@homeflare/alchemy 0.44.0 → 0.46.0

package/dist/proxmox/qemu-dns.d.ts

@@ -0,0 +1,2 @@
+export declare const dnsRefusals: (nameserver: unknown) => string[];
+//# sourceMappingURL=qemu-dns.d.ts.map

package/dist/proxmox/qemu-dns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-dns.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-dns.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,WAAW,eAAgB,OAAO,KAAG,MAAM,EAQvD,CAAC"}

package/dist/proxmox/qemu-errors.d.ts

@@ -1,5 +1,6 @@
 /** A QEMU write or observation this provider will not turn into a create or a delete. */
 export declare class QemuRefusedError extends Error {
+    readonly _tag = "QemuRefusedError";
     constructor(message: string);
 }
 //# sourceMappingURL=qemu-errors.d.ts.map

package/dist/proxmox/qemu-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qemu-errors.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-errors.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}
+{"version":3,"file":"qemu-errors.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-errors.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,sBAAsB;IACnC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/proxmox/qemu-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qemu-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-form.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,KAAK,OAAO,EAKb,MAAM,iBAAiB,CAAC;AAEzB;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,MAAM,EAG6C,CAAC;AAElG,2FAA2F;AAC3F,eAAO,MAAM,IAAI,UAAW,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAO1D,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,UAAW,OAAO;;CAGvC,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,UAAU,aAAO,CAAC"}
+{"version":3,"file":"qemu-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-form.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,KAAK,OAAO,EAKb,MAAM,iBAAiB,CAAC;AAGzB;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,MAAM,EAKnD,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,IAAI,UAAW,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAO1D,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,UAAW,OAAO;;CAGvC,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,UAAU,aAAO,CAAC"}

package/dist/proxmox/qemu-judge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qemu-judge.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-judge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,OAAO,EAAsD,MAAM,iBAAiB,CAAC;AAInG,MAAM,MAAM,QAAQ,GAAG;IACrB,mFAAmF;IACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;AAEF,eAAO,MAAM,KAAK,UAAW,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,QA8CtE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,SAAU,MAAM,OAAO,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAI1B,CAAC"}
+{"version":3,"file":"qemu-judge.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-judge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,OAAO,EAAsD,MAAM,iBAAiB,CAAC;AAKnG,MAAM,MAAM,QAAQ,GAAG;IACrB,mFAAmF;IACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;AAEF,eAAO,MAAM,KAAK,UAAW,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,QA8CtE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,SAAU,MAAM,OAAO,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAI1B,CAAC"}

package/dist/proxmox/qemu-lifecycle.d.ts

@@ -1,40 +1,45 @@
 import type { Input } from 'alchemy/Input';
 import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
-import { type VmAttributes, type VmProps } from './qemu-props.ts';
-export declare const readQemu: (props: VmProps) => Effect.Effect<VmAttributes | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { QemuRefusedError } from './qemu-errors.ts';
+import type { VmAttributes, VmProps } from './qemu-props.ts';
+import { type QemuDiskResizeRefused } from './qemu-size.ts';
+type QemuLifecycleError = Effect.Error<ReturnType<typeof readQemu>> | nodes.PutNodeQemuResizeError | QemuRefusedError | QemuDiskResizeRefused;
+export declare const readQemu: (props: VmProps) => Effect.Effect<VmAttributes | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, HttpClient.HttpClient>;
 /** No purge, no skiplock, no destroy-unreferenced-disks. A missing config is already gone. */
-export declare const deleteQemu: (props: VmProps) => Effect.Effect<void | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const deleteQemu: (props: VmProps) => Effect.Effect<void | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | nodes.ProxmoxOpError, HttpClient.HttpClient>;
 export declare const qemuHandlers: {
     list: () => Effect.Effect<never[], never, never>;
     /**
      * ⛔ `Unowned` UNLESS STATE ALREADY VOUCHES FOR IT (C2). With no attributes this is Alchemy's
      *   adoption probe or the recovery read for an interrupted create (ownership/probe.ts); `settled`
-     *   is the same `judge` reconcile uses, so "proven ours" and "reconcile would write nothing" are
-     *   the same question asked once.
+     *   uses the same config comparison as reconcile. Disk growth is a post-create step, so its
+     *   drift cannot disown a VM after an interrupted/failed resize (measured 2026-10-05).
      */
     read: (args_0: {
         fqn: string;
         instanceId: string;
         olds: VmProps;
         output: VmAttributes | undefined;
-    }) => Effect.Effect<VmAttributes | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<VmAttributes | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, HttpClient.HttpClient>;
     diff: (args_0: {
         news: Input<VmProps>;
         olds: VmProps;
         output: VmAttributes | undefined;
     }) => Effect.Effect<{
-        readonly action: "noop" | "update";
-    } | undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+        readonly action: 'noop' | 'update';
+    } | undefined, QemuLifecycleError, HttpClient.HttpClient>;
     reconcile: (args_0: {
         fqn: string;
         instanceId: string;
         news: VmProps;
         olds: VmProps | undefined;
         output: VmAttributes | undefined;
-    }) => Effect.Effect<VmAttributes, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<VmAttributes, QemuLifecycleError, HttpClient.HttpClient>;
     delete: ({ olds }: {
         olds: VmProps;
-    }) => Effect.Effect<void | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<void | undefined, Error | import("./credential-errors.ts").PveCredentialDenied | nodes.ProxmoxOpError, HttpClient.HttpClient>;
 };
+export {};
 //# sourceMappingURL=qemu-lifecycle.d.ts.map

package/dist/proxmox/qemu-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qemu-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-lifecycle.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAOxC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,OAAO,EAMb,MAAM,iBAAiB,CAAC;AAwCzB,eAAO,MAAM,QAAQ,UAAW,OAAO,iOAapC,CAAC;AAEJ,8FAA8F;AAC9F,eAAO,MAAM,UAAU,UAAW,OAAO,+KAMyB,CAAC;AAmBnE,eAAO,MAAM,YAAY;IACvB,IAAI;IACJ;;;;;OAKG;IACH,IAAI;aAMG,MAAM;oBACC,MAAM;cACZ,OAAO;gBACL,YAAY,GAAG,SAAS;;IAQlC,IAAI;cAKI,KAAK,CAAC,OAAO,CAAC;cACd,OAAO;gBACL,YAAY,GAAG,SAAS;;;;IAwBlC,SAAS;aAOF,MAAM;oBACC,MAAM;cACZ,OAAO;cACP,OAAO,GAAG,SAAS;gBACjB,YAAY,GAAG,SAAS;;IAoDlC,MAAM,aAAa;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE;CACrC,CAAC"}
+{"version":3,"file":"qemu-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-lifecycle.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI7D,OAAO,EAAE,KAAK,qBAAqB,EAAyC,MAAM,gBAAgB,CAAC;AAOnG,KAAK,kBAAkB,GACnB,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC,GACzC,KAAK,CAAC,sBAAsB,GAC5B,gBAAgB,GAChB,qBAAqB,CAAC;AAE1B,eAAO,MAAM,QAAQ,UAAW,OAAO,kMAapC,CAAC;AAEJ,8FAA8F;AAC9F,eAAO,MAAM,UAAU,UAAW,OAAO,gJAMyB,CAAC;AAmBnE,eAAO,MAAM,YAAY;IACvB,IAAI;IACJ;;;;;OAKG;IACH,IAAI;aAMG,MAAM;oBACC,MAAM;cACZ,OAAO;gBACL,YAAY,GAAG,SAAS;;IAUlC,IAAI;cAKI,KAAK,CAAC,OAAO,CAAC;cACd,OAAO;gBACL,YAAY,GAAG,SAAS;;yBAEb,MAAM,GAAG,QAAQ;;IA4BtC,SAAS;aAOF,MAAM;oBACC,MAAM;cACZ,OAAO;cACP,OAAO,GAAG,SAAS;gBACjB,YAAY,GAAG,SAAS;;IAuDlC,MAAM,aAAa;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE;CACrC,CAAC"}

package/dist/proxmox/qemu-props.d.ts

@@ -46,6 +46,16 @@ export interface VmProps extends WithTarget {
     boot?: string;
     /** e.g. `virtio-scsi-single`. */
     scsihw?: string;
+    /** Cloud-init DNS servers: PVE's `address-list` (IP addresses or DNS names). */
+    nameserver?: string;
+    /** Cloud-init DNS search domains, in PVE's wire spelling. */
+    searchdomain?: string;
+    /**
+     * Minimum disk sizes in GiB, e.g. `{ scsi0: 64 }`, grown after import completes.
+     * Existing larger disks are left alone. Lowering a previously declared target is refused.
+     * These are resize targets, never config fields; declare the corresponding disk slot too.
+     */
+    diskSizesGiB?: Partial<Record<`scsi${number}` | `ide${number}`, number>>;
     /**
      * `local-zfs:32` to create a new volume, or the live volume string as adopted —
      * `cephtb4:vm-101-disk-0,size=32G` (n is 0 to 30, pve-qemu-server's own `$MAX_SCSI_DISKS`).

package/dist/proxmox/qemu-props.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qemu-props.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-props.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,kGAAkG;AAClG,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;AAEtC,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yFAAyF;IACzF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,CAAC,IAAI,EAAE,OAAO,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAC5C;;;OAGG;IACH,CAAC,GAAG,EAAE,MAAM,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,CAAC,SAAS,EAAE,MAAM,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAChD,mFAAmF;IACnF,CAAC,QAAQ,EAAE,WAAW,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACpD,gFAAgF;IAChF,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAChD,kCAAkC;IAClC,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,wCAAwC;IACxC,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAKD,8FAA8F;AAC9F,eAAO,MAAM,OAAO;aAClB,GAAG,EAAE,CAAC;aACN,QAAQ,EAAE,EAAE;aACZ,GAAG,EAAE,EAAE;aACP,IAAI,EAAE,EAAE;aACR,MAAM,EAAE,CAAC;CACD,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,OAAO,CAAC;AAEjD,4FAA4F;AAC5F,eAAO,MAAM,UAAU,QAAS,MAAM,KAAG,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,SAM3E,CAAC;AAeF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,QAAS,MAAM,KAAG,OACY,CAAC;AAExD,6GAA6G;AAC7G,eAAO,MAAM,aAAa,UAAW,OAAO,OAAO,MAAM,KAAG,OACR,CAAC;AAErD,wFAAwF;AACxF,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,MAAM,EAGzC,CAAC;AAEZ,iGAAiG;AACjG,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,MACmB,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAQjF,CAAC"}
+{"version":3,"file":"qemu-props.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-props.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,kGAAkG;AAClG,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;AAEtC,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yFAAyF;IACzF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE;;;OAGG;IACH,CAAC,IAAI,EAAE,OAAO,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAC5C;;;OAGG;IACH,CAAC,GAAG,EAAE,MAAM,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,CAAC,SAAS,EAAE,MAAM,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAChD,mFAAmF;IACnF,CAAC,QAAQ,EAAE,WAAW,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACpD,gFAAgF;IAChF,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAChD,kCAAkC;IAClC,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,wCAAwC;IACxC,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAKD,8FAA8F;AAC9F,eAAO,MAAM,OAAO;aAClB,GAAG,EAAE,CAAC;aACN,QAAQ,EAAE,EAAE;aACZ,GAAG,EAAE,EAAE;aACP,IAAI,EAAE,EAAE;aACR,MAAM,EAAE,CAAC;CACD,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,OAAO,CAAC;AAEjD,4FAA4F;AAC5F,eAAO,MAAM,UAAU,QAAS,MAAM,KAAG,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,SAM3E,CAAC;AAiBF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,QAAS,MAAM,KAAG,OACY,CAAC;AAExD,6GAA6G;AAC7G,eAAO,MAAM,aAAa,UAAW,OAAO,OAAO,MAAM,KAAG,OACR,CAAC;AAErD,wFAAwF;AACxF,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,MAAM,EAGzC,CAAC;AAEZ,iGAAiG;AACjG,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,MACmB,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAQjF,CAAC"}

package/dist/proxmox/qemu-resize.d.ts

@@ -0,0 +1,10 @@
+import * as Effect from 'effect/Effect';
+import { type VmProps } from './qemu-props.ts';
+/**
+ * ⛔ Observe the unlocked, allocated disk before each resize, including recovery after import.
+ * Absolute targets make retries safe; `+60G` would grow again after interrupted state writes.
+ * This resource never starts a guest. Its caller can power on only after reconcile returns.
+ * SDK failures retain their generated tags; provider refusals are QemuDiskResizeRefused.
+ */
+export declare const resizeDisks: (props: VmProps) => Effect.Effect<undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=qemu-resize.d.ts.map

package/dist/proxmox/qemu-resize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-resize.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-resize.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,OAAO,EAAgB,MAAM,iBAAiB,CAAC;AAqC7D;;;;;GAKG;AACH,eAAO,MAAM,WAAW,UAAW,OAAO,kNAuCtC,CAAC"}

package/dist/proxmox/qemu-size.d.ts

@@ -0,0 +1,20 @@
+import * as Effect from 'effect/Effect';
+import { type VmProps } from './qemu-props.ts';
+declare const QemuDiskResizeRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "QemuDiskResizeRefused";
+} & Readonly<A>;
+export declare class QemuDiskResizeRefused extends QemuDiskResizeRefused_base<{
+    readonly disk: string;
+    readonly message: string;
+}> {
+}
+/** PVE config reports binary sizes, including fractional G and integer M/K for imported images. */
+export declare const diskBytes: (config: string | undefined) => number | undefined;
+/** Validate the whole declaration before any write, including a later attempted target decrease. */
+export declare const validateDiskSizes: (props: VmProps, olds?: VmProps) => Effect.Effect<undefined, QemuDiskResizeRefused, never>;
+/** Capacity drift drives reconcile; recovery ownership ignores it because resize follows create. */
+export declare const diskSizeDrift: (props: VmProps, config: Record<string, string>) => string[];
+/** Missing slots may be imported by the upcoming config write; unreadable existing sizes fail closed. */
+export declare const checkLiveDiskSizes: (props: VmProps, config: Record<string, string>, allowMissing?: boolean) => Effect.Effect<undefined, QemuDiskResizeRefused, never>;
+export {};
+//# sourceMappingURL=qemu-size.d.ts.map

package/dist/proxmox/qemu-size.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-size.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-size.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,OAAO,EAA6B,MAAM,iBAAiB,CAAC;;;;AAG1E,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AAEL,mGAAmG;AACnG,eAAO,MAAM,SAAS,WAAY,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAO/D,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,iBAAiB,UAAW,OAAO,SAAS,OAAO,2DAwC5D,CAAC;AAEL,oGAAoG;AACpG,eAAO,MAAM,aAAa,UAAW,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,MAAM,EAKzC,CAAC;AAE7C,yGAAyG;AACzG,eAAO,MAAM,kBAAkB,UACtB,OAAO,UACN,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,mFAmB5B,CAAC"}

package/dist/proxmox/qemu-spec.d.ts

@@ -0,0 +1,25 @@
+/** QEMU config forms and vendor guards, separated from lifecycle to keep both reviewable. */
+import { createForm } from './qemu-form.ts';
+import { type VmAttributes, type VmProps } from './qemu-props.ts';
+export declare const attributesOf: (live: Record<string, unknown>, props: VmProps) => VmAttributes;
+/**
+ * ⚠️ KEPT ONLY TO SATISFY `PveSpec`'S REQUIRED FIELD — `qemu-judge.ts`'s `judge` is what diff and
+ *   reconcile actually decide by, since a plain string compare is exactly the bug C1 found (it
+ *   never matches the "new disk" or MAC-less spellings a declaration may use).
+ */
+declare const matches: (attributes: VmAttributes, props: VmProps) => boolean;
+export declare const spec: {
+    attributes: typeof attributesOf;
+    collection: (props: VmProps) => string;
+    createForm: typeof createForm;
+    endpoint: {
+        create: string;
+        update: string;
+    };
+    matches: typeof matches;
+    path: (props: VmProps) => string;
+    updateForm: typeof import("./qemu-form.ts").form;
+};
+export declare const guardCreate: (props: VmProps, presence: boolean) => import("effect/Effect").Effect<void>, guardUpdate: (props: VmProps) => import("effect/Effect").Effect<void>;
+export {};
+//# sourceMappingURL=qemu-spec.d.ts.map

package/dist/proxmox/qemu-spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qemu-spec.d.ts","sourceRoot":"","sources":["../../src/proxmox/qemu-spec.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,UAAU,EAAc,MAAM,gBAAgB,CAAC;AACxD,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,OAAO,EAMb,MAAM,iBAAiB,CAAC;AAIzB,eAAO,MAAM,YAAY,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,OAAO,KAAG,YAI3E,CAAC;AAEH;;;;GAIG;AACH,QAAA,MAAM,OAAO,eAAgB,YAAY,SAAS,OAAO,YAG2B,CAAC;AAErF,eAAO,MAAM,IAAI;;wBAEK,OAAO;;;QAGzB,MAAM;QACN,MAAM;;;kBAGM,OAAO;;CAEmB,CAAC;AAE3C,eAAO,MAAQ,WAAW,+EAAE,WAAW,0DAAqB,CAAC"}

package/dist/verify/fake-engine.d.ts

@@ -53,7 +53,7 @@ export type DriftRow = {
     readonly action: string;
 };
 export interface FakeEngine {
-    /** Plan and apply `body`, as `alchemy deploy --adopt` would; resolves to the planned actions. */
+    /** Plan and apply `body` with the configured adoption policy; resolves to planned actions. */
     readonly deploy: (body: Body) => Promise<Record<string, string>>;
     /** Verify `body` against what the earlier deploys recorded. */
     readonly verify: (body: Body, options?: VerifyOptions) => Promise<AdoptReport>;
@@ -78,7 +78,9 @@ export interface FakeEngine {
  * hands in its real provider over a fake transport (proxmox/ceph-pool-adopt.test.ts).
  * ⚠️ THE CASTS ARE AT THE ENGINE'S TYPED BOUNDARY — openbao/fake-stack.ts has the reasoning.
  */
-export declare const engineOver: <ROut, E, RIn>(layer: Layer.Layer<ROut, E, RIn>) => FakeEngine;
+export declare const engineOver: <ROut, E, RIn>(layer: Layer.Layer<ROut, E, RIn>, options?: {
+    readonly adopt?: boolean;
+}) => FakeEngine;
 /** The fake family over `cloud`. */
 export declare const fakeEngine: (cloud: Cloud) => FakeEngine;
 //# sourceMappingURL=fake-engine.d.ts.map

package/dist/verify/fake-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-engine.d.ts","sourceRoot":"","sources":["../../src/verify/fake-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAiB,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D,4EAA4E;AAC5E,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,QAAS,SAAQ,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AACnG,eAAO,MAAM,QAAQ,iCAA8C,CAAC;AAEpE,gGAAgG;AAChG,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAQ,KAI1D,CAAC;AAEH,8CAA8C;AAC9C,eAAO,MAAM,QAAQ,UAAW,KAAK,KAAG,MAAM,EAC2C,CAAC;AAyB1F,4FAA4F;AAC5F,eAAO,MAAM,cAAc,UAAW,KAAK,8GAmCxC,CAAC;AAEJ,oFAAoF;AACpF,MAAM,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAK5D,gGAAgG;AAChG,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,UAAU;IACzB,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAG,UAmD3E,CAAC;AAEF,oCAAoC;AACpC,eAAO,MAAM,UAAU,UAAW,KAAK,KAAG,UAA+C,CAAC"}
+{"version":3,"file":"fake-engine.d.ts","sourceRoot":"","sources":["../../src/verify/fake-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAiB,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D,4EAA4E;AAC5E,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,QAAS,SAAQ,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AACnG,eAAO,MAAM,QAAQ,iCAA8C,CAAC;AAEpE,gGAAgG;AAChG,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAQ,KAI1D,CAAC;AAEH,8CAA8C;AAC9C,eAAO,MAAM,QAAQ,UAAW,KAAK,KAAG,MAAM,EAC2C,CAAC;AAyB1F,4FAA4F;AAC5F,eAAO,MAAM,cAAc,UAAW,KAAK,8GAmCxC,CAAC;AAEJ,oFAAoF;AACpF,MAAM,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAK5D,gGAAgG;AAChG,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,UAAU;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,SAC9B,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,YACvB;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,KACpC,UAmDF,CAAC;AAEF,oCAAoC;AACpC,eAAO,MAAM,UAAU,UAAW,KAAK,KAAG,UAA+C,CAAC"}

package/docs/postgres-role.md

@@ -26,16 +26,26 @@ run yourself. The `Postgres.Database` resource in this kit already binds `@effec
   never re-sends a secret that already matches, and never stores one. A create that declares a
   password but whose variable is unset refuses before any write
   (`PostgresRolePasswordEnvUnsetError`), including the retry of a create whose password statement
-  never sealed.
+  never sealed. Non-ASCII passwords fail typed before writes (`PostgresRolePasswordNonAsciiRefused`):
+  PostgreSQL applies SASLprep, and this provider does not implement that normalization.
 - **Membership is `pg_auth_members`, compared as a sorted set.** `memberOf` omitted leaves live
   memberships alone; `[]` ensures none. Moves run through one-parent `GRANT`/`REVOKE`
   (`alter_role.sgml`: "there are no options for adding or removing memberships; use GRANT and
   REVOKE"). A plain `REVOKE` only removes the session grantor's row (`plan_single_revoke` matches
   `grantor`); each unwanted row is `REVOKE … GRANTED BY` its own grantor. A wanted row that is
-  `WITH ADMIN` or still `SET TRUE` is repaired in place with one
-  `GRANT … WITH ADMIN FALSE, SET FALSE` (`AddRoleMems` updates that grantor's tuple). Another
-  grantor's unsafe row is revoked by name afterwards. A row whose grantor role is gone cannot be
-  named and fails `PostgresRoleMembershipUnrepaired`. A missing parent fails
+  `WITH ADMIN`, still `SET TRUE`, or `INHERIT TRUE` when `inherit:false` is declared is repaired
+  with `REVOKE ADMIN/SET/INHERIT OPTION FOR … GRANTED BY … RESTRICT`. Unwanted-row revokes commit
+  first, then each retained row's options share a repair transaction. SQLSTATE 2BP01/42501 becomes
+  `PostgresRoleMembershipUnrepaired` naming that parent and grantor, preserving refused options
+  and dependent rows without rolling back unwanted-row revokes. No CASCADE is issued.
+  Option repair was measured once by hand on a throwaway PostgreSQL 17.11 (2026-10-02);
+  automated tests stub the 2BP01/42501 responses. Semantics: PostgreSQL
+  [16 GRANT](https://www.postgresql.org/docs/16/sql-grant.html) / [REVOKE](https://www.postgresql.org/docs/16/sql-revoke.html),
+  [17 GRANT](https://www.postgresql.org/docs/17/sql-grant.html) / [REVOKE](https://www.postgresql.org/docs/17/sql-revoke.html),
+  [18 GRANT](https://www.postgresql.org/docs/18/sql-grant.html) / [REVOKE](https://www.postgresql.org/docs/18/sql-revoke.html).
+  `buildRepairMembershipSql` now requires the grantor and option (`ADMIN`, `SET` or `INHERIT`).
+  A null grantor is a defensive inconsistent-catalog case, not an ordinary DROP ROLE outcome,
+  and fails `PostgresRoleMembershipUnrepaired`. A missing parent fails
   `PostgresRoleParentMissing` before any statement.
 - **`defaultRemovalPolicy: 'retain'`.** A seat group role may own objects and be granted across
   databases. A destroy is still implemented in full (`DROP ROLE IF EXISTS`, idempotent), opted in
@@ -47,7 +57,9 @@ run yourself. The `Postgres.Database` resource in this kit already binds `@effec
   says `WITH SET FALSE`. Create runs `CREATE`, the password `ALTER` and the seat `GRANT`s in one
   transaction, so a later statement failure does not leave a LOGIN role behind. `diff` reads
   `pg_auth_members` live — stored attributes omit the option rows, and the engine passes stored
-  attributes — so `ADMIN` or `SET TRUE` plans as `update`. A live oid that is not the stored oid
+  attributes — so unsafe `ADMIN`, `SET` or `INHERIT` plans as `update`. Privileged catalog flags also plan
+  `update`, reaching the typed reconcile refusal. `read` omits membership option rows just as
+  reconcile does, so an unchanged role does not report structural drift. A live oid that is not the stored oid
   is `PostgresRoleIdentityRefused` on read, diff, reconcile and delete: the name was recreated
   out of band and is not dropped or altered.
 

package/docs/proxmox-qemu-resize.md

@@ -0,0 +1,62 @@
+# Cloud-init DNS and imported disk growth
+
+```ts
+Proxmox.Vm('talos', {
+  target,
+  node: 'n2',
+  vmid: 10000,
+  scsi0: 'cephtb4:0,import-from=cephfs-tb4:import/talos.raw',
+  diskSizesGiB: { scsi0: 64 },
+  ide2: 'cephtb4:cloudinit',
+  ipconfig0: 'ip=10.20.16.20/24,gw=10.20.16.254',
+  nameserver: '10.20.16.254',
+  searchdomain: 'example.internal',
+});
+```
+
+`diskSizesGiB` declares minimum capacity in positive integer GiB. Declare the disk
+slot alongside its target. Equal or larger live disks need no resize; lowering a
+previously declared target is refused with `QemuDiskResizeRefused`, which callers
+can handle with `Effect.catchTag`. Removing a target leaves capacity unmanaged.
+Unsupported slots, CD-ROM/cloud-init drives and unreadable live sizes are refused.
+
+The provider waits for import, reads the allocated disk, sends an absolute target
+through the generated `putNodeQemuResize` operation, waits for its task, and verifies
+the resulting capacity. An interrupted create resumes without `--adopt` when its
+config matches, even if disk growth remains unfinished. Each resize checks the raw
+VM lock first; lock waits and resize task polling share a 60-observation budget per
+disk. A persistent lock raises `QemuDiskResizeRefused` without a resize write.
+Absolute targets let retries finish growth without adding capacity twice.
+`size=` in a volume config string is still observed metadata: omit it when
+using a resize target. An unrelated update never resends the import source.
+
+This resource never starts a VM. Complete its reconciliation before the separate
+power-on step. Resizing an existing guest does not grow its partitions/filesystems.
+
+DNS keys use the same declared-key comparison as `ipconfig0`: omitted keys remain
+unmanaged. `nameserver` enforces the generated `address-list` constraint; PVE permits
+IP addresses or DNS names, separated by whitespace, commas or semicolons. The provider
+preserves the supplied spelling. `searchdomain` has no extra schema constraint.
+
+Schema provenance: `codegen/manifest.json`, pve-manager **9.2.11/f6997e698c7933ea**,
+SHA-256 `9def8f13611184ee1c7d0399713130dfc4a065701d0d91a69b9c03df929344e9`.
+QEMU resize already exists in both generated surfaces: distilled's `nodes.ts` and
+the legacy generator's packed `nodes-node-qemu-vmid-mtunnel.ts`. A filename search
+for `qemu-vmid-resize.ts` misses the latter; neither output needs hand editing.
+Both caches were recovered byte-for-byte from public vendor sources, then
+`bun codegen/constraints.ts` generated the resize guard. The existing type generator
+already supports the operation. No generated file was edited by hand.
+
+Recovery used the vendor Makefile's concatenation order: `api-viewer/apidata.js`
+and `api-viewer/PVEAPI.js` from proxmox/pve-docs
+`4e7ff22c70eb35c63e65b0ba65c98980cb4d7bf5`, then `src/api-viewer/APIViewer.js`
+from proxmox/proxmox-widget-toolkit `9204a77880eb31aff6ffc8bcf65ca48539685ab1`.
+The result is exactly 4,337,847 bytes and the manifest SHA-256 above. PBS's 1,508,860
+bytes were recovered from the public `proxmox-backup-docs_4.2.3-1_all.deb`, matching
+the manifest's full SHA-256 (the recorded server version is 4.2.6-1, running 4.2.3).
+No host was contacted. Tests cover generated constraints/types and fake SDK transport.
+
+The named format's semantics come from
+[PVE::JSONSchema](https://github.com/proxmox/pve-common/blob/defd246f31f327463f901a2daaf8dc52efcc5a97/src/PVE/JSONSchema.pm)
+and `PVE::ParseUtils` at the same commit, inspected 2026-10-05. This is vendor-source
+and fake-transport evidence; no live PVE call or Talos boot was performed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.44.0",
+  "version": "0.46.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/ceph/ceph-argv.test.ts

@@ -208,7 +208,7 @@ describe('K-A4 finding 4: configValueProblem never accepts a flag-shaped value',
     ['a short flag', '-n'],
     ['a file-overwrite flag glued to its argument', '-o/etc/ceph/ceph.conf'],
     ['a long flag with =', '--admin-daemon=/var/run/ceph/ceph-mon.a.asok'],
-    ['another long flag', '--conf=/tmp/x'],
+    ['another long flag', '--conf=/tmp/x'], // tmp-allow: refused argv, not a directory this test creates
     ['the empty string', ''],
     ['a bare dash', '-'],
   ])('refuses %s (%j)', (_name, value) => {

package/src/launchd/sudo-allowlist.test.ts

@@ -15,7 +15,7 @@ import {
 } from './sudo-allowlist.ts';
 
 const DAEMONS = '/Library/LaunchDaemons';
-const context = { prefixes: [DAEMONS, '/opt/example'], staged: '/tmp/hf-sudo-x/staged' };
+const context = { prefixes: [DAEMONS, '/opt/example'], staged: '/tmp/hf-sudo-x/staged' }; // tmp-allow: in-memory staging path, not a directory this test creates
 const allowed = (argv: string[]) => privilegedProblem(argv, context);
 const PLIST = `${DAEMONS}/com.example.a.plist`;
 
@@ -66,7 +66,7 @@ describe('launchctl shapes', () => {
     ['bootstrap of two plists', [LAUNCHCTL, 'bootstrap', 'system', PLIST, PLIST]],
     [
       'bootstrap outside every prefix',
-      [LAUNCHCTL, 'bootstrap', 'system', '/tmp/com.example.a.plist'],
+      [LAUNCHCTL, 'bootstrap', 'system', '/tmp/com.example.a.plist'], // tmp-allow: refused argv, not a directory this test creates
     ],
     ['bootstrap of a non-plist', [LAUNCHCTL, 'bootstrap', 'system', `${DAEMONS}/com.example.a`]],
     // ★ Only where launchd loads daemons at boot: anywhere else is a job that vanishes on restart.

package/src/linux/sudo-allowlist.test.ts

@@ -22,7 +22,7 @@ import {
 } from './sudo-allowlist.ts';
 
 const PREFIXES = ['/etc/systemd/system', '/usr/local/bin'];
-const STAGED = '/tmp/hf-sudo-1/staged';
+const STAGED = '/tmp/hf-sudo-1/staged'; // tmp-allow: in-memory staging path, not a directory this test creates
 const TEMP = '/etc/systemd/system/.thing.service.hf-abcdef012345.tmp';
 const context: AllowContext = { prefixes: PREFIXES, staged: STAGED, temp: TEMP };
 const allowed = (argv: string[]) => privilegedProblem(argv, context);
@@ -51,7 +51,7 @@ describe('install shapes', () => {
       'a target that is not the derived temp',
       [INSTALL, '-m', '0644', '-T', '--', STAGED, '/etc/systemd/system/x.service'],
     ],
-    ['a temp outside every prefix', [INSTALL, '-m', '0644', '-T', '--', STAGED, '/tmp/x.tmp']],
+    ['a temp outside every prefix', [INSTALL, '-m', '0644', '-T', '--', STAGED, '/tmp/x.tmp']], // tmp-allow: refused argv, not a directory this test creates
     ['no -T', [INSTALL, '-m', '0644', '--', STAGED, TEMP]],
     ['a three-digit mode', [INSTALL, '-m', '644', '-T', '--', STAGED, TEMP]],
     ['-S (the Mac flag)', [INSTALL, '-S', '-m', '0644', '-T', '--', STAGED, TEMP]],
@@ -103,7 +103,7 @@ describe('mv and rm shapes', () => {
     ['mv without -T', [MV, '-f', '--', TEMP, '/etc/systemd/system/thing.service']],
     ['rm -r', [RM, '-rf', '--', TEMP]],
     ['rm without --', [RM, '-f', TEMP]],
-    ['rm outside every prefix', [RM, '-f', '--', '/tmp/x']],
+    ['rm outside every prefix', [RM, '-f', '--', '/tmp/x']], // tmp-allow: refused argv, not a directory this test creates
     ['sudo in argv', ['/usr/bin/sudo', '-n', RM, '-f', '--', TEMP]],
   ])('refuses %s', (_name, argv) => {
     expect(allowed(argv)).toBeString();

package/src/linux/sudo-runner.test.ts

@@ -52,7 +52,7 @@ describe('writeFileAtomic under a prefix', () => {
     for (const line of logs) expect(line.startsWith('homeflare/linux sudo -n ')).toBe(true);
     // No temp file left behind, and the staging directory is gone too.
     expect([...fake.files.keys()].some((path) => path.includes('.hf-'))).toBe(false);
-    expect([...fake.dirs.keys()].some((path) => path.startsWith('/tmp/hf-sudo-'))).toBe(false);
+    expect([...fake.dirs.keys()].some((path) => path.startsWith('/tmp/hf-sudo-'))).toBe(false); // tmp-allow: in-memory fake path from fake-sudo, not a directory this test creates
   });
 
   test('a failed mv removes the temp it just installed, then still throws', async () => {
@@ -68,7 +68,7 @@ describe('writeFileAtomic under a prefix', () => {
     expect(calls[2]?.at(-1)).toBe(calls[0]?.at(-1));
     expect(fake.files.has(DEST)).toBe(false);
     expect([...fake.files.keys()].some((path) => path.includes('.hf-'))).toBe(false);
-    expect([...fake.dirs.keys()].some((path) => path.startsWith('/tmp/hf-sudo-'))).toBe(false);
+    expect([...fake.dirs.keys()].some((path) => path.startsWith('/tmp/hf-sudo-'))).toBe(false); // tmp-allow: in-memory fake path from fake-sudo, not a directory this test creates
   });
 
   // 🔴 Adversarial review, round 2: a failed CLEANUP rm after a failed mv used to be swallowed

package/src/postgres/fake-role-sql.ts

@@ -22,11 +22,14 @@ export interface FakeRoleState {
   /** Bare role names, backing the `roleExists` check the database family's owner probe uses. */
   readonly roleNames: Set<string>;
   readonly roleRows: Map<string, PostgresRoleAttributes>;
-  /** `member\0parent\0grantor` triples backing `pg_auth_members` (`''` grantor = dropped
+  /** `member\0parent\0grantor` triples backing `pg_auth_members` (`''` grantor = unresolvable
    * grantor); `GRANT`/`REVOKE` mutate it. */
   readonly memberships: Set<string>;
   /** Options a name-only compare would hide, keyed `member\0parent\0grantor`. */
-  readonly membershipOptions: Map<string, { readonly admin: boolean; readonly set: boolean }>;
+  readonly membershipOptions: Map<
+    string,
+    { readonly admin: boolean; readonly set: boolean; readonly inherit?: boolean }
+  >;
   /** Hands out the next `oid` a real cluster would assign. */
   nextOid(): number;
 }
@@ -106,6 +109,7 @@ export const applyRoleStatement = <A extends object>(
           grantor: parts[2] === undefined || parts[2] === '' ? null : (parts[2] as string),
           admin: options?.admin === true,
           set: options?.set === true,
+          inherit: options?.inherit === true,
         };
       })
       .sort(
@@ -165,17 +169,33 @@ export const applyRoleStatement = <A extends object>(
     // `grant.sgml` (REL_18_6): altering an existing membership retains every option the new
     // GRANT omits, so only the full-options form clears ADMIN; `WITH SET FALSE` alone keeps a
     // current ADMIN. A bare `GRANT` (never issued by this family) leaves options untouched.
-    const options = state.membershipOptions.get(key) ?? { admin: false, set: false };
+    const options = state.membershipOptions.get(key) ?? {
+      admin: false,
+      set: false,
+      inherit: state.roleRows.get(member)?.inherit ?? true,
+    };
     if (text.endsWith('WITH ADMIN FALSE, SET FALSE')) {
-      state.membershipOptions.delete(key);
+      state.membershipOptions.set(key, { ...options, admin: false, set: false });
     } else if (text.endsWith('WITH SET FALSE')) {
-      if (options.admin) state.membershipOptions.set(key, { admin: true, set: false });
-      else state.membershipOptions.delete(key);
+      state.membershipOptions.set(key, { ...options, set: false });
     }
     return Effect.succeed([] as unknown as ReadonlyArray<A>);
   }
 
   if (text.startsWith('REVOKE')) {
+    const option =
+      /^REVOKE (ADMIN|SET|INHERIT) OPTION FOR "((?:[^"]|"")*)" FROM "((?:[^"]|"")*)" GRANTED BY "((?:[^"]|"")*)" RESTRICT$/.exec(
+        text,
+      );
+    if (option !== null) {
+      const key = `${unquoteIdent(option[3] as string)}\0${unquoteIdent(option[2] as string)}\0${unquoteIdent(option[4] as string)}`;
+      const options = state.membershipOptions.get(key) ?? { admin: false, set: false };
+      const next = { ...options, [(option[1] as string).toLowerCase()]: false };
+      if (next.admin || next.set || next.inherit !== undefined)
+        state.membershipOptions.set(key, next);
+      else state.membershipOptions.delete(key);
+      return Effect.succeed([] as unknown as ReadonlyArray<A>);
+    }
     const granted =
       /^REVOKE "((?:[^"]|"")*)" FROM "((?:[^"]|"")*)" GRANTED BY "((?:[^"]|"")*)"$/.exec(text);
     if (granted !== null) {

package/src/postgres/fake-sql.ts

@@ -35,12 +35,14 @@ export interface FakeSql extends PgExecutor {
   readonly roleRows: Map<string, PostgresRoleAttributes>;
   /** `member\0parent\0grantor` triples backing `pg_auth_members` (a plain `pg_auth_members`
    * read, a grant, a revoke and a DROP ROLE cascade all go through `fake-role-sql.ts`);
-   * `GRANT`/`REVOKE` mutate it. An empty grantor segment is a grantor role that no longer
-   * exists. */
+   * `GRANT`/`REVOKE` mutate it. An empty grantor segment is an inconsistent catalog/test row. */
   readonly memberships: Set<string>;
   /** Options on a membership the name alone hides, keyed `member\0parent\0grantor`. Absent
-   * means neither ADMIN nor SET. */
-  readonly membershipOptions: Map<string, { readonly admin: boolean; readonly set: boolean }>;
+   * means neither ADMIN, SET nor an explicit per-grant INHERIT. */
+  readonly membershipOptions: Map<
+    string,
+    { readonly admin: boolean; readonly set: boolean; readonly inherit?: boolean }
+  >;
   /** Mutable on purpose: a test seeds a live schema (adoption, drift) or clears one (drop). */
   readonly schemas: Map<string, PostgresSchemaAttributes>;
   /** Mutable on purpose: names of schemas this fake pretends hold at least one relation, so a
@@ -85,7 +87,10 @@ export const makeFakeSql = (options: FakeSqlOptions = {}): FakeSql => {
   const roleRows = new Map(options.roleRows?.map((r) => [r.name, r] as const) ?? []);
   const databases = new Map(options.databases?.map((d) => [d.name, d] as const) ?? []);
   const memberships = new Set<string>();
-  const membershipOptions = new Map<string, { readonly admin: boolean; readonly set: boolean }>();
+  const membershipOptions = new Map<
+    string,
+    { readonly admin: boolean; readonly set: boolean; readonly inherit?: boolean }
+  >();
   const schemas = seedSchemas(options.schemas, options.database ?? 'postgres');
   const relationsIn = new Set(options.schemasWithRelations ?? []);
   let raceRemaining = options.raceNextCreate === true ? 1 : 0;

package/src/postgres/index.ts

@@ -147,6 +147,7 @@ export {
   PostgresRoleNameRefused,
   PostgresRoleParentMissing,
   PostgresRolePasswordEnvUnsetError,
+  PostgresRolePasswordNonAsciiRefused,
   PostgresRolePrivilegedRefused,
   PostgresRoleRenameRefused,
   PostgresRoleValidUntilRefused,

package/src/postgres/role-attrs.ts

@@ -62,7 +62,8 @@ export interface PostgresRoleProps {
   readonly login: boolean;
   /** `CONNECTION LIMIT n`, `-1` for unlimited — maps to `pg_roles.rolconnlimit`. */
   readonly connectionLimit: number;
-  /** `INHERIT` or `NOINHERIT` — maps to `pg_roles.rolinherit`. */
+  /** `INHERIT` or `NOINHERIT` — maps to `pg_roles.rolinherit`; false also clears per-grant
+   * INHERIT on declared memberships (PG 16+ uses the role flag only to default new grants). */
   readonly inherit: boolean;
   /**
    * `VALID UNTIL 'timestamp'` — maps to `pg_roles.rolvaliduntil`. ISO 8601 without a timezone is
@@ -112,18 +113,20 @@ export interface PostgresRoleAttributes {
    */
   readonly memberOf: readonly string[] | null;
   /**
-   * The membership rows behind `memberOf`, including `admin_option` and `set_option`. Present
+   * The membership rows behind `memberOf`, including `admin_option`, `set_option` and
+   * `inherit_option`. Present
    * on a catalog read; stripped before attributes are stored (`storedAttributes`), because the
    * engine's diff receives stored attributes and would never see them there. The provider's
    * diff reads these rows live. `grantor` is the role that made the grant
-   * (`pg_auth_members.grantor`), null when that role was dropped — a dropped-grantor row cannot
-   * be named in `REVOKE … GRANTED BY`, so reconcile can only fail typed on it.
+   * (`pg_auth_members.grantor`). Null is a defensive inconsistent-catalog case, not an ordinary
+   * DROP ROLE outcome; such a row cannot be named in `REVOKE … GRANTED BY`.
    */
   readonly memberships?: readonly {
     readonly parent: string;
     readonly grantor: string | null;
     readonly admin: boolean;
     readonly set: boolean;
+    readonly inherit: boolean;
   }[];
   /**
    * A seal of the last password value written, or `''` if none was ever written (`seal()` from