@homeflare/alchemy 0.19.1 → 0.21.0

package/dist/linux/region.d.ts

@@ -23,6 +23,17 @@ export type RegionSpec = {
     readonly comment?: string;
 };
 export declare const DEFAULT_COMMENT = "#";
+/**
+ * Whether two declarations name the SAME block.
+ *
+ * ⛔ THE COMMENT TOKEN IS PART OF THE IDENTITY, not a formatting preference. The markers are
+ *   matched as literal whole lines, so `# BEGIN pf` and `// BEGIN pf` are two different blocks:
+ *   changing the token leaves the old block invisible to every later read, exactly as renaming
+ *   does. A resource that treated either as a mere content change would splice a second block in
+ *   and never be able to find the first one again.
+ * ★ Whole-file mode is its own identity: `undefined` equals only `undefined`.
+ */
+export declare const sameRegion: (a: RegionSpec | undefined, b: RegionSpec | undefined) => boolean;
 export declare const regionProblems: (spec: RegionSpec) => string[];
 /**
  * The file's bytes with the block set to `body`, appended at the end when it is not there yet.

package/dist/linux/region.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"region.d.ts","sourceRoot":"","sources":["../../src/linux/region.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,UAAU,GAAG;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,eAAO,MAAM,eAAe,MAAM,CAAC;AAUnC,eAAO,MAAM,cAAc,SAAU,UAAU,KAAG,MAAM,EAYvD,CAAC;AA8BF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,QAAQ,UAAU,QAAQ,MAAM,KAAG,MAW3E,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,UAAU,SAAU,MAAM,QAAQ,UAAU,KAAG,MAAM,GAAG,SAMpE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,QAAQ,UAAU,KAAG,MAK7D,CAAC"}
+{"version":3,"file":"region.d.ts","sourceRoot":"","sources":["../../src/linux/region.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,UAAU,GAAG;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,eAAO,MAAM,eAAe,MAAM,CAAC;AAUnC;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,MAAO,UAAU,GAAG,SAAS,KAAK,UAAU,GAAG,SAAS,KAAG,OAGU,CAAC;AAE7F,eAAO,MAAM,cAAc,SAAU,UAAU,KAAG,MAAM,EAYvD,CAAC;AA8BF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,QAAQ,UAAU,QAAQ,MAAM,KAAG,MAW3E,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,UAAU,SAAU,MAAM,QAAQ,UAAU,KAAG,MAAM,GAAG,SAMpE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,QAAQ,UAAU,KAAG,MAK7D,CAAC"}

package/dist/linux/remote-file-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-file-lifecycle.d.ts","sourceRoot":"","sources":["../../src/linux/remote-file-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AAErE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,QAAQ,WACX,UAAU,QACZ,eAAe,UACb,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAed,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,WAChB,UAAU,SACX,eAAe,WACb,oBAAoB,sBAE5B,OAAO,CAAC,oBAAoB,CA6D9B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,WACb,UAAU,UACV,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAkBd,CAAC"}
+{"version":3,"file":"remote-file-lifecycle.d.ts","sourceRoot":"","sources":["../../src/linux/remote-file-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AAErE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,QAAQ,WACX,UAAU,QACZ,eAAe,UACb,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAgBd,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,WAChB,UAAU,SACX,eAAe,WACb,oBAAoB,sBAE5B,OAAO,CAAC,oBAAoB,CA6E9B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,WACb,UAAU,UACV,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAkBd,CAAC"}

package/dist/linux/remote-file-plan.d.ts

@@ -11,6 +11,28 @@ export type Identity = {
 /** Validate, then resolve owner and group names to ids through the runner. */
 export declare const identity: (runner: HostRunner, props: RemoteFileProps) => Promise<Identity>;
 export declare const digestOf: (text: string) => string;
+/** What this declaration now owns, compared with what the last deploy owned. */
+export type Move = 'none' | 'path' | 'region';
+/**
+ * Has the thing this resource owns MOVED since the last deploy — and if so, how?
+ *
+ * 🔴 WHY THIS EXISTS (found by review, reproduced against the fake host, 2026-09-22). Without it,
+ *   only `path` was identity and both of these read as a routine `update`:
+ *   - RENAMING THE REGION left the old block in the file FOREVER. The new markers were spliced in,
+ *     the old ones were never touched, and `delete` — which can only look for the name in state,
+ *     now the new one — could never remove them. Two `anchor` lines in a packet filter, two
+ *     entries in a host table, and nothing in the stack able to take either back.
+ *   - DROPPING `region` TOOK OVER THE WHOLE FILE. The plan said `update`; the apply replaced every
+ *     byte of a file belonging to a vendor package with this resource's four lines. That is the
+ *     one thing the managed-region design exists to make impossible.
+ * ⛔ A FLIP BETWEEN THE TWO MODES IS A REFUSAL, NOT A MOVE. Neither order is safe: writing the
+ *   whole file first destroys the other owner's bytes before anything can be undone, and removing
+ *   the block first destroys our own claim and then refuses. The operator destroys the resource
+ *   and declares a new one, which is the only sequence with a reviewable diff at each step.
+ * ★ A region-to-region rename IS safe as a move, because both blocks can exist at once: write the
+ *   new one, verify it, then take the old one out (remote-file-lifecycle.ts reconcileFile).
+ */
+export declare const relocation: (props: RemoteFileProps, output: RemoteFileAttributes) => Move;
 /** The digest of the part this resource owns, or `undefined` when that part is not there. */
 export declare const ownedDigest: (file: string | undefined, region: RegionSpec | undefined) => string | undefined;
 /** The file as it is now, plus the digest of the part this resource owns. */

package/dist/linux/remote-file-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-file-plan.d.ts","sourceRoot":"","sources":["../../src/linux/remote-file-plan.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAY,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,KAAK,UAAU,EAA4B,MAAM,aAAa,CAAC;AACxE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAErB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,OAAO,aAAoB,CAAC;AACzC,eAAO,MAAM,OAAO,aAAoB,CAAC;AAEzC,eAAO,MAAM,MAAM,SAAU,MAAM,WAAW,MAAM,KAAG,KACT,CAAC;AAK/C,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,WAAkB,UAAU,SAAS,eAAe,KAAG,OAAO,CAAC,QAAQ,CAc3F,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,MAAyC,CAAC;AAElF,6FAA6F;AAC7F,eAAO,MAAM,WAAW,SAChB,MAAM,GAAG,SAAS,UAChB,UAAU,GAAG,SAAS,KAC7B,MAAM,GAAG,SAKX,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,WACrB,UAAU,QACZ,MAAM,UACJ,UAAU,GAAG,SAAS,KAC7B,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAe1C,CAAC;AAQF,MAAM,MAAM,IAAI,GAAG;IACjB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS,WACZ,UAAU,SACX,eAAe,QAChB,QAAQ,KACb,OAAO,CAAC,IAAI,CA+Cd,CAAC"}
+{"version":3,"file":"remote-file-plan.d.ts","sourceRoot":"","sources":["../../src/linux/remote-file-plan.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAY,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,KAAK,UAAU,EAAwC,MAAM,aAAa,CAAC;AACpF,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAErB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,OAAO,aAAoB,CAAC;AACzC,eAAO,MAAM,OAAO,aAAoB,CAAC;AAEzC,eAAO,MAAM,MAAM,SAAU,MAAM,WAAW,MAAM,KAAG,KACT,CAAC;AAK/C,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,WAAkB,UAAU,SAAS,eAAe,KAAG,OAAO,CAAC,QAAQ,CAc3F,CAAC;AAEF,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,MAAyC,CAAC;AAElF,gFAAgF;AAChF,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,UAAU,UAAW,eAAe,UAAU,oBAAoB,KAAG,IAYjF,CAAC;AAEF,6FAA6F;AAC7F,eAAO,MAAM,WAAW,SAChB,MAAM,GAAG,SAAS,UAChB,UAAU,GAAG,SAAS,KAC7B,MAAM,GAAG,SAKX,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,WACrB,UAAU,QACZ,MAAM,UACJ,UAAU,GAAG,SAAS,KAC7B,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAe1C,CAAC;AAQF,MAAM,MAAM,IAAI,GAAG;IACjB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS,WACZ,UAAU,SACX,eAAe,QAChB,QAAQ,KACb,OAAO,CAAC,IAAI,CA+Cd,CAAC"}

package/dist/linux/remote-file.d.ts

@@ -6,10 +6,13 @@
  *   the host already says what we declare; then read back and compared.
  * - read — lstat plus the SHA-256 of the file and of the part this resource owns.
  * - diff — the declared digest against the stored AND the on-disk one, plus mode and owner.
- * - replace — only when `path` changes; create-before-delete.
+ * - replace — only when `path` changes; create-before-delete. A region renamed inside one file
+ *   is an update that writes the new block, verifies it, then takes the old one out.
  * - delete — removes the file, or in region mode only the block.
  *
  * ⛔ NEVER A SECRET — see remote-file-form.ts.
+ * ⛔ THE REGION IS PART OF THE IDENTITY. Renaming it, or changing its comment token, moves the block;
+ *   swapping between owning the whole file and owning a block is refused (remote-file-plan.ts).
  * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt` (docs/ownership.md): a file already at the path, or a
  *   block already carrying the markers, reads as `Unowned`.
  * ★ IT IS A SEPARATE RESOURCE FROM `Host.File`, not a flag on it: the two have different attributes

package/dist/linux/remote-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-file.d.ts","sourceRoot":"","sources":["../../src/linux/remote-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQnF,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEnF,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,6FA0C5B,CAAC"}
+{"version":3,"file":"remote-file.d.ts","sourceRoot":"","sources":["../../src/linux/remote-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQnF,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEnF,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,6FA0C5B,CAAC"}

package/dist/linux/sudo-listing.d.ts

@@ -0,0 +1,47 @@
+/**
+ * ONE READ OF `ls -ldn --` FOR A WHOLE LIST OF PATHS, parsed into the same FileStat the seam uses
+ * plus the one thing `stat` cannot say on Linux: whether the path carries a POSIX ACL.
+ *
+ * ★ WHY `ls` AND NOT `stat`, AND WHY ONE CALL. The Mac guard lstats every directory from `/` down
+ *   with a local syscall each; over ssh each of those is a TCP connection with no multiplexing
+ *   (ssh-runner.ts), so a five-deep chain would be five handshakes per check and per plan. `ls -ldn`
+ *   takes every path as an operand and answers in one connection, and its mode column carries the
+ *   ACL flag the chain check needs anyway.
+ * ★ MEASURED 2026-09-22, read-only over ssh, on two host classes — an unprivileged LXC container
+ *   and a Proxmox VE node, both Debian 13 / coreutils 9.7, LANG=C, ssh user uid 1001 and 1000:
+ *     $ ls -ldn / /etc /etc/systemd /etc/systemd/system /usr /usr/lib /usr/lib/systemd …
+ *       drwxr-xr-x 18 0 0 4096 Sep 22 10:12 /etc          (all ten root:root 0755, no flag)
+ *     $ ls -ld /var/log/journal
+ *       drwxr-sr-x+ 3 root systemd-journal …              (the `+` IS the POSIX ACL flag here)
+ *     $ ls -lden …  →  ls: invalid option -- 'e'          (the Mac's spelling does not exist)
+ *     $ command -v getfacl  →  absent on both Debian classes (present on the NixOS class)
+ *   ⛔ SO THE ACL SIGNAL IS THE `+` FLAG, NOT `getfacl`: the tool that would enumerate the entries
+ *     is not installed on the hosts this runner is for, and a guard that shells out to a missing
+ *     program and fails closed would refuse every write on them. `ls` is coreutils, always there.
+ *   ⚠️ THE PRICE, STATED: we learn THAT a directory has an ACL, never WHAT it grants, so any ACL on
+ *     the chain is a refusal — including a read-only one the Mac guard would allow. Fail closed and
+ *     say so; the remedy is a prefix without one.
+ * ⚠️ `.` in that column is an SELinux context, not an ACL, and is not a grant. `@` is macOS's.
+ * ⛔ FAIL CLOSED ON ANYTHING WE DO NOT UNDERSTAND. A line that does not parse, a path that no line
+ *   named, two lines for one path, or a non-zero exit is an error — never "nothing is there".
+ */
+import type { FileStat, HostRunner } from '../launchd/runner.ts';
+/** What one `ls -ldn` line says: the lstat fields, plus whether the path carries an ACL. */
+export type Listed = FileStat & {
+    readonly acl: boolean;
+};
+/**
+ * `rwxr-x---` → 0o750, with the three special bits `ls` hides in the execute columns:
+ * `s`/`S` = setuid (user) or setgid (group), `t`/`T` = sticky; the capital is the bit without
+ * execute. ⚠️ Anything else in a column is a shape we do not know, and returns undefined.
+ */
+export declare const permBits: (perms: string) => number | undefined;
+/** Every requested path's entry, or `undefined` when the listing is not exactly that. */
+export declare const parseListing: (stdout: string, paths: readonly string[]) => Map<string, Listed> | undefined;
+/**
+ * Read every path in one call, as the deploying user — no sudo, the same read at plan time and
+ * before the write. ⛔ Anything but a complete, understood listing is a SudoRefusedError: a chain
+ *   we could not read is a chain we cannot say is root's alone.
+ */
+export declare const readListing: (base: HostRunner, ls: string, what: string, paths: readonly string[]) => Promise<Map<string, Listed>>;
+//# sourceMappingURL=sudo-listing.d.ts.map

package/dist/linux/sudo-listing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-listing.d.ts","sourceRoot":"","sources":["../../src/linux/sudo-listing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGjE,4FAA4F;AAC5F,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC;AAQ1D;;;;GAIG;AACH,eAAO,MAAM,QAAQ,UAAW,MAAM,KAAG,MAAM,GAAG,SAgBjD,CAAC;AAgBF,yFAAyF;AACzF,eAAO,MAAM,YAAY,WACf,MAAM,SACP,SAAS,MAAM,EAAE,KACvB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAmBxB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,WAAW,SAChB,UAAU,MACZ,MAAM,QACJ,MAAM,SACL,SAAS,MAAM,EAAE,KACvB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAU7B,CAAC"}

package/dist/linux/unit-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unit-handlers.d.ts","sourceRoot":"","sources":["../../src/linux/unit-handlers.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,eAAO,MAAM,WAAW,WACd,UAAU,QACZ,gBAAgB,UACd,qBAAqB,GAAG,SAAS,KACxC,MAAM,CAAC,MAAM,CAAC,qBAAqB,GAAG,SAAS,EAAE,KAAK,CAKrD,CAAC;AAEL,eAAO,MAAM,WAAW,WACd,UAAU,cACN,MAAM,QACZ,KAAK,CAAC,gBAAgB,CAAC,UACrB,qBAAqB,GAAG,SAAS,WAChC,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,KAAK,CAgBvC,CAAC;AAEF,eAAO,MAAM,gBAAgB,WACnB,UAAU,QACZ;IACJ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC3C,WACQ,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAG1C,CAAC;AAEJ,eAAO,MAAM,aAAa,WAChB,UAAU,UACV,qBAAqB,KAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAA2C,CAAC"}
+{"version":3,"file":"unit-handlers.d.ts","sourceRoot":"","sources":["../../src/linux/unit-handlers.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAI9E,eAAO,MAAM,WAAW,WACd,UAAU,QACZ,gBAAgB,UACd,qBAAqB,GAAG,SAAS,KACxC,MAAM,CAAC,MAAM,CAAC,qBAAqB,GAAG,SAAS,EAAE,KAAK,CAKrD,CAAC;AAEL,eAAO,MAAM,WAAW,WACd,UAAU,cACN,MAAM,QACZ,KAAK,CAAC,gBAAgB,CAAC,UACrB,qBAAqB,GAAG,SAAS,WAChC,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,KAAK,CAsBvC,CAAC;AAEF,eAAO,MAAM,gBAAgB,WACnB,UAAU,QACZ;IACJ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC3C,WACQ,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAG1C,CAAC;AAEJ,eAAO,MAAM,aAAa,WAChB,UAAU,UACV,qBAAqB,KAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAA2C,CAAC"}

package/dist/linux/unit-preflight.d.ts

@@ -24,7 +24,7 @@ export declare const assertMayWrite: (runner: HostRunner, name: string) => void;
  * ⛔ A MASKED UNIT IS SOMEONE'S DECISION, NOT DRIFT. `systemctl mask` survives reboots and makes
  *   start fail; unmasking here would silently overrule whoever masked it.
  */
-export declare const assertUsable: (props: SystemdUnitProps, status: UnitStatus) => void;
+export declare const assertUsable: (props: Pick<SystemdUnitProps, 'name'>, status: UnitStatus) => void;
 /**
  * ⛔ A UNIT THIS RESOURCE DOES NOT OWN IS NEVER OVERWRITTEN. Alchemy's adoption probe guards a
  *   create, but NOT the new name of a replace — the engine reads nothing there — so a rename onto
@@ -33,6 +33,15 @@ export declare const assertUsable: (props: SystemdUnitProps, status: UnitStatus)
  *   that died between write and reload), and rewriting it changes nothing.
  */
 export declare const assertUnclaimed: (runner: HostRunner, props: SystemdUnitProps) => Promise<void>;
+/**
+ * The half of a rename check that needs only the NEW NAME: the old unit deletable, the new one
+ * writable and not masked.
+ * ★ ON ITS OWN it is for the rename unit-handlers.ts `diffHandler` spots while `content` is still
+ *   an Output. That plan is a delete-first replace too, so a masked target refused only in
+ *   reconcile would again arrive after the old unit was stopped. The unit file itself cannot be
+ *   compared until `content` resolves, so `assertUnclaimed` stays reconcile's job there.
+ */
+export declare const assertRenameTarget: (runner: HostRunner, old: SystemdUnitAttributes, name: string) => Promise<void>;
 /**
  * A rename, checked at plan time: the new identity must be valid, writable, not masked and free,
  * and the old one deletable — before the plan may promise a delete-first replace.

package/dist/linux/unit-preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unit-preflight.d.ts","sourceRoot":"","sources":["../../src/linux/unit-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,KAAK,UAAU,EAAY,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAMtB,MAAM,gBAAgB,CAAC;AAKxB,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAW,gBAAgB,WAAW,MAAM,KAAG,IAGtE,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,cAAc,WAAY,UAAU,QAAQ,MAAM,KAAG,IAOjE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,UAAW,gBAAgB,UAAU,UAAU,KAAG,IAQ1E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAClB,UAAU,SACX,gBAAgB,KACtB,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,WACpB,UAAU,QACZ,gBAAgB,OACjB,qBAAqB,WACjB,MAAM,KACd,OAAO,CAAC,IAAI,CAOd,CAAC"}
+{"version":3,"file":"unit-preflight.d.ts","sourceRoot":"","sources":["../../src/linux/unit-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,KAAK,UAAU,EAAY,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAMtB,MAAM,gBAAgB,CAAC;AAKxB,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAW,gBAAgB,WAAW,MAAM,KAAG,IAGtE,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,cAAc,WAAY,UAAU,QAAQ,MAAM,KAAG,IAOjE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,UAAW,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,UAAU,KAAG,IAQxF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAClB,UAAU,SACX,gBAAgB,KACtB,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,WACrB,UAAU,OACb,qBAAqB,QACpB,MAAM,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,WACpB,UAAU,QACZ,gBAAgB,OACjB,qBAAqB,WACjB,MAAM,KACd,OAAO,CAAC,IAAI,CAKd,CAAC"}

package/dist/proxmox/credential-literals.d.ts

@@ -23,7 +23,7 @@
  *   it from the template. docs/pbs-notifications.md says the same to the reader.
  * ⛔ A REFUSAL NAMES THE FIELD, NEVER THE VALUE — the message lands in a terminal and a CI log.
  */
-import type { FromEnv } from './write-only.ts';
+import type { FromEnv } from '../secrets/write-only.ts';
 export declare const isCredentialName: (name: string) => boolean;
 /** Plain header values that are credentials by their header's name. `{ fromEnv }` is never one. */
 export declare const literalCredentialHeaders: (header: Readonly<Record<string, FromEnv | string>> | undefined) => string[];

package/dist/proxmox/credential-literals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-literals.d.ts","sourceRoot":"","sources":["../../src/proxmox/credential-literals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAU/C,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,OACY,CAAC;AAI7D,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,WAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,KAC7D,MAAM,EAKE,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAAS,MAAM,GAAG,SAAS,KAAG,MAAM,EAkBvE,CAAC"}
+{"version":3,"file":"credential-literals.d.ts","sourceRoot":"","sources":["../../src/proxmox/credential-literals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAUxD,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,OACY,CAAC;AAI7D,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,WAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,KAC7D,MAAM,EAKE,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAAS,MAAM,GAAG,SAAS,KAAG,MAAM,EAkBvE,CAAC"}

package/dist/proxmox/generated/pbs/nodes-node.d.ts

@@ -162,5 +162,5 @@ export type NodesNodeDisksZfsPostParams = {
 /** POST /nodes/{node}/disks/zfs — `data` payload after client unwrap. */
 export type NodesNodeDisksZfsPostReturn = string;
 /** GET /nodes/{node}/disks/zfs/{name} — `data` payload after client unwrap. */
-export type NodesNodeDisksZfsNameGetReturn = {};
+export type NodesNodeDisksZfsNameGetReturn = Record<string, unknown>;
 //# sourceMappingURL=nodes-node.d.ts.map

package/dist/proxmox/generated/pbs/nodes-node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nodes-node.d.ts","sourceRoot":"","sources":["../../../../src/proxmox/generated/pbs/nodes-node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qEAAqE;AACrE,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EACX,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,OAAO,GACP,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,OAAO,GACP,OAAO,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EACX,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,OAAO,GACP,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,OAAO,GACP,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,SAAS,CACd,MAAM,GACN,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,mBAAmB,GACnB,cAAc,GACd,UAAU,CAAC,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;CACnC,CAAC;AACF,qEAAqE;AACrE,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE5C,oEAAoE;AACpE,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE3C,8EAA8E;AAC9E,MAAM,MAAM,gCAAgC,GAAG,SAAS;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB,EAAE,CAAC;AAEJ,0FAA0F;AAC1F,MAAM,MAAM,iCAAiC,GAAG;IAC9C,eAAe,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;CACnC,CAAC;AACF,+EAA+E;AAC/E,MAAM,MAAM,iCAAiC,GAAG,MAAM,CAAC;AAEvD,wFAAwF;AACxF,MAAM,MAAM,uCAAuC,GAAG,IAAI,CAAC;AAE3D,wFAAwF;AACxF,MAAM,MAAM,+BAA+B,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9E,6EAA6E;AAC7E,MAAM,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAErD,oFAAoF;AACpF,MAAM,MAAM,2BAA2B,GAAG;IACxC,oBAAoB,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACjC,SAAS,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACtB,YAAY,CAAC,EACT,QAAQ,GACR,SAAS,GACT,KAAK,GACL,KAAK,GACL,cAAc,GACd,YAAY,GACZ,YAAY,CAAC;CAClB,CAAC;AACF,yEAAyE;AACzE,MAAM,MAAM,2BAA2B,GAAG,SAAS;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;IAC/C,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,SAAS;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,EAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,aAAa,GAAG,KAAK,GAAG,MAAM,GAAG,YAAY,CAAC;QAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,EAAE,CAAC;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,cAAc,GAAG,YAAY,GAAG,YAAY,CAAC;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,EAAE,CAAC;AAEJ,qFAAqF;AACrF,MAAM,MAAM,4BAA4B,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AACpF,0EAA0E;AAC1E,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,SAAS;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EAAE,CAAC;IACJ,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wFAAwF;AACxF,MAAM,MAAM,+BAA+B,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAC/D,6EAA6E;AAC7E,MAAM,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAErD,wEAAwE;AACxE,MAAM,MAAM,0BAA0B,GAAG,SAAS;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,EAAE,CAAC;AAEJ,oFAAoF;AACpF,MAAM,MAAM,2BAA2B,GAAG;IACxC,eAAe,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IAC5B,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;CAC3E,CAAC;AACF,yEAAyE;AACzE,MAAM,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAEjD,+EAA+E;AAC/E,MAAM,MAAM,8BAA8B,GAAG,EAAE,CAAC"}
+{"version":3,"file":"nodes-node.d.ts","sourceRoot":"","sources":["../../../../src/proxmox/generated/pbs/nodes-node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qEAAqE;AACrE,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EACX,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,OAAO,GACP,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,OAAO,GACP,OAAO,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EACX,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,OAAO,GACP,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,OAAO,GACP,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,SAAS,CACd,MAAM,GACN,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,mBAAmB,GACnB,cAAc,GACd,UAAU,CAAC,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;CACnC,CAAC;AACF,qEAAqE;AACrE,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE5C,oEAAoE;AACpE,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE3C,8EAA8E;AAC9E,MAAM,MAAM,gCAAgC,GAAG,SAAS;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB,EAAE,CAAC;AAEJ,0FAA0F;AAC1F,MAAM,MAAM,iCAAiC,GAAG;IAC9C,eAAe,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;CACnC,CAAC;AACF,+EAA+E;AAC/E,MAAM,MAAM,iCAAiC,GAAG,MAAM,CAAC;AAEvD,wFAAwF;AACxF,MAAM,MAAM,uCAAuC,GAAG,IAAI,CAAC;AAE3D,wFAAwF;AACxF,MAAM,MAAM,+BAA+B,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9E,6EAA6E;AAC7E,MAAM,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAErD,oFAAoF;AACpF,MAAM,MAAM,2BAA2B,GAAG;IACxC,oBAAoB,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACjC,SAAS,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACtB,YAAY,CAAC,EACT,QAAQ,GACR,SAAS,GACT,KAAK,GACL,KAAK,GACL,cAAc,GACd,YAAY,GACZ,YAAY,CAAC;CAClB,CAAC;AACF,yEAAyE;AACzE,MAAM,MAAM,2BAA2B,GAAG,SAAS;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;IAC/C,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,SAAS;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,EAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,aAAa,GAAG,KAAK,GAAG,MAAM,GAAG,YAAY,CAAC;QAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,EAAE,CAAC;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,cAAc,GAAG,YAAY,GAAG,YAAY,CAAC;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,EAAE,CAAC;AAEJ,qFAAqF;AACrF,MAAM,MAAM,4BAA4B,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AACpF,0EAA0E;AAC1E,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,SAAS;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EAAE,CAAC;IACJ,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wFAAwF;AACxF,MAAM,MAAM,+BAA+B,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAC/D,6EAA6E;AAC7E,MAAM,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAErD,wEAAwE;AACxE,MAAM,MAAM,0BAA0B,GAAG,SAAS;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,EAAE,CAAC;AAEJ,oFAAoF;AACpF,MAAM,MAAM,2BAA2B,GAAG;IACxC,eAAe,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IAC5B,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;CAC3E,CAAC;AACF,yEAAyE;AACzE,MAAM,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAEjD,+EAA+E;AAC/E,MAAM,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC"}

package/dist/proxmox/generated/pbs.d.ts

@@ -13,6 +13,13 @@
  * ⚠️ 151 request parameters are typed `\`${number}\`` because the vendor calls them
  *   integer or number. They were `string` before, which accepted 'banana'. A caller holding a
  *   number writes \`${n}\` — `String(n)` is a plain `string` and will not typecheck, deliberately.
+ *
+ * ⛔ 135 OF THESE NAMES ARE ALSO EXPORTED BY `pve.ts`, MEANING SOMETHING ELSE. Both
+ *   products document a `/nodes/{node}` subtree, so a name like `NodesNodeCertificatesGetReturn`
+ *   exists on each side — here an array of objects, there `null`. Nothing stops a pve call
+ *   importing the pbs spelling: it compiles, and the type is simply wrong about the payload.
+ *   Import from the barrel that names your product. tests/schema-types.test.ts pins this count, so
+ *   a vendor upgrade that adds a collision fails there rather than at runtime.
  */
 export * from './pbs/access.ts';
 export * from './pbs/access-users.ts';

package/dist/proxmox/generated/pbs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pbs.d.ts","sourceRoot":"","sources":["../../../src/proxmox/generated/pbs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC;AACvD,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"pbs.d.ts","sourceRoot":"","sources":["../../../src/proxmox/generated/pbs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC;AACvD,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC"}

package/dist/proxmox/generated/pve.d.ts

@@ -13,6 +13,13 @@
  * ⚠️ 480 request parameters are typed `\`${number}\`` because the vendor calls them
  *   integer or number. They were `string` before, which accepted 'banana'. A caller holding a
  *   number writes \`${n}\` — `String(n)` is a plain `string` and will not typecheck, deliberately.
+ *
+ * ⛔ 135 OF THESE NAMES ARE ALSO EXPORTED BY `pbs.ts`, MEANING SOMETHING ELSE. Both
+ *   products document a `/nodes/{node}` subtree, so a name like `NodesNodeCertificatesGetReturn`
+ *   exists on each side — here an array of objects, there `null`. Nothing stops a pbs call
+ *   importing the pve spelling: it compiles, and the type is simply wrong about the payload.
+ *   Import from the barrel that names your product. tests/schema-types.test.ts pins this count, so
+ *   a vendor upgrade that adds a collision fails there rather than at runtime.
  */
 export * from './pve/access.ts';
 export * from './pve/access-roles.ts';

package/dist/proxmox/generated/pve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pve.d.ts","sourceRoot":"","sources":["../../../src/proxmox/generated/pve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0CAA0C,CAAC;AACzD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,0BAA0B,CAAC;AACzC,cAAc,yCAAyC,CAAC;AACxD,cAAc,iDAAiD,CAAC;AAChE,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC;AACpD,cAAc,kCAAkC,CAAC;AACjD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"pve.d.ts","sourceRoot":"","sources":["../../../src/proxmox/generated/pve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0CAA0C,CAAC;AACzD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,0BAA0B,CAAC;AACzC,cAAc,yCAAyC,CAAC;AACxD,cAAc,iDAAiD,CAAC;AAChE,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC;AACpD,cAAc,kCAAkC,CAAC;AACjD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC"}

package/dist/proxmox/index.d.ts

@@ -21,6 +21,18 @@
  * ★ THE VENDOR CONSTRAINT READER JOINED 2026-09-22 (codegen/README.md). `constraintsFor` and
  *   `violations` are exported so a CONSUMING stack can assert its own declarations offline — the
  *   `deploy:pbs` that failed on a 128-character comment had no way to ask that question.
+ * ★ THE CEPH DAEMON, FILESYSTEM AND OSD RESOURCES JOINED 2026-09-22, BECAUSE EACH IS ALREADY
+ *   ADOPT-ONLY BY SHAPE and a live cluster measured that way was waiting on nothing but this line.
+ *   `ProxmoxCephDaemon` (mon/mgr/mds) and `ProxmoxCephFs` compare nothing, so no edit can plan a
+ *   replace; `ProxmoxCephOsd` never POSTs unless `dev` is declared. All three default to `retain`,
+ *   so deleting a declaration drops a state row and leaves the quorum member, the filesystem or
+ *   the replica alone. ceph-adopt.test.ts pins adopting each as reads only, and removing each as
+ *   no DELETE, through Alchemy's own Plan and Apply.
+ * ⛔ `ProxmoxCephFlag` STAYS PROVIDER-ONLY, AND ON PURPOSE. A flag is a hand on the brake, not
+ *   configuration: a declared `noout: false` clears an operator's `noout` on EVERY deploy,
+ *   including one run for an unrelated resource in the middle of a maintenance window
+ *   (ceph-flag.ts has the whole argument). A stack that wants a flag set must reach for the
+ *   Provider deliberately; the barrel does not offer the sentence by default.
  * ★ Anything else unlisted is still reachable by path if you genuinely need
  *   it — that is a deliberate, visible act rather than an accident of barrelling.
  */
@@ -28,10 +40,10 @@ export { ProxmoxAcl, ProxmoxAclProvider } from './acl.ts';
 export { type AlertmanagerBodyOptions, alertmanagerAlertBody } from './alertmanager-body.ts';
 export { ProxmoxApiTokenProvider } from './api-token.ts';
 export { ProxmoxBackupJob, ProxmoxBackupJobProvider } from './backup-job.ts';
-export { ProxmoxCephDaemonProvider } from './ceph-daemon.ts';
+export { ProxmoxCephDaemon, ProxmoxCephDaemonProvider } from './ceph-daemon.ts';
 export { ProxmoxCephFlagProvider } from './ceph-flag.ts';
-export { ProxmoxCephFsProvider } from './ceph-fs.ts';
-export { ProxmoxCephOsdProvider } from './ceph-osd.ts';
+export { ProxmoxCephFs, ProxmoxCephFsProvider } from './ceph-fs.ts';
+export { ProxmoxCephOsd, ProxmoxCephOsdProvider } from './ceph-osd.ts';
 export { ProxmoxCephPool, ProxmoxCephPoolProvider } from './ceph-pool.ts';
 export { constraintsFor, formViolations } from './constraint-guard.ts';
 export { type EndpointConstraints, type EndpointKey, type ParamConstraint, violations, } from './constraints.ts';
@@ -64,6 +76,6 @@ export { ProxmoxSdnVnet, ProxmoxSdnVnetProvider } from './sdn-vnet.ts';
 export { ProxmoxSdnZone, ProxmoxSdnZoneProvider } from './sdn-zone.ts';
 export { ProxmoxStorage, ProxmoxStorageProvider } from './storage.ts';
 export { ProxmoxUser, ProxmoxUserProvider } from './user.ts';
-export { type FromEnv } from './write-only.ts';
+export { type FromEnv } from '../secrets/write-only.ts';
 export { ProxmoxZfsPoolProvider } from './zfs-pool.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/proxmox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxmox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,KAAK,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,0BAA0B,GAChC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,KAAK,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxmox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,KAAK,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,0BAA0B,GAChC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,KAAK,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC"}

package/dist/proxmox/index.js

@@ -3696,7 +3696,7 @@ var literalCredentialsInUrl = (url) => {
 // src/proxmox/pbs-notification-target-wire.ts
 import { Buffer as Buffer2 } from "node:buffer";
 
-// src/proxmox/write-only.ts
+// src/secrets/write-only.ts
 import { Buffer } from "node:buffer";
 import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 var resolveAll = (refs, env = process.env) => {
@@ -4998,9 +4998,12 @@ export {
   ProxmoxApiTokenProvider,
   ProxmoxBackupJob,
   ProxmoxBackupJobProvider,
+  ProxmoxCephDaemon,
   ProxmoxCephDaemonProvider,
   ProxmoxCephFlagProvider,
+  ProxmoxCephFs,
   ProxmoxCephFsProvider,
+  ProxmoxCephOsd,
   ProxmoxCephOsdProvider,
   ProxmoxCephPool,
   ProxmoxCephPoolProvider,
@@ -5049,5 +5052,5 @@ export {
   violations
 };
 
-//# debugId=35B6C615E87D256B64756E2164756E21
+//# debugId=917FA0CD3BD7B9E964756E2164756E21
 //# sourceMappingURL=index.js.map