"],"type":"string"},
+    "performance": {"format":"backup-performance","type":"string"},
+    "prune-backups": {"default":"keep-all=1","format":"prune-backups","type":"string"},
+    "schedule": {"format":"pve-calendar-event","maxLength":128,"type":"string"},
+    "starttime": {"pattern":"^\\d{1,2}:\\d{1,2}\\n?$","patternSource":"\\d{1,2}:\\d{1,2}","type":"string"},
+    "stopwait": {"default":"10","minimum":0,"type":"integer"},
+    "storage": {"format":"pve-storage-id","type":"string"},
+    "vmid": {"format":"pve-vmid-list","type":"string"},
+  },
+};

package/src/proxmox/generated/constraints/pve-cluster-ceph.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated pve-manager parameter constraints for `/cluster/ceph` — DO NOT EDIT BY HAND.
+ *
+ * Run: bun codegen/constraints.ts
+ * Manifest entry: `pve-apidoc` — pve-manager 9.2.11/f6997e698c7933ea
+ *   sha256 9def8f13611184ee, read on a PVE cluster node from
+ *   /usr/share/pve-docs/api-viewer/apidoc.js
+ *
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
+ * and therefore unchecked at plan time.
+ *
+ * ⚠️ A `patternSource` with no `pattern` beside it is a rule that could NOT be carried into a
+ *   JavaScript RegExp faithfully (codegen/pattern.ts). It is recorded and NOT enforced.
+ * ⚠️ `pattern` IS NOT THE VENDOR'S SPELLING. For PVE it is anchored, because PVE applies
+ *   `m/^$pattern$/` itself (JSONSchema.pm); for PBS it is the vendor's own, which already
+ *   carries its anchors. `patternSource` is the spelling to quote at a human — param-rules.ts.
+ * ⚠️ `each: true` means the value rules describe every ELEMENT of a repeated key, because the
+ *   parameter is an array and stated its limits on `items`.
+ */
+import type { EndpointConstraints } from '../../constraints.ts';
+
+export const PVE_CLUSTER_CEPH_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>> = {
+  "pve:PUT /cluster/ceph/flags/{flag}": {
+    "value": {"required":true,"type":"boolean"},
+  },
+};

package/src/proxmox/generated/constraints/pve-cluster-firewall.ts

@@ -0,0 +1,35 @@
+/**
+ * Generated pve-manager parameter constraints for `/cluster/firewall` — DO NOT EDIT BY HAND.
+ *
+ * Run: bun codegen/constraints.ts
+ * Manifest entry: `pve-apidoc` — pve-manager 9.2.11/f6997e698c7933ea
+ *   sha256 9def8f13611184ee, read on a PVE cluster node from
+ *   /usr/share/pve-docs/api-viewer/apidoc.js
+ *
+ * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
+ * and therefore unchecked at plan time.
+ *
+ * ⚠️ A `patternSource` with no `pattern` beside it is a rule that could NOT be carried into a
+ *   JavaScript RegExp faithfully (codegen/pattern.ts). It is recorded and NOT enforced.
+ * ⚠️ `pattern` IS NOT THE VENDOR'S SPELLING. For PVE it is anchored, because PVE applies
+ *   `m/^$pattern$/` itself (JSONSchema.pm); for PBS it is the vendor's own, which already
+ *   carries its anchors. `patternSource` is the spelling to quote at a human — param-rules.ts.
+ * ⚠️ `each: true` means the value rules describe every ELEMENT of a repeated key, because the
+ *   parameter is an array and stated its limits on `items`.
+ */
+import type { EndpointConstraints } from '../../constraints.ts';
+
+export const PVE_CLUSTER_FIREWALL_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>> = {
+  "pve:POST /cluster/firewall/aliases": {
+    "cidr": {"format":"IPorCIDR","required":true,"type":"string"},
+    "comment": {"format":"pve-fw-comment-spec","type":"string"},
+    "name": {"maxLength":64,"minLength":2,"pattern":"^[A-Za-z][A-Za-z0-9\\-\\_]+\\n?$","patternSource":"[A-Za-z][A-Za-z0-9\\-\\_]+","required":true,"type":"string"},
+  },
+  "pve:PUT /cluster/firewall/aliases/{name}": {
+    "cidr": {"format":"IPorCIDR","required":true,"type":"string"},
+    "comment": {"format":"pve-fw-comment-spec","type":"string"},
+    "digest": {"maxLength":64,"type":"string"},
+    "rename": {"maxLength":64,"minLength":2,"pattern":"^[A-Za-z][A-Za-z0-9\\-\\_]+\\n?$","patternSource":"[A-Za-z][A-Za-z0-9\\-\\_]+","type":"string"},
+  },
+};