@homeflare/alchemy 0.4.0 → 0.5.0

package/src/openbao/plugin-wire.ts

@@ -0,0 +1,65 @@
+/**
+ * The OpenBao calls Bao.Plugin makes — read one catalog entry, register, deregister. Split from
+ * plugin.ts so the calls can be pinned against a fake server, the way mount-wire.ts is.
+ *
+ * ★ ENDPOINTS, READ FROM openbao v2.6.2 api/sys_plugins.go (the client `bao plugin` uses) and the
+ *   handlers in vault/logical_system.go:
+ *     read        GET    sys/plugins/catalog/<type>/<name>[?version=]  (GetPlugin, :159-183)
+ *     register    PUT    sys/plugins/catalog/<type>/<name>             (RegisterPlugin, :212-228)
+ *     deregister  DELETE sys/plugins/catalog/<type>/<name>[?version=]  (DeregisterPlugin, :249-261)
+ *   (api/sys_plugins.go diffed identical between v2.6.0 and v2.6.2.)
+ * ⚠️ ALL THREE NEED `sudo` ON THE PATH, not just the verb (docs/api/system/plugins-catalog.mdx). A
+ *   token without it reads as 403, which is an error here, never "absent".
+ */
+import type * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
+import type { BaoError } from './bao-status.ts';
+import {
+  type BaoPluginForm,
+  type BaoPluginType,
+  catalogPath,
+  registerBody,
+  versionedPath,
+} from './plugin-form.ts';
+
+/**
+ * One catalog entry, or undefined when the catalog has none at that name, type and version.
+ *
+ * ★ UNLIKE A MOUNT, A MISSING PLUGIN REALLY IS A 404. handlePluginCatalogRead returns `nil, nil` when
+ *   the catalog lookup finds nothing (vault/logical_system.go:545-547), and RespondErrorCommon turns
+ *   a nil READ response into 404 (sdk v2.6.2 logical/response_util.go:23-26). No second question is
+ *   needed, unlike the mount-table check in mount-wire.ts.
+ * ⚠️ A BUILTIN ANSWERS TOO. With no external registration at an unversioned name, the catalog falls
+ *   through to OpenBao's own builtin of that name and type (plugin_catalog.go get, :1016-1036), which
+ *   reads back with `builtin: true` — present, but not a registration. plugin.ts decides what that
+ *   means.
+ */
+export const readPluginData = (
+  form: BaoPluginForm,
+): Effect.Effect<Record<string, unknown> | undefined, BaoError, HttpClient.HttpClient> =>
+  baoRead(versionedPath(form.type, form.name, form.version));
+
+export const registerPlugin = (
+  form: BaoPluginForm,
+): Effect.Effect<void, BaoError, HttpClient.HttpClient> =>
+  baoWrite('PUT', catalogPath(form.type, form.name), registerBody(form));
+
+/**
+ * ★ IDEMPOTENT ON THE SERVER. deleteInternal deletes the storage key whether or not it exists
+ *   (plugin_catalog.go:1272-1284) and the handler answers with no body, so a retried delete succeeds.
+ *   ⚠️ BUT A MISSING TYPED KEY FALLS BACK TO THE BARE NAME. When `<type>/<name>[/<version>]` is not
+ *     in storage, the same function deletes the key `<name>` instead — where registrations made
+ *     before plugin types existed live, whatever their type. A fresh 2.x vault has none; one
+ *     migrated from an old Vault may. REASONED FROM SOURCE, not run.
+ * ⛔ AND THAT IS THE DANGER: NOTHING CHECKS WHETHER A MOUNT STILL USES THE PLUGIN. The same function
+ *   has no mount lookup at all, so deregistering the plugin a live mount runs succeeds. The running
+ *   process is not killed by it; the mount breaks the next time OpenBao has to START the plugin — a
+ *   reload, a restart, an unseal — long after the plan that did it. REASONED FROM SOURCE, not run.
+ */
+export const deregisterPlugin = (
+  type: BaoPluginType,
+  name: string,
+  version: string,
+): Effect.Effect<void, BaoError, HttpClient.HttpClient> =>
+  baoDelete(versionedPath(type, name, version));

package/src/openbao/plugin.ts

@@ -0,0 +1,100 @@
+/**
+ * An OpenBao plugin catalog entry — `sys/plugins/catalog/<type>/<name>`: which binary in
+ * plugin_directory, at which SHA-256, may run as a plugin of that name. METADATA ONLY.
+ *
+ * ⛔ IT REGISTERS; IT DOES NOT DELIVER. The binary must already sit in plugin_directory. Copying it
+ *   there is a host step.
+ *   ⚠️ A MISSING FILE FAILS THE WRITE; A WRONG SHA-256 DOES NOT. setInternal (plugin_catalog.go
+ *     :1150-1230) resolves the path first, which fails loudly, but the run that would notice a
+ *     checksum mismatch is only the version probe, and that is best-effort: it logs a warning and
+ *     stores the entry anyway. The mismatch then surfaces when a mount first starts the plugin.
+ * ⛔ NO `env` PROP, AND THERE MUST NEVER BE ONE — see registerBody in plugin-form.ts. Alchemy keeps
+ *   props and attributes UNENCRYPTED in its state store (policy.ts has the reasoning).
+ * ⚠️ A NEW SHA-256 DOES NOT RESTART A RUNNING PLUGIN. setInternal writes the catalog entry and
+ *   reloads nothing, so mounts keep the old process until `sys/plugins/reload/backend` or a
+ *   restart. Reloading is an operator step, not this resource.
+ *
+ * ★ `defaultRemovalPolicy: 'retain'`. Deregistering does not check whether a mount still runs the
+ *   plugin (the ⛔ on deregisterPlugin in plugin-wire.ts), so a destroy would break that mount at its
+ *   next start. Retain also means a version bump — a REPLACE, below — leaves the old version
+ *   registered for mounts pinned to it; prune it by hand once nothing uses it.
+ */
+import { Resource } from 'alchemy';
+import { isResolved } from 'alchemy/Diff';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoPluginAttributes, type BaoPluginProps, matches, resolve } from './plugin-form.ts';
+import { readEntry, reconcilePlugin } from './plugin-reconcile.ts';
+import { deregisterPlugin } from './plugin-wire.ts';
+
+export type { BaoPluginAttributes, BaoPluginProps, BaoPluginType } from './plugin-form.ts';
+
+export interface BaoPlugin extends Resource<
+  'Bao.Plugin',
+  BaoPluginProps,
+  BaoPluginAttributes,
+  never,
+  HttpClient.HttpClient
+> {}
+
+export const BaoPlugin = Resource<BaoPlugin>('Bao.Plugin', {
+  defaultRemovalPolicy: 'retain',
+});
+
+export const BaoPluginProvider = () =>
+  Provider.effect(
+    BaoPlugin,
+    Effect.succeed(
+      BaoPlugin.Provider.of({
+        /**
+         * ⛔ THE CATALOG IS NOT A LIST OF THINGS THIS OWNS. It answers every builtin plugin and
+         *   every hand registration. Returning them would invite Alchemy to adopt — and then
+         *   deregister — plugins it never registered.
+         */
+        list: () => Effect.succeed([]),
+
+        read: Effect.fn(function* ({ olds }) {
+          const found = yield* readEntry(resolve(olds));
+          return found?.attributes;
+        }),
+
+        /** ⛔ IT COMPARES THE LIVE ENTRY, NOT THE STORED DIGEST — a hand re-register is drift. */
+        diff: Effect.fn(function* ({ news, output }) {
+          if (output === undefined || !isResolved(news)) return undefined;
+          const form = resolve(news);
+          /**
+           * ⛔ NAME, TYPE AND VERSION ARE THE CATALOG KEY, so changing one is a different entry,
+           *   not an edit. Writing the new key would leave the old registration in place under a
+           *   state record that no longer names it.
+           */
+          if (
+            output.name !== form.name ||
+            output.type !== form.type ||
+            output.version !== form.version
+          ) {
+            return { action: 'replace' } as const;
+          }
+          const found = yield* readEntry(form);
+          if (found === undefined) return { action: 'update' } as const;
+          return matches(found.attributes, form)
+            ? ({ action: 'noop' } as const)
+            : ({ action: 'update' } as const);
+        }),
+
+        /** The refusals — declarative, builtin, self-reported version — live in plugin-reconcile.ts. */
+        reconcile: Effect.fn(function* ({ news }) {
+          return yield* reconcilePlugin(news);
+        }),
+
+        /**
+         * ⛔ READ THE ⛔ ON deregisterPlugin FIRST: nothing checks that a mount still runs this.
+         *   Idempotent as Alchemy requires — already gone is success on the server.
+         */
+        delete: Effect.fn(function* ({ output }) {
+          yield* deregisterPlugin(output.type, output.name, output.version);
+          return undefined;
+        }),
+      }),
+    ),
+  );

package/src/openbao/ssh-role-form.test.ts

@@ -0,0 +1,105 @@
+/**
+ * Bao.SshRole's two shapes — a user-cert role and a host-cert role — through writeBody and back
+ * through attributesOf, the round trip every plan rests on.
+ *
+ * ★ `cert_type` IS NOT A ROLE FIELD. It is a SIGN parameter, default `user` (openbao v2.6.2
+ *   builtin/logical/ssh/path_sign.go:50-54); a host-cert role is `allow_host_certificates` plus the
+ *   domain fields, and the host asks for `cert_type=host` when it signs. path_roles.go has no such
+ *   field, so nothing here sends one.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  type BaoSshRoleProps,
+  attributesOf,
+  matches,
+  resolve,
+  writeBody,
+} from './ssh-role-form.ts';
+
+const USER: BaoSshRoleProps = {
+  allowUserCertificates: true,
+  allowedUsers: ['ops', 'deploy'],
+  defaultExtensions: { 'permit-pty': '', 'permit-agent-forwarding': '' },
+  maxTtl: '16h',
+  name: 'operator',
+  ttl: '16h',
+};
+
+const HOST: BaoSshRoleProps = {
+  allowHostCertificates: true,
+  allowSubdomains: true,
+  allowedDomains: ['example.test', 'lab.example.test'],
+  allowedUsers: [],
+  maxTtl: '8760h',
+  mount: 'ssh-host/',
+  name: 'host',
+  ttl: '8760h',
+};
+
+describe('ssh role writeBody', () => {
+  it('sends the maps as JSON objects, never as JSON strings (sdk TypeMap refuses a string)', () => {
+    const body = writeBody(resolve(USER));
+    assert.deepEqual(body['default_extensions'], {
+      'permit-agent-forwarding': '',
+      'permit-pty': '',
+    });
+    assert.deepEqual(body['default_critical_options'], {});
+    assert.equal(typeof body['default_extensions'], 'object');
+  });
+
+  it('writes a user-cert role with key_type ca, sorted principals and a stated TTL', () => {
+    const body = writeBody(resolve(USER));
+    assert.equal(body['key_type'], 'ca');
+    assert.equal(body['allowed_users'], 'deploy,ops');
+    assert.equal(body['allow_user_certificates'], 'true');
+    assert.equal(body['allow_host_certificates'], 'false');
+    assert.equal(body['ttl'], '16h');
+    assert.equal('cert_type' in body, false);
+  });
+
+  it('writes a host-cert role with domains and subdomains on its own mount', () => {
+    const form = resolve(HOST);
+    const body = writeBody(form);
+    assert.equal(form.mount, 'ssh-host');
+    assert.equal(body['allow_host_certificates'], 'true');
+    assert.equal(body['allow_user_certificates'], 'false');
+    assert.equal(body['allowed_domains'], 'example.test,lab.example.test');
+    assert.equal(body['allow_subdomains'], 'true');
+    assert.equal(body['allowed_users'], '');
+  });
+});
+
+describe('ssh role round trip', () => {
+  it('matches the role OpenBao reads back — seconds, objects, comma strings', () => {
+    const live = {
+      allow_host_certificates: false,
+      allow_user_certificates: true,
+      allowed_users: 'ops,deploy',
+      default_critical_options: {},
+      default_extensions: { 'permit-agent-forwarding': '', 'permit-pty': '' },
+      key_type: 'ca',
+      max_ttl: 57600,
+      ttl: 57600,
+    };
+    const form = resolve(USER);
+    assert.equal(matches(attributesOf(form, live), form), true);
+    assert.equal(matches(attributesOf(form, { ...live, ttl: 14400 }), form), false);
+  });
+
+  it('matches a host role read back', () => {
+    const live = {
+      allow_host_certificates: true,
+      allow_subdomains: true,
+      allowed_domains: 'lab.example.test,example.test',
+      allowed_users: '',
+      default_critical_options: {},
+      default_extensions: {},
+      key_type: 'ca',
+      max_ttl: 31536000,
+      ttl: 31536000,
+    };
+    const form = resolve(HOST);
+    assert.equal(matches(attributesOf(form, live), form), true);
+  });
+});

package/src/openbao/ssh-role-form.ts

@@ -13,6 +13,7 @@
  */
 import { sha256 } from './digest.ts';
 import { parseDuration, ttlSeconds } from './mount-form.ts';
+import { sshMountOf as mountOf } from './mount-path.ts';
 
 export interface BaoSshRoleProps {
   /** Role name, as `<mount>/roles/{name}` takes it. */
@@ -76,8 +77,7 @@ export interface BaoSshRoleAttributes extends Omit<BaoSshRoleForm, 'maxTtl' | 't
   digest: string;
 }
 
-/** Mount path without a trailing slash; `ssh` when the caller did not say. */
-export const mountOf = (mount: string | undefined) => (mount ?? 'ssh').replace(/\/+$/, '');
+export { mountOf };
 
 export const readPath = (mount: string | undefined, name: string) =>
   `${mountOf(mount)}/roles/${name}`;
@@ -159,26 +159,28 @@ export const attributesOf = (
 };
 
 /**
- * ⛔ THE MAPS CROSS THE WIRE AS A JSON STRING, AND THAT IS THE CORRECT SHAPE. MEASURED with
- *   `bao write -output-curl-string` against the live v2.6.2 (no write was sent): the CLI
- *   puts every `k=v` value in the body as a string, so `default_extensions` leaves as
- *   `"{\"permit-pty\":\"\"}"` and never as an object. OpenBao's own OpenAPI types that field
- *   `object`/`format: map` — a `framework` TypeMap, which JSON-decodes a string value.
- *   ⚠️ THAT DECODE IS REASONED, NOT MEASURED: writing to the live engine was out of bounds,
- *   so the round trip was never executed. If a first deploy lands a role whose
- *   default_extensions came out EMPTY, this is the line that was wrong, and the fix is to
- *   send the map as a JSON object in writeBody rather than as this string — the HTTP body
- *   can now carry either.
+ * ⛔ THE MAPS CROSS THE WIRE AS JSON OBJECTS. A JSON STRING IS REJECTED, SO EVERY WRITE FAILED.
+ *   History: `bao write -output-curl-string` showed the CLI sending `k=v` values as strings,
+ *   so this once sent `"{\"permit-pty\":\"\"}"` on the reasoning that a `framework` TypeMap
+ *   JSON-decodes a string. ⚠️ IT DOES NOT. MEASURED 2026-09-21 against sdk v2.6.2 itself (a Go
+ *   probe of framework.FieldData.Validate, no server): TypeMap is `mapstructure.WeakDecode`
+ *   (framework/field_data.go:271-276), which refuses a string with "expected type
+ *   'map[string]interface {}', got unconvertible type 'string'" — and framework/backend.go:
+ *   281-285 answers that with a 400 before the handler runs. `"{}"` fails the same way, so every
+ *   Bao.SshRole write, not only those with extensions, would have been refused. It went unseen
+ *   because the adopted roles already matched and no write was ever sent. The same probe
+ *   accepted the object form and every other field of writeBody as sent.
  */
-const mapValue = (map: Readonly<Record<string, string>>) => JSON.stringify(extMap(map));
+const mapValue = (map: Readonly<Record<string, string>>) => extMap(map);
 
 /**
  * ⛔ EVERY MANAGED FIELD IS SENT ON EVERY WRITE, INCLUDING THE FALSE ONES. The role write is
  *   a full replace (see ssh-role.ts), so an omitted field is not "left alone" — it is reset.
- *   Sending the resolved form makes the body and the declaration the same statement. All
- *   strings, exactly the `k=v` pairs `bao write` sent, for `PUT <mount>/roles/<name>`.
+ *   Sending the resolved form makes the body and the declaration the same statement. Strings,
+ *   exactly the `k=v` pairs `bao write` sent, for `PUT <mount>/roles/<name>` — except the two
+ *   maps, which must be objects (the ⛔ on mapValue).
  */
-export const writeBody = (form: BaoSshRoleForm): Record<string, string> => ({
+export const writeBody = (form: BaoSshRoleForm): Record<string, unknown> => ({
   key_type: 'ca',
   allowed_users: form.allowedUsers.join(','),
   default_user: form.defaultUser,

package/src/openbao/ssh-role.ts

@@ -209,10 +209,9 @@ export const BaoSshRoleProvider = () =>
             yield* baoWrite('PUT', path, writeBody(form));
           }
           /**
-           * ⚠️ RE-READ RATHER THAN ECHO THE DECLARATION. The write is the only place the
-           *   JSON-string encoding of `default_extensions` could be wrong (see the ⛔ on
-           *   mapValue), and a provider that returned its own props would record a role it
-           *   had never confirmed.
+           * ⚠️ RE-READ RATHER THAN ECHO THE DECLARATION. The map encoding in the write was
+           *   wrong once already, unseen until 2026-09-21 (the ⛔ on mapValue), and a provider
+           *   that returned its own props would record a role it had never confirmed.
            */
           const after = yield* readRole(form);
           if (after === undefined) {

package/src/proxmox/index.test.ts

@@ -0,0 +1,53 @@
+/**
+ * Public barrel: control-plane Resource constructors, not guests or NIC apply.
+ *
+ * ⛔ Lxc/Vm stay Provider-only. A Resource export would let a stack declare
+ *   guests before storage/SDN exist. NodeNetwork/NetworkApply stay off the
+ *   barrel for the same reason — they stage interfaces.new.
+ */
+import { expect, test } from 'bun:test';
+import { PbsDatastore, ProxmoxStorage } from './index.ts';
+
+const src = await Bun.file(new URL('./index.ts', import.meta.url)).text();
+
+const resourceExports = [
+  'PbsDatastore',
+  'PbsPruneJob',
+  'PbsSyncJob',
+  'PbsVerifyJob',
+  'ProxmoxAcl',
+  'ProxmoxBackupJob',
+  'ProxmoxGroup',
+  'ProxmoxHaResource',
+  'ProxmoxHaRule',
+  'ProxmoxMetricServer',
+  'ProxmoxNotificationTarget',
+  'ProxmoxRole',
+  'ProxmoxSdnApply',
+  'ProxmoxSdnSubnet',
+  'ProxmoxSdnVnet',
+  'ProxmoxSdnZone',
+  'ProxmoxStorage',
+  'ProxmoxUser',
+] as const;
+
+test('control-plane Resource constructors are on the public barrel', () => {
+  expect(ProxmoxStorage).toBeDefined();
+  expect(PbsDatastore).toBeDefined();
+  for (const name of resourceExports) {
+    expect(src).toContain(`${name},`);
+  }
+});
+
+test('guests and NIC apply stay Provider-only', () => {
+  expect(src).not.toMatch(/export \{ ProxmoxLxc[, }]/);
+  expect(src).not.toMatch(/export \{ ProxmoxVm[, }]/);
+  expect(src).not.toMatch(/export \{ ProxmoxNodeNetwork[, }]/);
+  expect(src).not.toMatch(/export \{ ProxmoxNetworkApply[, }]/);
+  expect(src).not.toMatch(/export \{ ProxmoxApiToken[, }]/);
+  expect(src).not.toMatch(/export \{ ProxmoxZfsPool[, }]/);
+  expect(src).not.toMatch(/export \{ ProxmoxCephOsd[, }]/);
+  expect(src).not.toMatch(/export \{ ProxmoxCephFs[, }]/);
+  expect(src).not.toMatch(/export \{ ProxmoxCephDaemon[, }]/);
+  expect(src).not.toMatch(/export \{ ProxmoxCephFlag[, }]/);
+});

package/src/proxmox/index.ts

@@ -5,38 +5,44 @@
  *   These are the symbols a real stack consumes; the rest of the files are internals a
  *   provider needs but a consumer should not depend on. An `export *` here would publish
  *   every helper as API and make the next refactor a breaking change.
- * ★ Anything unlisted is still reachable by path if you genuinely need it — that is a
- *   deliberate, visible act rather than an accident of barrelling.
+ * ★ Control-plane Resource constructors (Storage, SDN, access, HA, backup,
+ *   metrics, PBS) sit next to their Providers. Guests and NIC apply stay
+ *   Provider-only so a stack cannot declare them by accident.
+ * ★ Anything else unlisted is still reachable by path if you genuinely need
+ *   it — that is a deliberate, visible act rather than an accident of barrelling.
  */
-export { ProxmoxAclProvider } from './acl.ts';
+export { ProxmoxAcl, ProxmoxAclProvider } from './acl.ts';
 export { ProxmoxApiTokenProvider } from './api-token.ts';
-export { ProxmoxBackupJobProvider } from './backup-job.ts';
+export { ProxmoxBackupJob, ProxmoxBackupJobProvider } from './backup-job.ts';
 export { ProxmoxCephDaemonProvider } from './ceph-daemon.ts';
 export { ProxmoxCephFlagProvider } from './ceph-flag.ts';
 export { ProxmoxCephFsProvider } from './ceph-fs.ts';
 export { ProxmoxCephOsdProvider } from './ceph-osd.ts';
 export { ProxmoxCephPool, ProxmoxCephPoolProvider } from './ceph-pool.ts';
 export { ProxmoxFirewallAliasProvider } from './firewall-alias.ts';
-export { ProxmoxGroupProvider } from './group.ts';
-export { ProxmoxHaResourceProvider } from './ha-resource.ts';
-export { ProxmoxHaRuleProvider } from './ha-rule.ts';
+export { ProxmoxGroup, ProxmoxGroupProvider } from './group.ts';
+export { ProxmoxHaResource, ProxmoxHaResourceProvider } from './ha-resource.ts';
+export { ProxmoxHaRule, ProxmoxHaRuleProvider } from './ha-rule.ts';
 export { ProxmoxLxcProvider } from './lxc.ts';
-export { ProxmoxMetricServerProvider } from './metric-server.ts';
+export { ProxmoxMetricServer, ProxmoxMetricServerProvider } from './metric-server.ts';
 export { ProxmoxNetworkApplyProvider } from './network-apply.ts';
 export { ProxmoxNodeNetworkProvider } from './node-network.ts';
-export { ProxmoxNotificationTargetProvider } from './notification-target.ts';
-export { PbsDatastoreProvider } from './pbs-datastore.ts';
-export { PbsPruneJobProvider } from './pbs-prune-job.ts';
-export { PbsSyncJobProvider } from './pbs-sync-job.ts';
-export { PbsVerifyJobProvider } from './pbs-verify-job.ts';
+export {
+  ProxmoxNotificationTarget,
+  ProxmoxNotificationTargetProvider,
+} from './notification-target.ts';
+export { PbsDatastore, PbsDatastoreProvider } from './pbs-datastore.ts';
+export { PbsPruneJob, PbsPruneJobProvider } from './pbs-prune-job.ts';
+export { PbsSyncJob, PbsSyncJobProvider } from './pbs-sync-job.ts';
+export { PbsVerifyJob, PbsVerifyJobProvider } from './pbs-verify-job.ts';
 export { ProxmoxPool, ProxmoxPoolProvider } from './pool.ts';
 export { ProxmoxVmProvider } from './qemu.ts';
 export { ProxmoxReplicationJobProvider } from './replication-job.ts';
-export { ProxmoxRoleProvider } from './role.ts';
-export { ProxmoxSdnApplyProvider } from './sdn-apply.ts';
-export { ProxmoxSdnSubnetProvider } from './sdn-subnet.ts';
-export { ProxmoxSdnVnetProvider } from './sdn-vnet.ts';
-export { ProxmoxSdnZoneProvider } from './sdn-zone.ts';
-export { ProxmoxStorageProvider } from './storage.ts';
-export { ProxmoxUserProvider } from './user.ts';
+export { ProxmoxRole, ProxmoxRoleProvider } from './role.ts';
+export { ProxmoxSdnApply, ProxmoxSdnApplyProvider } from './sdn-apply.ts';
+export { ProxmoxSdnSubnet, ProxmoxSdnSubnetProvider } from './sdn-subnet.ts';
+export { ProxmoxSdnVnet, ProxmoxSdnVnetProvider } from './sdn-vnet.ts';
+export { ProxmoxSdnZone, ProxmoxSdnZoneProvider } from './sdn-zone.ts';
+export { ProxmoxStorage, ProxmoxStorageProvider } from './storage.ts';
+export { ProxmoxUser, ProxmoxUserProvider } from './user.ts';
 export { ProxmoxZfsPoolProvider } from './zfs-pool.ts';