@homeflare/alchemy 0.37.6 → 0.37.7

package/dist/proxmox/lxc-errors.d.ts

@@ -0,0 +1,12 @@
+import type { PveTarget } from './credentials.ts';
+/** A lifecycle refusal. Post-write refusals carry the task diagnostic, never imply rollback. */
+export declare class LxcRefusedError extends Error {
+    readonly name = "LxcRefusedError";
+}
+/** Where one guest lives. Its identity, and nothing else. */
+export type LxcWhere = {
+    readonly target: PveTarget;
+    readonly node: string;
+    readonly vmid: number;
+};
+//# sourceMappingURL=lxc-errors.d.ts.map

package/dist/proxmox/lxc-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc-errors.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,gGAAgG;AAChG,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAkB,IAAI,qBAAqB;CAC5C;AAED,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/proxmox/lxc-lifecycle.d.ts

@@ -1,48 +1,26 @@
 /**
  * The calls a `Proxmox.Lxc` makes: read one config, create, update in place, grow, delete.
  *
- * ⛔ A READ FAILURE IS A FAILURE HERE, NOT "ABSENT" — THE ONE PLACE THIS PACKAGE DEPARTS FROM
- *   resource.ts. `pveOperations.read` folds every error into `undefined`, which for a guest means a
- *   403 or a node that did not answer plans a CREATE over a running container. PVE answers a
- *   missing guest with HTTP 500, `Configuration file 'nodes/<node>/lxc/<vmid>.conf' does not
- *   exist` (pve-guest-common `AbstractConfig::load_config`), so only a 500 may mean absent — and
- *   even then only after the cluster says so, below. Anything else fails the plan.
- *
- * ⛔ "ABSENT" IS DECIDED BY THE WHOLE CLUSTER, NOT BY THE ERROR TEXT. A config lives under its
- *   node, so a guest migrated to another node — or a QEMU VM holding the same cluster-wide vmid —
- *   also reads as missing at the declared path. `GET /cluster/resources?type=vm` settles it: the
- *   vmid nowhere is absent; the vmid anywhere else FAILS the read with where it is; the vmid on
- *   the declared node fails with PVE's own error. ★ Keyed on the cluster rather than on matching
- *   the message, so a PVE that words it differently still cannot turn into a create.
+ * ★ Discovery lives in lxc-read.ts; it proves precise absence with one read credential.
+ *   Writes use named distilled operations, and lxc-task.ts preserves task ownership and bounds.
  *
  * ⚠️ CREATE, RESIZE AND DELETE ARE ASYNCHRONOUS; A CONFIG PUT IS NOT. The first three answer a
  *   UPID the moment PVE forks the worker (`NodesNodeLxcPostReturn`, `…ResizePutReturn`,
  *   `…VmidDeleteReturn` are all `string`), so each waits for its task's exitstatus. `PUT …/config`
  *   answers `null` after writing (`…ConfigPutReturn`), so it needs no wait.
- * ⛔ EACH TASK IS POLLED WITH THE CREDENTIAL THAT STARTED IT — see `awaitTask`: only the owner
+ * ⛔ EACH TASK IS POLLED WITH THE CREDENTIAL THAT STARTED IT — see `lxcTask`: only the owner
  *   skips `Sys.Audit`. A fresh `provision` mint per write gives the full 300s lease a create needs;
  *   a cached lease can be handed out with 60s left (lease-cache.ts).
  */
 import * as Effect from 'effect/Effect';
-import type { PveTarget } from './credentials.ts';
+import { LxcRefusedError, type LxcWhere } from './lxc-errors.ts';
 import { type LxcChange } from './lxc-judge.ts';
 import type { LxcAttributes, LxcProps } from './lxc-props.ts';
-/** A plan-time or apply-time refusal. Nothing was written when one of these is raised. */
-export declare class LxcRefusedError extends Error {
-    readonly name = "LxcRefusedError";
-}
-/** Where one guest lives. Its identity, and nothing else. */
-export type LxcWhere = {
-    readonly target: PveTarget;
-    readonly node: string;
-    readonly vmid: number;
-};
-export declare const guestPath: (where: LxcWhere) => string;
-/** The live config, or undefined when no guest holds this vmid anywhere in the cluster. */
-export declare const readLive: (where: LxcWhere) => Effect.Effect<Record<string, unknown> | undefined, Error | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+export { LxcRefusedError, type LxcWhere } from './lxc-errors.ts';
+export { readLive } from './lxc-read.ts';
 export declare const attributesOf: (where: LxcWhere, live: Record<string, unknown>) => LxcAttributes;
 /** POST the create and wait for the template to unpack. ⛔ Refusals are the caller's to check. */
-export declare const createGuest: (props: LxcProps) => Effect.Effect<undefined, Error | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const createGuest: (props: LxcProps) => Effect.Effect<undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * Apply a judged change: the config PUT first, then each resize.
  * ⚠️ IN THAT ORDER BECAUSE A MOUNT POINT'S PUT CARRIES ITS LIVE `size=`, and the resize rewrites it.
@@ -53,7 +31,7 @@ export declare const createGuest: (props: LxcProps) => Effect.Effect<undefined,
  *   seen by reconcile's fresh judge instead: a declared key edited meanwhile is written back to the
  *   declaration (even after a plan that warned of nothing), an undeclared one is left alone.
  */
-export declare const updateGuest: (props: LxcProps, change: LxcChange, digest: string) => Effect.Effect<void, Error | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const updateGuest: (props: LxcProps, change: LxcChange, digest: string) => Effect.Effect<void, Error | import("effect/unstable/http/HttpClientError").HttpClientError | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ⛔ NO `force`, NO `purge`, NO STOP FIRST. PVE refuses to destroy a running or protected guest,
  *   and that refusal is kept: stopping a guest so a delete can proceed is an operator's decision.
@@ -64,5 +42,5 @@ export declare const updateGuest: (props: LxcProps, change: LxcChange, digest: s
  *   first; one that no longer matches is refused with the keys that differ, and deleting it (or
  *   declaring it again) is the operator's call.
  */
-export declare const destroyGuest: (where: LxcWhere, declared: LxcProps) => Effect.Effect<undefined, Error | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const destroyGuest: (where: LxcWhere, declared: LxcProps) => Effect.Effect<undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=lxc-lifecycle.d.ts.map

package/dist/proxmox/lxc-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lxc-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK9D,0FAA0F;AAC1F,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAkB,IAAI,qBAAqB;CAC5C;AAED,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG,eAAO,MAAM,SAAS,UAAW,QAAQ,WAAoD,CAAC;AAgC9F,2FAA2F;AAC3F,eAAO,MAAM,QAAQ,UAAW,QAAQ,6LAqCpC,CAAC;AAEL,eAAO,MAAM,YAAY,UAAW,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,aAK5E,CAAC;AAgCH,iGAAiG;AACjG,eAAO,MAAM,WAAW,UAAW,QAAQ,mKAmBvC,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,UAAW,QAAQ,UAAU,SAAS,UAAU,MAAM,8JAyB1E,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,UAAW,QAAQ,YAAY,QAAQ,mKAe5D,CAAC"}
+{"version":3,"file":"lxc-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAMjE,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAI9D,OAAO,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AA0BzC,eAAO,MAAM,YAAY,UAAW,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,aAK5E,CAAC;AAEH,iGAAiG;AACjG,eAAO,MAAM,WAAW,UAAW,QAAQ,oOAsBvC,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,UAAW,QAAQ,UAAU,SAAS,UAAU,MAAM,+NA4B1E,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,UAAW,QAAQ,YAAY,QAAQ,oOAoB5D,CAAC"}

package/dist/proxmox/lxc-read.d.ts

@@ -0,0 +1,4 @@
+import * as Effect from 'effect/Effect';
+import { LxcRefusedError, type LxcWhere } from './lxc-errors.ts';
+export declare const readLive: (where: LxcWhere) => Effect.Effect<Record<string, unknown> | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=lxc-read.d.ts.map

package/dist/proxmox/lxc-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-read.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGjE,eAAO,MAAM,QAAQ,UAAW,QAAQ,8PAoEpC,CAAC"}

package/dist/proxmox/lxc-task.d.ts

@@ -0,0 +1,15 @@
+import type { ProxmoxOpContext } from '@distilled.cloud/proxmox/Protocol';
+import * as Effect from 'effect/Effect';
+import { LxcRefusedError, type LxcWhere } from './lxc-errors.ts';
+/**
+ * ⛔ Fresh provision mint for each write, then retain it for every task poll. PVE's task
+ *   owner skips Sys.Audit; another mint is another token identity. This also gives a create
+ *   the full lease rather than a cached lease with only 60 seconds left.
+ * ⚠️ A failed post-write poll is uncertainty, never absence or permission to retry the write.
+ *   Preserve the existing one-second bound and the UPID diagnostic. NetworkApply keeps its
+ *   separate raw helper; migrating this caller does not alter reload behavior.
+ * ★ SDK labels are percent-encoded. Installed APIServer/AnyEvent.pm uri_unescape runs before
+ *   routing, so an encoded UPID reaches the same task as its old literal spelling.
+ */
+export declare const lxcTask: <E>(where: LxcWhere, operation: Effect.Effect<string, E, ProxmoxOpContext>, what: string, polls: number) => Effect.Effect<undefined, E | Error | LxcRefusedError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=lxc-task.d.ts.map

package/dist/proxmox/lxc-task.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc-task.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-task.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIjE;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,GAAI,CAAC,SAChB,QAAQ,aACJ,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,gBAAgB,CAAC,QAC/C,MAAM,SACL,MAAM,uKA+CX,CAAC"}

package/dist/proxmox/network-apply-read.d.ts

@@ -17,13 +17,8 @@
  *   of `data`, set only when the diff is non-empty. `client.ts`'s `pve()` returns `body.data` and
  *   drops the envelope, so the one readable pending signal is invisible to every other resource in
  *   this package. Without the fetch below, `Proxmox.NetworkApply` could not diff honestly at all.
- *   ★ `pveEnvelopeWith` in client.ts now carries the same member failover as every other call.
- *   ⛔ WHY THIS FAMILY DID NOT MOVE TO DISTILLED WITH `Proxmox.NodeNetwork` (2026-09-24, decision
- *     43's walk-down): CONFIRMED against `@distilled.cloud/proxmox`'s own `protocol.ts` that its
- *     `transformResponse` unconditionally returns `body.data ?? {}` for every operation, before a
- *     generated call's typed output is even built — no typed call, current or future, could see
- *     `changes` without a protocol-level change upstream. `pveEnvelopeWith` stays because nothing
- *     else preserves the sibling this function needs.
+ *   ★ `listNodeNetwork` keeps a string `changes` sibling. The protocol unwraps every other
+ *     envelope. The diff string is counted here and then dropped.
  *
  * ⛔ AND THE INTERFACE ROWS CANNOT TELL YOU EITHER. MEASURED in PVE/INotify.pm `read_file`: when
  *   `/etc/network/interfaces.new` exists, THAT is the file that gets parsed, so
@@ -41,6 +36,7 @@
  *   there waiting for the next reload anybody triggers. The file's existence is not exposed by the
  *   API in any other form, so the alternative is not a better read — it is SSH.
  */
+import * as cluster from '@distilled.cloud/proxmox/cluster';
 import * as Effect from 'effect/Effect';
 import { type PveCredential, type PveTarget } from './credentials.ts';
 /** What the cluster looked like the moment it was asked. Never persisted — see network-apply.ts. */
@@ -60,7 +56,7 @@ export type ClusterHealth = {
  */
 export declare const pendingLines: (diff: string) => number;
 /** How many staged lines this node is carrying. Zero is the only settled value. */
-export declare const pendingCount: (target: PveTarget, node: string) => Effect.Effect<number, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const pendingCount: (target: PveTarget, node: string) => Effect.Effect<number, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * Why the cluster is not healthy, or `undefined` when it is.
  *
@@ -75,7 +71,7 @@ export declare const pendingCount: (target: PveTarget, node: string) => Effect.E
  *   pools losing min_size; reloading another node's networking while it is out is the move that
  *   completes the outage. Bring it back, or apply by hand with the cluster in front of you.
  */
-export declare const degradedReason: (target: PveTarget) => Effect.Effect<string | undefined, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const degradedReason: (target: PveTarget) => Effect.Effect<string | undefined, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | cluster.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ⛔ NOT AN EXITSTATUS PVE CAN RETURN, AND THAT IS THE POINT. The caller compares against `'OK'`;
  *   these two say WHY the answer is not OK without needing a second branch for "we do not know".
@@ -95,11 +91,8 @@ export declare const UNREACHABLE = "the task could not be read -- the node stopp
  *   is not the owner — which is why this takes a `PveCredential` and the caller keeps one lease
  *   across both calls, instead of widening the provisioning role to read its own tasks.
  *
- * ⛔ THE OTHER REASON THIS FAMILY DID NOT MOVE TO DISTILLED (2026-09-24): CHECKED against
- *   `@distilled.cloud/proxmox`'s own `Task.awaitTask` (`src/task.ts`) before deciding — it
- *   propagates a poll failure as a genuine typed `GetNodeTaskStatusError` rather than collapsing
- *   it to `UNREACHABLE` the way this function does, which would turn the ⛔ two paragraphs above
- *   into a failed `reconcile` on exactly the poll a mid-reload connection drop is expected to hit.
+ * ★ A poll failure stays `UNREACHABLE`. `getNodeTaskStatus` would otherwise fail the reload
+ *   on the connection drop this function exists to survive.
  */
 export declare const awaitTask: (target: PveTarget, credential: PveCredential, node: string, upid: string, attempts?: number) => Effect.Effect<string, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=network-apply-read.d.ts.map

package/dist/proxmox/network-apply-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-apply-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAatE,oGAAoG;AACpG,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AA0B7E;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,WAWxC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,WAAY,SAAS,QAAQ,MAAM,8IACH,CAAC;AAiC1D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,WAAY,SAAS,0JAO7C,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,0FACiE,CAAC;AAY1F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,SAAS,WACZ,SAAS,cACL,aAAa,QACnB,MAAM,QACN,MAAM,aAEF,MAAM,uFAgCd,CAAC"}
+{"version":3,"file":"network-apply-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,OAAO,MAAM,kCAAkC,CAAC;AAE5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAItE,oGAAoG;AACpG,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AA0B7E;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,WAWxC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,WAAY,SAAS,QAAQ,MAAM,+MACH,CAAC;AAiC1D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,WAAY,SAAS,4QAO7C,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,0FACiE,CAAC;AAY1F;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,SAAS,WACZ,SAAS,cACL,aAAa,QACnB,MAAM,QACN,MAAM,aAEF,MAAM,uFA0Bd,CAAC"}

package/dist/proxmox/network-apply-run.d.ts

@@ -0,0 +1,7 @@
+import * as Effect from 'effect/Effect';
+import type { NetworkApplyProps } from './network-apply.ts';
+export declare const applyNetwork: (props: NetworkApplyProps) => Effect.Effect<{
+    node: string;
+    pending: number;
+}, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=network-apply-run.d.ts.map

package/dist/proxmox/network-apply-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-apply-run.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply-run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAO5D,eAAO,MAAM,YAAY,UAAW,iBAAiB;;;uLAkFjD,CAAC"}

package/dist/proxmox/network-apply.d.ts

@@ -45,12 +45,11 @@
  *   GRANT — it also carries that node's DNS, hosts file, time and service configuration. Granting
  *   it cluster-wide to run this resource widens the provisioning role well beyond networking.
  *
- * ⛔ STAYS ON `client.ts` (2026-09-24) — network-apply-read.ts's header has the two MEASURED reasons.
+ * Named operations: `listNodeNetwork` keeps the diff sibling, `putNodeNetwork` reloads.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import type { PveRequirements } from './resource.ts';
-import type { WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource.ts';
 export interface NetworkApplyProps extends WithTarget {
     /**
      * The node whose staged interfaces file this applies — `node-b`.

package/dist/proxmox/network-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-apply.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAM7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAAwD,CAAC;AAiIzF,eAAO,MAAM,2BAA2B,yIACyD,CAAC"}
+{"version":3,"file":"network-apply.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEjE,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAAwD,CAAC;AA2CzF,eAAO,MAAM,2BAA2B,yIACyD,CAAC"}

package/dist/proxmox/qemu-errors.d.ts

@@ -0,0 +1,5 @@
+/** A QEMU write or observation this provider will not turn into a create or a delete. */
+export declare class QemuRefusedError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=qemu-errors.d.ts.map

package/dist/proxmox/qemu-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-errors.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-errors.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/proxmox/qemu-form.d.ts

@@ -0,0 +1,22 @@
+/** QEMU create and update forms. Path identity stays out of the body. */
+import type { VmProps } from './qemu.ts';
+/** Fields both create and update send. `net0` is optional and is not compared. */
+export declare const shape: (props: VmProps) => {
+    cores: string;
+    memory: string;
+    name: string;
+    onboot: string;
+    sockets: string;
+    net0?: string;
+};
+/** ★ Exported so the constraint proof can run the REAL create form, not a retyped copy of it. */
+export declare const createForm: (props: VmProps) => {
+    cores: string;
+    memory: string;
+    name: string;
+    onboot: string;
+    sockets: string;
+    net0?: string;
+    vmid: string;
+};
+//# sourceMappingURL=qemu-form.d.ts.map

package/dist/proxmox/qemu-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-form.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,kFAAkF;AAClF,eAAO,MAAM,KAAK,UAAW,OAAO;;;;;;;CAOlC,CAAC;AAEH,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAW,OAAO;;;;;;;;CAAoD,CAAC"}

package/dist/proxmox/qemu-lifecycle.d.ts

@@ -0,0 +1,26 @@
+import type { Input } from 'alchemy/Input';
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import * as Effect from 'effect/Effect';
+import type { VmAttributes, VmProps } from './qemu.ts';
+export declare const readQemu: (props: VmProps) => Effect.Effect<VmAttributes | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+/** No purge, no skiplock, no destroy-unreferenced-disks. A missing config is already gone. */
+export declare const deleteQemu: (props: VmProps) => Effect.Effect<void | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const qemuHandlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: VmProps;
+    }) => Effect.Effect<VmAttributes | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args_0: {
+        news: Input<VmProps>;
+        output: VmAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: "noop" | "update";
+    } | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args_0: {
+        news: VmProps;
+    }) => Effect.Effect<VmAttributes, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds }: {
+        olds: VmProps;
+    }) => Effect.Effect<void | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+//# sourceMappingURL=qemu-lifecycle.d.ts.map

package/dist/proxmox/qemu-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-lifecycle.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAMxC,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkDvD,eAAO,MAAM,QAAQ,UAAW,OAAO,iOAGpC,CAAC;AAEJ,8FAA8F;AAC9F,eAAO,MAAM,UAAU,UAAW,OAAO,+KAMyB,CAAC;AAEnE,eAAO,MAAM,YAAY;IACvB,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE;IAClC,IAAI;cAII,KAAK,CAAC,OAAO,CAAC;gBACZ,YAAY,GAAG,SAAS;;;;IAalC,SAAS;cAAyC,OAAO;;IAgCzD,MAAM,aAAa;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE;CACrC,CAAC"}

package/dist/proxmox/qemu-read.d.ts

@@ -0,0 +1,5 @@
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import * as Effect from 'effect/Effect';
+import type { VmProps } from './qemu.ts';
+export declare const readVm: (props: VmProps) => Effect.Effect<nodes.GetNodeQemuConfigResponse | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=qemu-read.d.ts.map

package/dist/proxmox/qemu-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-read.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,eAAO,MAAM,MAAM,UAAW,OAAO,oPAuDjC,CAAC"}

package/dist/proxmox/qemu-task.d.ts

@@ -0,0 +1,9 @@
+import type { ProxmoxOpContext } from '@distilled.cloud/proxmox/Protocol';
+import * as Effect from 'effect/Effect';
+import type { VmProps } from './qemu.ts';
+/**
+ * ⛔ Fresh provision mint, then the same lease for every poll. A timed-out poll is uncertainty,
+ *   never a reason to send the write again.
+ */
+export declare const qemuTask: <E>(props: VmProps, operation: Effect.Effect<string, E, ProxmoxOpContext>, what: string, polls: number) => Effect.Effect<undefined, E | Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=qemu-task.d.ts.map

package/dist/proxmox/qemu-task.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-task.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-task.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC;;;GAGG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,SACjB,OAAO,aACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,gBAAgB,CAAC,QAC/C,MAAM,SACL,MAAM,qJA6CX,CAAC"}

package/dist/proxmox/qemu.d.ts

@@ -1,9 +1,9 @@
 /**
  * `Proxmox.Vm` — a QEMU virtual machine, declared.
  *
- * ⚠️ THE SAME FOUR OPERATIONS AS AN LXC OVER A DIFFERENT PATH, which is the point of the factory:
- *   `nodes/{node}/qemu` to create, `nodes/{node}/qemu/{vmid}/config` to read and update. A VM and a
- *   container differ in what they carry, not in how they are reconciled.
+ * ⚠️ CREATE is `POST /nodes/{node}/qemu`. GET and PUT stay on `.../qemu/{vmid}/config`.
+ *   ⛔ DELETE is `DELETE /nodes/{node}/qemu/{vmid}` (`destroy_vm` in qemu-server Qemu.pm). The
+ *   config route is not a destroy. A missing config file is `QemuConfigNotFound` only.
  *
  * ⛔ `vmid` IS CLUSTER-WIDE AND SHARED WITH CONTAINERS. A VM and an LXC cannot hold the same id, so
  *   these two resources compete for one number space. Declaring both with vmid 101 is not a
@@ -16,7 +16,7 @@
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource.ts';
 export interface VmProps extends WithTarget {
     node: string;
     /** ⛔ Cluster-wide, and shared with LXC. See the ⛔ above. */
@@ -42,15 +42,10 @@ export interface VmAttributes {
 export interface ProxmoxVm extends Resource<'Proxmox.Vm', VmProps, VmAttributes, never, PveRequirements> {
 }
 export declare const ProxmoxVm: import("alchemy").ResourceClass<ProxmoxVm>;
-/** ★ Exported so the constraint proof can run the REAL create form, not a retyped copy of it. */
-export declare const createForm: (props: VmProps) => {
-    vmid: string;
-    cores: string;
-    memory: string;
-    name: string;
-    onboot: string;
-    sockets: string;
-    net0?: string;
-};
+export { createForm } from './qemu-form.ts';
+/**
+ * ⛔ Destroy uses deleteNodeQemu (`DELETE /nodes/{node}/qemu/{vmid}`), not the config path.
+ *   The old factory sent both reads and deletes to `.../config`.
+ */
 export declare const ProxmoxVmProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxVm>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=qemu.d.ts.map

package/dist/proxmox/qemu.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qemu.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,OAAO,EACP,YAAY,EACZ,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,SAAS,4CAAoC,CAAC;AAE3D,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAW,OAAO;;;;;;;;CAAoD,CAAC;AAsC9F,eAAO,MAAM,iBAAiB,+HAC+C,CAAC"}
+{"version":3,"file":"qemu.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEjE,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,OAAO,EACP,YAAY,EACZ,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,SAAS,4CAAoC,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,iBAAiB,+HACmD,CAAC"}

package/dist/proxmox/replication-firewall-fixtures.d.ts

@@ -0,0 +1,30 @@
+import type { CoreCase } from './live-core-fixtures.ts';
+export declare const replicationProps: {
+    target: import("./credentials.ts").PveTarget;
+    guest: number;
+    jobnum: number;
+    targetNode: string;
+};
+export declare const aliasProps: {
+    target: import("./credentials.ts").PveTarget;
+    name: string;
+    cidr: string;
+    comment: string;
+};
+export declare const replicationLive: {
+    id: string;
+    guest: number;
+    jobnum: number;
+    target: string;
+    type: string;
+    source: string;
+};
+export declare const aliasLive: {
+    name: string;
+    cidr: string;
+    ipversion: number;
+};
+export declare const replicationMissing: () => Response;
+export declare const aliasMissing: () => Response;
+export declare const replicationFirewallCases: CoreCase[];
+//# sourceMappingURL=replication-firewall-fixtures.d.ts.map

package/dist/proxmox/replication-firewall-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replication-firewall-fixtures.d.ts","sourceRoot":"","sources":["../../src/proxmox/replication-firewall-fixtures.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAMxD,eAAO,MAAM,gBAAgB;IAAK,MAAM;IAAe,KAAK;IAAO,MAAM;IAAK,UAAU;CAAW,CAAC;AACpG,eAAO,MAAM,UAAU;IACrB,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,OAAO;CACR,CAAC;AACF,eAAO,MAAM,eAAe;IAC1B,EAAE;IACF,KAAK;IACL,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;CACP,CAAC;AACF,eAAO,MAAM,SAAS;IAAK,IAAI;IAAa,IAAI;IAAe,SAAS;CAAK,CAAC;AAC9E,eAAO,MAAM,kBAAkB,gBAC+D,CAAC;AAC/F,eAAO,MAAM,YAAY,gBAItB,CAAC;AAEJ,eAAO,MAAM,wBAAwB,EAAE,QAAQ,EAoC9C,CAAC"}

package/dist/proxmox/replication-job-config.d.ts

@@ -0,0 +1,56 @@
+/** Existing comparison and form semantics, separated from the named SDK transport. */
+import type { ReplicationJobAttributes, ReplicationJobProps } from './replication-job.ts';
+import { createBody, updateBody } from './replication-job-form.ts';
+export declare const replicationJobSpec: {
+    /**
+     * ⚠️ EVERY FALLBACK IS PVE'S DOCUMENTED DEFAULT, NOT `false`/`''` PICKED FOR CONVENIENCE, so the
+     *   answer does not depend on whether a given release echoes back a key it never wrote.
+     *   SectionConfig stores what it was handed; a job created in the UI without a schedule has no
+     *   schedule line, and reading that absence as anything but `DEFAULT_SCHEDULE` would report
+     *   drift on a job nobody touched and then WRITE the reading back.
+     * ⛔ The distilled read validates the response and requested identity before applying defaults.
+     *   Only the precise typed vendor exception means absence. `digest` is deliberately absent
+     *   here — it changes when ANY job changes, including one somebody else declared.
+     */
+    attributes: (live: Record<string, unknown>, props: ReplicationJobProps) => {
+        comment: string;
+        disable: boolean;
+        guest: number;
+        id: string;
+        jobnum: number;
+        rate: number;
+        remove_job: string;
+        schedule: string;
+        source: string;
+        targetNode: string;
+        type: string;
+    };
+    collection: () => string;
+    createForm: typeof createBody;
+    /**
+     * ⚠️ `targetNode` AND `source` ARE OUT OF THIS COMPARISON FOR TWO REASONS EACH, AND EITHER ALONE
+     *   WOULD BE ENOUGH. They are create-only — `target` is a `fixed` option, `source` has no honest
+     *   declared value — AND PVE REWRITES BOTH BEHIND YOUR BACK. MEASURED in
+     *   `switch_replication_job_target_nolock`: when a guest migrates, PVE sets
+     *   `$jobcfg->{target} = $new_target` and `$jobcfg->{source} = $old_target`, so the job follows
+     *   the guest. Compared, a single migration would make every later plan report an update that the
+     *   PUT cannot perform, forever. The cost of leaving them out is stated on the `targetNode` prop:
+     *   a changed target plans as noop, and a migrated job is not dragged back.
+     * ⚠️ `guest`, `jobnum`, `type` AND `id` ARE NOT COMPARED EITHER: the first two are the id in
+     *   integer form, `type` has one legal value, and `id` is the path — a change there is a
+     *   different object, which reads as absent and is created.
+     * ⛔ `remove_job` IS COMPARED, AND IT IS THE ONE FIELD HERE THAT LOOKS LIKE A FOREVER-UPDATE AND
+     *   IS NOT. A DELETE marks the job rather than removing it, so a re-declared id can name a job
+     *   that is busy deleting itself, and matching that would be a noop over a vanishing object. It
+     *   settles because `updateBody` actually clears the marker — see there.
+     */
+    /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */
+    endpoint: {
+        create: string;
+        update: string;
+    };
+    matches: (attributes: ReplicationJobAttributes, props: ReplicationJobProps) => boolean;
+    path: (props: ReplicationJobProps) => string;
+    updateForm: typeof updateBody;
+};
+//# sourceMappingURL=replication-job-config.d.ts.map

package/dist/proxmox/replication-job-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replication-job-config.d.ts","sourceRoot":"","sources":["../../src/proxmox/replication-job-config.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE1F,OAAO,EAAoB,UAAU,EAAS,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAmB5F,eAAO,MAAM,kBAAkB;IAC7B;;;;;;;;;OASG;;;;;;;;;;;;;;;;IAgBH;;;;;;;;;;;;;;;;OAgBG;IACH,wFAAwF;;QAEtF,MAAM;QACN,MAAM;;;;;CAUwD,CAAC"}

package/dist/proxmox/replication-job-lifecycle.d.ts

@@ -0,0 +1,62 @@
+import type { Input } from 'alchemy/Input';
+import * as cluster from '@distilled.cloud/proxmox/cluster';
+import * as Effect from 'effect/Effect';
+import type { ReplicationJobAttributes, ReplicationJobProps } from './replication-job.ts';
+export declare const readReplicationJob: (props: ReplicationJobProps) => Effect.Effect<{
+    comment: string;
+    disable: boolean;
+    guest: number;
+    id: string;
+    jobnum: number;
+    rate: number;
+    remove_job: string;
+    schedule: string;
+    source: string;
+    targetNode: string;
+    type: string;
+} | undefined, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | cluster.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** DELETE without force/keep marks full background removal; it must never force immediate removal. */
+export declare const deleteReplicationJob: (props: ReplicationJobProps) => Effect.Effect<void | cluster.DeleteClusterReplicationResponse, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | cluster.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const replicationJobHandlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: ReplicationJobProps;
+    }) => Effect.Effect<{
+        comment: string;
+        disable: boolean;
+        guest: number;
+        id: string;
+        jobnum: number;
+        rate: number;
+        remove_job: string;
+        schedule: string;
+        source: string;
+        targetNode: string;
+        type: string;
+    } | undefined, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | cluster.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args_0: {
+        news: Input<ReplicationJobProps>;
+        output: ReplicationJobAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: "noop" | "update";
+    } | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args_0: {
+        news: ReplicationJobProps;
+    }) => Effect.Effect<{
+        comment: string;
+        disable: boolean;
+        guest: number;
+        id: string;
+        jobnum: number;
+        rate: number;
+        remove_job: string;
+        schedule: string;
+        source: string;
+        targetNode: string;
+        type: string;
+    }, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds }: {
+        olds: ReplicationJobProps;
+    }) => Effect.Effect<void | cluster.DeleteClusterReplicationResponse, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | cluster.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+//# sourceMappingURL=replication-job-lifecycle.d.ts.map

package/dist/proxmox/replication-job-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replication-job-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/replication-job-lifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,OAAO,MAAM,kCAAkC,CAAC;AAE5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAc1F,eAAO,MAAM,kBAAkB,UAAW,mBAAmB;;;;;;;;;;;;oPA4B1D,CAAC;AAEJ,sGAAsG;AACtG,eAAO,MAAM,oBAAoB,UAAW,mBAAmB,ySAMO,CAAC;AAEvE,eAAO,MAAM,sBAAsB;IAEjC,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,mBAAmB,CAAA;KAAE;;;;;;;;;;;;;IAC9C,IAAI;cAII,KAAK,CAAC,mBAAmB,CAAC;gBACxB,wBAAwB,GAAG,SAAS;;;;IAa9C,SAAS;cAAyC,mBAAmB;;;;;;;;;;;;;;IA4BrE,MAAM,aAAa;QAAE,IAAI,EAAE,mBAAmB,CAAA;KAAE;CACjD,CAAC"}

package/dist/proxmox/replication-job.d.ts

@@ -56,13 +56,12 @@
  *     checks `VM.Audit` on `/vms/<guest>`, `hf-read@pve` holds the built-in `PVEAuditor` at `/`
  *     with propagate — both MEASURED — and `PVEAuditor` carries `VM.Audit`. This family is not a
  *     fourth one that must borrow the provision lease.
- *   ⚠️ A MISSING JOB IS A 500, NOT A 404 — "no such replication job '100-0'" — and the factory
- *     folds any failed read into "absent", so a 403 reads as absent too. A plan insisting on
- *     creating a job that plainly exists is a credential problem; the honest error arrives one step
- *     later, from the create.
+ *   ⚠️ A MISSING JOB IS A 500, NOT A 404 — "no such replication job '100-0'" — and distilled now
+ *     exposes a precise missing-job tag. Permission failures and unrelated server errors propagate
+ *     before any write; only the vendor missing-job signal means absent.
  *
  * ⛔ DELETE DOES NOT DELETE, AND A DESTROY IS NOT FREE. MEASURED: with neither `force` nor `keep` —
- *   and the factory's `destroy` sends no form at all — the handler only sets `remove_job = 'full'`
+ *   and the named SDK delete sends neither option — the handler only sets `remove_job = 'full'`
  *   on the job and writes the config back. The job stays in replication.cfg until the SOURCE node's
  *   `pvesr` timer next runs it, at which point it removes the local replication snapshots, removes
  *   the replicated volumes on the target, and finally removes itself. So a destroy costs the
@@ -85,7 +84,7 @@
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
 export interface ReplicationJobProps extends WithTarget {
     /** ⛔ The guest being replicated. 100 or above — PVE reserves everything below. Identity. */
     guest: number;

package/dist/proxmox/replication-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replication-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/replication-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAsB,SAAQ,QAAQ,CACrD,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,qBAAqB,wDAA4D,CAAC;AA6E/F;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,2IAIvC,CAAC"}
+{"version":3,"file":"replication-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/replication-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGtE,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAsB,SAAQ,QAAQ,CACrD,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,qBAAqB,wDAA4D,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,2IAIvC,CAAC"}

package/dist/release/archive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../src/release/archive.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,KAAK,WAAW,EAAa,MAAM,UAAU,CAAC;AAKvD;;;;GAIG;AACH,eAAO,MAAM,cAAc,YAChB,UAAU,UACX,WAAW,CAAC,MAAM,CAAC,SACpB,MAAM,KACZ,OAAO,CAAC,WAAW,CAkCrB,CAAC;AAUF;;;;GAIG;AACH,eAAO,MAAM,cAAc,YAChB,UAAU,WACV,cAAc,KACtB,OAAO,CAAC,UAAU,CAgBpB,CAAC"}
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../src/release/archive.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,KAAK,WAAW,EAAa,MAAM,UAAU,CAAC;AAKvD;;;;GAIG;AACH,eAAO,MAAM,cAAc,YAChB,UAAU,UACX,WAAW,CAAC,MAAM,CAAC,SACpB,MAAM,KACZ,OAAO,CAAC,WAAW,CAqCrB,CAAC;AAUF;;;;GAIG;AACH,eAAO,MAAM,cAAc,YAChB,UAAU,WACV,cAAc,KACtB,OAAO,CAAC,UAAU,CAgBpB,CAAC"}