@homeflare/alchemy 0.37.6 → 0.37.8

package/src/linux/sudo-lifecycle.test.ts

@@ -1,15 +1,19 @@
 /**
- * `Systemd.Unit` and `Remote.File`'s own lifecycle functions, driven through sshSudoRunner over
- * the fake Linux host — proving the two families this runner exists for actually work end to end,
- * not just that the runner's own primitives do. No sudo runs anywhere but through the fake.
+ * `Systemd.Unit`, `Remote.File` and `Podman.Container`'s own lifecycle functions, driven through
+ * sshSudoRunner over the fake Linux host — proving the families this runner exists for actually
+ * work end to end, not just that the runner's own primitives do. No sudo runs anywhere but through
+ * the fake.
  */
 import { describe, expect, test } from 'bun:test';
+import { fakeQuadletHost } from './fake-quadlet.ts';
 import { fakeSudoHost } from './fake-sudo.ts';
 import { SudoRefusedError } from './sudo-runner.ts';
 import { deleteFile, reconcileFile } from './remote-file-lifecycle.ts';
 import type { RemoteFileProps } from './remote-file-form.ts';
 import { deleteUnit, diffUnit, reconcileUnit } from './unit-lifecycle.ts';
 import type { SystemdUnitProps } from './unit-form.ts';
+import { reconcileContainer } from './container-lifecycle.ts';
+import type { ContainerProps } from './container-form.ts';
 
 const UNIT: SystemdUnitProps = {
   name: 'hf-thing.service',
@@ -124,6 +128,63 @@ describe('Systemd.Unit through sshSudoRunner', () => {
   });
 });
 
+// 🔴 REGRESSION, CT100 deploy 2026-09-26 00:11Z: `Podman.Container caddy`'s generated unit's
+//   FragmentPath (`/run/systemd/generator/…`) was refused outright by the ownership check above,
+//   even though its SourcePath (`/etc/containers/systemd/caddy.container`) was this runner's own
+//   `.container` file, under a declared prefix. `fakeQuadletHost` in place of the plain
+//   `fakeLinuxHost` (via `fakeSudoHost`'s `hostFactory`) reproduces the exact CT100 shape: a
+//   generated unit whose FragmentPath is the generator's own output directory.
+const CADDY_PREFIXES = ['/etc/containers/systemd', '/etc/systemd/system'];
+const CADDY: ContainerProps = {
+  container: { image: 'docker.io/library/caddy:2', network: 'host' },
+  install: { wantedBy: ['multi-user.target'] },
+  name: 'caddy',
+  service: { restart: 'always' },
+};
+
+describe('Podman.Container through sshSudoRunner', () => {
+  test(
+    'a full reconcile writes, reloads and starts — the generated unit’s FragmentPath under ' +
+      'the generator is reachable because its SourcePath is under a declared prefix',
+    async () => {
+      const { privileged, runner } = fakeSudoHost({}, undefined, {
+        hostFactory: fakeQuadletHost,
+        prefixes: CADDY_PREFIXES,
+      });
+      const attrs = await reconcileContainer(runner, CADDY, undefined);
+      expect(attrs.active).toBe(true);
+      expect(attrs.sourcePath).toBe('/etc/containers/systemd/caddy.container');
+      const verbs = privileged()
+        .filter((c) => c[0] === '/usr/bin/systemctl')
+        .map((c) => c[1]);
+      expect(verbs).toContain('daemon-reload');
+      expect(verbs).toContain('start');
+    },
+  );
+
+  test('a generated unit whose SourcePath is outside every declared prefix still refuses', async () => {
+    const { fake, privileged, runner } = fakeSudoHost({}, undefined, {
+      hostFactory: fakeQuadletHost,
+      prefixes: CADDY_PREFIXES,
+    });
+    // A `.container` file Quadlet's OWN search path would also read (podman-systemd.unit(5)), but
+    // not under any prefix THIS runner declared — a foreign Quadlet source, same idea as the
+    // vendor `pveproxy.service` test above for a plain unit.
+    fake.files.set('/run/containers/systemd/other.container', {
+      bytes: new TextEncoder().encode('[Container]\nImage=example/other:1\n'),
+      gid: 0,
+      kind: 'file',
+      mode: 0o644,
+      uid: 0,
+    });
+    await runner.exec(['systemctl', 'daemon-reload']);
+    await expect(runner.exec(['systemctl', 'restart', '--', 'other.service'])).rejects.toThrow(
+      /SourcePath .* is not under one either/,
+    );
+    expect(privileged().some((c) => c[1] === 'restart')).toBe(false);
+  });
+});
+
 const SCRIPT: RemoteFileProps = {
   content: '#!/bin/sh\necho hi\n',
   mode: 0o755,

package/src/linux/unit-form.ts

@@ -12,8 +12,11 @@
  * ⛔ `content` IS NEVER A SECRET. Props sit unencrypted in Alchemy state and the unit file is
  *   world-readable at 0644; a unit that needs a secret takes `EnvironmentFile=` pointing at a file
  *   a secret renderer maintains.
+ * ★ THE TEXT-SHAPE CHECKS (comments/blank lines before [Section], [Install] key lookup) live in
+ *   `unit-text.ts`, split out to keep this file under the house line cap.
  */
 import { sha256Hex } from '../launchd/job-form.ts';
+import { hasInstallSection, textProblems } from './unit-text.ts';
 
 export type UnitSection = {
   /** `Unit`, `Service`, `Timer`, `Install`, … — verbatim, including its capitalisation. */
@@ -172,8 +175,6 @@ const TYPES = new Set([
   'timer',
 ]);
 
-const INSTALL_KEYS = new Set(['WantedBy', 'RequiredBy', 'UpsertedBy', 'Also', 'Alias']);
-
 /**
  * Every refusal at once, so one plan shows the whole list.
  * ⛔ THE TWO STRUCTURAL RULES, both proven by systemd's own output rather than assumed:
@@ -206,7 +207,7 @@ export const unitProblems = (props: SystemdUnitProps, expect?: string): string[]
         `${directory} is not one of them. Move it, or declare enabled: false.`,
     );
   }
-  if (props.enabled !== false && !hasInstall(props)) {
+  if (props.enabled !== false && !hasInstallSection(unitText(props))) {
     found.push(
       'enabled units need an [Install] section with WantedBy/RequiredBy/Also/Alias; without one ' +
         'systemd calls the unit "static" and `systemctl enable` has nothing to link. Add one, or ' +
@@ -218,18 +219,3 @@ export const unitProblems = (props: SystemdUnitProps, expect?: string): string[]
   }
   return found;
 };
-
-const hasInstall = (props: SystemdUnitProps): boolean => {
-  const text = unitText(props);
-  if (!text.includes('[Install]')) return false;
-  const after = text.slice(text.indexOf('[Install]'));
-  return [...INSTALL_KEYS].some((key) => new RegExp(`^${key}=`, 'm').test(after));
-};
-
-const textProblems = (text: string): string[] => {
-  const found: string[] = [];
-  if (text.trim() === '') found.push('the unit file is empty');
-  if (text.includes('\u0000')) found.push('the unit file contains NUL');
-  if (!/^\s*\[[A-Za-z]+]/.test(text)) found.push('a unit file must begin with a [Section]');
-  return found;
-};

package/src/linux/unit-text.test.ts

@@ -0,0 +1,67 @@
+/**
+ * `unit-text.ts`'s own tests — the INI text-shape checks, on their own, separate from
+ * `unit-lifecycle.test.ts`'s end-to-end fake-host behaviour.
+ */
+import { describe, expect, test } from 'bun:test';
+import { hasInstallSection, textProblems } from './unit-text.ts';
+
+// 🔴 REGRESSION, CT100 deploy 2026-09-26 00:11Z: `assertValid` refused this EXACT content — "a
+//   unit file must begin with a [Section]" — even though it is byte-identical to what systemd
+//   already loads on CT100 (sha256 verified against the live host). Leading lines copied
+//   verbatim from homeflare-ct100's src/openbao-agent/files/openbao-agent.service.
+const CT100_OPENBAO_AGENT = [
+  "# CT100's openbao-agent.",
+  '#',
+  "# THIS FILE WAS RECOVERED FROM THE RUNNING BOX, NOT PUSHED TO IT. The repo's copy was STALE",
+  '#   and would have REMOVED `Environment=BAO_NAMESPACE=homeflare` -- without which the agent',
+  '#   authenticates into the root namespace, every template 403s, and the failure reads as a',
+  '#   missing grant rather than a missing variable. That is the exact shape the vault policies',
+  '#   README warns about: a deploy converging a stale copy over a working live one.',
+  '# So the FIRST run of deploy-ct100.sh was a --dry-run, and this is what it was for.',
+  '[Unit]',
+  'Description=OpenBao agent',
+  'After=network-online.target',
+  'Wants=network-online.target',
+  '[Service]',
+  'Environment=BAO_NAMESPACE=homeflare',
+  'ExecStart=/usr/bin/bao agent -config=/etc/openbao/agent.hcl',
+  'RuntimeDirectory=openbao',
+  'Restart=on-failure',
+  'RestartSec=10',
+  '[Install]',
+  'WantedBy=multi-user.target',
+  '',
+].join('\n');
+
+describe('textProblems', () => {
+  test('the CT100 openbao-agent.service fixture validates — comments may precede [Unit]', () => {
+    expect(textProblems(CT100_OPENBAO_AGENT)).toEqual([]);
+  });
+
+  test('blank lines alone may also precede the first section', () => {
+    expect(textProblems('\n\n[Unit]\nDescription=x\n')).toEqual([]);
+  });
+
+  test('a ; comment is accepted the same as a #  comment', () => {
+    expect(textProblems('; a semicolon comment\n[Unit]\nDescription=x\n')).toEqual([]);
+  });
+
+  test('a genuine key=value before any section still refuses — comments are not a blanket exemption', () => {
+    expect(textProblems('Description=no section at all\n[Unit]\n').join(' ')).toMatch(
+      /must begin with a \[Section\]/,
+    );
+  });
+
+  test('an empty file and one with NUL are still refused', () => {
+    expect(textProblems('   \n').join(' ')).toMatch(/is empty/);
+    expect(textProblems('[Unit]\nDescription=a\u0000b\n').join(' ')).toMatch(/contains NUL/);
+  });
+});
+
+describe('hasInstallSection', () => {
+  test('true only once an [Install] key actually appears after the header', () => {
+    expect(hasInstallSection('[Unit]\n[Install]\nWantedBy=multi-user.target\n')).toBe(true);
+    expect(hasInstallSection('[Unit]\nDescription=x\n')).toBe(false);
+    expect(hasInstallSection('[Unit]\n[Install]\n')).toBe(false);
+  });
+});

package/src/linux/unit-text.ts

@@ -0,0 +1,58 @@
+/**
+ * The parts of `unit-form.ts`'s validation that inspect the unit file's TEXT rather than its
+ * props struct — split out so unit-form.ts stays under the file cap, and because these are one
+ * coherent concern: is this INI shape something systemd would actually load. Takes plain strings,
+ * never `SystemdUnitProps`, so it never needs to import back from unit-form.ts.
+ *
+ * ⛔ `[Install]` KEYS ARE `unit-form.ts`'s OWN LIST, NOT SYSTEMD'S FULL VOCABULARY — WantedBy,
+ *   RequiredBy, UpsertedBy, Also, Alias, per `systemd.unit(5)` §[Install]. `container-form.ts`'s
+ *   own header notes it deliberately does NOT reuse this set: a `.container` file's `[Install]`
+ *   supports only Alias/WantedBy/RequiredBy (`podman-systemd.unit(5)`), narrower than this.
+ */
+
+export const INSTALL_KEYS = new Set(['WantedBy', 'RequiredBy', 'UpsertedBy', 'Also', 'Alias']);
+
+/** Whether `text` has an `[Install]` section carrying at least one key systemd actually links on. */
+export const hasInstallSection = (text: string): boolean => {
+  if (!text.includes('[Install]')) return false;
+  const after = text.slice(text.indexOf('[Install]'));
+  return [...INSTALL_KEYS].some((key) => new RegExp(`^${key}=`, 'm').test(after));
+};
+
+/**
+ * The first line that is neither blank nor a comment — the line whose shape actually decides
+ * whether the file "begins with a [Section]", per `textProblems` below.
+ * ★ systemd.syntax(7): "Empty lines and lines starting with '#' or ';' are ignored", with no
+ *   carve-out for the position before the first section — a comment header is ordinary content
+ *   there, same as anywhere else in the file.
+ */
+export const firstSubstantiveLine = (text: string): string | undefined =>
+  text
+    .split('\n')
+    .find((line) => !(line.trim() === '' || line.startsWith('#') || line.startsWith(';')));
+
+/**
+ * 🔴 MEASURED FALSE, CT100 deploy 2026-09-26 00:11Z: the openbao-agent.service asset's first eight
+ *   lines are `#`-comments recording where the file was recovered from (verbatim from the live
+ *   host — homeflare-ct100's `src/openbao-agent/files/openbao-agent.service`), and the file is
+ *   byte-identical to what systemd already loads there. The old check tested the WHOLE text
+ *   against `/^\s*\[[A-Za-z]+]/` — `\s*` skips blank lines and indentation, never a `#`/`;`
+ *   comment — so a leading comment line failed it outright. This checks only the first
+ *   SUBSTANTIVE line, so any number of leading blank lines and comments are fine and a genuine
+ *   `key=value` before any section — the one real error this exists to catch — still fails, since
+ *   that line is neither blank nor a comment either.
+ */
+export const textProblems = (text: string): string[] => {
+  const found: string[] = [];
+  if (text.trim() === '') found.push('the unit file is empty');
+  if (text.includes('\u0000')) found.push('the unit file contains NUL');
+  const first = firstSubstantiveLine(text);
+  // ★ `\s*` kept from the original regex — leading indentation on the SECTION line itself was
+  //   already tolerated before this fix and stays that way; only the leading-comment shape changes.
+  if (first === undefined || !/^\s*\[[A-Za-z]+]/.test(first)) {
+    found.push(
+      'a unit file must begin with a [Section] (blank lines and #/; comments before it are fine)',
+    );
+  }
+  return found;
+};

package/src/proxmox/firewall-alias-config.ts

@@ -0,0 +1,39 @@
+/** Existing alias normalization and forms, independent of the named SDK transport. */
+import type { FirewallAliasAttributes, FirewallAliasProps } from './firewall-alias.ts';
+import type { PveSpec } from './resource-spec.ts';
+import { body, cidr, comment } from './firewall-alias-form.ts';
+import { int, text } from './values.ts';
+
+export const firewallAliasSpec = {
+  /** The SDK read refuses malformed successful payloads before applying these normalizers. */
+  attributes: (live, props) => {
+    const address = cidr(live['cidr']);
+    return {
+      cidr: address,
+      comment: comment(live['comment']),
+      ipversion: int(live['ipversion'], 0),
+      /** The read checks identity; the stored spelling is preserved for display. */
+      name: text(live['name'], props.name),
+    };
+  },
+  collection: () => 'cluster/firewall/aliases',
+  createForm: (props) => ({ ...body(props), name: props.name }),
+  /**
+   * ⚠️ EXACTLY THE TWO FIELDS A PUT CAN PUT BACK, both sides through the same normalisers. `name`
+   *   is identity and case-only drift (see the header); `ipversion` is derived and unwritable.
+   *   Comparing either would report an update that no update can settle.
+   */
+  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */
+  endpoint: {
+    create: 'pve:POST /cluster/firewall/aliases',
+    update: 'pve:PUT /cluster/firewall/aliases/{name}',
+  },
+  matches: (attributes, props) =>
+    attributes.cidr === cidr(props.cidr) && attributes.comment === comment(props.comment),
+  /**
+   * ⚠️ UNESCAPED ON PURPOSE: `pve-fw-alias` admits only `[A-Za-z][A-Za-z0-9\-\_]+`, so there is no
+   *   character here that a URL would need to encode, and PVE lowercases the segment on arrival.
+   */
+  path: (props) => `cluster/firewall/aliases/${props.name}`,
+  updateForm: body,
+} satisfies PveSpec<FirewallAliasProps, FirewallAliasAttributes>;

package/src/proxmox/firewall-alias-form.ts

@@ -106,7 +106,7 @@ export const comment = (value: unknown) => {
  *   this form would be a second, invisible identity for the object, set from a field the resource
  *   does not have.
  */
-export const body = (props: FirewallAliasProps): Record<string, string> => {
+export const body = (props: FirewallAliasProps): Record<string, string> & { cidr: string } => {
   const note = comment(props.comment);
   return { cidr: cidr(props.cidr), ...(note === '' ? {} : { comment: note }) };
 };

package/src/proxmox/firewall-alias-lifecycle.ts

@@ -0,0 +1,100 @@
+/** Named SDK operations; pve-firewall 6.0.5 Aliases.pm supplies exact absence and idempotent delete. */
+import { isResolved } from 'alchemy/Diff';
+import type { Input } from 'alchemy/Input';
+import * as cluster from '@distilled.cloud/proxmox/cluster';
+import { ProxmoxParseError } from '@distilled.cloud/proxmox/Errors';
+import * as Effect from 'effect/Effect';
+import type { FirewallAliasAttributes, FirewallAliasProps } from './firewall-alias.ts';
+import { firewallAliasSpec as spec } from './firewall-alias-config.ts';
+import { cidr, fold } from './firewall-alias-form.ts';
+import { runPve } from './distilled-pve.ts';
+import { specGuards } from './resource-guard.ts';
+import { formToSend } from './update-guard.ts';
+
+const { guardCreate, guardUpdate } = specGuards(spec);
+
+export const readFirewallAlias = (props: FirewallAliasProps) =>
+  runPve(props.target, 'read', false, cluster.getClusterFirewallAlias({ name: props.name })).pipe(
+    Effect.flatMap((live) => {
+      // Vendor's GET schema is bare object; read_alias returns the stored name/cidr entry.
+      // ⛔ A malformed successful read is not absence and must never authorize a POST.
+      if (
+        live === null ||
+        typeof live !== 'object' ||
+        Array.isArray(live) ||
+        !('name' in live) ||
+        typeof live.name !== 'string' ||
+        fold(live.name) !== fold(props.name) ||
+        !('cidr' in live) ||
+        typeof live.cidr !== 'string' ||
+        cidr(live.cidr) === ''
+      ) {
+        return Effect.fail(
+          new ProxmoxParseError({
+            body: undefined,
+            cause: 'Firewall alias response does not match the requested vendor identity',
+          }),
+        );
+      }
+      return Effect.succeed(spec.attributes({ ...live }, props));
+    }),
+    Effect.catchTag('FirewallAliasNotFound', () => Effect.succeed(undefined)),
+  );
+
+/** Vendor deletion silently removes a missing key. All actual SDK failures still propagate. */
+export const deleteFirewallAlias = (props: FirewallAliasProps) =>
+  runPve(props.target, 'provision', true, cluster.deleteClusterFirewallAlias({ name: props.name }));
+
+export const firewallAliasHandlers = {
+  list: () => Effect.succeed([]),
+  read: ({ olds }: { olds: FirewallAliasProps }) => readFirewallAlias(olds),
+  diff: Effect.fn(function* ({
+    news,
+    output,
+  }: {
+    news: Input<FirewallAliasProps>;
+    output: FirewallAliasAttributes | undefined;
+  }) {
+    if (!isResolved(news)) return undefined;
+    yield* guardCreate(news, output === undefined);
+    yield* guardUpdate(news);
+    if (output === undefined) return undefined;
+    // A case-only spelling is the same vendor key; a real rename remains create-first replacement.
+    if (fold(news.name) !== fold(output.name)) return { action: 'replace' } as const;
+    const live = yield* readFirewallAlias(news);
+    if (live === undefined) {
+      yield* guardCreate(news, true);
+      return { action: 'update' } as const;
+    }
+    return { action: spec.matches(live, news) ? 'noop' : 'update' } as const;
+  }),
+  reconcile: Effect.fn(function* ({ news }: { news: FirewallAliasProps }) {
+    const live = yield* readFirewallAlias(news);
+    yield* guardCreate(news, live === undefined);
+    yield* guardUpdate(news);
+    if (live === undefined) {
+      yield* runPve(
+        news.target,
+        'provision',
+        true,
+        cluster.createClusterFirewallAlias(spec.createForm(news)),
+      );
+    } else {
+      const form = formToSend(spec.matches, live, news, spec.updateForm(news));
+      if (form !== undefined)
+        yield* runPve(
+          news.target,
+          'provision',
+          true,
+          cluster.putClusterFirewallAlias({ ...form, name: news.name }),
+        );
+    }
+    const after = yield* readFirewallAlias(news);
+    if (after === undefined)
+      return yield* Effect.fail(
+        new Error(`${spec.path(news)}: write returned success but the resource is still absent`),
+      );
+    return after;
+  }),
+  delete: ({ olds }: { olds: FirewallAliasProps }) => deleteFirewallAlias(olds),
+};

package/src/proxmox/firewall-alias.ts

@@ -93,12 +93,10 @@
  *   confirm the SECOND plan says noop before trusting this file.
  */
 import { Resource } from 'alchemy';
-import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import { body, cidr, comment, fold } from './firewall-alias-form.ts';
-import { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';
-import { int, text } from './values.ts';
+import type { PveRequirements, WithTarget } from './resource-spec.ts';
+import { firewallAliasHandlers } from './firewall-alias-lifecycle.ts';
 
 export interface FirewallAliasProps extends WithTarget {
   /**
@@ -144,70 +142,9 @@ export interface ProxmoxFirewallAlias extends Resource<
 
 export const ProxmoxFirewallAlias = Resource<ProxmoxFirewallAlias>('Proxmox.FirewallAlias');
 
-const handlers = pveHandlers<FirewallAliasProps, FirewallAliasAttributes>({
-  /**
-   * ⚠️ AN ENTRY WITH NO CIDR IS NOT AN ALIAS. `read_alias` raises for a name it does not hold, so
-   *   absence normally arrives as a failed call the factory folds into `undefined`; this guard
-   *   covers the other shape — a 200 carrying something that is not an alias — rather than
-   *   recording state for an object with an empty address. The next reconcile then POSTs and PVE
-   *   answers "alias already exists", which is loud and points at the read.
-   */
-  attributes: (live, props) => {
-    const address = cidr(live['cidr']);
-    return address === ''
-      ? undefined
-      : {
-          cidr: address,
-          comment: comment(live['comment']),
-          ipversion: int(live['ipversion'], 0),
-          /** ⚠️ FROM THE CLUSTER, falling back to props: the stored spelling is the interesting one. */
-          name: text(live['name'], props.name),
-        };
-  },
-  collection: () => 'cluster/firewall/aliases',
-  createForm: (props) => ({ ...body(props), name: props.name }),
-  /**
-   * ⚠️ EXACTLY THE TWO FIELDS A PUT CAN PUT BACK, both sides through the same normalisers. `name`
-   *   is identity and case-only drift (see the header); `ipversion` is derived and unwritable.
-   *   Comparing either would report an update that no update can settle.
-   */
-  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */
-  endpoint: {
-    create: 'pve:POST /cluster/firewall/aliases',
-    update: 'pve:PUT /cluster/firewall/aliases/{name}',
-  },
-  matches: (attributes, props) =>
-    attributes.cidr === cidr(props.cidr) && attributes.comment === comment(props.comment),
-  /**
-   * ⚠️ UNESCAPED ON PURPOSE: `pve-fw-alias` admits only `[A-Za-z][A-Za-z0-9\-\_]+`, so there is no
-   *   character here that a URL would need to encode, and PVE lowercases the segment on arrival.
-   */
-  path: (props) => `cluster/firewall/aliases/${props.name}`,
-  updateForm: body,
-});
-
-/**
- * ⛔ ONE HANDLER IS OVERRIDDEN AND THE REST COME FROM THE FACTORY, for the reason `acl.ts` spells
- *   out at length: the factory answers `replace` only for an object with no update path, and this
- *   one has a PUT. Left to delegate, a changed `name` would read absent at the new path, plan as an
- *   update, and quietly leave the old alias behind. Everything else — the empty `list`, the read,
- *   the read-back-guarded reconcile, the delete — is the factory's, unchanged.
- */
+/** Named distilled operations preserve create-first identity replacement and explicit adoption. */
 export const ProxmoxFirewallAliasProvider = () =>
   Provider.effect(
     ProxmoxFirewallAlias,
-    Effect.succeed(
-      ProxmoxFirewallAlias.Provider.of({
-        ...handlers,
-        diff: Effect.fn(function* ({ news, output }) {
-          // ⚠️ `isResolved` FIRST: at plan time `news.name` can still be an unresolved Output, and
-          //   folding a placeholder would report a replace nobody asked for — the worst possible
-          //   false positive on this family, since a replace here DELETES an alias.
-          if (output !== undefined && isResolved(news) && fold(news.name) !== fold(output.name)) {
-            return { action: 'replace' } as const;
-          }
-          return yield* handlers.diff({ news, output });
-        }),
-      }),
-    ),
+    Effect.succeed(ProxmoxFirewallAlias.Provider.of(firewallAliasHandlers)),
   );

package/src/proxmox/lxc-create.test.ts

@@ -96,7 +96,10 @@ describe('removing a container', () => {
       `POST nodes/${NODE}/lxc`,
       `DELETE nodes/${NODE}/lxc/${String(VMID)}`,
     ]);
-    expect(pve.seen.some((call) => /\/tasks\/UPID:.*vzdestroy/.test(call.path))).toBe(true);
+    // PVE APIServer/AnyEvent.pm uri_unescape runs before routing; the SDK encodes labels.
+    expect(
+      pve.seen.some((call) => /\/tasks\/UPID:.*vzdestroy/.test(decodeURIComponent(call.path))),
+    ).toBe(true);
     // ⛔ No `force` (stops a running guest), `purge` (drops it from HA and backup jobs) or
     //   `destroy-unreferenced-disks` (deletes volumes the config does not even name).
     const del = pve.seen.find((call) => call.method === 'DELETE');