@homeflare/alchemy 0.8.0 → 0.10.0

package/src/proxmox/lxc-create.test.ts

@@ -0,0 +1,126 @@
+/**
+ * Declaring a NEW container, and removing one, through the real engine over fake-pve-lxc.ts.
+ *
+ * ⛔ WHAT THESE PIN: a create POSTs once, waits for its task, reads back what PVE allocated and
+ *   then plans `noop` against it; a create an API token cannot finish (no template, device
+ *   passthrough, a bind mount) fails before any write; dropping the declaration retains the guest;
+ *   and only `RemovalPolicy.destroy()` sends the DELETE.
+ */
+import { afterEach, describe, expect, test } from 'bun:test';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Effect from 'effect/Effect';
+import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
+import { TARGET, lxcEngine } from './lxc-harness.ts';
+import { ProxmoxLxc } from './lxc.ts';
+import type { LxcProps } from './lxc-props.ts';
+
+const NODE = 'pve1';
+const VMID = 150;
+
+const door = (over: Partial<LxcProps> = {}): LxcProps => ({
+  cores: 1,
+  features: 'nesting=1',
+  hostname: 'door-example',
+  memory: 512,
+  net0: 'name=eth0,bridge=vmbr0,ip=192.0.2.20/24,gw=192.0.2.1',
+  node: NODE,
+  onboot: 1,
+  ostemplate: 'local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst',
+  rootfs: 'local-zfs:8',
+  start: 1,
+  tags: 'Vault;door',
+  target: TARGET,
+  vmid: VMID,
+  ...over,
+});
+
+let fake: FakePve | undefined;
+afterEach(() => {
+  fake?.stop();
+  fake = undefined;
+});
+const empty = () => {
+  fake = fakePve();
+  return fake;
+};
+
+describe('creating a container', () => {
+  test('one POST, then the next plan is noop against what PVE allocated', async () => {
+    const pve = empty();
+    const stack = lxcEngine(pve);
+    const created = await stack.deploy(ProxmoxLxc('door', door()));
+    expect(created.actions).toEqual({ door: 'create' });
+    expect(created.failure).toBe('');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+    const post = pve.seen.find((call) => call.method === 'POST')?.form;
+    expect(post?.get('rootfs')).toBe('local-zfs:8');
+    expect(post?.get('start')).toBe('1');
+    expect(post?.get('password')).toBeNull();
+    const live = pve.guests.get(`${NODE}/${String(VMID)}`);
+    expect(live?.['rootfs']).toBe(`local-zfs:subvol-${String(VMID)}-disk-0,size=8G`);
+    expect(live?.['net0']).toContain('hwaddr=');
+    expect((await stack.plan(ProxmoxLxc('door', door()))).actions).toEqual({ door: 'noop' });
+  });
+
+  test.each([
+    ['no template', { ostemplate: '' }, /nothing to create it from/],
+    ['device passthrough', { dev0: '/dev/net/tun' }, /pct set 150 --dev0/],
+    ['a bind mount', { mp0: '/srv/share,mp=/share' }, /bind or device mount point/],
+    ['a feature beyond nesting', { features: 'nesting=1,keyctl=1' }, /other than nesting/],
+  ])('refused before any write: %s', async (_, over, reason) => {
+    const pve = empty();
+    const run = await lxcEngine(pve).deploy(ProxmoxLxc('door', door(over as Partial<LxcProps>)));
+    expect(run.failure).toMatch(reason);
+    expect(writesOf(pve)).toEqual([]);
+  });
+});
+
+describe('removing a container', () => {
+  test('retain is the default: dropping the declaration sends no DELETE', async () => {
+    const pve = empty();
+    const stack = lxcEngine(pve);
+    await stack.deploy(ProxmoxLxc('door', door()));
+    expect((await stack.deploy(Effect.void)).failure).toBe('');
+    expect(stack.status('door')).toBeUndefined();
+    expect(pve.guests.has(`${NODE}/${String(VMID)}`)).toBe(true);
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+  });
+
+  test('RemovalPolicy.destroy() reaches the DELETE, and waits for its task', async () => {
+    const pve = empty();
+    const stack = lxcEngine(pve);
+    await stack.deploy(ProxmoxLxc('door', door()).pipe(RemovalPolicy.destroy()));
+    expect((await stack.deploy(Effect.void)).failure).toBe('');
+    expect(pve.guests.has(`${NODE}/${String(VMID)}`)).toBe(false);
+    expect(writesOf(pve)).toEqual([
+      `POST nodes/${NODE}/lxc`,
+      `DELETE nodes/${NODE}/lxc/${String(VMID)}`,
+    ]);
+    expect(pve.seen.some((call) => /\/tasks\/UPID:.*vzdestroy/.test(call.path))).toBe(true);
+    // ⛔ No `force` (stops a running guest), `purge` (drops it from HA and backup jobs) or
+    //   `destroy-unreferenced-disks` (deletes volumes the config does not even name).
+    const del = pve.seen.find((call) => call.method === 'DELETE');
+    expect(del?.form.toString()).toBe('');
+  });
+
+  test('destroy() refuses a guest that no longer matches: the vmid may be somebody else’s', async () => {
+    const pve = empty();
+    const stack = lxcEngine(pve);
+    await stack.deploy(ProxmoxLxc('door', door()).pipe(RemovalPolicy.destroy()));
+    const live = pve.guests.get(`${NODE}/${String(VMID)}`) ?? {};
+    live['hostname'] = 'someone-else';
+    const run = await stack.deploy(Effect.void);
+    expect(run.failure).toContain('no longer matches its last declaration (hostname)');
+    expect(pve.guests.has(`${NODE}/${String(VMID)}`)).toBe(true);
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+  });
+
+  test('a changed vmid is refused, never a second guest', async () => {
+    const pve = empty();
+    const stack = lxcEngine(pve);
+    await stack.deploy(ProxmoxLxc('door', door()));
+    const run = await stack.plan(ProxmoxLxc('door', door({ vmid: VMID + 1 })));
+    expect(run.failure).toContain('is a different guest');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+  });
+});

package/src/proxmox/lxc-guards.test.ts

@@ -0,0 +1,158 @@
+/**
+ * The guards an adversarial review found untested or missing, through the real engine over
+ * fake-pve-lxc.ts: each test here failed against a mutant of the guard it names (2026-09-21).
+ *
+ * ⛔ WHAT THESE PIN: a guest the cluster lost is named at plan before a deploy rebuilds it; a task
+ *   that fails, or answers no UPID, is a failed deploy; a write PVE accepted but did not store is
+ *   caught by the read-back; a new template is refused; an options change on a volume that also
+ *   grows keeps the live size in the PUT and resizes after it; and a vmid PVE spells as a string
+ *   is still "listed". Whose guest it is: lxc-ownership.test.ts.
+ */
+import { afterEach, describe, expect, test } from 'bun:test';
+import { adopt } from 'alchemy/AdoptPolicy';
+import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
+import { LIVE, TARGET, lxcEngine, seed } from './lxc-harness.ts';
+import { ProxmoxLxc } from './lxc.ts';
+import type { LxcProps } from './lxc-props.ts';
+
+const NODE = 'pve1';
+const VMID = 100;
+const KEY = `${NODE}/${String(VMID)}`;
+const TEMPLATE = 'local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst';
+
+const pasted = (over: Partial<LxcProps> = {}): LxcProps => {
+  const { lxc: _raw, ...config } = LIVE;
+  return { ...(config as Partial<LxcProps>), node: NODE, target: TARGET, vmid: VMID, ...over };
+};
+
+let fake: FakePve | undefined;
+afterEach(() => {
+  fake?.stop();
+  fake = undefined;
+});
+const cluster = () => {
+  fake = fakePve();
+  return fake;
+};
+
+describe('a guest the cluster no longer lists, with state still held', () => {
+  test('with a template: the plan warns it will be created again, and the deploy does', async () => {
+    const pve = cluster();
+    seed(pve, NODE, VMID);
+    const stack = lxcEngine(pve);
+    // ⚠️ Without the devices (a token cannot create passthrough), and with the NEW-disk
+    //   spellings, which compare equal to the live volumes but can only allocate fresh ones.
+    const rebuildable = pasted({
+      dev0: undefined,
+      dev1: undefined,
+      mp0: 'tank:200,mp=/data',
+      ostemplate: TEMPLATE,
+      rootfs: 'local-zfs:40',
+    });
+    const declared = () => ProxmoxLxc('ct', rebuildable).pipe(adopt(true));
+    expect((await stack.deploy(declared())).failure).toBe('');
+    pve.guests.delete(KEY);
+    const planned = await stack.plan(declared());
+    expect(planned.actions).toEqual({ ct: 'update' });
+    expect(planned.warnings.join('\n')).toContain('CREATES it again from ostemplate');
+    expect((await stack.deploy(declared())).failure).toBe('');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+  });
+
+  test('declared by live volume ids: refused, never a template unpacked onto them', async () => {
+    const pve = cluster();
+    seed(pve, NODE, VMID);
+    const stack = lxcEngine(pve);
+    const declared = () =>
+      ProxmoxLxc('ct', pasted({ dev0: undefined, dev1: undefined, ostemplate: TEMPLATE })).pipe(
+        adopt(true),
+      );
+    expect((await stack.deploy(declared())).failure).toBe('');
+    pve.guests.delete(KEY);
+    const run = await stack.deploy(declared());
+    expect(run.failure).toContain('rootfs: local-zfs:subvol-100-disk-0,size=40G names an existing');
+    expect(run.failure).toContain('mp0: tank:subvol-100-disk-0');
+    expect(writesOf(pve)).toEqual([]);
+  });
+
+  test('without one: the plan fails, rather than planning an update the deploy cannot make', async () => {
+    const pve = cluster();
+    seed(pve, NODE, VMID);
+    const stack = lxcEngine(pve);
+    expect((await stack.deploy(ProxmoxLxc('ct', pasted()).pipe(adopt(true)))).failure).toBe('');
+    pve.guests.delete(KEY);
+    expect((await stack.plan(ProxmoxLxc('ct', pasted()))).failure).toContain(
+      'nothing to create it from',
+    );
+  });
+});
+
+describe('a write is claimed only when PVE says it finished', () => {
+  const door = () =>
+    ProxmoxLxc('door', {
+      node: NODE,
+      ostemplate: TEMPLATE,
+      rootfs: 'local-zfs:8',
+      target: TARGET,
+      vmid: 150,
+    });
+
+  test('a create task that ends in an error fails the deploy, naming the task', async () => {
+    const pve = cluster();
+    pve.task.exit = 'unable to create CT 150 - command failed';
+    const run = await lxcEngine(pve).deploy(door());
+    expect(run.failure).toContain('ended "unable to create CT 150 - command failed"');
+  });
+
+  test('a create answered with no UPID fails the deploy', async () => {
+    const pve = cluster();
+    pve.task.noUpid = true;
+    expect((await lxcEngine(pve).deploy(door())).failure).toContain('returned no task id');
+  });
+
+  test('a config write PVE accepted but did not store fails the read-back', async () => {
+    const pve = cluster();
+    seed(pve, NODE, VMID);
+    pve.ignore.add('memory');
+    const run = await lxcEngine(pve).deploy(
+      ProxmoxLxc('ct', pasted({ memory: 4096 })).pipe(adopt(true)),
+    );
+    expect(run.failure).toContain('memory still differ');
+  });
+});
+
+describe('identity and volumes', () => {
+  test('another template for a guest that exists is refused at plan', async () => {
+    const pve = cluster();
+    seed(pve, NODE, VMID);
+    const stack = lxcEngine(pve);
+    await stack.deploy(ProxmoxLxc('ct', pasted({ ostemplate: TEMPLATE })).pipe(adopt(true)));
+    const run = await stack.plan(
+      ProxmoxLxc('ct', pasted({ ostemplate: 'local:vztmpl/other.tar.zst' })),
+    );
+    expect(run.failure).toContain('a template is consumed at create');
+    expect(writesOf(pve)).toEqual([]);
+  });
+
+  test('options and growth on one volume: the PUT keeps the live size, the resize follows', async () => {
+    const pve = cluster();
+    seed(pve, NODE, VMID);
+    const mp0 = 'tank:subvol-100-disk-0,mp=/data,backup=1,size=300G';
+    const run = await lxcEngine(pve).deploy(ProxmoxLxc('ct', pasted({ mp0 })).pipe(adopt(true)));
+    expect(run.failure).toBe('');
+    const path = `nodes/${NODE}/lxc/${String(VMID)}`;
+    expect(writesOf(pve)).toEqual([`PUT ${path}/config`, `PUT ${path}/resize`]);
+    const put = pve.seen.find((call) => call.path.endsWith('/config') && call.method === 'PUT');
+    expect(put?.form.get('mp0')).toBe('tank:subvol-100-disk-0,mp=/data,backup=1,size=200G');
+    expect(pve.guests.get(KEY)?.['mp0']).toContain('size=300G');
+  });
+
+  test('a vmid the cluster spells as a string is still listed, never absent', async () => {
+    const pve = cluster();
+    pve.others.push({ node: 'pve2', type: 'qemu', vmid: '101' });
+    const run = await lxcEngine(pve).plan(
+      ProxmoxLxc('ct', pasted({ ostemplate: TEMPLATE, vmid: 101 })),
+    );
+    expect(run.failure).toContain('vmid 101 is a qemu on pve2');
+  });
+});

package/src/proxmox/lxc-harness.ts

@@ -0,0 +1,150 @@
+/**
+ * Alchemy's real `Plan.make` and `apply` over fake-pve-lxc.ts, for the `Proxmox.Lxc` tests — the
+ * mesh-node-harness.ts composition, with plan-only runs added because the adoption gate is a PLAN.
+ *
+ * ⛔ TEST-ONLY. No provider imports this file and it is not on the barrel.
+ * ⛔ THE SHELL'S OPENBAO VARIABLES ARE REPLACED FOR THE LIFE OF EACH RUN. `mint` reads
+ *   `BAO_AGENT_ADDR` before `BAO_ADDR`, and `BAO_TOKEN` rides every mint as a header; a developer
+ *   shell with either set would otherwise send its real token to the fake, or its mint to a real
+ *   agent. fake-bao-env.ts clears every BAO_* / VAULT_*, points BAO_ADDR at the fake, and
+ *   restores them afterwards.
+ * ★ WARNINGS ARE CAPTURED, because the drift warning in lxc.ts is the only thing a cold adoption
+ *   plan says about a declaration that does not match yet (the plan itself reads `adopted`).
+ * ★ ONE ARTIFACT STORE ACROSS A PLAN AND ITS APPLY, and `--adopt` as the AdoptPolicy service, as
+ *   openbao/fake-stack.ts provides them: the ownership rule reads both (src/ownership/).
+ */
+import { AdoptPolicy } from 'alchemy/AdoptPolicy';
+import { apply } from 'alchemy/Apply';
+import { provideFreshArtifactStore } from 'alchemy/Artifacts';
+import * as Plan from 'alchemy/Plan';
+import { type CompiledStack, make as makeStack } from 'alchemy/Stack';
+import { Stage } from 'alchemy/Stage';
+import * as State from 'alchemy/State';
+import * as Cause from 'effect/Cause';
+import * as Effect from 'effect/Effect';
+import * as Exit from 'effect/Exit';
+import * as Layer from 'effect/Layer';
+import * as Logger from 'effect/Logger';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import type { PveTarget } from './credentials.ts';
+import { withFakeBao } from './fake-bao-env.ts';
+import { FAKE_BAO, FAKE_MEMBER, type FakePve } from './fake-pve-lxc.ts';
+import { ProxmoxLxcProvider } from './lxc.ts';
+
+export const TARGET: PveTarget = {
+  members: [FAKE_MEMBER],
+  mount: 'proxmox-lxc-test',
+  scheme: 'pve',
+};
+
+/**
+ * A PRODUCTION-SHAPED config — the same keys and the same spellings pvesh printed, PVE's defaults
+ * written out — with every VALUE a placeholder: TEST-NET addresses, RFC 7042 documentation MACs,
+ * and a made-up pool, VLAN, mount path, gid and sizes.
+ * ⛔ SHAPE ONLY. This file ships in the npm tarball (`files` includes `src`), so nothing here may be
+ *   the estate's real topology — sizes, VLANs and bridges included, not only addresses.
+ */
+export const LIVE: Readonly<Record<string, unknown>> = {
+  arch: 'amd64',
+  cores: 4,
+  dev0: '/dev/dri/renderD128,uid=0,gid=44,mode=0660',
+  dev1: '/dev/net/tun,uid=0,gid=0,mode=0666',
+  features: 'nesting=1',
+  hostname: 'ct-example',
+  lxc: [['lxc.prlimit.memlock', 'unlimited']],
+  memory: 8192,
+  mp0: 'tank:subvol-100-disk-0,mp=/data,backup=0,size=200G',
+  nameserver: '192.0.2.254',
+  net0:
+    'name=eth0,bridge=vmbr0,firewall=0,gw=192.0.2.1,hwaddr=00:00:5E:00:53:01,' +
+    'ip=192.0.2.10/24,mtu=1500,tag=42,type=veth',
+  net1: 'name=eth1,bridge=vmbr1,hwaddr=00:00:5E:00:53:02,ip=198.51.100.4/24,mtu=1500,type=veth',
+  onboot: 1,
+  ostype: 'debian',
+  rootfs: 'local-zfs:subvol-100-disk-0,size=40G',
+  searchdomain: 'example.com',
+  swap: 0,
+  tags: 'web',
+  unprivileged: 1,
+};
+
+/** Put `config` live on the fake as `node/vmid`, with a digest as PVE would add. */
+export const seed = (fake: FakePve, node: string, vmid: number, config = LIVE) => {
+  fake.guests.set(`${node}/${String(vmid)}`, { ...config, digest: 'digest-live' });
+};
+
+type Planned = { readonly action: string };
+type PlanView = {
+  readonly resources: Readonly<Record<string, Planned>>;
+  readonly deletions: Readonly<Record<string, Planned | undefined>>;
+};
+
+/** What the CLI would set for one run: `adopt` is `--adopt`. */
+export type RunOptions = { readonly adopt?: boolean };
+
+export type Run = {
+  /** Planned action per FQN, deletions included; empty when the plan itself failed. */
+  readonly actions: Readonly<Record<string, string>>;
+  /** The failure sentence, or `''`. */
+  readonly failure: string;
+  readonly warnings: readonly string[];
+};
+
+const withBaoEnv = <A>(body: () => Promise<A>): Promise<A> => withFakeBao(FAKE_BAO, body);
+
+export const lxcEngine = (fake: FakePve) => {
+  const rows: Record<string, Record<string, Record<string, State.ResourceState>>> = {};
+  const state = Layer.succeed(State.State, State.InMemoryService(rows));
+  const providers = ProxmoxLxcProvider().pipe(Layer.provideMerge(FetchHttpClient.layer));
+  const run = (
+    declare: Effect.Effect<unknown, unknown, unknown>,
+    write: boolean,
+    options: RunOptions,
+  ) =>
+    withBaoEnv(async (): Promise<Run> => {
+      const warnings: string[] = [];
+      const collect = Logger.make((options) => {
+        if (options.logLevel === 'Warn') warnings.push(String(options.message));
+      });
+      const exit = await Effect.runPromiseExit(
+        declare.pipe(
+          makeStack({ name: 'lxc', providers, state }) as never,
+          Effect.flatMap((compiled: CompiledStack) =>
+            Plan.make(compiled).pipe(
+              Effect.tap((planned) => (write ? apply(planned) : Effect.void)),
+              provideFreshArtifactStore,
+              Effect.provide(compiled.services),
+            ),
+          ),
+          options.adopt === undefined
+            ? (e) => e
+            : Effect.provideService(AdoptPolicy, options.adopt),
+          Effect.provide(Layer.succeed(Stage, 'test')),
+          Effect.provide(Logger.layer([collect])),
+          Effect.scoped,
+          Effect.provideService(FetchHttpClient.Fetch, fake.fetch),
+          // ⚠️ THE CAST IS AT THE ENGINE'S TYPED BOUNDARY (fake-stack.ts says why): the stack body
+          //   is typed against every service a CLI run provides, and this run provides the few it uses.
+        ) as unknown as Effect.Effect<PlanView, unknown>,
+      );
+      const actions: Record<string, string> = {};
+      if (Exit.isSuccess(exit)) {
+        for (const [fqn, node] of Object.entries(exit.value.resources)) actions[fqn] = node.action;
+        for (const [fqn, node] of Object.entries(exit.value.deletions)) {
+          if (node !== undefined) actions[fqn] = node.action;
+        }
+      }
+      const failure = Exit.isFailure(exit) ? String(Cause.squash(exit.cause)) : '';
+      return { actions, failure, warnings };
+    });
+  return {
+    /** Plan only — what `alchemy plan` shows. Nothing is applied and no state is written. */
+    plan: (declare: Effect.Effect<unknown, unknown, unknown>, options: RunOptions = {}) =>
+      run(declare, false, options),
+    /** Plan, then apply. */
+    deploy: (declare: Effect.Effect<unknown, unknown, unknown>, options: RunOptions = {}) =>
+      run(declare, true, options),
+    /** The stored row's status, or undefined when there is none. */
+    status: (fqn: string) => rows['lxc']?.['test']?.[fqn]?.status,
+  };
+};

package/src/proxmox/lxc-identity.ts

@@ -0,0 +1,43 @@
+/**
+ * What makes a `Proxmox.Lxc` a DIFFERENT guest: a new vmid, or another template. Judged by `diff`
+ * and `reconcile` in lxc.ts before anything else, and never planned as a replace — see lxc.ts.
+ */
+import type { LxcAttributes, LxcProps } from './lxc-props.ts';
+
+/** A prop's value if it is already plain data, else undefined (an unresolved Output). */
+const plain = (news: unknown, key: string): unknown => {
+  const value: unknown = (news as Record<string, unknown>)[key];
+  return typeof value === 'string' || typeof value === 'number' ? value : undefined;
+};
+
+/**
+ * ⛔ IDENTITY IS JUDGED BEFORE `isResolved(news)`. That guard returns early when ANY prop is still
+ *   an Output, and the engine then plans `update` — which, for a new vmid, would build a second
+ *   guest and orphan the first (the openbao rename lesson, rename.ts). A template is identity
+ *   too: it is consumed at create, so a different one is a different guest.
+ * ★ `node` IS NOT JUDGED HERE, BECAUSE A NODE CHANGE CAN BE THE DECLARATION CATCHING UP. HA fails
+ *   a guest over, or somebody runs `pct migrate`; the guest is on its new node before any line
+ *   says so. `readLive` at the declared node settles both cases: the guest is there (follow it,
+ *   and re-record state with a write-free update), or it is elsewhere and the read FAILS naming
+ *   where — asking to move a guest is a migration, and this resource does not migrate.
+ */
+export const identityRefusals = (
+  news: unknown,
+  olds: LxcProps,
+  output: LxcAttributes | undefined,
+): string[] => {
+  const was = output?.vmid ?? olds.vmid;
+  const vmid = plain(news, 'vmid');
+  const template = plain(news, 'ostemplate');
+  const reasons: string[] = [];
+  if (vmid !== undefined && vmid !== was) {
+    reasons.push(
+      `vmid: ${String(was)} -> ${String(vmid)} is a different guest. Declare it as a new ` +
+        'resource; this one is retained when its declaration goes.',
+    );
+  }
+  if (template !== undefined && olds.ostemplate !== undefined && template !== olds.ostemplate) {
+    reasons.push('ostemplate: a template is consumed at create; another one is a new guest.');
+  }
+  return reasons;
+};

package/src/proxmox/lxc-judge.test.ts

@@ -0,0 +1,175 @@
+/**
+ * The pure half of `Proxmox.Lxc`: which spellings are one value, what a change writes, and what is
+ * refused — no server. The engine-level tests beside this one prove the same rules survive plan
+ * and apply; these pin each rule on its own, with PVE's reason next to it.
+ */
+import { describe, expect, test } from 'bun:test';
+import { TARGET } from './lxc-harness.ts';
+import { createForm, createRefusals } from './lxc-create-form.ts';
+import { judge } from './lxc-judge.ts';
+import { type LxcProps, rawKeysOf, storedConfig } from './lxc-props.ts';
+import { judgeVolume, parseVolume, sizeBytes } from './lxc-volume.ts';
+
+const props = (over: Partial<LxcProps>): LxcProps => ({
+  node: 'pve1',
+  target: TARGET,
+  vmid: 100,
+  ...over,
+});
+const live = (config: Record<string, unknown>) => ({ unprivileged: 1, ...config });
+
+describe('sizes and volumes, as pve-container parses them', () => {
+  test('parse_size: binary units, bare bytes, and nothing else', () => {
+    expect(sizeBytes('40G')).toBe(40 * 1024 ** 3);
+    expect(sizeBytes('1.5T')).toBe(1.5 * 1024 ** 4);
+    expect(sizeBytes('512M')).toBe(512 * 1024 ** 2);
+    expect(sizeBytes('100')).toBe(100);
+    expect(sizeBytes('40GB')).toBeUndefined();
+  });
+
+  test('classify_mountpoint, plus the new-disk spelling', () => {
+    expect(parseVolume('local-zfs:40').kind).toBe('new');
+    expect(parseVolume('local-zfs:subvol-1-disk-0,size=40G').kind).toBe('volume');
+    expect(parseVolume('/srv/share,mp=/share').kind).toBe('bind');
+    expect(parseVolume('/dev/sdb1,mp=/disk').kind).toBe('device');
+  });
+
+  test('an options change on a volume declared as new is written with the LIVE volume id', () => {
+    const verdict = judgeVolume('mp0', 'tank:200,mp=/data,backup=1', LIVE_MP);
+    expect(verdict).toEqual({ put: 'tank:subvol-100-disk-0,mp=/data,backup=1,size=200G' });
+  });
+
+  test('a fractional new-disk size grows by the same GiB', () => {
+    expect(judgeVolume('mp0', 'tank:200.5,mp=/data', LIVE_MP)).toEqual({ resize: '200.5G' });
+  });
+});
+
+const LIVE_MP = 'tank:subvol-100-disk-0,mp=/data,backup=0,size=200G';
+
+describe('scalars compare the way PVE stores them', () => {
+  test.each([
+    [
+      'a description PVE handed back with a newline',
+      { description: 'hi' },
+      { description: 'hi\n' },
+    ],
+    ['tags in another order and case', { tags: 'B;a' }, { tags: 'a;b' }],
+    ['a default PVE leaves out', { onboot: 0, cpulimit: 0, swap: 512 }, {}],
+    ['startup with its default key bare', { startup: '1,up=30' }, { startup: 'order=1,up=30' }],
+    ['a boolean as true', { protection: true }, { protection: 1 }],
+    [
+      'features with an off key spelled out',
+      { features: 'nesting=1,keyctl=0' },
+      { features: 'nesting=1' },
+    ],
+  ])('%s is no drift', (_, declared, config) => {
+    expect(judge(props(declared as Partial<LxcProps>), live(config)).drift).toEqual([]);
+  });
+
+  test('cores absent means every host core, which no number is', () => {
+    expect(judge(props({ cores: 4 }), live({})).put).toEqual({ cores: '4' });
+  });
+
+  test('nameserver order is meaningful', () => {
+    const change = judge(props({ nameserver: 'b a' }), live({ nameserver: 'a b' }));
+    expect(change.put).toEqual({ nameserver: 'b a' });
+  });
+
+  test("'' clears a clearable key and refuses one that cannot be removed", () => {
+    expect(judge(props({ description: '' }), live({ description: 'x\n' })).clear).toEqual([
+      'description',
+    ]);
+    expect(judge(props({ hostname: '' }), live({ hostname: 'x' })).refuse[0]).toMatch(
+      /cannot be removed/,
+    );
+  });
+
+  test('a key this resource does not manage is refused, not written', () => {
+    const odd = props({}) as unknown as Record<string, unknown>;
+    odd['hookscript'] = 'local:snippets/x.sh';
+    expect(judge(odd as unknown as LxcProps, live({})).refuse[0]).toMatch(/not a config key/);
+  });
+});
+
+describe('features follow check_ct_modify_config_perm', () => {
+  test('nesting alone on an unprivileged guest is an update', () => {
+    expect(judge(props({ features: 'nesting=1' }), live({})).put).toEqual({
+      features: 'nesting=1',
+    });
+  });
+
+  test('any features write on a privileged guest is root@pam only', () => {
+    const change = judge(props({ features: 'nesting=1' }), { unprivileged: 0 });
+    expect(change.refuse[0]).toMatch(/root@pam/);
+    expect(change.put).toEqual({});
+  });
+
+  test('clearing features that hold more than nesting is root@pam only, as PVE counts keys', () => {
+    const change = judge(props({ features: '' }), live({ features: 'nesting=1,keyctl=0' }));
+    expect(change.refuse[0]).toMatch(/pct set 100 --delete features/);
+  });
+});
+
+describe('NICs and devices', () => {
+  test("net '' removes a NIC; a new NIC is added as declared", () => {
+    const change = judge(props({ net1: '', net2: 'name=eth2,bridge=vmbr1' }), live({ net1: 'x' }));
+    expect(change.clear).toEqual(['net1']);
+    expect(change.put).toEqual({ net2: 'name=eth2,bridge=vmbr1' });
+  });
+
+  test('a declared MAC is compared, case-insensitively', () => {
+    const net = 'name=eth0,bridge=vmbr0,hwaddr=00:00:5E:00:53:01,type=veth';
+    expect(judge(props({ net0: net.toLowerCase() }), live({ net0: net })).drift).toEqual([]);
+    const other = judge(props({ net0: net.replace(':01', ':09') }), live({ net0: net }));
+    expect(other.drift).toEqual(['net0']);
+  });
+
+  test("a device with deny-write=0 is the same device; a new one is root@pam's", () => {
+    const dev = '/dev/net/tun,deny-write=0';
+    expect(judge(props({ dev0: dev }), live({ dev0: '/dev/net/tun' })).drift).toEqual([]);
+    expect(judge(props({ dev0: dev }), live({})).refuse[0]).toMatch(/Device passthrough/);
+  });
+});
+
+describe('create', () => {
+  test('the form carries declared keys, drops empties, and sends features without off keys', () => {
+    const form = createForm(
+      props({
+        description: '',
+        features: 'nesting=1,keyctl=0',
+        ostemplate: 'local:vztmpl/t.tar.zst',
+        start: true,
+        unprivileged: true,
+      }),
+    );
+    expect(form).toEqual({
+      features: 'nesting=1',
+      ostemplate: 'local:vztmpl/t.tar.zst',
+      start: '1',
+      unprivileged: '1',
+      vmid: '100',
+    });
+  });
+
+  test('a privileged create with any feature is refused', () => {
+    const refusals = createRefusals(
+      props({ features: 'nesting=1', ostemplate: 't', unprivileged: false }),
+    );
+    expect(refusals.join('\n')).toMatch(/Any feature on a privileged guest/);
+  });
+});
+
+describe('what state keeps', () => {
+  test('never the notes, digest, lock, env or raw lxc values; raw keys by name only', () => {
+    const read = {
+      description: 'notes a human wrote\n',
+      digest: 'd',
+      env: 'A=1',
+      hostname: 'x',
+      lock: 'backup',
+      lxc: [['lxc.a', 'v']],
+    };
+    expect(storedConfig(read)).toEqual({ hostname: 'x' });
+    expect(rawKeysOf(read)).toEqual(['lxc.a']);
+  });
+});