@homeflare/alchemy 0.8.0 → 0.10.1

package/dist/proxmox/lxc-create-form.d.ts

@@ -0,0 +1,6 @@
+import { type LxcProps } from './lxc-props.ts';
+/** Why this declaration cannot be CREATED by an API token, if it cannot. */
+export declare const createRefusals: (props: LxcProps) => string[];
+/** The create body: every declared key with a value, plus the create-time instructions. */
+export declare const createForm: (props: LxcProps) => Record<string, string>;
+//# sourceMappingURL=lxc-create-form.d.ts.map

package/dist/proxmox/lxc-create-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc-create-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-create-form.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,KAAK,QAAQ,EAMd,MAAM,gBAAgB,CAAC;AAiBxB,4EAA4E;AAC5E,eAAO,MAAM,cAAc,UAAW,QAAQ,KAAG,MAAM,EA2BtD,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,UAAU,UAAW,QAAQ,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAUjE,CAAC"}

package/dist/proxmox/lxc-harness.d.ts

@@ -0,0 +1,34 @@
+import * as Effect from 'effect/Effect';
+import type { PveTarget } from './credentials.ts';
+import { type FakePve } from './fake-pve-lxc.ts';
+export declare const TARGET: PveTarget;
+/**
+ * A PRODUCTION-SHAPED config — the same keys and the same spellings pvesh printed, PVE's defaults
+ * written out — with every VALUE a placeholder: TEST-NET addresses, RFC 7042 documentation MACs,
+ * and a made-up pool, VLAN, mount path, gid and sizes.
+ * ⛔ SHAPE ONLY. This file ships in the npm tarball (`files` includes `src`), so nothing here may be
+ *   the estate's real topology — sizes, VLANs and bridges included, not only addresses.
+ */
+export declare const LIVE: Readonly<Record<string, unknown>>;
+/** Put `config` live on the fake as `node/vmid`, with a digest as PVE would add. */
+export declare const seed: (fake: FakePve, node: string, vmid: number, config?: Readonly<Record<string, unknown>>) => void;
+/** What the CLI would set for one run: `adopt` is `--adopt`. */
+export type RunOptions = {
+    readonly adopt?: boolean;
+};
+export type Run = {
+    /** Planned action per FQN, deletions included; empty when the plan itself failed. */
+    readonly actions: Readonly<Record<string, string>>;
+    /** The failure sentence, or `''`. */
+    readonly failure: string;
+    readonly warnings: readonly string[];
+};
+export declare const lxcEngine: (fake: FakePve) => {
+    /** Plan only — what `alchemy plan` shows. Nothing is applied and no state is written. */
+    plan: (declare: Effect.Effect<unknown, unknown, unknown>, options?: RunOptions) => Promise<Run>;
+    /** Plan, then apply. */
+    deploy: (declare: Effect.Effect<unknown, unknown, unknown>, options?: RunOptions) => Promise<Run>;
+    /** The stored row's status, or undefined when there is none. */
+    status: (fqn: string) => "created" | "creating" | "deleting" | "replaced" | "replacing" | "updated" | "updating" | undefined;
+};
+//# sourceMappingURL=lxc-harness.d.ts.map

package/dist/proxmox/lxc-harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc-harness.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-harness.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAyB,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAGxE,eAAO,MAAM,MAAM,EAAE,SAIpB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBlD,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,IAAI,SAAU,OAAO,QAAQ,MAAM,QAAQ,MAAM,qDAE7D,CAAC;AAQF,gEAAgE;AAChE,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtD,MAAM,MAAM,GAAG,GAAG;IAChB,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;AAIF,eAAO,MAAM,SAAS,SAAU,OAAO;IA8CnC,yFAAyF;IACzF,IAAI,YAAY,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,YAAW,UAAU;IAE7E,wBAAwB;IACxB,MAAM,YAAY,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,YAAW,UAAU;IAE/E,gEAAgE;IAChE,MAAM,QAAQ,MAAM;CAEvB,CAAC"}

package/dist/proxmox/lxc-identity.d.ts

@@ -0,0 +1,18 @@
+/**
+ * What makes a `Proxmox.Lxc` a DIFFERENT guest: a new vmid, or another template. Judged by `diff`
+ * and `reconcile` in lxc.ts before anything else, and never planned as a replace — see lxc.ts.
+ */
+import type { LxcAttributes, LxcProps } from './lxc-props.ts';
+/**
+ * ⛔ IDENTITY IS JUDGED BEFORE `isResolved(news)`. That guard returns early when ANY prop is still
+ *   an Output, and the engine then plans `update` — which, for a new vmid, would build a second
+ *   guest and orphan the first (the openbao rename lesson, rename.ts). A template is identity
+ *   too: it is consumed at create, so a different one is a different guest.
+ * ★ `node` IS NOT JUDGED HERE, BECAUSE A NODE CHANGE CAN BE THE DECLARATION CATCHING UP. HA fails
+ *   a guest over, or somebody runs `pct migrate`; the guest is on its new node before any line
+ *   says so. `readLive` at the declared node settles both cases: the guest is there (follow it,
+ *   and re-record state with a write-free update), or it is elsewhere and the read FAILS naming
+ *   where — asking to move a guest is a migration, and this resource does not migrate.
+ */
+export declare const identityRefusals: (news: unknown, olds: LxcProps, output: LxcAttributes | undefined) => string[];
+//# sourceMappingURL=lxc-identity.d.ts.map

package/dist/proxmox/lxc-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc-identity.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-identity.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAQ9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,SACrB,OAAO,QACP,QAAQ,UACN,aAAa,GAAG,SAAS,KAChC,MAAM,EAeR,CAAC"}

package/dist/proxmox/lxc-judge.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Declared against live: what a deploy would write to a container, and what it must refuse.
+ *
+ * ★ ONE PURE FUNCTION DECIDES FOR BOTH `diff` AND `reconcile`, so the plan and the write cannot
+ *   disagree about what is drift. This is resource.ts's `matches` guard grown up: an adopted guest
+ *   that already says what the declaration says produces an empty change, and an empty change is
+ *   not a write — adopting a running container must cost nothing.
+ *
+ * ⛔ SOME CHANGES NO API TOKEN CAN MAKE, AND THEY ARE REFUSED AT PLAN RATHER THAN 403'd MID-DEPLOY.
+ *   `PVE::LXC::check_ct_modify_config_perm` (pve-container 6.1.14) returns early only for
+ *   `$authuser eq 'root@pam'`, and a token's authuser is `root@pam!name` at best. So for a token:
+ *   - `devN` — "configuring device passthrough is only allowed for root@pam";
+ *   - a bind or device `mpN`/`rootfs` — "mount point type … is only allowed for root@pam";
+ *   - `features` on a privileged guest, or any feature but `nesting` — root@pam only.
+ *   Each refusal names the `pct set` to run on the node instead. After it, declare the value and
+ *   the next plan compares it like any other key.
+ */
+import { type LxcProps } from './lxc-props.ts';
+export type LxcChange = {
+    /** Keys to `PUT …/config`, as PVE's wire strings. */
+    readonly put: Record<string, string>;
+    /** Keys to remove with `delete=`. */
+    readonly clear: readonly string[];
+    /** Mount points to grow, one `PUT …/resize` each, after the config PUT. */
+    readonly resize: readonly {
+        readonly disk: string;
+        readonly size: string;
+    }[];
+    /** Why the change cannot be made as an update. Non-empty means nothing is written. */
+    readonly refuse: readonly string[];
+    /** Every declared key that differs from live, refused or not — what a plan should name. */
+    readonly drift: readonly string[];
+};
+/** A refusal naming the `pct set` to run instead. `''` is a removal, so it names `--delete`. */
+export declare const rootOnly: (vmid: number, key: string, value: string, why: string) => string;
+/**
+ * PVE's own `features` rule, on the value actually SENT (`sent` undefined means `delete=features`):
+ * nesting alone needs `VM.Allocate`, anything else is root@pam's.
+ * ⚠️ MIRRORED KEY FOR KEY, DEFAULTS INCLUDED, because PVE does not drop them: a live `keyctl=0`
+ *   against a sent value without `keyctl` is a change to PVE (`'0' ne ''`) and makes the write
+ *   root-only. `scalarForm` drops off keys from what is sent for the same reason.
+ */
+export declare const featuresNeedRoot: (live: string, sent: string | undefined, unprivileged: boolean) => boolean;
+export declare const featureWhy: (unprivileged: boolean) => string;
+export declare const judge: (props: LxcProps, live: Record<string, unknown>) => LxcChange;
+//# sourceMappingURL=lxc-judge.d.ts.map

package/dist/proxmox/lxc-judge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc-judge.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-judge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,KAAK,QAAQ,EAMd,MAAM,gBAAgB,CAAC;AAexB,MAAM,MAAM,SAAS,GAAG;IACtB,qDAAqD;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7E,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;AAKF,gGAAgG;AAChG,eAAO,MAAM,QAAQ,SAAU,MAAM,OAAO,MAAM,SAAS,MAAM,OAAO,MAAM,KAAG,MAGhD,CAAC;AAQlC;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,SACrB,MAAM,QACN,MAAM,GAAG,SAAS,gBACV,OAAO,KACpB,OASF,CAAC;AAEF,eAAO,MAAM,UAAU,iBAAkB,OAAO,KAAG,MACoC,CAAC;AAExF,eAAO,MAAM,KAAK,UAAW,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,SAmGtE,CAAC"}

package/dist/proxmox/lxc-lifecycle.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The calls a `Proxmox.Lxc` makes: read one config, create, update in place, grow, delete.
+ *
+ * ⛔ A READ FAILURE IS A FAILURE HERE, NOT "ABSENT" — THE ONE PLACE THIS PACKAGE DEPARTS FROM
+ *   resource.ts. `pveOperations.read` folds every error into `undefined`, which for a guest means a
+ *   403 or a node that did not answer plans a CREATE over a running container. PVE answers a
+ *   missing guest with HTTP 500, `Configuration file 'nodes/<node>/lxc/<vmid>.conf' does not
+ *   exist` (pve-guest-common `AbstractConfig::load_config`), so only a 500 may mean absent — and
+ *   even then only after the cluster says so, below. Anything else fails the plan.
+ *
+ * ⛔ "ABSENT" IS DECIDED BY THE WHOLE CLUSTER, NOT BY THE ERROR TEXT. A config lives under its
+ *   node, so a guest migrated to another node — or a QEMU VM holding the same cluster-wide vmid —
+ *   also reads as missing at the declared path. `GET /cluster/resources?type=vm` settles it: the
+ *   vmid nowhere is absent; the vmid anywhere else FAILS the read with where it is; the vmid on
+ *   the declared node fails with PVE's own error. ★ Keyed on the cluster rather than on matching
+ *   the message, so a PVE that words it differently still cannot turn into a create.
+ *
+ * ⚠️ CREATE, RESIZE AND DELETE ARE ASYNCHRONOUS; A CONFIG PUT IS NOT. The first three answer a
+ *   UPID the moment PVE forks the worker (`NodesNodeLxcPostReturn`, `…ResizePutReturn`,
+ *   `…VmidDeleteReturn` are all `string`), so each waits for its task's exitstatus. `PUT …/config`
+ *   answers `null` after writing (`…ConfigPutReturn`), so it needs no wait.
+ * ⛔ EACH TASK IS POLLED WITH THE CREDENTIAL THAT STARTED IT — see `awaitTask`: only the owner
+ *   skips `Sys.Audit`. A fresh `provision` mint per write gives the full 300s lease a create needs;
+ *   a cached lease can be handed out with 60s left (lease-cache.ts).
+ */
+import * as Effect from 'effect/Effect';
+import { type PveTarget } from './credentials.ts';
+import { type LxcChange } from './lxc-judge.ts';
+import type { LxcAttributes, LxcProps } from './lxc-props.ts';
+/** A plan-time or apply-time refusal. Nothing was written when one of these is raised. */
+export declare class LxcRefusedError extends Error {
+    readonly name = "LxcRefusedError";
+}
+/** Where one guest lives. Its identity, and nothing else. */
+export type LxcWhere = {
+    readonly target: PveTarget;
+    readonly node: string;
+    readonly vmid: number;
+};
+export declare const guestPath: (where: LxcWhere) => string;
+/** The live config, or undefined when no guest holds this vmid anywhere in the cluster. */
+export declare const readLive: (where: LxcWhere) => Effect.Effect<Record<string, unknown> | undefined, Error | LxcRefusedError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const attributesOf: (where: LxcWhere, live: Record<string, unknown>) => LxcAttributes;
+/** POST the create and wait for the template to unpack. ⛔ Refusals are the caller's to check. */
+export declare const createGuest: (props: LxcProps) => Effect.Effect<undefined, Error | LxcRefusedError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * Apply a judged change: the config PUT first, then each resize.
+ * ⚠️ IN THAT ORDER BECAUSE A MOUNT POINT'S PUT CARRIES ITS LIVE `size=`, and the resize rewrites it.
+ * ⛔ THE PUT CARRIES THE `digest` OF THE CONFIG IT WAS JUDGED AGAINST. PVE refuses the write if the
+ *   file changed since (`assert_if_modified`), so an edit landing between reconcile's own read and
+ *   its PUT fails the deploy instead of being overwritten by a change computed from the older file.
+ * ⚠️ THE DIGEST IS THE DEPLOY'S READ, NOT THE PLAN'S. A hand edit between `plan` and `deploy` is
+ *   seen by reconcile's fresh judge instead: a declared key edited meanwhile is written back to the
+ *   declaration (even after a plan that warned of nothing), an undeclared one is left alone.
+ */
+export declare const updateGuest: (props: LxcProps, change: LxcChange, digest: string) => Effect.Effect<void, Error | LxcRefusedError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * ⛔ NO `force`, NO `purge`, NO STOP FIRST. PVE refuses to destroy a running or protected guest,
+ *   and that refusal is kept: stopping a guest so a delete can proceed is an operator's decision.
+ *   Reached only under `RemovalPolicy.destroy()` — this resource retains by default.
+ * ⛔ AND ONLY THE GUEST THIS STACK DECLARED. State holds a vmid, and a vmid is reusable: after a
+ *   hand `pct destroy` and a new `pct create` at the same id, "delete CT 150" is somebody else's
+ *   container and all its volumes. So the live guest is judged against the last declaration
+ *   first; one that no longer matches is refused with the keys that differ, and deleting it (or
+ *   declaring it again) is the operator's call.
+ */
+export declare const destroyGuest: (where: LxcWhere, declared: LxcProps) => Effect.Effect<undefined, Error | LxcRefusedError, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=lxc-lifecycle.d.ts.map

package/dist/proxmox/lxc-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc-lifecycle.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,SAAS,EAAQ,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK9D,0FAA0F;AAC1F,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAkB,IAAI,qBAAqB;CAC5C;AAED,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG,eAAO,MAAM,SAAS,UAAW,QAAQ,WAAoD,CAAC;AAY9F,2FAA2F;AAC3F,eAAO,MAAM,QAAQ,UAAW,QAAQ,sIAqCpC,CAAC;AAEL,eAAO,MAAM,YAAY,UAAW,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,aAK5E,CAAC;AAgCH,iGAAiG;AACjG,eAAO,MAAM,WAAW,UAAW,QAAQ,4GAQxC,CAAC;AAEJ;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,UAAW,QAAQ,UAAU,SAAS,UAAU,MAAM,uGAmB1E,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,UAAW,QAAQ,YAAY,QAAQ,4GAe5D,CAAC"}

package/dist/proxmox/lxc-props.d.ts

@@ -0,0 +1,139 @@
+import type { WithTarget } from './resource.ts';
+/** A PVE boolean as pvesh prints it (`1`) or as TypeScript writes it (`true`). The same value. */
+export type PveFlag = boolean | 0 | 1;
+export interface LxcProps extends WithTarget {
+    /**
+     * The node that hosts it. ⛔ This resource never migrates: naming another node plans only when
+     * the guest is already there (after HA or `pct migrate`), and then writes nothing.
+     */
+    node: string;
+    /** ⛔ CLUSTER-WIDE primary key, shared with QEMU VMs. Required, never allocated here. */
+    vmid: number;
+    /**
+     * `local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst`. ⚠️ CREATE-ONLY AND NOT READABLE BACK:
+     * PVE consumes it while unpacking the rootfs. Optional, because an adopted guest was built from a
+     * template nobody recorded; required only when this resource has to create the guest.
+     */
+    ostemplate?: string;
+    /** Start the guest once, after its create finishes (PVE's create `start`). ⚠️ Never compared. */
+    start?: PveFlag;
+    /**
+     * ⛔ READ-ONLY AFTER CREATE. PVE refuses to change it ("unable to modify read-only option"), so a
+     * differing value is refused at plan. Absent from a live config means `0`: privileged. On create,
+     * PVE's own default is `1`.
+     */
+    unprivileged?: PveFlag;
+    hostname?: string;
+    arch?: string;
+    ostype?: string;
+    cores?: number;
+    /** `0` means no limit. May be fractional (`1.5`). */
+    cpulimit?: number;
+    cpuunits?: number;
+    /** MiB. */
+    memory?: number;
+    /** MiB. */
+    swap?: number;
+    /**
+     * `local-zfs:subvol-100-disk-0,size=40G` as read, or `local-zfs:40` (40 GiB, new volume) to
+     * create. See lxc-volume.ts for what may change: options in place, size up only.
+     */
+    rootfs?: string;
+    /** `nesting=1,keyctl=1`. ⛔ Only `nesting` is writable by an API token — see lxc-judge.ts. */
+    features?: string;
+    onboot?: PveFlag;
+    /** `order=1,up=30,down=60`. */
+    startup?: string;
+    protection?: PveFlag;
+    /** Free text. ⚠️ PVE stores it as `#` comment lines and hands it back with a trailing newline. */
+    description?: string;
+    /** `a;b`. ⚠️ Compared as a set; PVE sorts and, by default, lowercases them. */
+    tags?: string;
+    /** Space-separated. Order is meaningful to a resolver, so it is compared in order. */
+    nameserver?: string;
+    searchdomain?: string;
+    timezone?: string;
+    console?: PveFlag;
+    tty?: number;
+    cmode?: string;
+    /** `tank:subvol-100-disk-1,mp=/data,backup=1,size=100G`, or `tank:100,mp=/data` to create. */
+    [mount: `mp${number}`]: string | undefined;
+    /** `name=eth0,bridge=vmbr0,ip=dhcp`. ⚠️ An undeclared `hwaddr` keeps the live MAC. */
+    [nic: `net${number}`]: string | undefined;
+    /** `/dev/net/tun`, `/dev/dri/renderD128,gid=44,mode=0660`. ⛔ root@pam only — see lxc-judge.ts. */
+    [device: `dev${number}`]: string | undefined;
+    /** ⛔ A secret. See the header. */
+    password?: never;
+    /** ⛔ Treated as a secret here. See the header. */
+    'ssh-public-keys'?: never;
+    /** ⛔ Can carry anything, and a read token cannot even see it. See the header. */
+    env?: never;
+}
+export interface LxcAttributes {
+    node: string;
+    vmid: number;
+    /**
+     * The live config, each value as PVE's own string: every key this resource MANAGES
+     * (`isManagedKey`), declared or not, minus the keys in `UNSTORED`.
+     * ★ A MAP RATHER THAN TYPED FIELDS so a plan can show whatever managed key the guest carries.
+     * ⛔ AN ALLOWLIST, NOT "EVERYTHING BUT A DENYLIST" — see `storedConfig`.
+     */
+    config: Record<string, string>;
+    /**
+     * The raw `lxc.*` lines in the guest's config file — NAMES ONLY.
+     * ⚠️ A GAP, NOT A FEATURE: PVE's API returns these but cannot set them (`lxc.prlimit.memlock`,
+     *   `lxc.cgroup2.devices.allow`, `lxc.mount.entry`). They are edited in `/etc/pve/lxc/<vmid>.conf`
+     *   on the node, so this resource reports that they exist and never compares them. ⛔ Values are
+     *   not stored: `lxc.environment` is one of the keys PVE allows there.
+     */
+    rawKeys: string[];
+}
+/**
+ * Keys a read returns that state never keeps.
+ * ⚠️ `digest` covers the whole file and `lock` is transient (a running backup), so either would
+ *   rewrite state on every read; `env` and `lxc` are the secret risks in the header and above.
+ * ⛔ `description` IS THE GUEST'S "NOTES" PANEL IN THE PVE UI, where people paste credentials. A
+ *   declared one is already in props; an undeclared one is not this resource's to copy into an
+ *   unencrypted state store.
+ */
+export declare const UNSTORED: ReadonlySet<string>;
+/** The indexed families, with PVE's own limits (pve-container `$MAX_*`, 6.1.14). */
+export declare const INDEXED: {
+    readonly dev: 256;
+    readonly mp: 256;
+    readonly net: 32;
+};
+export type IndexedFamily = keyof typeof INDEXED;
+/** `mp3` → `['mp', 3]`; anything else → undefined. ⚠️ `mp03` is not a PVE key. */
+export declare const indexedKey: (key: string) => readonly [IndexedFamily, number] | undefined;
+/** Props that are not config keys: where the guest lives, and create-time instructions. */
+export declare const NOT_CONFIG: ReadonlySet<string>;
+/**
+ * A declaration read by key. ⚠️ The cast is the one place the three template-literal index
+ * signatures meet a plain string key; every reader goes through here rather than casting again.
+ */
+export declare const declaredValue: (props: LxcProps, key: string) => unknown;
+/** The declared config keys with a value, in a stable order. `''` counts: it means "absent". */
+export declare const declaredKeys: (props: LxcProps) => string[];
+/** One declared value as PVE's wire string. Booleans go as `1`/`0`, numbers as their decimal. */
+export declare const wireValue: (value: unknown) => string;
+/**
+ * A key this resource compares and may write: a scalar lxc-wire.ts knows, `unprivileged`, `rootfs`,
+ * or an indexed `mpN`/`netN`/`devN`. ★ ONE PREDICATE FOR THE THREE PLACES THAT ASK: `judge` refuses
+ * any other declared key, `createRefusals` refuses it before a POST, and `storedConfig` keeps
+ * nothing else. ⛔ Without the create half, a key smuggled past the types (a cast, a JS caller:
+ * `password`, `force`, `restore`, `hookscript`) went into the create body verbatim.
+ */
+export declare const isManagedKey: (key: string) => boolean;
+/**
+ * The live config as strings: managed keys only, the unstored ones dropped.
+ * ⛔ AN ALLOWLIST, BECAUSE A DENYLIST IS SURPRISED BY THE NEXT PVE RELEASE. `env` joined the config
+ *   in PVE 9 with application containers, and `entrypoint` with it — a command line, which can
+ *   carry a token as an argument. Under "store everything except UNSTORED" each new key lands in
+ *   the unencrypted state store until somebody notices; under this, it is not stored until this
+ *   resource manages it. `hookscript`, `unusedN`, `parent` and `lock` are dropped the same way.
+ */
+export declare const storedConfig: (live: Record<string, unknown>) => Record<string, string>;
+/** `[["lxc.prlimit.memlock","unlimited"]]` → `['lxc.prlimit.memlock']`. Values are dropped. */
+export declare const rawKeysOf: (live: Record<string, unknown>) => string[];
+//# sourceMappingURL=lxc-props.d.ts.map

package/dist/proxmox/lxc-props.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc-props.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-props.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,kGAAkG;AAClG,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;AAEtC,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,CAAC,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,sFAAsF;IACtF,CAAC,GAAG,EAAE,MAAM,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1C,kGAAkG;IAClG,CAAC,MAAM,EAAE,MAAM,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7C,kCAAkC;IAClC,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,KAAK,CAAC;IAC1B,iFAAiF;IACjF,GAAG,CAAC,EAAE,KAAK,CAAC;CACb;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,EAAE,WAAW,CAAC,MAAM,CAOvC,CAAC;AAEH,oFAAoF;AACpF,eAAO,MAAM,OAAO;aAClB,GAAG,EAAE,GAAG;aACR,EAAE,EAAE,GAAG;aACP,GAAG,EAAE,EAAE;CACC,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,OAAO,CAAC;AAEjD,kFAAkF;AAClF,eAAO,MAAM,UAAU,QAAS,MAAM,KAAG,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,SAM3E,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,MAAM,CAMzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,UAAW,QAAQ,OAAO,MAAM,KAAG,OACT,CAAC;AAErD,gGAAgG;AAChG,eAAO,MAAM,YAAY,UAAW,QAAQ,KAAG,MAAM,EAG1C,CAAC;AAEZ,iGAAiG;AACjG,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,MACmB,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,QAAS,MAAM,KAAG,OAIZ,CAAC;AAEhC;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAQjF,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,SAAS,SAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,EAM/D,CAAC"}

package/dist/proxmox/lxc-volume.d.ts

@@ -0,0 +1,29 @@
+/** PVE's `parse_size`: `\d+(\.\d+)?[KMGT]?`, binary units, bare means bytes. */
+export declare const sizeBytes: (text: string) => number | undefined;
+export type Volume = {
+    readonly kind: 'new' | 'volume' | 'bind' | 'device';
+    /** `new`/`volume`: the storage id. `bind`/`device`: the host path. */
+    readonly source: string;
+    /** `volume` only: the name after `storage:`. */
+    readonly volname: string;
+    /** From `size=`, or the new-disk GiB. Undefined when neither says. */
+    readonly size: number | undefined;
+    /** The size as written, for a resize request. */
+    readonly sizeText: string | undefined;
+    /** Every other option, comparable. */
+    readonly options: Map<string, string>;
+};
+/** PVE's `classify_mountpoint`, plus the new-disk spelling a declaration may use. */
+export declare const parseVolume: (text: string) => Volume;
+/** What one mount point needs. At most one of `refuse` / `rootOnly` is set, and then nothing else. */
+export type VolumeVerdict = {
+    readonly refuse?: string;
+    readonly rootOnly?: boolean;
+    /** The value to PUT, built on the LIVE volume id. */
+    readonly put?: string;
+    /** An absolute size to hand `PUT …/resize`, which only ever grows. */
+    readonly resize?: string;
+};
+export declare const isHostPath: (volume: Volume) => boolean;
+export declare const judgeVolume: (key: string, declared: string, live: string) => VolumeVerdict;
+//# sourceMappingURL=lxc-volume.d.ts.map

package/dist/proxmox/lxc-volume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc-volume.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-volume.ts"],"names":[],"mappings":"AAgCA,gFAAgF;AAChF,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAM,GAAG,SAIjD,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpD,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,qFAAqF;AACrF,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,MAiC1C,CAAC;AAEF,sGAAsG;AACtG,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,eAAO,MAAM,UAAU,WAAY,MAAM,YAAuD,CAAC;AAcjG,eAAO,MAAM,WAAW,QAAS,MAAM,YAAY,MAAM,QAAQ,MAAM,KAAG,aAuCzE,CAAC"}

package/dist/proxmox/lxc-wire.d.ts

@@ -0,0 +1,51 @@
+/** `a=1,b=2` → `[['a','1'],['b','2']]`. A bare token is `defaultKey`'s value. */
+export declare const pairs: (value: string, defaultKey?: string) => [string, string][];
+/**
+ * A key's default, per family: the value PVE treats absence as.
+ * ⚠️ `replicate` DEFAULTS ON and everything else here defaults off. `backup` on a mount point is
+ *   off when absent: vzdump skips any `mpN` without `backup=1` (the rootfs is always included).
+ */
+declare const DEFAULTS: Readonly<Record<string, Readonly<Record<string, string>>>>;
+/** A property string as a map of comparable values, with `family`'s defaults dropped. */
+export declare const optionMap: (value: string, family: keyof typeof DEFAULTS, defaultKey?: string) => Map<string, string>;
+export declare const sameMap: (left: Map<string, string>, right: Map<string, string>) => boolean;
+/** A map as one order-free string, for comparing and for naming a value in a message. */
+export declare const sortedForm: (map: Map<string, string>) => string;
+/** A map back to a property string, `lead` keys first — PVE wants `name` and the volume first. */
+export declare const printMap: (map: Map<string, string>, lead?: readonly string[]) => string;
+/**
+ * `net` maps for comparison. ⚠️ AN UNDECLARED `hwaddr` IS PVE'S, NOT DRIFT: PVE generates one on
+ * create, so the live MAC is dropped before comparing when the declaration names none.
+ */
+export declare const netMaps: (declared: string, live: string) => {
+    have: Map<string, string>;
+    want: Map<string, string>;
+};
+/**
+ * The `net` value to PUT: the declaration, plus the live MAC when it names none.
+ * ⛔ WITHOUT THE LIVE MAC, A PUT OF AN UNCHANGED NIC WOULD GENERATE A NEW ONE — a new MAC is a new
+ *   DHCP lease and a new IPv6 link-local address for a guest that only had its MTU edited.
+ */
+export declare const netWrite: (declared: string, live: string | undefined) => string;
+/** Tags as PVE stores them: split on `;`, `,` or space, deduplicated, sorted, lower-cased. */
+export declare const tagSet: (value: string) => string;
+/** A resolver list: order matters, the separator does not. */
+export declare const orderedList: (value: string) => string;
+/**
+ * ⚠️ PVE STORES A DESCRIPTION AS `#` COMMENT LINES AND READS EACH BACK WITH `"\n"` APPENDED
+ *   (`parse_pct_config`), so `foo` comes back `foo\n`. Trailing whitespace is not the value.
+ */
+export declare const descriptionText: (value: string) => string;
+/** How each scalar config key is compared. A key missing here is not one this resource manages. */
+export declare const SCALAR_KINDS: Readonly<Record<string, 'text' | 'number' | 'flag' | 'form'>>;
+/** Keys a declaration may set to `''` to mean "remove it". `delete=` takes them; nothing else may. */
+export declare const CLEARABLE: ReadonlySet<string>;
+/**
+ * What an absent key means, from the confdesc defaults. ⚠️ Only these compare equal to absence;
+ * `cores` absent means "every host core", which no number declares.
+ */
+export declare const SCALAR_DEFAULTS: Readonly<Record<string, string>>;
+/** One scalar value in its comparable spelling. */
+export declare const scalarForm: (key: string, value: string) => string;
+export {};
+//# sourceMappingURL=lxc-wire.d.ts.map

package/dist/proxmox/lxc-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-wire.ts"],"names":[],"mappings":"AAiBA,iFAAiF;AACjF,eAAO,MAAM,KAAK,UAAW,MAAM,eAAe,MAAM,KAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EASrE,CAAC;AAEP;;;;GAIG;AACH,QAAA,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAKxE,CAAC;AAkCF,yFAAyF;AACzF,eAAO,MAAM,SAAS,UACb,MAAM,UACL,MAAM,OAAO,QAAQ,eAChB,MAAM,KAClB,GAAG,CAAC,MAAM,EAAE,MAAM,CAQpB,CAAC;AAEF,eAAO,MAAM,OAAO,SAAU,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,YACY,CAAC;AAE1F,yFAAyF;AACzF,eAAO,MAAM,UAAU,QAAS,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,WAIrC,CAAC;AAEf,kGAAkG;AAClG,eAAO,MAAM,QAAQ,QAAS,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,SAAQ,SAAS,MAAM,EAAE,WAG5D,CAAC;AAEf;;;GAGG;AACH,eAAO,MAAM,OAAO,aAAc,MAAM,QAAQ,MAAM;;;CAKrD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,QAAQ,aAAc,MAAM,QAAQ,MAAM,GAAG,SAAS,WAKlE,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,MAAM,UAAW,MAAM,WAItB,CAAC;AAEf,8DAA8D;AAC9D,eAAO,MAAM,WAAW,UAAW,MAAM,WAI3B,CAAC;AAEf;;;GAGG;AACH,eAAO,MAAM,eAAe,UAAW,MAAM,WAA8B,CAAC;AAE5E,mGAAmG;AACnG,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,CAqBtF,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,MAAM,CAQxC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU5D,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,UAAU,QAAS,MAAM,SAAS,MAAM,KAAG,MAUvD,CAAC"}

package/dist/proxmox/lxc.d.ts

@@ -1,59 +1,39 @@
 /**
- * `Proxmox.Lxc` — a container, declared. This is what the estate's provision credential exists for.
+ * `Proxmox.Lxc` — a container, declared: adopted as it runs, or created from a template.
  *
- * ★ `hf-provision@pve` HOLDS EXACTLY THE ROLE THIS NEEDS, and nothing more: `LXCProvisioner` on `/`
- *   grants VM.Allocate, VM.Audit, VM.Config.{CPU,Disk,HWType,Memory,Network,Options},
- *   VM.PowerMgmt, Datastore.AllocateSpace, Datastore.Audit, SDN.Use, Sys.Audit. Read that list as a
- *   specification: the credential was scoped to provision containers and to do nothing else.
+ * ★ `hf-provision@pve` HOLDS EXACTLY THE ROLE THIS NEEDS: `LXCProvisioner` on `/` grants
+ *   VM.Allocate, VM.Audit, VM.Config.{CPU,Disk,HWType,Memory,Network,Options}, VM.PowerMgmt,
+ *   Datastore.AllocateSpace, Datastore.Audit, SDN.Use, Sys.Audit. What that role cannot do — device
+ *   passthrough, bind mounts, features beyond nesting — PVE keeps for root@pam, and lxc-judge.ts
+ *   refuses at plan with the `pct set` to run instead.
  *
- * ⛔ `vmid` IS THE PRIMARY KEY AND IT IS CLUSTER-WIDE, not per node. Two resources declaring the
- *   same vmid on different nodes are the same object, and PVE will refuse the second with
- *   "already exists". It is required rather than allocated here: letting the provider pick the next
- *   free id would make the identity of a container depend on the order plans happened to run in.
+ * ⛔ NOTHING HERE PLANS A REPLACE, AND NOTHING DESTROYS A GUEST BY DEFAULT. A replace of a guest is
+ *   a delete of a running machine and its disks, so every change PVE cannot make in place — a new
+ *   vmid, another template, an unprivileged flip, a storage move, a smaller disk, a move to
+ *   another node — FAILS the plan with a sentence instead. `defaultRemovalPolicy: 'retain'`:
+ *   dropping the declaration drops the state row and leaves the guest running; only
+ *   `RemovalPolicy.destroy()` reaches `destroyGuest`, which deletes only a guest that still
+ *   matches its last declaration, and PVE still refuses a running or protected one.
+ * ⛔ AND NOTHING HERE WRITES A VOLUME IT DID NOT ALLOCATE. A create takes `storage:GiB` only
+ *   (lxc-create-form.ts), and a deploy that planned a create never writes onto a guest it finds.
  *
- * ⚠️ MOST FIELDS ARE CREATE-TIME. `ostemplate` and `storage` are consumed when the rootfs is built
- *   and are not readable back afterwards, so they are deliberately NOT compared in `matches` --
- *   a provider that diffed them would report an update on every plan, forever. What is compared is
- *   what PVE will actually tell you about a running container.
+ * ⚠️ AN ADOPTION ALWAYS PLANS `adopted`, EVEN WHEN IT WOULD WRITE. alchemy 2.0.0-beta.79 turns a
+ *   cold adoption's diff into an update whatever it answered (Plan.ts, `forceUpdateAfterAdoption`)
+ *   and prints no property diff for it. So `diff` LOGS the keys a deploy would write, by name
+ *   (never by value), as a warning — the only place a plan can say the declaration is not the live
+ *   config yet. A clean adoption logs nothing, and its deploy writes nothing (lxc-judge.ts).
+ *
+ * ⚠️ POWER STATE IS NOT DECLARED. `onboot` is config; start and stop are an operator's act, as for
+ *   `Proxmox.Vm`. `start: 1` starts a guest once, after the create that built it, and never again.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type PveRequirements, type WithTarget } from './resource.ts';
-export interface LxcProps extends WithTarget {
-    /** Which node hosts it. Moving a container between nodes is a migration, not an update. */
-    node: string;
-    /** ⛔ CLUSTER-WIDE primary key. Required, never auto-allocated — see the ⛔ above. */
-    vmid: number;
-    /** e.g. `local:vztmpl/debian-13-standard_13.0-1_amd64.tar.zst`. Create-time only. */
-    ostemplate: string;
-    /** Storage for the rootfs, e.g. `local-zfs`. Create-time only. */
-    storage: string;
-    hostname?: string;
-    /** MiB. Mutable. */
-    memory?: number;
-    cores?: number;
-    /** e.g. `name=eth0,bridge=vmbr0,ip=dhcp`. Mutable. */
-    net0?: string;
-    /** Start on boot. Mutable. */
-    onboot?: boolean;
-}
-export interface LxcAttributes {
-    vmid: number;
-    node: string;
-    hostname: string;
-    memory: number;
-    cores: number;
-    onboot: boolean;
-    /** `running` | `stopped`. Reported, never declared — power state is not configuration. */
-    status: string;
-}
+import type { LxcAttributes, LxcProps } from './lxc-props.ts';
+import type { PveRequirements } from './resource.ts';
+export type { LxcAttributes, LxcProps } from './lxc-props.ts';
 export interface ProxmoxLxc extends Resource<'Proxmox.Lxc', LxcProps, LxcAttributes, never, PveRequirements> {
 }
+/** ★ `retain` by default — a guest's disks cannot be rebuilt from a line. See resource.ts. */
 export declare const ProxmoxLxc: import("alchemy").ResourceClass<ProxmoxLxc>;
-/**
- * ⛔ PVE REFUSES TO DELETE A RUNNING CONTAINER, and that refusal is kept — `handlers.delete`
- *   passes it straight through. Stopping a guest so that a `destroy` can proceed is a decision an
- *   operator makes, not one a plan makes on their behalf while they are reading the diff.
- */
 export declare const ProxmoxLxcProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxLxc>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=lxc.d.ts.map

package/dist/proxmox/lxc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lxc.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8BAA8B;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAgD9D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gIACgD,CAAC"}
+{"version":3,"file":"lxc.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAiB7C,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE9D,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,8FAA8F;AAC9F,eAAO,MAAM,UAAU,6CAA0E,CAAC;AA4KlG,eAAO,MAAM,kBAAkB,gIAI5B,CAAC"}

package/dist/proxmox/network-apply-read.d.ts

@@ -89,5 +89,5 @@ export declare const UNREACHABLE = "the task could not be read -- the node stopp
  *   is not the owner — which is why this takes a `PveCredential` and the caller keeps one lease
  *   across both calls, instead of widening the provisioning role to read its own tasks.
  */
-export declare const awaitTask: (target: PveTarget, credential: PveCredential, node: string, upid: string) => Effect.Effect<string, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const awaitTask: (target: PveTarget, credential: PveCredential, node: string, upid: string, attempts?: number) => Effect.Effect<string, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=network-apply-read.d.ts.map

package/dist/proxmox/network-apply-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-apply-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAatE,oGAAoG;AACpG,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AA0B7E;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,WAWxC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,WAAY,SAAS,QAAQ,MAAM,uFACH,CAAC;AAiC1D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,WAAY,SAAS,mGAO7C,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,0FACiE,CAAC;AAY1F;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS,WACZ,SAAS,cACL,aAAa,QACnB,MAAM,QACN,MAAM,uFAgCV,CAAC"}
+{"version":3,"file":"network-apply-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/network-apply-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAatE,oGAAoG;AACpG,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AA0B7E;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,SAAU,MAAM,WAWxC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,WAAY,SAAS,QAAQ,MAAM,uFACH,CAAC;AAiC1D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,WAAY,SAAS,mGAO7C,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,0FACiE,CAAC;AAY1F;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS,WACZ,SAAS,cACL,aAAa,QACnB,MAAM,QACN,MAAM,aAEF,MAAM,uFAgCd,CAAC"}

package/dist/proxmox/pbs-datastore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pbs-datastore.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-datastore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EAMf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,YAAY,EAAE,sBAAsB,EAAE,SAAS,EAAE,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,SAAS,CAAC;IAClB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,uFAAuF;AACvF,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH,eAAO,MAAM,oBAAoB,kIA4G9B,CAAC"}
+{"version":3,"file":"pbs-datastore.d.ts","sourceRoot":"","sources":["../../src/proxmox/pbs-datastore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EAMf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,YAAY,EAAE,sBAAsB,EAAE,SAAS,EAAE,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,SAAS,CAAC;IAClB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,uFAAuF;AACvF,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH,eAAO,MAAM,oBAAoB,kIA4G9B,CAAC"}

package/dist/proxmox/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,UAAU,IAAI;IAC7D,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7F,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC7D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;kBAGX,KAAK;iBAiBX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBASZ,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;sBAIV,KAAK;IA6DvB;;;;OAIG;oBACa,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,SAAS,MAAM,QAC1E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAI9B,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAChC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBAtHlC,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;IAoH5B,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,UAAU,IAAI;IAC7D,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7F,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC7D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;kBAGX,KAAK;iBAiBX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBASZ,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;sBAIV,KAAK;IA4DvB;;;;OAIG;oBACa,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,SAAS,MAAM,QAC1E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAI9B,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAChC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBArHlC,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;IAmH5B,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}

package/dist/proxmox/update-guard.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Whether an update has anything to write — decided ONCE for every PVE and PBS family.
+ *
+ * ⛔ AN ADOPTED ROW IS RECONCILED EVEN WHEN ITS DIFF SAID `noop`, SO THIS GUARD IS WHAT MAKES
+ *   ADOPTION FREE. alchemy beta.79 Plan.ts sets `forceUpdateAfterAdoption` after the cold-start
+ *   probe and turns a `noop` diff into an update; Apply.ts then calls `reconcile` for the
+ *   `adopted` action exactly as for `update`. The plan prints `adopted` either way, so nothing on
+ *   screen tells a matching object from a drifting one. docs/adopt-verify.md has the table of
+ *   what each family does on that path.
+ *
+ * 🔴 THE FAMILY THAT DID NOT HAVE IT. `Proxmox.CephPool` wrote its own reconcile and PUT the
+ *   declared set whenever the pool existed, so adopting a pool that already matched sent
+ *   `setpool` and forked a worker on the live cluster (found 2026-09-21 by tracing every family).
+ *   resource.ts and pbs-datastore.ts each had the guard inline; three copies of one predicate is
+ *   how the fourth family forgets it, so it lives here and all three call it.
+ *
+ * ★ `matches` IS THE SAME PREDICATE `diff` USES, so "the diff said noop" and "reconcile writes
+ *   nothing" cannot disagree. A field left OUT of `matches` is one the family does not manage, so
+ *   its drift is not this write's to repair.
+ *
+ * ⚠️ AN EMPTY FORM IS ALSO NOT A WRITE. `updateForm` can legitimately answer `{}` — a storage
+ *   declaring only `storage`, `type` and its locator has no mutable field at all — and PUTting an
+ *   empty body is a pointless write at best and a 400 that reads as a broken provider at worst.
+ *   (Moved here from resource.ts with the guard it explains.)
+ */
+export declare const formToSend: <Attributes, Props, Form extends object>(matches: (attributes: Attributes, props: Props) => boolean, live: Attributes, props: Props, form: Form) => Form | undefined;
+//# sourceMappingURL=update-guard.d.ts.map

package/dist/proxmox/update-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-guard.d.ts","sourceRoot":"","sources":["../../src/proxmox/update-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,UAAU,GAAI,UAAU,EAAE,KAAK,EAAE,IAAI,SAAS,MAAM,WACtD,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,QACpD,UAAU,SACT,KAAK,QACN,IAAI,KACT,IAAI,GAAG,SAAwF,CAAC"}