@homeflare/distilled-proxmox 0.3.1 → 0.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/distilled-proxmox",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Interim npm home for @distilled.cloud/proxmox — see docs/distilled-interim.md. Not published upstream yet; the kit aliases @distilled.cloud/proxmox onto this package until it is.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/distilled-proxmox#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/config-not-found.test.ts

@@ -9,6 +9,7 @@ import type { ProxmoxOpContext } from "./protocol.ts";
 import * as Retry from "./retry.ts";
 import * as pools from "./services/pools.ts";
 import * as cluster from "./services/cluster.ts";
+import * as nodes from "./services/nodes.ts";
 
 const call = <A, E>(
   op: Effect.Effect<A, E, ProxmoxOpContext>,
@@ -150,4 +151,52 @@ describe("precise config absence tags", () => {
       }),
     ).toMatchObject({ _tag: "ParameterVerificationFailed" });
   });
+  test("network absence is the exact sole iface error on GET and PUT", async () => {
+    const body = {
+      data: null,
+      message: "Parameter verification failed.\n",
+      errors: { iface: "interface does not exist" },
+    };
+    expect(
+      await call(
+        nodes.getNodeNetwork({ node: "n2", iface: "vmbr9" }),
+        400,
+        body,
+      ),
+    ).toMatchObject({ _tag: "NetworkInterfaceNotFound" });
+    // ⛔ RETAG REGRESSION'S OWN CASE — PVE's `update_network` (PUT) raises the byte-identical
+    //   400 (Network.pm:750) that `network_config` (GET) raises (:852); a consumer's catchTag
+    //   keyed on this tag must see the same absence signal from either operation.
+    expect(
+      await call(
+        nodes.putNodeNetwork2({ node: "n2", iface: "vmbr9", type: "bridge" }),
+        400,
+        body,
+      ),
+    ).toMatchObject({ _tag: "NetworkInterfaceNotFound" });
+    for (const errors of [
+      { iface: "invalid interface name" },
+      { iface: "interface does not exist", type: "invalid type" },
+      { other: "interface does not exist" },
+    ]) {
+      expect(
+        await call(nodes.getNodeNetwork({ node: "n2", iface: "vmbr9" }), 400, {
+          ...body,
+          errors,
+        }),
+      ).toMatchObject({ _tag: "ParameterVerificationFailed", errors });
+    }
+    for (const [status, tag] of [
+      [403, "Forbidden"],
+      [500, "InternalServerError"],
+    ] as const) {
+      expect(
+        await call(
+          nodes.getNodeNetwork({ node: "n2", iface: "vmbr9" }),
+          status,
+          body,
+        ),
+      ).toMatchObject({ _tag: tag });
+    }
+  });
 });

package/src/lxc-config-errors.test.ts

@@ -0,0 +1,100 @@
+/**
+ * Exact installed pve-container6.1.13/libpve-guest-common-perl6.0.5 absence; never generic500.
+ * ⛔ ATTACHED TO GET, PUT AND DELETE — all three call `AbstractConfig::load_config` first
+ *   (patches/nodes/lxc-config-errors.json's own provenance) and raise byte-identical text; a
+ *   PUT/DELETE against a container config a caller believes exists gets the same typed absence
+ *   a GET would, not a generic 500 a retry policy or catchTag could mistake for transient.
+ */
+import { expect, test } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import { credentials } from "./credentials.ts";
+import type { ProxmoxOpContext } from "./protocol.ts";
+import * as Retry from "./retry.ts";
+import * as nodes from "./services/nodes.ts";
+
+const missing =
+  "Configuration file 'nodes/pve-test/lxc/900.conf' does not exist\n";
+const call = <A, E>(
+  op: Effect.Effect<A, E, ProxmoxOpContext>,
+  status: number,
+  message?: string,
+) =>
+  Effect.runPromise(
+    op.pipe(
+      Retry.none,
+      Effect.provide(
+        credentials({
+          baseUrl: "https://pve.test:8006",
+          tokenId: "test@pve!test",
+          secret: "fake",
+        }),
+      ),
+      Effect.provideService(
+        HttpClient.HttpClient,
+        HttpClient.make((request) =>
+          Effect.succeed(
+            HttpClientResponse.fromWeb(
+              request,
+              Response.json({ data: null, message }, { status }),
+            ),
+          ),
+        ),
+      ),
+      Effect.flip,
+    ),
+  );
+
+test("only exact container-config absence on GET becomes LxcConfigNotFound", async () => {
+  const get = () => nodes.getNodeLxcConfig({ node: "pve-test", vmid: "900" });
+  expect(await call(get(), 500, missing)).toMatchObject({
+    _tag: "LxcConfigNotFound",
+  });
+  for (const message of [
+    undefined,
+    "got timeout\n",
+    missing.replace("lxc", "qemu-server"),
+    missing + "other error",
+  ]) {
+    expect(await call(get(), 500, message)).toMatchObject({
+      _tag: "InternalServerError",
+    });
+  }
+  expect(await call(get(), 403, missing)).toMatchObject({ _tag: "Forbidden" });
+});
+
+test("the same exact absence on PUT and DELETE also becomes LxcConfigNotFound", async () => {
+  expect(
+    await call(
+      nodes.putNodeLxcConfig({ node: "pve-test", vmid: "900" }),
+      500,
+      missing,
+    ),
+  ).toMatchObject({ _tag: "LxcConfigNotFound" });
+  expect(
+    await call(
+      nodes.deleteNodeLxc({ node: "pve-test", vmid: "900" }),
+      500,
+      missing,
+    ),
+  ).toMatchObject({ _tag: "LxcConfigNotFound" });
+  // ⛔ STILL NOT ABSENCE ON PUT/DELETE EITHER — a generic failure on the write paths must stay
+  //   generic, exactly like the GET-only assertions above.
+  for (const message of ["got timeout\n", missing + "other error"]) {
+    expect(
+      await call(
+        nodes.putNodeLxcConfig({ node: "pve-test", vmid: "900" }),
+        500,
+        message,
+      ),
+    ).toMatchObject({ _tag: "InternalServerError" });
+    expect(
+      await call(
+        nodes.deleteNodeLxc({ node: "pve-test", vmid: "900" }),
+        500,
+        message,
+      ),
+    ).toMatchObject({ _tag: "InternalServerError" });
+  }
+});

package/src/network-changes.test.ts

@@ -0,0 +1,60 @@
+/**
+ * The interfaces diff is a sibling of `data`. Generic unwrapping must not drop it,
+ * and a response without that sibling must still unwrap.
+ */
+import { describe, expect, test } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import { credentials } from "./credentials.ts";
+import type { ProxmoxOpContext } from "./protocol.ts";
+import * as Retry from "./retry.ts";
+import { getNodeTime, listNodeNetwork } from "./services/nodes.ts";
+
+const creds = credentials({
+  tokenId: "root@pam!test",
+  secret: "test-secret",
+  baseUrl: "https://pve.test:8006",
+});
+
+const http = (body: unknown) =>
+  Layer.succeed(
+    HttpClient.HttpClient,
+    HttpClient.make((request) =>
+      Effect.succeed(
+        HttpClientResponse.fromWeb(request, Response.json(body, { status: 200 })),
+      ),
+    ),
+  );
+
+const run = <A, E>(op: Effect.Effect<A, E, ProxmoxOpContext>, body: unknown) =>
+  Effect.runPromise(op.pipe(Retry.none, Effect.provide(Layer.mergeAll(http(body), creds))));
+
+describe("network changes sibling", () => {
+  test("a staged interfaces diff survives beside data", async () => {
+    const changes = "--- a\n+++ b\n+wpa-psk secret-value\n";
+    const live = await run(
+      listNodeNetwork({ node: "pve1" }),
+      { data: [{ iface: "vmbr0", type: "bridge" }], changes },
+    );
+    expect(live).toEqual({
+      data: [{ iface: "vmbr0", type: "bridge" }],
+      changes,
+    });
+  });
+
+  test("no changes sibling still unwraps to the interface list", async () => {
+    const live = await run(listNodeNetwork({ node: "pve1" }), {
+      data: [{ iface: "vmbr0", type: "bridge" }],
+    });
+    expect(live).toEqual([{ iface: "vmbr0", type: "bridge" }]);
+  });
+
+  test("another operation still unwraps data and ignores no sibling", async () => {
+    const live = await run(getNodeTime({ node: "pve1" }), {
+      data: { time: 1_700_000_000 },
+    });
+    expect(live).toMatchObject({ time: 1_700_000_000 });
+  });
+});

package/src/protocol.ts

@@ -113,9 +113,9 @@ export type ProxmoxOpContext = Credentials | HttpClient.HttpClient;
 const errorEnvelope = (body: unknown): RestErrorEnvelope | undefined => {
   if (body === null || typeof body !== "object") return undefined;
   const b = body as Record<string, unknown>;
-  // PVE's backup read/delete missing-id exception is a 400 with the useful
-  // message in errors.id (Backup.pm:406,458 at pve-manager 9.2.11). Expose
-  // ONLY that exact sole-field detail to the operation's typed matcher.
+  // PVE missing backup/interface/alias exceptions carry the useful message in one
+  // field (Backup.pm:406,458; Network.pm:852; Firewall/Aliases.pm:203). Expose
+  // ONLY those exact sole-field details to the operation's typed matcher.
   // Multiple errors, other fields, and unrelated validation stay unchanged.
   const errors = b.errors;
   if (
@@ -124,12 +124,20 @@ const errorEnvelope = (body: unknown): RestErrorEnvelope | undefined => {
     errors !== null &&
     typeof errors === "object" &&
     !Array.isArray(errors) &&
-    Object.keys(errors).length === 1 &&
-    "id" in errors &&
-    typeof errors.id === "string" &&
-    /^No such job '[^']+'$/.test(errors.id)
+    Object.keys(errors).length === 1
   ) {
-    return { message: errors.id };
+    if (
+      "id" in errors &&
+      typeof errors.id === "string" &&
+      /^No such job '[^']+'$/.test(errors.id)
+    )
+      return { message: errors.id };
+    if ("name" in errors && errors.name === "no such alias") {
+      return { message: errors.name };
+    }
+    if ("iface" in errors && errors.iface === "interface does not exist") {
+      return { message: errors.iface };
+    }
   }
   return { message: typeof b.message === "string" ? b.message : undefined };
 };
@@ -166,13 +174,22 @@ export const ProxmoxProtocol: Layer.Layer<API.Protocol> = withPveFormArrays(
     // Unwrap PVE's `{"data": …}` envelope BEFORE the schema-driven decode —
     // see the module header. `data` is `null`/absent for a Unit-output
     // operation; `?? {}` is core's own convention for "no body".
+    // ⛔ `changes` is a sibling, not a field of `data`. PVE/HTTPServer.pm copies
+    //   `$rpcenv->get_result_attrib('changes')` beside `data`. Network.pm sets
+    //   that attrib to the interfaces diff. Dropping it makes a pending reload
+    //   invisible. Only a string sibling is preserved; every other envelope
+    //   still unwraps. The network list schema is the union that can decode it.
     transformResponse: (body) => {
       if (
         body !== null &&
         typeof body === "object" &&
         "data" in (body as Record<string, unknown>)
       ) {
-        return (body as Record<string, unknown>).data ?? {};
+        const record = body as Record<string, unknown>;
+        if (typeof record.changes === "string") {
+          return { changes: record.changes, data: record.data ?? [] };
+        }
+        return record.data ?? {};
       }
       return body;
     },

package/src/qemu-config-absence.test.ts

@@ -0,0 +1,75 @@
+/**
+ * QEMU absence is the config-file sentence from AbstractConfig, not every 500.
+ * qemu-server Qemu.pm routes GET/PUT through `{vmid}/config` and DELETE through `{vmid}`.
+ */
+import { describe, expect, test } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import { credentials } from "./credentials.ts";
+import type { ProxmoxOpContext } from "./protocol.ts";
+import * as Retry from "./retry.ts";
+import { deleteNodeQemu, getNodeQemuConfig } from "./services/nodes.ts";
+
+const call = <A, E>(
+  op: Effect.Effect<A, E, ProxmoxOpContext>,
+  status: number,
+  body: unknown,
+) =>
+  Effect.runPromise(
+    op.pipe(
+      Retry.none,
+      Effect.provide(
+        credentials({
+          baseUrl: "https://pve.test:8006",
+          tokenId: "test@pve!test",
+          secret: "fake",
+        }),
+      ),
+      Effect.provide(
+        Layer.succeed(
+          HttpClient.HttpClient,
+          HttpClient.make((request) =>
+            Effect.succeed(
+              HttpClientResponse.fromWeb(
+                request,
+                Response.json(body, { status }),
+              ),
+            ),
+          ),
+        ),
+      ),
+      Effect.flip,
+    ),
+  );
+
+const missing = {
+  data: null,
+  message: "Configuration file 'nodes/pve1/qemu-server/150.conf' does not exist\n",
+};
+
+describe("QEMU config absence", () => {
+  test("config GET and guest DELETE share the missing-file tag", async () => {
+    expect(
+      await call(getNodeQemuConfig({ node: "pve1", vmid: "150" }), 500, missing),
+    ).toMatchObject({ _tag: "QemuConfigNotFound" });
+    expect(
+      await call(deleteNodeQemu({ node: "pve1", vmid: "150" }), 500, missing),
+    ).toMatchObject({ _tag: "QemuConfigNotFound" });
+  });
+
+  test("a container path, a running guest, and a bare 500 stay unrelated", async () => {
+    for (const message of [
+      "Configuration file 'nodes/pve1/lxc/150.conf' does not exist\n",
+      "VM 150 is running - destroy failed\n",
+      "unrelated failure",
+    ]) {
+      const error = await call(getNodeQemuConfig({ node: "pve1", vmid: "150" }), 500, {
+        data: null,
+        message,
+      });
+      expect(error).toMatchObject({ _tag: "InternalServerError" });
+    }
+  });
+});

package/src/replication-firewall-errors.test.ts

@@ -0,0 +1,126 @@
+/** Exact vendor exceptions at the real protocol boundary; source provenance is in patches. */
+import { expect, test } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import { credentials } from "./credentials.ts";
+import type { ProxmoxOpContext } from "./protocol.ts";
+import * as Retry from "./retry.ts";
+import * as cluster from "./services/cluster.ts";
+
+const call = <A, E>(
+  op: Effect.Effect<A, E, ProxmoxOpContext>,
+  status: number,
+  body: unknown,
+) =>
+  Effect.runPromise(
+    op.pipe(
+      Retry.none,
+      Effect.provide(
+        credentials({
+          baseUrl: "https://pve.test:8006",
+          tokenId: "test@pve!test",
+          secret: "fake",
+        }),
+      ),
+      Effect.provideService(
+        HttpClient.HttpClient,
+        HttpClient.make((request) =>
+          Effect.succeed(
+            HttpClientResponse.fromWeb(
+              request,
+              Response.json(body, { status }),
+            ),
+          ),
+        ),
+      ),
+      Effect.flip,
+    ),
+  );
+
+for (const [op, message] of [
+  [
+    cluster.getClusterReplication({ id: "900-0" }),
+    "no such replication job '900-0'\n",
+  ],
+  [cluster.putClusterReplication({ id: "900-0" }), "no such job '900-0'\n"],
+  [cluster.deleteClusterReplication({ id: "900-0" }), "no such job '900-0'\n"],
+] as const) {
+  test(`replication ${message.trim()} is typed only on its vendor status`, async () => {
+    expect(await call(op, 500, { data: null, message })).toMatchObject({
+      _tag: "ReplicationJobNotFound",
+    });
+    expect(await call(op, 403, { data: null, message })).toMatchObject({
+      _tag: "Forbidden",
+    });
+    for (const other of [
+      undefined,
+      "no such job 'unrelated'\n",
+      message + "other failure",
+      "got timeout\n",
+    ]) {
+      expect(await call(op, 500, { data: null, message: other })).toMatchObject(
+        { _tag: "InternalServerError" },
+      );
+    }
+  });
+}
+
+const missingAlias = {
+  data: null,
+  message: "Parameter verification failed.\n",
+  errors: { name: "no such alias" },
+};
+for (const op of [
+  cluster.getClusterFirewallAlias({ name: "test" }),
+  cluster.putClusterFirewallAlias({ name: "test", cidr: "192.0.2.1" }),
+]) {
+  test("alias requires the sole exact errors.name detail", async () => {
+    expect(await call(op, 400, missingAlias)).toMatchObject({
+      _tag: "FirewallAliasNotFound",
+    });
+    expect(await call(op, 403, missingAlias)).toMatchObject({
+      _tag: "Forbidden",
+    });
+    for (const errors of [
+      { name: "no such alias", cidr: "invalid" },
+      { other: "no such alias" },
+      { name: "invalid alias" },
+    ]) {
+      expect(await call(op, 400, { ...missingAlias, errors })).toMatchObject({
+        _tag: "ParameterVerificationFailed",
+      });
+    }
+    expect(
+      await call(op, 400, { ...missingAlias, message: "unrelated validation" }),
+    ).toMatchObject({ _tag: "ParameterVerificationFailed" });
+  });
+}
+
+test("absence patches do not classify unrelated operations", async () => {
+  expect(
+    await call(
+      cluster.createClusterFirewallAlias({ name: "test", cidr: "192.0.2.1" }),
+      400,
+      missingAlias,
+    ),
+  ).toMatchObject({ _tag: "ParameterVerificationFailed" });
+  expect(
+    await call(
+      cluster.deleteClusterFirewallAlias({ name: "test" }),
+      400,
+      missingAlias,
+    ),
+  ).toMatchObject({ _tag: "ParameterVerificationFailed" });
+  expect(
+    await call(
+      cluster.createClusterReplication({
+        id: "900-0",
+        target: "pve-b",
+        type: "local",
+      }),
+      500,
+      { message: "no such job '900-0'\n" },
+    ),
+  ).toMatchObject({ _tag: "InternalServerError" });
+});

package/src/services/cluster.ts

@@ -21,6 +21,18 @@ export class BackupJobNotFound
     [{ status: 400, message: { matches: "^No such job '[^']+'$" } }],
   ) {}
 
+/** Installed pve-firewall 6.0.5 PVE/API2/Firewall/Aliases.pm:203-204,252, read-only 2026-09-24; SHA256 aa4d71ea897515ca71caa8e04abd142aedf8077058649f793605f014be84db0e. GET and PUT raise HTTP400 Parameter verification failed with the sole field errors.name = no such alias. DELETE is intrinsically idempotent and has no missing-alias exception. Other validation failures remain ParameterVerificationFailed. */
+export class FirewallAliasNotFound
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<FirewallAliasNotFound>()(
+      "FirewallAliasNotFound",
+      {
+        message: S.String,
+      },
+    ).pipe(C.withBadRequestError),
+    [{ status: 400, message: { matches: "^no such alias$" } }],
+  ) {}
+
 /** The metrics server does not exist. pve-manager 9.2.11, f6997e698c7933ea8e62319e2bf1bf7262daa56a, PVE/API2/Cluster/MetricServer.pm:136 throws status server entry '<id>' does not exist on GET, and line 228 throws no such server '<id>' on PUT. Both are wire 500. DELETE dereferences the plugin config without an explicit absence check and is not declared to return this tag. */
 export class MetricServerNotFound
   extends /*@__PURE__*/ T.applyErrorMatchers(
@@ -41,6 +53,25 @@ export class MetricServerNotFound
     ],
   ) {}
 
+/** pve-manager 9.2.11 f6997e698c7933ea8e62319e2bf1bf7262daa56a PVE/API2/ReplicationConfig.pm:107,226,305. GET raises no such replication job; PUT and non-force DELETE raise no such job. Exact structured job IDs only. DELETE normally marks remove_job=full for background cleanup; an absent job is already removed. */
+export class ReplicationJobNotFound
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<ReplicationJobNotFound>()(
+      "ReplicationJobNotFound",
+      {
+        message: S.String,
+      },
+    ).pipe(C.withBadRequestError),
+    [
+      {
+        status: 500,
+        message: {
+          matches: "^no such (replication )?job '[0-9]+-[0-9]+'\\n?$",
+        },
+      },
+    ],
+  ) {}
+
 export interface CreateClusterAcmeAccountRequest {
   /** Contact email addresses. */
   contact: string;
@@ -15530,7 +15561,9 @@ export const deleteClusterQemuCustomCpuModel: API.OperationMethod<
   retry: Retry.Retry,
 }));
 
-export type DeleteClusterReplicationError = ProxmoxOpError;
+export type DeleteClusterReplicationError =
+  | ReplicationJobNotFound
+  | ProxmoxOpError;
 /** Mark replication job for removal. (root-privileged endpoint) */
 export const deleteClusterReplication: API.OperationMethod<
   DeleteClusterReplicationRequest,
@@ -15540,7 +15573,7 @@ export const deleteClusterReplication: API.OperationMethod<
 > = /*@__PURE__*/ API.make(() => ({
   input: DeleteClusterReplicationRequest,
   output: DeleteClusterReplicationResponse,
-  errors: [],
+  errors: [ReplicationJobNotFound],
   protocol: ProxmoxProtocol,
   retry: Retry.Retry,
 }));
@@ -15952,7 +15985,9 @@ export const getClusterConfigTotem: API.OperationMethod<
   retry: Retry.Retry,
 }));
 
-export type GetClusterFirewallAliasError = ProxmoxOpError;
+export type GetClusterFirewallAliasError =
+  | FirewallAliasNotFound
+  | ProxmoxOpError;
 /** Read alias. */
 export const getClusterFirewallAlias: API.OperationMethod<
   GetClusterFirewallAliasRequest,
@@ -15962,7 +15997,7 @@ export const getClusterFirewallAlias: API.OperationMethod<
 > = /*@__PURE__*/ API.make(() => ({
   input: GetClusterFirewallAliasRequest,
   output: GetClusterFirewallAliasResponse,
-  errors: [],
+  errors: [FirewallAliasNotFound],
   protocol: ProxmoxProtocol,
   retry: Retry.Retry,
 }));
@@ -16329,7 +16364,9 @@ export const getClusterQemuCustomCpuModel: API.OperationMethod<
   retry: Retry.Retry,
 }));
 
-export type GetClusterReplicationError = ProxmoxOpError;
+export type GetClusterReplicationError =
+  | ReplicationJobNotFound
+  | ProxmoxOpError;
 /** Read replication job configuration. */
 export const getClusterReplication: API.OperationMethod<
   GetClusterReplicationRequest,
@@ -16339,7 +16376,7 @@ export const getClusterReplication: API.OperationMethod<
 > = /*@__PURE__*/ API.make(() => ({
   input: GetClusterReplicationRequest,
   output: GetClusterReplicationResponse,
-  errors: [],
+  errors: [ReplicationJobNotFound],
   protocol: ProxmoxProtocol,
   retry: Retry.Retry,
 }));
@@ -17844,7 +17881,9 @@ export const putClusterCephHealthMute: API.OperationMethod<
   retry: Retry.Retry,
 }));
 
-export type PutClusterFirewallAliasError = ProxmoxOpError;
+export type PutClusterFirewallAliasError =
+  | FirewallAliasNotFound
+  | ProxmoxOpError;
 /** Update IP or Network alias. (root-privileged endpoint) */
 export const putClusterFirewallAlias: API.OperationMethod<
   PutClusterFirewallAliasRequest,
@@ -17854,7 +17893,7 @@ export const putClusterFirewallAlias: API.OperationMethod<
 > = /*@__PURE__*/ API.make(() => ({
   input: PutClusterFirewallAliasRequest,
   output: PutClusterFirewallAliasResponse,
-  errors: [],
+  errors: [FirewallAliasNotFound],
   protocol: ProxmoxProtocol,
   retry: Retry.Retry,
 }));
@@ -18146,7 +18185,9 @@ export const putClusterQemuCustomCpuModel: API.OperationMethod<
   retry: Retry.Retry,
 }));
 
-export type PutClusterReplicationError = ProxmoxOpError;
+export type PutClusterReplicationError =
+  | ReplicationJobNotFound
+  | ProxmoxOpError;
 /** Update replication job configuration. (root-privileged endpoint) */
 export const putClusterReplication: API.OperationMethod<
   PutClusterReplicationRequest,
@@ -18156,7 +18197,7 @@ export const putClusterReplication: API.OperationMethod<
 > = /*@__PURE__*/ API.make(() => ({
   input: PutClusterReplicationRequest,
   output: PutClusterReplicationResponse,
-  errors: [],
+  errors: [ReplicationJobNotFound],
   protocol: ProxmoxProtocol,
   retry: Retry.Retry,
 }));