@homeflare/alchemy 0.38.0 → 0.39.0

package/dist/proxmox/qemu-form.d.ts

@@ -1,22 +1,31 @@
-/** QEMU create and update forms. Path identity stays out of the body. */
-import type { VmProps } from './qemu.ts';
-/** Fields both create and update send. `net0` is optional and is not compared. */
-export declare const shape: (props: VmProps) => {
-    cores: string;
-    memory: string;
-    name: string;
-    onboot: string;
-    sockets: string;
-    net0?: string;
-};
-/** ★ Exported so the constraint proof can run the REAL create form, not a retyped copy of it. */
+/**
+ * QEMU create and update forms — declared keys only. Path identity stays out of the body.
+ *
+ * ⛔ NO DEFAULT IS EVER SUBSTITUTED FOR AN UNDECLARED FIELD. See qemu-props.ts's header for the
+ *   "5-default PUT" this replaces: the old `shape()` sent `cores`/`memory`/`name`/`onboot`/
+ *   `sockets` on every write, defaults included for whichever the declaration left out, so
+ *   editing one field on an adopted VM silently reset every other to its factory value.
+ */
+import { type VmProps } from './qemu-props.ts';
+/**
+ * Why a declared key cannot go on the wire, checked before every create and every update.
+ * ★ THE SAME RULE `lxc-create-form.ts` ENFORCES FOR `Proxmox.Lxc`: a key smuggled past the types
+ *   (a cast, a JS caller) is refused here rather than silently dropped or silently sent.
+ */
+export declare const formRefusals: (props: VmProps) => string[];
+/** The declared config, wire-spelled — every key `formRefusals` did not already refuse. */
+export declare const form: (props: VmProps) => Record<string, string>;
+/**
+ * The create body: the declared form plus the vmid a create needs.
+ * ⚠️ NO RETURN-TYPE ANNOTATION, ON PURPOSE. Annotating this `Record<string, string>` erases the
+ *   object literal's own inferred shape, and with it the one thing `nodes.createNodeQemu({
+ *   ...createForm(news), node: news.node })` (qemu-lifecycle.ts) needs: TypeScript only accepts a
+ *   spread as satisfying `CreateNodeQemuRequest`'s required `vmid` when the spread's inferred type
+ *   still carries `vmid` as a literal key, which an index-signature-only type cannot prove.
+ */
 export declare const createForm: (props: VmProps) => {
-    cores: string;
-    memory: string;
-    name: string;
-    onboot: string;
-    sockets: string;
-    net0?: string;
     vmid: string;
 };
+/** The update body — identical construction to `createForm`, minus `vmid`, which PUT never sends. */
+export declare const updateForm: typeof form;
 //# sourceMappingURL=qemu-form.d.ts.map

package/dist/proxmox/qemu-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qemu-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-form.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,kFAAkF;AAClF,eAAO,MAAM,KAAK,UAAW,OAAO;;;;;;;CAOlC,CAAC;AAEH,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAW,OAAO;;;;;;;;CAAoD,CAAC"}
+{"version":3,"file":"qemu-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-form.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,KAAK,OAAO,EAKb,MAAM,iBAAiB,CAAC;AAEzB;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,MAAM,EAG6C,CAAC;AAElG,2FAA2F;AAC3F,eAAO,MAAM,IAAI,UAAW,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAO1D,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,UAAW,OAAO;;CAGvC,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,UAAU,aAAO,CAAC"}

package/dist/proxmox/qemu-judge.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Declared against live: what a `Proxmox.Vm` deploy would write, per key — the QEMU sibling of
+ * lxc-judge.ts, added 2026-09-26 (red-team C1/I1 on PR 297).
+ *
+ * ⛔ REPLACES A WHOLE-STRING, WHOLE-FORM COMPARISON. Before this, `matches` compared each declared
+ *   key to live BYTE FOR BYTE and, on any drift, `formToSend` re-PUT every declared key at once
+ *   (qemu-lifecycle.ts). A `scsi0`/`ide2`/`net0` declared in the "new" or MAC-less spelling then
+ *   NEVER matched its own live volume/NIC (qemu-volume.ts / qemu-net.ts explain why), so every
+ *   deploy re-sent all three -- reallocating the disk, re-importing it, and handing out a fresh MAC
+ *   each time, even when nothing else changed. `judge` below decides per key, on the LIVE volume id
+ *   and LIVE MAC, so an unrelated field's drift no longer drags the disk/NIC keys along with it.
+ */
+import { type VmProps } from './qemu-props.ts';
+export type VmChange = {
+    /** Keys to `PUT …/config`, wire-spelled and built on live ids where one exists. */
+    readonly put: Record<string, string>;
+    /** Why a key cannot be written as an update. Non-empty means nothing is written. */
+    readonly refuse: readonly string[];
+    /** Every declared key that differs from live, refused or not. */
+    readonly drift: readonly string[];
+};
+export declare const judge: (props: VmProps, config: Record<string, string>) => VmChange;
+/**
+ * What makes a `Proxmox.Vm` a DIFFERENT machine: a new vmid (red-team I1). Never planned as a
+ * replace -- see qemu.ts's header on why nothing here replaces a running VM.
+ * ⚠️ `was` PREFERS THE RECORDED ATTRIBUTE, so a `node` change (HA failover, a hand `qm migrate`)
+ *   never reads as a vmid change: only `vmid` is judged here, mirroring lxc-identity.ts.
+ */
+export declare const identityRefusal: (vmid: number, was: number | undefined) => string | undefined;
+//# sourceMappingURL=qemu-judge.d.ts.map

package/dist/proxmox/qemu-judge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-judge.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-judge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,OAAO,EAAsD,MAAM,iBAAiB,CAAC;AAInG,MAAM,MAAM,QAAQ,GAAG;IACrB,mFAAmF;IACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;AAEF,eAAO,MAAM,KAAK,UAAW,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,QA8CtE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,SAAU,MAAM,OAAO,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAI1B,CAAC"}

package/dist/proxmox/qemu-lifecycle.d.ts

@@ -1,23 +1,37 @@
 import type { Input } from 'alchemy/Input';
 import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
-import type { VmAttributes, VmProps } from './qemu.ts';
+import { type VmAttributes, type VmProps } from './qemu-props.ts';
 export declare const readQemu: (props: VmProps) => Effect.Effect<VmAttributes | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /** No purge, no skiplock, no destroy-unreferenced-disks. A missing config is already gone. */
 export declare const deleteQemu: (props: VmProps) => Effect.Effect<void | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
 export declare const qemuHandlers: {
     list: () => Effect.Effect<never[], never, never>;
-    read: ({ olds }: {
+    /**
+     * ⛔ `Unowned` UNLESS STATE ALREADY VOUCHES FOR IT (C2). With no attributes this is Alchemy's
+     *   adoption probe or the recovery read for an interrupted create (ownership/probe.ts); `settled`
+     *   is the same `judge` reconcile uses, so "proven ours" and "reconcile would write nothing" are
+     *   the same question asked once.
+     */
+    read: (args_0: {
+        fqn: string;
+        instanceId: string;
         olds: VmProps;
+        output: VmAttributes | undefined;
     }) => Effect.Effect<VmAttributes | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
     diff: (args_0: {
         news: Input<VmProps>;
+        olds: VmProps;
         output: VmAttributes | undefined;
     }) => Effect.Effect<{
         readonly action: "noop" | "update";
     } | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
     reconcile: (args_0: {
+        fqn: string;
+        instanceId: string;
         news: VmProps;
+        olds: VmProps | undefined;
+        output: VmAttributes | undefined;
     }) => Effect.Effect<VmAttributes, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
     delete: ({ olds }: {
         olds: VmProps;

package/dist/proxmox/qemu-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qemu-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-lifecycle.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAMxC,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkDvD,eAAO,MAAM,QAAQ,UAAW,OAAO,iOAGpC,CAAC;AAEJ,8FAA8F;AAC9F,eAAO,MAAM,UAAU,UAAW,OAAO,+KAMyB,CAAC;AAEnE,eAAO,MAAM,YAAY;IACvB,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE;IAClC,IAAI;cAII,KAAK,CAAC,OAAO,CAAC;gBACZ,YAAY,GAAG,SAAS;;;;IAalC,SAAS;cAAyC,OAAO;;IAgCzD,MAAM,aAAa;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE;CACrC,CAAC"}
+{"version":3,"file":"qemu-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-lifecycle.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAOxC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,OAAO,EAMb,MAAM,iBAAiB,CAAC;AAwCzB,eAAO,MAAM,QAAQ,UAAW,OAAO,iOAapC,CAAC;AAEJ,8FAA8F;AAC9F,eAAO,MAAM,UAAU,UAAW,OAAO,+KAMyB,CAAC;AAmBnE,eAAO,MAAM,YAAY;IACvB,IAAI;IACJ;;;;;OAKG;IACH,IAAI;aAMG,MAAM;oBACC,MAAM;cACZ,OAAO;gBACL,YAAY,GAAG,SAAS;;IAQlC,IAAI;cAKI,KAAK,CAAC,OAAO,CAAC;cACd,OAAO;gBACL,YAAY,GAAG,SAAS;;;;IAwBlC,SAAS;aAOF,MAAM;oBACC,MAAM;cACZ,OAAO;cACP,OAAO,GAAG,SAAS;gBACjB,YAAY,GAAG,SAAS;;IAoDlC,MAAM,aAAa;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE;CACrC,CAAC"}

package/dist/proxmox/qemu-net.d.ts

@@ -0,0 +1,9 @@
+/** The MAC-substituted comparison maps: an undeclared/blank MAC is PVE's, not drift. */
+export declare const netMaps: (declared: string, live: string) => {
+    have: Map<string, string>;
+    want: Map<string, string>;
+};
+export declare const sameNet: (declared: string, live: string) => boolean;
+/** The value to PUT: the declaration, plus the live MAC when it names none. */
+export declare const netWrite: (declared: string, live: string) => string;
+//# sourceMappingURL=qemu-net.d.ts.map

package/dist/proxmox/qemu-net.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-net.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-net.ts"],"names":[],"mappings":"AAkDA,wFAAwF;AACxF,eAAO,MAAM,OAAO,aAAc,MAAM,QAAQ,MAAM;;;CASrD,CAAC;AAEF,eAAO,MAAM,OAAO,aAAc,MAAM,QAAQ,MAAM,KAAG,OAGxD,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,QAAQ,aAAc,MAAM,QAAQ,MAAM,KAAG,MASzD,CAAC"}

package/dist/proxmox/qemu-props.d.ts

@@ -0,0 +1,112 @@
+/**
+ * What a `Proxmox.Vm` declaration says, and what its state keeps.
+ *
+ * ★ THE SAME "DECLARED KEYS" MODEL AS `Proxmox.Lxc` (lxc-props.ts, joined 2026-09-21): an
+ *   undeclared key is UNMANAGED — never sent, never compared, never overwritten. Adopting a live
+ *   VM is then a paste of its config, not a translation of it, and the wire spelling is PVE's own
+ *   (`scsi0`, `net0`, `ipconfig0`, as `pvesh get .../qemu/{vmid}/config` prints them).
+ *
+ * ⛔ THIS REPLACES THE "5-DEFAULT PUT". Before 2026-09-26, `qemu-form.ts`'s `shape()` sent
+ *   `cores`/`memory`/`name`/`onboot`/`sockets` on EVERY write with a hard default substituted for
+ *   whichever of the five was left undeclared, so declaring only `memory: 4096` on an adopted VM
+ *   still PUT `name: 'vm101'` and `sockets: '1'` over whatever the guest actually had. Harmless
+ *   while `ProxmoxVm` stayed Provider-only (nothing declared it), load-bearing the moment Talos
+ *   does. `declaredKeys` below is the fix: a field absent from the declaration is never read,
+ *   never compared and never written — see qemu-form.ts's `form()`.
+ *
+ * ⛔ NO SECRET IS A PROP. `cipassword` (cloud-init's password) is write-only and Alchemy persists
+ *   props in plaintext (this estate's state store is dumped nightly) — typed `never`, exactly
+ *   like lxc-props.ts's `password`. A VM that needs a login uses `sshkeys`-free image defaults or
+ *   an out-of-band secret; this resource never carries one.
+ * ⛔ `machine` IS NEVER A PROP EITHER. It pins the emulated chipset/firmware revision a guest boots
+ *   against; PVE already resolves it from the node's installed QEMU version, and declaring it here
+ *   would fight every future node upgrade instead of tracking it. Typed `never` for the same
+ *   reason `cipassword` is: a cast is the only way in, and this file's helpers below never read
+ *   an unmanaged key onto the wire regardless.
+ */
+import type { WithTarget } from './resource.ts';
+/** A PVE boolean as pvesh prints it (`1`) or as TypeScript writes it (`true`). The same value. */
+export type PveFlag = boolean | 0 | 1;
+export interface VmProps extends WithTarget {
+    /** ⛔ This resource never migrates: qemu-read.ts refuses a VM found on another node. */
+    node: string;
+    /** ⛔ Cluster-wide, and shared with LXC. See qemu.ts's header. */
+    vmid: number;
+    name?: string;
+    /** MiB. */
+    memory?: number;
+    cores?: number;
+    sockets?: number;
+    /** Emulated CPU type, e.g. `host`. */
+    cpu?: string;
+    onboot?: PveFlag;
+    /** The QEMU guest agent. Talos reports its addresses through it once this is enabled. */
+    agent?: PveFlag;
+    /** `order=scsi0;ide2;net0`. */
+    boot?: string;
+    /** e.g. `virtio-scsi-single`. */
+    scsihw?: string;
+    /**
+     * `local-zfs:32` to create a new volume, or the live volume string as adopted —
+     * `cephtb4:vm-101-disk-0,size=32G` (n is 0 to 30, pve-qemu-server's own `$MAX_SCSI_DISKS`).
+     */
+    [scsi: `scsi${number}`]: string | undefined;
+    /**
+     * `virtio=<mac>,bridge=vmbr0,tag=<vlan>` — a VLAN-aware bridge with an 802.1q tag is a bridge
+     * plus this one sub-property; PVE's SDN stays out of it entirely (n is 0 to 31).
+     */
+    [nic: `net${number}`]: string | undefined;
+    /**
+     * The cloud-init drive, e.g. `cephtb4:cloudinit`. PVE's own web UI puts it on `ide2`, but any
+     * free `ide`/`sata`/`scsi` slot works; declaring one is what gives `ipconfig0` below somewhere
+     * to write the generated seed image (n is 0 to 3).
+     */
+    [cloudinit: `ide${number}`]: string | undefined;
+    /** cloud-init network config: `ip=dhcp`, or `ip=<cidr>,gw=<gw>` (n is 0 to 31). */
+    [ipconfig: `ipconfig${number}`]: string | undefined;
+    /** `socket` — a serial console, the way Talos exposes its own (n is 0 to 3). */
+    [serial: `serial${number}`]: string | undefined;
+    /** ⛔ A secret. See the header. */
+    cipassword?: never;
+    /** ⛔ Machine config. See the header. */
+    machine?: never;
+}
+export interface VmAttributes {
+    node: string;
+    vmid: number;
+    /** The live config, MANAGED keys only — see `storedConfig`. An allowlist, not a mirror. */
+    config: Record<string, string>;
+}
+/** The indexed families this resource manages, with pve-qemu-server's own published range. */
+export declare const INDEXED: {
+    readonly ide: 4;
+    readonly ipconfig: 32;
+    readonly net: 32;
+    readonly scsi: 31;
+    readonly serial: 4;
+};
+export type IndexedFamily = keyof typeof INDEXED;
+/** `scsi3` → `['scsi', 3]`; anything else, including an out-of-range index, → undefined. */
+export declare const indexedKey: (key: string) => readonly [IndexedFamily, number] | undefined;
+/**
+ * A key this resource compares and may write. ⛔ EVERYTHING ELSE IS REFUSED, NEVER SILENTLY
+ *   DROPPED OR SILENTLY SENT — `qemu-form.ts`'s `formRefusals` is what a declared key smuggled
+ *   past the types (a cast, a JS caller: `cipassword`, `machine`, `hookscript`) meets before any
+ *   write, the same rule `lxc-create-form.ts` enforces for `Proxmox.Lxc`.
+ */
+export declare const isManagedKey: (key: string) => boolean;
+/** A declaration read by key. ⚠️ The cast is the one place a template-literal index meets a plain string. */
+export declare const declaredValue: (props: VmProps, key: string) => unknown;
+/** The declared keys with a value, in a stable order — never `node`/`target`/`vmid`. */
+export declare const declaredKeys: (props: VmProps) => string[];
+/** One declared value as PVE's wire string. Booleans go as `1`/`0`, numbers as their decimal. */
+export declare const wireValue: (value: unknown) => string;
+/**
+ * The live config as strings: managed keys only.
+ * ⛔ AN ALLOWLIST, NOT "EVERYTHING BUT A DENYLIST" — same reasoning as `lxc-props.ts`'s
+ *   `storedConfig`. `digest` covers the whole file, `lock`/`pending` are transient, and a future
+ *   PVE release's new key does not land in this estate's unencrypted state store until this
+ *   resource is taught to manage it.
+ */
+export declare const storedConfig: (live: Record<string, unknown>) => Record<string, string>;
+//# sourceMappingURL=qemu-props.d.ts.map

package/dist/proxmox/qemu-props.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-props.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-props.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,kGAAkG;AAClG,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;AAEtC,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yFAAyF;IACzF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,CAAC,IAAI,EAAE,OAAO,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAC5C;;;OAGG;IACH,CAAC,GAAG,EAAE,MAAM,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,CAAC,SAAS,EAAE,MAAM,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAChD,mFAAmF;IACnF,CAAC,QAAQ,EAAE,WAAW,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACpD,gFAAgF;IAChF,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAChD,kCAAkC;IAClC,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,wCAAwC;IACxC,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAKD,8FAA8F;AAC9F,eAAO,MAAM,OAAO;aAClB,GAAG,EAAE,CAAC;aACN,QAAQ,EAAE,EAAE;aACZ,GAAG,EAAE,EAAE;aACP,IAAI,EAAE,EAAE;aACR,MAAM,EAAE,CAAC;CACD,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,OAAO,CAAC;AAEjD,4FAA4F;AAC5F,eAAO,MAAM,UAAU,QAAS,MAAM,KAAG,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,SAM3E,CAAC;AAeF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,QAAS,MAAM,KAAG,OACY,CAAC;AAExD,6GAA6G;AAC7G,eAAO,MAAM,aAAa,UAAW,OAAO,OAAO,MAAM,KAAG,OACR,CAAC;AAErD,wFAAwF;AACxF,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,MAAM,EAGzC,CAAC;AAEZ,iGAAiG;AACjG,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,MACmB,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAQjF,CAAC"}

package/dist/proxmox/qemu-volume.d.ts

@@ -0,0 +1,17 @@
+export type Disk = {
+    /** `fresh`: either new-disk spelling above. `volume`: an existing volume, `storage:volname,...`. */
+    readonly kind: 'fresh' | 'volume';
+    readonly source: string;
+    readonly volname: string;
+    readonly size: string | undefined;
+    readonly options: Map<string, string>;
+};
+/** `storage:volname,k=v,...` (or one of the two "fresh" spellings) into its comparable parts. */
+export declare const parseDisk: (text: string) => Disk;
+export type DiskVerdict = {
+    readonly refuse?: string;
+    /** The value to PUT, built on the LIVE volume id and LIVE size — never the declared spelling. */
+    readonly put?: string;
+};
+export declare const judgeDisk: (key: string, declared: string, live: string) => DiskVerdict;
+//# sourceMappingURL=qemu-volume.d.ts.map

package/dist/proxmox/qemu-volume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-volume.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-volume.ts"],"names":[],"mappings":"AA8BA,MAAM,MAAM,IAAI,GAAG;IACjB,oGAAoG;IACpG,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,IAwBxC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iGAAiG;IACjG,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAmBF,eAAO,MAAM,SAAS,QAAS,MAAM,YAAY,MAAM,QAAQ,MAAM,KAAG,WA+BvE,CAAC"}

package/dist/proxmox/qemu.d.ts

@@ -1,5 +1,7 @@
 /**
- * `Proxmox.Vm` — a QEMU virtual machine, declared.
+ * `Proxmox.Vm` — a QEMU virtual machine, declared. Exported (not just Provider-only) since
+ * 2026-09-26 for Talos: see qemu-props.ts for what a declaration may say and why `cipassword`
+ * and `machine` may never be one of them.
  *
  * ⚠️ CREATE is `POST /nodes/{node}/qemu`. GET and PUT stay on `.../qemu/{vmid}/config`.
  *   ⛔ DELETE is `DELETE /nodes/{node}/qemu/{vmid}` (`destroy_vm` in qemu-server Qemu.pm). The
@@ -10,37 +12,22 @@
  *   collision Alchemy can see -- they are different resource types -- and PVE refuses the second
  *   with "already exists". Pick ids per cluster, not per kind.
  *
- * ⚠️ POWER STATE IS REPORTED, NEVER DECLARED. `status` is an attribute so a plan can show it; there
- *   is no `running` prop. Starting and stopping a VM from a plan would make a deploy a maintenance
- *   window, and the estate has one of those already.
+ * ⛔ THIS RESOURCE NEVER MIGRATES. `qemu-read.ts` refuses the plan outright when the declared vmid
+ *   is found running on a DIFFERENT node than the one declared ("A migration is not an update") --
+ *   unchanged by the 2026-09-26 export, and exactly what keeps a node-pinned Talos VM pinned.
+ *
+ * ⚠️ POWER STATE IS NEITHER DECLARED NOR REPORTED. There is no `running` prop and `VmAttributes`
+ *   carries no `status` field (qemu-props.ts) — starting and stopping a VM from a plan would make a
+ *   deploy a maintenance window, and the estate has one of those already.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import type { PveRequirements, WithTarget } from './resource.ts';
-export interface VmProps extends WithTarget {
-    node: string;
-    /** ⛔ Cluster-wide, and shared with LXC. See the ⛔ above. */
-    vmid: number;
-    name?: string;
-    /** MiB. */
-    memory?: number;
-    cores?: number;
-    sockets?: number;
-    /** e.g. `virtio=<mac>,bridge=vmbr0`. */
-    net0?: string;
-    onboot?: boolean;
-}
-export interface VmAttributes {
-    vmid: number;
-    node: string;
-    name: string;
-    memory: number;
-    cores: number;
-    sockets: number;
-    onboot: boolean;
-}
+import type { PveRequirements } from './resource.ts';
+import type { VmAttributes, VmProps } from './qemu-props.ts';
+export type { VmAttributes, VmProps } from './qemu-props.ts';
 export interface ProxmoxVm extends Resource<'Proxmox.Vm', VmProps, VmAttributes, never, PveRequirements> {
 }
+/** ★ `retain` by default — a VM's disks cannot be rebuilt from a line. See resource.ts / lxc.ts. */
 export declare const ProxmoxVm: import("alchemy").ResourceClass<ProxmoxVm>;
 export { createForm } from './qemu-form.ts';
 /**

package/dist/proxmox/qemu.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qemu.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEjE,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,OAAO,EACP,YAAY,EACZ,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,SAAS,4CAAoC,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,iBAAiB,+HACmD,CAAC"}
+{"version":3,"file":"qemu.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE7D,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE7D,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,YAAY,EACZ,OAAO,EACP,YAAY,EACZ,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,oGAAoG;AACpG,eAAO,MAAM,SAAS,4CAAwE,CAAC;AAE/F,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,iBAAiB,+HACmD,CAAC"}

package/dist/proxmox/storage-download-errors.d.ts

@@ -0,0 +1,5 @@
+/** A `Proxmox.StorageDownload` write or observation this provider will not turn into a claim of success. */
+export declare class StorageDownloadRefusedError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=storage-download-errors.d.ts.map

package/dist/proxmox/storage-download-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-download-errors.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-download-errors.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/proxmox/storage-download-identity.d.ts

@@ -0,0 +1,27 @@
+/**
+ * What makes a `Proxmox.StorageDownload` a DIFFERENT file, and what a changed pin on the SAME
+ * file means. (2026-09-26, red-team I1/I2 on PR 297.)
+ *
+ * ★ `filename` (WITH `storage`) IS THE IDENTITY. PVE does not record what a volume was downloaded
+ *   from — `GET .../content` reports only `format`/`size`/`volid` (storage-download-props.ts) — so
+ *   once the file exists there is nothing left to compare a new `url`/`checksum` against except the
+ *   PREVIOUS DECLARATION. `storage-download-lifecycle.ts`'s `diff` asks `judgeIdentity` before
+ *   touching the file; a genuine identity change plans `replace` (delete the old file, download the
+ *   new one under its own name) rather than the silent `update` that used to orphan the old file
+ *   forever, and a changed pin on the SAME filename refuses rather than silently planning `noop`.
+ */
+import type { StorageDownloadProps } from './storage-download-props.ts';
+export type IdentityVerdict = {
+    readonly kind: 'same';
+} | {
+    readonly kind: 'replace';
+} | {
+    readonly kind: 'pin-changed';
+    readonly refuse: string;
+};
+/**
+ * `olds` is undefined for a resource with no prior declaration (a fresh create, or the recovery
+ * read for an interrupted one) — neither case has a pin to compare, so both are `same`.
+ */
+export declare const judgeIdentity: (news: StorageDownloadProps, olds: StorageDownloadProps | undefined) => IdentityVerdict;
+//# sourceMappingURL=storage-download-identity.d.ts.map

package/dist/proxmox/storage-download-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-download-identity.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-download-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAWxE,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,aAAa,SAClB,oBAAoB,QACpB,oBAAoB,GAAG,SAAS,KACrC,eAcF,CAAC"}

package/dist/proxmox/storage-download-lifecycle.d.ts

@@ -0,0 +1,97 @@
+import type { Input } from 'alchemy/Input';
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import * as Effect from 'effect/Effect';
+import type { StorageDownloadAttributes, StorageDownloadProps } from './storage-download-props.ts';
+/**
+ * The wire form, PVE-spelled (`checksum-algorithm`, `verify-certificates`) — what the generated
+ * vendor table keys by, and what `formViolations` checks. ⚠️ NOT re-spelled for the SDK call:
+ * `nodes.downloadNodesStorageUrl` never declares these two hyphenated names as typed properties
+ * either (its schema names them `checksum_algorithm`/`verify_certificates`), so passing this
+ * object straight through relies on protocol-http.ts's own documented "unknown keys pass through
+ * as body fields" rule — the same spec-drift path qemu-props.ts leans on for `scsi0`/`net0`, and
+ * unlike storage-wire.ts's `underscored()` this family has no reason to translate: the schema's
+ * OWN property names would just be a second spelling of the same two fields.
+ */
+export declare const downloadForm: (props: StorageDownloadProps) => {
+    checksum: string;
+    'checksum-algorithm': import("./storage-download-props.ts").ChecksumAlgorithm;
+    compression?: string;
+    content: string;
+    filename: string;
+    node: string;
+    storage: string;
+    url: string;
+    'verify-certificates'?: string;
+};
+/**
+ * Why this declaration cannot be sent, checked before every diff and every reconcile.
+ * ⛔ `checksum` REQUIRED, EVEN THOUGH THE TYPE ALREADY SAYS SO — a JS caller or a cast can still
+ *   leave it `''`; this is the runtime backstop storage-download.ts's header promises.
+ */
+export declare const createRefusals: (props: StorageDownloadProps) => string[];
+/**
+ * `GET .../content?content=import`, matched by filename suffix — see storage-download-props.ts's
+ * `volid` doc for why a suffix match, not an assumed prefix. `content` is already server-filtered.
+ * ⛔ I3: THE `read` ROLE, NOT `provision` — this is a plain GET, and every caller (read/diff AND
+ *   reconcile/delete, which mint their own `provision` credential for the actual write) may use the
+ *   cheaper, longer-lived one, exactly as `qemu-read.ts`'s `readVm` already does for its own GET.
+ */
+export declare const readDownload: (props: StorageDownloadProps) => Effect.Effect<{
+    filename: string;
+    format: string;
+    node: string;
+    size: number;
+    storage: string;
+    volid: string;
+} | undefined, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ⛔ IDEMPOTENT DELETE (distilled doctrine): a volume already gone is success, never a refusal. */
+export declare const destroyDownload: (props: StorageDownloadProps) => Effect.Effect<void, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const storageDownloadHandlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    /**
+     * ⛔ C2: `Unowned` unless state already vouches for it. With no attributes this is the adoption
+     *   probe or the recovery read for an interrupted download; `filename` (with `storage`) is the
+     *   whole identity this family has (storage-download-identity.ts), so once the row's own instance
+     *   is proven to hold the WHOLE declaration (`ownership/rows.ts`, inside `ownedRead`), a matching
+     *   file is ours -- there is no further per-key drift to prove, unlike a config-bearing resource.
+     */
+    read: (args_0: {
+        fqn: string;
+        instanceId: string;
+        olds: StorageDownloadProps;
+        output: StorageDownloadAttributes | undefined;
+    }) => Effect.Effect<{
+        filename: string;
+        format: string;
+        node: string;
+        size: number;
+        storage: string;
+        volid: string;
+    } | undefined, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args_0: {
+        news: Input<StorageDownloadProps>;
+        olds: StorageDownloadProps;
+        output: StorageDownloadAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'replace';
+    } | {
+        readonly action: "noop" | "update";
+    } | undefined, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args_0: {
+        fqn: string;
+        instanceId: string;
+        news: StorageDownloadProps;
+        output: StorageDownloadAttributes | undefined;
+    }) => Effect.Effect<{
+        filename: string;
+        format: string;
+        node: string;
+        size: number;
+        storage: string;
+        volid: string;
+    }, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds }: {
+        olds: StorageDownloadProps;
+    }) => Effect.Effect<void, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+//# sourceMappingURL=storage-download-lifecycle.d.ts.map

package/dist/proxmox/storage-download-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-download-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-download-lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAOxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAUnG;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,UAAW,oBAAoB;;;;;;;;;;CAYtD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,UAAW,oBAAoB,KAAG,MAAM,EAYlE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,UAAW,oBAAoB;;;;;;;kPA6BpD,CAAC;AAEL,mGAAmG;AACnG,eAAO,MAAM,eAAe,UAAW,oBAAoB,4PAcvD,CAAC;AAEL,eAAO,MAAM,uBAAuB;IAClC,IAAI;IACJ;;;;;;OAMG;IACH,IAAI;aAMG,MAAM;oBACC,MAAM;cACZ,oBAAoB;gBAClB,yBAAyB,GAAG,SAAS;;;;;;;;;IAK/C,IAAI;cAKI,KAAK,CAAC,oBAAoB,CAAC;cAC3B,oBAAoB;gBAClB,yBAAyB,GAAG,SAAS;;yBAYK,SAAS;;;;IAW7D,SAAS;aAMF,MAAM;oBACC,MAAM;cACZ,oBAAoB;gBAClB,yBAAyB,GAAG,SAAS;;;;;;;;;IAkC/C,MAAM,aAAa;QAAE,IAAI,EAAE,oBAAoB,CAAA;KAAE;CAClD,CAAC"}

package/dist/proxmox/storage-download-props.d.ts

@@ -0,0 +1,36 @@
+/** What a `Proxmox.StorageDownload` declaration says, and what its state keeps. See storage-download.ts's header. */
+import type { WithTarget } from './resource.ts';
+export type ChecksumAlgorithm = 'md5' | 'sha1' | 'sha224' | 'sha256' | 'sha384' | 'sha512';
+export interface StorageDownloadProps extends WithTarget {
+    /** The node this download runs on. Content lands on `storage`, shared or not — see the header. */
+    node: string;
+    storage: string;
+    /** The name PVE gives the file under `storage`'s `import` content. Normalized by PVE on write. */
+    filename: string;
+    /** Where to fetch the image from. ⚠️ Not re-verified after create — PVE does not store it. */
+    url: string;
+    /** ⛔ Required. See storage-download.ts's header on why this resource narrows the vendor's own optional field. */
+    checksum: string;
+    checksumAlgorithm: ChecksumAlgorithm;
+    /** Decompress the downloaded file with this algorithm before it lands on `storage`. */
+    compression?: string;
+    /** Verify the source's TLS certificate. PVE defaults this on; declare `false` for a self-signed mirror. */
+    verifyCertificates?: boolean;
+}
+export interface StorageDownloadAttributes {
+    node: string;
+    storage: string;
+    filename: string;
+    /**
+     * ⚠️ REASONED, NOT MEASURED LIVE. PVE's file-based content types spell a volid
+     *   `<storage>:<segment>/<filename>` — this codebase already relies on that shape for `iso` and
+     *   `vztmpl` (lxc-create-form.ts's `existingVolume`, lxc-create.test.ts's own fixture) — but the
+     *   exact `<segment>` spelling for `import` content is not independently confirmed against a
+     *   live cluster. `storage-download-lifecycle.ts`'s `readDownload` does not depend on knowing
+     *   it: it matches by filename SUFFIX within a list already server-filtered to `content=import`.
+     */
+    volid: string;
+    size: number;
+    format: string;
+}
+//# sourceMappingURL=storage-download-props.d.ts.map

package/dist/proxmox/storage-download-props.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-download-props.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-download-props.ts"],"names":[],"mappings":"AAAA,qHAAqH;AACrH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3F,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,kGAAkG;IAClG,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ,iHAAiH;IACjH,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2GAA2G;IAC3G,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/dist/proxmox/storage-download-task.d.ts

@@ -0,0 +1,17 @@
+import type { ProxmoxOpContext } from '@distilled.cloud/proxmox/Protocol';
+import * as Effect from 'effect/Effect';
+import type { PveTarget } from './credentials.ts';
+export interface StorageDownloadWhere {
+    readonly node: string;
+    readonly target: PveTarget;
+}
+/**
+ * ⛔ A CHECKSUM MISMATCH SURFACES HERE, NOT AS A DISTINCT TYPED ERROR. `download-url`'s POST
+ *   answers 200 with a UPID regardless of whether the checksum will match — PVE validates the
+ *   download itself, INSIDE the task, and reports the mismatch as that task's `exitstatus`. So
+ *   the refusal below (`exit !== 'OK'`) IS the checksum-mismatch refusal: this poller fails the
+ *   plan whenever the task did not report exactly `"OK"`, whatever the reason, without needing a
+ *   new SDK tag to name it.
+ */
+export declare const storageDownloadTask: <E>(where: StorageDownloadWhere, operation: Effect.Effect<string, E, ProxmoxOpContext>, what: string, polls: number) => Effect.Effect<undefined, E | Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=storage-download-task.d.ts.map

package/dist/proxmox/storage-download-task.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-download-task.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-download-task.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,SAC5B,oBAAoB,aAChB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,gBAAgB,CAAC,QAC/C,MAAM,SACL,MAAM,qJAsCX,CAAC"}

package/dist/proxmox/storage-download.d.ts

@@ -0,0 +1,44 @@
+/**
+ * `Proxmox.StorageDownload` — one `download-url` fetch of an image onto a named storage's
+ * `import` content, declared. Joined 2026-09-26 for Talos: a node needs a boot image on shared
+ * storage (`cephtb4`/`cephfs-tb4`) before `Proxmox.Vm` can reference it as a disk source.
+ *
+ * ★ A CREATE-ORIENTED FAMILY, NOT A GENERAL DOWNLOADER. `content` is fixed to `import` — never a
+ *   prop — because that is the one content type a VM disk import consumes; an ISO or a container
+ *   template already has its own path (`upload`, or an out-of-band copy) and does not belong here.
+ *
+ * ⛔ `checksum` AND `checksumAlgorithm` ARE REQUIRED, NOT OPTIONAL, EVEN THOUGH PVE'S OWN SCHEMA
+ *   MARKS BOTH OPTIONAL (`generated/pve/nodes-node-storage-storage.ts`). An unpinned download is
+ *   not a declaration — it is a promise that whatever the URL answers today is what a Talos node
+ *   boots from, silently, on every future adopt. This resource narrows the vendor's own contract
+ *   on purpose; `storage-download-lifecycle.ts`'s `createRefusals` is the runtime backstop for a
+ *   caller that casts around the type.
+ *
+ * ⛔ THERE IS NO UPDATE PATH. PVE does not remember the `url` or `checksum` a volume was created
+ *   from — `GET .../content` reports only `format`/`size`/`volid` — so once the file exists on
+ *   `storage`, this resource has nothing left to compare a new declaration against except the
+ *   PREVIOUS one (storage-download-identity.ts). A DIFFERENT `checksum`/`url` on the SAME `filename`
+ *   is REFUSED, never silently written or silently `noop` (2026-09-26, red-team I2 on PR 297):
+ *   change `filename` to force a new download, which plans a `replace` — the old file is deleted and
+ *   the new one downloaded under its own name — exactly as an immutable artifact should be.
+ *
+ * ⛔ NO SECRET IS A PROP. Every field here — `node`, `storage`, `filename`, `url`, the checksum
+ *   pair, `compression`, `verifyCertificates` — is either an identity or a public download
+ *   parameter; none is a credential, matching the "no secret prop" rule every PVE family here
+ *   carries (see qemu-props.ts's `cipassword`/`machine` for the family that has one to guard).
+ *
+ * ★ NOT `retain` BY DEFAULT, UNLIKE `Proxmox.Vm`/`Proxmox.Lxc`. A downloaded image is reproducible
+ *   from its own declaration (the same `url` and `checksum` rebuild it byte-for-byte); a VM's
+ *   disk state or a container's data is not. Dropping this declaration deletes the file — an
+ *   operator who wants to keep an unreferenced image around pins its own `RemovalPolicy.retain()`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type { PveRequirements } from './resource.ts';
+import type { StorageDownloadAttributes, StorageDownloadProps } from './storage-download-props.ts';
+export type { StorageDownloadAttributes, StorageDownloadProps } from './storage-download-props.ts';
+export interface ProxmoxStorageDownload extends Resource<'Proxmox.StorageDownload', StorageDownloadProps, StorageDownloadAttributes, never, PveRequirements> {
+}
+export declare const ProxmoxStorageDownload: import("alchemy").ResourceClass<ProxmoxStorageDownload>;
+export declare const ProxmoxStorageDownloadProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxStorageDownload>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=storage-download.d.ts.map