@homeflare/alchemy 0.11.0 → 0.13.0

package/dist/proxmox/index.js

@@ -230,7 +230,7 @@ var formToSend = (matches, live, props, form) => matches(live, props) || Object.
 
 // src/proxmox/resource.ts
 var pveOperations = (spec) => {
-  const read = (props) => pve(props.target, spec.readRole ?? "read", "GET", spec.path(props)).pipe(Effect5.map((data) => data === undefined ? undefined : spec.attributes(data, props)), Effect5.orElseSucceed(() => {
+  const read = (props) => pve(props.target, spec.readRole ?? "read", "GET", spec.path(props)).pipe(Effect5.map((data) => data == null ? undefined : spec.attributes(data, props)), Effect5.orElseSucceed(() => {
     return;
   }));
   return {
@@ -336,6 +336,56 @@ var ProxmoxAclProvider = () => Provider.effect(ProxmoxAcl, Effect6.succeed(Proxm
     yield* pve(olds.target, "provision", "PUT", "access/acl", removal);
   })
 })));
+// src/proxmox/alertmanager-body.ts
+var literal = (label, value) => {
+  if (/[{}\\]/.test(value) || value === "") {
+    throw new Error(`alertmanagerAlertBody: ${label} must be non-empty and hold no '{', '}' or '\\'`);
+  }
+  return JSON.stringify(value);
+};
+var absoluteUrl = (value) => {
+  const text = literal("generatorURL", value);
+  let protocol = "";
+  try {
+    protocol = new URL(value).protocol;
+  } catch {}
+  if (protocol !== "https:" && protocol !== "http:") {
+    throw new Error("alertmanagerAlertBody: generatorURL must be an absolute http(s) URL");
+  }
+  return text;
+};
+var FIELD_LABELS = [
+  ["job_type", "type"],
+  ["job_id", "job-id"],
+  ["datastore", "datastore"],
+  ["hostname", "hostname"]
+];
+var alertmanagerAlertBody = (options = {}) => {
+  const alertname = literal("alertname", options.alertname ?? "PbsNotification");
+  const source = literal("source", options.source ?? "pbs");
+  const labels = FIELD_LABELS.map(([label, field]) => `      {{#if fields.${field}}}"${label}": {{ json fields.${field} }},{{/if}}`);
+  const link = options.generatorURL === undefined ? "" : `,
+    "generatorURL": ${absoluteUrl(options.generatorURL)}`;
+  return [
+    "[",
+    "  {",
+    '    "labels": {',
+    ...labels,
+    '      "severity": {{ json severity }},',
+    `      "alertname": ${alertname},`,
+    `      "source": ${source}`,
+    "    },",
+    '    "annotations": {',
+    '      "summary": {{ json title }},',
+    '      "description": {{ json message }},',
+    '      "timestamp": "{{ timestamp }}"',
+    `    }${link}`,
+    "  }",
+    "]",
+    ""
+  ].join(`
+`);
+};
 // src/proxmox/api-token.ts
 import { Resource as Resource2 } from "alchemy";
 import * as Provider2 from "alchemy/Provider";
@@ -422,7 +472,7 @@ var handlers = {
   reconcile: Effect7.fn(function* ({ news }) {
     const live = yield* ops2.read(news);
     if (live === undefined) {
-      return yield* Effect7.die(new Error(`${news.userid}!${news.tokenid}: this resource does not create API tokens. PVE returns ` + "the secret only in the create response and it cannot be stored, so a token made here " + "would be a live credential nobody holds. Create it with `pveum user token add` and " + "capture the value, or mint a short-lived one from the OpenBao proxmox mount " + "(`bao read proxmox-tb4/creds/<role>`) -- then declare it here to manage it."));
+      return yield* Effect7.die(new Error(`${news.userid}!${news.tokenid}: this resource does not create API tokens. PVE returns ` + "the secret only in the create response and it cannot be stored, so a token made here " + "would be a live credential nobody holds. Create it with `pveum user token add` and " + "capture the value, or mint a short-lived one from the OpenBao proxmox mount " + "(`bao read proxmox-c1/creds/<role>`) -- then declare it here to manage it."));
     }
     return yield* ops2.reconcile(news);
   })
@@ -2184,11 +2234,101 @@ var handlers13 = pveHandlers({
   updateForm: updateBody2
 });
 var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Effect34.succeed(ProxmoxNodeNetwork.Provider.of(handlers13)));
-// src/proxmox/notification-target.ts
+// src/proxmox/notification-matcher.ts
 import { Resource as Resource17 } from "alchemy";
 import * as Provider17 from "alchemy/Provider";
 import * as Effect35 from "effect/Effect";
 
+// src/proxmox/notification-matcher-form.ts
+var list = (value) => Array.isArray(value) ? value.map((item) => String(item)) : [];
+var items = (values, canonical) => values.map((item) => canonical(item.trim())).filter((item) => item !== "");
+var severity = (item) => item.split(",").map((part) => part.trim()).filter((part) => part !== "").sort().join(",");
+var field4 = (item) => {
+  if (!item.startsWith("exact:"))
+    return item;
+  const at = item.indexOf("=");
+  if (at < 0)
+    return item;
+  const values = item.slice(at + 1).split(",");
+  return `${item.slice(0, at)}=${values.map((value) => value.trim()).join(",")}`;
+};
+var same3 = (item) => item;
+var canonicalRules = (fields) => ({
+  "match-calendar": items(fields["match-calendar"] ?? [], same3).sort(),
+  "match-field": items(fields["match-field"] ?? [], field4).sort(),
+  "match-severity": items(fields["match-severity"] ?? [], severity).sort(),
+  targets: items(fields.targets, same3).sort()
+});
+var matcherAttributes = (live, name) => ({
+  comment: text(live["comment"]),
+  disable: bool(live["disable"]),
+  "invert-match": bool(live["invert-match"]),
+  "match-calendar": items(list(live["match-calendar"]), same3).sort(),
+  "match-field": items(list(live["match-field"]), field4).sort(),
+  "match-severity": items(list(live["match-severity"]), severity).sort(),
+  mode: text(live["mode"], "all") || "all",
+  name,
+  origin: text(live["origin"]),
+  targets: items(list(live["target"]), same3).sort()
+});
+var equal = (a, b) => a.length === b.length && a.every((item, index) => item === b[index]);
+var matcherMatches = (attributes, fields) => {
+  const rules = canonicalRules(fields);
+  return attributes.disable === (fields.disable === true) && attributes["invert-match"] === (fields["invert-match"] === true) && attributes.mode === (fields.mode ?? "all") && equal(attributes.targets, rules.targets) && equal(attributes["match-severity"], rules["match-severity"]) && equal(attributes["match-field"], rules["match-field"]) && equal(attributes["match-calendar"], rules["match-calendar"]) && (fields.comment === undefined || attributes.comment === fields.comment);
+};
+var always = (fields) => ({
+  disable: fields.disable === true ? "1" : "0",
+  "invert-match": fields["invert-match"] === true ? "1" : "0",
+  mode: fields.mode ?? "all"
+});
+var lists = (fields) => {
+  const rules = canonicalRules(fields);
+  const out = {};
+  if (rules["match-calendar"].length > 0)
+    out["match-calendar"] = rules["match-calendar"];
+  if (rules["match-field"].length > 0)
+    out["match-field"] = rules["match-field"];
+  if (rules["match-severity"].length > 0)
+    out["match-severity"] = rules["match-severity"];
+  if (rules.targets.length > 0)
+    out.target = rules.targets;
+  return out;
+};
+var matcherCreateForm = (fields) => ({
+  ...always(fields),
+  ...lists(fields),
+  ...fields.comment === undefined || fields.comment === "" ? {} : { comment: fields.comment },
+  name: fields.name
+});
+var matcherUpdateForm = (fields) => {
+  const present = lists(fields);
+  const cleared = ["match-calendar", "match-field", "match-severity", "target"].filter((key) => present[key] === undefined);
+  if (fields.comment === "")
+    cleared.push("comment");
+  return {
+    ...always(fields),
+    ...present,
+    ...fields.comment === undefined || fields.comment === "" ? {} : { comment: fields.comment },
+    ...cleared.length === 0 ? {} : { delete: cleared }
+  };
+};
+
+// src/proxmox/notification-matcher.ts
+var ProxmoxNotificationMatcher = Resource17("Proxmox.NotificationMatcher");
+var handlers14 = pveHandlers({
+  attributes: (live, props) => matcherAttributes(live, props.name),
+  collection: () => "cluster/notifications/matchers",
+  createForm: matcherCreateForm,
+  matches: matcherMatches,
+  path: (props) => `cluster/notifications/matchers/${props.name}`,
+  updateForm: matcherUpdateForm
+});
+var ProxmoxNotificationMatcherProvider = () => Provider17.effect(ProxmoxNotificationMatcher, Effect35.succeed(ProxmoxNotificationMatcher.Provider.of(handlers14)));
+// src/proxmox/notification-target.ts
+import { Resource as Resource18 } from "alchemy";
+import * as Provider18 from "alchemy/Provider";
+import * as Effect36 from "effect/Effect";
+
 // src/proxmox/notification-target-form.ts
 var REPEATED_KEY = "\x00";
 var portOf = (value) => {
@@ -2217,8 +2357,8 @@ var shape4 = (props) => ({
 });
 
 // src/proxmox/notification-target.ts
-var ProxmoxNotificationTarget = Resource17("Proxmox.NotificationTarget");
-var handlers14 = pveHandlers({
+var ProxmoxNotificationTarget = Resource18("Proxmox.NotificationTarget");
+var handlers15 = pveHandlers({
   attributes: (live, props) => ({
     author: text(live["author"]),
     body: text(live["body"]),
@@ -2243,15 +2383,15 @@ var handlers14 = pveHandlers({
   path: (props) => `cluster/notifications/endpoints/${props.type}/${props.name}`,
   updateForm: shape4
 });
-var ProxmoxNotificationTargetProvider = () => Provider17.effect(ProxmoxNotificationTarget, Effect35.succeed(ProxmoxNotificationTarget.Provider.of(handlers14)));
+var ProxmoxNotificationTargetProvider = () => Provider18.effect(ProxmoxNotificationTarget, Effect36.succeed(ProxmoxNotificationTarget.Provider.of(handlers15)));
 // src/proxmox/pbs-datastore.ts
-import { Resource as Resource18 } from "alchemy";
+import { Resource as Resource19 } from "alchemy";
 import { isResolved as isResolved8 } from "alchemy/Diff";
-import * as Provider18 from "alchemy/Provider";
-import * as Effect38 from "effect/Effect";
+import * as Provider19 from "alchemy/Provider";
+import * as Effect39 from "effect/Effect";
 
 // src/proxmox/pbs-datastore-form.ts
-import * as Effect36 from "effect/Effect";
+import * as Effect37 from "effect/Effect";
 var attributes = (live, props) => ({
   backend: propertyString(live["backend"]),
   comment: text(live["comment"]),
@@ -2273,8 +2413,8 @@ var attributes = (live, props) => ({
   tuning: propertyString(live["tuning"]),
   "verify-new": bool(live["verify-new"])
 });
-var same3 = (declared, live) => declared === undefined || declared === live;
-var matches = (live, props) => same3(props.comment, live.comment) && same3(props["gc-schedule"]?.trim(), live["gc-schedule"]) && same3(props["prune-schedule"]?.trim(), live["prune-schedule"]) && same3(props["keep-last"], live["keep-last"]) && same3(props["keep-hourly"], live["keep-hourly"]) && same3(props["keep-daily"], live["keep-daily"]) && same3(props["keep-weekly"], live["keep-weekly"]) && same3(props["keep-monthly"], live["keep-monthly"]) && same3(props["keep-yearly"], live["keep-yearly"]) && same3(props["notify-user"], live["notify-user"]) && same3(props["counter-reset-schedule"]?.trim(), live["counter-reset-schedule"]) && (props["notification-thresholds"] === undefined || propertyString(props["notification-thresholds"]) === live["notification-thresholds"]) && same3(props["verify-new"], live["verify-new"]) && (props.notify === undefined || propertyString(props.notify) === live.notify) && (props.tuning === undefined || propertyString(props.tuning) === live.tuning) && (props["maintenance-mode"] === undefined || propertyString(props["maintenance-mode"], "type") === live["maintenance-mode"]);
+var same4 = (declared, live) => declared === undefined || declared === live;
+var matches = (live, props) => same4(props.comment, live.comment) && same4(props["gc-schedule"]?.trim(), live["gc-schedule"]) && same4(props["prune-schedule"]?.trim(), live["prune-schedule"]) && same4(props["keep-last"], live["keep-last"]) && same4(props["keep-hourly"], live["keep-hourly"]) && same4(props["keep-daily"], live["keep-daily"]) && same4(props["keep-weekly"], live["keep-weekly"]) && same4(props["keep-monthly"], live["keep-monthly"]) && same4(props["keep-yearly"], live["keep-yearly"]) && same4(props["notify-user"], live["notify-user"]) && same4(props["counter-reset-schedule"]?.trim(), live["counter-reset-schedule"]) && (props["notification-thresholds"] === undefined || propertyString(props["notification-thresholds"]) === live["notification-thresholds"]) && same4(props["verify-new"], live["verify-new"]) && (props.notify === undefined || propertyString(props.notify) === live.notify) && (props.tuning === undefined || propertyString(props.tuning) === live.tuning) && (props["maintenance-mode"] === undefined || propertyString(props["maintenance-mode"], "type") === live["maintenance-mode"]);
 var set2 = (key, value) => value === undefined ? {} : { [key]: value };
 var count = (value) => value === undefined ? undefined : String(value);
 var mutable = (props) => ({
@@ -2303,36 +2443,36 @@ var createForm4 = (props) => ({
 });
 var updateForm = (props) => mutable(props);
 var object2 = (props) => `config/datastore/${props.name}`;
-var readOne = (props) => pve(props.target, "read", "GET", object2(props)).pipe(Effect36.map((live) => live === undefined || typeof live["name"] !== "string" ? undefined : attributes(live, props)), Effect36.orElseSucceed(() => {
+var readOne = (props) => pve(props.target, "read", "GET", object2(props)).pipe(Effect37.map((live) => live === undefined || typeof live["name"] !== "string" ? undefined : attributes(live, props)), Effect37.orElseSucceed(() => {
   return;
 }));
 
 // src/proxmox/pbs-datastore-guard.ts
-import * as Effect37 from "effect/Effect";
+import * as Effect38 from "effect/Effect";
 var samePath = (left, right) => {
   const trim = (value) => value.length > 1 ? value.replace(/\/+$/, "") : value;
   return trim(left) === trim(right);
 };
-var guardPath = (live, props) => live.path === "" || samePath(live.path, props.path) ? Effect37.void : Effect37.die(new Error(`${object2(props)}: declared path ${props.path} but PBS holds ${live.path}. \`path\` ` + "is create-only, so this cannot be reconciled and will NOT be planned as a silent " + "noop: backups would keep landing in the old directory behind a green plan. Correct " + "the declaration, or remove the datastore and declare a new one -- the contents live, " + "because `destroy-data` is never sent."));
-var guardBackend = (live, props) => props.backend === undefined || propertyString(props.backend) === live.backend ? Effect37.void : Effect37.die(new Error(`${object2(props)}: declared backend ${props.backend} but PBS holds ` + `${live.backend === "" ? "(none — a local datastore)" : live.backend}. \`backend\` ` + "is create-only: PBS has no update for it, so this cannot be reconciled and will NOT " + "be planned as a silent noop. Correct the declaration to match what is really there, " + "or remove the datastore and declare a new one -- the contents live, because " + "`destroy-data` is never sent."));
-var settle3 = (read3, done) => Effect37.gen(function* () {
+var guardPath = (live, props) => live.path === "" || samePath(live.path, props.path) ? Effect38.void : Effect38.die(new Error(`${object2(props)}: declared path ${props.path} but PBS holds ${live.path}. \`path\` ` + "is create-only, so this cannot be reconciled and will NOT be planned as a silent " + "noop: backups would keep landing in the old directory behind a green plan. Correct " + "the declaration, or remove the datastore and declare a new one -- the contents live, " + "because `destroy-data` is never sent."));
+var guardBackend = (live, props) => props.backend === undefined || propertyString(props.backend) === live.backend ? Effect38.void : Effect38.die(new Error(`${object2(props)}: declared backend ${props.backend} but PBS holds ` + `${live.backend === "" ? "(none — a local datastore)" : live.backend}. \`backend\` ` + "is create-only: PBS has no update for it, so this cannot be reconciled and will NOT " + "be planned as a silent noop. Correct the declaration to match what is really there, " + "or remove the datastore and declare a new one -- the contents live, because " + "`destroy-data` is never sent."));
+var settle3 = (read3, done) => Effect38.gen(function* () {
   for (let attempt = 0;attempt < 60; attempt += 1) {
     const live = yield* read3;
     if (done(live))
       return live;
-    yield* Effect37.sleep("2 seconds");
+    yield* Effect38.sleep("2 seconds");
   }
   return yield* read3;
 });
 
 // src/proxmox/pbs-datastore.ts
-var PbsDatastore = Resource18("Pbs.Datastore", {
+var PbsDatastore = Resource19("Pbs.Datastore", {
   defaultRemovalPolicy: "retain"
 });
-var PbsDatastoreProvider = () => Provider18.effect(PbsDatastore, Effect38.succeed(PbsDatastore.Provider.of({
-  list: () => Effect38.succeed([]),
+var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect39.succeed(PbsDatastore.Provider.of({
+  list: () => Effect39.succeed([]),
   read: ({ olds }) => readOne(olds),
-  diff: ({ news, output }) => Effect38.gen(function* () {
+  diff: ({ news, output }) => Effect39.gen(function* () {
     if (output === undefined || !isResolved8(news))
       return;
     const live = yield* readOne(news);
@@ -2342,7 +2482,7 @@ var PbsDatastoreProvider = () => Provider18.effect(PbsDatastore, Effect38.succee
     yield* guardBackend(live, news);
     return matches(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect38.fn(function* ({ news }) {
+  reconcile: Effect39.fn(function* ({ news }) {
     const live = yield* readOne(news);
     let upid;
     if (live === undefined) {
@@ -2357,22 +2497,373 @@ var PbsDatastoreProvider = () => Provider18.effect(PbsDatastore, Effect38.succee
     }
     const after = yield* settle3(readOne(news), (row) => row !== undefined && matches(row, news));
     if (after === undefined || !matches(after, news)) {
-      return yield* Effect38.die(new Error(`${object2(news)}: the write returned no error but the datastore still does not ` + `match the declaration after 120s. PBS answered with task ${upid ?? "(none)"} ` + "-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a " + "plausible cause (see `settle`); a create over an existing chunk store is not, " + "because PBS refuses that outright rather than timing out."));
+      return yield* Effect39.die(new Error(`${object2(news)}: the write returned no error but the datastore still does not ` + `match the declaration after 120s. PBS answered with task ${upid ?? "(none)"} ` + "-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a " + "plausible cause (see `settle`); a create over an existing chunk store is not, " + "because PBS refuses that outright rather than timing out."));
     }
     return after;
   }),
-  delete: Effect38.fn(function* ({ olds }) {
+  delete: Effect39.fn(function* ({ olds }) {
     yield* pve(olds.target, "provision", "DELETE", object2(olds));
     const left = yield* settle3(readOne(olds), (row) => row === undefined);
     if (left !== undefined) {
-      return yield* Effect38.die(new Error(`${object2(olds)}: the DELETE returned no error but the datastore is still in ` + "datastore.cfg after 120s. Either a backup, verify or GC task still holds it, " + "or the provision role lacks Datastore.Allocate on /datastore/" + `${olds.name}. Read the task log with \`proxmox-backup-manager task log <upid>\`.`));
+      return yield* Effect39.die(new Error(`${object2(olds)}: the DELETE returned no error but the datastore is still in ` + "datastore.cfg after 120s. Either a backup, verify or GC task still holds it, " + "or the provision role lacks Datastore.Allocate on /datastore/" + `${olds.name}. Read the task log with \`proxmox-backup-manager task log <upid>\`.`));
     }
   })
 })));
+// src/proxmox/pbs-notification-matcher.ts
+import { Resource as Resource20 } from "alchemy";
+import * as Provider20 from "alchemy/Provider";
+import * as Effect40 from "effect/Effect";
+var PbsNotificationMatcher = Resource20("Pbs.NotificationMatcher");
+var handlers16 = pveHandlers({
+  attributes: (live, props) => matcherAttributes(live, props.name),
+  collection: () => "config/notifications/matchers",
+  createForm: matcherCreateForm,
+  matches: matcherMatches,
+  path: (props) => `config/notifications/matchers/${props.name}`,
+  updateForm: matcherUpdateForm
+});
+var PbsNotificationMatcherProvider = () => Provider20.effect(PbsNotificationMatcher, Effect40.succeed(PbsNotificationMatcher.Provider.of(handlers16)));
+// src/proxmox/pbs-notification-target.ts
+import { Resource as Resource21 } from "alchemy";
+import * as Provider21 from "alchemy/Provider";
+import * as Effect42 from "effect/Effect";
+
+// src/proxmox/pbs-notification-target-lifecycle.ts
+import { isResolved as isResolved9 } from "alchemy/Diff";
+import * as Effect41 from "effect/Effect";
+
+// src/proxmox/credential-literals.ts
+var READS_SECRET = /\{\{[^}]*\bsecrets\./;
+var CREDENTIAL_WORD = /(^|[-_])(api[-_]?key|apikey|key|token|secret|password|passwd|pwd|pass|auth|signature|sig|code)($|[-_])/i;
+var CREDENTIAL_HEADER = /^(proxy-authorization|authorization|cookie)$/i;
+var isCredentialName = (name) => CREDENTIAL_HEADER.test(name) || CREDENTIAL_WORD.test(name);
+var literal2 = (value) => value !== "" && !READS_SECRET.test(value);
+var literalCredentialHeaders = (header) => Object.entries(header ?? {}).filter(([name, value]) => typeof value === "string" && isCredentialName(name)).filter(([, value]) => literal2(value)).map(([name]) => name).sort();
+var literalCredentialsInUrl = (url) => {
+  if (url === undefined)
+    return [];
+  const out = [];
+  const authority = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i.exec(url)?.[1] ?? "";
+  const at = authority.lastIndexOf("@");
+  if (at >= 0) {
+    const userinfo = authority.slice(0, at);
+    const colon = userinfo.indexOf(":");
+    if (colon >= 0 && literal2(userinfo.slice(colon + 1)))
+      out.push("userinfo");
+  }
+  const params = url.replace(/^[^?#]*/, "");
+  for (const pair of params.split(/[?&#]/)) {
+    const eq = pair.indexOf("=");
+    const name = eq < 0 ? pair : pair.slice(0, eq);
+    if (eq >= 0 && isCredentialName(name) && literal2(pair.slice(eq + 1)))
+      out.push(`?${name}`);
+  }
+  return out;
+};
+
+// src/proxmox/pbs-notification-target-wire.ts
+import { Buffer as Buffer2 } from "node:buffer";
+
+// src/proxmox/write-only.ts
+import { Buffer } from "node:buffer";
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+var resolveAll = (refs, env = process.env) => {
+  const values = {};
+  const missing = [];
+  for (const [key, ref] of Object.entries(refs)) {
+    const value = env[ref.fromEnv];
+    if (value === undefined || value === "")
+      missing.push(ref.fromEnv);
+    else
+      values[key] = value;
+  }
+  return { missing: [...new Set(missing)].sort(), values };
+};
+var COST = { N: 16384, maxmem: 64 * 1024 * 1024, p: 1, r: 8 };
+var PREFIX = "scrypt";
+var canonical = (values) => JSON.stringify(Object.keys(values).sort().map((key) => [key, values[key]]));
+var digest = (salt, values) => scryptSync(canonical(values), salt, 32, COST);
+var seal = (values, salt) => {
+  if (Object.keys(values).length === 0)
+    return "";
+  const bytes = salt === undefined ? randomBytes(16) : Buffer.from(salt, "utf8");
+  return `${PREFIX}:${bytes.toString("base64url")}:${digest(bytes, values).toString("base64url")}`;
+};
+var sealMatches = (sealed, values) => {
+  if (sealed === "")
+    return Object.keys(values).length === 0;
+  const [prefix, salt, stored, extra] = sealed.split(":");
+  if (prefix !== PREFIX || salt === undefined || stored === undefined || extra !== undefined) {
+    return false;
+  }
+  const expected = Buffer.from(stored, "base64url");
+  const actual = digest(Buffer.from(salt, "base64url"), values);
+  return expected.length === actual.length && timingSafeEqual(expected, actual);
+};
+
+// src/proxmox/pbs-notification-target-wire.ts
+var base64 = (value) => Buffer2.from(value, "utf8").toString("base64");
+var unbase64 = (value) => Buffer2.from(value, "base64").toString("utf8");
+var keyAndValue = (item) => {
+  const parts = {};
+  for (const part of item.split(",")) {
+    const at = part.indexOf("=");
+    if (at > 0)
+      parts[part.slice(0, at).trim()] = part.slice(at + 1).trim();
+  }
+  const value = parts["value"];
+  return value === undefined ? { name: parts["name"] ?? "" } : { name: parts["name"] ?? "", value };
+};
+var wireItem = (name, value) => `name=${name},value=${base64(value)}`;
+var list2 = (value) => Array.isArray(value) ? value.map((item) => String(item)) : [];
+var names = (keys) => [...keys].filter((key) => key !== "").sort().join(",");
+var headerDigest = (target, pairs2) => seal(pairs2, `hf:pbs-notification-target:${target}:header`);
+var targetAttributes = (live, props) => {
+  const headers = {};
+  for (const item of list2(live["header"])) {
+    const { name, value } = keyAndValue(item);
+    if (name !== "")
+      headers[name] = unbase64(value ?? "");
+  }
+  const secrets = list2(live["secret"]).map((item) => keyAndValue(item).name);
+  return {
+    author: text(live["author"]),
+    body: unbase64(text(live["body"])),
+    comment: text(live["comment"]),
+    disable: bool(live["disable"]),
+    "from-address": text(live["from-address"]),
+    header: names(Object.keys(headers)),
+    headerDigest: headerDigest(props.name, headers),
+    mailto: addressList(live["mailto"]),
+    "mailto-user": addressList(live["mailto-user"]),
+    method: text(live["method"]),
+    mode: text(live["mode"]),
+    name: props.name,
+    origin: text(live["origin"]),
+    port: portOf(live["port"]),
+    secret: names(secrets),
+    sealed: "",
+    server: text(live["server"]),
+    type: props.type,
+    url: text(live["url"]),
+    username: text(live["username"])
+  };
+};
+
+// src/proxmox/pbs-notification-target-form.ts
+var OWNED = {
+  author: ["sendmail", "smtp"],
+  body: ["webhook"],
+  "from-address": ["sendmail", "smtp"],
+  header: ["webhook"],
+  mailto: ["sendmail", "smtp"],
+  "mailto-user": ["sendmail", "smtp"],
+  method: ["webhook"],
+  mode: ["smtp"],
+  password: ["smtp"],
+  port: ["smtp"],
+  secret: ["webhook"],
+  server: ["smtp"],
+  url: ["webhook"],
+  username: ["smtp"]
+};
+var REQUIRED = {
+  sendmail: [],
+  smtp: ["server", "from-address"],
+  webhook: ["url", "method"]
+};
+var CLEAN_NAME = /^[^,=\s]+$/;
+var WRITE_ONLY = "declare it { fromEnv: 'NAME' }, or keep it in 'secret' and write {{ secrets.<name> }}";
+var refusals = (props) => {
+  const out = [];
+  for (const [field5, types] of Object.entries(OWNED)) {
+    if (props[field5] !== undefined && !types.includes(props.type)) {
+      out.push(`'${field5}' belongs to ${types.join("/")} targets, not ${props.type}`);
+    }
+  }
+  for (const field5 of REQUIRED[props.type]) {
+    if (props[field5] === undefined || props[field5] === "")
+      out.push(`${props.type} needs '${field5}'`);
+  }
+  for (const key of [...Object.keys(props.header ?? {}), ...Object.keys(props.secret ?? {})]) {
+    if (!CLEAN_NAME.test(key))
+      out.push(`'${key}' cannot be a header or secret name`);
+  }
+  for (const name of literalCredentialHeaders(props.header)) {
+    out.push(`header '${name}' holds a literal credential; ${WRITE_ONLY}`);
+  }
+  for (const where of literalCredentialsInUrl(props.url)) {
+    out.push(`'url' ${where} holds a literal credential; ${WRITE_ONLY}`);
+  }
+  return out;
+};
+var isFromEnv = (value) => typeof value !== "string";
+var resolveGroups = (props, env = process.env) => {
+  const headerRefs = {};
+  const headers = {};
+  for (const [name, value] of Object.entries(props.header ?? {})) {
+    if (isFromEnv(value))
+      headerRefs[name] = value;
+    else
+      headers[name] = value;
+  }
+  const header = resolveAll(headerRefs, env);
+  const sealedRefs = {};
+  for (const [name, ref] of Object.entries(props.secret ?? {}))
+    sealedRefs[`secret:${name}`] = ref;
+  if (props.password !== undefined)
+    sealedRefs["password"] = props.password;
+  const sealed = resolveAll(sealedRefs, env);
+  return {
+    header: { missing: header.missing, values: { ...headers, ...header.values } },
+    sealed
+  };
+};
+var same5 = (declared, live) => declared === undefined || declared === live;
+var plainMatches = (live, props) => live.disable === (props.disable === true) && same5(props.comment, live.comment) && same5(props.author, live.author) && same5(props["from-address"], live["from-address"]) && same5(props.server, live.server) && (props.port === undefined || props.port === live.port) && same5(props.mode, live.mode) && same5(props.username, live.username) && same5(props.url, live.url) && same5(props.method, live.method) && same5(props.body, live.body) && (props.mailto === undefined || addressList(props.mailto) === live.mailto) && (props["mailto-user"] === undefined || addressList(props["mailto-user"]) === live["mailto-user"]);
+var headerState = (live, props, groups) => {
+  if (props.header === undefined)
+    return "match";
+  if (names(Object.keys(props.header)) !== live.header)
+    return "stale";
+  if (groups.header.missing.length > 0)
+    return "unknown";
+  return headerDigest(props.name, groups.header.values) === live.headerDigest ? "match" : "stale";
+};
+var sealedState = (live, props, groups, sealed) => {
+  if (props.secret === undefined && props.password === undefined)
+    return "match";
+  if (props.secret !== undefined && names(Object.keys(props.secret)) !== live.secret)
+    return "stale";
+  if (groups.sealed.missing.length > 0 || sealed === "")
+    return "unknown";
+  return sealMatches(sealed, groups.sealed.values) ? "match" : "stale";
+};
+var secretItems = (props, groups) => Object.keys(props.secret ?? {}).map((name) => wireItem(name, groups.sealed.values[`secret:${name}`] ?? ""));
+var headerItems = (props, groups) => Object.keys(props.header ?? {}).map((name) => wireItem(name, groups.header.values[name] ?? ""));
+var plainPairs = (props) => [
+  ["author", props.author ?? ""],
+  ["body", props.body === undefined ? "" : base64(props.body)],
+  ["comment", props.comment ?? ""],
+  ["from-address", props["from-address"] ?? ""],
+  ["method", props.method ?? ""],
+  ["mode", props.mode ?? ""],
+  ["port", props.port === undefined ? "" : String(props.port)],
+  ["server", props.server ?? ""],
+  ["url", props.url ?? ""],
+  ["username", props.username ?? ""],
+  ["mailto", props.mailto === undefined ? [] : addressList(props.mailto).split(",")],
+  [
+    "mailto-user",
+    props["mailto-user"] === undefined ? [] : addressList(props["mailto-user"]).split(",")
+  ]
+];
+var declared = (props, key) => props[key] !== undefined;
+var empty = (value) => typeof value === "string" ? value === "" : value.filter((item) => item !== "").length === 0;
+var targetForm = (props, groups, carry, mode) => {
+  const form = {
+    disable: props.disable === true ? "1" : "0"
+  };
+  const cleared = [];
+  const put = (key, value) => {
+    if (!empty(value))
+      form[key] = value;
+    else if (mode === "update")
+      cleared.push(key);
+  };
+  for (const [key, value] of plainPairs(props))
+    if (declared(props, key))
+      put(key, value);
+  if (carry.header && props.header !== undefined)
+    put("header", headerItems(props, groups));
+  if (carry.sealed && props.secret !== undefined)
+    put("secret", secretItems(props, groups));
+  if (carry.sealed && props.password !== undefined) {
+    form["password"] = groups.sealed.values["password"] ?? "";
+  }
+  if (mode === "create")
+    form["name"] = props.name;
+  if (cleared.length > 0)
+    form["delete"] = cleared;
+  return form;
+};
+
+// src/proxmox/pbs-notification-target-lifecycle.ts
+var path = (props) => `config/notifications/endpoints/${props.type}/${props.name}`;
+var readLive2 = (props) => pve(props.target, "read", "GET", path(props)).pipe(Effect41.map((data) => data == null ? undefined : targetAttributes(data, props)), Effect41.orElseSucceed(() => {
+  return;
+}));
+var refuse2 = (props) => {
+  const reasons = refusals(props);
+  return reasons.length === 0 ? Effect41.void : Effect41.die(new Error(`${path(props)}: ${reasons.join("; ")}.`));
+};
+var toCarry = (live, props, groups, sealed) => {
+  const header = headerState(live, props, groups) === "stale";
+  const sealedStale = sealedState(live, props, groups, sealed) === "stale";
+  return plainMatches(live, props) && !header && !sealedStale ? undefined : { header, sealed: sealedStale };
+};
+var requireValues = (props, groups, carry) => {
+  const missing = [
+    ...carry.header ? groups.header.missing : [],
+    ...carry.sealed ? groups.sealed.missing : []
+  ];
+  return missing.length === 0 ? Effect41.void : Effect41.die(new Error(`${path(props)}: this write must send write-only values, and ${missing.join(", ")} ` + "is unset or empty in the deploying environment. Export it and deploy again."));
+};
+var handlers17 = {
+  list: () => Effect41.succeed([]),
+  read: ({ olds, output }) => (output === undefined ? refuse2(olds) : Effect41.void).pipe(Effect41.andThen(readLive2(olds)), Effect41.map((live) => live === undefined ? undefined : { ...live, sealed: output?.sealed ?? "" })),
+  diff: ({
+    news,
+    olds,
+    output
+  }) => Effect41.gen(function* () {
+    if (output === undefined || !isResolved9(news))
+      return;
+    if (olds !== undefined && (olds.type !== news.type || olds.name !== news.name)) {
+      return { action: "replace", deleteFirst: olds.name === news.name };
+    }
+    yield* refuse2(news);
+    const live = yield* readLive2(news);
+    if (live === undefined)
+      return { action: "update" };
+    return toCarry(live, news, resolveGroups(news), output.sealed) === undefined ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: ({ news, output }) => Effect41.gen(function* () {
+    yield* refuse2(news);
+    const groups = resolveGroups(news);
+    const live = yield* readLive2(news);
+    let sealed = output?.sealed ?? "";
+    if (live === undefined) {
+      const carry = { header: true, sealed: true };
+      yield* requireValues(news, groups, carry);
+      const collection2 = `config/notifications/endpoints/${news.type}`;
+      yield* pve(news.target, "provision", "POST", collection2, targetForm(news, groups, carry, "create"));
+      sealed = seal(groups.sealed.values);
+    } else {
+      const carry = toCarry(live, news, groups, sealed);
+      if (carry !== undefined) {
+        yield* requireValues(news, groups, carry);
+        yield* pve(news.target, "provision", "PUT", path(news), targetForm(news, groups, carry, "update"));
+        if (carry.sealed)
+          sealed = seal(groups.sealed.values);
+      }
+    }
+    const after = yield* readLive2(news);
+    if (after === undefined) {
+      return yield* Effect41.die(new Error(`${path(news)}: the write returned no error but the target is still absent.`));
+    }
+    return { ...after, sealed };
+  }),
+  delete: ({ olds }) => pve(olds.target, "provision", "DELETE", path(olds))
+};
+
+// src/proxmox/pbs-notification-target.ts
+var PbsNotificationTarget = Resource21("Pbs.NotificationTarget");
+var PbsNotificationTargetProvider = () => Provider21.effect(PbsNotificationTarget, Effect42.succeed(PbsNotificationTarget.Provider.of(handlers17)));
 // src/proxmox/pbs-prune-job.ts
-import { Resource as Resource19 } from "alchemy";
-import * as Provider19 from "alchemy/Provider";
-import * as Effect39 from "effect/Effect";
+import { Resource as Resource22 } from "alchemy";
+import * as Provider22 from "alchemy/Provider";
+import * as Effect43 from "effect/Effect";
 
 // src/proxmox/pbs-prune-job-form.ts
 var KEEP_KEYS = [
@@ -2407,14 +2898,14 @@ var requireKeeps = (props) => {
     return;
   throw new Error(`Pbs.PruneJob ${props.id}: declares no keep-* window, which tells PBS to keep NOTHING on ` + `datastore '${props.store}'. Every keep-* is optional on the wire, so an omission and a ` + 'deliberate "retain nothing" are indistinguishable; declare at least one window (keep-last, ' + "keep-hourly, keep-daily, keep-weekly, keep-monthly or keep-yearly) or delete the job.");
 };
-var field4 = (name, value) => value === undefined ? {} : { [name]: value };
+var field5 = (name, value) => value === undefined ? {} : { [name]: value };
 var integer = (value) => value === undefined ? undefined : String(value);
 var shape5 = (props) => ({
   ...keepForm(props),
-  ...field4("comment", props.comment),
-  ...field4("disable", flag(props.disable)),
-  ...field4("max-depth", integer(props["max-depth"])),
-  ...field4("ns", props.ns),
+  ...field5("comment", props.comment),
+  ...field5("disable", flag(props.disable)),
+  ...field5("max-depth", integer(props["max-depth"])),
+  ...field5("ns", props.ns),
   schedule: props.schedule,
   store: props.store
 });
@@ -2428,9 +2919,9 @@ var updateBody3 = (props) => {
 };
 
 // src/proxmox/pbs-prune-job.ts
-var PbsPruneJob = Resource19("Pbs.PruneJob");
-var same4 = (declared, live) => declared === undefined || declared === live;
-var handlers15 = pveHandlers({
+var PbsPruneJob = Resource22("Pbs.PruneJob");
+var same6 = (declared2, live) => declared2 === undefined || declared2 === live;
+var handlers18 = pveHandlers({
   attributes: (live, props) => ({
     comment: text(live["comment"], ""),
     disable: bool(live["disable"], false),
@@ -2443,15 +2934,15 @@ var handlers15 = pveHandlers({
   }),
   collection: () => "config/prune",
   createForm: createBody2,
-  matches: (attributes2, props) => attributes2.schedule === props.schedule && attributes2.store === props.store && same4(props.ns, attributes2.ns) && same4(props["max-depth"], attributes2["max-depth"]) && same4(props.disable, attributes2.disable) && same4(props.comment, attributes2.comment) && keepsMatch(attributes2, props),
+  matches: (attributes2, props) => attributes2.schedule === props.schedule && attributes2.store === props.store && same6(props.ns, attributes2.ns) && same6(props["max-depth"], attributes2["max-depth"]) && same6(props.disable, attributes2.disable) && same6(props.comment, attributes2.comment) && keepsMatch(attributes2, props),
   path: (props) => `config/prune/${props.id}`,
   updateForm: updateBody3
 });
-var PbsPruneJobProvider = () => Provider19.effect(PbsPruneJob, Effect39.succeed(PbsPruneJob.Provider.of(handlers15)));
+var PbsPruneJobProvider = () => Provider22.effect(PbsPruneJob, Effect43.succeed(PbsPruneJob.Provider.of(handlers18)));
 // src/proxmox/pbs-sync-job.ts
-import { Resource as Resource20 } from "alchemy";
-import * as Provider20 from "alchemy/Provider";
-import * as Effect40 from "effect/Effect";
+import { Resource as Resource23 } from "alchemy";
+import * as Provider23 from "alchemy/Provider";
+import * as Effect44 from "effect/Effect";
 
 // src/proxmox/pbs-sync-job-form.ts
 var UNSET4 = -1;
@@ -2499,7 +2990,7 @@ var createBody3 = (props) => ({
   ...props["sync-direction"] === undefined ? {} : { "sync-direction": props["sync-direction"] }
 });
 var updateBody4 = (props) => shape6(props);
-var handlers16 = pveHandlers({
+var handlers19 = pveHandlers({
   attributes: (live, props) => ({
     comment: text(live["comment"], ""),
     "group-filter": filters(live["group-filter"]),
@@ -2526,12 +3017,12 @@ var handlers16 = pveHandlers({
 });
 
 // src/proxmox/pbs-sync-job.ts
-var PbsSyncJob = Resource20("Pbs.SyncJob");
-var PbsSyncJobProvider = () => Provider20.effect(PbsSyncJob, Effect40.succeed(PbsSyncJob.Provider.of(handlers16)));
+var PbsSyncJob = Resource23("Pbs.SyncJob");
+var PbsSyncJobProvider = () => Provider23.effect(PbsSyncJob, Effect44.succeed(PbsSyncJob.Provider.of(handlers19)));
 // src/proxmox/pbs-verify-job.ts
-import { Resource as Resource21 } from "alchemy";
-import * as Provider21 from "alchemy/Provider";
-import * as Effect41 from "effect/Effect";
+import { Resource as Resource24 } from "alchemy";
+import * as Provider24 from "alchemy/Provider";
+import * as Effect45 from "effect/Effect";
 
 // src/proxmox/pbs-verify-job-form.ts
 var rechecks = (ignoreVerified, outdatedAfter) => {
@@ -2552,8 +3043,8 @@ var shape7 = (props) => ({
 });
 
 // src/proxmox/pbs-verify-job.ts
-var PbsVerifyJob = Resource21("Pbs.VerifyJob");
-var handlers17 = pveHandlers({
+var PbsVerifyJob = Resource24("Pbs.VerifyJob");
+var handlers20 = pveHandlers({
   attributes: (live, props) => {
     const ignoreVerified = bool(live["ignore-verified"], true);
     const outdatedAfter = int(live["outdated-after"], -1);
@@ -2575,12 +3066,12 @@ var handlers17 = pveHandlers({
   path: (props) => `config/verify/${props.id}`,
   updateForm: shape7
 });
-var PbsVerifyJobProvider = () => Provider21.effect(PbsVerifyJob, Effect41.succeed(PbsVerifyJob.Provider.of(handlers17)));
+var PbsVerifyJobProvider = () => Provider24.effect(PbsVerifyJob, Effect45.succeed(PbsVerifyJob.Provider.of(handlers20)));
 // src/proxmox/pool.ts
-import { Resource as Resource22 } from "alchemy";
-import * as Provider22 from "alchemy/Provider";
-import * as Effect42 from "effect/Effect";
-var ProxmoxPool = Resource22("Proxmox.Pool");
+import { Resource as Resource25 } from "alchemy";
+import * as Provider25 from "alchemy/Provider";
+import * as Effect46 from "effect/Effect";
+var ProxmoxPool = Resource25("Proxmox.Pool");
 var poolCreateForm = (props) => ({
   comment: props.comment ?? "",
   poolid: props.poolid
@@ -2588,7 +3079,7 @@ var poolCreateForm = (props) => ({
 var poolUpdateForm = (props) => ({
   comment: props.comment ?? ""
 });
-var handlers18 = pveHandlers({
+var handlers21 = pveHandlers({
   attributes: (live, props) => {
     const row = live;
     return {
@@ -2603,13 +3094,287 @@ var handlers18 = pveHandlers({
   path: (props) => `pools/${props.poolid}`,
   updateForm: poolUpdateForm
 });
-var ProxmoxPoolProvider = () => Provider22.effect(ProxmoxPool, Effect42.succeed(ProxmoxPool.Provider.of(handlers18)));
-// src/proxmox/qemu.ts
-import { Resource as Resource23 } from "alchemy";
-import * as Provider23 from "alchemy/Provider";
-import * as Effect43 from "effect/Effect";
-var ProxmoxVm = Resource23("Proxmox.Vm");
+var ProxmoxPoolProvider = () => Provider25.effect(ProxmoxPool, Effect46.succeed(ProxmoxPool.Provider.of(handlers21)));
+// src/proxmox/provision-baseline.ts
+var PROVISION_PRIVILEGES = Object.freeze([
+  "Datastore.Allocate",
+  "Datastore.AllocateSpace",
+  "Datastore.Audit",
+  "Group.Allocate",
+  "Mapping.Audit",
+  "Mapping.Modify",
+  "Permissions.Modify",
+  "Pool.Allocate",
+  "Pool.Audit",
+  "Realm.AllocateUser",
+  "SDN.Allocate",
+  "SDN.Audit",
+  "SDN.Use",
+  "Sys.Audit",
+  "Sys.Console",
+  "Sys.Modify",
+  "User.Modify",
+  "VM.Allocate",
+  "VM.Audit",
+  "VM.Backup",
+  "VM.Config.CPU",
+  "VM.Config.Disk",
+  "VM.Config.HWType",
+  "VM.Config.Memory",
+  "VM.Config.Network",
+  "VM.Config.Options",
+  "VM.PowerMgmt"
+]);
+var PROVISION_DEFAULTS = Object.freeze({
+  comment: "provision baseline from @homeflare/alchemy - OpenBao mints short-lived tokens for members",
+  mintGroup: "hf-mint",
+  provisionUser: "hf-provision@pve",
+  readRole: "PVEAuditor",
+  readUser: "hf-read@pve",
+  role: "HfProvisioner"
+});
+var ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var USERID = /^[A-Za-z0-9][A-Za-z0-9._-]*@[A-Za-z][A-Za-z0-9._-]*$/;
+var COMMENT = /^[A-Za-z0-9 ._,()@/+-]*$/;
+var problems2 = (names2) => {
+  const found = [];
+  if (!ID.test(names2.role))
+    found.push(`role \`${names2.role}\` is not a PVE role id`);
+  if (!ID.test(names2.mintGroup))
+    found.push(`mintGroup \`${names2.mintGroup}\` is not a group id`);
+  if (!ID.test(names2.readRole))
+    found.push(`readRole \`${names2.readRole}\` is not a PVE role id`);
+  for (const [field6, userid] of [
+    ["provisionUser", names2.provisionUser],
+    ["readUser", names2.readUser]
+  ]) {
+    if (userid !== null && !USERID.test(userid)) {
+      found.push(`${field6} \`${userid}\` is not a realm-qualified user id (name@realm)`);
+    }
+  }
+  if (names2.readUser === names2.provisionUser)
+    found.push("readUser and provisionUser are one user");
+  if (!COMMENT.test(names2.comment))
+    found.push("comment holds a character the bootstrap will not quote");
+  return found;
+};
+var provisionBaseline = (names2 = {}) => {
+  const given = Object.entries(names2).filter(([, value]) => value !== undefined);
+  const resolved = {
+    ...PROVISION_DEFAULTS,
+    ...Object.fromEntries(given)
+  };
+  const found = problems2(resolved);
+  if (found.length > 0)
+    throw new Error(`provision baseline: ${found.join("; ")}`);
+  const lanes = [
+    ["provision", resolved.provisionUser, resolved.role]
+  ];
+  if (resolved.readUser !== null)
+    lanes.push(["read", resolved.readUser, resolved.readRole]);
+  return {
+    grants: lanes.map(([lane, userid, roleid]) => ({ lane, roleid, userid })),
+    group: { comment: resolved.comment, groupid: resolved.mintGroup },
+    role: { privs: PROVISION_PRIVILEGES, roleid: resolved.role },
+    users: lanes.map(([lane, userid]) => ({
+      comment: resolved.comment,
+      groups: [resolved.mintGroup],
+      lane,
+      userid
+    }))
+  };
+};
+// src/proxmox/provision-bootstrap.ts
+var HEADER = `#!/bin/sh
+# Provisioning baseline bootstrap, generated by @homeflare/alchemy (provisionBootstrap).
+# Run ONCE, as root, on one node of a NEW cluster (or a new standalone node). Every step reads
+# first and writes only what differs; a second run changes nothing. No token, no password.
+set -eu
+[ "$(id -u)" -eq 0 ] || { echo 'bootstrap: run this as root' >&2; exit 1; }
+command -v pvesh >/dev/null 2>&1 || { echo 'bootstrap: no pvesh; run this on a PVE node' >&2; exit 1; }
+perl -MJSON::PP -e 1 || { echo 'bootstrap: perl cannot load JSON::PP' >&2; exit 1; }
+
+# get <api-path> <perl>: print <perl> evaluated over the object at <api-path> (as $d).
+# Fails, silently, when the object does not exist: the empty input is not JSON.
+get() {
+  pvesh get "$1" --output-format json 2>/dev/null | perl -MJSON::PP -0777 -ne "\\$d = decode_json(\\$_); $2" 2>/dev/null
+}
+`;
+var perlText = (text3) => `q{${text3}}`;
+var USER_STATE = "my $g = $d->{groups} // []; $g = [split /,/, $g] unless ref $g; " + 'print join(";", "groups=" . join(",", sort @$g), "enable=" . (($d->{enable} // 1) ? 1 : 0), ' + '"expire=" . ($d->{expire} // 0), "email=" . ($d->{email} // ""), ' + '"firstname=" . ($d->{firstname} // ""), "lastname=" . ($d->{lastname} // ""), ' + '"comment=" . ($d->{comment} // ""))';
+var roleStep = ({ role }) => {
+  const privs = [...role.privs].sort().join(",");
+  return `
+# Role ${role.roleid}: exactly the provision privileges, on no path yet.
+want='${privs}'
+if have=$(get /access/roles/${role.roleid} 'print join(",", sort grep { /\\./ } keys %$d)'); then
+  if [ "$have" = "$want" ]; then echo 'role ${role.roleid}: ok'
+  else echo 'role ${role.roleid}: setting the baseline privileges'; pveum role modify ${role.roleid} --privs "$want"; fi
+else
+  echo 'role ${role.roleid}: adding'; pveum role add ${role.roleid} --privs "$want"
+fi
+`;
+};
+var groupStep = ({ group }) => `
+# Group ${group.groupid}: OpenBao may mint only for its members.
+if have=$(get /access/groups/${group.groupid} 'print $d->{comment} // ""'); then
+  if [ "$have" = '${group.comment}' ]; then echo 'group ${group.groupid}: ok'
+  else echo 'group ${group.groupid}: setting the comment'; pveum group modify ${group.groupid} --comment '${group.comment}'; fi
+else
+  echo 'group ${group.groupid}: adding'; pveum group add ${group.groupid} --comment '${group.comment}'
+fi
+`;
+var userStep = (user) => {
+  const groups = [...user.groups].sort().join(",");
+  const want = `groups=${groups};enable=1;expire=0;email=;firstname=;lastname=;comment=${user.comment}`;
+  const fields = `--groups ${groups} --comment '${user.comment}'`;
+  return `
+# User ${user.userid} (the ${user.lane} lane): in ${groups}, enabled, no password.
+if have=$(get /access/users/${user.userid} '${USER_STATE}'); then
+  if [ "$have" = '${want}' ]; then echo 'user ${user.userid}: ok'
+  else echo 'user ${user.userid}: setting groups, comment and account fields'
+    pveum user modify ${user.userid} ${fields} --enable 1 --expire 0 --email '' --firstname '' --lastname ''; fi
+else
+  echo 'user ${user.userid}: adding'; pveum user add ${user.userid} ${fields}
+fi
+`;
+};
+var grantStep = (grant) => {
+  const match = `print scalar grep { $_->{path} eq "/" && $_->{type} eq "user" && ` + `$_->{ugid} eq ${perlText(grant.userid)} && $_->{roleid} eq ${perlText(grant.roleid)} && ` + `($_->{propagate} // 1) } @$d`;
+  return `
+# Grant: ${grant.userid} holds ${grant.roleid} on /, propagated (the ${grant.lane} lane).
+if [ "$(get /access/acl '${match}')" = 1 ]; then echo 'grant ${grant.userid} ${grant.roleid} /: ok'
+else echo 'grant ${grant.userid} ${grant.roleid} /: adding'; pveum acl modify / --users ${grant.userid} --roles ${grant.roleid} --propagate 1; fi
+`;
+};
+var requireRole = (roleid) => `
+get /access/roles/${roleid} 'print 1' >/dev/null || { echo 'bootstrap: role ${roleid} does not exist; create it, or name another readRole' >&2; exit 1; }
+`;
+var provisionBootstrap = (names2 = {}) => {
+  const baseline = provisionBaseline(names2);
+  const borrowed = baseline.grants.map((grant) => grant.roleid).filter((roleid) => roleid !== baseline.role.roleid);
+  return [
+    HEADER,
+    ...[...new Set(borrowed)].map(requireRole),
+    roleStep(baseline),
+    groupStep(baseline),
+    ...baseline.users.map(userStep),
+    ...baseline.grants.map(grantStep),
+    `
+echo 'provision baseline: done. Next: point the OpenBao proxmox mount at these users, then deploy the stack that declares this baseline with --adopt.'
+`
+  ].join("");
+};
+// src/proxmox/provision-declare.ts
+import { adopt } from "alchemy/AdoptPolicy";
+import * as RemovalPolicy from "alchemy/RemovalPolicy";
+import * as Effect49 from "effect/Effect";
+
+// src/proxmox/role.ts
+import { Resource as Resource26 } from "alchemy";
+import * as Provider26 from "alchemy/Provider";
+import * as Effect47 from "effect/Effect";
+var ProxmoxRole = Resource26("Proxmox.Role");
+var canonical2 = (privs) => [...new Set(privs.map((priv) => priv.trim()).filter((priv) => priv.length > 0))].sort();
+var livePrivs = (live) => {
+  const listed = live["privs"];
+  if (typeof listed === "string")
+    return canonical2(listed.split(","));
+  return canonical2(Object.keys(live).filter((key) => key.includes(".")));
+};
+var handlers22 = pveHandlers({
+  attributes: (live, props) => ({ privs: livePrivs(live), roleid: props.roleid }),
+  collection: () => "access/roles",
+  createForm: (props) => ({ privs: canonical2(props.privs).join(","), roleid: props.roleid }),
+  matches: (attributes2, props) => canonical2(attributes2.privs).join(",") === canonical2(props.privs).join(","),
+  path: (props) => `access/roles/${props.roleid}`,
+  updateForm: (props) => ({ privs: canonical2(props.privs).join(",") })
+});
+var ProxmoxRoleProvider = () => Provider26.effect(ProxmoxRole, Effect47.succeed(ProxmoxRole.Provider.of(handlers22)));
+
+// src/proxmox/user.ts
+import { Resource as Resource27 } from "alchemy";
+import * as Provider27 from "alchemy/Provider";
+import * as Effect48 from "effect/Effect";
+var ProxmoxUser = Resource27("Proxmox.User");
+var str2 = (value) => typeof value === "string" ? value : "";
+var int2 = (value) => {
+  const parsed = typeof value === "number" ? value : Number(value ?? 0);
+  return Number.isFinite(parsed) ? parsed : 0;
+};
+var groupSet = (value) => {
+  const raw = Array.isArray(value) ? value : typeof value === "string" ? value.split(",") : [];
+  const names2 = raw.map((group) => str2(group).trim()).filter((group) => group !== "");
+  return [...new Set(names2)].sort();
+};
+var tokenNames = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.keys(value).sort() : [];
 var shape8 = (props) => ({
+  comment: props.comment ?? "",
+  email: props.email ?? "",
+  enable: props.enable === false ? "0" : "1",
+  expire: String(props.expire ?? 0),
+  firstname: props.firstname ?? "",
+  groups: groupSet(props.groups).join(","),
+  lastname: props.lastname ?? ""
+});
+var handlers23 = pveHandlers({
+  attributes: (live, props) => ({
+    comment: str2(live["comment"]),
+    email: str2(live["email"]),
+    enable: bool(live["enable"], true),
+    expire: int2(live["expire"]),
+    firstname: str2(live["firstname"]),
+    groups: groupSet(live["groups"]),
+    lastname: str2(live["lastname"]),
+    tokens: tokenNames(live["tokens"]),
+    userid: props.userid
+  }),
+  collection: () => "access/users",
+  createForm: (props) => ({ ...shape8(props), userid: props.userid }),
+  matches: (attributes2, props) => attributes2.comment === (props.comment ?? "") && attributes2.email === (props.email ?? "") && attributes2.enable === (props.enable !== false) && attributes2.expire === (props.expire ?? 0) && attributes2.firstname === (props.firstname ?? "") && attributes2.lastname === (props.lastname ?? "") && attributes2.groups.join(",") === groupSet(props.groups).join(","),
+  path: (props) => `access/users/${props.userid}`,
+  updateForm: shape8
+});
+var ProxmoxUserProvider = () => Provider27.effect(ProxmoxUser, Effect48.succeed(ProxmoxUser.Provider.of(handlers23)));
+
+// src/proxmox/provision-declare.ts
+var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect49.gen(function* () {
+  const baseline = yield* Effect49.try({
+    catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
+    try: () => provisionBaseline(names2)
+  });
+  const owned = (resource) => {
+    const kept = resource.pipe(RemovalPolicy.retain());
+    return options.adopt === undefined ? kept : kept.pipe(adopt(options.adopt));
+  };
+  const role = yield* owned(ProxmoxRole(`${id}-role`, {
+    privs: [...baseline.role.privs],
+    roleid: baseline.role.roleid,
+    target
+  }));
+  const group = yield* owned(ProxmoxGroup(`${id}-mint-group`, { ...baseline.group, target }));
+  const users = yield* Effect49.all(baseline.users.map((user) => owned(ProxmoxUser(`${id}-${user.lane}-user`, {
+    comment: user.comment,
+    groups: [...user.groups],
+    target,
+    userid: user.userid
+  }))));
+  const grants = yield* Effect49.all(baseline.grants.map((grant) => owned(ProxmoxAcl(`${id}-${grant.lane}-grant`, {
+    path: "/",
+    propagate: true,
+    roleid: grant.roleid,
+    target,
+    type: "user",
+    ugid: grant.userid
+  }))));
+  return { baseline, grants, group, role, users };
+});
+// src/proxmox/qemu.ts
+import { Resource as Resource28 } from "alchemy";
+import * as Provider28 from "alchemy/Provider";
+import * as Effect50 from "effect/Effect";
+var ProxmoxVm = Resource28("Proxmox.Vm");
+var shape9 = (props) => ({
   cores: String(props.cores ?? 1),
   memory: String(props.memory ?? 512),
   name: props.name ?? `vm${String(props.vmid)}`,
@@ -2617,7 +3382,7 @@ var shape8 = (props) => ({
   sockets: String(props.sockets ?? 1),
   ...props.net0 === undefined ? {} : { net0: props.net0 }
 });
-var handlers19 = pveHandlers({
+var handlers24 = pveHandlers({
   attributes: (live, props) => ({
     cores: num(live["cores"], 1),
     memory: num(live["memory"], 512),
@@ -2628,46 +3393,46 @@ var handlers19 = pveHandlers({
     vmid: props.vmid
   }),
   collection: (props) => `nodes/${props.node}/qemu`,
-  createForm: (props) => ({ ...shape8(props), vmid: String(props.vmid) }),
+  createForm: (props) => ({ ...shape9(props), vmid: String(props.vmid) }),
   matches: (attributes2, props) => attributes2.name === (props.name ?? `vm${String(props.vmid)}`) && attributes2.memory === (props.memory ?? 512) && attributes2.cores === (props.cores ?? 1) && attributes2.sockets === (props.sockets ?? 1) && attributes2.onboot === (props.onboot === true),
   path: (props) => `nodes/${props.node}/qemu/${String(props.vmid)}/config`,
-  updateForm: shape8
+  updateForm: shape9
 });
-var ProxmoxVmProvider = () => Provider23.effect(ProxmoxVm, Effect43.succeed(ProxmoxVm.Provider.of(handlers19)));
+var ProxmoxVmProvider = () => Provider28.effect(ProxmoxVm, Effect50.succeed(ProxmoxVm.Provider.of(handlers24)));
 // src/proxmox/replication-job.ts
-import { Resource as Resource24 } from "alchemy";
-import * as Provider24 from "alchemy/Provider";
-import * as Effect44 from "effect/Effect";
+import { Resource as Resource29 } from "alchemy";
+import * as Provider29 from "alchemy/Provider";
+import * as Effect51 from "effect/Effect";
 
 // src/proxmox/replication-job-form.ts
 var DEFAULT_SCHEDULE = "*/15";
 var jobId = (props) => `${String(props.guest)}-${String(props.jobnum)}`;
-var shape9 = (props) => ({
+var shape10 = (props) => ({
   comment: props.comment ?? "",
   disable: props.disable === true ? "1" : "0",
   schedule: props.schedule ?? DEFAULT_SCHEDULE,
   ...props.rate === undefined ? {} : { rate: String(props.rate) }
 });
 var createBody4 = (props) => ({
-  ...shape9(props),
+  ...shape10(props),
   id: jobId(props),
   target: props.targetNode,
   type: "local"
 });
 var updateBody5 = (props) => ({
-  ...shape9(props),
+  ...shape10(props),
   delete: "remove_job"
 });
 
 // src/proxmox/replication-job.ts
-var ProxmoxReplicationJob = Resource24("Proxmox.ReplicationJob");
+var ProxmoxReplicationJob = Resource29("Proxmox.ReplicationJob");
 var rateOf = (value) => {
   if (typeof value === "number")
     return value;
   const parsed = Number.parseFloat(text(value));
   return Number.isFinite(parsed) ? parsed : 0;
 };
-var handlers20 = pveHandlers({
+var handlers25 = pveHandlers({
   attributes: (live, props) => ({
     comment: text(live["comment"], ""),
     disable: bool(live["disable"], false),
@@ -2687,36 +3452,15 @@ var handlers20 = pveHandlers({
   path: (props) => `cluster/replication/${jobId(props)}`,
   updateForm: updateBody5
 });
-var ProxmoxReplicationJobProvider = () => Provider24.effect(ProxmoxReplicationJob, Effect44.succeed(ProxmoxReplicationJob.Provider.of(handlers20)));
-// src/proxmox/role.ts
-import { Resource as Resource25 } from "alchemy";
-import * as Provider25 from "alchemy/Provider";
-import * as Effect45 from "effect/Effect";
-var ProxmoxRole = Resource25("Proxmox.Role");
-var canonical = (privs) => [...new Set(privs.map((priv) => priv.trim()).filter((priv) => priv.length > 0))].sort();
-var livePrivs = (live) => {
-  const listed = live["privs"];
-  if (typeof listed === "string")
-    return canonical(listed.split(","));
-  return canonical(Object.keys(live).filter((key) => key.includes(".")));
-};
-var handlers21 = pveHandlers({
-  attributes: (live, props) => ({ privs: livePrivs(live), roleid: props.roleid }),
-  collection: () => "access/roles",
-  createForm: (props) => ({ privs: canonical(props.privs).join(","), roleid: props.roleid }),
-  matches: (attributes2, props) => canonical(attributes2.privs).join(",") === canonical(props.privs).join(","),
-  path: (props) => `access/roles/${props.roleid}`,
-  updateForm: (props) => ({ privs: canonical(props.privs).join(",") })
-});
-var ProxmoxRoleProvider = () => Provider25.effect(ProxmoxRole, Effect45.succeed(ProxmoxRole.Provider.of(handlers21)));
+var ProxmoxReplicationJobProvider = () => Provider29.effect(ProxmoxReplicationJob, Effect51.succeed(ProxmoxReplicationJob.Provider.of(handlers25)));
 // src/proxmox/sdn-apply.ts
-import { Resource as Resource26 } from "alchemy";
-import { isResolved as isResolved9 } from "alchemy/Diff";
-import * as Provider26 from "alchemy/Provider";
-import * as Effect47 from "effect/Effect";
+import { Resource as Resource30 } from "alchemy";
+import { isResolved as isResolved10 } from "alchemy/Diff";
+import * as Provider30 from "alchemy/Provider";
+import * as Effect53 from "effect/Effect";
 
 // src/proxmox/sdn-apply-read.ts
-import * as Effect46 from "effect/Effect";
+import * as Effect52 from "effect/Effect";
 var MARKED = [
   "cluster/sdn/zones",
   "cluster/sdn/vnets",
@@ -2725,7 +3469,7 @@ var MARKED = [
   "cluster/sdn/route-maps"
 ];
 var subsystemAbsent = (error) => error instanceof PveError && error.status === 501;
-var markedPending = (target) => Effect46.all(MARKED.map((collection2) => pve(target, "read", "GET", `${collection2}?pending=1`).pipe(Effect46.map((rows) => (rows ?? []).filter((row) => row.state !== undefined).length), Effect46.catchIf(subsystemAbsent, () => Effect46.succeed(0)))), { concurrency: "unbounded" }).pipe(Effect46.map((counts) => counts.reduce((total, count2) => total + count2, 0)));
+var markedPending = (target) => Effect52.all(MARKED.map((collection2) => pve(target, "read", "GET", `${collection2}?pending=1`).pipe(Effect52.map((rows) => (rows ?? []).filter((row) => row.state !== undefined).length), Effect52.catchIf(subsystemAbsent, () => Effect52.succeed(0)))), { concurrency: "unbounded" }).pipe(Effect52.map((counts) => counts.reduce((total, count2) => total + count2, 0)));
 var fabricStaged = (staged, running) => {
   if (staged === undefined && running === undefined)
     return 0;
@@ -2733,11 +3477,11 @@ var fabricStaged = (staged, running) => {
     return "inconsistent";
   return staged === running ? 0 : 1;
 };
-var fabricPending = (target) => Effect46.all(["pending", "running"].map((view) => pve(target, "read", "GET", `cluster/sdn/fabrics/all?${view}=1`).pipe(Effect46.map(canonical2), Effect46.catchIf(subsystemAbsent, () => Effect46.succeed(undefined)))), { concurrency: "unbounded" }).pipe(Effect46.flatMap(([staged, running]) => {
+var fabricPending = (target) => Effect52.all(["pending", "running"].map((view) => pve(target, "read", "GET", `cluster/sdn/fabrics/all?${view}=1`).pipe(Effect52.map(canonical3), Effect52.catchIf(subsystemAbsent, () => Effect52.succeed(undefined)))), { concurrency: "unbounded" }).pipe(Effect52.flatMap(([staged, running]) => {
   const verdict = fabricStaged(staged, running);
-  return verdict === "inconsistent" ? Effect46.die(new Error("cluster/sdn/fabrics/all answered 501 for one of ?pending=1 and ?running=1 and not " + "the other. Refusing to read that as a staged fabric change.")) : Effect46.succeed(verdict);
+  return verdict === "inconsistent" ? Effect52.die(new Error("cluster/sdn/fabrics/all answered 501 for one of ?pending=1 and ?running=1 and not " + "the other. Refusing to read that as a staged fabric change.")) : Effect52.succeed(verdict);
 }));
-var canonical2 = (value) => JSON.stringify(sortDeep(value));
+var canonical3 = (value) => JSON.stringify(sortDeep(value));
 var sortDeep = (value) => {
   if (Array.isArray(value)) {
     return value.map(sortDeep).sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
@@ -2748,39 +3492,39 @@ var sortDeep = (value) => {
   }
   return value;
 };
-var sdnPendingCount = (target) => Effect46.all([markedPending(target), fabricPending(target)], { concurrency: "unbounded" }).pipe(Effect46.map(([marked, fabric]) => marked + fabric));
+var sdnPendingCount = (target) => Effect52.all([markedPending(target), fabricPending(target)], { concurrency: "unbounded" }).pipe(Effect52.map(([marked, fabric]) => marked + fabric));
 
 // src/proxmox/sdn-apply.ts
-var ProxmoxSdnApply = Resource26("Proxmox.SdnApply");
-var read3 = (props) => sdnPendingCount(props.target).pipe(Effect47.map((pending) => ({ pending })));
-var ProxmoxSdnApplyProvider = () => Provider26.effect(ProxmoxSdnApply, Effect47.succeed(ProxmoxSdnApply.Provider.of({
-  list: () => Effect47.succeed([]),
-  read: Effect47.fn(function* ({ olds }) {
+var ProxmoxSdnApply = Resource30("Proxmox.SdnApply");
+var read3 = (props) => sdnPendingCount(props.target).pipe(Effect53.map((pending) => ({ pending })));
+var ProxmoxSdnApplyProvider = () => Provider30.effect(ProxmoxSdnApply, Effect53.succeed(ProxmoxSdnApply.Provider.of({
+  list: () => Effect53.succeed([]),
+  read: Effect53.fn(function* ({ olds }) {
     return yield* read3(olds);
   }),
-  diff: Effect47.fn(function* ({ news }) {
-    if (!isResolved9(news))
+  diff: Effect53.fn(function* ({ news }) {
+    if (!isResolved10(news))
       return;
     const { pending } = yield* read3(news);
     return pending === 0 ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect47.fn(function* ({ news }) {
+  reconcile: Effect53.fn(function* ({ news }) {
     const staged = yield* read3(news);
     if (staged.pending === 0)
       return staged;
     yield* pve(news.target, "provision", "PUT", "cluster/sdn");
     const after = yield* read3(news);
     if (after.pending !== 0) {
-      return yield* Effect47.die(new Error(`PUT /cluster/sdn returned no error but ${String(after.pending)} SDN object(s) ` + "are still staged. The running config does not match the declared one -- check " + "`pvesh get /cluster/sdn/zones --pending 1` for the objects PVE refused."));
+      return yield* Effect53.die(new Error(`PUT /cluster/sdn returned no error but ${String(after.pending)} SDN object(s) ` + "are still staged. The running config does not match the declared one -- check " + "`pvesh get /cluster/sdn/zones --pending 1` for the objects PVE refused."));
     }
     return after;
   }),
-  delete: () => Effect47.void
+  delete: () => Effect53.void
 })));
 // src/proxmox/sdn-subnet.ts
-import { Resource as Resource27 } from "alchemy";
-import * as Provider27 from "alchemy/Provider";
-import * as Effect48 from "effect/Effect";
+import { Resource as Resource31 } from "alchemy";
+import * as Provider31 from "alchemy/Provider";
+import * as Effect54 from "effect/Effect";
 
 // src/proxmox/sdn-subnet-form.ts
 var subnetId = (props) => `${props.zone}-${props.cidr.replace("/", "-")}`;
@@ -2810,8 +3554,8 @@ var updateForm2 = (props) => {
 };
 
 // src/proxmox/sdn-subnet.ts
-var ProxmoxSdnSubnet = Resource27("Proxmox.SdnSubnet");
-var handlers22 = pveHandlers({
+var ProxmoxSdnSubnet = Resource31("Proxmox.SdnSubnet");
+var handlers26 = pveHandlers({
   attributes: (live, props) => {
     const liveVnet = text(live["vnet"]);
     if (liveVnet !== "" && liveVnet !== props.vnet)
@@ -2836,14 +3580,14 @@ var handlers22 = pveHandlers({
   path: (props) => `cluster/sdn/vnets/${props.vnet}/subnets/${subnetId(props)}`,
   updateForm: updateForm2
 });
-var ProxmoxSdnSubnetProvider = () => Provider27.effect(ProxmoxSdnSubnet, Effect48.succeed(ProxmoxSdnSubnet.Provider.of(handlers22)));
+var ProxmoxSdnSubnetProvider = () => Provider31.effect(ProxmoxSdnSubnet, Effect54.succeed(ProxmoxSdnSubnet.Provider.of(handlers26)));
 // src/proxmox/sdn-vnet.ts
-import { Resource as Resource28 } from "alchemy";
-import * as Provider28 from "alchemy/Provider";
-import * as Effect49 from "effect/Effect";
-var ProxmoxSdnVnet = Resource28("Proxmox.SdnVnet");
+import { Resource as Resource32 } from "alchemy";
+import * as Provider32 from "alchemy/Provider";
+import * as Effect55 from "effect/Effect";
+var ProxmoxSdnVnet = Resource32("Proxmox.SdnVnet");
 var tagOf = (value) => typeof value === "number" ? value : undefined;
-var shape10 = (props) => {
+var shape11 = (props) => {
   const alias = props.alias ?? "";
   return {
     "isolate-ports": props.isolatePorts === true ? "1" : "0",
@@ -2858,9 +3602,9 @@ var updateForm3 = (props) => {
     ...(props.alias ?? "") === "" ? ["alias"] : [],
     ...props.tag === undefined ? ["tag"] : []
   ];
-  return withClears(shape10(props), unset2);
+  return withClears(shape11(props), unset2);
 };
-var handlers23 = pveHandlers({
+var handlers27 = pveHandlers({
   readRole: "provision",
   attributes: (live, props) => ({
     alias: typeof live["alias"] === "string" ? live["alias"] : "",
@@ -2872,18 +3616,18 @@ var handlers23 = pveHandlers({
     zone: typeof live["zone"] === "string" ? live["zone"] : ""
   }),
   collection: () => "cluster/sdn/vnets",
-  createForm: (props) => ({ ...shape10(props), vnet: props.vnet }),
+  createForm: (props) => ({ ...shape11(props), vnet: props.vnet }),
   matches: (attributes2, props) => attributes2.zone === props.zone && attributes2.alias === (props.alias ?? "") && attributes2.tag === props.tag && attributes2.vlanaware === (props.vlanaware === true) && attributes2.isolatePorts === (props.isolatePorts === true),
   path: (props) => `cluster/sdn/vnets/${props.vnet}`,
   updateForm: updateForm3
 });
-var ProxmoxSdnVnetProvider = () => Provider28.effect(ProxmoxSdnVnet, Effect49.succeed(ProxmoxSdnVnet.Provider.of(handlers23)));
+var ProxmoxSdnVnetProvider = () => Provider32.effect(ProxmoxSdnVnet, Effect55.succeed(ProxmoxSdnVnet.Provider.of(handlers27)));
 // src/proxmox/sdn-zone.ts
-import { Resource as Resource29 } from "alchemy";
-import * as Provider29 from "alchemy/Provider";
-import * as Effect50 from "effect/Effect";
-var ProxmoxSdnZone = Resource29("Proxmox.SdnZone");
-var sameIpam = (live, declared) => (live === "" ? "pve" : live) === (declared === undefined || declared === "" ? "pve" : declared);
+import { Resource as Resource33 } from "alchemy";
+import * as Provider33 from "alchemy/Provider";
+import * as Effect56 from "effect/Effect";
+var ProxmoxSdnZone = Resource33("Proxmox.SdnZone");
+var sameIpam = (live, declared2) => (live === "" ? "pve" : live) === (declared2 === undefined || declared2 === "" ? "pve" : declared2);
 var body6 = (props) => ({
   ...props.bridge === undefined ? {} : { bridge: props.bridge },
   ...props.dns === undefined ? {} : { dns: props.dns },
@@ -2902,7 +3646,7 @@ var clearable = {
   vlan: ["dns", "dnszone", "ipam", "mtu", "nodes"],
   vxlan: ["dns", "dnszone", "ipam", "mtu", "nodes"]
 };
-var handlers24 = pveHandlers({
+var handlers28 = pveHandlers({
   readRole: "provision",
   attributes: (live, props) => {
     const liveType = text(live["type"]);
@@ -2933,43 +3677,43 @@ var handlers24 = pveHandlers({
     return withClears(fields, clear);
   }
 });
-var ProxmoxSdnZoneProvider = () => Provider29.effect(ProxmoxSdnZone, Effect50.succeed(ProxmoxSdnZone.Provider.of(handlers24)));
+var ProxmoxSdnZoneProvider = () => Provider33.effect(ProxmoxSdnZone, Effect56.succeed(ProxmoxSdnZone.Provider.of(handlers28)));
 // src/proxmox/storage.ts
-import { Resource as Resource30 } from "alchemy";
-import * as Provider30 from "alchemy/Provider";
-import * as Effect51 from "effect/Effect";
-var ProxmoxStorage = Resource30("Proxmox.Storage", {
+import { Resource as Resource34 } from "alchemy";
+import * as Provider34 from "alchemy/Provider";
+import * as Effect57 from "effect/Effect";
+var ProxmoxStorage = Resource34("Proxmox.Storage", {
   defaultRemovalPolicy: "retain"
 });
-var str2 = (value, fallback = "") => typeof value === "string" ? value : fallback;
-var field5 = (name, value) => value === undefined ? {} : { [name]: value };
+var str3 = (value, fallback = "") => typeof value === "string" ? value : fallback;
+var field6 = (name, value) => value === undefined ? {} : { [name]: value };
 var locatorForm = (locator) => ({ ...locator });
 var tokens = (value) => value.split(",").map((part) => part.trim()).filter((part) => part !== "").sort().join(",");
-var sameList2 = (declared, live) => declared === undefined || tokens(declared) === tokens(live);
-var same5 = (declared, live) => declared === undefined || declared === live;
+var sameList2 = (declared2, live) => declared2 === undefined || tokens(declared2) === tokens(live);
+var same7 = (declared2, live) => declared2 === undefined || declared2 === live;
 var mutable2 = (props) => ({
-  ...field5("comment", props.comment),
-  ...field5("content", props.content),
-  ...field5("disable", flag(props.disable)),
-  ...field5("maxfiles", props.maxfiles === undefined ? undefined : String(props.maxfiles)),
-  ...field5("nodes", props.nodes),
-  ...field5("preallocation", props.preallocation),
-  ...field5("prune-backups", props["prune-backups"]),
-  ...field5("shared", flag(props.shared))
-});
-var handlers25 = pveHandlers({
+  ...field6("comment", props.comment),
+  ...field6("content", props.content),
+  ...field6("disable", flag(props.disable)),
+  ...field6("maxfiles", props.maxfiles === undefined ? undefined : String(props.maxfiles)),
+  ...field6("nodes", props.nodes),
+  ...field6("preallocation", props.preallocation),
+  ...field6("prune-backups", props["prune-backups"]),
+  ...field6("shared", flag(props.shared))
+});
+var handlers29 = pveHandlers({
   readRole: "provision",
   attributes: (live, props) => ({
-    comment: str2(live["comment"]),
-    content: str2(live["content"]),
+    comment: str3(live["comment"]),
+    content: str3(live["content"]),
     disable: bool(live["disable"]),
     maxfiles: typeof live["maxfiles"] === "number" ? live["maxfiles"] : -1,
-    nodes: str2(live["nodes"]),
-    preallocation: str2(live["preallocation"]),
-    "prune-backups": str2(live["prune-backups"]),
+    nodes: str3(live["nodes"]),
+    preallocation: str3(live["preallocation"]),
+    "prune-backups": str3(live["prune-backups"]),
     shared: bool(live["shared"]),
     storage: props.storage,
-    type: str2(live["type"], props.type)
+    type: str3(live["type"], props.type)
   }),
   collection: () => "storage",
   createForm: (props) => ({
@@ -2978,62 +3722,18 @@ var handlers25 = pveHandlers({
     storage: props.storage,
     type: props.type
   }),
-  matches: (attributes2, props) => sameList2(props.content, attributes2.content) && sameList2(props.nodes, attributes2.nodes) && sameList2(props["prune-backups"], attributes2["prune-backups"]) && same5(props.disable, attributes2.disable) && same5(props.shared, attributes2.shared) && same5(props.preallocation, attributes2.preallocation) && same5(props.comment, attributes2.comment) && same5(props.maxfiles, attributes2.maxfiles),
+  matches: (attributes2, props) => sameList2(props.content, attributes2.content) && sameList2(props.nodes, attributes2.nodes) && sameList2(props["prune-backups"], attributes2["prune-backups"]) && same7(props.disable, attributes2.disable) && same7(props.shared, attributes2.shared) && same7(props.preallocation, attributes2.preallocation) && same7(props.comment, attributes2.comment) && same7(props.maxfiles, attributes2.maxfiles),
   path: (props) => `storage/${props.storage}`,
   updateForm: mutable2
 });
-var ProxmoxStorageProvider = () => Provider30.effect(ProxmoxStorage, Effect51.succeed(ProxmoxStorage.Provider.of(handlers25)));
-// src/proxmox/user.ts
-import { Resource as Resource31 } from "alchemy";
-import * as Provider31 from "alchemy/Provider";
-import * as Effect52 from "effect/Effect";
-var ProxmoxUser = Resource31("Proxmox.User");
-var str3 = (value) => typeof value === "string" ? value : "";
-var int2 = (value) => {
-  const parsed = typeof value === "number" ? value : Number(value ?? 0);
-  return Number.isFinite(parsed) ? parsed : 0;
-};
-var groupSet = (value) => {
-  const raw = Array.isArray(value) ? value : typeof value === "string" ? value.split(",") : [];
-  const names = raw.map((group) => str3(group).trim()).filter((group) => group !== "");
-  return [...new Set(names)].sort();
-};
-var tokenNames = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.keys(value).sort() : [];
-var shape11 = (props) => ({
-  comment: props.comment ?? "",
-  email: props.email ?? "",
-  enable: props.enable === false ? "0" : "1",
-  expire: String(props.expire ?? 0),
-  firstname: props.firstname ?? "",
-  groups: groupSet(props.groups).join(","),
-  lastname: props.lastname ?? ""
-});
-var handlers26 = pveHandlers({
-  attributes: (live, props) => ({
-    comment: str3(live["comment"]),
-    email: str3(live["email"]),
-    enable: bool(live["enable"], true),
-    expire: int2(live["expire"]),
-    firstname: str3(live["firstname"]),
-    groups: groupSet(live["groups"]),
-    lastname: str3(live["lastname"]),
-    tokens: tokenNames(live["tokens"]),
-    userid: props.userid
-  }),
-  collection: () => "access/users",
-  createForm: (props) => ({ ...shape11(props), userid: props.userid }),
-  matches: (attributes2, props) => attributes2.comment === (props.comment ?? "") && attributes2.email === (props.email ?? "") && attributes2.enable === (props.enable !== false) && attributes2.expire === (props.expire ?? 0) && attributes2.firstname === (props.firstname ?? "") && attributes2.lastname === (props.lastname ?? "") && attributes2.groups.join(",") === groupSet(props.groups).join(","),
-  path: (props) => `access/users/${props.userid}`,
-  updateForm: shape11
-});
-var ProxmoxUserProvider = () => Provider31.effect(ProxmoxUser, Effect52.succeed(ProxmoxUser.Provider.of(handlers26)));
+var ProxmoxStorageProvider = () => Provider34.effect(ProxmoxStorage, Effect57.succeed(ProxmoxStorage.Provider.of(handlers29)));
 // src/proxmox/zfs-pool.ts
-import { Resource as Resource32 } from "alchemy";
-import * as Provider32 from "alchemy/Provider";
-import * as Effect54 from "effect/Effect";
+import { Resource as Resource35 } from "alchemy";
+import * as Provider35 from "alchemy/Provider";
+import * as Effect59 from "effect/Effect";
 
 // src/proxmox/zfs-pool-write.ts
-import * as Effect53 from "effect/Effect";
+import * as Effect58 from "effect/Effect";
 var createForm6 = (props) => ({
   devices: props.devices.join(","),
   name: props.name,
@@ -3043,28 +3743,28 @@ var createForm6 = (props) => ({
   ...props["draid-config"] === undefined ? {} : { "draid-config": props["draid-config"] }
 });
 var SETTLE_ATTEMPTS = 30;
-var createPool = (props, collection2, path, read4) => Effect53.gen(function* () {
+var createPool = (props, collection2, path2, read4) => Effect58.gen(function* () {
   const existing = yield* read4(props);
   if (existing !== undefined)
     return existing;
   const upid = yield* pve(props.target, "provision", "POST", collection2, createForm6(props));
-  const settle4 = (attempts) => Effect53.gen(function* () {
+  const settle4 = (attempts) => Effect58.gen(function* () {
     const live = yield* read4(props);
     if (live !== undefined || attempts <= 0)
       return live;
-    yield* Effect53.sleep("2 seconds");
+    yield* Effect58.sleep("2 seconds");
     return yield* settle4(attempts - 1);
   });
   const after = yield* settle4(SETTLE_ATTEMPTS);
   if (after === undefined) {
-    return yield* Effect53.die(new Error(`${path}: POST returned ${text(upid, "(no UPID)")} but the pool has not appeared. That ` + "POST only forks a `zfscreate` worker, so the task holds the real error -- read it " + `with \`pvesh get /nodes/${props.node}/tasks/<upid>/log\`. NOTHING WAS RETRIED AND ` + "NOTHING WAS CLEANED UP: if the worker reached `zpool create`, the declared devices " + "have already been written to."));
+    return yield* Effect58.die(new Error(`${path2}: POST returned ${text(upid, "(no UPID)")} but the pool has not appeared. That ` + "POST only forks a `zfscreate` worker, so the task holds the real error -- read it " + `with \`pvesh get /nodes/${props.node}/tasks/<upid>/log\`. NOTHING WAS RETRIED AND ` + "NOTHING WAS CLEANED UP: if the worker reached `zpool create`, the declared devices " + "have already been written to."));
   }
   return after;
 });
-var destroyPool = (olds, path) => pve(olds.target, "provision", "DELETE", path);
+var destroyPool = (olds, path2) => pve(olds.target, "provision", "DELETE", path2);
 
 // src/proxmox/zfs-pool.ts
-var ProxmoxZfsPool = Resource32("Proxmox.ZfsPool", {
+var ProxmoxZfsPool = Resource35("Proxmox.ZfsPool", {
   defaultRemovalPolicy: "retain"
 });
 var leafDevices = (children) => Array.isArray(children) ? children.flatMap((entry) => {
@@ -3090,17 +3790,23 @@ var spec2 = {
   path: (props) => `nodes/${props.node}/disks/zfs/${props.name}`
 };
 var ops5 = pveOperations(spec2);
-var handlers27 = {
+var handlers30 = {
   ...pveHandlers(spec2),
-  delete: Effect54.fn(function* ({ olds }) {
+  delete: Effect59.fn(function* ({ olds }) {
     yield* destroyPool(olds, spec2.path(olds));
   }),
   reconcile: ({ news }) => createPool(news, spec2.collection(news), spec2.path(news), ops5.read)
 };
-var ProxmoxZfsPoolProvider = () => Provider32.effect(ProxmoxZfsPool, Effect54.succeed(ProxmoxZfsPool.Provider.of(handlers27)));
+var ProxmoxZfsPoolProvider = () => Provider35.effect(ProxmoxZfsPool, Effect59.succeed(ProxmoxZfsPool.Provider.of(handlers30)));
 export {
+  PROVISION_DEFAULTS,
+  PROVISION_PRIVILEGES,
   PbsDatastore,
   PbsDatastoreProvider,
+  PbsNotificationMatcher,
+  PbsNotificationMatcherProvider,
+  PbsNotificationTarget,
+  PbsNotificationTargetProvider,
   PbsPruneJob,
   PbsPruneJobProvider,
   PbsSyncJob,
@@ -3131,6 +3837,8 @@ export {
   ProxmoxMetricServerProvider,
   ProxmoxNetworkApplyProvider,
   ProxmoxNodeNetworkProvider,
+  ProxmoxNotificationMatcher,
+  ProxmoxNotificationMatcherProvider,
   ProxmoxNotificationTarget,
   ProxmoxNotificationTargetProvider,
   ProxmoxPool,
@@ -3151,8 +3859,12 @@ export {
   ProxmoxUser,
   ProxmoxUserProvider,
   ProxmoxVmProvider,
-  ProxmoxZfsPoolProvider
+  ProxmoxZfsPoolProvider,
+  alertmanagerAlertBody,
+  declareProvisionBaseline,
+  provisionBaseline,
+  provisionBootstrap
 };
 
-//# debugId=6EEA5191A9F0C54064756E2164756E21
+//# debugId=98691C143D2F953764756E2164756E21
 //# sourceMappingURL=index.js.map