@homeflare/alchemy 0.45.0 → 0.46.1

package/src/postgres/schema-test-kit.ts

@@ -11,6 +11,7 @@
  *   branch's marker and matches its own.
  */
 import type { PsqlRunner } from './psql-executor.ts';
+import { stripPin } from './search-path.ts';
 import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';
 
 export const ok = (stdout: string) => Promise.resolve({ code: 0, stdout, stderr: '' });
@@ -29,9 +30,12 @@ export interface RouteAnswers {
 
 /** Route one stdin to its answer by the markers above, `undefined` when no branch matches. */
 export const route = (stdin: string, answers: RouteAnswers): string | undefined => {
+  // The atomic drop (`schema-drop-sql.ts`) quotes every marker below inside its body: it answers
+  // nothing, and a refusal is injected by `runnerWith`'s `failOn`, never routed.
+  if (stdin.startsWith('DO ')) return undefined;
   if (stdin.includes('AS empty')) return answers.empty;
-  if (stdin.includes('FROM pg_namespace')) return answers.schema;
-  if (stdin.includes('FROM pg_database')) return answers.probe;
+  if (stdin.includes('FROM pg_catalog.pg_namespace')) return answers.schema;
+  if (stdin.includes('FROM pg_catalog.pg_database')) return answers.probe;
   if (stdin.includes('current_database()')) return answers.proof;
   return undefined;
 };
@@ -46,14 +50,24 @@ export const router = (answers: RouteAnswers) => (stdin: string) => route(stdin,
  */
 export const runnerWith = (
   answers: (stdin: string) => string,
+  /** The `psql` stderr a statement fails with (exit 3), or `undefined` to answer normally. */
+  failOn: (stdin: string) => string | undefined = () => undefined,
 ): { run: PsqlRunner; stdins: string[]; argvs: Array<readonly string[]> } => {
   const stdins: string[] = [];
   const argvs: Array<readonly string[]> = [];
   return {
-    run: ({ stdin, argv }) => {
+    // The pin prefix (`search-path.ts`) is stripped: these tests assert the STATEMENT. The pin
+    // itself is asserted once, on the raw stdin, in `search-path.test.ts`.
+    run: ({ stdin: raw, argv }) => {
+      const stdin = stripPin(raw);
       stdins.push(stdin);
       argvs.push(argv);
-      return Promise.resolve({ code: 0, stdout: answers(stdin), stderr: '' });
+      const stderr = failOn(stdin);
+      return Promise.resolve(
+        stderr === undefined
+          ? { code: 0, stdout: answers(stdin), stderr: '' }
+          : { code: 3, stdout: '', stderr },
+      );
     },
     stdins,
     argvs,

package/src/postgres/search-path.test.ts

@@ -0,0 +1,100 @@
+/**
+ * The `search_path` pin (`search-path.ts`): every session this family opens starts with
+ * `SET search_path = pg_catalog, pg_temp`, on both transports, and the SQL builders only name
+ * catalogs as `pg_catalog.*`. The Opus read of PR 334 (2026-10-02) found that a role allowed to
+ * create objects in a schema on the path could forge `pg_namespace` and fake the delete proof.
+ */
+import { readFileSync, readdirSync } from 'node:fs';
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { currentDatabase } from './schema-sql.ts';
+import { makePsqlExecutor } from './psql-executor.ts';
+import { PIN_SCRIPT_PREFIX, PIN_SEARCH_PATH_SQL } from './search-path.ts';
+
+describe('runner transport', () => {
+  const target = { database: 'postgres', username: 'postgres' };
+  const record = () => {
+    const stdins: string[] = [];
+    const run = ({ stdin }: { stdin: string }) => {
+      stdins.push(stdin);
+      return Promise.resolve({ code: 0, stdout: '[]', stderr: '' });
+    };
+    return { stdins, run };
+  };
+
+  test('a read starts with the pin, in the same psql session as the statement', async () => {
+    const { stdins, run } = record();
+    await Effect.runPromise(currentDatabase(makePsqlExecutor(run, target)));
+    expect(stdins).toHaveLength(1);
+    expect(stdins[0]?.startsWith('SET search_path = pg_catalog, pg_temp;\n')).toBe(true);
+    expect(stdins[0]?.startsWith(PIN_SCRIPT_PREFIX)).toBe(true);
+  });
+
+  test('a write and a transaction start with the pin too', async () => {
+    const { stdins, run } = record();
+    const pg = makePsqlExecutor(run, target);
+    await Effect.runPromise(pg.unsafe('COMMENT ON SCHEMA "a" IS E\'b\''));
+    await Effect.runPromise(pg.transaction(['CREATE ROLE "r"']));
+    expect(stdins).toHaveLength(2);
+    for (const stdin of stdins) expect(stdin.startsWith(PIN_SCRIPT_PREFIX)).toBe(true);
+    // The pin comes BEFORE `BEGIN`: it is a session setting, not part of the transaction.
+    expect(stdins[1]).toBe(`${PIN_SCRIPT_PREFIX}BEGIN;\nCREATE ROLE "r";\nCOMMIT;`);
+  });
+
+  test('the pin is the one statement text both transports share', () => {
+    expect(PIN_SEARCH_PATH_SQL).toBe('SET search_path = pg_catalog, pg_temp');
+  });
+});
+
+/** Every hand-written SQL builder in this family. The `*errors.ts` files are excluded: they name
+ * catalogs in error-message PROSE, which no server ever parses. The fakes match on the qualified
+ * text the builders emit, so their own tests pin them. */
+const sources = readdirSync(import.meta.dir).filter(
+  (f) =>
+    f.endsWith('.ts') &&
+    !f.endsWith('.test.ts') &&
+    !f.startsWith('fake-') &&
+    !/errors?\.ts$/.test(f),
+);
+const CATALOGS =
+  /(?<![\w.])(pg_(?:namespace|class|proc|type|operator|roles|authid|auth_members|database|tablespace|attribute|default_acl|depend|constraint|trigger|rewrite|attrdef|policy))\b/g;
+
+describe('catalog references', () => {
+  test('no SQL builder names a catalog without the pg_catalog. qualifier', () => {
+    const offenders: string[] = [];
+    for (const file of sources) {
+      const text = readFileSync(`${import.meta.dir}/${file}`, 'utf8');
+      // Only template/quoted SQL is judged: skip comment lines and `'pg_namespace'` literals
+      // (an `obj_description` class argument is a string, not a relation reference).
+      for (const [index, line] of text.split('\n').entries()) {
+        const trimmed = line.trim();
+        if (/^(\/\/|\*|\/\*)/.test(trimmed)) continue;
+        for (const match of line.matchAll(CATALOGS)) {
+          const before = line[(match.index ?? 0) - 1];
+          if (before === "'" || before === '`') continue;
+          offenders.push(`${file}:${String(index + 1)} ${match[1] ?? ''}`);
+        }
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+
+  test('the scan sees the catalogs it is meant to police', () => {
+    const joined = sources.map((f) => readFileSync(`${import.meta.dir}/${f}`, 'utf8')).join('\n');
+    for (const needle of [
+      'pg_catalog.pg_namespace',
+      'pg_catalog.pg_class',
+      'pg_catalog.pg_depend',
+      'pg_catalog.pg_roles',
+      'pg_catalog.pg_database',
+    ]) {
+      expect(joined).toContain(needle);
+    }
+  });
+
+  test('the scan itself fails on an unqualified reference', () => {
+    const bad = '  FROM pg_namespace n\n  JOIN pg_catalog.pg_class c ON true';
+    const hits = [...bad.matchAll(CATALOGS)].map((m) => m[1]);
+    expect(hits).toEqual(['pg_namespace']);
+  });
+});

package/src/postgres/search-path.ts

@@ -0,0 +1,62 @@
+/**
+ * The session setup every `Postgres.*` connection runs first: `search_path = pg_catalog, pg_temp`.
+ *
+ * ⛔ AN UNPINNED SESSION READS ITS OWN CATALOGS THROUGH `search_path`. Postgres searches
+ *   `pg_catalog` first only while the path does not NAME it (ddl.sgml 5.10.3); a role- or
+ *   database-level `ALTER … SET search_path = public, pg_catalog` (or a path naming any schema
+ *   another role may create in) puts a writable schema ahead of it, and a `public.pg_namespace`
+ *   TABLE then answers the delete proof's `oid`/`owner` re-read. Found by the Opus read of PR 334
+ *   (2026-10-02). The pin makes the order ours whatever the role, database or server says; the SQL
+ *   builders ALSO write `pg_catalog.<name>` (`catalog-qualified.test.ts` greps for it), so no
+ *   single layer is the whole defence.
+ * ★ `pg_temp` goes LAST on purpose: unnamed, it is searched FIRST for relations.
+ * ★ TWO TRANSPORTS, TWO MECHANISMS. The runner path prefixes the stdin script: `psql` argv is
+ *   the consumer's to join into a remote command, and a value with a space would split. The
+ *   socket path pins the ONE connection an operation reserves, because the driver's startup
+ *   message carries user, database and application_name only (`PgConnection.ts`, 4.0.0-rc.115)
+ *   and a pool hands each statement a different, unpinned connection.
+ */
+import type { PgClient } from '@effect/sql-pg/PgClient';
+import * as Effect from 'effect/Effect';
+import type * as Scope from 'effect/Scope';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { PgExecutor } from './database-sql.ts';
+
+export const PIN_SEARCH_PATH_SQL = 'SET search_path = pg_catalog, pg_temp';
+
+/** The runner path's script prefix. */
+export const PIN_SCRIPT_PREFIX = `${PIN_SEARCH_PATH_SQL};\n`;
+
+/** A runner stdin without its pin — for tests that assert the statement that follows it. */
+export const stripPin = (stdin: string): string =>
+  stdin.startsWith(PIN_SCRIPT_PREFIX) ? stdin.slice(PIN_SCRIPT_PREFIX.length) : stdin;
+
+/**
+ * A `PgExecutor` over ONE reserved, pinned connection, for the life of the surrounding scope.
+ * `unsafe` runs on it (the client routes any statement under `transactionService` to that
+ * connection, so spans and error classification stay the driver's); `transaction` is a plain
+ * `BEGIN` … `COMMIT` on it — `withTransaction` would open a SAVEPOINT, because the service is
+ * already provided. A failure rolls back, and the pin is re-asserted by the next operation's own
+ * reservation, never assumed to survive one.
+ */
+export const pinnedSocketExecutor = (
+  pg: PgClient,
+): Effect.Effect<PgExecutor, SqlError, Scope.Scope> =>
+  Effect.gen(function* () {
+    const connection = yield* pg.reserve;
+    const run = <A extends object>(sql: string, params?: ReadonlyArray<unknown>) =>
+      Effect.provideService(pg.unsafe<A>(sql, params), pg.transactionService, [connection, 0]);
+    yield* run(PIN_SEARCH_PATH_SQL);
+    return {
+      unsafe: run,
+      transaction: (statements) =>
+        Effect.gen(function* () {
+          yield* run('BEGIN');
+          for (const sql of statements) yield* run(sql);
+          yield* run('COMMIT');
+        }).pipe(
+          Effect.onError(() => run('ROLLBACK').pipe(Effect.ignore)),
+          Effect.asVoid,
+        ),
+    };
+  });

package/src/proxmox/generated/constraints/index.ts

@@ -54,4 +54,4 @@ export const PROXMOX_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>>
  * ★ A DIGEST OF THE DATA, NOT OF THE FILE TEXT, so reformatting is not a stale generation while
  *   changing a 128 to a 129 by hand is. `tests/schema-manifest.test.ts` recomputes it.
  */
-export const PROXMOX_CONSTRAINTS_DIGEST = '8b6745a471839974';
+export const PROXMOX_CONSTRAINTS_DIGEST = 'cbf63b7bac0500ef';

package/src/proxmox/generated/constraints/pve-access.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-backup.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-ceph.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-firewall.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-ha.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-metrics.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-notifications.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-replication.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-sdn.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-ceph.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-disks.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-lxc.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-network.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-qemu.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *
@@ -122,4 +122,9 @@ export const PVE_NODES_QEMU_CONSTRAINTS: Readonly<Record<string, EndpointConstra
     "vmstatestorage": {"format":"pve-storage-id","type":"string"},
     "watchdog": {"format":"pve-qm-watchdog","type":"string"},
   },
+  "pve:PUT /nodes/{node}/qemu/{vmid}/resize": {
+    "digest": {"maxLength":40,"type":"string"},
+    "disk": {"enum":["ide0","ide1","ide2","ide3","scsi0","scsi1","scsi2","scsi3","scsi4","scsi5","scsi6","scsi7","scsi8","scsi9","scsi10","scsi11","scsi12","scsi13","scsi14","scsi15","scsi16","scsi17","scsi18","scsi19","scsi20","scsi21","scsi22","scsi23","scsi24","scsi25","scsi26","scsi27","scsi28","scsi29","scsi30","virtio0","virtio1","virtio2","virtio3","virtio4","virtio5","virtio6","virtio7","virtio8","virtio9","virtio10","virtio11","virtio12","virtio13","virtio14","virtio15","sata0","sata1","sata2","sata3","sata4","sata5","efidisk0","tpmstate0"],"required":true,"type":"string"},
+    "size": {"pattern":"^\\+?\\d+(\\.\\d+)?[KMGT]?\\n?$","patternSource":"\\+?\\d+(\\.\\d+)?[KMGT]?","required":true,"type":"string"},
+  },
 };

package/src/proxmox/generated/constraints/pve-nodes-storage.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-pools.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-storage.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/index.ts

@@ -113,6 +113,7 @@ export {
 export { provisionBootstrap } from './provision-bootstrap.ts';
 export { type DeclareProvisionOptions, declareProvisionBaseline } from './provision-declare.ts';
 export { ProxmoxVm, ProxmoxVmProvider, type VmAttributes, type VmProps } from './qemu.ts';
+export { QemuDiskResizeRefused } from './qemu-size.ts';
 export {
   ProxmoxStorageDownload,
   ProxmoxStorageDownloadProvider,

package/src/proxmox/qemu-dns.test.ts

@@ -0,0 +1,73 @@
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { FAKE_TARGET, fakePve, withoutBao } from './fake-pve.ts';
+import { createForm, formRefusals, updateForm } from './qemu-form.ts';
+import { judge } from './qemu-judge.ts';
+import { qemuHandlers } from './qemu-lifecycle.ts';
+import { storedConfig } from './qemu-props.ts';
+
+const base = { target: FAKE_TARGET, node: 'n2', vmid: 10000 };
+const props = { ...base, nameserver: '10.20.16.254', searchdomain: 'example.internal' };
+
+test('cloud-init DNS survives form rendering, stored attributes and per-key diff', () => {
+  const config = { nameserver: props.nameserver, searchdomain: props.searchdomain };
+  expect(createForm(props)).toEqual({ ...config, vmid: '10000' });
+  expect(updateForm(props)).toEqual(config);
+  expect(storedConfig(config)).toEqual(config);
+  expect(judge(props, config)).toEqual({ drift: [], put: {}, refuse: [] });
+  expect(judge({ ...props, nameserver: '10.20.16.1' }, config)).toEqual({
+    drift: ['nameserver'],
+    put: { nameserver: '10.20.16.1' },
+    refuse: [],
+  });
+  expect(judge({ ...props, searchdomain: 'new.internal' }, config).put).toEqual({
+    searchdomain: 'new.internal',
+  });
+  expect(judge(base, config).drift).toEqual([]);
+});
+
+test('address-list follows PVE: IPs, DNS names, separators and empty lists', () => {
+  for (const nameserver of [
+    '',
+    '10.20.16.254',
+    '2001:db8::53',
+    'dns.example.internal',
+    '10.20.16.254, 2001:db8::53;dns.example.internal',
+    '10.20.16.254\0dns.example.internal',
+  ]) {
+    expect(formRefusals({ ...base, nameserver }), nameserver).toEqual([]);
+  }
+  for (const nameserver of [
+    'https://dns.example',
+    '10.20.16.254/24',
+    '[2001:db8::53]',
+    '-bad.example',
+    'bad_.example',
+    '2001:db8::broken',
+    'dns.example.',
+  ]) {
+    expect(formRefusals({ ...base, nameserver })[0], nameserver).toContain('address-list');
+  }
+});
+
+test('invalid DNS fails with a typed refusal before any live read or write', async () => {
+  const fake = fakePve(() => {
+    throw new Error('unexpected API call');
+  });
+  await withoutBao(async () => {
+    const refusal = await Effect.runPromise(
+      qemuHandlers
+        .diff({
+          news: { ...props, nameserver: 'dns://invalid' },
+          olds: base,
+          output: undefined,
+        })
+        .pipe(
+          Effect.catchTag('QemuRefusedError', (error) => Effect.succeed(error.message)),
+          Effect.provide(fake.layer),
+        ),
+    );
+    expect(refusal).toBe('nameserver: must satisfy the vendor address-list format');
+  });
+  expect(fake.calls).toEqual([]);
+});

package/src/proxmox/qemu-dns.ts

@@ -0,0 +1,32 @@
+/** Cloud-init's one named format, checked against the vendor table and validator source. */
+import { isIP } from 'node:net';
+import { constraintsFor } from './constraint-guard.ts';
+
+/**
+ * PVE::JSONSchema pve_verify_address/check_format and PVE::ParseUtils split_list,
+ * proxmox/pve-common@defd246f31f327463f901a2daaf8dc52efcc5a97 (read 2026-10-05).
+ * https://github.com/proxmox/pve-common/blob/defd246f31f327463f901a2daaf8dc52efcc5a97/src/PVE/JSONSchema.pm
+ * ★ `address` permits DNS names too; an IP-only check would reject vendor-valid declarations.
+ * Empty lists are allowed. NUL-separated lists take precedence over whitespace/comma/semicolon.
+ * This supplements the PVE 9.2.11 schema's named format; it does not invent a DNS-server limit.
+ */
+const addressList = (value: string): boolean => {
+  const values = value.includes('\0')
+    ? value.split('\0')
+    : value.replace(/[,;]/g, ' ').trimStart().split(/\s+/);
+  // Perl split drops trailing empty elements, but retains interior empty elements.
+  while (values.at(-1) === '') values.pop();
+  const label = '[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?';
+  const dns = new RegExp(`^(?:${label}\\.)*${label}(?![\\s\\S])`);
+  return values.every((value) => (isIP(value) !== 0 && !value.includes('%')) || dns.test(value));
+};
+
+export const dnsRefusals = (nameserver: unknown): string[] => {
+  if (nameserver === undefined) return [];
+  const rule = constraintsFor('pve:PUT /nodes/{node}/qemu/{vmid}/config')['nameserver'];
+  return rule?.format === 'address-list' &&
+    typeof nameserver === 'string' &&
+    addressList(nameserver)
+    ? []
+    : ['nameserver: must satisfy the vendor address-list format'];
+};

package/src/proxmox/qemu-errors.ts

@@ -1,5 +1,6 @@
 /** A QEMU write or observation this provider will not turn into a create or a delete. */
 export class QemuRefusedError extends Error {
+  readonly _tag = 'QemuRefusedError';
   constructor(message: string) {
     super(message);
     this.name = 'QemuRefusedError';

package/src/proxmox/qemu-form.ts

@@ -13,16 +13,19 @@ import {
   isManagedKey,
   wireValue,
 } from './qemu-props.ts';
+import { dnsRefusals } from './qemu-dns.ts';
 
 /**
  * Why a declared key cannot go on the wire, checked before every create and every update.
  * ★ THE SAME RULE `lxc-create-form.ts` ENFORCES FOR `Proxmox.Lxc`: a key smuggled past the types
  *   (a cast, a JS caller) is refused here rather than silently dropped or silently sent.
  */
-export const formRefusals = (props: VmProps): string[] =>
-  declaredKeys(props)
+export const formRefusals = (props: VmProps): string[] => [
+  ...declaredKeys(props)
     .filter((key) => !isManagedKey(key))
-    .map((key) => `${key}: not a config key this resource manages (vmid ${String(props.vmid)}).`);
+    .map((key) => `${key}: not a config key this resource manages (vmid ${String(props.vmid)}).`),
+  ...dnsRefusals(props.nameserver),
+];
 
 /** The declared config, wire-spelled — every key `formRefusals` did not already refuse. */
 export const form = (props: VmProps): Record<string, string> => {

package/src/proxmox/qemu-judge.ts

@@ -13,6 +13,7 @@
 import { type VmProps, declaredKeys, declaredValue, indexedKey, wireValue } from './qemu-props.ts';
 import { judgeDisk } from './qemu-volume.ts';
 import { netWrite, sameNet } from './qemu-net.ts';
+import { diskSizeDrift } from './qemu-size.ts';
 
 export type VmChange = {
   /** Keys to `PUT …/config`, wire-spelled and built on live ids where one exists. */
@@ -26,7 +27,7 @@ export type VmChange = {
 export const judge = (props: VmProps, config: Record<string, string>): VmChange => {
   const put: Record<string, string> = {};
   const refuse: string[] = [];
-  const drift = new Set<string>();
+  const drift = new Set<string>(diskSizeDrift(props, config));
 
   for (const key of declaredKeys(props)) {
     const want = wireValue(declaredValue(props, key));