@homeflare/alchemy 0.37.6 → 0.37.8

package/src/proxmox/qemu-lifecycle.test.ts

@@ -0,0 +1,171 @@
+/** QEMU engine tests over a stub fetch. No live host is contacted. */
+import { describe, expect, test } from 'bun:test';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import { engineOver } from '../verify/fake-engine.ts';
+import { FAKE_TARGET, type FakePve, fakePve, withoutBao } from './fake-pve.ts';
+import { ProxmoxVm, ProxmoxVmProvider } from './qemu.ts';
+
+const NODE = 'pve1';
+const VMID = 150;
+const props = { target: FAKE_TARGET, node: NODE, vmid: VMID };
+const digest = 'a'.repeat(40);
+const live = { digest, name: 'vm150', memory: '512', cores: 1, sockets: 1, onboot: 0 };
+const missing = () =>
+  Response.json(
+    {
+      data: null,
+      message: `Configuration file 'nodes/${NODE}/qemu-server/${String(VMID)}.conf' does not exist\n`,
+    },
+    { status: 500 },
+  );
+const UPID = `UPID:${NODE}:00000001:0:0:qmcreate:${String(VMID)}:test@pve!fake:`;
+
+const engine = (fake: FakePve) =>
+  engineOver(ProxmoxVmProvider().pipe(Layer.provideMerge(fake.layer)));
+
+const isIndex = (call: { method: string; path: string }) =>
+  call.method === 'GET' && call.path.startsWith('cluster/resources');
+
+describe('Proxmox.Vm distilled transport', () => {
+  test('adoption and a second plan write nothing', async () => {
+    const fake = fakePve((call) => (call.method === 'GET' ? live : null));
+    await withoutBao(async () => {
+      const stack = engine(fake);
+      expect(await stack.deploy(ProxmoxVm('row', props))).toEqual({ row: 'adopted' });
+      expect((await stack.verify(ProxmoxVm('row', props), { all: true })).rows).toEqual([
+        expect.objectContaining({ diff: 'noop', ok: true }),
+      ]);
+    });
+    expect(fake.writes()).toEqual([]);
+  });
+
+  test('absence creates on the collection route, waits, then settles', async () => {
+    let exists = false;
+    const fake = fakePve((call) => {
+      if (call.path.includes('/tasks/') && call.path.endsWith('/status')) {
+        return { status: 'stopped', exitstatus: 'OK' };
+      }
+      if (isIndex(call)) return [];
+      if (call.method === 'GET') return exists ? live : missing();
+      exists = true;
+      return UPID;
+    });
+    await withoutBao(async () => {
+      const stack = engine(fake);
+      await stack.deploy(
+        ProxmoxVm('row', { ...props, net0: 'virtio=AA:BB:CC:DD:EE:FF,bridge=vmbr0' }),
+      );
+      expect((await stack.verify(ProxmoxVm('row', props), { all: true })).rows[0]).toMatchObject({
+        diff: 'noop',
+      });
+    });
+    expect(fake.writes()).toEqual([`POST nodes/${NODE}/qemu`]);
+    expect(fake.calls.find((call) => call.method === 'POST')?.form['net0']).toBe(
+      'virtio=AA:BB:CC:DD:EE:FF,bridge=vmbr0',
+    );
+    expect(fake.calls.some((call) => call.path.includes('/tasks/'))).toBe(true);
+  });
+
+  test('a transitional task status keeps polling instead of aborting the create', async () => {
+    // ⚠️ `GetNodeTaskStatusResponseStatus` types `status` as the closed union
+    //   "running" | "stopped", but the runtime validator is `S.String` (distilled-proxmox's
+    //   nodes.ts) -- a status word this endpoint's contract was never proven to exclude must
+    //   keep polling rather than abort the whole create, since only "stopped" ends the task
+    //   (2026-09-25 adversarial review; matches lxc-task.ts's own regression test).
+    let exists = false;
+    let polls = 0;
+    const fake = fakePve((call) => {
+      if (call.path.includes('/tasks/') && call.path.endsWith('/status')) {
+        polls++;
+        return polls === 1 ? { status: 'starting' } : { status: 'stopped', exitstatus: 'OK' };
+      }
+      if (isIndex(call)) return [];
+      if (call.method === 'GET') return exists ? live : missing();
+      exists = true;
+      return UPID;
+    });
+    await withoutBao(async () => {
+      const stack = engine(fake);
+      await stack.deploy(ProxmoxVm('row', props));
+      expect((await stack.verify(ProxmoxVm('row', props), { all: true })).rows[0]).toMatchObject({
+        diff: 'noop',
+      });
+    });
+    expect(polls).toBe(2);
+    expect(fake.writes()).toEqual([`POST nodes/${NODE}/qemu`]);
+  });
+
+  test('a vmid held by a container is not created', async () => {
+    const fake = fakePve((call) => {
+      if (isIndex(call)) {
+        return [{ id: 'lxc/150', type: 'lxc', vmid: 150, node: 'pve2' }];
+      }
+      if (call.method === 'GET') return missing();
+      return UPID;
+    });
+    await withoutBao(async () => {
+      await expect(engine(fake).deploy(ProxmoxVm('row', props))).rejects.toThrow(
+        /container|lxc|pve2/,
+      );
+    });
+    expect(fake.writes()).toEqual([]);
+  });
+
+  test('drift updates the config route and the next plan is a no-op', async () => {
+    let current: unknown = { ...live, memory: '256' };
+    const fake = fakePve((call) => {
+      if (call.method === 'GET') return current;
+      current = live;
+      return null;
+    });
+    await withoutBao(async () => {
+      const stack = engine(fake);
+      expect((await stack.verify(ProxmoxVm('row', props), { all: true })).rows[0]).toMatchObject({
+        diff: 'update',
+      });
+      await stack.deploy(ProxmoxVm('row', props));
+      expect((await stack.verify(ProxmoxVm('row', props), { all: true })).rows[0]).toMatchObject({
+        diff: 'noop',
+      });
+    });
+    expect(fake.writes()).toEqual([`PUT nodes/${NODE}/qemu/${String(VMID)}/config`]);
+  });
+
+  test('unrelated read failures and a digest-less body do not write', async () => {
+    for (const body of [
+      Response.json({ data: null, message: 'unrelated failure' }, { status: 500 }),
+      Response.json({ data: null, message: 'permission denied' }, { status: 403 }),
+      { name: 'vm150' },
+    ]) {
+      const fake = fakePve(() => body);
+      await withoutBao(async () => {
+        await expect(engine(fake).deploy(ProxmoxVm('row', props))).rejects.toBeDefined();
+      });
+      expect(fake.writes()).toEqual([]);
+    }
+  });
+
+  test('destroy deletes the guest route and waits for its task', async () => {
+    let exists = true;
+    const fake = fakePve((call) => {
+      if (call.path.includes('/tasks/') && call.path.endsWith('/status')) {
+        return { status: 'stopped', exitstatus: 'OK' };
+      }
+      if (call.method === 'GET') return exists ? live : missing();
+      if (call.method === 'DELETE') {
+        exists = false;
+        return UPID;
+      }
+      return null;
+    });
+    await withoutBao(async () => {
+      const stack = engine(fake);
+      await stack.deploy(ProxmoxVm('row', props).pipe(RemovalPolicy.destroy()));
+      await stack.deploy(Effect.void);
+    });
+    expect(fake.writes()).toEqual([`DELETE nodes/${NODE}/qemu/${String(VMID)}`]);
+    expect(fake.writes().some((line) => line.includes('/config'))).toBe(false);
+  });
+});

package/src/proxmox/qemu-lifecycle.ts

@@ -0,0 +1,134 @@
+/**
+ * QEMU lifecycle on named operations.
+ * ⛔ GET and PUT use `/nodes/{node}/qemu/{vmid}/config`. DELETE uses `/nodes/{node}/qemu/{vmid}`.
+ *   qemu-server Qemu.pm names that second route `destroy_vm`. Sending DELETE to the config
+ *   route does not destroy the guest.
+ */
+import { isResolved } from 'alchemy/Diff';
+import type { Input } from 'alchemy/Input';
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import * as Effect from 'effect/Effect';
+import { runPve } from './distilled-pve.ts';
+import { createForm, shape } from './qemu-form.ts';
+import { QemuRefusedError } from './qemu-errors.ts';
+import { readVm } from './qemu-read.ts';
+import { qemuTask } from './qemu-task.ts';
+import type { VmAttributes, VmProps } from './qemu.ts';
+import type { PveSpec } from './resource-spec.ts';
+import { specGuards } from './resource-guard.ts';
+import { formToSend } from './update-guard.ts';
+import { int } from './values.ts';
+
+const CREATE_POLLS = 180;
+const DELETE_POLLS = 60;
+
+const attributesOf = (
+  live: {
+    cores?: unknown;
+    memory?: unknown;
+    name?: unknown;
+    onboot?: unknown;
+    sockets?: unknown;
+  },
+  props: VmProps,
+): VmAttributes => ({
+  cores: int(live.cores, 1),
+  memory: int(live.memory, 512),
+  name: typeof live.name === 'string' ? live.name : '',
+  node: props.node,
+  onboot: live.onboot === 1 || live.onboot === true,
+  sockets: int(live.sockets, 1),
+  vmid: props.vmid,
+});
+
+const matches = (attributes: VmAttributes, props: VmProps) =>
+  attributes.name === (props.name ?? `vm${String(props.vmid)}`) &&
+  attributes.memory === (props.memory ?? 512) &&
+  attributes.cores === (props.cores ?? 1) &&
+  attributes.sockets === (props.sockets ?? 1) &&
+  attributes.onboot === (props.onboot === true);
+
+const spec = {
+  attributes: attributesOf,
+  collection: (props: VmProps) => `nodes/${props.node}/qemu`,
+  createForm,
+  endpoint: {
+    create: 'pve:POST /nodes/{node}/qemu',
+    update: 'pve:PUT /nodes/{node}/qemu/{vmid}/config',
+  },
+  matches,
+  path: (props: VmProps) => `nodes/${props.node}/qemu/${String(props.vmid)}/config`,
+  updateForm: shape,
+} satisfies PveSpec<VmProps, VmAttributes>;
+
+const { guardCreate, guardUpdate } = specGuards(spec);
+
+export const readQemu = (props: VmProps) =>
+  readVm(props).pipe(
+    Effect.map((live) => (live === undefined ? undefined : attributesOf(live, props))),
+  );
+
+/** No purge, no skiplock, no destroy-unreferenced-disks. A missing config is already gone. */
+export const deleteQemu = (props: VmProps) =>
+  qemuTask(
+    props,
+    nodes.deleteNodeQemu({ node: props.node, vmid: String(props.vmid) }),
+    `destroy VM ${String(props.vmid)}`,
+    DELETE_POLLS,
+  ).pipe(Effect.catchTag('QemuConfigNotFound', () => Effect.void));
+
+export const qemuHandlers = {
+  list: () => Effect.succeed([]),
+  read: ({ olds }: { olds: VmProps }) => readQemu(olds),
+  diff: Effect.fn(function* ({
+    news,
+    output,
+  }: {
+    news: Input<VmProps>;
+    output: VmAttributes | undefined;
+  }) {
+    if (!isResolved(news)) return undefined;
+    yield* guardCreate(news, output === undefined);
+    yield* guardUpdate(news);
+    if (output === undefined) return undefined;
+    const live = yield* readQemu(news);
+    if (live === undefined) {
+      yield* guardCreate(news, true);
+      return { action: 'update' } as const;
+    }
+    return { action: spec.matches(live, news) ? 'noop' : 'update' } as const;
+  }),
+  reconcile: Effect.fn(function* ({ news }: { news: VmProps }) {
+    const live = yield* readQemu(news);
+    yield* guardCreate(news, live === undefined);
+    yield* guardUpdate(news);
+    if (live === undefined) {
+      yield* qemuTask(
+        news,
+        nodes.createNodeQemu({ ...createForm(news), node: news.node }),
+        `create VM ${String(news.vmid)}`,
+        CREATE_POLLS,
+      );
+    } else {
+      const form = formToSend(spec.matches, live, news, spec.updateForm(news));
+      if (form !== undefined) {
+        yield* runPve(
+          news.target,
+          'provision',
+          true,
+          nodes.putNodeQemuConfig({ ...form, node: news.node, vmid: String(news.vmid) }),
+        );
+      }
+    }
+    const after = yield* readQemu(news);
+    if (after === undefined) {
+      return yield* Effect.fail(
+        new QemuRefusedError(
+          `${spec.path(news)}: write returned success but the VM is still absent`,
+        ),
+      );
+    }
+    return after;
+  }),
+  delete: ({ olds }: { olds: VmProps }) => deleteQemu(olds),
+};

package/src/proxmox/qemu-read.ts

@@ -0,0 +1,73 @@
+/**
+ * One QEMU config read, then a cluster-wide vmid check when that file is absent.
+ * ⛔ QemuConfigNotFound means the file is missing on THIS node. AbstractConfig raises it
+ *   before any other guest type is considered. A vmid is shared with containers, so absence
+ *   here is not permission to POST until the same credential's guest index agrees.
+ */
+import * as cluster from '@distilled.cloud/proxmox/cluster';
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import * as Effect from 'effect/Effect';
+import { runPveWith } from './distilled-pve.ts';
+import { leased } from './lease-cache.ts';
+import { QemuRefusedError } from './qemu-errors.ts';
+import type { VmProps } from './qemu.ts';
+import { text } from './values.ts';
+
+const guestTypes = ['lxc', 'qemu'] as const;
+
+export const readVm = (props: VmProps) =>
+  Effect.gen(function* () {
+    const credential = yield* leased(props.target, 'read');
+    const answer = yield* runPveWith(
+      props.target,
+      credential,
+      false,
+      nodes.getNodeQemuConfig({ node: props.node, vmid: String(props.vmid) }),
+    ).pipe(
+      Effect.map((data) => ({ data, error: undefined })),
+      Effect.catchTag('QemuConfigNotFound', (error) => Effect.succeed({ data: undefined, error })),
+    );
+    if (answer.error === undefined) {
+      const live = answer.data;
+      // ⛔ The vendor requires digest. Null or an empty object is not absence.
+      if (typeof live.digest !== 'string' || live.digest === '') {
+        return yield* Effect.fail(
+          new QemuRefusedError(
+            `VM ${String(props.vmid)}: config read did not return a digest-bearing config.`,
+          ),
+        );
+      }
+      return live;
+    }
+    const rows = yield* runPveWith(
+      props.target,
+      credential,
+      false,
+      cluster.listClusterResources({ type: 'vm' }),
+    );
+    if (
+      !Array.isArray(rows) ||
+      rows.some(
+        (row) =>
+          !Number.isSafeInteger(Number(row?.vmid)) ||
+          Number(row?.vmid) <= 0 ||
+          typeof row?.node !== 'string' ||
+          row.node === '' ||
+          !guestTypes.includes(row.type as (typeof guestTypes)[number]),
+      )
+    ) {
+      return yield* Effect.fail(
+        new QemuRefusedError('The cluster guest index did not identify its rows.'),
+      );
+    }
+    const found = rows.find((row) => Number(row.vmid) === props.vmid);
+    if (found === undefined) return undefined;
+    if (found.node === props.node && found.type === 'qemu') return yield* Effect.fail(answer.error);
+    return yield* Effect.fail(
+      new QemuRefusedError(
+        `vmid ${String(props.vmid)} is a ${text(found.type, 'guest')} on ` +
+          `${text(found.node, '?')}, not a VM on ${props.node}. A migration is not an ` +
+          'update and vmids are cluster-wide: declare the node it is on, or pick a free vmid.',
+      ),
+    );
+  });

package/src/proxmox/qemu-task.ts

@@ -0,0 +1,64 @@
+/** Bounded QEMU task observation on the credential that started the worker. */
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import type { ProxmoxOpContext } from '@distilled.cloud/proxmox/Protocol';
+import * as Effect from 'effect/Effect';
+import { runPveWith } from './distilled-pve.ts';
+import { mint } from './mint.ts';
+import { QemuRefusedError } from './qemu-errors.ts';
+import type { VmProps } from './qemu.ts';
+import { text } from './values.ts';
+
+/**
+ * ⛔ Fresh provision mint, then the same lease for every poll. A timed-out poll is uncertainty,
+ *   never a reason to send the write again.
+ */
+export const qemuTask = <E>(
+  props: VmProps,
+  operation: Effect.Effect<string, E, ProxmoxOpContext>,
+  what: string,
+  polls: number,
+) =>
+  Effect.gen(function* () {
+    const credential = yield* mint(props.target, 'provision');
+    const upid = text(yield* runPveWith(props.target, credential, true, operation));
+    if (upid === '') {
+      return yield* Effect.fail(
+        new QemuRefusedError(
+          `${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`,
+        ),
+      );
+    }
+    let exit = 'still running when this provider stopped waiting';
+    for (let attempt = 0; attempt < polls; attempt++) {
+      const status = yield* runPveWith(
+        props.target,
+        credential,
+        false,
+        nodes.getNodeTaskStatus({ node: props.node, upid }),
+      ).pipe(Effect.orElseSucceed(() => undefined));
+      // ⚠️ "COULD NOT BE READ" IS A MISSING ANSWER OR A MISSING `status` FIELD, NOT AN UNEXPECTED
+      //   ONE. `GetNodeTaskStatusResponseStatus` types `status` as the closed union
+      //   `"running" | "stopped"`, but the runtime validator is `S.String` (measured in
+      //   distilled-proxmox's nodes.ts), so a well-formed answer with a status word this
+      //   endpoint's contract was never proven to exclude (something other than exactly
+      //   "running") must keep polling rather than abort, since only "stopped" ends the task
+      //   (2026-09-25 adversarial review; matches lxc-task.ts and network-apply-read.ts's
+      //   awaitTask).
+      if (status === undefined || status.status === undefined) {
+        exit = 'the task could not be read';
+        break;
+      }
+      if (status.status === 'stopped') {
+        exit = text(status.exitstatus, 'stopped with no exitstatus');
+        break;
+      }
+      yield* Effect.sleep('1 second');
+    }
+    if (exit !== 'OK') {
+      return yield* Effect.fail(
+        new QemuRefusedError(
+          `${what}: task ${upid} ended "${exit}". Read the task log before running the deploy again.`,
+        ),
+      );
+    }
+  });

package/src/proxmox/qemu.ts

@@ -1,9 +1,9 @@
 /**
  * `Proxmox.Vm` — a QEMU virtual machine, declared.
  *
- * ⚠️ THE SAME FOUR OPERATIONS AS AN LXC OVER A DIFFERENT PATH, which is the point of the factory:
- *   `nodes/{node}/qemu` to create, `nodes/{node}/qemu/{vmid}/config` to read and update. A VM and a
- *   container differ in what they carry, not in how they are reconciled.
+ * ⚠️ CREATE is `POST /nodes/{node}/qemu`. GET and PUT stay on `.../qemu/{vmid}/config`.
+ *   ⛔ DELETE is `DELETE /nodes/{node}/qemu/{vmid}` (`destroy_vm` in qemu-server Qemu.pm). The
+ *   config route is not a destroy. A missing config file is `QemuConfigNotFound` only.
  *
  * ⛔ `vmid` IS CLUSTER-WIDE AND SHARED WITH CONTAINERS. A VM and an LXC cannot hold the same id, so
  *   these two resources compete for one number space. Declaring both with vmid 101 is not a
@@ -17,8 +17,8 @@
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';
-import { num } from './values.ts';
+import { qemuHandlers } from './qemu-lifecycle.ts';
+import type { PveRequirements, WithTarget } from './resource.ts';
 
 export interface VmProps extends WithTarget {
   node: string;
@@ -54,44 +54,11 @@ export interface ProxmoxVm extends Resource<
 
 export const ProxmoxVm = Resource<ProxmoxVm>('Proxmox.Vm');
 
-/** ★ Exported so the constraint proof can run the REAL create form, not a retyped copy of it. */
-export const createForm = (props: VmProps) => ({ ...shape(props), vmid: String(props.vmid) });
-
-const shape = (props: VmProps) => ({
-  cores: String(props.cores ?? 1),
-  memory: String(props.memory ?? 512),
-  name: props.name ?? `vm${String(props.vmid)}`,
-  onboot: props.onboot === true ? '1' : '0',
-  sockets: String(props.sockets ?? 1),
-  ...(props.net0 === undefined ? {} : { net0: props.net0 }),
-});
-
-const handlers = pveHandlers<VmProps, VmAttributes>({
-  attributes: (live, props) => ({
-    cores: num(live['cores'], 1),
-    memory: num(live['memory'], 512),
-    name: typeof live['name'] === 'string' ? live['name'] : '',
-    node: props.node,
-    onboot: live['onboot'] === 1 || live['onboot'] === true,
-    sockets: num(live['sockets'], 1),
-    vmid: props.vmid,
-  }),
-  collection: (props) => `nodes/${props.node}/qemu`,
-  createForm,
-  /** The vendor rules both forms are checked against at plan time — resource-spec.ts. */
-  endpoint: {
-    create: 'pve:POST /nodes/{node}/qemu',
-    update: 'pve:PUT /nodes/{node}/qemu/{vmid}/config',
-  },
-  matches: (attributes, props) =>
-    attributes.name === (props.name ?? `vm${String(props.vmid)}`) &&
-    attributes.memory === (props.memory ?? 512) &&
-    attributes.cores === (props.cores ?? 1) &&
-    attributes.sockets === (props.sockets ?? 1) &&
-    attributes.onboot === (props.onboot === true),
-  path: (props) => `nodes/${props.node}/qemu/${String(props.vmid)}/config`,
-  updateForm: shape,
-});
+export { createForm } from './qemu-form.ts';
 
+/**
+ * ⛔ Destroy uses deleteNodeQemu (`DELETE /nodes/{node}/qemu/{vmid}`), not the config path.
+ *   The old factory sent both reads and deletes to `.../config`.
+ */
 export const ProxmoxVmProvider = () =>
-  Provider.effect(ProxmoxVm, Effect.succeed(ProxmoxVm.Provider.of(handlers)));
+  Provider.effect(ProxmoxVm, Effect.succeed(ProxmoxVm.Provider.of(qemuHandlers)));

package/src/proxmox/replication-firewall-fixtures.ts

@@ -0,0 +1,71 @@
+/** Source-backed vendor responses; no live host or credential is used by these tests. */
+import * as Layer from 'effect/Layer';
+import { engineOver } from '../verify/fake-engine.ts';
+import { FAKE_TARGET } from './fake-pve.ts';
+import type { CoreCase } from './live-core-fixtures.ts';
+import { ProxmoxReplicationJob, ProxmoxReplicationJobProvider } from './replication-job.ts';
+import { deleteReplicationJob, readReplicationJob } from './replication-job-lifecycle.ts';
+import { ProxmoxFirewallAlias, ProxmoxFirewallAliasProvider } from './firewall-alias.ts';
+import { deleteFirewallAlias, readFirewallAlias } from './firewall-alias-lifecycle.ts';
+
+export const replicationProps = { target: FAKE_TARGET, guest: 900, jobnum: 0, targetNode: 'pve-b' };
+export const aliasProps = {
+  target: FAKE_TARGET,
+  name: 'HomeLan',
+  cidr: '192.0.2.1/32',
+  comment: ' 0 ',
+};
+export const replicationLive = {
+  id: '900-0',
+  guest: 900,
+  jobnum: 0,
+  target: 'pve-b',
+  type: 'local',
+  source: 'pve-a',
+};
+export const aliasLive = { name: 'homelan', cidr: '192.0.2.1', ipversion: 4 };
+export const replicationMissing = () =>
+  Response.json({ data: null, message: "no such replication job '900-0'\n" }, { status: 500 });
+export const aliasMissing = () =>
+  Response.json(
+    { data: null, message: 'Parameter verification failed.\n', errors: { name: 'no such alias' } },
+    { status: 400 },
+  );
+
+export const replicationFirewallCases: CoreCase[] = [
+  {
+    name: 'ReplicationJob',
+    path: 'cluster/replication/900-0',
+    createPath: 'cluster/replication',
+    declare: () => ProxmoxReplicationJob('row', replicationProps),
+    engine: (fake) =>
+      engineOver(ProxmoxReplicationJobProvider().pipe(Layer.provideMerge(fake.layer))),
+    read: () => readReplicationJob(replicationProps),
+    remove: () => deleteReplicationJob(replicationProps),
+    live: replicationLive,
+    drift: { ...replicationLive, remove_job: 'full' },
+    missing: replicationMissing,
+    createForm: {
+      id: '900-0',
+      type: 'local',
+      target: 'pve-b',
+      comment: '',
+      disable: '0',
+      schedule: '*/15',
+    },
+  },
+  {
+    name: 'FirewallAlias',
+    path: 'cluster/firewall/aliases/HomeLan',
+    createPath: 'cluster/firewall/aliases',
+    declare: () => ProxmoxFirewallAlias('row', aliasProps),
+    engine: (fake) =>
+      engineOver(ProxmoxFirewallAliasProvider().pipe(Layer.provideMerge(fake.layer))),
+    read: () => readFirewallAlias(aliasProps),
+    remove: () => deleteFirewallAlias(aliasProps),
+    live: aliasLive,
+    drift: { ...aliasLive, comment: 'old' },
+    missing: aliasMissing,
+    createForm: { name: 'HomeLan', cidr: '192.0.2.1' },
+  },
+];