@homeflare/alchemy 0.37.6 → 0.37.8

package/src/proxmox/replication-firewall-lifecycle.test.ts

@@ -0,0 +1,109 @@
+/** Real Alchemy Plan/Apply and distilled requests; fixtures never reach a real host. */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import { fakePve, withoutBao } from './fake-pve.ts';
+import { replicationFirewallCases } from './replication-firewall-fixtures.ts';
+
+for (const entry of replicationFirewallCases) {
+  describe(`distilled ${entry.name}`, () => {
+    test('adoption, subsequent plan and apply have zero writes', async () => {
+      const fake = fakePve(() => entry.live);
+      await withoutBao(async () => {
+        const engine = entry.engine(fake);
+        expect((await engine.verify(entry.declare(), { all: true })).rows).toEqual([
+          expect.objectContaining({ diff: 'noop', ok: true }),
+        ]);
+        expect(await engine.deploy(entry.declare())).toEqual({ row: 'adopted' });
+        expect((await engine.verify(entry.declare(), { all: true })).rows).toEqual([
+          expect.objectContaining({ diff: 'noop', ok: true }),
+        ]);
+        await engine.deploy(entry.declare());
+        expect(engine.stored()).not.toContain('fake-not-a-secret');
+      });
+      expect(fake.writes()).toEqual([]);
+    });
+
+    test('genuine absence creates once, then reads and converges', async () => {
+      let exists = false;
+      const fake = fakePve((call) => {
+        if (call.method === 'GET') return exists ? entry.live : entry.missing();
+        exists = true;
+        return null;
+      });
+      await withoutBao(async () => {
+        const engine = entry.engine(fake);
+        await engine.deploy(entry.declare());
+        expect((await engine.verify(entry.declare(), { all: true })).rows[0]).toMatchObject({
+          diff: 'noop',
+        });
+      });
+      expect(fake.writes()).toEqual([`POST ${entry.createPath}`]);
+      expect(fake.calls.find((call) => call.method === 'POST')?.form).toEqual(entry.createForm);
+    });
+
+    test('live drift produces exactly one PUT and preserves omitted fields', async () => {
+      let live = entry.drift;
+      const fake = fakePve((call) => {
+        if (call.method === 'GET') return live;
+        live = entry.live;
+        return null;
+      });
+      await withoutBao(async () => {
+        const engine = entry.engine(fake);
+        expect((await engine.verify(entry.declare(), { all: true })).rows[0]).toMatchObject({
+          diff: 'update',
+        });
+        await engine.deploy(entry.declare());
+        expect((await engine.verify(entry.declare(), { all: true })).rows[0]).toMatchObject({
+          diff: 'noop',
+        });
+      });
+      expect(fake.writes()).toEqual([`PUT ${entry.path}`]);
+      const form = fake.calls.find((call) => call.method === 'PUT')?.form;
+      if (entry.name === 'ReplicationJob') {
+        expect(form).toEqual({ comment: '', disable: '0', schedule: '*/15', delete: 'remove_job' });
+      } else {
+        // PUT replaces the alias entry: omitted comment clears it, no delete/rename/id fields.
+        expect(form).toEqual({ cidr: '192.0.2.1' });
+      }
+    });
+
+    for (const status of [401, 403, 500]) {
+      test(`${status} read failure stops cold adoption and confirmed drift before writes`, async () => {
+        let fail = true;
+        const fake = fakePve(() =>
+          fail
+            ? Response.json({ data: null, message: 'unrelated failure' }, { status })
+            : entry.live,
+        );
+        await withoutBao(async () => {
+          const engine = entry.engine(fake);
+          await expect(engine.deploy(entry.declare())).rejects.toBeDefined();
+          fail = false;
+          await engine.deploy(entry.declare());
+          fail = true;
+          await expect(engine.drift(entry.declare())).rejects.toBeDefined();
+          await expect(engine.deploy(entry.declare())).rejects.toBeDefined();
+        });
+        expect(fake.writes()).toEqual([]);
+      });
+    }
+
+    test('delete failure retains the engine state and propagates', async () => {
+      let failing = false;
+      const fake = fakePve(() =>
+        failing
+          ? Response.json({ data: null, message: 'permission denied' }, { status: 403 })
+          : entry.live,
+      );
+      await withoutBao(async () => {
+        const engine = entry.engine(fake);
+        await engine.deploy(entry.declare().pipe(RemovalPolicy.destroy()));
+        failing = true;
+        await expect(engine.deploy(Effect.void)).rejects.toBeDefined();
+        expect(engine.stored()).toContain('row');
+      });
+    });
+  });
+}

package/src/proxmox/replication-firewall-wire.test.ts

@@ -0,0 +1,173 @@
+/** Exact absence, state identity and deletion semantics through the real distilled protocol. */
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import { engineOver } from '../verify/fake-engine.ts';
+import { fakePve, withoutBao } from './fake-pve.ts';
+import {
+  aliasLive,
+  aliasProps,
+  replicationFirewallCases,
+  replicationLive,
+  replicationProps,
+} from './replication-firewall-fixtures.ts';
+import { ProxmoxFirewallAlias, ProxmoxFirewallAliasProvider } from './firewall-alias.ts';
+import { ProxmoxReplicationJob, ProxmoxReplicationJobProvider } from './replication-job.ts';
+
+for (const entry of replicationFirewallCases) {
+  test(`${entry.name}: malformed successful reads never authorize a create`, async () => {
+    for (const live of [null, {}, [], 'invalid', { ...entry.live, name: 'wrong', id: '901-0' }]) {
+      const fake = fakePve(() => live);
+      await withoutBao(async () => {
+        expect(
+          await Effect.runPromise(entry.read().pipe(Effect.flip, Effect.provide(fake.layer))),
+        ).toMatchObject({ _tag: 'ProxmoxParseError', body: undefined });
+        await expect(entry.engine(fake).deploy(entry.declare())).rejects.toBeDefined();
+      });
+      expect(fake.writes()).toEqual([]);
+    }
+  });
+
+  test(`${entry.name}: only source-backed absence is folded`, async () => {
+    const fake = fakePve(entry.missing);
+    await withoutBao(async () => {
+      expect(
+        await Effect.runPromise(entry.read().pipe(Effect.provide(fake.layer))),
+      ).toBeUndefined();
+    });
+    for (const [status, tag] of [
+      [401, 'Unauthorized'],
+      [403, 'Forbidden'],
+      [500, 'InternalServerError'],
+    ] as const) {
+      const failed = fakePve(() =>
+        Response.json({ data: null, message: 'unrelated failure' }, { status }),
+      );
+      await withoutBao(async () => {
+        expect(
+          await Effect.runPromise(entry.read().pipe(Effect.flip, Effect.provide(failed.layer))),
+        ).toMatchObject({ _tag: tag });
+        expect(
+          await Effect.runPromise(entry.remove().pipe(Effect.flip, Effect.provide(failed.layer))),
+        ).toMatchObject({ _tag: tag });
+      });
+    }
+  });
+
+  test(`${entry.name}: deletion succeeds when already absent`, async () => {
+    const fake = fakePve(() =>
+      entry.name === 'ReplicationJob'
+        ? Response.json({ data: null, message: "no such job '900-0'\n" }, { status: 500 })
+        : null,
+    );
+    await withoutBao(async () => {
+      await Effect.runPromise(entry.remove().pipe(Effect.provide(fake.layer)));
+    });
+    expect(fake.writes()).toEqual([`DELETE ${entry.path}`]);
+    expect(fake.calls[0]?.form).toEqual({});
+  });
+
+  test(`${entry.name}: explicit retain avoids DELETE, default destroy is implemented`, async () => {
+    for (const retain of [true, false]) {
+      const fake = fakePve((call) => (call.method === 'GET' ? entry.live : null));
+      await withoutBao(async () => {
+        const engine = entry.engine(fake);
+        await engine.deploy(
+          retain ? entry.declare().pipe(RemovalPolicy.retain()) : entry.declare(),
+        );
+        await engine.deploy(Effect.void);
+      });
+      expect(fake.writes()).toEqual(retain ? [] : [`DELETE ${entry.path}`]);
+      expect(fake.calls.find((call) => call.method === 'DELETE')?.form ?? {}).toEqual({});
+    }
+  });
+}
+
+test('alias rename is create-first replacement; case-only rename remains no-op', async () => {
+  const rows = new Map([['homelan', aliasLive]]);
+  const fake = fakePve((call) => {
+    const name = call.path.split('/').at(-1)?.toLowerCase() ?? '';
+    if (call.method === 'GET')
+      return (
+        rows.get(name) ??
+        Response.json(
+          {
+            data: null,
+            message: 'Parameter verification failed.\n',
+            errors: { name: 'no such alias' },
+          },
+          { status: 400 },
+        )
+      );
+    if (call.method === 'POST') {
+      const createdName = call.form['name'];
+      if (createdName === undefined) throw new Error('alias create omitted its required name');
+      rows.set(createdName.toLowerCase(), { ...aliasLive, name: createdName });
+    }
+    if (call.method === 'DELETE') rows.delete(name);
+    return null;
+  });
+  await withoutBao(async () => {
+    const engine = engineOver(ProxmoxFirewallAliasProvider().pipe(Layer.provideMerge(fake.layer)));
+    await engine.deploy(ProxmoxFirewallAlias('row', aliasProps));
+    await engine.deploy(ProxmoxFirewallAlias('row', { ...aliasProps, name: 'HOMELAN' }));
+    expect(fake.writes()).toEqual([]);
+    await engine.deploy(ProxmoxFirewallAlias('row', { ...aliasProps, name: 'NewLan' }));
+  });
+  expect(fake.writes()).toEqual([
+    'POST cluster/firewall/aliases',
+    'DELETE cluster/firewall/aliases/HomeLan',
+  ]);
+});
+
+test('replication ignores migrated source/target and undeclared fractional rate', async () => {
+  const fake = fakePve(() => ({
+    ...replicationLive,
+    target: 'pve-c',
+    source: 'pve-b',
+    rate: '10.5',
+  }));
+  await withoutBao(async () => {
+    const engine = engineOver(ProxmoxReplicationJobProvider().pipe(Layer.provideMerge(fake.layer)));
+    await engine.deploy(ProxmoxReplicationJob('row', replicationProps));
+    expect(
+      (
+        await engine.verify(ProxmoxReplicationJob('row', { ...replicationProps, rate: 10.5 }), {
+          all: true,
+        })
+      ).rows[0],
+    ).toMatchObject({ diff: 'noop' });
+  });
+  expect(fake.writes()).toEqual([]);
+});
+
+test('replication tolerates guest/jobnum echoed as text, not just as numbers', async () => {
+  // ⚠️ SectionConfig releases can echo `guest`/`jobnum` as text the same way `rate` sometimes
+  //   arrives as text above; a strict `===` against the raw wire value would misread the exact
+  //   same job as an identity mismatch and fail the read closed (2026-09-25 adversarial review).
+  const fake = fakePve(() => ({ ...replicationLive, guest: '900', jobnum: '0' }));
+  await withoutBao(async () => {
+    const engine = engineOver(ProxmoxReplicationJobProvider().pipe(Layer.provideMerge(fake.layer)));
+    expect(
+      (await engine.verify(ProxmoxReplicationJob('row', replicationProps), { all: true })).rows[0],
+    ).toMatchObject({ diff: 'noop', ok: true });
+  });
+  expect(fake.writes()).toEqual([]);
+});
+
+test('vendor constraints reject invalid declarations before any write', async () => {
+  for (const replication of [true, false]) {
+    const fake = fakePve(() => (replication ? replicationLive : { ...aliasLive, name: 'x' }));
+    await withoutBao(async () => {
+      const engine = replication
+        ? engineOver(ProxmoxReplicationJobProvider().pipe(Layer.provideMerge(fake.layer)))
+        : engineOver(ProxmoxFirewallAliasProvider().pipe(Layer.provideMerge(fake.layer)));
+      const declaration = replication
+        ? ProxmoxReplicationJob('row', { ...replicationProps, rate: 0 })
+        : ProxmoxFirewallAlias('row', { ...aliasProps, name: 'x' });
+      await expect(engine.deploy(declaration)).rejects.toBeDefined();
+    });
+    expect(fake.writes()).toEqual([]);
+  }
+});

package/src/proxmox/replication-job-config.ts

@@ -0,0 +1,79 @@
+/** Existing comparison and form semantics, separated from the named SDK transport. */
+import type { ReplicationJobAttributes, ReplicationJobProps } from './replication-job.ts';
+import type { PveSpec } from './resource-spec.ts';
+import { DEFAULT_SCHEDULE, createBody, jobId, updateBody } from './replication-job-form.ts';
+import { bool, int, text } from './values.ts';
+
+/**
+ * ⚠️ `rate` IS THE ONLY FLOAT IN THIS PACKAGE, so it gets a coercion of its own rather than a sixth
+ *   entry in `values.ts` — the rule that module states for itself: a coercion only one PVE object
+ *   needs belongs in that object's file, next to the field it serves. `int` cannot serve it, since
+ *   `Number.parseInt('10.5')` is 10 and a rate silently rounded down is both a limit nobody chose
+ *   and a comparison that never settles. It accepts a string for the reason `int` does: these are
+ *   SectionConfig sections, and whether `10` arrives as a number is a property of the release.
+ * ⚠️ 0 MEANS UNSET, and is safe as the marker because PVE's schema gives `rate` a minimum of 1 —
+ *   the same trick as `metric-server.ts`'s `UNSET = -1`, for the same reason.
+ */
+const rateOf = (value: unknown): number => {
+  if (typeof value === 'number') return value;
+  const parsed = Number.parseFloat(text(value));
+  return Number.isFinite(parsed) ? parsed : 0;
+};
+
+export const replicationJobSpec = {
+  /**
+   * ⚠️ EVERY FALLBACK IS PVE'S DOCUMENTED DEFAULT, NOT `false`/`''` PICKED FOR CONVENIENCE, so the
+   *   answer does not depend on whether a given release echoes back a key it never wrote.
+   *   SectionConfig stores what it was handed; a job created in the UI without a schedule has no
+   *   schedule line, and reading that absence as anything but `DEFAULT_SCHEDULE` would report
+   *   drift on a job nobody touched and then WRITE the reading back.
+   * ⛔ The distilled read validates the response and requested identity before applying defaults.
+   *   Only the precise typed vendor exception means absence. `digest` is deliberately absent
+   *   here — it changes when ANY job changes, including one somebody else declared.
+   */
+  attributes: (live, props) => ({
+    comment: text(live['comment'], ''),
+    disable: bool(live['disable'], false),
+    guest: int(live['guest'], props.guest),
+    id: text(live['id'], jobId(props)),
+    jobnum: int(live['jobnum'], props.jobnum),
+    rate: rateOf(live['rate']),
+    remove_job: text(live['remove_job'], ''),
+    schedule: text(live['schedule'], DEFAULT_SCHEDULE),
+    source: text(live['source'], ''),
+    targetNode: text(live['target'], props.targetNode),
+    type: text(live['type'], 'local'),
+  }),
+  collection: () => 'cluster/replication',
+  createForm: createBody,
+  /**
+   * ⚠️ `targetNode` AND `source` ARE OUT OF THIS COMPARISON FOR TWO REASONS EACH, AND EITHER ALONE
+   *   WOULD BE ENOUGH. They are create-only — `target` is a `fixed` option, `source` has no honest
+   *   declared value — AND PVE REWRITES BOTH BEHIND YOUR BACK. MEASURED in
+   *   `switch_replication_job_target_nolock`: when a guest migrates, PVE sets
+   *   `$jobcfg->{target} = $new_target` and `$jobcfg->{source} = $old_target`, so the job follows
+   *   the guest. Compared, a single migration would make every later plan report an update that the
+   *   PUT cannot perform, forever. The cost of leaving them out is stated on the `targetNode` prop:
+   *   a changed target plans as noop, and a migrated job is not dragged back.
+   * ⚠️ `guest`, `jobnum`, `type` AND `id` ARE NOT COMPARED EITHER: the first two are the id in
+   *   integer form, `type` has one legal value, and `id` is the path — a change there is a
+   *   different object, which reads as absent and is created.
+   * ⛔ `remove_job` IS COMPARED, AND IT IS THE ONE FIELD HERE THAT LOOKS LIKE A FOREVER-UPDATE AND
+   *   IS NOT. A DELETE marks the job rather than removing it, so a re-declared id can name a job
+   *   that is busy deleting itself, and matching that would be a noop over a vanishing object. It
+   *   settles because `updateBody` actually clears the marker — see there.
+   */
+  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */
+  endpoint: {
+    create: 'pve:POST /cluster/replication',
+    update: 'pve:PUT /cluster/replication/{id}',
+  },
+  matches: (attributes, props) =>
+    attributes.remove_job === '' &&
+    attributes.schedule === (props.schedule ?? DEFAULT_SCHEDULE) &&
+    attributes.disable === (props.disable === true) &&
+    attributes.comment === (props.comment ?? '') &&
+    (props.rate === undefined || attributes.rate === props.rate),
+  path: (props) => `cluster/replication/${jobId(props)}`,
+  updateForm: updateBody,
+} satisfies PveSpec<ReplicationJobProps, ReplicationJobAttributes>;

package/src/proxmox/replication-job-lifecycle.ts

@@ -0,0 +1,113 @@
+/** Named SDK transport; pve-manager 9.2.11 ReplicationConfig.pm defines absence and removal. */
+import { isResolved } from 'alchemy/Diff';
+import type { Input } from 'alchemy/Input';
+import * as cluster from '@distilled.cloud/proxmox/cluster';
+import { ProxmoxParseError } from '@distilled.cloud/proxmox/Errors';
+import * as Effect from 'effect/Effect';
+import * as Schema from 'effect/Schema';
+import { runPve } from './distilled-pve.ts';
+import type { ReplicationJobAttributes, ReplicationJobProps } from './replication-job.ts';
+import { replicationJobSpec as spec } from './replication-job-config.ts';
+import { jobId } from './replication-job-form.ts';
+import { specGuards } from './resource-guard.ts';
+import { formToSend } from './update-guard.ts';
+import { int } from './values.ts';
+
+const { guardCreate, guardUpdate } = specGuards(spec);
+const malformed = () =>
+  new ProxmoxParseError({
+    body: undefined,
+    cause: 'Replication job response does not match the requested vendor identity',
+  });
+
+export const readReplicationJob = (props: ReplicationJobProps) =>
+  runPve(props.target, 'read', false, cluster.getClusterReplication({ id: jobId(props) })).pipe(
+    Effect.flatMap((live) =>
+      // ⚠️ SectionConfig releases can echo `guest`/`jobnum` (and `rate`) as text rather than a JSON
+      //   number — measured on replication-job-config.ts's own `int()`/`rateOf()` fields, which is
+      //   why every other numeric read in this family goes through `int()` rather than a strict
+      //   type. `GetClusterReplicationResponse` types `guest`/`jobnum` as `S.Number` with no
+      //   coercion, so a string echo fails decode before the identity check below ever runs;
+      //   normalize both through `int()` first, same as `rate` is normalized to skip its own
+      //   release-dependent shape.
+      Schema.decodeUnknownEffect(Schema.toType(cluster.GetClusterReplicationResponse))({
+        ...live,
+        guest: int(live.guest, Number.NaN),
+        jobnum: int(live.jobnum, Number.NaN),
+        rate: undefined,
+      }).pipe(Effect.mapError(malformed), Effect.as(live)),
+    ),
+    Effect.flatMap((live) =>
+      // ⛔ `id` alone (a string PVE always returns, e.g. "900-0") already proves identity; the
+      //   guest/jobnum recheck is defense in depth, so it must tolerate the same string-or-number
+      //   wire shape as the decode above rather than `===` against the raw, possibly-text value.
+      live.id === jobId(props) &&
+      int(live.guest, Number.NaN) === props.guest &&
+      int(live.jobnum, Number.NaN) === props.jobnum
+        ? Effect.succeed(spec.attributes({ ...live }, props))
+        : Effect.fail(malformed()),
+    ),
+    Effect.catchTag('ReplicationJobNotFound', () => Effect.succeed(undefined)),
+  );
+
+/** DELETE without force/keep marks full background removal; it must never force immediate removal. */
+export const deleteReplicationJob = (props: ReplicationJobProps) =>
+  runPve(
+    props.target,
+    'provision',
+    true,
+    cluster.deleteClusterReplication({ id: jobId(props) }),
+  ).pipe(Effect.catchTag('ReplicationJobNotFound', () => Effect.void));
+
+export const replicationJobHandlers = {
+  // Explicit declaration is the only way to adopt a job and gain deletion authority over replicas.
+  list: () => Effect.succeed([]),
+  read: ({ olds }: { olds: ReplicationJobProps }) => readReplicationJob(olds),
+  diff: Effect.fn(function* ({
+    news,
+    output,
+  }: {
+    news: Input<ReplicationJobProps>;
+    output: ReplicationJobAttributes | undefined;
+  }) {
+    if (!isResolved(news)) return undefined;
+    yield* guardCreate(news, output === undefined);
+    yield* guardUpdate(news);
+    if (output === undefined) return undefined;
+    const live = yield* readReplicationJob(news);
+    if (live === undefined) {
+      yield* guardCreate(news, true);
+      return { action: 'update' } as const;
+    }
+    return { action: spec.matches(live, news) ? 'noop' : 'update' } as const;
+  }),
+  reconcile: Effect.fn(function* ({ news }: { news: ReplicationJobProps }) {
+    const live = yield* readReplicationJob(news);
+    yield* guardCreate(news, live === undefined);
+    yield* guardUpdate(news);
+    if (live === undefined) {
+      yield* runPve(
+        news.target,
+        'provision',
+        true,
+        cluster.createClusterReplication(spec.createForm(news)),
+      );
+    } else {
+      const form = formToSend(spec.matches, live, news, spec.updateForm(news));
+      if (form !== undefined)
+        yield* runPve(
+          news.target,
+          'provision',
+          true,
+          cluster.putClusterReplication({ ...form, id: jobId(news) }),
+        );
+    }
+    const after = yield* readReplicationJob(news);
+    if (after === undefined)
+      return yield* Effect.fail(
+        new Error(`${spec.path(news)}: write returned success but the resource is still absent`),
+      );
+    return after;
+  }),
+  delete: ({ olds }: { olds: ReplicationJobProps }) => deleteReplicationJob(olds),
+};

package/src/proxmox/replication-job.ts

@@ -56,13 +56,12 @@
  *     checks `VM.Audit` on `/vms/<guest>`, `hf-read@pve` holds the built-in `PVEAuditor` at `/`
  *     with propagate — both MEASURED — and `PVEAuditor` carries `VM.Audit`. This family is not a
  *     fourth one that must borrow the provision lease.
- *   ⚠️ A MISSING JOB IS A 500, NOT A 404 — "no such replication job '100-0'" — and the factory
- *     folds any failed read into "absent", so a 403 reads as absent too. A plan insisting on
- *     creating a job that plainly exists is a credential problem; the honest error arrives one step
- *     later, from the create.
+ *   ⚠️ A MISSING JOB IS A 500, NOT A 404 — "no such replication job '100-0'" — and distilled now
+ *     exposes a precise missing-job tag. Permission failures and unrelated server errors propagate
+ *     before any write; only the vendor missing-job signal means absent.
  *
  * ⛔ DELETE DOES NOT DELETE, AND A DESTROY IS NOT FREE. MEASURED: with neither `force` nor `keep` —
- *   and the factory's `destroy` sends no form at all — the handler only sets `remove_job = 'full'`
+ *   and the named SDK delete sends neither option — the handler only sets `remove_job = 'full'`
  *   on the job and writes the config back. The job stays in replication.cfg until the SOURCE node's
  *   `pvesr` timer next runs it, at which point it removes the local replication snapshots, removes
  *   the replicated volumes on the target, and finally removes itself. So a destroy costs the
@@ -86,9 +85,8 @@
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import { DEFAULT_SCHEDULE, createBody, jobId, updateBody } from './replication-job-form.ts';
-import { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';
-import { bool, int, text } from './values.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
+import { replicationJobHandlers } from './replication-job-lifecycle.ts';
 
 export interface ReplicationJobProps extends WithTarget {
   /** ⛔ The guest being replicated. 100 or above — PVE reserves everything below. Identity. */
@@ -164,81 +162,6 @@ export interface ProxmoxReplicationJob extends Resource<
 
 export const ProxmoxReplicationJob = Resource<ProxmoxReplicationJob>('Proxmox.ReplicationJob');
 
-/**
- * ⚠️ `rate` IS THE ONLY FLOAT IN THIS PACKAGE, so it gets a coercion of its own rather than a sixth
- *   entry in `values.ts` — the rule that module states for itself: a coercion only one PVE object
- *   needs belongs in that object's file, next to the field it serves. `int` cannot serve it, since
- *   `Number.parseInt('10.5')` is 10 and a rate silently rounded down is both a limit nobody chose
- *   and a comparison that never settles. It accepts a string for the reason `int` does: these are
- *   SectionConfig sections, and whether `10` arrives as a number is a property of the release.
- * ⚠️ 0 MEANS UNSET, and is safe as the marker because PVE's schema gives `rate` a minimum of 1 —
- *   the same trick as `metric-server.ts`'s `UNSET = -1`, for the same reason.
- */
-const rateOf = (value: unknown): number => {
-  if (typeof value === 'number') return value;
-  const parsed = Number.parseFloat(text(value));
-  return Number.isFinite(parsed) ? parsed : 0;
-};
-
-const handlers = pveHandlers<ReplicationJobProps, ReplicationJobAttributes>({
-  /**
-   * ⚠️ EVERY FALLBACK IS PVE'S DOCUMENTED DEFAULT, NOT `false`/`''` PICKED FOR CONVENIENCE, so the
-   *   answer does not depend on whether a given release echoes back a key it never wrote.
-   *   SectionConfig stores what it was handed; a job created in the UI without a schedule has no
-   *   schedule line, and reading that absence as anything but `DEFAULT_SCHEDULE` would report
-   *   drift on a job nobody touched and then WRITE the reading back.
-   * ⛔ NO "IS IT REALLY THERE" GUARD, for `backup-job.ts`'s reason: absence is the API declining to
-   *   answer, which `pveOperations.read` already handles, not a key missing from an answer that did
-   *   arrive. `digest` is deliberately absent too — it changes when ANY job in the file changes,
-   *   including one somebody else declared (`ha-resource.ts` hit exactly that).
-   */
-  attributes: (live, props) => ({
-    comment: text(live['comment'], ''),
-    disable: bool(live['disable'], false),
-    guest: int(live['guest'], props.guest),
-    id: text(live['id'], jobId(props)),
-    jobnum: int(live['jobnum'], props.jobnum),
-    rate: rateOf(live['rate']),
-    remove_job: text(live['remove_job'], ''),
-    schedule: text(live['schedule'], DEFAULT_SCHEDULE),
-    source: text(live['source'], ''),
-    targetNode: text(live['target'], props.targetNode),
-    type: text(live['type'], 'local'),
-  }),
-  collection: () => 'cluster/replication',
-  createForm: createBody,
-  /**
-   * ⚠️ `targetNode` AND `source` ARE OUT OF THIS COMPARISON FOR TWO REASONS EACH, AND EITHER ALONE
-   *   WOULD BE ENOUGH. They are create-only — `target` is a `fixed` option, `source` has no honest
-   *   declared value — AND PVE REWRITES BOTH BEHIND YOUR BACK. MEASURED in
-   *   `switch_replication_job_target_nolock`: when a guest migrates, PVE sets
-   *   `$jobcfg->{target} = $new_target` and `$jobcfg->{source} = $old_target`, so the job follows
-   *   the guest. Compared, a single migration would make every later plan report an update that the
-   *   PUT cannot perform, forever. The cost of leaving them out is stated on the `targetNode` prop:
-   *   a changed target plans as noop, and a migrated job is not dragged back.
-   * ⚠️ `guest`, `jobnum`, `type` AND `id` ARE NOT COMPARED EITHER: the first two are the id in
-   *   integer form, `type` has one legal value, and `id` is the path — a change there is a
-   *   different object, which reads as absent and is created.
-   * ⛔ `remove_job` IS COMPARED, AND IT IS THE ONE FIELD HERE THAT LOOKS LIKE A FOREVER-UPDATE AND
-   *   IS NOT. A DELETE marks the job rather than removing it, so a re-declared id can name a job
-   *   that is busy deleting itself, and matching that would be a noop over a vanishing object. It
-   *   settles because `updateBody` actually clears the marker — see there.
-   */
-  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */
-  endpoint: {
-    create: 'pve:POST /cluster/replication',
-    update: 'pve:PUT /cluster/replication/{id}',
-  },
-  matches: (attributes, props) =>
-    attributes.remove_job === '' &&
-    attributes.schedule === (props.schedule ?? DEFAULT_SCHEDULE) &&
-    attributes.disable === (props.disable === true) &&
-    attributes.comment === (props.comment ?? '') &&
-    (props.rate === undefined || attributes.rate === props.rate),
-  path: (props) => `cluster/replication/${jobId(props)}`,
-  updateForm: updateBody,
-});
-
 /**
  * ⛔ Empty `list` like every other resource here: `GET /cluster/replication` hands back every job an
  *   operator ever made, and adopting one is how a later `alchemy destroy` takes away a standby copy
@@ -250,5 +173,5 @@ const handlers = pveHandlers<ReplicationJobProps, ReplicationJobAttributes>({
 export const ProxmoxReplicationJobProvider = () =>
   Provider.effect(
     ProxmoxReplicationJob,
-    Effect.succeed(ProxmoxReplicationJob.Provider.of(handlers)),
+    Effect.succeed(ProxmoxReplicationJob.Provider.of(replicationJobHandlers)),
   );

package/src/release/archive.ts

@@ -54,7 +54,10 @@ export const extractMembers = async (
       offset += SLICE;
     },
   });
-  const unzipped = source.pipeThrough(new DecompressionStream('gzip')).getReader();
+  // ⚠️ TS 7's DOM lib types this writable chunk as BufferSource, which pipeThrough
+  //   will not accept as Uint8Array. The slices enqueued above are Uint8Array.
+  const gunzip = new DecompressionStream('gzip') as ReadableWritablePair<Uint8Array, Uint8Array>;
+  const unzipped = source.pipeThrough(gunzip).getReader();
   try {
     for (;;) {
       const { done, value } = await unzipped.read();