@homeflare/alchemy 0.37.1 → 0.37.3

package/src/proxmox/pbs-notification-errors.test.ts

@@ -0,0 +1,93 @@
+/** Read failures must never turn an existing notification route into a planned create. */
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import { engineOver } from '../verify/fake-engine.ts';
+import type { PbsTarget } from './credentials.ts';
+import { fakePve, withoutBao } from './fake-pve.ts';
+import { deleteMatcher, readMatcher } from './pbs-notification-matcher-distilled.ts';
+import {
+  PbsNotificationMatcher,
+  PbsNotificationMatcherProvider,
+} from './pbs-notification-matcher.ts';
+import { createTarget, deleteTarget, readTarget } from './pbs-notification-target-distilled.ts';
+import { PbsNotificationTarget, PbsNotificationTargetProvider } from './pbs-notification-target.ts';
+
+const PBS: PbsTarget = { api: 'https://pbs.test:8007', mount: 'pbs-test', scheme: 'pbs' };
+const MATCHER = { name: 'pager', target: PBS, targets: ['mail-to-root'] };
+const TARGET = { name: 'mail-to-root', target: PBS, type: 'sendmail' as const };
+
+for (const status of [401, 403, 500, 503]) {
+  test(`PBS ${String(status)} fails cold adoption and cannot POST either notification family`, async () => {
+    const fake = fakePve(() => Response.json({ message: 'read refused' }, { status }));
+    const providers = Layer.mergeAll(
+      PbsNotificationMatcherProvider(),
+      PbsNotificationTargetProvider(),
+    );
+    const stack = Effect.gen(function* () {
+      yield* PbsNotificationMatcher('pager', MATCHER);
+      yield* PbsNotificationTarget('mail', TARGET);
+    });
+    await withoutBao(async () => {
+      const engine = engineOver(providers.pipe(Layer.provideMerge(fake.layer)));
+      await expect(engine.deploy(stack)).rejects.toBeDefined();
+    });
+    expect(fake.writes()).toEqual([]);
+  });
+}
+
+test('only the typed NotFound is absence, and deleting it is idempotent for both families', async () => {
+  // PBS 4.2 read-only missing-name probe, 2026-09-24: notification absence is plain-text 404.
+  const fake = fakePve(() => new Response("matcher 'pager' not found", { status: 404 }));
+  await withoutBao(async () => {
+    const outcome = await Effect.runPromise(
+      Effect.gen(function* () {
+        const matcher = yield* readMatcher(MATCHER);
+        const target = yield* readTarget(TARGET);
+        yield* deleteMatcher(MATCHER);
+        yield* deleteTarget(TARGET);
+        return { matcher, target };
+      }).pipe(Effect.provide(fake.layer)),
+    );
+    expect(outcome).toEqual({ matcher: undefined, target: undefined });
+  });
+});
+
+test('a malformed successful resource response is a failure, never absence', async () => {
+  const fake = fakePve(() => undefined);
+  await withoutBao(async () => {
+    for (const read of [
+      readMatcher(MATCHER).pipe(Effect.asVoid),
+      readTarget(TARGET).pipe(Effect.asVoid),
+    ]) {
+      await expect(Effect.runPromise(read.pipe(Effect.provide(fake.layer)))).rejects.toBeDefined();
+    }
+  });
+  expect(fake.writes()).toEqual([]);
+});
+
+test('typed write errors also propagate instead of being treated as completed deletes', async () => {
+  const fake = fakePve(() => Response.json({ message: 'permission denied' }, { status: 403 }));
+  await withoutBao(async () => {
+    for (const remove of [deleteMatcher(MATCHER), deleteTarget(TARGET)]) {
+      const error = await Effect.runPromise(remove.pipe(Effect.flip, Effect.provide(fake.layer)));
+      expect(error).toMatchObject({ _tag: 'Forbidden' });
+    }
+  });
+  expect(fake.writes()).toHaveLength(2);
+});
+
+test('invalid SDK input never echoes a write-only value or sends a vendor request', async () => {
+  const fake = fakePve(() => undefined);
+  await withoutBao(async () => {
+    const error = await Effect.runPromise(
+      createTarget(
+        { ...TARGET, type: 'smtp' },
+        { name: TARGET.name, password: 'invalid-input-secret-must-stay-private' },
+      ).pipe(Effect.flip, Effect.provide(fake.layer)),
+    );
+    expect(error).toMatchObject({ _tag: 'PbsNotificationInputRefusal' });
+    expect(JSON.stringify(error)).not.toContain('invalid-input-secret-must-stay-private');
+  });
+  expect(fake.calls).toEqual([]);
+});

package/src/proxmox/pbs-notification-input.ts

@@ -0,0 +1,25 @@
+/** Validate translated fields with the SDK's own schema without echoing write-only values. */
+import * as Data from 'effect/Data';
+import * as Effect from 'effect/Effect';
+import * as Schema from 'effect/Schema';
+
+export class PbsNotificationInputRefusal extends Data.TaggedError('PbsNotificationInputRefusal')<{
+  readonly message: string;
+}> {}
+
+/**
+ * Fields already use SDK Type-side names; toType validates without any wire transforms.
+ * A schema diagnostic can reproduce the whole submitted form, including a webhook secret or
+ * SMTP password. Sanitize only our pre-request validation failure. SDK operation errors below
+ * this boundary retain their original typed tags and are never remapped.
+ */
+export const notificationInput = <S extends Schema.Top>(schema: S, fields: unknown) =>
+  Schema.decodeUnknownEffect(Schema.toType(schema))(fields).pipe(
+    Effect.mapError(
+      () =>
+        new PbsNotificationInputRefusal({
+          message:
+            'PBS notification fields do not match the SDK request schema; no PBS request was sent.',
+        }),
+    ),
+  );

package/src/proxmox/pbs-notification-mail.test.ts

@@ -0,0 +1,64 @@
+/** Mail target CRUD uses the SDK's field spellings without losing lists or the password seal. */
+import { afterEach, expect, test } from 'bun:test';
+import * as Layer from 'effect/Layer';
+import { engineOver } from '../verify/fake-engine.ts';
+import type { PbsTarget } from './credentials.ts';
+import { fakeNotify } from './fake-pbs-notify.ts';
+import { withoutBao } from './fake-pve.ts';
+import { PbsNotificationTarget, PbsNotificationTargetProvider } from './pbs-notification-target.ts';
+
+const PBS: PbsTarget = { api: 'https://pbs.test:8007', mount: 'pbs-test', scheme: 'pbs' };
+const PASSWORD = 'smtp-test-secret-not-real';
+afterEach(() => {
+  delete process.env['HF_PBS_SMTP_TEST_PASSWORD'];
+});
+
+for (const type of ['sendmail', 'smtp'] as const) {
+  test(`${type} creates, reads its dashed fields, clears recipients and redeploys without a write`, async () => {
+    process.env['HF_PBS_SMTP_TEST_PASSWORD'] = PASSWORD;
+    const fake = fakeNotify();
+    const declare = (mailto: readonly string[]) =>
+      PbsNotificationTarget('pager', {
+        type,
+        name: 'pager',
+        target: PBS,
+        'from-address': 'sender@example.com',
+        'mailto-user': ['root@pam'],
+        mailto,
+        ...(type === 'smtp'
+          ? {
+              mode: 'starttls' as const,
+              password: { fromEnv: 'HF_PBS_SMTP_TEST_PASSWORD' },
+              port: 587,
+              server: 'smtp.example.com',
+              username: 'pager',
+            }
+          : {}),
+      });
+    await withoutBao(async () => {
+      const engine = engineOver(
+        PbsNotificationTargetProvider().pipe(Layer.provideMerge(fake.layer)),
+      );
+      await engine.deploy(declare(['ops@example.com', 'backup@example.com']));
+      expect(
+        (await engine.verify(declare(['ops@example.com', 'backup@example.com']), { all: true }))
+          .rows[0]?.diff,
+      ).toBe('noop');
+      expect(engine.stored()).not.toContain(PASSWORD);
+      await engine.deploy(declare([]));
+      expect((await engine.verify(declare([]), { all: true })).rows[0]?.diff).toBe('noop');
+      await engine.deploy(declare([]));
+    });
+    expect(fake.writes()).toEqual([
+      `POST config/notifications/endpoints/${type}`,
+      `PUT config/notifications/endpoints/${type}/pager`,
+    ]);
+    const post = fake.calls.find((call) => call.method === 'POST');
+    expect(post?.pairs).toContainEqual(['from-address', 'sender@example.com']);
+    expect(post?.pairs).toContainEqual(['mailto-user', 'root@pam']);
+    expect(post?.pairs.filter(([key]) => key === 'mailto')).toHaveLength(2);
+    const put = fake.calls.find((call) => call.method === 'PUT');
+    expect(put?.pairs).toContainEqual(['delete', 'mailto']);
+    expect(put?.pairs.map(([key]) => key)).not.toContain('password');
+  });
+}

package/src/proxmox/pbs-notification-matcher-distilled.ts

@@ -0,0 +1,65 @@
+/** PBS 4.2.6-1 matcher operations through SDK 0.3.0; failed reads never become absence. */
+import * as config from '@distilled.cloud/proxmox-backup/config';
+import * as Effect from 'effect/Effect';
+import { notificationInput } from './pbs-notification-input.ts';
+import { runPbs } from './distilled-pbs.ts';
+import {
+  type MatcherCreateForm,
+  type MatcherUpdateForm,
+  matcherAttributes,
+} from './notification-matcher-form.ts';
+import type { PbsNotificationMatcherProps as Props } from './pbs-notification-matcher.ts';
+
+export const readMatcher = (props: Props) =>
+  runPbs(props.target, 'read', config.getConfigNotificationMatcher({ name: props.name })).pipe(
+    Effect.map((row) =>
+      matcherAttributes(
+        {
+          ...row,
+          'invert-match': row.invert_match,
+          'match-calendar': row.match_calendar,
+          'match-field': row.match_field,
+          'match-severity': row.match_severity,
+        },
+        props.name,
+      ),
+    ),
+    Effect.catchTag('NotFound', () => Effect.succeed(undefined)),
+  );
+
+/** Validate with the SDK's request schema after spelling the shared PVE/PBS form's keys. */
+const requestFields = (props: Props, form: MatcherCreateForm | MatcherUpdateForm) => ({
+  ...form,
+  invert_match: form['invert-match'],
+  match_calendar: form['match-calendar'],
+  match_field: form['match-field'],
+  match_severity: form['match-severity'],
+  name: props.name,
+});
+
+export const createMatcher = (props: Props, form: MatcherCreateForm) =>
+  runPbs(
+    props.target,
+    'provision',
+    notificationInput(
+      config.CreateConfigNotificationMatcherRequest,
+      requestFields(props, form),
+    ).pipe(Effect.flatMap(config.createConfigNotificationMatcher)),
+  );
+
+export const updateMatcher = (props: Props, form: MatcherUpdateForm) =>
+  runPbs(
+    props.target,
+    'provision',
+    notificationInput(config.PutConfigNotificationMatcherRequest, requestFields(props, form)).pipe(
+      Effect.flatMap(config.putConfigNotificationMatcher),
+    ),
+  );
+
+/** PBS reverts built-ins on deletion; it reports NotFound only for an absent user-created row. */
+export const deleteMatcher = (props: Props) =>
+  runPbs(
+    props.target,
+    'provision',
+    config.deleteConfigNotificationMatcher({ name: props.name }),
+  ).pipe(Effect.catchTag('NotFound', () => Effect.void));

package/src/proxmox/pbs-notification-matcher.ts

@@ -36,21 +36,30 @@
  * ★ WHAT THIS NEEDS, READ OFF THE SERVER'S SCHEMA (generated/pbs.ts source):
  *     read      GET                 Sys.Audit  on /system/notifications
  *     write     POST, PUT, DELETE   Sys.Modify on /system/notifications
- *   ⚠️ NOT A DATASTORE PRIVILEGE. A PBS credential scoped to `/datastore/...` reads every matcher
- *     as absent — the "absent, then already exists" signature notification-target.ts describes.
+ *   ⚠️ NOT A DATASTORE PRIVILEGE. A credential scoped to `/datastore/...` cannot read matchers;
+ *     the old client treated that refusal as absent — notification-target.ts describes the
+ *     resulting "absent, then already exists" signature.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
+import { isResolved } from 'alchemy/Diff';
+import type { Input } from 'alchemy/Input';
 import * as Effect from 'effect/Effect';
 import {
   type NotificationMatcherAttributes,
   type NotificationMatcherFields,
-  matcherAttributes,
   matcherCreateForm,
   matcherMatches,
   matcherUpdateForm,
 } from './notification-matcher-form.ts';
-import { type PveRequirements, type WithPbsTarget, pveHandlers } from './resource.ts';
+import type { PveRequirements, WithPbsTarget } from './resource.ts';
+import { guardForm } from './constraint-guard.ts';
+import {
+  createMatcher,
+  deleteMatcher,
+  readMatcher,
+  updateMatcher,
+} from './pbs-notification-matcher-distilled.ts';
 
 export interface PbsNotificationMatcherProps extends NotificationMatcherFields, WithPbsTarget {}
 
@@ -65,19 +74,63 @@ export interface PbsNotificationMatcher extends Resource<
 /** ⚠️ No `retain`, for notification-matcher.ts's reason; a built-in REVERTS on delete. */
 export const PbsNotificationMatcher = Resource<PbsNotificationMatcher>('Pbs.NotificationMatcher');
 
-const handlers = pveHandlers<PbsNotificationMatcherProps, NotificationMatcherAttributes>({
-  attributes: (live, props) => matcherAttributes(live, props.name),
-  collection: () => 'config/notifications/matchers',
-  createForm: matcherCreateForm,
-  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */
-  endpoint: {
-    create: 'pbs:POST /config/notifications/matchers',
-    update: 'pbs:PUT /config/notifications/matchers/{name}',
-  },
-  matches: matcherMatches,
-  path: (props) => `config/notifications/matchers/${props.name}`,
-  updateForm: matcherUpdateForm,
-});
+type Props = PbsNotificationMatcherProps;
+type Attributes = NotificationMatcherAttributes;
+
+const guardCreate = (props: Props, requirePresence: boolean) =>
+  guardForm('pbs:POST /config/notifications/matchers', matcherCreateForm(props), requirePresence);
+const guardUpdate = (props: Props) =>
+  guardForm('pbs:PUT /config/notifications/matchers/{name}', matcherUpdateForm(props), false);
+
+/**
+ * SDK-backed lifecycle: read before writing and compare the entire rule so adoption is free.
+ * ⛔ A 401, 403, malformed response or failed credential mint must fail the plan. Only the
+ *   SDK's typed NotFound means absent; the old factory turned all of these into false creates.
+ */
+const handlers = {
+  /** Built-ins belong to the host; adopting them must stay an explicit declaration. */
+  list: () => Effect.succeed([]),
+  read: ({ olds }: { olds: Props }) => readMatcher(olds),
+  diff: ({
+    news,
+    olds,
+    output,
+  }: {
+    news: Input<Props>;
+    olds: Props;
+    output: Attributes | undefined;
+  }) =>
+    Effect.gen(function* () {
+      if (!isResolved(news)) return undefined;
+      yield* guardCreate(news, output === undefined);
+      yield* guardUpdate(news);
+      if (output === undefined) return undefined;
+      if (olds.name !== news.name) return { action: 'replace' } as const;
+      const live = yield* readMatcher(news);
+      if (live === undefined) {
+        yield* guardCreate(news, true);
+        return { action: 'update' } as const;
+      }
+      return { action: matcherMatches(live, news) ? 'noop' : 'update' } as const;
+    }),
+  reconcile: ({ news }: { news: Props }) =>
+    Effect.gen(function* () {
+      const live = yield* readMatcher(news);
+      yield* guardCreate(news, live === undefined);
+      yield* guardUpdate(news);
+      if (live === undefined) yield* createMatcher(news, matcherCreateForm(news));
+      else if (!matcherMatches(live, news)) yield* updateMatcher(news, matcherUpdateForm(news));
+      const after = yield* readMatcher(news);
+      if (after === undefined)
+        return yield* Effect.fail(
+          new Error(
+            `config/notifications/matchers/${news.name}: the write returned no error but the matcher is still absent.`,
+          ),
+        );
+      return after;
+    }),
+  delete: ({ olds }: { olds: Props }) => deleteMatcher(olds),
+};
 
 export const PbsNotificationMatcherProvider = () =>
   Provider.effect(

package/src/proxmox/pbs-notification-target-distilled.ts

@@ -0,0 +1,124 @@
+/**
+ * PBS 4.2.6-1 notification operations, generated from its vendor schema in SDK 0.3.0.
+ *
+ * ★ Keep targetForm's selective secret groups and deletion semantics. The SDK schemas validate
+ *   the spelling adapter before their typed operations encode it; no request shape is cast.
+ *   Only the SDK's NotFound is absence. An unreadable target must stop adoption, not create it.
+ */
+import * as config from '@distilled.cloud/proxmox-backup/config';
+import type {
+  ProxmoxBackupOpContext,
+  ProxmoxBackupOpError,
+} from '@distilled.cloud/proxmox-backup/Protocol';
+import * as Effect from 'effect/Effect';
+import { notificationInput } from './pbs-notification-input.ts';
+import type { PveForm } from './client.ts';
+import { runPbs } from './distilled-pbs.ts';
+import type { PbsNotificationTargetProps as Props } from './pbs-notification-target.ts';
+import { targetAttributes } from './pbs-notification-target-wire.ts';
+
+/** SDK property names differ from the vendor's form keys only at these two fields. */
+const requestFields = (props: Props, form: PveForm) => ({
+  ...form,
+  from_address: form['from-address'],
+  mailto_user: form['mailto-user'],
+  name: props.name,
+});
+
+const read = (
+  props: Props,
+): Effect.Effect<Record<string, unknown>, ProxmoxBackupOpError, ProxmoxBackupOpContext> => {
+  switch (props.type) {
+    case 'sendmail':
+      return config.getConfigNotificationEndpointSendmail({ name: props.name }).pipe(
+        Effect.map((row) => ({
+          ...row,
+          'from-address': row.from_address,
+          'mailto-user': row.mailto_user,
+        })),
+      );
+    case 'smtp':
+      return config.getConfigNotificationEndpointSmtp({ name: props.name }).pipe(
+        Effect.map((row) => ({
+          ...row,
+          'from-address': row.from_address,
+          'mailto-user': row.mailto_user,
+        })),
+      );
+    case 'webhook':
+      return config
+        .getConfigNotificationEndpointWebhook({ name: props.name })
+        .pipe(Effect.map((row) => ({ ...row })));
+  }
+};
+
+export const readTarget = (props: Props) =>
+  runPbs(props.target, 'read', read(props)).pipe(
+    Effect.map((row) => targetAttributes(row, props)),
+    Effect.catchTag('NotFound', () => Effect.succeed(undefined)),
+  );
+
+/** No request: run the same translated-input validation before replacement can delete anything. */
+export const validateTargetWrite = (props: Props, form: PveForm, mode: 'create' | 'update') => {
+  const schema =
+    mode === 'create'
+      ? {
+          sendmail: config.CreateConfigNotificationEndpointSendmailRequest,
+          smtp: config.CreateConfigNotificationEndpointSmtpRequest,
+          webhook: config.CreateConfigNotificationEndpointWebhookRequest,
+        }[props.type]
+      : {
+          sendmail: config.PutConfigNotificationEndpointSendmailRequest,
+          smtp: config.PutConfigNotificationEndpointSmtpRequest,
+          webhook: config.PutConfigNotificationEndpointWebhookRequest,
+        }[props.type];
+  return notificationInput(schema, requestFields(props, form)).pipe(Effect.asVoid);
+};
+
+export const createTarget = (props: Props, form: PveForm) => {
+  const fields = requestFields(props, form);
+  const operation =
+    props.type === 'sendmail'
+      ? notificationInput(config.CreateConfigNotificationEndpointSendmailRequest, fields).pipe(
+          Effect.flatMap(config.createConfigNotificationEndpointSendmail),
+        )
+      : props.type === 'smtp'
+        ? notificationInput(config.CreateConfigNotificationEndpointSmtpRequest, fields).pipe(
+            Effect.flatMap(config.createConfigNotificationEndpointSmtp),
+          )
+        : notificationInput(config.CreateConfigNotificationEndpointWebhookRequest, fields).pipe(
+            Effect.flatMap(config.createConfigNotificationEndpointWebhook),
+          );
+  return runPbs(props.target, 'provision', operation);
+};
+
+export const updateTarget = (props: Props, form: PveForm) => {
+  const fields = requestFields(props, form);
+  const operation =
+    props.type === 'sendmail'
+      ? notificationInput(config.PutConfigNotificationEndpointSendmailRequest, fields).pipe(
+          Effect.flatMap(config.putConfigNotificationEndpointSendmail),
+        )
+      : props.type === 'smtp'
+        ? notificationInput(config.PutConfigNotificationEndpointSmtpRequest, fields).pipe(
+            Effect.flatMap(config.putConfigNotificationEndpointSmtp),
+          )
+        : notificationInput(config.PutConfigNotificationEndpointWebhookRequest, fields).pipe(
+            Effect.flatMap(config.putConfigNotificationEndpointWebhook),
+          );
+  return runPbs(props.target, 'provision', operation);
+};
+
+/** Built-ins still follow PBS's revert-on-delete semantics; missing objects are already deleted. */
+export const deleteTarget = (props: Props) => {
+  const request = { name: props.name };
+  const operation =
+    props.type === 'sendmail'
+      ? config.deleteConfigNotificationEndpointSendmail(request)
+      : props.type === 'smtp'
+        ? config.deleteConfigNotificationEndpointSmtp(request)
+        : config.deleteConfigNotificationEndpointWebhook(request);
+  return runPbs(props.target, 'provision', operation).pipe(
+    Effect.catchTag('NotFound', () => Effect.void),
+  );
+};

package/src/proxmox/pbs-notification-target-lifecycle.ts

@@ -14,7 +14,13 @@
 import { isResolved } from 'alchemy/Diff';
 import type { Input } from 'alchemy/Input';
 import * as Effect from 'effect/Effect';
-import { pve } from './client.ts';
+import {
+  createTarget,
+  deleteTarget,
+  readTarget as readLive,
+  updateTarget,
+  validateTargetWrite,
+} from './pbs-notification-target-distilled.ts';
 import { guardForm } from './constraint-guard.ts';
 import { pbsTargetEndpoint } from './pbs-notification-target-endpoint.ts';
 import type {
@@ -31,7 +37,6 @@ import {
   sealedState,
   targetForm,
 } from './pbs-notification-target-form.ts';
-import { targetAttributes } from './pbs-notification-target-wire.ts';
 import { seal } from '../secrets/write-only.ts';
 
 type Props = PbsNotificationTargetProps;
@@ -39,16 +44,6 @@ type Attributes = PbsNotificationTargetAttributes;
 
 const path = (props: Props) => `config/notifications/endpoints/${props.type}/${props.name}`;
 
-/**
- * ⚠️ A 404 and `{"data": null}` are answers here — and so, resource.ts's ⛔, is a 403. `pve()`
- *   returns `null` for the second, not `undefined`, so the test is `== null`.
- */
-const readLive = (props: Props) =>
-  pve<Record<string, unknown>>(props.target, 'read', 'GET', path(props)).pipe(
-    Effect.map((data) => (data == null ? undefined : targetAttributes(data, props))),
-    Effect.orElseSucceed(() => undefined),
-  );
-
 const refuse = (props: Props) => {
   const reasons = refusals(props);
   return reasons.length === 0
@@ -124,10 +119,25 @@ export const handlers = {
   }) =>
     Effect.gen(function* () {
       if (output === undefined || !isResolved(news)) return undefined;
+      yield* refuse(news);
       if (olds !== undefined && (olds.type !== news.type || olds.name !== news.name)) {
+        // ⛔ Preflight the destination before delete-first can remove a working target. A rename
+        // may adopt an existing endpoint; its write-only values have no seal from this resource.
+        const destination = yield* readLive(news);
+        const groups = resolveGroups(news);
+        const carry =
+          destination === undefined
+            ? { header: true, sealed: true }
+            : toCarry(destination, news, groups, '');
+        if (carry !== undefined) {
+          yield* requireValues(news, groups, carry);
+          const mode = destination === undefined ? 'create' : 'update';
+          const form = targetForm(news, groups, carry, mode);
+          yield* guardForm(pbsTargetEndpoint(news)[mode], form, destination === undefined);
+          yield* validateTargetWrite(news, form, mode);
+        }
         return { action: 'replace', deleteFirst: olds.name === news.name } as const;
       }
-      yield* refuse(news);
       const live = yield* readLive(news);
       if (live === undefined) return { action: 'update' } as const;
       return toCarry(live, news, resolveGroups(news), output.sealed) === undefined
@@ -143,7 +153,6 @@ export const handlers = {
       if (live === undefined) {
         const carry = { header: true, sealed: true } as const;
         yield* requireValues(news, groups, carry);
-        const collection = `config/notifications/endpoints/${news.type}`;
         const form = targetForm(news, groups, carry, 'create');
         /**
          * ⛔ WITH PRESENCE, BECAUSE THIS BRANCH IS UNCONDITIONALLY THE CREATE. PBS marks `name` on
@@ -153,7 +162,7 @@ export const handlers = {
          *   parameter NAME into its message (constraints.ts), so a refusal never quotes one.
          */
         yield* guardForm(pbsTargetEndpoint(news).create, form, true);
-        yield* pve(news.target, 'provision', 'POST', collection, form);
+        yield* createTarget(news, form);
         sealed = seal(groups.sealed.values);
       } else {
         const carry = toCarry(live, news, groups, sealed);
@@ -162,7 +171,7 @@ export const handlers = {
           const form = targetForm(news, groups, carry, 'update');
           /** ⚠️ NO PRESENCE: an update form is partial by design — it carries what `toCarry` said. */
           yield* guardForm(pbsTargetEndpoint(news).update, form, false);
-          yield* pve(news.target, 'provision', 'PUT', path(news), form);
+          yield* updateTarget(news, form);
           if (carry.sealed) sealed = seal(groups.sealed.values);
         }
       }
@@ -175,5 +184,5 @@ export const handlers = {
       }
       return { ...after, sealed } satisfies Attributes;
     }),
-  delete: ({ olds }: { olds: Props }) => pve(olds.target, 'provision', 'DELETE', path(olds)),
+  delete: ({ olds }: { olds: Props }) => deleteTarget(olds),
 };

package/src/proxmox/pbs-notification-target.ts

@@ -24,7 +24,7 @@
  *   the consequence. Read `origin` before declaring a name you did not create.
  *
  * ★ WHAT THIS NEEDS (generated/pbs.ts source): Sys.Audit on /system/notifications to read,
- *   Sys.Modify there to write. A datastore-scoped credential reads every target as absent.
+ *   Sys.Modify there to write. A datastore-scoped credential cannot read targets; its typed refusal now fails the plan.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/src/proxmox/pbs-notifications-stack.test.ts

@@ -92,3 +92,28 @@ test('a new type under the same name replaces delete-first — names are unique
     'POST config/notifications/endpoints/sendmail',
   ]);
 });
+
+test('renaming a matcher replaces it instead of leaving the old route behind', async () => {
+  const fake = fakeNotify();
+  const declare = (name: string) =>
+    PbsNotificationMatcher('route', {
+      name,
+      target: PBS,
+      targets: ['mail-to-root'],
+    });
+  await withoutBao(async () => {
+    const engine = engineOver(
+      PbsNotificationMatcherProvider().pipe(Layer.provideMerge(fake.layer)),
+    );
+    await engine.deploy(declare('route-old'));
+    await engine.deploy(declare('route-new'));
+    expect((await engine.verify(declare('route-new'), { all: true })).rows[0]?.diff).toBe('noop');
+  });
+  expect(fake.objects.has('config/notifications/matchers/route-old')).toBe(false);
+  expect(fake.objects.has('config/notifications/matchers/route-new')).toBe(true);
+  expect(fake.writes()).toEqual([
+    'POST config/notifications/matchers',
+    'POST config/notifications/matchers',
+    'DELETE config/notifications/matchers/route-old',
+  ]);
+});