EXTENSIONS

Porkbun registrar and DNS API (v3) read-only provider model: validate credentials and snapshot domains, nameservers, DNS records, contacts, DNSSEC, availability, and pricing. Body auth (vaulted apikey+secretapikey) lives in a single injectable fetch seam; every request is a POST gated on the SUCCESS/ERROR envelope. Reads only - no registration, renewal, or record mutations.

listmonk (v6.2.0) REST API behavior — a typed swamp primitive for driving a

Invoice Ninja v5 (`/api/v1`) model — read-side snapshots (invoices, payments,

Provider-agnostic ManageSieve (RFC 5804) client built directly on Deno's native TCP/TLS primitives -- no third-party ManageSieve library exists on npm with any real maintenance signal, so the small line protocol (STARTTLS, SASL PLAIN, and the literal/quoted string framing for LISTSCRIPTS/GETSCRIPT/PUTSCRIPT/SETACTIVE/DELETESCRIPT/CHECKSCRIPT) is implemented in-repo behind a single injectable transport seam. Read-only methods: listScripts, getScript, getActive, checkScript (CHECKSCRIPT without installing). Gated write methods: putScript, setActive, deleteScript -- dryRun defaults true, every write validates via CHECKSCRIPT first (putScript) or a live LISTSCRIPTS snapshot (setActive/deleteScript), and deleteScript refuses to remove the currently-active script. Script names/text are always sent as RFC 5804 non-synchronizing literals ({n+}), which are purely length-prefixed, so no caller-supplied content can ever be interpreted as a protocol boundary.

IPv6 address planner: region-rooted /40 allocation, /44-stride site envelopes, subnet/tunnel/loopback/anycast computation with overlap validation.

Provider-agnostic IMAP inspection + gated-write model built on imapflow. Phase 1 (read-only): listFolders enumerates the folder tree with per-folder message counts and sizes; sync snapshots message envelopes plus a fixed header set (From, To, Cc, Subject, Date, Message-ID, In-Reply-To, References, List-ID, List-Unsubscribe, List-Post, Reply-To, Auto-Submitted, Precedence) with flags and size into versioned data -- HEADERS ONLY, never bodies. fetchMessage (read-only, EXAMINE) is the one method that pulls FULL bodies, for ONE folder per call (an IMAP UID is unique only within one folder+UIDVALIDITY): it uses a pre-fetch size gate (one {uid,size} fetch to partition the UID set against MAX_BODY_BYTES, then one source fetch for the under-cap UIDs only, never a per-UID loop), decodes with postal-mime, and writes one messageBody record per UID (text/html, attachment metadata only, extracted http/https links, an error field). An over-cap body is deliberately NOT pulled (truncated=true, sourceBytes=server size, null bodies) so oversized sources are never buffered; a no-server-size body over the cap is byte-truncated; each decode is isolated so one malformed message cannot abort the batch; a null-UID or absent UID is skipped. html is stored UNSANITIZED. messageBody records have a FINITE (30d) lifetime. It performs ZERO mutation and is structurally read-only like sync (EXAMINE; no peek knob). Mailboxes are opened read-only (EXAMINE) for these methods. Phase 3 (gated write): addKeywords/removeKeywords/move fan out one STORE/MOVE command over a UID set, dryRun-gated, uidValidity-guarded, verified by a post-mutation re-FETCH. applyTagPlan (Reconcile-B) reads the latest tagPlan record from a @shrug/mail-ontology instance and applies it over the same safety core, fanned out by (folder,keyword) and (folder,destination) group. createFolder (imap-create-folder) ensures a LIST of mailbox paths exist in one call (imapflow mailboxCreate), idempotent on ALREADYEXISTS, verified by a post-creation re-LIST; it is mailbox-level and needs no UID/uidValidity machinery. The mailbox credential is resolved from a swamp vault via CEL; it is never inlined.

Swamp-managed Android device over ADB. One model type (@shrug/android/device) drives the local `adb` CLI (via Deno.Command, behind an injectable exec seam) to pull device state into typed, versioned snapshots and to manage apps through gated, auditable mutations. Reads (all non-root): device identity + capability ceiling + owners (syncDevice), full app inventory joined from `pm list` + `dumpsys package` (syncPackages), per-app usage + standby buckets (syncUsage), on-disk code sizes (syncStorage), user-facing runtime permissions with a privacy-category rollup (syncPermissions), estimated per-app power use in mAh (syncBattery), special-access appops holders (syncAppControls), and per-app notification posture (syncNotifications); a fan-out `sync` captures the whole surface in one model-lock run. Management (dry-run by default, confirm=true to apply, protected-app guard, every run audited to a mutation/reconcile log): disable/enable/uninstall/restore (single + fan-out), force-stop, clear-data, set an appop, and a declarative desired-state reconcile (applyDesired). syncLabels resolves human-readable app names in three layers (Play/F-Droid lookup by package id, an embedded-APK label parsed in-process without aapt, then a package-id fallback). Privacy-conscious: notification posture is derived from the POST_NOTIFICATIONS grant, never from notification content, and nothing leaves the device except the opt-in store-label lookups. Ships an app-classification report that flags unused junk, enriched by the Universal Debloater Alliance (UAD-NG) community list. Pure parsers over captured adb stdout make the whole surface unit-testable with no device.

USB-UART serial console + config management. The `serial-port` type is the raw console primitive (establish/send/read/exec/login) over a serial device (e.g. /dev/ttyUSB0); line config via stty(1), byte I/O via a direct Deno.open fd or a dd/cat subprocess fallback (auto), device paths allowlisted so login's vaulted password can't reach an arbitrary terminal. The `serial-cfgmgmt/*` types (node/exec/package/service) are the serial-console counterpart to SSH config management — for boards with no network — built on that same console primitive.

Migadu mailbox-admin REST API (v1) client for swamp. The third mail primitive

Polycom VVX phone control + real-data idle display. One model type (@shrug/polycom-vvx/phone) with typed methods 1:1 to the verified REST/push surface (discover, dial, call-forward, config get/set, UI drive, screen capture, reboot) — serialized, dry-run-by-default writes, cert-pinned TLS — plus composeIdleSnapshot, a typed-primitive interpreter that turns declarative providers + recorded Grafana data into the {tiles,rows} snapshot the render daemon serves. Ships its companion render/serve daemon (display plane the phone polls) with token-auth'd endpoints. Vaulted Basic/Digest creds; single injectable fetch seam.

Drive [Forgejo](https://forgejo.org/) and [Gitea](https://gitea.io/) instances

Drive a Twenty CRM instance over its REST v1 API (validated against v2.38.1): read/create People, Companies, Opportunities, and Notes, look records up idempotently by an immutable leadId marker (or composite email/domain filters), and self-provision the custom leadId/isEmergency fields. Its core is push_leads — a single fan-out method that ingests a batch of contact-form leads in one execution: it validates and sanitizes every field first (a bad lead writes nothing), dedups within the batch and against Twenty on leadId, reuses but never structurally mutates an existing Person, creates/links a Company only for business leads on a real corporate domain, always ensures the per-lead message Note, and flags emergency leads independently of the idempotency skip so an urgent alert can never be dropped. Mutations are confirm-gated with a no-write dryRun plan, run a live reachability pre-flight, and log the vaulted bearer token length-only. The token inherits whatever role you assign its API key in-workspace (Twenty gates by object-, field-, and row-level permissions); the REST API cannot manage roles, so emergency-record visibility is a documented UI pre-config rather than an API call. Ships a Claude skill playbook for driving the model.

Manage a Coolify instance over its REST API v1: list/get services (incl. docker_compose_raw) and applications, patch a service's compose, start/stop/restart applications, add persistent (named-volume) application storage, and trigger deploys/restarts. Also creates git-backed docker-compose applications, sets their compose location/domains, manages application env vars (secret-safe, length-only snapshots), toggles the predefined docker network, and introspects the deployment queue + build logs. Reads the instance version as a capability probe, configures an application's HTTP healthcheck, and delivers a file-mount's content via the storages API. Mutations are audited, confirm-gated, and preceded by a live reachability pre-flight check.

Mercury banking API (/api/v1) read-only source model: discover accounts and snapshot transactions as the canonical BankTxn[] contract (settled-only by default). Bearer token auth (vaulted, read-only token — no IP allowlist). The amount-sign convention (negative == outgoing debit) lives in one tested decider, verified against a live response.

Host agent for borgmatic backups over SSH. Version-aware config rendering (commands: on borgmatic ≥2.0, before_backup: on 1.8–1.9), apply-gated on `borgmatic config validate`, with install/keygen/timer convergence, on-demand backup/prune/compact/check, and queryable listArchives/info/status. Every mutation is audited on both success and failure.

Xen Orchestra (XO) / XCP-NG VM lifecycle model over the REST API (/rest/v0): create a VM from a template with cloud-init, start, stop (clean/hard), snapshot, and destroy, plus template/pool/SR/network discovery so UUIDs are resolved rather than hardcoded. Token auth via the `authenticationToken` cookie (vaulted); plain HTTPS through one injectable fetch seam, TLS verification always on (optional private-CA trust via caCert).

YNAB API (/v1) read-only source model: discover budgets and accounts, snapshot transactions as canonical BankTxn[] (design §6). YNAB amount in milliunits → decimal (abs), sign → direction (negative == debit). Delta sync via server_knowledge; deleted transactions flagged isDeleted=true.

Query UniFi Network sites via the official integration API — VLANs, firewall

CSV/OFX bank-export parser: read-only source model that emits the canonical BankTxn[] contract (design §6) — the same nullable shape @shrug/mercury emits. OFX FITID or a mapped/synthesized CSV id is the dedup key; posted rows always carry a postedDate (WREV-4). Pure-TS parsers, no host binaries.

Manage a RethinkDB instance/cluster over ReQL (rethinkdb-ts driver, no REST API): ping/health, Rule-6 fan-out sync of cluster/servers/databases/tables/issues, per-table snapshot, an idempotent declarative `provision` entrypoint plus create/delete of databases/tables/indexes and reconfigure, and a per-table JSON `backup` export. Also ships a single-document atomic-CAS distributed lock (provisionLockTable/acquireLock/releaseLock/extendLock/inspectLock/forceRelease) and a verifyDatastore probe. Mutations are confirm-gated and audited on both success and failure.

Swamp datastore backend on RethinkDB: a single-document atomic-CAS distributed lock (TTL heartbeat, nonce-gated forceRelease, stale-lock takeover), an r.now() health verifier, and a content-addressed sync tier (immutable blobs + doc-size chunking + a single rev-CAS manifest, with per-namespace manifest routing so repos sharing one database stay isolated). Wraps the proven @shrug/rethinkdb spike components.

TPM 2.0-backed non-exportable OpenPGP key via tpm2-pkcs11 + gnupg-pkcs11-scd; presents a ready GNUPGHOME for a pass vault (generate/unlock/status/revoke).

Manage FreeIPA user & host groups over the JSON-RPC API: snapshot the inventory, generic user-group CRUD (groupShow/groupAdd/groupMod/groupDel) plus a desired-state groupSync reconcile, ensure the FreeRADIUS radius-vlan-<id> group pair, and add/remove members — idempotent and auditable, with a confirm-guarded delete.

Issue, inspect, and revoke X.509 certificates for any FreeIPA principal (user/host/service) over the JSON-RPC API, with optional in-model RSA/EC keygen and vaulted private keys.