@homeflare/alchemy 0.34.0 → 0.36.0

package/dist/proxmox/network-apply-read.d.ts

@@ -18,6 +18,12 @@
  *   drops the envelope, so the one readable pending signal is invisible to every other resource in
  *   this package. Without the fetch below, `Proxmox.NetworkApply` could not diff honestly at all.
  *   ★ `pveEnvelopeWith` in client.ts now carries the same member failover as every other call.
+ *   ⛔ WHY THIS FAMILY DID NOT MOVE TO DISTILLED WITH `Proxmox.NodeNetwork` (2026-09-24, decision
+ *     43's walk-down): CONFIRMED against `@distilled.cloud/proxmox`'s own `protocol.ts` that its
+ *     `transformResponse` unconditionally returns `body.data ?? {}` for every operation, before a
+ *     generated call's typed output is even built — no typed call, current or future, could see
+ *     `changes` without a protocol-level change upstream. `pveEnvelopeWith` stays because nothing
+ *     else preserves the sibling this function needs.
  *
  * ⛔ AND THE INTERFACE ROWS CANNOT TELL YOU EITHER. MEASURED in PVE/INotify.pm `read_file`: when
  *   `/etc/network/interfaces.new` exists, THAT is the file that gets parsed, so
@@ -88,6 +94,12 @@ export declare const UNREACHABLE = "the task could not be read -- the node stopp
  *   of the task". Every mint returns a NEW token id, so a second mint is a different identity and
  *   is not the owner — which is why this takes a `PveCredential` and the caller keeps one lease
  *   across both calls, instead of widening the provisioning role to read its own tasks.
+ *
+ * ⛔ THE OTHER REASON THIS FAMILY DID NOT MOVE TO DISTILLED (2026-09-24): CHECKED against
+ *   `@distilled.cloud/proxmox`'s own `Task.awaitTask` (`src/task.ts`) before deciding — it
+ *   propagates a poll failure as a genuine typed `GetNodeTaskStatusError` rather than collapsing
+ *   it to `UNREACHABLE` the way this function does, which would turn the ⛔ two paragraphs above
+ *   into a failed `reconcile` on exactly the poll a mid-reload connection drop is expected to hit.
  */
 export declare const awaitTask: (target: PveTarget, credential: PveCredential, node: string, upid: string, attempts?: number) => Effect.Effect<string, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=network-apply-read.d.ts.map

package/dist/proxmox/network-apply-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-apply-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAatE,oGAAoG;AACpG,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AA0B7E;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,WAWxC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,WAAY,SAAS,QAAQ,MAAM,8IACH,CAAC;AAiC1D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,WAAY,SAAS,0JAO7C,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,0FACiE,CAAC;AAY1F;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS,WACZ,SAAS,cACL,aAAa,QACnB,MAAM,QACN,MAAM,aAEF,MAAM,uFAgCd,CAAC"}
+{"version":3,"file":"network-apply-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAatE,oGAAoG;AACpG,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AA0B7E;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,WAWxC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,WAAY,SAAS,QAAQ,MAAM,8IACH,CAAC;AAiC1D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,WAAY,SAAS,0JAO7C,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,0FACiE,CAAC;AAY1F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,SAAS,WACZ,SAAS,cACL,aAAa,QACnB,MAAM,QACN,MAAM,aAEF,MAAM,uFAgCd,CAAC"}

package/dist/proxmox/network-apply.d.ts

@@ -44,6 +44,8 @@
  *   task it starts so it can poll it without `Sys.Audit`. ⛔ `Sys.Modify` ON A NODE IS NOT A SMALL
  *   GRANT — it also carries that node's DNS, hosts file, time and service configuration. Granting
  *   it cluster-wide to run this resource widens the provisioning role well beyond networking.
+ *
+ * ⛔ STAYS ON `client.ts` (2026-09-24) — network-apply-read.ts's header has the two MEASURED reasons.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/proxmox/network-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-apply.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAM7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAAwD,CAAC;AAiIzF,eAAO,MAAM,2BAA2B,yIACyD,CAAC"}
+{"version":3,"file":"network-apply.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAM7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAAwD,CAAC;AAiIzF,eAAO,MAAM,2BAA2B,yIACyD,CAAC"}

package/dist/proxmox/node-network-form.d.ts

@@ -1,31 +1,63 @@
 /**
- * How a node interface crosses the wire in both directions — props to a PVE form, a PVE answer to
- * a comparable attribute — and when two of those values count as the same value.
- *
- * ★ SPLIT OUT OF node-network.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the
- *   same one metric-server-form.ts uses, one field wider: this file owns the COERCIONS, in both
- *   directions, because a read that normalises differently from the write that produced it is
- *   exactly how a forever-diff is born — keeping `ifaceList` next to both ends is what stops that.
- *   node-network.ts answers "what is an interface, and which of its fields are safe to compare at
- *   all". Nothing here calls the cluster.
- *
- * ⚠️ THE `import type` BACK TO node-network.ts IS A CYCLE ON PAPER ONLY — type-only, erased before
- *   anything runs, so `NodeNetworkProps` stays in the file that declares the resource.
- *
- * * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED, AND EACH ONE IS A MEASURED FOREVER-DIFF.
- *   `priority` is assigned by PVE FROM FILE ORDER — `my $priority = 2; ... $d->{priority} =
- *   $priority++` — and it is not a POST or PUT parameter at all. MEASURED ACROSS C1: vmbr1.42 is
- *   priority 16 on node-b and node-c and 15 on node-d, because node-d has no `wlan0` above it. One declaration
- *   reused across three nodes would diff on exactly one of them, forever, over nothing.
- *   `method` is RECOMPUTED on every write from whether the form carried an address, `families` is
- *   recomputed the same way and never written to the file, `active` and `exists` describe the
- *   kernel rather than the config, and `bond_miimon`, `bridge_stp` and `bridge_fd` are emitted by
- *   PVE's writer with defaults (100, `off`, 0) while appearing in NEITHER write schema —
- *   `additionalProperties => 0` means sending one is a 400. Live proof of all three: node-b's bond0
- *   returns `bond_miimon "100"` and vmbr1 returns `bridge_stp "off"`, `bridge_fd "0"`, none of
- *   which any declaration can set.
+ * `Proxmox.NodeNetwork`'s declared shape (`NodeNetworkProps`) and WRITE side, plus the wire
+ * coercions the read side needs too — kept here since neither `matches` nor `updateForm` makes
+ * sense without agreeing on the same normalisation. Split out of node-network.ts (2026-09-24,
+ * the distilled migration; `Props` joined it in this PR's later line-cap trim) — the
+ * storage.ts/storage-form.ts seam.
  */
-import type { NodeNetworkAttributes, NodeNetworkProps } from './node-network.ts';
+import type { NodeNetworkType } from './node-network-wire.ts';
+import { type WithTarget } from './resource-spec.ts';
+export interface NodeNetworkProps extends WithTarget {
+    /** Which node's file this stanza lives in. Interfaces are per node, never cluster-wide. */
+    node: string;
+    /** `vmbr0`, `bond0`, `vmbr1.42`. 2-20 characters, PVE's `pve-iface` format. */
+    iface: string;
+    /** ⛔ REQUIRED ON EVERY WRITE, update included, never used to retype — see node-network-wire.ts. */
+    type: NodeNetworkType;
+    /**
+     * `198.51.100.12/24`. ⛔ THE ONE FIELD WITH NO UNMANAGED MODE: leaving it out is an instruction
+     * to make the interface `manual`, not an instruction to leave its address alone. The ⛔ on
+     * `updateForm` in node-network-form.ts has the measurement and the consequence.
+     */
+    cidr?: string;
+    /** ⚠️ PVE allows exactly ONE default gateway per node and refuses a second with "Default
+     *  gateway already exists on interface '<other>'". On C1 it is vmbr0.41's. */
+    gateway?: string;
+    /**
+     * `auto <iface>` in the file. Absent on read means off, which is why `bool`'s fallback is used.
+     * ⚠️ UNDECLARED IS UNMANAGED ON AN UPDATE AND OFF ON A CREATE — the same asymmetry storage.ts
+     *   has, and it bites harder here: an interface created without `autostart` is one the node
+     *   will not bring up at boot. Every C1 bridge, bond and vlan carries it.
+     */
+    autostart?: boolean;
+    /** 1280-65520. Unset leaves the file without an `mtu` line and the kernel default in force. */
+    mtu?: number;
+    /** ⚠️ Round-trips only after normalisation — see `comment` in node-network-wire.ts. */
+    comments?: string;
+    /** Space-separated, a SET: `enp87s0`, or `bond0`. ⚠️ PVE refuses a port already used elsewhere. */
+    bridge_ports?: string;
+    /** `2-4094`, or `2 100-200`. Only written when `bridge_vlan_aware` is on. */
+    bridge_vids?: string;
+    /** ⛔ A `false` here is sent as `delete=`, never as `0` — node-network-form.ts's ⛔ says why. */
+    bridge_vlan_aware?: boolean;
+    /**
+     * A bond's members, space separated. ⚠️ THE PARAMETER IS `slaves`, NOT `bond_slaves`, in BOTH
+     * directions on this PVE: MEASURED, the POST/PUT schema names only `slaves` and the GET returns
+     * `"slaves":"enp2s0f0np0 enp2s0f1np1"`. `bond_slaves` appears nowhere in Network.pm here.
+     */
+    slaves?: string;
+    bond_mode?: string;
+    /** ⚠️ Only written when `bond_mode` is `balance-xor` or `802.3ad`; ignored otherwise. */
+    bond_xmit_hash_policy?: string;
+    /** active-backup only. Kept hyphenated because that is the wire name. */
+    'bond-primary'?: string;
+    /** ⚠️ DERIVED FROM A DOTTED NAME. `vmbr1.42` reports `vlan-id` 42 with no such line in the file;
+     *  declaring it there is harmless but adds a line the file did not have. */
+    'vlan-id'?: number;
+    'vlan-raw-device'?: string;
+}
+export declare const NODE_NETWORK_CREATE = "pve:POST /nodes/{node}/network";
+export declare const NODE_NETWORK_UPDATE = "pve:PUT /nodes/{node}/network/{iface}";
 /**
  * "Not set", for the three integers this family reports.
  *
@@ -68,7 +100,7 @@ export declare const ifaceList: (value: unknown) => string;
  *   C1 has none; on an interface that does, leave `comments` undeclared rather than fighting it.
  */
 export declare const comment: (value: unknown) => string;
-/** Undeclared is unmanaged: neither sent nor compared. See the ⚠️ on `body`. */
+/** Undeclared is unmanaged: neither sent nor compared. */
 export declare const same: <T>(declared: T | undefined, live: T) => boolean;
 export declare const sameList: (declared: string | undefined, live: string) => boolean;
 export declare const sameComment: (declared: string | undefined, live: string) => boolean;
@@ -78,12 +110,13 @@ export declare const sameComment: (declared: string | undefined, live: string) =
  * ⚠️ UNDECLARED IS UNMANAGED — not sent, and not compared either. PVE's PUT MERGES the form into
  *   the existing stanza (`foreach my $k (keys %$param) { $ifaces->{$iface}->{$k} = $param->{$k} }`),
  *   so an omitted parameter is left exactly as it was. `cidr` is the one exception and it is not
- *   a small one — see the ⛔ in node-network.ts.
+ *   a small one — see node-network.ts's own ⛔.
  *
  * ⛔ `type` IS REQUIRED ON THE PUT, NOT ONLY ON THE POST. It carries no `optional` in either
- *   schema, and the merge above writes it straight into the stanza — so a PUT naming the wrong
- *   type would RETYPE A LIVE INTERFACE in the file and the writer would then emit a bridge stanza
- *   for what is really a vlan. node-network.ts refuses that case before it can reach here.
+ *   schema (CONFIRMED again in distilled's generated `PutNodeNetwork2Request`/
+ *   `CreateNodeNetworkRequest`), and the merge above writes it straight into the stanza — so a PUT
+ *   naming the wrong type would RETYPE A LIVE INTERFACE in the file. node-network-wire.ts's
+ *   `attributesOf` refuses that case before it can reach here.
  *
  * ⛔ `bridge_vlan_aware` IS SENT ONLY WHEN TRUE, AND A FALSE ONE IS A `delete=`. MEASURED in the
  *   writer: the test is `if (defined($d->{bridge_vlan_aware}))`, not a truth test, so `0` is
@@ -94,23 +127,31 @@ export declare const sameComment: (declared: string | undefined, live: string) =
  *   "netmask conflicts with cidr" when both are sent, and the reader rewrites whatever was written
  *   into prefix form — MEASURED: node-b's vmbr1.42 reports `"netmask":"24"`, never `255.255.255.0`.
  *   A resource accepting both spellings would let a declaration diff against its own value.
+ *
+ * ★ HYPHENATED, THE WIRE SHAPE — `guardWrite` (node-network.ts) checks this form directly, keyed
+ *   by PVE's own names (`generated/constraints/pve-nodes-network.ts`). `toDistilledCreate`/
+ *   `toDistilledUpdate` below translate a COPY for the actual SDK call — storage-form.ts's
+ *   `underscored` has the fuller measurement of why the wire itself does not need this rename
+ *   (distilled's own `T.Body()` annotation re-hyphenates on the way out either way), reused here
+ *   only for the three fields this family's schema renames: `bond-primary`, `vlan-id`,
+ *   `vlan-raw-device` -> `bond_primary`, `vlan_id`, `vlan_raw_device`.
  */
 export declare const body: (props: NodeNetworkProps) => Record<string, string>;
 /**
  * The create form: `body` plus the name of the interface being created.
  *
- * 🔴 `iface` WAS MISSING UNTIL 2026-09-22, AND EVERY CREATE THIS FAMILY HAS EVER PLANNED WOULD
- *   HAVE 400ed. `POST /nodes/{node}/network` declares `iface` REQUIRED (`pve-iface`, 2..20) and
- *   `{node}` is its only path parameter, so the name has to travel in the BODY — unlike the PUT,
- *   where `/network/{iface}` carries it and `updateBody` is right to leave it out. Nothing caught
- *   it because no NodeNetwork has been created from a declaration yet: C1's three nodes were all
- *   adopted, which takes the PUT path. Found by wiring this family to the vendor's own table,
- *   which is exactly the 128-character comment again with a different parameter.
+ * 🔴 `iface` MUST BE IN THE BODY, NOT ONLY THE PATH — `POST /nodes/{node}/network` declares
+ *   `iface` REQUIRED (`pve-iface`, 2..20) and `{node}` is its only path parameter, CONFIRMED again
+ *   in distilled's generated `CreateNodeNetworkRequest`, which carries `iface` as a plain body
+ *   field, never a `T.Label()`. The pre-distilled client.ts version of this file shipped without
+ *   it for a time (see the git history around 2026-09-22) — every create this family had ever
+ *   planned would have 400ed, caught only because every C1 interface had been adopted, never
+ *   created, so nothing exercised the POST until the vendor table was wired in.
  *
  * ⚠️ NOT ADDED TO `body`, BECAUSE THE PUT MUST NOT CARRY IT. `additionalProperties => 0` on the
  *   update schema makes a second copy of the name a 400 rather than an ignored hint.
  */
-export declare const createBody: (props: NodeNetworkProps) => Record<string, string>;
+export declare const createForm: (props: NodeNetworkProps) => Record<string, string>;
 /**
  * The update form: `body` plus the two fields that can only be cleared explicitly.
  *
@@ -119,25 +160,16 @@ export declare const createBody: (props: NodeNetworkProps) => Record<string, str
  *   `$param->{method} = $param->{address} ? 'static' : 'manual'` — so a PUT WITHOUT an address
  *   makes the interface manual no matter what the caller intended. Left at that, the merge would
  *   leave the old `address` and `netmask` in the hash and the writer would emit an `address` line
- *   under `iface … inet manual`: a stanza PVE's own UI cannot produce, whose behaviour under
- *   `ifreload -a` I did NOT measure. Clearing cidr explicitly at least produces a clean, honest
- *   manual interface — and `matches` compares `cidr` UNCONDITIONALLY, so the plan says so first.
+ *   under `iface … inet manual`: a stanza PVE's own UI cannot produce. Clearing cidr explicitly at
+ *   least produces a clean, honest manual interface — and `matches` compares `cidr`
+ *   UNCONDITIONALLY, so the plan says so first.
  *
  * ⛔ ON vmbr1.42 THAT IS THE CEPH TRANSPORT. A declaration of that interface without its `cidr` is
  *   a declaration that it should have no address, applied across three nodes. The plan will read
  *   `1 to update` rather than `noop`; do not wave it through.
  *
- * ⚠️ `delete` IS A PUT-ONLY PARAMETER. The POST schema is `additionalProperties => 0` and has no
- *   `delete`, so sending it on a create is a 400 — which is why `createForm` calls `body` directly.
- */
-export declare const updateBody: (props: NodeNetworkProps) => Record<string, string>;
-/**
- * One live interface as attributes, or `undefined` — "this is not really there".
- *
- * ⚠️ EVERY FIELD PVE REPORTS IS CARRIED HERE, INCLUDING THE SEVEN NO DECLARATION CAN SET. A plan
- *   that cannot show `priority`, `method` or `bond_miimon` cannot explain why it is ignoring them,
- *   and the next person to read a forever-diff would start by adding them to `matches`. They are
- *   reported precisely so that they are visibly OUT of it — see the ⛔ above the attribute type.
+ * ⚠️ `delete` IS A PUT-ONLY PARAMETER. The POST schema has no `delete` at all, which is why
+ *   `createForm` calls `body` directly rather than going through this function.
  */
-export declare const readAttributes: (live: Record<string, unknown>, props: NodeNetworkProps) => NodeNetworkAttributes | undefined;
+export declare const updateForm: (props: NodeNetworkProps) => Record<string, string>;
 //# sourceMappingURL=node-network-form.d.ts.map

package/dist/proxmox/node-network-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-network-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGjF;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,UAAW,OAAO,WAK1B,CAAC;AAEf;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,UAAW,OAAO,WAAoC,CAAC;AAE3E,gFAAgF;AAChF,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,YACX,CAAC;AAE9C,eAAO,MAAM,QAAQ,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YACX,CAAC;AAEzD,eAAO,MAAM,WAAW,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YAChB,CAAC;AAKvD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAgBlE,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGxE,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,UAAU,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAOzE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,SACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,gBAAgB,KACtB,qBAAqB,GAAG,SAuC1B,CAAC"}
+{"version":3,"file":"node-network-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network-form.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,IAAI,EAAE,eAAe,CAAC;IACtB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;kFAC8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;gFAC4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,mBAAmB,mCAAmC,CAAC;AACpE,eAAO,MAAM,mBAAmB,0CAA0C,CAAC;AAE3E;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,UAAW,OAAO,WAK1B,CAAC;AAEf;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,UAAW,OAAO,WAAoC,CAAC;AAE3E,0DAA0D;AAC1D,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,YACX,CAAC;AAE9C,eAAO,MAAM,QAAQ,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YACX,CAAC;AAEzD,eAAO,MAAM,WAAW,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YAChB,CAAC;AAKvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,IAAI,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAgBlE,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAGxE,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,UAAU,UAAW,gBAAgB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMzE,CAAC"}

package/dist/proxmox/node-network-wire.d.ts

@@ -0,0 +1,100 @@
+import * as Effect from 'effect/Effect';
+import { type NodeNetworkProps } from './node-network-form.ts';
+import { UNREADABLE, type Unreadable } from './unreadable-read.ts';
+/**
+ * PVE's interface types. `unknown` is what a NIC it does not manage reports — node-b and node-c
+ * both report `wlan0` that way, and node-d has no such interface at all.
+ *
+ * ⚠️ THAT ASYMMETRY IS A TRAP FOR A DECLARATION SHARED ACROSS NODES. On node-d the read answers
+ *   400 ("interface does not exist"), which this provider cannot tell from "deleted", so
+ *   reconcile POSTs — writing a stanza for a card that is not in the machine. Declare per node
+ *   what each node actually has; a physical interface is discovered, not decided.
+ */
+export type NodeNetworkType = 'OVSBond' | 'OVSBridge' | 'OVSIntPort' | 'OVSPort' | 'alias' | 'bond' | 'bridge' | 'eth' | 'fabric' | 'unknown' | 'vlan' | 'vnet';
+/**
+ * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED — each is a MEASURED forever-diff, and the
+ *   evidence for every one of them is below, beside the code that reads them.
+ */
+export interface NodeNetworkAttributes {
+    node: string;
+    iface: string;
+    type: string;
+    cidr: string;
+    gateway: string;
+    autostart: boolean;
+    mtu: number;
+    comments: string;
+    bridge_ports: string;
+    bridge_vids: string;
+    bridge_vlan_aware: boolean;
+    slaves: string;
+    bond_mode: string;
+    bond_xmit_hash_policy: string;
+    'bond-primary': string;
+    'vlan-id': number;
+    'vlan-raw-device': string;
+    priority: number;
+    method: string;
+    families: string;
+    active: boolean;
+    exists: boolean;
+    bond_miimon: string;
+    bridge_stp: string;
+    bridge_fd: string;
+}
+/**
+ * ★ Default `read` role — `Sys.Audit` on `/nodes/{node}` (node-network.ts's header).
+ * ⛔ `{ node: props.node, iface: props.iface }`, NEVER THE WHOLE `props` — storage.ts's/user.ts's
+ *   own ⛔, the kit 0.31.1 regression: `GetNodeNetworkRequest`'s schema declares only `node` and
+ *   `iface` (both path labels); any OTHER key on the object passed to `nodes.getNodeNetwork` is
+ *   treated by distilled's `buildRequest` as an "unknown key" and JSON-encoded onto this bodyless
+ *   GET, which a stricter fetch client refuses outright.
+ * ⛔ A MISSING INTERFACE IS A 400, NOT A 500 AND NOT A 404 — MEASURED against the live cluster
+ *   (TB4 `n2`, read-role, read-only probe, 2026-09-24): `GET /nodes/n2/network/vmbr9` answers
+ *   `{"errors":{"iface":"interface does not exist"},"data":null,"message":"Parameter verification
+ *   failed.\n"}` at HTTP 400 — a THIRD shape, different from every other migrated family's
+ *   measured 500. `@distilled.cloud/proxmox` types this as a genuine typed error,
+ *   `ParameterVerificationFailed` (`errors.ts`), carrying the per-field `errors` object rather
+ *   than collapsing it to an opaque `BadRequest` — PVE's OWN 400 is never one shape (it is
+ *   whatever the endpoint's parameter verification rejected), so `errors.ts`'s own header spells
+ *   out why this ONE typed error is global rather than per-operation.
+ * ⛔ ONLY THIS EXACT SIGNAL MEANS ABSENT, EVEN WITH THE FOLD BELOW. A different 400 reason, a
+ *   permission gap, a network blip, or ANY OTHER `ParameterVerificationFailed` reason is never
+ *   read as "this interface is not there" — `diff` calls this directly and propagates every one
+ *   of them loudly.
+ */
+export declare const readInterfaceOrFail: (props: NodeNetworkProps) => Effect.Effect<typeof UNREADABLE | NodeNetworkAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`'s adoption/recovery branch
+ *   AND `reconcile` MAY USE IT — FOUND BY ADVERSARIAL REVIEW, 2026-09-24: a first draft used
+ *   `readInterfaceOrFail` (precise, non-folding) for EVERY caller, on the reasoning that a typed,
+ *   parsed absence signal made folding unnecessary. That reasoning conflated two different
+ *   questions: HOW PRECISELY a signal means absent (this family's is unusually precise), and
+ *   WHETHER a given caller can safely treat an UNRELATED failure as "proceed as though absent"
+ *   (storage.ts's/user.ts's own reasoning: a wrongful fold costs at most a redundant
+ *   `createNodeNetwork` POST, refused loudly). Plan.ts's cold-start adoption probe and
+ *   interrupted-create recovery, and Apply.ts's delete recovery, all call `read` with
+ *   `output: undefined` and NO catch of their own (`Plan.ts` v2.0.0-beta.79 ~line 1308) — and
+ *   Plan.ts fails the WHOLE PLAN, every other resource included, if that call throws. A malformed
+ *   `iface` in ONE brand-new declaration (a DIFFERENT `ParameterVerificationFailed` than the
+ *   absence one) would abort `bun run plan` for the entire stack under the precise-only design,
+ *   where every other migrated family instead defers that same malformed declaration to a scoped,
+ *   loud refusal at apply. This restores that same fold for those three call sites.
+ */
+export declare const readInterface: (props: NodeNetworkProps) => Effect.Effect<typeof UNREADABLE | NodeNetworkAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
+export declare const dropUnreadable: (live: NodeNetworkAttributes | Unreadable | undefined) => NodeNetworkAttributes | undefined;
+/**
+ * ⛔ `cidr` IS THE ONLY FIELD COMPARED WHEN UNDECLARED, AND THAT ASYMMETRY IS THE POINT. Every
+ *   other field here follows storage.ts: undeclared means unmanaged, so it is neither sent nor
+ *   compared and a plan cannot report an update no write could satisfy. `cidr` cannot be
+ *   unmanaged, because PVE derives `method` from the presence of an address IN THE FORM — an
+ *   omission is an edit. Comparing it unconditionally is what makes that edit visible in `plan`
+ *   instead of at `ifreload` time.
+ *
+ * ⚠️ NOTHING IN THE REPORTED-ONLY BLOCK IS HERE, and that is what makes the C1 declaration
+ *   plan as `noop` on all three nodes at once — the module header lists them and the
+ *   measurement behind each.
+ */
+export declare const matches: (attributes: NodeNetworkAttributes, props: NodeNetworkProps) => boolean;
+//# sourceMappingURL=node-network-wire.d.ts.map

package/dist/proxmox/node-network-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-network-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network-wire.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,KAAK,gBAAgB,EAOtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,CAAC;AAEX;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AA4DD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,UAAW,gBAAgB,m3BAmBxD,CAAC;AAEJ;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,UAAW,gBAAgB,sIACmB,CAAC;AAEzE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,qBAAqB,GAAG,UAAU,GAAG,SAAS,sCAC3C,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAcnB,CAAC"}

package/dist/proxmox/node-network.d.ts

@@ -11,6 +11,9 @@
  *   that apply — this one never calls it, exactly as `Proxmox.SdnZone` never calls
  *   `Proxmox.SdnApply`.
  *
+ * ⛔ `Proxmox.NetworkApply` STAYS ON `client.ts`, NOT MIGRATED WITH THIS FILE — network-apply-
+ *   read.ts's own header has the two MEASURED reasons distilled cannot represent yet.
+ *
  * ⛔ CEPH ON C1 RIDES TWO NETWORKS AND THIS API ONLY SEES ONE OF THEM. Measured from
  *   `/etc/pve/ceph.conf` on 2026-09-13:
  *
@@ -18,7 +21,8 @@
  *     cluster_network = 203.0.113.0/24     -> every OSD's cluster_addr: .102 / .103 / .104
  *
  *   The cluster network — OSD REPLICATION, the traffic that rebuilds a lost replica — lives on
- *   `203.0.113.10X/32` addresses carried by `tb0`, `tb1` and `dummy_c1`: the Thunderbolt mesh.
+ *   `203.0.113.10X/32` addresses carried by `tb0`, `tb1` and `dummy_c1`: the Thunderbolt mesh —
+ *   TB4's own fabric ports, EXCLUDED from this family by decision 28/29/9 (SdnFabric owns them).
  *
  * ⛔ AND THOSE ADDRESSES ARE INVISIBLE HERE, WHICH IS THE TRAP. They are declared in
  *   `/etc/network/interfaces.d/sdn`, and PVE's network API does not parse that directory.
@@ -34,8 +38,9 @@
  *   owns them, not this resource.
  *
  * ⚠️ Two ways this file limits the damage on the interfaces it CAN see: `cidr` is compared
- *   unconditionally (the ⛔ on `matches`), and a live interface whose `type` disagrees with the
- *   declaration is reported ABSENT rather than retyped (the ⛔ in `attributes`).
+ *   unconditionally (node-network-wire.ts's own ⛔ on `matches`), and a live interface whose
+ *   `type` disagrees with the declaration is reported ABSENT rather than retyped
+ *   (node-network-wire.ts's `attributesOf`).
  *
  * ★ THE REASON IT EXISTS IS THAT THE STAGED READ CANNOT TELL YOU THE NETWORK IS RIGHT — it can
  *   only tell you the FILE is. Once anything is staged, `GET /nodes/{node}/network/{iface}`
@@ -48,11 +53,9 @@
  *   object to scope to, so that also buys the node's services, certificates, DNS and time.
  *   Collected with every other family in docs/privileges.md.
  *
- * ★ A RECONCILE OVER A MATCHING INTERFACE IS A NO-WRITE, AND AN EARLIER DRAFT OF THIS COMMENT
- *   SAID THE OPPOSITE. `pveOperations.reconcile` gates on `matches` BEFORE the PUT
- *   (`resource.ts`: `else if (spec.updateForm !== undefined && !spec.matches(live, news))`), and
- *   the ⛔ above that line names THIS family as the reason the guard was added — adopting an
- *   interface a node already has would otherwise leave it holding a pending network change.
+ * ★ A RECONCILE OVER A MATCHING INTERFACE IS A NO-WRITE. `reconcile` below gates the PUT on
+ *   `matches` first — adopting an interface a node already has must not leave it holding a
+ *   pending network change, since a PUT under `/nodes/{node}/network/{iface}` STAGES one.
  *
  * ⚠️ WHAT IS STILL TRUE: when `matches` is false the PUT rewrites the whole stanza, and that can
  *   ADD lines the file did not have — a `vlan-raw-device vmbr1` under `vmbr1.42`, where PVE had
@@ -64,110 +67,22 @@
  *   them would put Alchemy one `destroy` away from staging the removal of a node's uplink — and
  *   `delete_network` has NO in-use check at all: MEASURED, it deletes the hash entry and writes
  *   the file. Adoption stays explicit.
+ *
+ * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s
+ *   typed `nodes.getNodeNetwork`/`createNodeNetwork`/`putNodeNetwork2`/`deleteNodeNetwork2`
+ *   (2026-09-24, decision 43). Dual-path read and `read`'s `output`-branching wired like every
+ *   other migrated family; node-network-wire.ts's `readInterfaceOrFail` has the new nuance.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
-/**
- * PVE's interface types. `unknown` is what a NIC it does not manage reports — node-b and node-c both
- * report `wlan0` that way, and node-d has no such interface at all.
- *
- * ⚠️ THAT ASYMMETRY IS A TRAP FOR A DECLARATION SHARED ACROSS NODES. On node-d the read answers 404,
- *   which this provider cannot tell from "deleted", so reconcile POSTs — writing a stanza for a
- *   card that is not in the machine. Declare per node what each node actually has; a physical
- *   interface is discovered, not decided.
- */
-export type NodeNetworkType = 'OVSBond' | 'OVSBridge' | 'OVSIntPort' | 'OVSPort' | 'alias' | 'bond' | 'bridge' | 'eth' | 'fabric' | 'unknown' | 'vlan' | 'vnet';
-export interface NodeNetworkProps extends WithTarget {
-    /** Which node's file this stanza lives in. Interfaces are per node, never cluster-wide. */
-    node: string;
-    /** `vmbr0`, `bond0`, `vmbr1.42`. 2-20 characters, PVE's `pve-iface` format. */
-    iface: string;
-    /** ⛔ REQUIRED ON EVERY WRITE, update included, never used to retype — see `readAttributes`. */
-    type: NodeNetworkType;
-    /**
-     * `198.51.100.12/24`. ⛔ THE ONE FIELD WITH NO UNMANAGED MODE: leaving it out is an instruction
-     * to make the interface `manual`, not an instruction to leave its address alone. The ⛔ on
-     * `updateBody` in node-network-form.ts has the measurement and the consequence.
-     */
-    cidr?: string;
-    /** ⚠️ PVE allows exactly ONE default gateway per node and refuses a second with "Default
-     *  gateway already exists on interface '<other>'". On C1 it is vmbr0.41's. */
-    gateway?: string;
-    /**
-     * `auto <iface>` in the file. Absent on read means off, which is why `bool`'s fallback is used.
-     * ⚠️ UNDECLARED IS UNMANAGED ON AN UPDATE AND OFF ON A CREATE — the same asymmetry storage.ts
-     *   has, and it bites harder here: an interface created without `autostart` is one the node
-     *   will not bring up at boot. Every C1 bridge, bond and vlan carries it.
-     */
-    autostart?: boolean;
-    /** 1280-65520. Unset leaves the file without an `mtu` line and the kernel default in force. */
-    mtu?: number;
-    /** ⚠️ Round-trips only after normalisation — see `comment` in node-network-form.ts. */
-    comments?: string;
-    /** Space-separated, a SET: `enp87s0`, or `bond0`. ⚠️ PVE refuses a port already used elsewhere. */
-    bridge_ports?: string;
-    /** `2-4094`, or `2 100-200`. Only written when `bridge_vlan_aware` is on. */
-    bridge_vids?: string;
-    /** ⛔ A `false` here is sent as `delete=`, never as `0` — the ⛔ on `body` says why. */
-    bridge_vlan_aware?: boolean;
-    /**
-     * A bond's members, space separated. ⚠️ THE PARAMETER IS `slaves`, NOT `bond_slaves`, in BOTH
-     * directions on this PVE: MEASURED, the POST/PUT schema names only `slaves` and the GET returns
-     * `"slaves":"enp2s0f0np0 enp2s0f1np1"`. `bond_slaves` appears nowhere in Network.pm here.
-     */
-    slaves?: string;
-    bond_mode?: string;
-    /** ⚠️ Only written when `bond_mode` is `balance-xor` or `802.3ad`; ignored otherwise. */
-    bond_xmit_hash_policy?: string;
-    /** active-backup only. Kept hyphenated because that is the wire name. */
-    'bond-primary'?: string;
-    /** ⚠️ DERIVED FROM A DOTTED NAME. `vmbr1.42` reports `vlan-id` 42 with no such line in the file;
-     *  declaring it there is harmless but adds a line the file did not have. */
-    'vlan-id'?: number;
-    'vlan-raw-device'?: string;
-}
-/**
- * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED — each is a MEASURED forever-diff, and the
- *   evidence for every one of them is in node-network-form.ts, beside the code that reads them.
- */
-export interface NodeNetworkAttributes {
-    node: string;
-    iface: string;
-    type: string;
-    cidr: string;
-    gateway: string;
-    autostart: boolean;
-    mtu: number;
-    comments: string;
-    bridge_ports: string;
-    bridge_vids: string;
-    bridge_vlan_aware: boolean;
-    slaves: string;
-    bond_mode: string;
-    bond_xmit_hash_policy: string;
-    'bond-primary': string;
-    'vlan-id': number;
-    'vlan-raw-device': string;
-    priority: number;
-    method: string;
-    families: string;
-    active: boolean;
-    exists: boolean;
-    bond_miimon: string;
-    bridge_stp: string;
-    bridge_fd: string;
-}
+import { type NodeNetworkProps } from './node-network-form.ts';
+import type { NodeNetworkAttributes } from './node-network-wire.ts';
+import { type PveRequirements } from './resource-spec.ts';
+export type { NodeNetworkAttributes, NodeNetworkType } from './node-network-wire.ts';
+export type { NodeNetworkProps } from './node-network-form.ts';
 export interface ProxmoxNodeNetwork extends Resource<'Proxmox.NodeNetwork', NodeNetworkProps, NodeNetworkAttributes, never, PveRequirements> {
 }
 /** ★ `retain` by default — a node's only uplink cannot be rebuilt. See the ★ in resource.ts. */
 export declare const ProxmoxNodeNetwork: import("alchemy").ResourceClass<ProxmoxNodeNetwork>;
-/**
- * ⚠️ THE DESTROY IS STAGED LIKE EVERY OTHER WRITE, WHICH MAKES IT THE ONE RECOVERABLE DESTROY IN
- *   THIS PACKAGE. It removes the stanza from `interfaces.new` and nothing else;
- *   `DELETE /nodes/{node}/network` puts the node back by unlinking that file. It becomes
- *   irreversible the moment somebody applies — and PVE performs NO in-use check before removing
- *   an interface other bridges or Ceph still stand on.
- */
 export declare const ProxmoxNodeNetworkProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxNodeNetwork>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=node-network.d.ts.map

package/dist/proxmox/node-network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-network.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAU7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,CAAC;AAEX,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,IAAI,EAAE,eAAe,CAAC;IACtB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;kFAC8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;gFAC4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AA4CH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wIACwD,CAAC"}
+{"version":3,"file":"node-network.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAGL,KAAK,gBAAgB,EAGtB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAIrF,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAiCH,eAAO,MAAM,0BAA0B,wIAuFpC,CAAC"}