@homeflare/alchemy 0.15.0 → 0.19.1

package/dist/linux/unit-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unit-preflight.d.ts","sourceRoot":"","sources":["../../src/linux/unit-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,KAAK,UAAU,EAAY,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAMtB,MAAM,gBAAgB,CAAC;AAKxB,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAW,gBAAgB,WAAW,MAAM,KAAG,IAGtE,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,cAAc,WAAY,UAAU,QAAQ,MAAM,KAAG,IAOjE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,UAAW,gBAAgB,UAAU,UAAU,KAAG,IAQ1E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAClB,UAAU,SACX,gBAAgB,KACtB,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,WACpB,UAAU,QACZ,gBAAgB,OACjB,qBAAqB,WACjB,MAAM,KACd,OAAO,CAAC,IAAI,CAOd,CAAC"}

package/dist/linux/unit-settle.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The step that decides whether anything on the host actually moves: enablement, running state and
+ * — only for a real change — a restart. Split from unit-lifecycle.ts because it is the rule the
+ * whole family exists to keep, and it should be readable on its own.
+ *
+ * ⛔ THE RESTART CONDITION IS THE WHOLE CONTRACT. `changed` is set by the caller from the four
+ *   things that earn one (unit-lifecycle.ts reconcileUnit); `configChanged` is a digest the
+ *   DECLARATION itself listed. Nothing else restarts a unit — not a re-run, not an unrelated
+ *   resource in the same deploy, not `--adopt`.
+ */
+import type { HostRunner } from '../launchd/runner.ts';
+import { type SystemdUnitAttributes, type SystemdUnitProps } from './unit-form.ts';
+import { type UnitStatus } from './systemctl.ts';
+export declare const refuse: (name: string, message: string) => Error;
+export declare const attributesOf: (props: SystemdUnitProps, unitSha256: string, status: UnitStatus) => SystemdUnitAttributes;
+export type Settle = {
+    readonly before: Uint8Array | undefined;
+    /** The unit file or systemd's view of it changed in a way that earns a restart. */
+    readonly changed: boolean;
+    readonly configChanged: boolean;
+    readonly desired: string;
+    readonly path: string;
+    readonly status: UnitStatus;
+};
+/**
+ * Bring enablement and running state to the declaration, restarting ONLY for a real change.
+ * ⛔ THE RESTART CONDITION IS THE WHOLE CONTRACT: the unit file changed, or a digest the caller
+ *   listed changed. Nothing else — not a re-run, not an unrelated resource, not `--adopt`.
+ */
+export declare const settle: (runner: HostRunner, props: SystemdUnitProps, step: Settle) => Promise<SystemdUnitAttributes>;
+//# sourceMappingURL=unit-settle.d.ts.map

package/dist/linux/unit-settle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unit-settle.d.ts","sourceRoot":"","sources":["../../src/linux/unit-settle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,UAAU,EAQhB,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,MAAM,SAAU,MAAM,WAAW,MAAM,KAAG,KACR,CAAC;AAEhD,eAAO,MAAM,YAAY,UAChB,gBAAgB,cACX,MAAM,UACV,UAAU,KACjB,qBAUD,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,MAAM,WACT,UAAU,SACX,gBAAgB,QACjB,MAAM,KACX,OAAO,CAAC,qBAAqB,CA2C/B,CAAC"}

package/dist/linux/unit.d.ts

@@ -0,0 +1,35 @@
+/**
+ * `Systemd.Unit` and `Systemd.Timer` — one systemd unit file and systemd's view of it, declared.
+ *
+ * - create / update — write the unit file atomically, `daemon-reload`, enable or disable, then
+ *   start, stop, or RESTART ONLY when something actually changed (unit-lifecycle.ts settle).
+ * - read — the unit file's SHA-256 plus `systemctl show` (load state, active state, enablement).
+ * - diff — the rendered digest against the stored AND the on-disk one, the declared enablement and
+ *   running state against systemd's, and systemd's own `NeedDaemonReload`.
+ * - replace — only when the unit's name or directory changes, and DELETE FIRST: two unit files for
+ *   one name cannot both be the one systemd reads.
+ * - delete — stop, disable, remove the file, reload.
+ *
+ * ⛔ A DEPLOY NEVER MASS-RESTARTS — see the ⛔ at the top of unit-lifecycle.ts. It is the property
+ *   that lets this family reach a host holding a vault, a clock or a UPS handler.
+ * ⛔ THE UNIT FILE IS NEVER A SECRET (unit-form.ts): it is 0644 and its props sit in state.
+ * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`. A unit already on the host reads as `Unowned`; adopting
+ *   one that already matches the declaration does not restart it.
+ * ★ TWO RESOURCES, ONE LIFECYCLE. A timer is a unit whose file ends `.timer` and carries a
+ *   `[Timer]` section; splitting the TYPE rather than the code means a plan says which of the two
+ *   a row is, and a `.service` declared as a timer is a refusal instead of a puzzle.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import { HostRunnerService } from '../launchd/runner.ts';
+import type { SystemdUnitAttributes, SystemdUnitProps } from './unit-form.ts';
+export type { SystemdUnitAttributes, SystemdUnitProps, UnitSection } from './unit-form.ts';
+export interface SystemdUnit extends Resource<'Systemd.Unit', SystemdUnitProps, SystemdUnitAttributes> {
+}
+export interface SystemdTimer extends Resource<'Systemd.Timer', SystemdUnitProps, SystemdUnitAttributes> {
+}
+export declare const SystemdUnit: import("alchemy").ResourceClass<SystemdUnit>;
+export declare const SystemdTimer: import("alchemy").ResourceClass<SystemdTimer>;
+export declare const SystemdUnitProvider: () => import("effect/Layer").Layer<Provider.Provider<SystemdUnit>, never, HostRunnerService>;
+export declare const SystemdTimerProvider: () => import("effect/Layer").Layer<Provider.Provider<SystemdTimer>, never, HostRunnerService>;
+//# sourceMappingURL=unit.d.ts.map

package/dist/linux/unit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unit.d.ts","sourceRoot":"","sources":["../../src/linux/unit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE3F,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,gBAAgB,EAChB,qBAAqB,CACtB;CAAG;AAEJ,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,gBAAgB,EAChB,qBAAqB,CACtB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AACjE,eAAO,MAAM,YAAY,+CAA0C,CAAC;AAEpE,eAAO,MAAM,mBAAmB,8FAkB7B,CAAC;AAEJ,eAAO,MAAM,oBAAoB,+FAe9B,CAAC"}

package/dist/netbox/client.d.ts

@@ -0,0 +1,52 @@
+/**
+ * One authenticated call to the NetBox REST API at `/api`.
+ *
+ * ⚠️ `Authorization: Token <value>`, NOT `Bearer`. NetBox is Django REST Framework using DRF's own
+ *   `TokenAuthentication`. MEASURED on this estate's own instance while it was up: `Bearer`
+ *   returns 401 and `Token` returns 200. ⛔ A wrong scheme and a wrong credential are
+ *   indistinguishable in the response, which is why this is written down rather than inferred.
+ *
+ * ⚠️ NETBOX DOES NOT WRAP A DETAIL RESPONSE THE WAY PVE DOES — a GET of one object returns the
+ *   object. A LIST, however, IS wrapped: `{count, next, previous, results: [...]}`. A caller that
+ *   treats a list like a detail sees `undefined` and calls a healthy object absent, which plans a
+ *   create over something that already exists.
+ *
+ * ⛔ THE TOKEN IS NEVER A PROP. It is read from `NETBOX_TOKEN` at call time only. Alchemy persists
+ *   attributes unencrypted; nothing stored here may be a credential.
+ */
+import * as Effect from 'effect/Effect';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
+/**
+ * The instance, from `NETBOX_URL`. Trailing slash stripped.
+ *
+ * ⛔ NO DEFAULT HOSTNAME AND NO DEFAULT PORT. A published package that fell back to a loopback
+ *   address would let a consumer who forgot the variable watch every call fail against a machine
+ *   that is not theirs, instead of being told which variable is missing.
+ * ⚠️ Read at CALL time, never at module scope — a value captured at import is pinned to whatever
+ *   the first isolate saw.
+ */
+export declare const apiBase: () => string;
+export declare class NetboxError extends Error {
+    readonly status: number;
+    readonly method: string;
+    readonly path: string;
+    constructor(status: number, method: string, path: string, detail: string);
+}
+/** A NetBox list response. ⚠️ Paginated: `next` is a URL, not a cursor to guess at. */
+export interface NetboxList<T> {
+    readonly count: number;
+    readonly next: string | null;
+    readonly results: readonly T[];
+}
+export type NetboxRow = Record<string, unknown>;
+/** One JSON call. Returns the parsed body, or `undefined` when the response is empty (DELETE). */
+export declare const netbox: <T>(method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', path: string, body?: Record<string, unknown>) => Effect.Effect<T, NetboxError, HttpClient.HttpClient>;
+/**
+ * The single row a filtered list returns, or `undefined`.
+ *
+ * ⛔ MORE THAN ONE MATCH IS A DEFECT, NOT A REASON TO TAKE THE FIRST. A `locate` filter that is
+ *   not unique would let adopt bind to whichever row NetBox happened to order first, and the next
+ *   plan would bind to the other one and report drift that is not there.
+ */
+export declare const soleMatch: <T>(rows: readonly T[], describe: string) => T | undefined;
+//# sourceMappingURL=client.d.ts.map

package/dist/netbox/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/netbox/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAK9D;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,QAAO,MAQ1B,CAAC;AAEF,qBAAa,WAAY,SAAQ,KAAK;IAElC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EAIf;CACF;AAkBD,uFAAuF;AACvF,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;CAChC;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,kGAAkG;AAClG,eAAO,MAAM,MAAM,GAAI,CAAC,UACd,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,QAC7C,MAAM,SACL,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,yDA8C5B,CAAC;AAEL;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,QAAQ,SAAS,CAAC,EAAE,YAAY,MAAM,KAAG,CAAC,GAAG,SAQvE,CAAC"}

package/dist/netbox/constraint-guard.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The generated tables, looked up by endpoint, and the refusal that stops a plan.
+ *
+ * ★ ONE FILE BETWEEN THE PROVIDERS AND THE GENERATED DATA, so `resource.ts` gains three lines
+ *   rather than an import of the generated module and a merge, and so a family that writes its
+ *   own handlers reaches the same check by the same name.
+ *
+ * ⛔ AN UNKNOWN KEY IS A DEFECT, NOT A REASON TO SKIP THE CHECK. Silently passing would put us
+ *   back where this started: a declaration nothing checked, and a plan that says so in no way at
+ *   all. The generator resolves every key in its source scan against the vendor document, so a
+ *   key that is absent here means the tables were not regenerated — which the message says.
+ */
+import * as Effect from 'effect/Effect';
+import { type EndpointConstraints, type EndpointKey, type NetboxBody } from './constraints.ts';
+import { NETBOX_CONSTRAINTS } from './generated/constraints/index.ts';
+export { NETBOX_CONSTRAINTS };
+export declare const constraintsFor: (key: EndpointKey) => EndpointConstraints;
+/** Every vendor rule this body breaks. Pure — a test calls it with a literal body. */
+export declare const bodyViolations: (key: EndpointKey, body: NetboxBody, presence: boolean) => readonly string[];
+/**
+ * ⛔ `Effect.die`, NOT `Effect.fail`. A declaration the vendor would reject is a DEFECT in the
+ *   stack file, not a recoverable condition: there is no retry and no fallback that makes a
+ *   201-character description legal.
+ */
+export declare const guardBody: (key: EndpointKey | undefined, body: NetboxBody, presence: boolean) => Effect.Effect<void>;
+//# sourceMappingURL=constraint-guard.d.ts.map

package/dist/netbox/constraint-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraint-guard.d.ts","sourceRoot":"","sources":["../../src/netbox/constraint-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,UAAU,EAGhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,eAAO,MAAM,cAAc,QAAS,WAAW,KAAG,mBASjD,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,cAAc,QACpB,WAAW,QACV,UAAU,YACN,OAAO,KAChB,SAAS,MAAM,EAAyD,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,SAAS,QACf,WAAW,GAAG,SAAS,QACtB,UAAU,YACN,OAAO,KAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAKjB,CAAC"}

package/dist/netbox/constraints.d.ts

@@ -0,0 +1,76 @@
+/**
+ * NetBox's own rules, checked here, before the request is built.
+ *
+ * 🔴 THE INCIDENT THIS PATTERN EXISTS FOR, 2026-09-22 (Proxmox, not NetBox). `homeflare-proxmox`'s
+ *   first `deploy:pbs` adopted ten objects and then failed its one create:
+ *   `comment: value may only be 128 characters long`. Half a deploy in, on the server, from a
+ *   limit the vendor publishes in its own schema and the generated type did not carry. Plan was
+ *   green, `bun run check` was green, the adopt verifier was green. ★ NetBox gets the same
+ *   treatment BEFORE its first write rather than after it.
+ *
+ * ★ SO THE TABLE IS GENERATED AND THIS FILE IS THE READER. `generated/constraints/*` is emitted
+ *   from NetBox's own OpenAPI document by `bun codegen/netbox.ts`; nothing here is hand-typed,
+ *   because a hand-typed limit is tribal knowledge that does not run.
+ *
+ * ⛔ A SEPARATE READER FROM `../proxmox/constraints.ts`, AND IT IS NOT DUPLICATION. That one
+ *   checks a `PveForm` — every value already a string, because PVE takes form encoding. A NetBox
+ *   body is JSON: a number stays a number, a boolean stays a boolean, a foreign key is an
+ *   integer, and `String(value)` on any of them would make `minimum: 0` pass for `false` and
+ *   `maxLength` meaningless. Sharing one reader would mean stringifying at the door, which is
+ *   exactly the mangling the Proxmox version's own ⛔ warns about.
+ *
+ * ⚠️ WHAT IT DELIBERATELY DOES NOT ENFORCE, so nobody reads a green plan as more than it is:
+ *   - a `format` NAME (`uri`, `email`, `date-time`): a validator DRF implements server-side.
+ *     Recorded, never checked.
+ *   - a pattern the generator could not carry faithfully (codegen/py-pattern.ts). Recorded
+ *     verbatim as `patternSource`, never checked.
+ *   - UNIQUENESS, VRF containment, custom-field validators, and every other rule that lives in
+ *     Django rather than in the schema. Those still arrive as a server-side 400.
+ *   Each is a fact in the table rather than a guess, which is the rule this follows: if the
+ *   vendor did not state it, it is not enforced and the table says so.
+ */
+export interface ParamConstraint {
+    readonly type?: string;
+    /** From the schema's `required` array. ⚠️ Checked on CREATE only — see `violations`. */
+    readonly required?: boolean;
+    readonly maxLength?: number;
+    readonly minLength?: number;
+    readonly minimum?: number;
+    readonly maximum?: number;
+    readonly enum?: readonly string[];
+    /** A JavaScript-safe translation. Absent when Python's dialect could not be carried over. */
+    readonly pattern?: string;
+    /** The vendor's own spelling, always — what a violation message quotes, and the audit trail. */
+    readonly patternSource?: string;
+    /** DRF's server-side validator name. Recorded so a reader knows what is NOT checked here. */
+    readonly format?: string;
+    readonly default?: string;
+}
+export type EndpointConstraints = Readonly<Record<string, ParamConstraint>>;
+/** `netbox:POST /api/ipam/prefixes/` — exactly how the generated tables key an endpoint. */
+export type EndpointKey = string;
+/** A NetBox request body: JSON, with the types the schema declares. */
+export type NetboxBody = Record<string, unknown>;
+export interface ViolationOptions {
+    /**
+     * Check that every schema-required property is present.
+     *
+     * ⛔ CREATE ONLY. A NetBox update is a PATCH and is deliberately PARTIAL — it carries the fields
+     *   that changed and nothing else — so requiring presence there would refuse every ordinary
+     *   edit.
+     */
+    readonly presence?: boolean;
+}
+/**
+ * Every vendor rule this body breaks, in the order the properties are declared. Pure: no network,
+ * no clock, no environment — so `diff` can call it and a test can call it with a literal.
+ *
+ * ⚠️ A KEY THE TABLE DOES NOT MENTION IS NOT AN ERROR. The table carries the constrained
+ *   properties, not every property, and a body may legitimately send an unconstrained one.
+ * ⚠️ `null` IS A VALUE, NOT AN ABSENCE. NetBox uses explicit `null` to CLEAR a nullable foreign
+ *   key, so it must not trip the presence check — and no string or number rule applies to it.
+ */
+export declare const violations: (table: EndpointConstraints, body: NetboxBody, options?: ViolationOptions) => readonly string[];
+/** The message a plan dies with. ⛔ Names the endpoint, because the rule belongs to the vendor. */
+export declare const refusal: (endpoint: EndpointKey, found: readonly string[]) => string;
+//# sourceMappingURL=constraints.d.ts.map

package/dist/netbox/constraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraints.d.ts","sourceRoot":"","sources":["../../src/netbox/constraints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;AAE5E,4FAA4F;AAC5F,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC,uEAAuE;AACvE,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAkDD;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,UACd,mBAAmB,QACpB,UAAU,YACP,gBAAgB,KACxB,SAAS,MAAM,EAejB,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,OAAO,aAAc,WAAW,SAAS,SAAS,MAAM,EAAE,KAAG,MAGG,CAAC"}

package/dist/netbox/generated/constraints/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Every generated NetBox constraint table, merged — DO NOT EDIT BY HAND.
+ *
+ * Run: bun codegen/netbox.ts
+ *
+ * ⚠️ EVERY KEY IS PREFIXED `netbox:` FOR THE SAME REASON THE PROXMOX TABLES ARE PREFIXED. One
+ *   estate runs several vendors and the reader is shared; an unprefixed `POST /api/…` would be
+ *   one vendor away from colliding.
+ */
+import type { EndpointConstraints } from '../../constraints.ts';
+export declare const NETBOX_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>>;
+/**
+ * sha256 of the merged table, truncated.
+ *
+ * ★ A DIGEST OF THE DATA, NOT OF THE FILE TEXT, so reformatting is not a stale generation while
+ *   changing a 200 to a 201 by hand is. `tests/netbox-manifest.test.ts` recomputes it.
+ */
+export declare const NETBOX_CONSTRAINTS_DIGEST = "1de1cebe7491d94f";
+//# sourceMappingURL=index.d.ts.map

package/dist/netbox/generated/constraints/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/netbox/generated/constraints/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAE5E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC"}

package/dist/netbox/generated/constraints/netbox-ipam.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated NetBox REST API (OpenAPI 3.0.3) request-body constraints for `/api/ipam` — DO NOT EDIT BY HAND.
+ *
+ * Run: bun codegen/netbox.ts
+ * Manifest entry: `netbox-openapi` — NetBox REST API (OpenAPI 3.0.3) 4.7.0
+ *   sha256 be7f971179b1d6ba, vendor repository, pinned to the release tag
+ *   contrib/openapi.json in netbox-community/netbox, at tag v4.7.0
+ *
+ * 2 of this product's 949 POST/PUT/PATCH/DELETE endpoints are tabled across all
+ * areas: the ones this package writes to, named in its own source. Every other vendor write
+ * endpoint is UNTABLED and therefore unchecked at plan time.
+ *
+ * ⚠️ A `patternSource` with no `pattern` beside it could NOT be carried into a JavaScript
+ *   RegExp faithfully — Python's `\w` is Unicode and JavaScript's is ASCII
+ *   (codegen/py-pattern.ts). It is recorded and NOT enforced.
+ * ⚠️ A FOREIGN KEY CARRIES ONLY ITS TYPE. `tenant`, `vlan`, `role` and friends are
+ *   `integer|object` in the schema, and the related object's own rules do not govern them.
+ */
+import type { EndpointConstraints } from '../../constraints.ts';
+export declare const NETBOX_IPAM_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>>;
+//# sourceMappingURL=netbox-ipam.d.ts.map

package/dist/netbox/generated/constraints/netbox-ipam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"netbox-ipam.d.ts","sourceRoot":"","sources":["../../../../src/netbox/generated/constraints/netbox-ipam.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAWjF,CAAC"}

package/dist/netbox/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * NetBox providers for Alchemy.
+ *
+ * ⛔ THIS BARREL IS THE PUBLIC API, AND IT IS DELIBERATELY SMALLER THAN THE DIRECTORY. These are
+ *   the symbols a real stack consumes; the rest of the files are internals a provider needs but a
+ *   consumer should not depend on. An `export *` here would publish every helper as API and make
+ *   the next refactor a breaking change.
+ * ★ The constraint reader IS exported, because a consumer writing its own family needs the same
+ *   guard — and because a table nobody can reach is a table nobody uses.
+ */
+export { NetboxError, apiBase } from './client.ts';
+export { NETBOX_CONSTRAINTS, bodyViolations, constraintsFor, guardBody, } from './constraint-guard.ts';
+export { type EndpointConstraints, type EndpointKey, type NetboxBody, type ParamConstraint, refusal, violations, } from './constraints.ts';
+export { NETBOX_CONSTRAINTS_DIGEST } from './generated/constraints/index.ts';
+export { NetboxPrefix, NetboxPrefixProvider, type PrefixAttributes, type PrefixProps, type PrefixStatus, } from './prefix.ts';
+export { type NetboxRequirements, type NetboxSpec, netboxHandlers } from './resource.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/netbox/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/netbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,OAAO,EACP,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/dist/netbox/index.js

@@ -0,0 +1,331 @@
+// src/netbox/client.ts
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+var PATH_PREFIX = "/api";
+var apiBase = () => {
+  const raw = process.env["NETBOX_URL"];
+  if (raw === undefined || raw.trim() === "") {
+    throw new Error("NETBOX_URL is not set. Point it at your NetBox instance, e.g. https://netbox.example.com");
+  }
+  return raw.trim().replace(/\/$/, "");
+};
+
+class NetboxError extends Error {
+  status;
+  method;
+  path;
+  constructor(status, method, path, detail) {
+    super(`NetBox ${method} ${path} -> ${String(status)}: ${detail}`);
+    this.status = status;
+    this.method = method;
+    this.path = path;
+    this.name = "NetboxError";
+  }
+}
+var token = () => Effect.gen(function* () {
+  const raw = process.env["NETBOX_TOKEN"];
+  if (raw === undefined || raw.trim() === "") {
+    return yield* Effect.fail(new NetboxError(0, "GET", "", "NETBOX_TOKEN is unset. Mint a scoped token and export it — never store it in Alchemy props."));
+  }
+  return raw.trim();
+});
+var netbox = (method, path, body) => Effect.gen(function* () {
+  const credential = yield* token();
+  const url = `${apiBase()}${PATH_PREFIX}/${path.replace(/^\//, "")}`;
+  const client = yield* HttpClient.HttpClient;
+  const request = HttpClientRequest.make(method)(url).pipe(HttpClientRequest.setHeaders({
+    Accept: "application/json",
+    Authorization: `Token ${credential}`
+  }), body === undefined ? (self) => self : HttpClientRequest.bodyText(JSON.stringify(body), "application/json"));
+  const response = yield* client.execute(request).pipe(Effect.mapError((cause) => new NetboxError(0, method, path, String(cause))));
+  if (response.status < 200 || response.status >= 300) {
+    const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
+    return yield* Effect.fail(new NetboxError(response.status, method, path, detail.slice(0, 300)));
+  }
+  const text = yield* response.text.pipe(Effect.mapError((cause) => new NetboxError(0, method, path, String(cause))));
+  return text === "" ? undefined : JSON.parse(text);
+});
+var soleMatch = (rows, describe) => {
+  if (rows.length > 1) {
+    throw new Error(`${describe} matched ${String(rows.length)} NetBox objects. An object's identity must be ` + "unique; narrow it (the VRF, the site, the tenant) rather than taking the first row.");
+  }
+  return rows[0];
+};
+// src/netbox/constraint-guard.ts
+import * as Effect2 from "effect/Effect";
+
+// src/netbox/constraints.ts
+var lengthOf = (value) => [...value].length;
+var checkString = (name, value, rule) => {
+  const out = [];
+  if (rule.maxLength !== undefined && lengthOf(value) > rule.maxLength) {
+    out.push(`${name}: at most ${String(rule.maxLength)} characters`);
+  }
+  if (rule.minLength !== undefined && lengthOf(value) < rule.minLength) {
+    out.push(`${name}: at least ${String(rule.minLength)} characters`);
+  }
+  if (rule.enum !== undefined && !rule.enum.includes(value)) {
+    out.push(`${name}: must be one of ${rule.enum.join(", ")}`);
+  }
+  if (rule.pattern !== undefined && !new RegExp(rule.pattern).test(value)) {
+    out.push(`${name}: must match ${rule.patternSource ?? rule.pattern}`);
+  }
+  return out;
+};
+var checkNumber = (name, value, rule) => {
+  const out = [];
+  if (!Number.isFinite(value))
+    return out;
+  if (rule.minimum !== undefined && value < rule.minimum) {
+    out.push(`${name}: at least ${String(rule.minimum)}`);
+  }
+  if (rule.maximum !== undefined && value > rule.maximum) {
+    out.push(`${name}: at most ${String(rule.maximum)}`);
+  }
+  return out;
+};
+var checkValue = (name, value, rule) => {
+  if (typeof value === "string")
+    return checkString(name, value, rule);
+  if (typeof value === "number")
+    return checkNumber(name, value, rule);
+  return [];
+};
+var violations = (table, body, options = {}) => {
+  const out = [];
+  for (const [name, rule] of Object.entries(table)) {
+    if (!Object.hasOwn(body, name)) {
+      if (options.presence === true && rule.required === true)
+        out.push(`${name}: required`);
+      continue;
+    }
+    const value = body[name];
+    for (const item of Array.isArray(value) ? value : [value]) {
+      out.push(...checkValue(name, item, rule));
+    }
+  }
+  return out;
+};
+var refusal = (endpoint, found) => `${endpoint} would be rejected by the vendor:
+  - ${found.join(`
+  - `)}
+` + "These are NetBox's own limits, read from its published OpenAPI document " + "(packages/alchemy/src/netbox/generated/constraints). Fix the declaration.";
+
+// src/netbox/generated/constraints/netbox-ipam.ts
+var NETBOX_IPAM_CONSTRAINTS = {
+  "netbox:PATCH /api/ipam/prefixes/{id}/": {
+    description: { maxLength: 200, type: "string" },
+    prefix: { minLength: 1, type: "string" },
+    status: { enum: ["container", "active", "reserved", "deprecated"], type: "string" }
+  },
+  "netbox:POST /api/ipam/prefixes/": {
+    description: { maxLength: 200, type: "string" },
+    prefix: { minLength: 1, required: true, type: "string" },
+    status: { enum: ["container", "active", "reserved", "deprecated"], type: "string" }
+  }
+};
+
+// src/netbox/generated/constraints/index.ts
+var NETBOX_CONSTRAINTS = {
+  ...NETBOX_IPAM_CONSTRAINTS
+};
+var NETBOX_CONSTRAINTS_DIGEST = "1de1cebe7491d94f";
+
+// src/netbox/constraint-guard.ts
+var constraintsFor = (key) => {
+  const table = NETBOX_CONSTRAINTS[key];
+  if (table === undefined) {
+    throw new Error(`no vendor constraint table for '${key}'. It is named in this package but not generated: ` + "run `bun codegen/netbox.ts` (see codegen/README.md).");
+  }
+  return table;
+};
+var bodyViolations = (key, body, presence) => violations(constraintsFor(key), body, { presence });
+var guardBody = (key, body, presence) => Effect2.suspend(() => {
+  if (key === undefined)
+    return Effect2.void;
+  const found = bodyViolations(key, body, presence);
+  return found.length === 0 ? Effect2.void : Effect2.die(new Error(refusal(key, found)));
+});
+// src/netbox/prefix.ts
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import * as Effect4 from "effect/Effect";
+
+// src/netbox/prefix-form.ts
+var DEFAULT_STATUS = "active";
+var settled = (props) => ({
+  isPool: props.isPool ?? false,
+  markUtilized: props.markUtilized ?? false,
+  status: props.status ?? DEFAULT_STATUS
+});
+var prefixBody = (props) => {
+  const fixed = settled(props);
+  const out = {
+    is_pool: fixed.isPool,
+    mark_utilized: fixed.markUtilized,
+    prefix: props.prefix,
+    status: fixed.status
+  };
+  if (props.description !== undefined)
+    out["description"] = props.description;
+  if (props.comments !== undefined)
+    out["comments"] = props.comments;
+  if (props.vrf !== undefined)
+    out["vrf"] = props.vrf;
+  if (props.tenant !== undefined)
+    out["tenant"] = props.tenant;
+  if (props.vlan !== undefined)
+    out["vlan"] = props.vlan;
+  return out;
+};
+var prefixMatches = (attributes, props) => {
+  const fixed = settled(props);
+  return attributes.status === fixed.status && attributes.isPool === fixed.isPool && attributes.markUtilized === fixed.markUtilized && (props.description === undefined || attributes.description === props.description) && (props.comments === undefined || attributes.comments === props.comments) && (props.tenant === undefined || attributes.tenant === props.tenant) && (props.vlan === undefined || attributes.vlan === props.vlan);
+};
+
+// src/netbox/resource.ts
+import { isResolved } from "alchemy/Diff";
+import * as Effect3 from "effect/Effect";
+var absentOn404 = (io) => io.pipe(Effect3.catchIf((cause) => cause instanceof NetboxError && cause.status === 404, () => Effect3.succeed(undefined)));
+var LOCATE_PAGE = 20;
+var query = (pairs) => new URLSearchParams([
+  ...pairs.map(([k, v]) => [k, v]),
+  ["limit", String(LOCATE_PAGE)]
+]).toString();
+var netboxOperations = (spec) => {
+  const fetchLive = (props) => absentOn404(netbox("GET", `${spec.collection}/?${query(spec.locate(props))}`)).pipe(Effect3.map((list) => {
+    if (list !== undefined && list.count > LOCATE_PAGE) {
+      throw new Error(`${spec.describe(props)}: the locate filter matched ${String(list.count)} rows, more ` + `than the ${String(LOCATE_PAGE)}-row page this reads. That is not a natural key — ` + "narrow the filter rather than paging through candidates.");
+    }
+    const rows = list?.results ?? [];
+    const narrow = spec.identifies;
+    return soleMatch(narrow === undefined ? rows : rows.filter((row) => narrow(row, props)), spec.describe(props));
+  }));
+  const objectPath = (live) => `${spec.collection}/${String(live["id"])}`;
+  const read = (props) => fetchLive(props).pipe(Effect3.map((live) => live === undefined ? undefined : spec.attributes(live, props)));
+  return {
+    read,
+    diff: (news, output) => Effect3.gen(function* () {
+      if (output === undefined || !isResolved(news))
+        return;
+      const live = yield* read(news);
+      if (live === undefined)
+        return { action: "update" };
+      if (spec.matches(live, news))
+        return { action: "noop" };
+      return spec.updateBody === undefined ? { action: "replace" } : { action: "update" };
+    }),
+    reconcile: (news) => Effect3.gen(function* () {
+      const before = yield* fetchLive(news);
+      if (before === undefined) {
+        const body = spec.createBody(news);
+        yield* guardBody(spec.endpoint.create, body, true);
+        yield* netbox("POST", `${spec.collection}/`, body);
+      } else if (spec.updateBody !== undefined) {
+        const mapped = spec.attributes(before, news);
+        if (mapped !== undefined && !spec.matches(mapped, news)) {
+          const body = spec.updateBody(news);
+          yield* guardBody(spec.endpoint.update, body, false);
+          if (Object.keys(body).length > 0) {
+            yield* netbox("PATCH", `${objectPath(before)}/`, body);
+          }
+        }
+      }
+      const after = yield* read(news);
+      if (after === undefined) {
+        return yield* Effect3.die(new Error(`${spec.describe(news)}: the write returned no error but the object is still ` + "absent. NetBox returns the object it wrote — read back rather than trusting the " + "status code."));
+      }
+      return after;
+    }),
+    destroy: (olds) => Effect3.gen(function* () {
+      const live = yield* fetchLive(olds);
+      if (live === undefined)
+        return;
+      yield* netbox("DELETE", `${objectPath(live)}/`);
+    })
+  };
+};
+var netboxHandlers = (spec) => {
+  const ops = netboxOperations(spec);
+  return {
+    list: () => Effect3.succeed([]),
+    read: ({ olds }) => ops.read(olds),
+    diff: ({ news, output }) => ops.diff(news, output),
+    reconcile: ({ news }) => ops.reconcile(news),
+    delete: ({ olds }) => ops.destroy(olds)
+  };
+};
+
+// src/netbox/values.ts
+var text = (value) => typeof value === "string" ? value : "";
+var choice = (value) => {
+  if (typeof value === "string")
+    return value;
+  if (typeof value === "object" && value !== null && "value" in value) {
+    return text(value.value);
+  }
+  return "";
+};
+var fk = (value) => {
+  if (typeof value === "number")
+    return value;
+  if (typeof value === "object" && value !== null && "id" in value) {
+    const id = value.id;
+    return typeof id === "number" ? id : undefined;
+  }
+  return;
+};
+
+// src/netbox/prefix.ts
+var NetboxPrefix = Resource("Netbox.Prefix", {
+  defaultRemovalPolicy: "retain"
+});
+var handlers = netboxHandlers({
+  attributes: (live, props) => {
+    const id = live["id"];
+    if (typeof id !== "number")
+      return;
+    return {
+      comments: text(live["comments"]),
+      description: text(live["description"]),
+      isPool: live["is_pool"] === true,
+      markUtilized: live["mark_utilized"] === true,
+      prefix: text(live["prefix"]) || props.prefix,
+      prefixId: id,
+      status: choice(live["status"]),
+      tenant: fk(live["tenant"]),
+      vlan: fk(live["vlan"]),
+      vrf: fk(live["vrf"])
+    };
+  },
+  collection: "ipam/prefixes",
+  createBody: prefixBody,
+  describe: (props) => `ipam/prefixes ${props.prefix}`,
+  endpoint: {
+    create: "netbox:POST /api/ipam/prefixes/",
+    update: "netbox:PATCH /api/ipam/prefixes/{id}/"
+  },
+  identifies: (live, props) => fk(live["vrf"]) === props.vrf,
+  locate: (props) => [["prefix", props.prefix]],
+  matches: prefixMatches,
+  updateBody: prefixBody
+});
+var NetboxPrefixProvider = () => Provider.effect(NetboxPrefix, Effect4.succeed(NetboxPrefix.Provider.of(handlers)));
+export {
+  NETBOX_CONSTRAINTS,
+  NETBOX_CONSTRAINTS_DIGEST,
+  NetboxError,
+  NetboxPrefix,
+  NetboxPrefixProvider,
+  apiBase,
+  bodyViolations,
+  constraintsFor,
+  guardBody,
+  netboxHandlers,
+  refusal,
+  violations
+};
+
+//# debugId=8207BD9178A5636864756E2164756E21
+//# sourceMappingURL=index.js.map