@homeflare/alchemy 0.37.2 → 0.37.3

package/dist/proxmox/pbs-sync-job.d.ts

@@ -35,8 +35,8 @@
  *     `/api2/json/config/sync` is not even evidence that the endpoint exists. THE FIRST PLAN
  *     AGAINST A LIVE PBS IS THE MEASUREMENT. Read it; do not deploy it unseen.
  *   ⚠️ AN ERROR BODY IS NOT WRAPPED: the 401 body is the bare text `authentication failed`, not
- *     JSON. `pve()` checks `response.ok` before it parses, so a `pbs()` copied from it is safe —
- *     provided the check stays in that order.
+ *     JSON. The original `pve()` checked status before decoding success data. The distilled PBS
+ *     protocol preserves this distinction and classifies error text through SDK patches.
  *
  * ⚠️ `Proxmox.BackupJob` AND `Pbs.SyncJob` ARE NOT THE SAME FAMILY AND THE NAMES NEARLY COLLIDE.
  *   The first is a PVE vzdump schedule; this is a Proxmox Backup SERVER sync job, on a different
@@ -54,6 +54,8 @@
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
+import type { SyncJobAttributes } from './pbs-sync-job-attributes.ts';
+export type { SyncJobAttributes } from './pbs-sync-job-attributes.ts';
 import type { PveRequirements } from './resource.ts';
 import type { WithPbsTarget } from './resource.ts';
 /**
@@ -155,10 +157,10 @@ export interface SyncJobProps extends WithPbsTarget {
     'transfer-last'?: number;
     /**
      * ⛔ NOT DECLARABLE, AND A COMPILE ERROR RATHER THAN A PROP THAT HALF WORKS — the storage.ts
-     *   `password` idiom, for two independent reasons, either of which alone would be enough.
+     *   `password` idiom. Two barriers originally applied; the second remains unresolved.
      *   1. THE WIRE FORM IS AN ARRAY. PBS takes `group-filter` as a repeated parameter
-     *      (`group-filter=type:ct&group-filter=regex:^web`), and `pve()`'s form is
-     *      `Record<string, string>` — one value per key — so a list cannot be expressed at all.
+     *      (`group-filter=type:ct&group-filter=regex:^web`). The old single-value form could not
+     *      express it; the distilled PBS protocol now supports repeated keys.
      *   2. NARROWING A FILTER MAY BE A DELETE. Whether `remove-vanished` skips the groups a filter
      *      excludes is NOT something I could measure without a credential. If it does not, then
      *      editing this field on a job with `remove-vanished` set removes every local group the new
@@ -166,8 +168,8 @@ export interface SyncJobProps extends WithPbsTarget {
      *      half-working prop.
      *   ★ IT IS STILL REPORTED in the attributes, so a plan shows the filters a hand-made job carries
      *     and this resource never strips them: undeclared is unmanaged, and PBS's update assigns only
-     *     what it was sent. To make it declarable, fix both halves — a form type that can repeat a
-     *     key, and a MEASURED answer to (2) — in that order.
+     *     what it was sent. Making it declarable still needs a MEASURED answer to (2), even though
+     *     the SDK now supplies the necessary repeated-key transport.
      */
     'group-filter'?: never;
     /**
@@ -192,38 +194,6 @@ export interface SyncJobProps extends WithPbsTarget {
      */
     'verified-only'?: boolean;
 }
-export interface SyncJobAttributes {
-    /** From the props — it is the path this object was read by. */
-    id: string;
-    store: string;
-    /** `''` is the root namespace, which is also how PBS spells it. */
-    ns: string;
-    /** `''` means a LOCAL sync — datastore to datastore on this PBS. */
-    remote: string;
-    'remote-store': string;
-    'remote-ns': string;
-    /** `''` means the job runs only when somebody starts it. */
-    schedule: string;
-    comment: string;
-    'remove-vanished': boolean;
-    /** ⚠️ Absent on the wire means `false`, PBS's own default. */
-    'verified-only': boolean;
-    /** `''` means no owner in the config, i.e. `root@pam` at runtime. An identifier, never a secret. */
-    owner: string;
-    /** Bytes per second, or `UNSET` (-1). See `bytes()`. */
-    'rate-in': number;
-    /** `UNSET` (-1) means unset, which means full recursion. `0` is a real value meaning none. */
-    'max-depth': number;
-    /** `UNSET` (-1) means all snapshots. */
-    'transfer-last': number;
-    /**
-     * ⚠️ REPORTED, NEVER SENT, NEVER COMPARED — the live filter list joined for display only. See the
-     *   ⛔ on the prop for why it is not declarable.
-     */
-    'group-filter': string;
-    /** `pull` or `push`. Reported, never compared — create-only here. */
-    'sync-direction': string;
-}
 export interface PbsSyncJob extends Resource<'Pbs.SyncJob', SyncJobProps, SyncJobAttributes, never, PveRequirements> {
 }
 /**

package/dist/proxmox/pbs-sync-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pbs-sync-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-sync-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD;;;;;;;OAOG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,eAAe,EAAE,OAAO,CAAC;IACzB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,gIACgD,CAAC"}
+{"version":3,"file":"pbs-sync-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-sync-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD;;;;;;;OAOG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,gIACgD,CAAC"}

package/dist/proxmox/pbs-verify-job-lifecycle.d.ts

@@ -0,0 +1,22 @@
+import type { Input } from 'alchemy/Input';
+import * as Effect from 'effect/Effect';
+import type { PbsVerifyJobAttributes, PbsVerifyJobProps } from './pbs-verify-job.ts';
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: PbsVerifyJobProps;
+    }) => Effect.Effect<PbsVerifyJobAttributes | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | import("@distilled.cloud/proxmox-backup/Protocol").ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: ({ news, output, }: {
+        news: Input<PbsVerifyJobProps>;
+        output: PbsVerifyJobAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: "noop" | "update";
+    } | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: ({ news }: {
+        news: PbsVerifyJobProps;
+    }) => Effect.Effect<PbsVerifyJobAttributes, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds }: {
+        olds: PbsVerifyJobProps;
+    }) => Effect.Effect<import("@distilled.cloud/proxmox-backup/config").DeleteConfigVerifyResponse | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | import("@distilled.cloud/proxmox-backup/Protocol").ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+//# sourceMappingURL=pbs-verify-job-lifecycle.d.ts.map

package/dist/proxmox/pbs-verify-job-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-verify-job-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-verify-job-lifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAMrF,eAAO,MAAM,QAAQ;IAEnB,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,iBAAiB,CAAA;KAAE;IAC5C,IAAI,sBAGD;QACD,IAAI,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC/B,MAAM,EAAE,sBAAsB,GAAG,SAAS,CAAC;KAC5C;;;IAaD,SAAS,aAAa;QAAE,IAAI,EAAE,iBAAiB,CAAA;KAAE;IAgBjD,MAAM,aAAa;QAAE,IAAI,EAAE,iBAAiB,CAAA;KAAE;CAC/C,CAAC"}

package/dist/proxmox/pbs-verify-job-spec.d.ts

@@ -0,0 +1,16 @@
+/** PBS 4.2.6-1 values and vendor form guards; SDK transport is in pbs-verify-job-wire.ts. */
+import type { PbsVerifyJobAttributes, PbsVerifyJobProps } from './pbs-verify-job.ts';
+import type { PveSpec } from './resource-spec.ts';
+/**
+ * ⚠️ EVERY FIELD IS READ THROUGH `values.ts` THOUGH PBS RETURNS REAL JSON TYPES. Unlike PVE's
+ *   SectionConfig round-trip, `GET /config/verify/{id}` serialises a Rust struct, so
+ *   `ignore-verified` arrives as a JSON boolean and `max-depth` as a JSON number. `bool` and `int`
+ *   accept both spellings, and using them costs nothing while covering the version that does not.
+ * ⚠️ `digest` IS NOT AN ATTRIBUTE AND CANNOT BECOME ONE BY ACCIDENT. PBS puts it on the rpcenv, and
+ *   the JSON formatter adds rpcenv attributes as SIBLINGS of `data` — `{"data":{…},"digest":"…"}` —
+ *   so both the old client and the SDK expose only the resource data. Attributes deliberately
+ *   exclude it: the digest covers verification.cfg as a FILE, so keeping it would churn state
+ *   whenever an unrelated verify job was edited.
+ */
+export declare const spec: PveSpec<PbsVerifyJobProps, PbsVerifyJobAttributes>;
+//# sourceMappingURL=pbs-verify-job-spec.d.ts.map

package/dist/proxmox/pbs-verify-job-spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-verify-job-spec.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-verify-job-spec.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACrF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAIlD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,IAAI,EAAE,OAAO,CAAC,iBAAiB,EAAE,sBAAsB,CA0DnE,CAAC"}

package/dist/proxmox/pbs-verify-job-wire.d.ts

@@ -0,0 +1,11 @@
+/** PBS 4.2.6-1 operations through @distilled.cloud/proxmox-backup. */
+import * as config from '@distilled.cloud/proxmox-backup/config';
+import * as Effect from 'effect/Effect';
+import type { PbsVerifyJobProps } from './pbs-verify-job.ts';
+/** ⛔ Only the SDK VerifyJobNotFound is absence; permission, transport and malformed replies propagate. */
+export declare const readOne: (props: PbsVerifyJobProps) => Effect.Effect<import("./pbs-verify-job.ts").PbsVerifyJobAttributes | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | config.ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const createOne: (props: PbsVerifyJobProps) => Effect.Effect<config.VerifyConfigResponse, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | config.ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const updateOne: (props: PbsVerifyJobProps) => Effect.Effect<config.PutConfigVerifyResponse, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | config.ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** Deleting the schedule never deletes backups; already missing is a successful deletion. */
+export declare const deleteOne: (props: PbsVerifyJobProps) => Effect.Effect<config.DeleteConfigVerifyResponse | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | config.ProxmoxBackupOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=pbs-verify-job-wire.d.ts.map

package/dist/proxmox/pbs-verify-job-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbs-verify-job-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-verify-job-wire.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,KAAK,MAAM,MAAM,wCAAwC,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAkC7D,0GAA0G;AAC1G,eAAO,MAAM,OAAO,UAAW,iBAAiB,4QAI7C,CAAC;AAEJ,eAAO,MAAM,SAAS,UAAW,iBAAiB,uOAC4B,CAAC;AAE/E,eAAO,MAAM,SAAS,UAAW,iBAAiB,0OAC+B,CAAC;AAElF,6FAA6F;AAC7F,eAAO,MAAM,SAAS,UAAW,iBAAiB,yPAK9C,CAAC"}

package/dist/proxmox/pbs-verify-job.d.ts

@@ -9,22 +9,22 @@
  *   green `Proxmox.BackupJob` makes it worse rather than better, because a vzdump job that says
  *   "OK" every night is exactly the evidence people stop at.
  *
- * ⛔ THIS FILE CANNOT AUTHENTICATE UNTIL TWO THINGS OUTSIDE IT CHANGE, AND IT IS SHIPPED SAYING SO
- *   RATHER THAN SHIPPED LOOKING FINISHED. Both are recorded on `PbsTarget` below:
+ * ⚠️ HISTORICAL BOOTSTRAP BLOCKER, 2026-09-13: TWO THINGS OUTSIDE THIS FILE WERE MISSING
+ *   before PBS could authenticate. Both are now resolved by the PBS lane and SDK:
  *     1. `credentials.ts` has no PBS mint. MEASURED 2026-09-13 from this Mac: the agent's
  *        approle is refused `sys/mounts`, `kv/infra/proxmox` and `proxmox-pbs/creds/read` alike —
  *        403 permission denied on all three — so there is no mount to name and none is invented.
  *     2. `client.ts`'s `authorization()` builds a PVE header, and PBS will not accept it. See the
  *        ⛔ on `PbsTarget`.
- *   Until both land, every call 401s, `pveOperations.read` folds that into "absent", and the plan
- *   reports `create` for a job that is plainly there. The deploy then FAILS at the POST rather
+ *   Before both landed, every call 401'd, `pveOperations.read` folded that into "absent", and the plan
+ *   reported `create` for a job that was plainly there. The deploy then FAILED at the POST rather
  *   than clobbering anything — an unauthenticated POST 401s, and an authenticated one is refused
  *   because PBS will not take a duplicate section id — so the cost is a LYING PLAN and a broken
  *   run, not a lost job. That is still reason enough not to wire it into a stack yet: a plan
  *   nobody can trust is its own outage.
  *
- * ⚠️ THE SHAPES BELOW ARE READ FROM PUBLISHED SOURCE, NOT MEASURED ON THIS ESTATE. Everything is
- *   taken from `pbs-api-types/src/jobs.rs`, `src/api2/config/verify.rs`, `src/server/verify_job.rs`
+ * ⚠️ THE ORIGINAL SHAPES WERE READ FROM PUBLISHED SOURCE, NOT MEASURED ON THIS ESTATE. Everything is
+ *   originally taken from `pbs-api-types/src/jobs.rs`, `src/api2/config/verify.rs`, `src/server/verify_job.rs`
  *   and `src/backup/verify.rs` at HEAD of the Proxmox git mirrors on 2026-09-13. What WAS measured
  *   here: `pbs.example.com:8007` and `pbs.mgmt.example.com:8007` both answer HTTP 401 under
  *   STRICT TLS (curl `ssl_verify_result=0`), so no `-k` is needed and `client.ts`'s plain `fetch`
@@ -34,7 +34,7 @@
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import type { PbsTarget } from './credentials.ts';
-import { type PveRequirements } from './resource.ts';
+import type { PveRequirements } from './resource-spec.ts';
 export interface PbsVerifyJobProps {
     /** ⛔ A PBS host, never a PVE cluster. See `PbsTarget`. */
     target: PbsTarget;
@@ -128,7 +128,7 @@ export interface PbsVerifyJob extends Resource<'Pbs.VerifyJob', PbsVerifyJobProp
  */
 export declare const PbsVerifyJob: import("alchemy").ResourceClass<PbsVerifyJob>;
 /**
- * ⛔ `list` IS EMPTY, INHERITED FROM `pveHandlers`, AND THE REASON IS SHARPER HERE THAN ELSEWHERE.
+ * ⛔ `list` STAYS EXPLICITLY EMPTY, AND THE REASON IS SHARPER HERE THAN ELSEWHERE.
  *   `GET /config/verify` returns every verification job the caller can see, including the
  *   ones the PBS installer and a human made. Adopting those would put Alchemy one dropped line
  *   away from DELETING a datastore's only verification schedule — and deleting it destroys nothing
@@ -136,10 +136,10 @@ export declare const PbsVerifyJob: import("alchemy").ResourceClass<PbsVerifyJob>
  *   to say when the rot started. Adoption stays explicit: declare the existing id.
  *
  * ⚠️ NO `digest` IS SENT ON UPDATE OR DELETE, SO THIS IS LAST-WRITER-WINS. PBS accepts an optional
- *   `digest` on both and would refuse a write made against a stale read. Sending one would need a
- *   read-then-write window this provider does not have — `pveOperations` reads and writes in two
- *   separate calls with two separate mints — so a concurrent edit from the PBS UI is overwritten
- *   rather than refused. Same behaviour as every PVE family here; stated because PBS offers better.
+ *   `digest` on both and would refuse a write made against a stale read. This migration preserves
+ *   the existing forms, which omit it; the SDK runner reuses leased credentials but does not add
+ *   an optimistic-lock check. A concurrent edit from the PBS UI may therefore be overwritten
+ *   rather than refused. PBS offers that stronger guarantee as a separate provider change.
  */
 export declare const PbsVerifyJobProvider: () => import("effect/Layer").Layer<Provider.Provider<PbsVerifyJob>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=pbs-verify-job.d.ts.map

package/dist/proxmox/pbs-verify-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pbs-verify-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-verify-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAE,KAAK,eAAe,EAAe,MAAM,eAAe,CAAC;AAGlE,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,MAAM,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,+CAA0C,CAAC;AAyEpE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,kIACkD,CAAC"}
+{"version":3,"file":"pbs-verify-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-verify-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,MAAM,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,+CAA0C,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,kIACkD,CAAC"}

package/dist/proxmox/pool.d.ts

@@ -17,8 +17,10 @@
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
+import * as pools from '@distilled.cloud/proxmox/pools';
+import * as Effect from 'effect/Effect';
 import type { PoolsPoolidPutParams, PoolsPostParams } from './generated/pve.ts';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 export interface PoolProps extends WithTarget {
     /** PVE's primary key for a pool. Changing it is a replace, not an update. */
     poolid: string;
@@ -38,5 +40,12 @@ export declare const ProxmoxPool: import("alchemy").ResourceClass<ProxmoxPool>;
 export declare const poolCreateForm: (props: PoolProps) => PoolsPostParams;
 /** PUT body — only `comment`; path carries `poolid`. Matches deprecated `/pools/{poolid}`. */
 export declare const poolUpdateForm: (props: PoolProps) => Pick<PoolsPoolidPutParams, 'comment'>;
+/** Pool absence is PVE's typed 500, not a catch-all; pve-manager 9.2.11. */
+export declare const readPool: (props: PoolProps) => Effect.Effect<{
+    comment: string;
+    members: number;
+    poolid: string;
+} | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/caddy").UnprocessableEntity | import("@distilled.cloud/proxmox/Errors").ClientErrors, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const deletePool: (props: PoolProps) => Effect.Effect<void | pools.DeletePoolResponse, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/caddy").UnprocessableEntity | import("@distilled.cloud/proxmox/Errors").ClientErrors, import("effect/unstable/http/HttpClient").HttpClient>;
 export declare const ProxmoxPoolProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxPool>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=pool.d.ts.map

package/dist/proxmox/pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAEV,oBAAoB,EACpB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAEjE,mFAAmF;AACnF,eAAO,MAAM,cAAc,UAAW,SAAS,KAAG,eAGhD,CAAC;AAEH,8FAA8F;AAC9F,eAAO,MAAM,cAAc,UAAW,SAAS,KAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAEpF,CAAC;AAoBH,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}
+{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AAGxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAW,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAK/E,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAEjE,mFAAmF;AACnF,eAAO,MAAM,cAAc,UAAW,SAAS,KAAG,eAGhD,CAAC;AAEH,8FAA8F;AAC9F,eAAO,MAAM,cAAc,UAAW,SAAS,KAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAEpF,CAAC;AAsBH,4EAA4E;AAC5E,eAAO,MAAM,QAAQ,UAAW,SAAS;;;;o+BAiBtC,CAAC;AAEJ,eAAO,MAAM,UAAU,UAAW,SAAS,ygCAIxC,CAAC;AAEJ,eAAO,MAAM,mBAAmB,iIAoD7B,CAAC"}

package/docs/pbs-distilled-jobs.md

@@ -0,0 +1,31 @@
+# PBS jobs on distilled
+
+The datastore, prune, sync and verification providers use the typed operations in
+`@distilled.cloud/proxmox-backup`, generated from **proxmox-backup-server 4.2.6-1**.
+`distilled-pbs.ts` supplies the existing leased read/provision credentials to the SDK's
+Credentials service. The SDK owns the `PBSAPIToken` header and request serialization.
+
+Existing props and state remain unchanged: retention windows omitted from a declaration
+stay unmanaged, `remove-vanished` still defaults to false, a verification schedule may be
+explicitly null, and a datastore path or backend change is refused. No automatic clearing,
+new deletion flag or live job execution is introduced.
+
+Read-only probes on 2026-09-24 found that missing configuration sections answer plain-text
+HTTP 400: `no such datastore`, `no such prune`, `no such sync`, or `no such verification`.
+The SDK patches those specific GET errors as `DatastoreNotFound`, `PruneJobNotFound`,
+`SyncJobNotFound` and `VerifyJobNotFound`. Providers catch those tags only. Permission
+errors, unrelated 400/500 responses, malformed replies and failed transports propagate.
+A failed read can no longer become a speculative create or a successful deletion.
+
+Delete first reads the declared item. A typed absent item needs no DELETE. When it exists,
+the provider calls the SDK delete operation; any unclassified error during a concurrent
+removal propagates. The datastore retains its bounded readback and default retain policy;
+`destroy-data` is never sent.
+
+The pinned schema declares a null result for datastore create and a UPID for delete. The
+provider verifies the resulting configuration rather than inventing a create task id.
+
+The offline lifecycle suite uses `alchemy/Test/Bun` and a strict in-memory PBS HTTP
+fixture. It covers matching adoption without writes, genuine create, drift repair followed
+by a no-op plan, and refused reads. Live adoption remains a separate consumer gate against
+the released package; an offline fixture is not proof of the running estate.

package/docs/pbs-notifications.md

@@ -12,6 +12,11 @@
 
 A target that no matcher names receives nothing. Declare both.
 
+PBS lifecycle calls use `@distilled.cloud/proxmox-backup` (vendor schema PBS 4.2.6-1).
+The runner reuses short-lived OpenBao leases and bounds each request to 20 seconds, with SDK
+retries disabled. A typed `NotFound` alone means absence or an already completed delete.
+Other read failures stop the plan, so a denied read cannot silently plan a create.
+
 ## Paging on a failed verify, sync, prune or garbage collection
 
 ```ts
@@ -157,7 +162,8 @@ built-in reverts it to the shipped rule**, and the server reports success. The a
 | PBS    | `Sys.Audit` on `/system/notifications`                          | `Sys.Modify` on `/system/notifications`      |
 | PVE    | `Mapping.Audit` or `Mapping.Modify` on `/mapping/notifications` | `Mapping.Modify` on `/mapping/notifications` |
 
-⚠️ A missing read privilege looks like "absent". The plan says `create` and the server answers
-that the object already exists. Grant the read before changing anything else. On PVE,
+⚠️ The old shared client hid missing read privileges as "absent", planning a `create` that the
+server rejected as already existing. PBS now preserves the SDK refusal and fails the plan.
+Grant the required read privilege before changing infrastructure. On PVE,
 `Mapping.Use` is not enough: it opens the matcher list, not the per-matcher read this package
 makes (`get_matcher` in pve-manager's `Notifications.pm`).

package/docs/proxmox-notification-sdk.md

@@ -0,0 +1,28 @@
+# PVE notification SDK migration
+
+PVE 9.2.11 notification targets and matchers use named distilled SDK operations
+for every lifecycle call. Their existing declaration forms, comparison rules,
+secret omission and vendor constraint guards remain in place.
+
+A missing matcher or target returns HTTP 404, confirmed by read-only probes on
+2026-09-24. The provider catches the SDK's typed `NotFound` for absent reads and
+idempotent deletes. Authentication, permissions, transport failures and unrelated
+server errors propagate. A malformed successful read fails against the SDK's
+response schema; diagnostics do not retain response contents.
+
+SDK request schemas validate the form-name translation before sending a write.
+Arrays use repeated form keys. Commas within matcher rules and webhook property
+strings remain part of each item. An explicitly empty recipient/header list uses
+the vendor's update `delete` field, because an empty SDK array emits no keys.
+Undeclared fields remain unmanaged.
+
+A matching adoption sends no write. A changed name replaces the resource; an
+endpoint changing type under the same name replaces delete-first because the
+name is unique across types. Built-in deletion still reverts the vendor default,
+and a gotify create still refuses its missing write-only token: this migration
+does not introduce secrets into persisted props.
+
+`notification-distilled.test.ts` exercises create, matching adoption, list clearing,
+identity replacement, malformed/refused reads and subsequent no-op plans through
+the upstream Alchemy harness and real SDK protocol. Live verification follows the
+published release in the consuming stack; fixtures do not prove live writes.

package/docs/proxmox-sdk-migration.md

@@ -0,0 +1,60 @@
+# PVE/PBS SDK migration
+
+2026-09-24. Transport completion and live adoption are separate gates. The interim
+SDKs follow [the distilled route](./distilled-interim.md): generated vendor schemas,
+local distilled fixes first, verbatim source copies, and published npm aliases.
+
+## Implemented transport
+
+Seventeen existing PVE resource families use named distilled operations throughout:
+ACL, ApiToken, BackupJob, CephDaemon, CephFs, CephOsd, CephPool, Group, MetricServer,
+NodeNetwork, NotificationMatcher, NotificationTarget, Pool, Role, Storage, User and
+ZfsPool. All six existing PBS families now do too: Datastore, NotificationMatcher,
+NotificationTarget, PruneJob, SyncJob and VerifyJob.
+
+The latest migration preserves credential leases, safe member failover, bounded
+polling, vendor constraints, write-only secret handling and existing state shapes.
+The newly migrated pool, metric, job and notification providers fold only typed
+missing-resource errors to absence; their other SDK failures propagate.
+Protocol fixtures exercise the generated operations; Alchemy engine tests prove
+matching adoption does not write and a real update settles to a no-op.
+
+The SDK patches record PVE 9.2.11 source and PBS 4.2.6-1 schema provenance. Read-only
+probes against PVE 9.2.11 and PBS 4.2.3 distinguish notification HTTP404 responses
+from PBS configuration HTTP400 responses. Resource providers do not inspect status
+codes or message text to make that distinction.
+
+## Consumer gate
+
+These families cover the default TB4/HF-Ops/PBS adoption declarations in
+`homeflare-proxmox` at commit `91b31b0`. Its opt-in vault-door Lxc is still a later
+slice. This source migration alone does not establish live adoption.
+After both SDKs and the provider release publish, the consumer pins those exact
+versions, runs its full check and all three adoption verifiers, then compares the
+read and admin plans at stage `live`. A write requires a fresh matching proof.
+
+## Remaining PVE families
+
+Twelve existing families still retain some hand-client transport: Lxc, Vm (QEMU),
+NetworkApply, SdnApply, SdnZone, SdnVnet, SdnSubnet, HaResource, HaRule,
+ReplicationJob, FirewallAlias and CephFlag. Their previous measured-none records
+are historical inventories, not a current census or permission to skip migration.
+
+- NetworkApply needs the `changes` sibling beside the response's `data`; generic
+  unwrapping discards it. Fix the distilled protocol/schema boundary before moving
+  this read. The network diff can contain secrets and must not enter state or logs.
+- Lxc task polling must keep the credential that started the task, preserve bounded
+  uncertainty after connection loss, and retain its cluster-wide identity checks.
+- SdnApply distinguishes an unavailable subsystem from failed reads and refuses
+  undiffable settings. Those semantics need vendor-backed typed SDK errors.
+- Qemu's guest DELETE route differs from its configuration GET/PUT route; copying
+  the old generic factory path would keep an existing bug.
+
+Complete vendor coverage additionally requires a census of families not yet modeled
+as resources. The 23 migrated families above are a transport milestone, not that
+larger completion claim. No upstream push or pull request was made.
+
+Existing NodeNetwork and ZfsPool adoption/reconcile reads still contain broad failure
+folds. Their strict diff reads do not remove that separate conformance gap. CephFs
+task polling also tolerates temporary read failures, but uses a bounded uncertainty
+policy rather than treating a resource as absent.

package/docs/upstream-conformance-families.md

@@ -10,6 +10,9 @@ measurements and open findings are preserved below.
    - 27 `Effect.die` sites in non-test source (defect risk, not a separate S20 ban);
    - 7 test files on `node:test`;
    - `Pbs.*` type strings (H14).
+     **SDK progress, 2026-09-24:** 17 PVE and all six existing PBS resource families now
+     call named distilled operations. The [migration record](./proxmox-sdk-migration.md)
+     separates that transport milestone, the published-consumer gate and remaining families.
 8. **`talos/*`.** Its `talosctl` calls go through `ChildProcessSpawner`, as upstream's Docker
    provider does, which conforms. Its file handling uses `Bun.file`, `Bun.write`,
    `Bun.YAML` and `node:fs` (S42), and it uses `Effect.promise` in 3 files (S19). The
@@ -75,8 +78,9 @@ HttpClient` client. The old status-carrying `NetboxError` and its `cause.status
 12. **Resource JSDoc is not in upstream's generator format.** Zero files use `@resource`,
     `**Example:**` or `### Section` (S31, H10). **Decision:** maintainer, because it moves
     the house's glyph rationale into `//` comments.
-13. **Tests never use `alchemy/Test/Bun`.** Every lifecycle is proven against loopback
-    fakes (S28, H12). Live suites need a place to run, and that is a maintainer decision.
+13. **Original finding: tests did not use `alchemy/Test/Bun`.** The PVE/PBS SDK migration
+    now exercises provider lifecycles through that upstream engine harness with fake HTTP
+    responses. It does not claim live write coverage; live suites still need a place to run.
 14. **`discord/*` is new (2026-09-24, task-authorized, kit PR TBD) and built directly on
     `@distilled.cloud/discord` — no hand-rolled `client.ts` ever existed to retire.**
     `Discord.ApplicationCommand` and `Discord.GuildApplicationCommand` call the SDK's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.37.2",
+  "version": "0.37.3",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/proxmox/adopt-noop.test.ts

@@ -2,10 +2,9 @@
  * Adopting an object that already matches must be read-only — measured per reconcile SHAPE, through
  * Alchemy's own Plan and Apply over a fake cluster (fake-pve.ts, ../verify/fake-engine.ts).
  *
- * ★ ONE ROW PER WAY A FAMILY REACHES ITS WRITE, not one per family. Every family built on
- *   `pveHandlers` shares resource.ts's reconcile, so `Proxmox.Pool` stands for all of them; `Acl`
- *   wraps that reconcile; `PbsDatastore` and `SdnApply` write their own. CephPool, the one that got
- *   it wrong, has its own file. docs/adopt-verify.md carries the full per-family table.
+ * ★ ONE ROW PER WAY A FAMILY REACHES ITS WRITE, not one per family. Pool now has its own distilled
+ *   lifecycle; `Acl` wraps resource.ts's shared reconcile; `PbsDatastore` and `SdnApply` write their
+ *   own. CephPool, the one that got it wrong, has its own file. docs/adopt-verify.md carries the full per-family table.
  * ⚠️ A FIXTURE THAT DOES NOT MATCH TURNS A ROW INTO A DRIFT TEST, and the assertion on the
  *   verifier's `noop` is what catches that: a wrong fixture fails loudly instead of passing for
  *   the wrong reason. The Pool drift row proves the harness can see a write at all.
@@ -36,7 +35,7 @@ const cases: readonly Case[] = [
   {
     declare: () => ProxmoxPool('lab', { comment: 'x', poolid: 'lab', target: FAKE_TARGET }),
     live: { 'pools/lab': { comment: 'x', members: [] } },
-    name: 'Proxmox.Pool (pveHandlers: every factory family)',
+    name: 'Proxmox.Pool (direct distilled lifecycle)',
     provider: ProxmoxPoolProvider as never,
   },
   {

package/src/proxmox/backup-job-config.ts

@@ -0,0 +1,95 @@
+/** Pure existing forms, normalization and equality, shared by plan and SDK lifecycle. */
+import type { BackupJobAttributes, BackupJobProps } from './backup-job.ts';
+import type { PveSpec } from './resource-spec.ts';
+import { bool, guestList, propertyString, text } from './values.ts';
+
+/**
+ * The form for both create and update.
+ *
+ * ⛔ A FIELD THE DECLARATION LEAVES OUT IS NOT SENT, AND THAT IS LOAD BEARING. PVE's PUT can only
+ *   SET a key; clearing one needs `delete=<key>`, which this resource deliberately never sends.
+ *   `updateForm` is handed the props and nothing else, so a `delete` list could only be "every
+ *   field you did not declare" — and on a job adopted out of the UI that would silently strip
+ *   settings this resource does not even model, `compress`, `mailto` and `bwlimit` among them, on
+ *   the first deploy. Leaving undeclared fields alone is the smaller lie, and `matches` tells the
+ *   same lie consistently: it does not compare what it cannot change.
+ *
+ * ⚠️ THE FIVE FIELDS PVE DOCUMENTS A DEFAULT FOR ARE ALWAYS SENT AND ALWAYS COMPARED — `enabled`
+ *   (1), `all` (0), `mode` (snapshot), `notification-mode` (auto), `repeat-missed` (0). That is
+ *   what makes a hand-flipped `enabled 0` show up as drift rather than as silence, and it is also
+ *   what stops those five looping: a field compared against a default must be sent as that
+ *   default, or every plan reports an update the PUT never performs. The cost is worth reading
+ *   before the first deploy against an adopted job — an omitted `all` is a declaration that this
+ *   job backs up NOTHING, and PVE accepts a job that selects nothing without a word. Read that
+ *   first plan; do not deploy it unseen.
+ */
+const shape = (props: BackupJobProps) => ({
+  all: props.all === true ? '1' : '0',
+  enabled: props.enabled === false ? '0' : '1',
+  mode: props.mode ?? 'snapshot',
+  'notification-mode': props['notification-mode'] ?? 'auto',
+  'repeat-missed': props['repeat-missed'] === true ? '1' : '0',
+  schedule: props.schedule,
+  ...(props.comment === undefined ? {} : { comment: props.comment }),
+  ...(props.exclude === undefined ? {} : { exclude: guestList(props.exclude) }),
+  ...(props.fleecing === undefined ? {} : { fleecing: props.fleecing }),
+  ...(props['notes-template'] === undefined ? {} : { 'notes-template': props['notes-template'] }),
+  ...(props.pool === undefined ? {} : { pool: props.pool }),
+  ...(props['prune-backups'] === undefined ? {} : { 'prune-backups': props['prune-backups'] }),
+  ...(props.storage === undefined ? {} : { storage: props.storage }),
+  ...(props.vmid === undefined ? {} : { vmid: guestList(props.vmid) }),
+});
+
+export const backupJobSpec = {
+  /**
+   * ⛔ NO "IS IT REALLY THERE" GUARD, ON PURPOSE. Returning undefined for a job whose JSON is
+   *   missing some key would be a guess about which keys PVE echoes back, and a wrong guess here
+   *   does not read as absent-and-harmless: `reconcile` would POST, and POST creates ANOTHER job.
+   *   Absence is decided by the API declining to answer, which `pveOperations.read` already
+   *   handles — not by a key being missing from an answer that did arrive.
+   */
+  attributes: (live, props) => ({
+    all: bool(live['all'], false),
+    comment: text(live['comment'], ''),
+    enabled: bool(live['enabled'], true),
+    exclude: guestList(live['exclude']),
+    fleecing: propertyString(live['fleecing'], 'enabled'),
+    id: props.id,
+    mode: text(live['mode'], 'snapshot'),
+    'next-run': typeof live['next-run'] === 'number' ? live['next-run'] : 0,
+    'notes-template': text(live['notes-template'], ''),
+    'notification-mode': text(live['notification-mode'], 'auto'),
+    pool: text(live['pool'], ''),
+    'prune-backups': propertyString(live['prune-backups']),
+    'repeat-missed': bool(live['repeat-missed'], false),
+    schedule: text(live['schedule'], ''),
+    storage: text(live['storage'], ''),
+    vmid: guestList(live['vmid']),
+  }),
+  collection: () => 'cluster/backup',
+  /** ⛔ `id` IS SENT AND IS NOT OPTIONAL. Everything above depends on PVE not inventing one. */
+  createForm: (props) => ({ ...shape(props), id: props.id }),
+  /** Each line reads "not declared, or equal"; the five defaulted fields have no undeclared case. */
+  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */
+  endpoint: { create: 'pve:POST /cluster/backup', update: 'pve:PUT /cluster/backup/{id}' },
+  matches: (attributes, props) =>
+    attributes.schedule === props.schedule &&
+    attributes.enabled === (props.enabled !== false) &&
+    attributes.all === (props.all === true) &&
+    attributes.mode === (props.mode ?? 'snapshot') &&
+    attributes['notification-mode'] === (props['notification-mode'] ?? 'auto') &&
+    attributes['repeat-missed'] === (props['repeat-missed'] === true) &&
+    (props.storage === undefined || attributes.storage === props.storage) &&
+    (props.pool === undefined || attributes.pool === props.pool) &&
+    (props.comment === undefined || attributes.comment === props.comment) &&
+    (props.vmid === undefined || attributes.vmid === guestList(props.vmid)) &&
+    (props.exclude === undefined || attributes.exclude === guestList(props.exclude)) &&
+    (props['notes-template'] === undefined ||
+      attributes['notes-template'] === props['notes-template']) &&
+    (props['prune-backups'] === undefined ||
+      attributes['prune-backups'] === propertyString(props['prune-backups'])) &&
+    (props.fleecing === undefined ||
+      attributes.fleecing === propertyString(props.fleecing, 'enabled')),
+  path: (props) => `cluster/backup/${props.id}`,
+  updateForm: shape,
+} satisfies PveSpec<BackupJobProps, BackupJobAttributes>;