EXTENSIONS

USB-UART serial console + config management. The `serial-port` type is the raw console primitive (establish/send/read/exec/login) over a serial device (e.g. /dev/ttyUSB0); line config via stty(1), byte I/O via a direct Deno.open fd or a dd/cat subprocess fallback (auto), device paths allowlisted so login's vaulted password can't reach an arbitrary terminal. The `serial-cfgmgmt/*` types (node/exec/package/service) are the serial-console counterpart to SSH config management — for boards with no network — built on that same console primitive.

Xen Orchestra (XO) / XCP-NG VM lifecycle model over the REST API (/rest/v0): create a VM from a template with cloud-init, start, stop (clean/hard), snapshot, and destroy, plus template/pool/SR/network discovery so UUIDs are resolved rather than hardcoded. Token auth via the `authenticationToken` cookie (vaulted); plain HTTPS through one injectable fetch seam, TLS verification always on (optional private-CA trust via caCert).

Invoice Ninja v5 (`/api/v1`) model — read-side snapshots (invoices, payments,

Query UniFi Network sites via the official integration API — VLANs, firewall

CSV/OFX bank-export parser: read-only source model that emits the canonical BankTxn[] contract (design §6) — the same nullable shape @shrug/mercury emits. OFX FITID or a mapped/synthesized CSV id is the dedup key; posted rows always carry a postedDate (WREV-4). Pure-TS parsers, no host binaries.

Mercury banking API (/api/v1) read-only source model: discover accounts and snapshot transactions as the canonical BankTxn[] contract (settled-only by default). Bearer token auth (vaulted, read-only token — no IP allowlist). The amount-sign convention (negative == outgoing debit) lives in one tested decider, verified against a live response.

Manage a RethinkDB instance/cluster over ReQL (rethinkdb-ts driver, no REST API): ping/health, Rule-6 fan-out sync of cluster/servers/databases/tables/issues, per-table snapshot, an idempotent declarative `provision` entrypoint plus create/delete of databases/tables/indexes and reconfigure, and a per-table JSON `backup` export. Also ships a single-document atomic-CAS distributed lock (provisionLockTable/acquireLock/releaseLock/extendLock/inspectLock/forceRelease) and a verifyDatastore probe. Mutations are confirm-gated and audited on both success and failure.

Swamp datastore backend on RethinkDB: a single-document atomic-CAS distributed lock (TTL heartbeat, nonce-gated forceRelease, stale-lock takeover), an r.now() health verifier, and a content-addressed sync tier (immutable blobs + doc-size chunking + a single rev-CAS manifest, with per-namespace manifest routing so repos sharing one database stay isolated). Wraps the proven @shrug/rethinkdb spike components.

Query [Forgejo](https://forgejo.org/) and [Gitea](https://gitea.io/) instances

Manage FreeIPA user & host groups over the JSON-RPC API: snapshot the inventory, generic user-group CRUD (groupShow/groupAdd/groupMod/groupDel) plus a desired-state groupSync reconcile, ensure the FreeRADIUS radius-vlan-<id> group pair, and add/remove members — idempotent and auditable, with a confirm-guarded delete.

Issue, inspect, and revoke X.509 certificates for any FreeIPA principal (user/host/service) over the JSON-RPC API, with optional in-model RSA/EC keygen and vaulted private keys.

Manage a VyOS router over SSH: read the running config, apply set/delete commands via vbash, and run arbitrary op-/config-mode commands.

Manage FreeIPA sudo, HBAC, RBAC, privilege, and CA-ACL policy over the JSON-RPC API: find/show read-only snapshots plus idempotent ensureSudoRule/ensureHbacRule/ensureRole/ensurePrivilege/ensureCaAcl, fan-out member/option/privilege/permission/certprofile methods, enable/disable toggles, read-only privilege/permission/CA-ACL discovery, and confirm-guarded deletes, each mutation with an audit trail.

Manage a FreeRADIUS server wherever it runs (local | ssh | nsenter): write raddb config files atomically with backups, gate every restart on `radiusd -C`, and roll back on a failed check. Typed methods for clients, modules, VLAN post-auth policy, cert perms, and removing swamp-managed blocks.

Manage FreeIPA DNS over the JSON-RPC API: zoneFind/zoneShow/recordFind read-only snapshots plus idempotent ensureZone/ensureForwardZone and a fan-out ensureRecords (add a list of records in one call), with confirm-guarded zoneDel/recordDel — each write carrying an audit trail. ensureRecords records partial applies honestly.

Manage a Coolify instance over its REST API v1: list/get services (incl. docker_compose_raw) and applications, patch a service's compose, start/stop/restart applications, add persistent (named-volume) application storage, and trigger deploys/restarts. Mutations are audited, confirm-gated, and preceded by a live reachability pre-flight check.

Manage FreeIPA hosts over the JSON-RPC API: find/show read-only snapshots plus add/mod/del/disable writes and a desired-state sync reconcile, each with an audit trail and a confirm-guarded delete. add random:true vaults the one-time enrollment password; add/del take an optional idempotent flag.

Grafana swamp-native gaps: a control-plane admin model (idempotent ensureServiceAccount over basic-auth) plus a queryLogs extension that adds LogQL/Loki reads to @keeb/grafana/instance alongside its queryMetrics.

IPv6 address planner: region-rooted /40 allocation, /44-stride site envelopes, subnet/tunnel/loopback/anycast computation with overlap validation.

Manage FreeIPA users over the JSON-RPC API: find/show read-only snapshots plus add/mod/del/setEnabled writes and a desired-state sync reconcile, each with an audit trail and a confirm-guarded delete. add/del take an optional idempotent flag.

Reach inside a systemd-nspawn machine over SSH+nsenter: snapshot state, run an argv, read/write files atomically (with backup), and restart/inspect units — a reusable container transport.

Read-only FreeIPA domain inspection over the JSON-RPC API: realm/config, server inventory, and replication topology, plus a markdown + Mermaid summary report.