@homeflare/alchemy 0.14.0 → 0.19.0

package/dist/proxmox/index.js

@@ -2,7 +2,7 @@
 import { Resource } from "alchemy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
-import * as Effect6 from "effect/Effect";
+import * as Effect8 from "effect/Effect";
 
 // src/proxmox/client.ts
 import * as Effect4 from "effect/Effect";
@@ -223,30 +223,1027 @@ var pve = (target, role, method, path, form) => Effect4.gen(function* () {
 
 // src/proxmox/resource.ts
 import { isResolved } from "alchemy/Diff";
+import * as Effect7 from "effect/Effect";
+
+// src/proxmox/resource-guard.ts
+import * as Effect6 from "effect/Effect";
+
+// src/proxmox/constraint-guard.ts
 import * as Effect5 from "effect/Effect";
 
+// src/proxmox/constraints.ts
+var lengthOf = (value) => [...value].length;
+var checkValue = (name, value, rule) => {
+  const out = [];
+  if (rule.maxLength !== undefined && lengthOf(value) > rule.maxLength) {
+    out.push(`${name}: at most ${rule.maxLength} characters`);
+  }
+  if (rule.minLength !== undefined && lengthOf(value) < rule.minLength) {
+    out.push(`${name}: at least ${rule.minLength} characters`);
+  }
+  if (rule.enum !== undefined && !rule.enum.includes(value)) {
+    out.push(`${name}: must be one of ${rule.enum.join(", ")}`);
+  }
+  if (rule.pattern !== undefined && !new RegExp(rule.pattern, rule.patternFlags).test(value)) {
+    out.push(`${name}: must match ${rule.patternSource ?? rule.pattern}`);
+  }
+  const numeric = Number(value);
+  const bounded = rule.minimum !== undefined || rule.maximum !== undefined;
+  if (bounded && value !== "" && Number.isFinite(numeric)) {
+    if (rule.minimum !== undefined && numeric < rule.minimum) {
+      out.push(`${name}: at least ${rule.minimum}`);
+    }
+    if (rule.maximum !== undefined && numeric > rule.maximum) {
+      out.push(`${name}: at most ${rule.maximum}`);
+    }
+  }
+  return out;
+};
+var violations = (table, form, options = {}) => {
+  const out = [];
+  for (const [name, rule] of Object.entries(table)) {
+    const value = form[name];
+    if (value === undefined) {
+      if (options.presence === true && rule.required === true)
+        out.push(`${name}: required`);
+      continue;
+    }
+    for (const item of typeof value === "string" ? [value] : value) {
+      out.push(...checkValue(name, item, rule));
+    }
+  }
+  return out;
+};
+var refusal = (endpoint, found) => `${endpoint} would be rejected by the vendor:
+  - ${found.join(`
+  - `)}
+` + "These are the vendor's own limits, read from its published schema " + "(packages/alchemy/src/proxmox/generated/constraints). Fix the declaration.";
+
+// src/proxmox/generated/constraints/pve-access.ts
+var PVE_ACCESS_CONSTRAINTS = {
+  "pve:POST /access/groups": {
+    groupid: { format: "pve-groupid", required: true, type: "string" }
+  },
+  "pve:POST /access/roles": {
+    privs: { format: "pve-priv-list", type: "string" },
+    roleid: { format: "pve-roleid", required: true, type: "string" }
+  },
+  "pve:POST /access/users": {
+    comment: { maxLength: 2048, type: "string" },
+    email: { format: "email-opt", maxLength: 254, type: "string" },
+    expire: { minimum: 0, type: "integer" },
+    firstname: { maxLength: 1024, type: "string" },
+    groups: { format: "pve-groupid-list", type: "string" },
+    keys: { pattern: "^[0-9a-zA-Z!=]{0,4096}\\n?$", patternSource: "[0-9a-zA-Z!=]{0,4096}", type: "string" },
+    lastname: { maxLength: 1024, type: "string" },
+    password: { maxLength: 64, minLength: 8, type: "string" },
+    userid: { format: "pve-userid", maxLength: 64, required: true, type: "string" }
+  },
+  "pve:POST /access/users/{userid}/token/{tokenid}": {
+    expire: { default: "same as user", minimum: 0, type: "integer" }
+  },
+  "pve:PUT /access/acl": {
+    groups: { format: "pve-groupid-list", type: "string" },
+    path: { required: true, type: "string" },
+    roles: { format: "pve-roleid-list", required: true, type: "string" },
+    tokens: { format: "pve-tokenid-list", type: "string" },
+    users: { format: "pve-userid-list", type: "string" }
+  },
+  "pve:PUT /access/groups/{groupid}": {},
+  "pve:PUT /access/roles/{roleid}": {
+    privs: { format: "pve-priv-list", type: "string" }
+  },
+  "pve:PUT /access/users/{userid}": {
+    comment: { maxLength: 2048, type: "string" },
+    email: { format: "email-opt", maxLength: 254, type: "string" },
+    expire: { minimum: 0, type: "integer" },
+    firstname: { maxLength: 1024, type: "string" },
+    groups: { format: "pve-groupid-list", type: "string" },
+    keys: { pattern: "^[0-9a-zA-Z!=]{0,4096}\\n?$", patternSource: "[0-9a-zA-Z!=]{0,4096}", type: "string" },
+    lastname: { maxLength: 1024, type: "string" }
+  },
+  "pve:PUT /access/users/{userid}/token/{tokenid}": {
+    delete: { format: "pve-configid-list", type: "string" },
+    expire: { default: "same as user", minimum: 0, type: "integer" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-cluster-backup.ts
+var PVE_CLUSTER_BACKUP_CONSTRAINTS = {
+  "pve:POST /cluster/backup": {
+    bwlimit: { default: "0", minimum: 0, type: "integer" },
+    comment: { maxLength: 512, type: "string" },
+    compress: { default: "0", enum: ["0", "1", "gzip", "lzo", "zstd"], type: "string" },
+    dow: { default: "mon,tue,wed,thu,fri,sat,sun", format: "pve-day-of-week-list", type: "string" },
+    exclude: { format: "pve-vmid-list", type: "string" },
+    fleecing: { format: "backup-fleecing", type: "string" },
+    id: { format: "pve-configid", type: "string" },
+    ionice: { default: "7", maximum: 8, minimum: 0, type: "integer" },
+    lockwait: { default: "180", minimum: 0, type: "integer" },
+    mailnotification: { default: "always", enum: ["always", "failure"], type: "string" },
+    mailto: { format: "email-or-username-list", type: "string" },
+    mode: { default: "snapshot", enum: ["snapshot", "suspend", "stop"], type: "string" },
+    node: { format: "pve-node", type: "string" },
+    "notes-template": { maxLength: 1024, type: "string" },
+    "notification-mode": { default: "auto", enum: ["auto", "legacy-sendmail", "notification-system"], type: "string" },
+    "pbs-change-detection-mode": { enum: ["legacy", "data", "metadata"], type: "string" },
+    performance: { format: "backup-performance", type: "string" },
+    "prune-backups": { default: "keep-all=1", format: "prune-backups", type: "string" },
+    schedule: { format: "pve-calendar-event", maxLength: 128, type: "string" },
+    starttime: { pattern: "^\\d{1,2}:\\d{1,2}\\n?$", patternSource: "\\d{1,2}:\\d{1,2}", type: "string" },
+    stopwait: { default: "10", minimum: 0, type: "integer" },
+    storage: { format: "pve-storage-id", type: "string" },
+    vmid: { format: "pve-vmid-list", type: "string" }
+  },
+  "pve:PUT /cluster/backup/{id}": {
+    bwlimit: { default: "0", minimum: 0, type: "integer" },
+    comment: { maxLength: 512, type: "string" },
+    compress: { default: "0", enum: ["0", "1", "gzip", "lzo", "zstd"], type: "string" },
+    delete: { format: "pve-configid-list", type: "string" },
+    dow: { format: "pve-day-of-week-list", type: "string" },
+    exclude: { format: "pve-vmid-list", type: "string" },
+    fleecing: { format: "backup-fleecing", type: "string" },
+    ionice: { default: "7", maximum: 8, minimum: 0, type: "integer" },
+    lockwait: { default: "180", minimum: 0, type: "integer" },
+    mailnotification: { default: "always", enum: ["always", "failure"], type: "string" },
+    mailto: { format: "email-or-username-list", type: "string" },
+    mode: { default: "snapshot", enum: ["snapshot", "suspend", "stop"], type: "string" },
+    node: { format: "pve-node", type: "string" },
+    "notes-template": { maxLength: 1024, type: "string" },
+    "notification-mode": { default: "auto", enum: ["auto", "legacy-sendmail", "notification-system"], type: "string" },
+    "pbs-change-detection-mode": { enum: ["legacy", "data", "metadata"], type: "string" },
+    performance: { format: "backup-performance", type: "string" },
+    "prune-backups": { default: "keep-all=1", format: "prune-backups", type: "string" },
+    schedule: { format: "pve-calendar-event", maxLength: 128, type: "string" },
+    starttime: { pattern: "^\\d{1,2}:\\d{1,2}\\n?$", patternSource: "\\d{1,2}:\\d{1,2}", type: "string" },
+    stopwait: { default: "10", minimum: 0, type: "integer" },
+    storage: { format: "pve-storage-id", type: "string" },
+    vmid: { format: "pve-vmid-list", type: "string" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-cluster-ceph.ts
+var PVE_CLUSTER_CEPH_CONSTRAINTS = {
+  "pve:PUT /cluster/ceph/flags/{flag}": {
+    value: { required: true, type: "boolean" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-cluster-firewall.ts
+var PVE_CLUSTER_FIREWALL_CONSTRAINTS = {
+  "pve:POST /cluster/firewall/aliases": {
+    cidr: { format: "IPorCIDR", required: true, type: "string" },
+    comment: { format: "pve-fw-comment-spec", type: "string" },
+    name: { maxLength: 64, minLength: 2, pattern: "^[A-Za-z][A-Za-z0-9\\-\\_]+\\n?$", patternSource: "[A-Za-z][A-Za-z0-9\\-\\_]+", required: true, type: "string" }
+  },
+  "pve:PUT /cluster/firewall/aliases/{name}": {
+    cidr: { format: "IPorCIDR", required: true, type: "string" },
+    comment: { format: "pve-fw-comment-spec", type: "string" },
+    digest: { maxLength: 64, type: "string" },
+    rename: { maxLength: 64, minLength: 2, pattern: "^[A-Za-z][A-Za-z0-9\\-\\_]+\\n?$", patternSource: "[A-Za-z][A-Za-z0-9\\-\\_]+", type: "string" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-cluster-ha.ts
+var PVE_CLUSTER_HA_CONSTRAINTS = {
+  "pve:POST /cluster/ha/resources": {
+    comment: { maxLength: 4096, type: "string" },
+    group: { format: "pve-configid", type: "string" },
+    max_relocate: { default: "1", minimum: 0, type: "integer" },
+    max_restart: { default: "1", minimum: 0, type: "integer" },
+    sid: { format: "pve-ha-resource-or-vm-id", required: true, type: "string" },
+    state: { default: "started", enum: ["started", "stopped", "enabled", "disabled", "ignored"], type: "string" },
+    type: { enum: ["ct", "vm"], type: "string" }
+  },
+  "pve:POST /cluster/ha/rules": {
+    affinity: { enum: ["positive", "negative"], type: "string" },
+    comment: { maxLength: 4096, type: "string" },
+    resources: { format: "pve-ha-resource-id-list", required: true, type: "string" },
+    rule: { format: "pve-configid", required: true, type: "string" }
+  },
+  "pve:PUT /cluster/ha/resources/{sid}": {
+    comment: { maxLength: 4096, type: "string" },
+    delete: { format: "pve-configid-list", maxLength: 4096, type: "string" },
+    digest: { maxLength: 64, type: "string" },
+    group: { format: "pve-configid", type: "string" },
+    max_relocate: { default: "1", minimum: 0, type: "integer" },
+    max_restart: { default: "1", minimum: 0, type: "integer" },
+    state: { default: "started", enum: ["started", "stopped", "enabled", "disabled", "ignored"], type: "string" }
+  },
+  "pve:PUT /cluster/ha/rules/{rule}": {
+    affinity: { enum: ["positive", "negative"], type: "string" },
+    comment: { maxLength: 4096, type: "string" },
+    delete: { format: "pve-configid-list", maxLength: 4096, type: "string" },
+    digest: { maxLength: 64, type: "string" },
+    resources: { format: "pve-ha-resource-id-list", type: "string" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-cluster-metrics.ts
+var PVE_CLUSTER_METRICS_CONSTRAINTS = {
+  "pve:POST /cluster/metrics/server/{id}": {
+    influxdbproto: { default: "udp", enum: ["udp", "http", "https"], type: "string" },
+    "max-body-size": { default: "25000000", minimum: 1, type: "integer" },
+    mtu: { default: "1500", maximum: 65536, minimum: 512, type: "integer" },
+    "otel-compression": { default: "gzip", enum: ["none", "gzip"], type: "string" },
+    "otel-headers": { maxLength: 1024, type: "string" },
+    "otel-max-body-size": { default: "10000000", minimum: 1024, type: "integer" },
+    "otel-protocol": { default: "https", enum: ["http", "https"], type: "string" },
+    "otel-resource-attributes": { maxLength: 1024, type: "string" },
+    "otel-timeout": { default: "5", maximum: 10, minimum: 1, type: "integer" },
+    path: { format: "graphite-path", type: "string" },
+    port: { maximum: 65536, minimum: 1, required: true, type: "integer" },
+    proto: { enum: ["udp", "tcp"], type: "string" },
+    server: { format: "address", required: true, type: "string" },
+    timeout: { default: "1", minimum: 0, type: "integer" },
+    type: { enum: ["graphite", "influxdb", "opentelemetry"], format: "pve-configid", required: true, type: "string" }
+  },
+  "pve:PUT /cluster/metrics/server/{id}": {
+    delete: { format: "pve-configid-list", maxLength: 4096, type: "string" },
+    digest: { maxLength: 64, type: "string" },
+    influxdbproto: { default: "udp", enum: ["udp", "http", "https"], type: "string" },
+    "max-body-size": { default: "25000000", minimum: 1, type: "integer" },
+    mtu: { default: "1500", maximum: 65536, minimum: 512, type: "integer" },
+    "otel-compression": { default: "gzip", enum: ["none", "gzip"], type: "string" },
+    "otel-headers": { maxLength: 1024, type: "string" },
+    "otel-max-body-size": { default: "10000000", minimum: 1024, type: "integer" },
+    "otel-protocol": { default: "https", enum: ["http", "https"], type: "string" },
+    "otel-resource-attributes": { maxLength: 1024, type: "string" },
+    "otel-timeout": { default: "5", maximum: 10, minimum: 1, type: "integer" },
+    path: { format: "graphite-path", type: "string" },
+    port: { maximum: 65536, minimum: 1, required: true, type: "integer" },
+    proto: { enum: ["udp", "tcp"], type: "string" },
+    server: { format: "address", required: true, type: "string" },
+    timeout: { default: "1", minimum: 0, type: "integer" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-cluster-notifications.ts
+var PVE_CLUSTER_NOTIFICATIONS_CONSTRAINTS = {
+  "pve:POST /cluster/notifications/endpoints/gotify": {
+    name: { format: "pve-configid", required: true, type: "string" },
+    server: { required: true, type: "string" },
+    token: { required: true, type: "string" }
+  },
+  "pve:POST /cluster/notifications/endpoints/sendmail": {
+    mailto: { each: true, format: "email-or-username", type: "array" },
+    "mailto-user": { each: true, format: "pve-userid", type: "array" },
+    name: { format: "pve-configid", required: true, type: "string" }
+  },
+  "pve:POST /cluster/notifications/endpoints/smtp": {
+    "from-address": { required: true, type: "string" },
+    mailto: { each: true, format: "email-or-username", type: "array" },
+    "mailto-user": { each: true, format: "pve-userid", type: "array" },
+    mode: { default: "tls", enum: ["insecure", "starttls", "tls"], type: "string" },
+    name: { format: "pve-configid", required: true, type: "string" },
+    server: { required: true, type: "string" }
+  },
+  "pve:POST /cluster/notifications/endpoints/webhook": {
+    method: { enum: ["post", "put", "get"], required: true, type: "string" },
+    name: { format: "pve-configid", required: true, type: "string" },
+    url: { required: true, type: "string" }
+  },
+  "pve:POST /cluster/notifications/matchers": {
+    mode: { default: "all", enum: ["all", "any"], type: "string" },
+    name: { format: "pve-configid", required: true, type: "string" },
+    target: { each: true, format: "pve-configid", type: "array" }
+  },
+  "pve:PUT /cluster/notifications/endpoints/gotify/{name}": {
+    delete: { each: true, format: "pve-configid", type: "array" },
+    digest: { maxLength: 64, type: "string" }
+  },
+  "pve:PUT /cluster/notifications/endpoints/sendmail/{name}": {
+    delete: { each: true, format: "pve-configid", type: "array" },
+    digest: { maxLength: 64, type: "string" },
+    mailto: { each: true, format: "email-or-username", type: "array" },
+    "mailto-user": { each: true, format: "pve-userid", type: "array" }
+  },
+  "pve:PUT /cluster/notifications/endpoints/smtp/{name}": {
+    delete: { each: true, format: "pve-configid", type: "array" },
+    digest: { maxLength: 64, type: "string" },
+    mailto: { each: true, format: "email-or-username", type: "array" },
+    "mailto-user": { each: true, format: "pve-userid", type: "array" },
+    mode: { default: "tls", enum: ["insecure", "starttls", "tls"], type: "string" }
+  },
+  "pve:PUT /cluster/notifications/endpoints/webhook/{name}": {
+    delete: { each: true, format: "pve-configid", type: "array" },
+    digest: { maxLength: 64, type: "string" },
+    method: { enum: ["post", "put", "get"], type: "string" }
+  },
+  "pve:PUT /cluster/notifications/matchers/{name}": {
+    delete: { each: true, format: "pve-configid", type: "array" },
+    digest: { maxLength: 64, type: "string" },
+    mode: { default: "all", enum: ["all", "any"], type: "string" },
+    target: { each: true, format: "pve-configid", type: "array" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-cluster-replication.ts
+var PVE_CLUSTER_REPLICATION_CONSTRAINTS = {
+  "pve:POST /cluster/replication": {
+    comment: { maxLength: 4096, type: "string" },
+    id: { format: "pve-replication-job-id", pattern: "^[1-9][0-9]{2,8}-\\d{1,9}\\n?$", patternSource: "[1-9][0-9]{2,8}-\\d{1,9}", required: true, type: "string" },
+    rate: { minimum: 1, type: "number" },
+    remove_job: { enum: ["local", "full"], type: "string" },
+    schedule: { default: "*/15", format: "pve-calendar-event", maxLength: 128, type: "string" },
+    source: { format: "pve-node", type: "string" },
+    target: { format: "pve-node", required: true, type: "string" },
+    type: { enum: ["local"], required: true, type: "string" }
+  },
+  "pve:PUT /cluster/replication/{id}": {
+    comment: { maxLength: 4096, type: "string" },
+    delete: { format: "pve-configid-list", maxLength: 4096, type: "string" },
+    digest: { maxLength: 64, type: "string" },
+    rate: { minimum: 1, type: "number" },
+    remove_job: { enum: ["local", "full"], type: "string" },
+    schedule: { default: "*/15", format: "pve-calendar-event", maxLength: 128, type: "string" },
+    source: { format: "pve-node", type: "string" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-cluster-sdn.ts
+var PVE_CLUSTER_SDN_CONSTRAINTS = {
+  "pve:POST /cluster/sdn/vnets": {
+    alias: { maxLength: 256, patternSource: "(?^i:[\\(\\)-_.\\w\\d\\s]{0,256})", type: "string" },
+    tag: { maximum: 16777215, minimum: 1, type: "integer" },
+    type: { enum: ["vnet"], type: "string" },
+    vnet: { maxLength: 8, minLength: 2, pattern: "^[a-zA-Z][a-zA-Z0-9]*[a-zA-Z0-9]\\n?$", patternSource: "[a-zA-Z][a-zA-Z0-9]*[a-zA-Z0-9]", required: true, type: "string" },
+    zone: { required: true, type: "string" }
+  },
+  "pve:POST /cluster/sdn/vnets/{vnet}/subnets": {
+    "dhcp-dns-server": { format: "ip", type: "string" },
+    "dhcp-range": { each: true, format: "pve-sdn-dhcp-range", type: "array" },
+    dnszoneprefix: { format: "dns-name", type: "string" },
+    gateway: { format: "ip", type: "string" },
+    subnet: { format: "pve-sdn-subnet-id", required: true, type: "string" },
+    type: { enum: ["subnet"], required: true, type: "string" }
+  },
+  "pve:POST /cluster/sdn/zones": {
+    dhcp: { enum: ["dnsmasq"], type: "string" },
+    dnszone: { format: "dns-name", type: "string" },
+    exitnodes: { format: "pve-node-list", type: "string" },
+    "exitnodes-primary": { format: "pve-node", type: "string" },
+    fabric: { format: "pve-sdn-fabric-id", type: "string" },
+    mac: { format: "mac-addr", type: "string" },
+    nodes: { format: "pve-node-list", type: "string" },
+    peers: { format: "ip-list", type: "string" },
+    "rt-import": { format: "pve-sdn-bgp-rt-list", type: "string" },
+    "secondary-controllers": { each: true, maxLength: 64, minLength: 2, pattern: "^[a-zA-Z][a-zA-Z0-9_-]*[a-zA-Z0-9]\\n?$", patternSource: "[a-zA-Z][a-zA-Z0-9_-]*[a-zA-Z0-9]", type: "array" },
+    tag: { minimum: 0, type: "integer" },
+    type: { enum: ["evpn", "faucet", "qinq", "simple", "vlan", "vxlan"], format: "pve-configid", required: true, type: "string" },
+    "vlan-protocol": { default: "802.1q", enum: ["802.1q", "802.1ad"], type: "string" },
+    "vrf-vxlan": { maximum: 16777215, minimum: 1, type: "integer" },
+    "vxlan-port": { default: "4789", maximum: 65536, minimum: 1, type: "integer" },
+    zone: { maxLength: 8, minLength: 2, pattern: "^[a-zA-Z][a-zA-Z0-9]*[a-zA-Z0-9]\\n?$", patternSource: "[a-zA-Z][a-zA-Z0-9]*[a-zA-Z0-9]", required: true, type: "string" }
+  },
+  "pve:PUT /cluster/sdn": {},
+  "pve:PUT /cluster/sdn/vnets/{vnet}": {
+    alias: { maxLength: 256, patternSource: "(?^i:[\\(\\)-_.\\w\\d\\s]{0,256})", type: "string" },
+    delete: { format: "pve-configid-list", maxLength: 4096, type: "string" },
+    digest: { maxLength: 64, type: "string" },
+    tag: { maximum: 16777215, minimum: 1, type: "integer" }
+  },
+  "pve:PUT /cluster/sdn/vnets/{vnet}/subnets/{subnet}": {
+    delete: { format: "pve-configid-list", maxLength: 4096, type: "string" },
+    "dhcp-dns-server": { format: "ip", type: "string" },
+    "dhcp-range": { each: true, format: "pve-sdn-dhcp-range", type: "array" },
+    digest: { maxLength: 64, type: "string" },
+    dnszoneprefix: { format: "dns-name", type: "string" },
+    gateway: { format: "ip", type: "string" }
+  },
+  "pve:PUT /cluster/sdn/zones/{zone}": {
+    delete: { format: "pve-configid-list", maxLength: 4096, type: "string" },
+    dhcp: { enum: ["dnsmasq"], type: "string" },
+    digest: { maxLength: 64, type: "string" },
+    dnszone: { format: "dns-name", type: "string" },
+    exitnodes: { format: "pve-node-list", type: "string" },
+    "exitnodes-primary": { format: "pve-node", type: "string" },
+    fabric: { format: "pve-sdn-fabric-id", type: "string" },
+    mac: { format: "mac-addr", type: "string" },
+    nodes: { format: "pve-node-list", type: "string" },
+    peers: { format: "ip-list", type: "string" },
+    "rt-import": { format: "pve-sdn-bgp-rt-list", type: "string" },
+    "secondary-controllers": { each: true, maxLength: 64, minLength: 2, pattern: "^[a-zA-Z][a-zA-Z0-9_-]*[a-zA-Z0-9]\\n?$", patternSource: "[a-zA-Z][a-zA-Z0-9_-]*[a-zA-Z0-9]", type: "array" },
+    tag: { minimum: 0, type: "integer" },
+    "vlan-protocol": { default: "802.1q", enum: ["802.1q", "802.1ad"], type: "string" },
+    "vrf-vxlan": { maximum: 16777215, minimum: 1, type: "integer" },
+    "vxlan-port": { default: "4789", maximum: 65536, minimum: 1, type: "integer" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-nodes-ceph.ts
+var PVE_NODES_CEPH_CONSTRAINTS = {
+  "pve:POST /nodes/{node}/ceph/fs/{name}": {
+    pg_num: { default: "128", maximum: 32768, minimum: 8, type: "integer" }
+  },
+  "pve:POST /nodes/{node}/ceph/mds/{name}": {},
+  "pve:POST /nodes/{node}/ceph/mgr/{id}": {},
+  "pve:POST /nodes/{node}/ceph/mon/{monid}": {
+    "mon-address": { format: "ip-list", type: "string" }
+  },
+  "pve:POST /nodes/{node}/ceph/osd": {
+    db_dev_size: { minimum: 1, type: "number" },
+    dev: { required: true, type: "string" },
+    "osds-per-device": { minimum: 1, type: "integer" },
+    wal_dev_size: { minimum: 0.5, type: "number" }
+  },
+  "pve:POST /nodes/{node}/ceph/pool": {
+    application: { default: "rbd", enum: ["rbd", "cephfs", "rgw"], type: "string" },
+    min_size: { default: "2", maximum: 7, minimum: 1, type: "integer" },
+    name: { patternSource: "(?^:^[^:/\\s]+$)", required: true, type: "string" },
+    pg_autoscale_mode: { default: "warn", enum: ["on", "off", "warn"], type: "string" },
+    pg_num: { default: "128", maximum: 32768, minimum: 1, type: "integer" },
+    pg_num_min: { maximum: 32768, type: "integer" },
+    size: { default: "3", maximum: 7, minimum: 1, type: "integer" },
+    target_size: { pattern: "^^(\\d+(\\.\\d+)?)([KMGT])?$\\n?$", patternSource: "^(\\d+(\\.\\d+)?)([KMGT])?$", type: "string" }
+  },
+  "pve:PUT /nodes/{node}/ceph/pool/{name}": {
+    application: { enum: ["rbd", "cephfs", "rgw"], type: "string" },
+    min_size: { maximum: 7, minimum: 1, type: "integer" },
+    pg_autoscale_mode: { enum: ["on", "off", "warn"], type: "string" },
+    pg_num: { maximum: 32768, minimum: 1, type: "integer" },
+    pg_num_min: { maximum: 32768, type: "integer" },
+    size: { maximum: 7, minimum: 1, type: "integer" },
+    target_size: { pattern: "^^(\\d+(\\.\\d+)?)([KMGT])?$\\n?$", patternSource: "^(\\d+(\\.\\d+)?)([KMGT])?$", type: "string" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-nodes-disks.ts
+var PVE_NODES_DISKS_CONSTRAINTS = {
+  "pve:POST /nodes/{node}/disks/zfs": {
+    ashift: { default: "12", maximum: 16, minimum: 9, type: "integer" },
+    compression: { default: "on", enum: ["on", "off", "gzip", "lz4", "lzjb", "zle", "zstd"], type: "string" },
+    devices: { format: "string-list", required: true, type: "string" },
+    name: { format: "pve-storage-id", required: true, type: "string" },
+    raidlevel: { enum: ["single", "mirror", "raid10", "raidz", "raidz2", "raidz3", "draid", "draid2", "draid3"], required: true, type: "string" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-nodes-lxc.ts
+var PVE_NODES_LXC_CONSTRAINTS = {
+  "pve:POST /nodes/{node}/lxc": {
+    arch: { default: "amd64", enum: ["amd64", "i386", "arm64", "armhf", "riscv32", "riscv64"], type: "string" },
+    bwlimit: { default: "restore limit from datacenter or storage config", minimum: 0, type: "number" },
+    cmode: { default: "tty", enum: ["shell", "console", "tty"], type: "string" },
+    cores: { maximum: 8192, minimum: 1, type: "integer" },
+    cpulimit: { default: "0", maximum: 8192, minimum: 0, type: "number" },
+    cpuunits: { default: "cgroup v1: 1024, cgroup v2: 100", maximum: 500000, minimum: 0, type: "integer" },
+    description: { maxLength: 8192, type: "string" },
+    entrypoint: { default: "/sbin/init", patternSource: "(?^:[^\\x00-\\x08\\x0a-\\x1F\\x7F]+)", type: "string" },
+    env: { patternSource: "(?^:(?:\\w+=[^\\x00-\\x08\\x0a-\\x1F\\x7F]*)(?:\\0\\w+=[^\\x00-\\x08\\x0a-\\x1F\\x7F]*)*)", type: "string" },
+    hookscript: { format: "pve-volume-id", type: "string" },
+    hostname: { format: "dns-name", maxLength: 255, type: "string" },
+    lock: { enum: ["backup", "create", "destroyed", "disk", "fstrim", "migrate", "mounted", "rollback", "snapshot", "snapshot-delete"], type: "string" },
+    memory: { default: "512", minimum: 16, type: "integer" },
+    nameserver: { format: "lxc-ip-with-ll-iface-list", type: "string" },
+    ostemplate: { maxLength: 255, required: true, type: "string" },
+    ostype: { enum: ["debian", "devuan", "ubuntu", "centos", "fedora", "opensuse", "archlinux", "alpine", "gentoo", "nixos", "unmanaged"], type: "string" },
+    password: { minLength: 5, type: "string" },
+    pool: { format: "pve-poolid", type: "string" },
+    searchdomain: { format: "dns-name-list", type: "string" },
+    startup: { format: "pve-startup-order", type: "string" },
+    storage: { default: "local", format: "pve-storage-id", type: "string" },
+    swap: { default: "512", minimum: 0, type: "integer" },
+    tags: { format: "pve-tag-list", type: "string" },
+    timezone: { format: "pve-ct-timezone", type: "string" },
+    tty: { default: "2", maximum: 6, minimum: 0, type: "integer" },
+    vmid: { format: "pve-vmid", maximum: 999999999, minimum: 100, required: true, type: "integer" }
+  },
+  "pve:PUT /nodes/{node}/lxc/{vmid}/config": {
+    arch: { default: "amd64", enum: ["amd64", "i386", "arm64", "armhf", "riscv32", "riscv64"], type: "string" },
+    cmode: { default: "tty", enum: ["shell", "console", "tty"], type: "string" },
+    cores: { maximum: 8192, minimum: 1, type: "integer" },
+    cpulimit: { default: "0", maximum: 8192, minimum: 0, type: "number" },
+    cpuunits: { default: "cgroup v1: 1024, cgroup v2: 100", maximum: 500000, minimum: 0, type: "integer" },
+    delete: { format: "pve-configid-list", type: "string" },
+    description: { maxLength: 8192, type: "string" },
+    digest: { maxLength: 40, type: "string" },
+    entrypoint: { default: "/sbin/init", patternSource: "(?^:[^\\x00-\\x08\\x0a-\\x1F\\x7F]+)", type: "string" },
+    env: { patternSource: "(?^:(?:\\w+=[^\\x00-\\x08\\x0a-\\x1F\\x7F]*)(?:\\0\\w+=[^\\x00-\\x08\\x0a-\\x1F\\x7F]*)*)", type: "string" },
+    hookscript: { format: "pve-volume-id", type: "string" },
+    hostname: { format: "dns-name", maxLength: 255, type: "string" },
+    lock: { enum: ["backup", "create", "destroyed", "disk", "fstrim", "migrate", "mounted", "rollback", "snapshot", "snapshot-delete"], type: "string" },
+    memory: { default: "512", minimum: 16, type: "integer" },
+    nameserver: { format: "lxc-ip-with-ll-iface-list", type: "string" },
+    ostype: { enum: ["debian", "devuan", "ubuntu", "centos", "fedora", "opensuse", "archlinux", "alpine", "gentoo", "nixos", "unmanaged"], type: "string" },
+    revert: { format: "pve-configid-list", type: "string" },
+    searchdomain: { format: "dns-name-list", type: "string" },
+    startup: { format: "pve-startup-order", type: "string" },
+    swap: { default: "512", minimum: 0, type: "integer" },
+    tags: { format: "pve-tag-list", type: "string" },
+    timezone: { format: "pve-ct-timezone", type: "string" },
+    tty: { default: "2", maximum: 6, minimum: 0, type: "integer" }
+  },
+  "pve:PUT /nodes/{node}/lxc/{vmid}/resize": {
+    digest: { maxLength: 40, type: "string" },
+    disk: { enum: ["rootfs", "mp0", "mp1", "mp2", "mp3", "mp4", "mp5", "mp6", "mp7", "mp8", "mp9", "mp10", "mp11", "mp12", "mp13", "mp14", "mp15", "mp16", "mp17", "mp18", "mp19", "mp20", "mp21", "mp22", "mp23", "mp24", "mp25", "mp26", "mp27", "mp28", "mp29", "mp30", "mp31", "mp32", "mp33", "mp34", "mp35", "mp36", "mp37", "mp38", "mp39", "mp40", "mp41", "mp42", "mp43", "mp44", "mp45", "mp46", "mp47", "mp48", "mp49", "mp50", "mp51", "mp52", "mp53", "mp54", "mp55", "mp56", "mp57", "mp58", "mp59", "mp60", "mp61", "mp62", "mp63", "mp64", "mp65", "mp66", "mp67", "mp68", "mp69", "mp70", "mp71", "mp72", "mp73", "mp74", "mp75", "mp76", "mp77", "mp78", "mp79", "mp80", "mp81", "mp82", "mp83", "mp84", "mp85", "mp86", "mp87", "mp88", "mp89", "mp90", "mp91", "mp92", "mp93", "mp94", "mp95", "mp96", "mp97", "mp98", "mp99", "mp100", "mp101", "mp102", "mp103", "mp104", "mp105", "mp106", "mp107", "mp108", "mp109", "mp110", "mp111", "mp112", "mp113", "mp114", "mp115", "mp116", "mp117", "mp118", "mp119", "mp120", "mp121", "mp122", "mp123", "mp124", "mp125", "mp126", "mp127", "mp128", "mp129", "mp130", "mp131", "mp132", "mp133", "mp134", "mp135", "mp136", "mp137", "mp138", "mp139", "mp140", "mp141", "mp142", "mp143", "mp144", "mp145", "mp146", "mp147", "mp148", "mp149", "mp150", "mp151", "mp152", "mp153", "mp154", "mp155", "mp156", "mp157", "mp158", "mp159", "mp160", "mp161", "mp162", "mp163", "mp164", "mp165", "mp166", "mp167", "mp168", "mp169", "mp170", "mp171", "mp172", "mp173", "mp174", "mp175", "mp176", "mp177", "mp178", "mp179", "mp180", "mp181", "mp182", "mp183", "mp184", "mp185", "mp186", "mp187", "mp188", "mp189", "mp190", "mp191", "mp192", "mp193", "mp194", "mp195", "mp196", "mp197", "mp198", "mp199", "mp200", "mp201", "mp202", "mp203", "mp204", "mp205", "mp206", "mp207", "mp208", "mp209", "mp210", "mp211", "mp212", "mp213", "mp214", "mp215", "mp216", "mp217", "mp218", "mp219", "mp220", "mp221", "mp222", "mp223", "mp224", "mp225", "mp226", "mp227", "mp228", "mp229", "mp230", "mp231", "mp232", "mp233", "mp234", "mp235", "mp236", "mp237", "mp238", "mp239", "mp240", "mp241", "mp242", "mp243", "mp244", "mp245", "mp246", "mp247", "mp248", "mp249", "mp250", "mp251", "mp252", "mp253", "mp254", "mp255"], required: true, type: "string" },
+    size: { pattern: "^\\+?\\d+(\\.\\d+)?[KMGT]?\\n?$", patternSource: "\\+?\\d+(\\.\\d+)?[KMGT]?", required: true, type: "string" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-nodes-network.ts
+var PVE_NODES_NETWORK_CONSTRAINTS = {
+  "pve:POST /nodes/{node}/network": {
+    address: { format: "ipv4", type: "string" },
+    address6: { format: "ipv6", type: "string" },
+    "bond-primary": { format: "pve-iface", type: "string" },
+    bond_mode: { enum: ["balance-rr", "active-backup", "balance-xor", "broadcast", "802.3ad", "balance-tlb", "balance-alb", "balance-slb", "lacp-balance-slb", "lacp-balance-tcp"], type: "string" },
+    bond_xmit_hash_policy: { enum: ["layer2", "layer2+3", "layer3+4"], type: "string" },
+    bridge_ports: { format: "pve-iface-list", type: "string" },
+    bridge_vids: { format: "pve-vlan-id-or-range-list", type: "string" },
+    cidr: { format: "CIDRv4", type: "string" },
+    cidr6: { format: "CIDRv6", type: "string" },
+    gateway: { format: "ipv4", type: "string" },
+    gateway6: { format: "ipv6", type: "string" },
+    iface: { format: "pve-iface", maxLength: 20, minLength: 2, required: true, type: "string" },
+    mtu: { maximum: 65520, minimum: 1280, type: "integer" },
+    netmask: { format: "ipv4mask", type: "string" },
+    netmask6: { maximum: 128, minimum: 0, type: "integer" },
+    ovs_bonds: { format: "pve-iface-list", type: "string" },
+    ovs_bridge: { format: "pve-iface", type: "string" },
+    ovs_options: { maxLength: 1024, type: "string" },
+    ovs_ports: { format: "pve-iface-list", type: "string" },
+    ovs_tag: { maximum: 4094, minimum: 1, type: "integer" },
+    slaves: { format: "pve-iface-list", type: "string" },
+    type: { enum: ["bridge", "bond", "eth", "alias", "vlan", "fabric", "OVSBridge", "OVSBond", "OVSPort", "OVSIntPort", "vnet", "unknown"], required: true, type: "string" },
+    "vlan-id": { maximum: 4094, minimum: 1, type: "integer" },
+    "vlan-raw-device": { format: "pve-iface", type: "string" }
+  },
+  "pve:PUT /nodes/{node}/network": {},
+  "pve:PUT /nodes/{node}/network/{iface}": {
+    address: { format: "ipv4", type: "string" },
+    address6: { format: "ipv6", type: "string" },
+    "bond-primary": { format: "pve-iface", type: "string" },
+    bond_mode: { enum: ["balance-rr", "active-backup", "balance-xor", "broadcast", "802.3ad", "balance-tlb", "balance-alb", "balance-slb", "lacp-balance-slb", "lacp-balance-tcp"], type: "string" },
+    bond_xmit_hash_policy: { enum: ["layer2", "layer2+3", "layer3+4"], type: "string" },
+    bridge_ports: { format: "pve-iface-list", type: "string" },
+    bridge_vids: { format: "pve-vlan-id-or-range-list", type: "string" },
+    cidr: { format: "CIDRv4", type: "string" },
+    cidr6: { format: "CIDRv6", type: "string" },
+    delete: { format: "pve-configid-list", type: "string" },
+    gateway: { format: "ipv4", type: "string" },
+    gateway6: { format: "ipv6", type: "string" },
+    mtu: { maximum: 65520, minimum: 1280, type: "integer" },
+    netmask: { format: "ipv4mask", type: "string" },
+    netmask6: { maximum: 128, minimum: 0, type: "integer" },
+    ovs_bonds: { format: "pve-iface-list", type: "string" },
+    ovs_bridge: { format: "pve-iface", type: "string" },
+    ovs_options: { maxLength: 1024, type: "string" },
+    ovs_ports: { format: "pve-iface-list", type: "string" },
+    ovs_tag: { maximum: 4094, minimum: 1, type: "integer" },
+    slaves: { format: "pve-iface-list", type: "string" },
+    type: { enum: ["bridge", "bond", "eth", "alias", "vlan", "fabric", "OVSBridge", "OVSBond", "OVSPort", "OVSIntPort", "vnet", "unknown"], required: true, type: "string" },
+    "vlan-id": { maximum: 4094, minimum: 1, type: "integer" },
+    "vlan-raw-device": { format: "pve-iface", type: "string" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-nodes-qemu.ts
+var PVE_NODES_QEMU_CONSTRAINTS = {
+  "pve:POST /nodes/{node}/qemu": {
+    affinity: { format: "pve-cpuset", type: "string" },
+    "amd-sev": { format: "pve-qemu-sev-fmt", type: "string" },
+    arch: { enum: ["x86_64", "aarch64"], type: "string" },
+    archive: { maxLength: 255, type: "string" },
+    balloon: { minimum: 0, type: "integer" },
+    bios: { default: "seabios", enum: ["seabios", "ovmf"], type: "string" },
+    boot: { format: "pve-qm-boot", type: "string" },
+    bootdisk: { format: "pve-qm-bootdisk", pattern: "^(ide|sata|scsi|virtio)\\d+\\n?$", patternSource: "(ide|sata|scsi|virtio)\\d+", type: "string" },
+    bwlimit: { default: "restore limit from datacenter or storage config", minimum: 0, type: "integer" },
+    cdrom: { format: "pve-qm-ide", type: "string" },
+    cicustom: { format: "pve-qm-cicustom", type: "string" },
+    citype: { enum: ["configdrive2", "nocloud", "opennebula"], type: "string" },
+    cores: { default: "1", minimum: 1, type: "integer" },
+    cpu: { format: "pve-vm-cpu-conf", type: "string" },
+    cpulimit: { default: "0", maximum: 128, minimum: 0, type: "number" },
+    cpuunits: { default: "cgroup v1: 1024, cgroup v2: 100", maximum: 262144, minimum: 1, type: "integer" },
+    description: { maxLength: 8192, type: "string" },
+    hookscript: { format: "pve-volume-id", type: "string" },
+    "hostpci[n]": { format: "pve-qm-hostpci", type: "string" },
+    hotplug: { default: "network,disk,usb", format: "pve-hotplug-features", type: "string" },
+    hugepages: { enum: ["any", "2", "1024"], type: "string" },
+    "import-working-storage": { format: "pve-storage-id", type: "string" },
+    "intel-tdx": { format: "pve-qemu-tdx-fmt", type: "string" },
+    "ipconfig[n]": { format: "pve-qm-ipconfig", type: "string" },
+    keyboard: { enum: ["de", "de-ch", "da", "en-gb", "en-us", "es", "fi", "fr", "fr-be", "fr-ca", "fr-ch", "hu", "is", "it", "ja", "lt", "mk", "nl", "no", "pl", "pt", "pt-br", "sv", "sl", "tr"], type: "string" },
+    lock: { enum: ["backup", "clone", "create", "migrate", "rollback", "snapshot", "snapshot-delete", "suspending", "suspended"], type: "string" },
+    migrate_downtime: { default: "0.1", minimum: 0, type: "number" },
+    migrate_speed: { default: "0", minimum: 0, type: "integer" },
+    name: { format: "dns-name", type: "string" },
+    nameserver: { format: "address-list", type: "string" },
+    ostype: { default: "other", enum: ["other", "wxp", "w2k", "w2k3", "w2k8", "wvista", "win7", "win8", "win10", "win11", "l24", "l26", "solaris"], type: "string" },
+    "parallel[n]": { pattern: "^/dev/parport\\d+|/dev/usb/lp\\d+\\n?$", patternSource: "/dev/parport\\d+|/dev/usb/lp\\d+", type: "string" },
+    pool: { format: "pve-poolid", type: "string" },
+    rng0: { format: "pve-qm-rng", type: "string" },
+    scsihw: { default: "lsi", enum: ["lsi", "lsi53c810", "virtio-scsi-pci", "virtio-scsi-single", "megasas", "pvscsi"], type: "string" },
+    "serial[n]": { pattern: "^(/dev/[^,]+|socket)\\n?$", patternSource: "(/dev/[^,]+|socket)", type: "string" },
+    shares: { default: "1000", maximum: 50000, minimum: 0, type: "integer" },
+    smbios1: { format: "pve-qm-smbios1", maxLength: 512, type: "string" },
+    smp: { default: "1", minimum: 1, type: "integer" },
+    sockets: { default: "1", minimum: 1, type: "integer" },
+    sshkeys: { format: "urlencoded", type: "string" },
+    startdate: { default: "now", pattern: "^(now|\\d{4}-\\d{1,2}-\\d{1,2}(T\\d{1,2}:\\d{1,2}:\\d{1,2})?)\\n?$", patternSource: "(now|\\d{4}-\\d{1,2}-\\d{1,2}(T\\d{1,2}:\\d{1,2}:\\d{1,2})?)", type: "string" },
+    startup: { format: "pve-startup-order", type: "string" },
+    storage: { format: "pve-storage-id", type: "string" },
+    tags: { format: "pve-tag-list", type: "string" },
+    vcpus: { default: "0", minimum: 1, type: "integer" },
+    vmgenid: { default: "1 (autogenerated)", pattern: "^(?:[a-fA-F0-9]{8}(?:-[a-fA-F0-9]{4}){3}-[a-fA-F0-9]{12}|[01])\\n?$", patternSource: "(?:[a-fA-F0-9]{8}(?:-[a-fA-F0-9]{4}){3}-[a-fA-F0-9]{12}|[01])", type: "string" },
+    vmid: { format: "pve-vmid", maximum: 999999999, minimum: 100, required: true, type: "integer" },
+    vmstatestorage: { format: "pve-storage-id", type: "string" },
+    watchdog: { format: "pve-qm-watchdog", type: "string" }
+  },
+  "pve:PUT /nodes/{node}/qemu/{vmid}/config": {
+    affinity: { format: "pve-cpuset", type: "string" },
+    "amd-sev": { format: "pve-qemu-sev-fmt", type: "string" },
+    arch: { enum: ["x86_64", "aarch64"], type: "string" },
+    balloon: { minimum: 0, type: "integer" },
+    bios: { default: "seabios", enum: ["seabios", "ovmf"], type: "string" },
+    boot: { format: "pve-qm-boot", type: "string" },
+    bootdisk: { format: "pve-qm-bootdisk", pattern: "^(ide|sata|scsi|virtio)\\d+\\n?$", patternSource: "(ide|sata|scsi|virtio)\\d+", type: "string" },
+    cdrom: { format: "pve-qm-ide", type: "string" },
+    cicustom: { format: "pve-qm-cicustom", type: "string" },
+    citype: { enum: ["configdrive2", "nocloud", "opennebula"], type: "string" },
+    cores: { default: "1", minimum: 1, type: "integer" },
+    cpu: { format: "pve-vm-cpu-conf", type: "string" },
+    cpulimit: { default: "0", maximum: 128, minimum: 0, type: "number" },
+    cpuunits: { default: "cgroup v1: 1024, cgroup v2: 100", maximum: 262144, minimum: 1, type: "integer" },
+    delete: { format: "pve-configid-list", type: "string" },
+    description: { maxLength: 8192, type: "string" },
+    digest: { maxLength: 40, type: "string" },
+    hookscript: { format: "pve-volume-id", type: "string" },
+    "hostpci[n]": { format: "pve-qm-hostpci", type: "string" },
+    hotplug: { default: "network,disk,usb", format: "pve-hotplug-features", type: "string" },
+    hugepages: { enum: ["any", "2", "1024"], type: "string" },
+    "intel-tdx": { format: "pve-qemu-tdx-fmt", type: "string" },
+    "ipconfig[n]": { format: "pve-qm-ipconfig", type: "string" },
+    keyboard: { enum: ["de", "de-ch", "da", "en-gb", "en-us", "es", "fi", "fr", "fr-be", "fr-ca", "fr-ch", "hu", "is", "it", "ja", "lt", "mk", "nl", "no", "pl", "pt", "pt-br", "sv", "sl", "tr"], type: "string" },
+    lock: { enum: ["backup", "clone", "create", "migrate", "rollback", "snapshot", "snapshot-delete", "suspending", "suspended"], type: "string" },
+    migrate_downtime: { default: "0.1", minimum: 0, type: "number" },
+    migrate_speed: { default: "0", minimum: 0, type: "integer" },
+    name: { format: "dns-name", type: "string" },
+    nameserver: { format: "address-list", type: "string" },
+    ostype: { default: "other", enum: ["other", "wxp", "w2k", "w2k3", "w2k8", "wvista", "win7", "win8", "win10", "win11", "l24", "l26", "solaris"], type: "string" },
+    "parallel[n]": { pattern: "^/dev/parport\\d+|/dev/usb/lp\\d+\\n?$", patternSource: "/dev/parport\\d+|/dev/usb/lp\\d+", type: "string" },
+    revert: { format: "pve-configid-list", type: "string" },
+    rng0: { format: "pve-qm-rng", type: "string" },
+    scsihw: { default: "lsi", enum: ["lsi", "lsi53c810", "virtio-scsi-pci", "virtio-scsi-single", "megasas", "pvscsi"], type: "string" },
+    "serial[n]": { pattern: "^(/dev/[^,]+|socket)\\n?$", patternSource: "(/dev/[^,]+|socket)", type: "string" },
+    shares: { default: "1000", maximum: 50000, minimum: 0, type: "integer" },
+    smbios1: { format: "pve-qm-smbios1", maxLength: 512, type: "string" },
+    smp: { default: "1", minimum: 1, type: "integer" },
+    sockets: { default: "1", minimum: 1, type: "integer" },
+    sshkeys: { format: "urlencoded", type: "string" },
+    startdate: { default: "now", pattern: "^(now|\\d{4}-\\d{1,2}-\\d{1,2}(T\\d{1,2}:\\d{1,2}:\\d{1,2})?)\\n?$", patternSource: "(now|\\d{4}-\\d{1,2}-\\d{1,2}(T\\d{1,2}:\\d{1,2}:\\d{1,2})?)", type: "string" },
+    startup: { format: "pve-startup-order", type: "string" },
+    tags: { format: "pve-tag-list", type: "string" },
+    vcpus: { default: "0", minimum: 1, type: "integer" },
+    vmgenid: { default: "1 (autogenerated)", pattern: "^(?:[a-fA-F0-9]{8}(?:-[a-fA-F0-9]{4}){3}-[a-fA-F0-9]{12}|[01])\\n?$", patternSource: "(?:[a-fA-F0-9]{8}(?:-[a-fA-F0-9]{4}){3}-[a-fA-F0-9]{12}|[01])", type: "string" },
+    vmstatestorage: { format: "pve-storage-id", type: "string" },
+    watchdog: { format: "pve-qm-watchdog", type: "string" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-pools.ts
+var PVE_POOLS_CONSTRAINTS = {
+  "pve:POST /pools": {
+    poolid: { format: "pve-poolid", required: true, type: "string" }
+  },
+  "pve:PUT /pools/{poolid}": {
+    storage: { format: "pve-storage-id-list", type: "string" },
+    vms: { format: "pve-vmid-list", type: "string" }
+  }
+};
+
+// src/proxmox/generated/constraints/pve-storage.ts
+var PVE_STORAGE_CONSTRAINTS = {
+  "pve:POST /storage": {
+    base: { format: "pve-volume-id", type: "string" },
+    blocksize: { format: "pve-storage-zfs-blocksize", type: "string" },
+    content: { format: "pve-storage-content-list", type: "string" },
+    "content-dirs": { format: "pve-dir-override-list", type: "string" },
+    domain: { maxLength: 256, type: "string" },
+    export: { format: "pve-storage-path", type: "string" },
+    fingerprint: { pattern: "^([A-Fa-f0-9]{2}:){31}[A-Fa-f0-9]{2}\\n?$", patternSource: "([A-Fa-f0-9]{2}:){31}[A-Fa-f0-9]{2}", type: "string" },
+    format: { enum: ["raw", "qcow2", "subvol", "vmdk"], type: "string" },
+    "fs-name": { format: "pve-configid", type: "string" },
+    "max-protected-backups": { default: "Unlimited for users with Datastore.Allocate privilege, 5 for other users", minimum: -1, type: "integer" },
+    monhost: { format: "pve-storage-portal-dns-list", type: "string" },
+    mountpoint: { format: "pve-storage-path", type: "string" },
+    nodes: { format: "pve-node-list", type: "string" },
+    options: { format: "pve-storage-options", type: "string" },
+    password: { maxLength: 256, type: "string" },
+    path: { format: "pve-storage-path", type: "string" },
+    port: { maximum: 65535, minimum: 1, type: "integer" },
+    portal: { format: "pve-storage-portal-dns", type: "string" },
+    preallocation: { default: "metadata", enum: ["off", "metadata", "falloc", "full"], type: "string" },
+    "prune-backups": { format: "prune-backups", type: "string" },
+    "saferemove-stepsize": { default: "32", enum: ["1", "2", "4", "8", "16", "32"], type: "integer" },
+    server: { format: "pve-storage-server", type: "string" },
+    smbversion: { default: "default", enum: ["default", "2.0", "2.1", "3", "3.0", "3.11"], type: "string" },
+    storage: { format: "pve-storage-id", required: true, type: "string" },
+    subdir: { format: "pve-storage-path", type: "string" },
+    thinpool: { format: "pve-storage-vgname", type: "string" },
+    type: { enum: ["btrfs", "cephfs", "cifs", "dir", "esxi", "iscsi", "iscsidirect", "lvm", "lvmthin", "nfs", "pbs", "rbd", "zfs", "zfspool"], required: true, type: "string" },
+    vgname: { format: "pve-storage-vgname", type: "string" },
+    "zfs-base-path": { format: "pve-storage-path", type: "string" }
+  },
+  "pve:PUT /storage/{storage}": {
+    blocksize: { format: "pve-storage-zfs-blocksize", type: "string" },
+    content: { format: "pve-storage-content-list", type: "string" },
+    "content-dirs": { format: "pve-dir-override-list", type: "string" },
+    delete: { format: "pve-configid-list", maxLength: 4096, type: "string" },
+    digest: { maxLength: 64, type: "string" },
+    domain: { maxLength: 256, type: "string" },
+    fingerprint: { pattern: "^([A-Fa-f0-9]{2}:){31}[A-Fa-f0-9]{2}\\n?$", patternSource: "([A-Fa-f0-9]{2}:){31}[A-Fa-f0-9]{2}", type: "string" },
+    format: { enum: ["raw", "qcow2", "subvol", "vmdk"], type: "string" },
+    "fs-name": { format: "pve-configid", type: "string" },
+    "max-protected-backups": { default: "Unlimited for users with Datastore.Allocate privilege, 5 for other users", minimum: -1, type: "integer" },
+    monhost: { format: "pve-storage-portal-dns-list", type: "string" },
+    mountpoint: { format: "pve-storage-path", type: "string" },
+    nodes: { format: "pve-node-list", type: "string" },
+    options: { format: "pve-storage-options", type: "string" },
+    password: { maxLength: 256, type: "string" },
+    port: { maximum: 65535, minimum: 1, type: "integer" },
+    preallocation: { default: "metadata", enum: ["off", "metadata", "falloc", "full"], type: "string" },
+    "prune-backups": { format: "prune-backups", type: "string" },
+    "saferemove-stepsize": { default: "32", enum: ["1", "2", "4", "8", "16", "32"], type: "integer" },
+    server: { format: "pve-storage-server", type: "string" },
+    smbversion: { default: "default", enum: ["default", "2.0", "2.1", "3", "3.0", "3.11"], type: "string" },
+    subdir: { format: "pve-storage-path", type: "string" },
+    "zfs-base-path": { format: "pve-storage-path", type: "string" }
+  }
+};
+
+// src/proxmox/generated/constraints/pbs-config.ts
+var PBS_CONFIG_CONSTRAINTS = {
+  "pbs:POST /config/datastore": {
+    "backing-device": { pattern: "^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$", patternSource: "/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/", type: "string" },
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    "keep-daily": { minimum: 1, type: "integer" },
+    "keep-hourly": { minimum: 1, type: "integer" },
+    "keep-last": { minimum: 1, type: "integer" },
+    "keep-monthly": { minimum: 1, type: "integer" },
+    "keep-weekly": { minimum: 1, type: "integer" },
+    "keep-yearly": { minimum: 1, type: "integer" },
+    name: { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", required: true, type: "string" },
+    "notification-mode": { default: "notification-system", enum: ["legacy-sendmail", "notification-system"], type: "string" },
+    "notify-user": { maxLength: 64, minLength: 3, pattern: "^(?:[^\\s:/\\x00-\\x1f\\x7f]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[^\\s:/[:cntrl:]]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "string" },
+    path: { maxLength: 4096, minLength: 1, required: true, type: "string" }
+  },
+  "pbs:POST /config/notifications/endpoints/sendmail": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    mailto: { each: true, maxLength: 64, minLength: 2, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "array" },
+    "mailto-user": { each: true, maxLength: 64, minLength: 2, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "array" },
+    name: { maxLength: 32, minLength: 2, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", required: true, type: "string" },
+    origin: { enum: ["user-created", "builtin", "modified-builtin"], type: "string" }
+  },
+  "pbs:POST /config/notifications/endpoints/smtp": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    "from-address": { required: true, type: "string" },
+    mailto: { each: true, maxLength: 64, minLength: 2, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "array" },
+    "mailto-user": { each: true, maxLength: 64, minLength: 2, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "array" },
+    mode: { default: "tls", enum: ["insecure", "starttls", "tls"], type: "string" },
+    name: { maxLength: 32, minLength: 2, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", required: true, type: "string" },
+    origin: { enum: ["user-created", "builtin", "modified-builtin"], type: "string" },
+    port: { maximum: 65535, minimum: 0, type: "integer" },
+    server: { required: true, type: "string" }
+  },
+  "pbs:POST /config/notifications/endpoints/webhook": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    method: { default: "post", enum: ["post", "put", "get"], required: true, type: "string" },
+    name: { maxLength: 32, minLength: 2, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", required: true, type: "string" },
+    origin: { enum: ["user-created", "builtin", "modified-builtin"], type: "string" },
+    url: { pattern: "^https?://(?:(?:(?:(?:(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?)\\.)*(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?))|(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|\\[(?:(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))\\]))(?::(?:[0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?)|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))(?:/[^\x00-\x1F]*)?$", patternSource: "/^https?://(?:(?:(?:(?:(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?)\\.)*(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?))|(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|\\[(?:(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))\\]))(?::(?:[0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?)|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))(?:/[^\x00-\x1F]*)?$/", required: true, type: "string" }
+  },
+  "pbs:POST /config/notifications/matchers": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    mode: { default: "all", enum: ["all", "any"], type: "string" },
+    name: { maxLength: 32, minLength: 2, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", required: true, type: "string" },
+    origin: { enum: ["user-created", "builtin", "modified-builtin"], type: "string" },
+    target: { each: true, maxLength: 32, minLength: 2, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "array" }
+  },
+  "pbs:POST /config/prune": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    id: { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", required: true, type: "string" },
+    "keep-daily": { minimum: 1, type: "integer" },
+    "keep-hourly": { minimum: 1, type: "integer" },
+    "keep-last": { minimum: 1, type: "integer" },
+    "keep-monthly": { minimum: 1, type: "integer" },
+    "keep-weekly": { minimum: 1, type: "integer" },
+    "keep-yearly": { minimum: 1, type: "integer" },
+    "max-depth": { maximum: 7, minimum: 0, type: "integer" },
+    ns: { maxLength: 256, pattern: "^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$", patternSource: "/^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$/", type: "string" },
+    schedule: { required: true, type: "string" },
+    store: { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", required: true, type: "string" }
+  },
+  "pbs:POST /config/sync": {
+    "active-encryption-key": { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "string" },
+    "associated-key": { each: true, maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "array" },
+    "burst-in": { maxLength: 64, minLength: 1, type: "string" },
+    "burst-out": { maxLength: 64, minLength: 1, type: "string" },
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    id: { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", required: true, type: "string" },
+    "max-depth": { maximum: 7, minimum: 0, type: "integer" },
+    ns: { maxLength: 256, pattern: "^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$", patternSource: "/^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$/", type: "string" },
+    owner: { maxLength: 64, minLength: 3, pattern: "^(?:(?:[^\\s:/\\x00-\\x1f\\x7f]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)|(?:[^\\s:/\\x00-\\x1f\\x7f]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)!(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))$", patternSource: "/^(?:(?:[^\\s:/[:cntrl:]]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)|(?:[^\\s:/[:cntrl:]]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)!(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))$/", type: "string" },
+    "rate-in": { maxLength: 64, minLength: 1, type: "string" },
+    "rate-out": { maxLength: 64, minLength: 1, type: "string" },
+    remote: { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "string" },
+    "remote-ns": { maxLength: 256, pattern: "^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$", patternSource: "/^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$/", type: "string" },
+    "remote-store": { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", required: true, type: "string" },
+    store: { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", required: true, type: "string" },
+    "sync-direction": { default: "pull", enum: ["pull", "push"], type: "string" },
+    "transfer-last": { minimum: 1, type: "integer" },
+    "worker-threads": { default: "1", maximum: 32, minimum: 1, type: "integer" }
+  },
+  "pbs:POST /config/verify": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    id: { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", required: true, type: "string" },
+    "max-depth": { default: "7", maximum: 7, minimum: 0, type: "integer" },
+    ns: { maxLength: 256, pattern: "^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$", patternSource: "/^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$/", type: "string" },
+    "outdated-after": { minimum: 0, type: "integer" },
+    "read-threads": { default: "1", maximum: 32, minimum: 1, type: "integer" },
+    store: { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", required: true, type: "string" },
+    "verify-threads": { default: "4", maximum: 32, minimum: 1, type: "integer" }
+  },
+  "pbs:PUT /config/datastore/{name}": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    delete: { each: true, enum: ["comment", "gc-schedule", "gc-on-unmount", "prune-schedule", "keep-last", "keep-hourly", "keep-daily", "keep-weekly", "keep-monthly", "keep-yearly", "verify-new", "notify-user", "notify", "notification-mode", "tuning", "maintenance-mode", "notification-thresholds", "counter-reset-schedule"], type: "array" },
+    digest: { pattern: "^[a-f0-9]{64}$", patternSource: "/^[a-f0-9]{64}$/", type: "string" },
+    "keep-daily": { minimum: 1, type: "integer" },
+    "keep-hourly": { minimum: 1, type: "integer" },
+    "keep-last": { minimum: 1, type: "integer" },
+    "keep-monthly": { minimum: 1, type: "integer" },
+    "keep-weekly": { minimum: 1, type: "integer" },
+    "keep-yearly": { minimum: 1, type: "integer" },
+    "notification-mode": { default: "notification-system", enum: ["legacy-sendmail", "notification-system"], type: "string" },
+    "notify-user": { maxLength: 64, minLength: 3, pattern: "^(?:[^\\s:/\\x00-\\x1f\\x7f]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[^\\s:/[:cntrl:]]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "string" }
+  },
+  "pbs:PUT /config/notifications/endpoints/sendmail/{name}": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    delete: { each: true, enum: ["author", "comment", "disable", "from-address", "mailto", "mailto-user"], type: "array" },
+    digest: { pattern: "^[a-f0-9]{64}$", patternSource: "/^[a-f0-9]{64}$/", type: "string" },
+    mailto: { each: true, maxLength: 64, minLength: 2, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "array" },
+    "mailto-user": { each: true, maxLength: 64, minLength: 2, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "array" }
+  },
+  "pbs:PUT /config/notifications/endpoints/smtp/{name}": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    delete: { each: true, enum: ["author", "comment", "disable", "mailto", "mailto-user", "password", "port", "username"], type: "array" },
+    digest: { pattern: "^[a-f0-9]{64}$", patternSource: "/^[a-f0-9]{64}$/", type: "string" },
+    mailto: { each: true, maxLength: 64, minLength: 2, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "array" },
+    "mailto-user": { each: true, maxLength: 64, minLength: 2, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "array" },
+    mode: { default: "tls", enum: ["insecure", "starttls", "tls"], type: "string" },
+    port: { maximum: 65535, minimum: 0, type: "integer" }
+  },
+  "pbs:PUT /config/notifications/endpoints/webhook/{name}": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    delete: { each: true, enum: ["comment", "disable", "header", "body", "secret"], type: "array" },
+    digest: { pattern: "^[a-f0-9]{64}$", patternSource: "/^[a-f0-9]{64}$/", type: "string" },
+    method: { default: "post", enum: ["post", "put", "get"], type: "string" },
+    url: { pattern: "^https?://(?:(?:(?:(?:(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?)\\.)*(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?))|(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|\\[(?:(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))\\]))(?::(?:[0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?)|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))(?:/[^\x00-\x1F]*)?$", patternSource: "/^https?://(?:(?:(?:(?:(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?)\\.)*(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?))|(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|\\[(?:(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))\\]))(?::(?:[0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?)|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){6})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:::(?:(?:[0-9a-fA-F]{1,4}):){5})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){4})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,1}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){3})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,2}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){2})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,3}(?:[0-9a-fA-F]{1,4}))?::(?:(?:[0-9a-fA-F]{1,4}):){1})(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,4}(?:[0-9a-fA-F]{1,4}))?::)(?:(?:(?:(?:(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9]))|(?:[0-9a-fA-F]{1,4}):(?:[0-9a-fA-F]{1,4}))))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,5}(?:[0-9a-fA-F]{1,4}))?::)(?:[0-9a-fA-F]{1,4}))|(?:(?:(?:(?:(?:[0-9a-fA-F]{1,4}):){0,6}(?:[0-9a-fA-F]{1,4}))?::))))(?:/[^\x00-\x1F]*)?$/", type: "string" }
+  },
+  "pbs:PUT /config/notifications/matchers/{name}": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    delete: { each: true, enum: ["comment", "disable", "invert-match", "match-calendar", "match-field", "match-severity", "mode", "target"], type: "array" },
+    digest: { pattern: "^[a-f0-9]{64}$", patternSource: "/^[a-f0-9]{64}$/", type: "string" },
+    mode: { default: "all", enum: ["all", "any"], type: "string" },
+    target: { each: true, maxLength: 32, minLength: 2, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "array" }
+  },
+  "pbs:PUT /config/prune/{id}": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    delete: { each: true, enum: ["comment", "disable", "ns", "max-depth", "keep-last", "keep-hourly", "keep-daily", "keep-weekly", "keep-monthly", "keep-yearly"], type: "array" },
+    digest: { pattern: "^[a-f0-9]{64}$", patternSource: "/^[a-f0-9]{64}$/", type: "string" },
+    "keep-daily": { minimum: 1, type: "integer" },
+    "keep-hourly": { minimum: 1, type: "integer" },
+    "keep-last": { minimum: 1, type: "integer" },
+    "keep-monthly": { minimum: 1, type: "integer" },
+    "keep-weekly": { minimum: 1, type: "integer" },
+    "keep-yearly": { minimum: 1, type: "integer" },
+    "max-depth": { maximum: 7, minimum: 0, type: "integer" },
+    ns: { maxLength: 256, pattern: "^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$", patternSource: "/^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$/", type: "string" },
+    store: { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "string" }
+  },
+  "pbs:PUT /config/sync/{id}": {
+    "active-encryption-key": { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "string" },
+    "associated-key": { each: true, maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "array" },
+    "burst-in": { maxLength: 64, minLength: 1, type: "string" },
+    "burst-out": { maxLength: 64, minLength: 1, type: "string" },
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    delete: { each: true, enum: ["remote", "owner", "comment", "schedule", "remove-vanished", "group-filter", "rate-in", "burst-in", "rate-out", "burst-out", "ns", "remote-ns", "max-depth", "transfer-last", "encrypted-only", "verified-only", "run-on-mount", "unmount-on-done", "sync-direction", "worker-threads", "active-encryption-key", "associated-key"], type: "array" },
+    digest: { pattern: "^[a-f0-9]{64}$", patternSource: "/^[a-f0-9]{64}$/", type: "string" },
+    "max-depth": { maximum: 7, minimum: 0, type: "integer" },
+    ns: { maxLength: 256, pattern: "^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$", patternSource: "/^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$/", type: "string" },
+    owner: { maxLength: 64, minLength: 3, pattern: "^(?:(?:[^\\s:/\\x00-\\x1f\\x7f]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)|(?:[^\\s:/\\x00-\\x1f\\x7f]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)!(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))$", patternSource: "/^(?:(?:[^\\s:/[:cntrl:]]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)|(?:[^\\s:/[:cntrl:]]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)!(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))$/", type: "string" },
+    "rate-in": { maxLength: 64, minLength: 1, type: "string" },
+    "rate-out": { maxLength: 64, minLength: 1, type: "string" },
+    remote: { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "string" },
+    "remote-ns": { maxLength: 256, pattern: "^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$", patternSource: "/^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$/", type: "string" },
+    "remote-store": { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "string" },
+    store: { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "string" },
+    "sync-direction": { default: "pull", enum: ["pull", "push"], type: "string" },
+    "transfer-last": { minimum: 1, type: "integer" },
+    "worker-threads": { default: "1", maximum: 32, minimum: 1, type: "integer" }
+  },
+  "pbs:PUT /config/verify/{id}": {
+    comment: { maxLength: 128, pattern: "^[^\\x00-\\x1f\\x7f]*$", patternSource: "/^[[:^cntrl:]]*$/", type: "string" },
+    delete: { each: true, enum: ["ignore-verified", "comment", "schedule", "outdated-after", "ns", "max-depth", "read-threads", "verify-threads"], type: "array" },
+    digest: { pattern: "^[a-f0-9]{64}$", patternSource: "/^[a-f0-9]{64}$/", type: "string" },
+    "max-depth": { default: "7", maximum: 7, minimum: 0, type: "integer" },
+    ns: { maxLength: 256, pattern: "^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$", patternSource: "/^(?:(?:(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)/){0,7}(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))?$/", type: "string" },
+    "outdated-after": { minimum: 0, type: "integer" },
+    "read-threads": { default: "1", maximum: 32, minimum: 1, type: "integer" },
+    store: { maxLength: 32, minLength: 3, pattern: "^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$", patternSource: "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/", type: "string" },
+    "verify-threads": { default: "4", maximum: 32, minimum: 1, type: "integer" }
+  }
+};
+
+// src/proxmox/generated/constraints/index.ts
+var PROXMOX_CONSTRAINTS = {
+  ...PVE_ACCESS_CONSTRAINTS,
+  ...PVE_CLUSTER_BACKUP_CONSTRAINTS,
+  ...PVE_CLUSTER_CEPH_CONSTRAINTS,
+  ...PVE_CLUSTER_FIREWALL_CONSTRAINTS,
+  ...PVE_CLUSTER_HA_CONSTRAINTS,
+  ...PVE_CLUSTER_METRICS_CONSTRAINTS,
+  ...PVE_CLUSTER_NOTIFICATIONS_CONSTRAINTS,
+  ...PVE_CLUSTER_REPLICATION_CONSTRAINTS,
+  ...PVE_CLUSTER_SDN_CONSTRAINTS,
+  ...PVE_NODES_CEPH_CONSTRAINTS,
+  ...PVE_NODES_DISKS_CONSTRAINTS,
+  ...PVE_NODES_LXC_CONSTRAINTS,
+  ...PVE_NODES_NETWORK_CONSTRAINTS,
+  ...PVE_NODES_QEMU_CONSTRAINTS,
+  ...PVE_POOLS_CONSTRAINTS,
+  ...PVE_STORAGE_CONSTRAINTS,
+  ...PBS_CONFIG_CONSTRAINTS
+};
+
+// src/proxmox/constraint-guard.ts
+var constraintsFor = (key) => {
+  const table = PROXMOX_CONSTRAINTS[key];
+  if (table === undefined) {
+    throw new Error(`no vendor constraint table for '${key}'. It is named in this package but not generated: ` + "run `bun codegen/constraints.ts` (see codegen/README.md).");
+  }
+  return table;
+};
+var formViolations = (key, form, presence) => violations(constraintsFor(key), form, { presence });
+var guardForm = (key, form, presence) => Effect5.suspend(() => {
+  if (key === undefined)
+    return Effect5.void;
+  const found = formViolations(key, form, presence);
+  return found.length === 0 ? Effect5.void : Effect5.die(new Error(refusal(key, found)));
+});
+
+// src/proxmox/resource-guard.ts
+var specGuards = (spec) => {
+  const endpointsOf = (props) => typeof spec.endpoint === "function" ? spec.endpoint(props) : spec.endpoint;
+  const guardCreate = (props, presence) => Effect6.suspend(() => {
+    const create = endpointsOf(props)?.create;
+    return create === undefined ? Effect6.void : guardForm(create, spec.createForm(props), presence);
+  });
+  const guardUpdate = (props) => Effect6.suspend(() => {
+    const update = endpointsOf(props)?.update;
+    if (update === undefined)
+      return Effect6.void;
+    const form = spec.updateForm?.(props);
+    return form === undefined ? Effect6.void : guardForm(update, form, false);
+  });
+  return { guardCreate, guardUpdate };
+};
+
 // src/proxmox/update-guard.ts
 var formToSend = (matches, live, props, form) => matches(live, props) || Object.keys(form).length === 0 ? undefined : form;
 
 // src/proxmox/resource.ts
 var pveOperations = (spec) => {
-  const read = (props) => pve(props.target, spec.readRole ?? "read", "GET", spec.path(props)).pipe(Effect5.map((data) => data == null ? undefined : spec.attributes(data, props)), Effect5.orElseSucceed(() => {
+  const { guardCreate, guardUpdate } = specGuards(spec);
+  const read = (props) => pve(props.target, spec.readRole ?? "read", "GET", spec.path(props)).pipe(Effect7.map((data) => data == null ? undefined : spec.attributes(data, props)), Effect7.orElseSucceed(() => {
     return;
   }));
   return {
+    guardCreate,
+    guardUpdate,
     read,
-    diff: (news, output) => Effect5.gen(function* () {
-      if (output === undefined || !isResolved(news))
+    diff: (news, output) => Effect7.gen(function* () {
+      if (!isResolved(news))
+        return;
+      yield* guardCreate(news, output === undefined);
+      yield* guardUpdate(news);
+      if (output === undefined)
         return;
       const live = yield* read(news);
-      if (live === undefined)
+      if (live === undefined) {
+        yield* guardCreate(news, true);
         return { action: "update" };
+      }
       if (spec.matches(live, news))
         return { action: "noop" };
       return spec.updateForm === undefined ? { action: "replace" } : { action: "update" };
     }),
-    reconcile: (news) => Effect5.gen(function* () {
+    reconcile: (news) => Effect7.gen(function* () {
       const live = yield* read(news);
+      yield* guardCreate(news, live === undefined);
+      yield* guardUpdate(news);
       if (live === undefined) {
         yield* pve(news.target, "provision", "POST", spec.collection(news), spec.createForm(news));
       } else if (spec.updateForm !== undefined) {
@@ -257,7 +1254,7 @@ var pveOperations = (spec) => {
       }
       const after = yield* read(news);
       if (after === undefined) {
-        return yield* Effect5.die(new Error(`${spec.path(news)}: the write returned no error but the object is still absent. ` + 'PVE wraps every answer in {"data":...} and can report success on a call that did ' + "nothing -- read back rather than trusting the status code."));
+        return yield* Effect7.die(new Error(`${spec.path(news)}: the write returned no error but the object is still absent. ` + 'PVE wraps every answer in {"data":...} and can report success on a call that did ' + "nothing -- read back rather than trusting the status code."));
       }
       return after;
     }),
@@ -267,7 +1264,7 @@ var pveOperations = (spec) => {
 var pveHandlers = (spec) => {
   const ops = pveOperations(spec);
   return {
-    list: () => Effect5.succeed([]),
+    list: () => Effect7.succeed([]),
     read: ({ olds }) => ops.read(olds),
     diff: ({ news, output }) => ops.diff(news, output),
     reconcile: ({ news }) => ops.reconcile(news),
@@ -309,29 +1306,30 @@ var ops = pveOperations({
   readRole: "provision",
   collection: () => "access/acl",
   createForm: bind,
+  endpoint: { create: "pve:PUT /access/acl", update: "pve:PUT /access/acl" },
   matches: (attributes, props) => attributes.bound && attributes.propagate === (props.propagate !== false),
   path: () => "access/acl",
   updateForm: bind
 });
-var ProxmoxAclProvider = () => Provider.effect(ProxmoxAcl, Effect6.succeed(ProxmoxAcl.Provider.of({
-  list: () => Effect6.succeed([]),
-  read: Effect6.fn(function* ({ olds }) {
+var ProxmoxAclProvider = () => Provider.effect(ProxmoxAcl, Effect8.succeed(ProxmoxAcl.Provider.of({
+  list: () => Effect8.succeed([]),
+  read: Effect8.fn(function* ({ olds }) {
     return yield* ops.read(olds);
   }),
-  diff: Effect6.fn(function* ({ news, output }) {
+  diff: Effect8.fn(function* ({ news, output }) {
     if (output !== undefined && isResolved2(news) && identity(news) !== identity(output)) {
       return { action: "replace" };
     }
     return yield* ops.diff(news, output);
   }),
-  reconcile: Effect6.fn(function* ({ news }) {
+  reconcile: Effect8.fn(function* ({ news }) {
     const after = yield* ops.reconcile(news);
     if (!after.bound) {
-      return yield* Effect6.die(new Error(`access/acl: the write returned no error but ${identity(news)} is still not ` + "bound. Either the PUT did nothing, or the read credential cannot see the " + "grant -- GET /access/acl is filtered to paths you may MODIFY permissions on, " + "so a read-only role is answered [] rather than 403."));
+      return yield* Effect8.die(new Error(`access/acl: the write returned no error but ${identity(news)} is still not ` + "bound. Either the PUT did nothing, or the read credential cannot see the " + "grant -- GET /access/acl is filtered to paths you may MODIFY permissions on, " + "so a read-only role is answered [] rather than 403."));
     }
     return after;
   }),
-  delete: Effect6.fn(function* ({ olds }) {
+  delete: Effect8.fn(function* ({ olds }) {
     const removal = { delete: "1", ...tuple(olds) };
     yield* pve(olds.target, "provision", "PUT", "access/acl", removal);
   })
@@ -389,7 +1387,7 @@ var alertmanagerAlertBody = (options = {}) => {
 // src/proxmox/api-token.ts
 import { Resource as Resource2 } from "alchemy";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect7 from "effect/Effect";
+import * as Effect9 from "effect/Effect";
 
 // src/proxmox/values.ts
 var num = (value, fallback) => typeof value === "number" ? value : fallback;
@@ -457,6 +1455,10 @@ var apiTokenSpec = {
   },
   collection: (props) => `access/users/${props.userid}/token/${props.tokenid}`,
   createForm: shape,
+  endpoint: {
+    create: "pve:POST /access/users/{userid}/token/{tokenid}",
+    update: "pve:PUT /access/users/{userid}/token/{tokenid}"
+  },
   matches: (attributes, props) => attributes.comment === (props.comment ?? "") && attributes.expire === props.expire && attributes.privsep === props.privsep,
   path: (props) => `access/users/${props.userid}/token/${props.tokenid}`,
   updateForm: shape
@@ -469,19 +1471,19 @@ var ProxmoxApiToken = Resource2("Proxmox.ApiToken", {
 var ops2 = pveOperations(apiTokenSpec);
 var handlers = {
   ...pveHandlers(apiTokenSpec),
-  reconcile: Effect7.fn(function* ({ news }) {
+  reconcile: Effect9.fn(function* ({ news }) {
     const live = yield* ops2.read(news);
     if (live === undefined) {
-      return yield* Effect7.die(new Error(`${news.userid}!${news.tokenid}: this resource does not create API tokens. PVE returns ` + "the secret only in the create response and it cannot be stored, so a token made here " + "would be a live credential nobody holds. Create it with `pveum user token add` and " + "capture the value, or mint a short-lived one from the OpenBao proxmox mount " + "(`bao read proxmox-c1/creds/<role>`) -- then declare it here to manage it."));
+      return yield* Effect9.die(new Error(`${news.userid}!${news.tokenid}: this resource does not create API tokens. PVE returns ` + "the secret only in the create response and it cannot be stored, so a token made here " + "would be a live credential nobody holds. Create it with `pveum user token add` and " + "capture the value, or mint a short-lived one from the OpenBao proxmox mount " + "(`bao read proxmox-c1/creds/<role>`) -- then declare it here to manage it."));
     }
     return yield* ops2.reconcile(news);
   })
 };
-var ProxmoxApiTokenProvider = () => Provider2.effect(ProxmoxApiToken, Effect7.succeed(ProxmoxApiToken.Provider.of(handlers)));
+var ProxmoxApiTokenProvider = () => Provider2.effect(ProxmoxApiToken, Effect9.succeed(ProxmoxApiToken.Provider.of(handlers)));
 // src/proxmox/backup-job.ts
 import { Resource as Resource3 } from "alchemy";
 import * as Provider3 from "alchemy/Provider";
-import * as Effect8 from "effect/Effect";
+import * as Effect10 from "effect/Effect";
 var ProxmoxBackupJob = Resource3("Proxmox.BackupJob");
 var shape2 = (props) => ({
   all: props.all === true ? "1" : "0",
@@ -520,17 +1522,23 @@ var handlers2 = pveHandlers({
   }),
   collection: () => "cluster/backup",
   createForm: (props) => ({ ...shape2(props), id: props.id }),
+  endpoint: { create: "pve:POST /cluster/backup", update: "pve:PUT /cluster/backup/{id}" },
   matches: (attributes, props) => attributes.schedule === props.schedule && attributes.enabled === (props.enabled !== false) && attributes.all === (props.all === true) && attributes.mode === (props.mode ?? "snapshot") && attributes["notification-mode"] === (props["notification-mode"] ?? "auto") && attributes["repeat-missed"] === (props["repeat-missed"] === true) && (props.storage === undefined || attributes.storage === props.storage) && (props.pool === undefined || attributes.pool === props.pool) && (props.comment === undefined || attributes.comment === props.comment) && (props.vmid === undefined || attributes.vmid === guestList(props.vmid)) && (props.exclude === undefined || attributes.exclude === guestList(props.exclude)) && (props["notes-template"] === undefined || attributes["notes-template"] === props["notes-template"]) && (props["prune-backups"] === undefined || attributes["prune-backups"] === propertyString(props["prune-backups"])) && (props.fleecing === undefined || attributes.fleecing === propertyString(props.fleecing, "enabled")),
   path: (props) => `cluster/backup/${props.id}`,
   updateForm: shape2
 });
-var ProxmoxBackupJobProvider = () => Provider3.effect(ProxmoxBackupJob, Effect8.succeed(ProxmoxBackupJob.Provider.of(handlers2)));
+var ProxmoxBackupJobProvider = () => Provider3.effect(ProxmoxBackupJob, Effect10.succeed(ProxmoxBackupJob.Provider.of(handlers2)));
 // src/proxmox/ceph-daemon.ts
 import { Resource as Resource4 } from "alchemy";
 import * as Provider4 from "alchemy/Provider";
-import * as Effect9 from "effect/Effect";
+import * as Effect11 from "effect/Effect";
 
 // src/proxmox/ceph-daemon-form.ts
+var DAEMON_ENDPOINTS = {
+  mds: { create: "pve:POST /nodes/{node}/ceph/mds/{name}" },
+  mgr: { create: "pve:POST /nodes/{node}/ceph/mgr/{id}" },
+  mon: { create: "pve:POST /nodes/{node}/ceph/mon/{monid}" }
+};
 var daemonId = (props) => props.name ?? props.node;
 var collectionPath = (props) => `nodes/${props.node}/ceph/${props.kind}`;
 var daemonPath = (props) => `${collectionPath(props)}/${daemonId(props)}`;
@@ -542,60 +1550,63 @@ var createForm = (props) => {
   return hotstandby === undefined ? {} : { hotstandby };
 };
 var findRow = (live, props) => (Array.isArray(live) ? live : []).filter((row) => typeof row === "object" && row !== null).find((row) => row["name"] === daemonId(props));
+var daemonAttributes = (live, props) => {
+  const row = findRow(live, props);
+  if (row === undefined)
+    return;
+  return {
+    addr: text(row["addr"]),
+    fsName: text(row["fs_name"]),
+    host: text(row["host"]),
+    kind: props.kind,
+    name: daemonId(props),
+    node: props.node,
+    quorum: bool(row["quorum"]),
+    rank: num(row["rank"], -1),
+    service: bool(row["service"]),
+    standbyReplay: bool(row["standby_replay"]),
+    state: text(row["state"]),
+    version: text(row["ceph_version_short"])
+  };
+};
 
 // src/proxmox/ceph-daemon.ts
 var ProxmoxCephDaemon = Resource4("Proxmox.CephDaemon", {
   defaultRemovalPolicy: "retain"
 });
 var handlers3 = pveHandlers({
-  attributes: (live, props) => {
-    const row = findRow(live, props);
-    if (row === undefined)
-      return;
-    return {
-      addr: text(row["addr"]),
-      fsName: text(row["fs_name"]),
-      host: text(row["host"]),
-      kind: props.kind,
-      name: daemonId(props),
-      node: props.node,
-      quorum: bool(row["quorum"]),
-      rank: num(row["rank"], -1),
-      service: bool(row["service"]),
-      standbyReplay: bool(row["standby_replay"]),
-      state: text(row["state"]),
-      version: text(row["ceph_version_short"])
-    };
-  },
+  attributes: daemonAttributes,
   collection: daemonPath,
   createForm,
+  endpoint: (props) => DAEMON_ENDPOINTS[props.kind],
   matches: () => true,
   path: collectionPath
 });
-var ProxmoxCephDaemonProvider = () => Provider4.effect(ProxmoxCephDaemon, Effect9.succeed(ProxmoxCephDaemon.Provider.of({
+var ProxmoxCephDaemonProvider = () => Provider4.effect(ProxmoxCephDaemon, Effect11.succeed(ProxmoxCephDaemon.Provider.of({
   ...handlers3,
   delete: ({ olds }) => pve(olds.target, "provision", "DELETE", daemonPath(olds))
 })));
 // src/proxmox/ceph-flag.ts
 import { Resource as Resource5 } from "alchemy";
 import * as Provider5 from "alchemy/Provider";
-import * as Effect10 from "effect/Effect";
+import * as Effect12 from "effect/Effect";
 var ProxmoxCephFlag = Resource5("Proxmox.CephFlag");
 var handlers4 = pveHandlers({
   attributes: (live, props) => ({ flag: props.flag, value: bool(live) }),
   collection: () => "cluster/ceph/flags",
   createForm: (props) => ({ [props.flag]: flag(props.value) ?? "0" }),
+  endpoint: { update: "pve:PUT /cluster/ceph/flags/{flag}" },
   matches: (attributes, props) => attributes.value === props.value,
   path: (props) => `cluster/ceph/flags/${props.flag}`,
   updateForm: (props) => ({ value: flag(props.value) ?? "0" })
 });
-var ProxmoxCephFlagProvider = () => Provider5.effect(ProxmoxCephFlag, Effect10.succeed(ProxmoxCephFlag.Provider.of({
+var ProxmoxCephFlagProvider = () => Provider5.effect(ProxmoxCephFlag, Effect12.succeed(ProxmoxCephFlag.Provider.of({
   ...handlers4,
-  delete: () => Effect10.void,
-  reconcile: Effect10.fn(function* ({ news }) {
+  delete: () => Effect12.void,
+  reconcile: Effect12.fn(function* ({ news }) {
     const after = yield* handlers4.reconcile({ news });
     if (after.value !== news.value) {
-      return yield* Effect10.die(new Error(`cluster/ceph/flags/${news.flag}: the PUT returned no error but ceph still ` + `reports the flag ${after.value ? "set" : "clear"} rather than ` + `${news.value ? "set" : "clear"}. This endpoint's success is documented as a ` + "null body, so the status code proves nothing -- check `ceph osd dump | " + "head -1` and the cluster log. `pause` in particular is two ceph flags read " + "as one; see the header."));
+      return yield* Effect12.die(new Error(`cluster/ceph/flags/${news.flag}: the PUT returned no error but ceph still ` + `reports the flag ${after.value ? "set" : "clear"} rather than ` + `${news.value ? "set" : "clear"}. This endpoint's success is documented as a ` + "null body, so the status code proves nothing -- check `ceph osd dump | " + "head -1` and the cluster log. `pause` in particular is two ceph flags read " + "as one; see the header."));
     }
     return after;
   })
@@ -604,10 +1615,10 @@ var ProxmoxCephFlagProvider = () => Provider5.effect(ProxmoxCephFlag, Effect10.s
 import { Resource as Resource6 } from "alchemy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 import * as Provider6 from "alchemy/Provider";
-import * as Effect12 from "effect/Effect";
+import * as Effect14 from "effect/Effect";
 
 // src/proxmox/ceph-fs-wire.ts
-import * as Effect11 from "effect/Effect";
+import * as Effect13 from "effect/Effect";
 var readRow = (live, props) => {
   const row = (Array.isArray(live) ? live : []).filter((entry) => typeof entry === "object" && entry !== null).find((entry) => entry["name"] === props.name);
   if (row === undefined)
@@ -635,29 +1646,29 @@ var destroyPath = (props) => {
   ].filter((part) => part !== undefined);
   return query.length === 0 ? objectPath(props) : `${objectPath(props)}?${query.join("&")}`;
 };
-var settle = (target, node, upid, what) => Effect11.gen(function* () {
+var settle = (target, node, upid, what) => Effect13.gen(function* () {
   for (let attempt = 0;attempt < POLL_ATTEMPTS; attempt += 1) {
-    const status = yield* pve(target, "read", "GET", `nodes/${node}/tasks/${encodeURIComponent(upid)}/status`).pipe(Effect11.orElseSucceed(() => {
+    const status = yield* pve(target, "read", "GET", `nodes/${node}/tasks/${encodeURIComponent(upid)}/status`).pipe(Effect13.orElseSucceed(() => {
       return;
     }));
     if (status?.status === "stopped") {
       const exit = text(status.exitstatus);
       if (exit === "OK")
         return;
-      return yield* Effect11.die(new Error(`${what}: PVE task ${upid} finished with "${exit === "" ? "no exit status" : exit}". ` + "The write returned HTTP 200 because it only forked the worker -- the real error is " + `in \`pvesh get /nodes/${node}/tasks/${upid}/log\`.`));
+      return yield* Effect13.die(new Error(`${what}: PVE task ${upid} finished with "${exit === "" ? "no exit status" : exit}". ` + "The write returned HTTP 200 because it only forked the worker -- the real error is " + `in \`pvesh get /nodes/${node}/tasks/${upid}/log\`.`));
     }
-    yield* Effect11.sleep(POLL_SECONDS * 1000);
+    yield* Effect13.sleep(POLL_SECONDS * 1000);
   }
-  return yield* Effect11.die(new Error(`${what}: PVE task ${upid} was still running after ` + `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its ` + "status could not be read. Check the task log, and check that the `read` role holds " + `Sys.Audit on /nodes/${node} -- each call mints a new token, so the poller is never the ` + "task owner and is answered 403 rather than told to wait."));
+  return yield* Effect13.die(new Error(`${what}: PVE task ${upid} was still running after ` + `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its ` + "status could not be read. Check the task log, and check that the `read` role holds " + `Sys.Audit on /nodes/${node} -- each call mints a new token, so the poller is never the ` + "task owner and is answered 403 rather than told to wait."));
 });
-var createFs = (props) => Effect11.gen(function* () {
+var createFs = (props) => Effect13.gen(function* () {
   const upid = text(yield* pve(props.target, "provision", "POST", objectPath(props), createForm2(props)));
   if (upid === "") {
-    return yield* Effect11.die(new Error(`${objectPath(props)}: POST returned no task id. PVE wraps every answer in ` + '{"data":...} and can report success on a call that did nothing.'));
+    return yield* Effect13.die(new Error(`${objectPath(props)}: POST returned no task id. PVE wraps every answer in ` + '{"data":...} and can report success on a call that did nothing.'));
   }
   yield* settle(props.target, props.node, upid, objectPath(props));
 });
-var destroyFs = (props) => Effect11.gen(function* () {
+var destroyFs = (props) => Effect13.gen(function* () {
   const upid = text(yield* pve(props.target, "provision", "DELETE", destroyPath(props)));
   if (upid !== "")
     yield* settle(props.target, props.node, upid, destroyPath(props));
@@ -673,47 +1684,48 @@ var ops3 = pveOperations({
   attributes: readRow,
   collection: objectPath,
   createForm: createForm2,
+  endpoint: { create: "pve:POST /nodes/{node}/ceph/fs/{name}" },
   matches: () => true,
   path: (props) => `nodes/${props.node}/ceph/fs`
 });
-var ProxmoxCephFsProvider = () => Provider6.effect(ProxmoxCephFs, Effect12.succeed(ProxmoxCephFs.Provider.of({
-  list: () => Effect12.succeed([]),
-  read: Effect12.fn(function* ({ olds }) {
+var ProxmoxCephFsProvider = () => Provider6.effect(ProxmoxCephFs, Effect14.succeed(ProxmoxCephFs.Provider.of({
+  list: () => Effect14.succeed([]),
+  read: Effect14.fn(function* ({ olds }) {
     return yield* ops3.read(olds);
   }),
-  diff: Effect12.fn(function* ({ news, output }) {
+  diff: Effect14.fn(function* ({ news, output }) {
     if (output !== undefined && isResolved3(news) && news.name !== output.name) {
       return { action: "replace" };
     }
     return yield* ops3.diff(news, output);
   }),
-  reconcile: Effect12.fn(function* ({ news }) {
+  reconcile: Effect14.fn(function* ({ news }) {
     const live = yield* ops3.read(news);
     if (live !== undefined)
       return live;
     yield* createFs(news);
     const after = yield* ops3.read(news);
     if (after === undefined)
-      return yield* Effect12.die(notCreated(news));
+      return yield* Effect14.die(notCreated(news));
     return after;
   }),
-  delete: Effect12.fn(function* ({ olds }) {
+  delete: Effect14.fn(function* ({ olds }) {
     if ((yield* ops3.read(olds)) === undefined)
       return;
     yield* destroyFs(olds);
     const after = yield* ops3.read(olds);
     if (after !== undefined)
-      return yield* Effect12.die(notDestroyed(olds));
+      return yield* Effect14.die(notDestroyed(olds));
   })
 })));
 // src/proxmox/ceph-osd.ts
 import { Resource as Resource7 } from "alchemy";
 import { isResolved as isResolved4 } from "alchemy/Diff";
 import * as Provider7 from "alchemy/Provider";
-import * as Effect15 from "effect/Effect";
+import * as Effect17 from "effect/Effect";
 
 // src/proxmox/ceph-osd-tree.ts
-import * as Effect13 from "effect/Effect";
+import * as Effect15 from "effect/Effect";
 var branches = (node) => (Array.isArray(node["children"]) ? node["children"] : []).filter((child) => typeof child === "object" && child !== null);
 var osdLeaves = (tree) => {
   const root = tree["root"];
@@ -739,25 +1751,29 @@ var osdAttributes = (leaf, props) => ({
   status: text(leaf["status"]),
   total_space: num(leaf["total_space"], 0)
 });
-var readOsd = (props) => pve(props.target, "read", "GET", `nodes/${props.node}/ceph/osd`).pipe(Effect13.map((t) => {
+var readOsd = (props) => pve(props.target, "read", "GET", `nodes/${props.node}/ceph/osd`).pipe(Effect15.map((t) => {
   const leaf = t === undefined ? undefined : findOsd(t, props.osdid);
   return leaf === undefined ? undefined : osdAttributes(leaf, props);
 }));
 
 // src/proxmox/ceph-osd-write.ts
-import * as Effect14 from "effect/Effect";
+import * as Effect16 from "effect/Effect";
+var OSD_CREATE_ENDPOINT = "pve:POST /nodes/{node}/ceph/osd";
 var describe = (props) => `osd.${String(props.osdid)} on ${props.node}`;
-var createOsd = Effect14.fn(function* (news) {
+var createOsdForm = (props, dev) => ({
+  dev,
+  ...props.device_class === undefined ? {} : { "crush-device-class": props.device_class }
+});
+var createOsd = Effect16.fn(function* (news) {
   if (news.dev === undefined) {
-    return yield* Effect14.die(new Error(`${describe(news)}: no such OSD in the CRUSH tree, and no \`dev\` was declared. ` + "Without a device this resource is an ASSERTION over an OSD that must already " + "exist. Declare `dev` to let it create one -- which WIPES that device -- or fix " + "the declaration; if the disk was there yesterday, a replica is missing and Ceph " + "is degraded."));
+    return yield* Effect16.die(new Error(`${describe(news)}: no such OSD in the CRUSH tree, and no \`dev\` was declared. ` + "Without a device this resource is an ASSERTION over an OSD that must already " + "exist. Declare `dev` to let it create one -- which WIPES that device -- or fix " + "the declaration; if the disk was there yesterday, a replica is missing and Ceph " + "is degraded."));
   }
-  yield* pve(news.target, "provision", "POST", `nodes/${news.node}/ceph/osd`, {
-    dev: news.dev,
-    ...news.device_class === undefined ? {} : { "crush-device-class": news.device_class }
-  });
+  const form = createOsdForm(news, news.dev);
+  yield* guardForm(OSD_CREATE_ENDPOINT, form, true);
+  yield* pve(news.target, "provision", "POST", `nodes/${news.node}/ceph/osd`, form);
   const created = yield* readOsd(news);
   if (created === undefined) {
-    return yield* Effect14.die(new Error(`${describe(news)}: the create returned no error but osd.${String(news.osdid)} is ` + "still absent. Ceph allocates OSD ids and cannot be told which to use, so it most " + "likely assigned a different number -- check `ceph osd tree`, and declare the id it " + "actually gave the device rather than deploying again."));
+    return yield* Effect16.die(new Error(`${describe(news)}: the create returned no error but osd.${String(news.osdid)} is ` + "still absent. Ceph allocates OSD ids and cannot be told which to use, so it most " + "likely assigned a different number -- check `ceph osd tree`, and declare the id it " + "actually gave the device rather than deploying again."));
   }
   return created;
 });
@@ -770,11 +1786,11 @@ var ProxmoxCephOsd = Resource7("Proxmox.CephOsd", {
 var settled = (live, props) => (props.host === undefined || props.host === live.host) && (props.device_class === undefined || props.device_class === live.device_class);
 var describe2 = (props) => `osd.${String(props.osdid)} (read via nodes/${props.node}/ceph/osd)`;
 var handlers5 = {
-  list: () => Effect15.succeed([]),
-  read: Effect15.fn(function* ({ olds }) {
+  list: () => Effect17.succeed([]),
+  read: Effect17.fn(function* ({ olds }) {
     return yield* readOsd(olds);
   }),
-  diff: Effect15.fn(function* ({
+  diff: Effect17.fn(function* ({
     news,
     output
   }) {
@@ -787,25 +1803,25 @@ var handlers5 = {
       return { action: "update" };
     return settled(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect15.fn(function* ({ news }) {
+  reconcile: Effect17.fn(function* ({ news }) {
     const live = yield* readOsd(news);
     if (live === undefined) {
       return yield* createOsd(news);
     }
     if (!settled(live, news)) {
-      return yield* Effect15.die(new Error(`${describe2(news)}: exists but not as declared -- live host=${live.host} ` + `device_class=${live.device_class}. Nothing here moves an OSD between hosts or ` + "reclassifies it; fix the declaration, or move it deliberately with `ceph osd crush " + "move` / `ceph osd crush set-device-class` and deploy again."));
+      return yield* Effect17.die(new Error(`${describe2(news)}: exists but not as declared -- live host=${live.host} ` + `device_class=${live.device_class}. Nothing here moves an OSD between hosts or ` + "reclassifies it; fix the declaration, or move it deliberately with `ceph osd crush " + "move` / `ceph osd crush set-device-class` and deploy again."));
     }
     return live;
   }),
-  delete: Effect15.fn(function* ({ olds }) {
+  delete: Effect17.fn(function* ({ olds }) {
     yield* destroyOsd(olds);
   })
 };
-var ProxmoxCephOsdProvider = () => Provider7.effect(ProxmoxCephOsd, Effect15.succeed(ProxmoxCephOsd.Provider.of(handlers5)));
+var ProxmoxCephOsdProvider = () => Provider7.effect(ProxmoxCephOsd, Effect17.succeed(ProxmoxCephOsd.Provider.of(handlers5)));
 // src/proxmox/ceph-pool.ts
 import { Resource as Resource8 } from "alchemy";
 import * as Provider8 from "alchemy/Provider";
-import * as Effect17 from "effect/Effect";
+import * as Effect19 from "effect/Effect";
 
 // src/proxmox/ceph-pool-form.ts
 var object = (props) => `nodes/${props.node}/ceph/pool/${props.name}`;
@@ -834,14 +1850,14 @@ var createBody = (props) => ({
 });
 
 // src/proxmox/ceph-pool-settle.ts
-import * as Effect16 from "effect/Effect";
-var confirmAbsent = (props, collection2, describe3) => pve(props.target, "read", "GET", collection2).pipe(Effect16.flatMap((rows) => (rows ?? []).some((row) => row.pool_name === props.name) ? Effect16.die(new Error(`${describe3}: the cluster lists this pool but its status could not be read, ` + "so this deploy will NOT create over it. Check that the node is up and that the " + "read role holds Sys.Audit or Datastore.Audit on / -- a create here would apply " + "pg_num to a live pool and start a PG merge.")) : Effect16.void));
-var settle2 = (props, read, done) => Effect16.gen(function* () {
+import * as Effect18 from "effect/Effect";
+var confirmAbsent = (props, collection2, describe3) => pve(props.target, "read", "GET", collection2).pipe(Effect18.flatMap((rows) => (rows ?? []).some((row) => row.pool_name === props.name) ? Effect18.die(new Error(`${describe3}: the cluster lists this pool but its status could not be read, ` + "so this deploy will NOT create over it. Check that the node is up and that the " + "read role holds Sys.Audit or Datastore.Audit on / -- a create here would apply " + "pg_num to a live pool and start a PG merge.")) : Effect18.void));
+var settle2 = (props, read, done) => Effect18.gen(function* () {
   for (let attempt = 0;attempt < 30; attempt += 1) {
     const live = yield* read(props);
     if (done(live))
       return live;
-    yield* Effect16.sleep("2 seconds");
+    yield* Effect18.sleep("2 seconds");
   }
   return yield* read(props);
 });
@@ -874,38 +1890,44 @@ var spec = {
   },
   collection,
   createForm: createBody,
+  endpoint: {
+    create: "pve:POST /nodes/{node}/ceph/pool",
+    update: "pve:PUT /nodes/{node}/ceph/pool/{name}"
+  },
   matches: (attributes, props) => same(props.size, attributes.size, attributes.nosizechange) && same(props.min_size, attributes.min_size, attributes.nosizechange) && same(props.pg_autoscale_mode, attributes.pg_autoscale_mode) && same(hint(props.pg_num_min), attributes.pg_num_min, attributes.nopgchange) && same(props.crush_rule, attributes.crush_rule, attributes.crush_rule === "") && same(hint(props.target_size), attributes.target_size),
   path: (props) => `${object(props)}/status?verbose=1`,
   updateForm: updateBody
 };
 var ops4 = pveOperations(spec);
-var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect17.succeed(ProxmoxCephPool.Provider.of({
-  list: () => Effect17.succeed([]),
+var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect19.succeed(ProxmoxCephPool.Provider.of({
+  list: () => Effect19.succeed([]),
   read: ({ olds }) => ops4.read(olds),
   diff: ({ news, output }) => ops4.diff(news, output),
-  reconcile: Effect17.fn(function* ({ news }) {
+  reconcile: Effect19.fn(function* ({ news }) {
     const live = yield* ops4.read(news);
     let upid;
     if (live === undefined) {
+      yield* ops4.guardCreate(news, true);
       yield* confirmAbsent(news, spec.collection(news), object(news));
       upid = yield* pve(news.target, "provision", "POST", collection(news), createBody(news));
     } else {
       const form = formToSend(spec.matches, live, news, updateBody(news));
       if (form !== undefined) {
+        yield* ops4.guardUpdate(news);
         upid = yield* pve(news.target, "provision", "PUT", object(news), form);
       }
     }
     const after = yield* settle2(news, ops4.read, (row) => row !== undefined && spec.matches(row, news));
     if (after === undefined || !spec.matches(after, news)) {
-      return yield* Effect17.die(new Error(`${object(news)}: the write returned no error but the pool still does not match ` + `the declaration after 60s. PVE answered with task ${upid ?? "(none)"} -- read ` + "its log with `pvesh get /nodes/<node>/tasks/<upid>/log` to see what Ceph " + "refused."));
+      return yield* Effect19.die(new Error(`${object(news)}: the write returned no error but the pool still does not match ` + `the declaration after 60s. PVE answered with task ${upid ?? "(none)"} -- read ` + "its log with `pvesh get /nodes/<node>/tasks/<upid>/log` to see what Ceph " + "refused."));
     }
     return after;
   }),
-  delete: Effect17.fn(function* ({ olds }) {
+  delete: Effect19.fn(function* ({ olds }) {
     yield* pve(olds.target, "provision", "DELETE", object(olds));
     const left = yield* settle2(olds, ops4.read, (row) => row === undefined);
     if (left !== undefined) {
-      return yield* Effect17.die(new Error(`${object(olds)}: the DELETE returned no error but the pool is still there after ` + "60s. Either a storage on it still holds RBD images, or the mons are running " + "with mon_allow_pool_delete false."));
+      return yield* Effect19.die(new Error(`${object(olds)}: the DELETE returned no error but the pool is still there after ` + "60s. Either a storage on it still holds RBD images, or the mons are running " + "with mon_allow_pool_delete false."));
     }
   })
 })));
@@ -913,7 +1935,7 @@ var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect17.s
 import { Resource as Resource9 } from "alchemy";
 import { isResolved as isResolved5 } from "alchemy/Diff";
 import * as Provider9 from "alchemy/Provider";
-import * as Effect18 from "effect/Effect";
+import * as Effect20 from "effect/Effect";
 
 // src/proxmox/firewall-alias-form.ts
 var fold = (name) => name.trim().toLowerCase();
@@ -945,13 +1967,17 @@ var handlers6 = pveHandlers({
   },
   collection: () => "cluster/firewall/aliases",
   createForm: (props) => ({ ...body(props), name: props.name }),
+  endpoint: {
+    create: "pve:POST /cluster/firewall/aliases",
+    update: "pve:PUT /cluster/firewall/aliases/{name}"
+  },
   matches: (attributes, props) => attributes.cidr === cidr(props.cidr) && attributes.comment === comment(props.comment),
   path: (props) => `cluster/firewall/aliases/${props.name}`,
   updateForm: body
 });
-var ProxmoxFirewallAliasProvider = () => Provider9.effect(ProxmoxFirewallAlias, Effect18.succeed(ProxmoxFirewallAlias.Provider.of({
+var ProxmoxFirewallAliasProvider = () => Provider9.effect(ProxmoxFirewallAlias, Effect20.succeed(ProxmoxFirewallAlias.Provider.of({
   ...handlers6,
-  diff: Effect18.fn(function* ({ news, output }) {
+  diff: Effect20.fn(function* ({ news, output }) {
     if (output !== undefined && isResolved5(news) && fold(news.name) !== fold(output.name)) {
       return { action: "replace" };
     }
@@ -961,7 +1987,7 @@ var ProxmoxFirewallAliasProvider = () => Provider9.effect(ProxmoxFirewallAlias,
 // src/proxmox/group.ts
 import { Resource as Resource10 } from "alchemy";
 import * as Provider10 from "alchemy/Provider";
-import * as Effect19 from "effect/Effect";
+import * as Effect21 from "effect/Effect";
 var ProxmoxGroup = Resource10("Proxmox.Group", {
   defaultRemovalPolicy: "retain"
 });
@@ -981,15 +2007,16 @@ var handlers7 = pveHandlers({
   }),
   collection: () => "access/groups",
   createForm: (props) => ({ comment: storedComment(props.comment), groupid: props.groupid }),
+  endpoint: { create: "pve:POST /access/groups", update: "pve:PUT /access/groups/{groupid}" },
   matches: (attributes, props) => attributes.comment === storedComment(props.comment),
   path: (props) => `access/groups/${props.groupid}`,
   updateForm: (props) => ({ comment: storedComment(props.comment) })
 });
-var ProxmoxGroupProvider = () => Provider10.effect(ProxmoxGroup, Effect19.succeed(ProxmoxGroup.Provider.of(handlers7)));
+var ProxmoxGroupProvider = () => Provider10.effect(ProxmoxGroup, Effect21.succeed(ProxmoxGroup.Provider.of(handlers7)));
 // src/proxmox/ha-resource.ts
 import { Resource as Resource11 } from "alchemy";
 import * as Provider11 from "alchemy/Provider";
-import * as Effect20 from "effect/Effect";
+import * as Effect22 from "effect/Effect";
 var ProxmoxHaResource = Resource11("Proxmox.HaResource");
 var kind = (sid) => sid.split(":")[0] ?? "";
 var shape3 = (props) => ({
@@ -1009,15 +2036,19 @@ var handlers8 = pveHandlers({
   }),
   collection: () => "cluster/ha/resources",
   createForm: (props) => ({ ...shape3(props), sid: props.sid }),
+  endpoint: {
+    create: "pve:POST /cluster/ha/resources",
+    update: "pve:PUT /cluster/ha/resources/{sid}"
+  },
   matches: (attributes, props) => attributes.state === (props.state ?? "started") && attributes.comment === (props.comment ?? "") && attributes.max_restart === (props.max_restart ?? 1) && attributes.max_relocate === (props.max_relocate ?? 1),
   path: (props) => `cluster/ha/resources/${props.sid}`,
   updateForm: shape3
 });
-var ProxmoxHaResourceProvider = () => Provider11.effect(ProxmoxHaResource, Effect20.succeed(ProxmoxHaResource.Provider.of(handlers8)));
+var ProxmoxHaResourceProvider = () => Provider11.effect(ProxmoxHaResource, Effect22.succeed(ProxmoxHaResource.Provider.of(handlers8)));
 // src/proxmox/ha-rule.ts
 import { Resource as Resource12 } from "alchemy";
 import * as Provider12 from "alchemy/Provider";
-import * as Effect21 from "effect/Effect";
+import * as Effect23 from "effect/Effect";
 
 // src/proxmox/ha-rule-form.ts
 var nodeList = (value) => {
@@ -1085,6 +2116,7 @@ var handlers9 = pveHandlers({
   },
   collection: () => "cluster/ha/rules",
   createForm: (props) => ({ ...body2(props), rule: props.rule }),
+  endpoint: { create: "pve:POST /cluster/ha/rules", update: "pve:PUT /cluster/ha/rules/{rule}" },
   matches: (attributes, props) => attributes.resources === csv(props.resources) && attributes.affinity === props.affinity && attributes.comment === commentText(props.comment ?? "") && attributes.disable === (props.disable === true) && (props.type !== "node-affinity" || attributes.nodes === nodeList(props.nodes) && attributes.strict === (props.strict === true)),
   path: (props) => `cluster/ha/rules/${props.rule}`,
   updateForm: (props) => {
@@ -1093,43 +2125,43 @@ var handlers9 = pveHandlers({
     return withClears(fields, clear);
   }
 });
-var ProxmoxHaRuleProvider = () => Provider12.effect(ProxmoxHaRule, Effect21.succeed(ProxmoxHaRule.Provider.of(handlers9)));
+var ProxmoxHaRuleProvider = () => Provider12.effect(ProxmoxHaRule, Effect23.succeed(ProxmoxHaRule.Provider.of(handlers9)));
 // src/proxmox/lxc.ts
 import { Resource as Resource13 } from "alchemy";
 import { isResolved as isResolved6 } from "alchemy/Diff";
 import * as Provider13 from "alchemy/Provider";
-import * as Effect31 from "effect/Effect";
+import * as Effect33 from "effect/Effect";
 
 // src/ownership/adopt.ts
 import { AdoptPolicy } from "alchemy/AdoptPolicy";
 import { AlchemyContext } from "alchemy/AlchemyContext";
 import { Stack as Stack3 } from "alchemy/Stack";
-import * as Effect25 from "effect/Effect";
+import * as Effect27 from "effect/Effect";
 import * as Option5 from "effect/Option";
 
 // src/ownership/resume.ts
 import { Unowned } from "alchemy/AdoptPolicy";
 import { Artifacts } from "alchemy/Artifacts";
-import * as Effect22 from "effect/Effect";
+import * as Effect24 from "effect/Effect";
 import * as Option2 from "effect/Option";
 var PROVEN = "homeflare/ownership/resumes";
 var UNFINISHED = "homeflare/ownership/unfinished";
-var note = (key, instanceId) => Effect22.gen(function* () {
-  const bag = yield* Effect22.serviceOption(Artifacts);
+var note = (key, instanceId) => Effect24.gen(function* () {
+  const bag = yield* Effect24.serviceOption(Artifacts);
   if (Option2.isSome(bag))
     yield* bag.value.set(key, instanceId);
 });
-var noted = (key, instanceId) => Effect22.gen(function* () {
-  const bag = yield* Effect22.serviceOption(Artifacts);
+var noted = (key, instanceId) => Effect24.gen(function* () {
+  const bag = yield* Effect24.serviceOption(Artifacts);
   if (Option2.isNone(bag))
     return false;
   return (yield* bag.value.get(key)) === instanceId;
 });
-var noteUnfinished = (instanceId) => Effect22.as(note(UNFINISHED, instanceId), undefined);
-var noteResume = (instanceId, recovered) => Effect22.gen(function* () {
+var noteUnfinished = (instanceId) => Effect24.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect24.gen(function* () {
   yield* noteUnfinished(instanceId);
-  const unproven = () => Effect22.succeed(undefined);
-  const found = yield* recovered.pipe(Effect22.catch(unproven), Effect22.catchDefect(unproven));
+  const unproven = () => Effect24.succeed(undefined);
+  const found = yield* recovered.pipe(Effect24.catch(unproven), Effect24.catchDefect(unproven));
   if (found === undefined || found === null || Unowned.is(found))
     return;
   yield* note(PROVEN, instanceId);
@@ -1140,7 +2172,7 @@ var provingResumes = (service) => {
   const { diff, read } = service;
   if (diff === undefined || read === undefined)
     return service;
-  const proving = (input) => Effect22.gen(function* () {
+  const proving = (input) => Effect24.gen(function* () {
     if (input.output === undefined) {
       yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
     }
@@ -1152,12 +2184,12 @@ var provingResumes = (service) => {
 // src/ownership/rows.ts
 import { Stack as Stack2 } from "alchemy/Stack";
 import { State, isActionState } from "alchemy/State/State";
-import * as Effect24 from "effect/Effect";
+import * as Effect26 from "effect/Effect";
 import * as Option4 from "effect/Option";
 
 // src/ownership/whole.ts
 import { Stack } from "alchemy/Stack";
-import * as Effect23 from "effect/Effect";
+import * as Effect25 from "effect/Effect";
 import * as Option3 from "effect/Option";
 var absent = (value) => value === undefined || value === null;
 var isPlainObject = (value) => {
@@ -1183,22 +2215,22 @@ var carries = (declared, recorded) => {
   }
   return true;
 };
-var wholeDeclaration = (fqn, props) => Effect23.map(Effect23.serviceOption(Stack), (stack) => {
+var wholeDeclaration = (fqn, props) => Effect25.map(Effect25.serviceOption(Stack), (stack) => {
   const declared = Option3.isSome(stack) ? stack.value.resources[fqn] : undefined;
   return declared !== undefined && carries(declared.Props, props);
 });
 
 // src/ownership/rows.ts
-var storeOf = Effect24.gen(function* () {
-  const stack = yield* Effect24.serviceOption(Stack2);
-  const state = yield* Effect24.serviceOption(State);
+var storeOf = Effect26.gen(function* () {
+  const stack = yield* Effect26.serviceOption(Stack2);
+  const state = yield* Effect26.serviceOption(State);
   if (Option4.isNone(stack) || Option4.isNone(state))
     return;
   const store = yield* state.value;
   const where = { stack: stack.value.name, stage: stack.value.stage };
   return { resources: stack.value.resources, store, where };
 });
-var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect24.orElseSucceed(() => {
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect26.orElseSucceed(() => {
   return;
 }));
 var generationOf = (row, instanceId) => {
@@ -1211,7 +2243,7 @@ var generationOf = (row, instanceId) => {
   }
   return;
 };
-var recordedGeneration = (fqn, instanceId) => Effect24.gen(function* () {
+var recordedGeneration = (fqn, instanceId) => Effect26.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return;
@@ -1222,14 +2254,14 @@ var recordedGeneration = (fqn, instanceId) => Effect24.gen(function* () {
   }
   return;
 });
-var recordedInstance = (fqn, instanceId) => Effect24.gen(function* () {
+var recordedInstance = (fqn, instanceId) => Effect26.gen(function* () {
   const generation = yield* recordedGeneration(fqn, instanceId);
   if (generation === undefined)
     return "absent";
   return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
 });
-var isCreate = (fqn, instanceId) => Effect24.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
-var forgetRefusedCreate = (fqn, instanceId) => Effect24.gen(function* () {
+var isCreate = (fqn, instanceId) => Effect26.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var forgetRefusedCreate = (fqn, instanceId) => Effect26.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return;
@@ -1238,32 +2270,32 @@ var forgetRefusedCreate = (fqn, instanceId) => Effect24.gen(function* () {
   if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
     return;
   }
-  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect24.ignore);
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect26.ignore);
 });
 
 // src/ownership/adopt.ts
-var adoptEnabled = (fqn) => Effect25.gen(function* () {
-  const stack = yield* Effect25.serviceOption(Stack3);
+var adoptEnabled = (fqn) => Effect27.gen(function* () {
+  const stack = yield* Effect27.serviceOption(Stack3);
   const scoped = Option5.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
   if (scoped !== undefined)
     return scoped;
-  const policy = yield* Effect25.serviceOption(AdoptPolicy);
+  const policy = yield* Effect27.serviceOption(AdoptPolicy);
   if (Option5.isSome(policy))
     return policy.value;
-  const context = yield* Effect25.serviceOption(AlchemyContext);
+  const context = yield* Effect27.serviceOption(AlchemyContext);
   return Option5.isSome(context) ? context.value.adopt : false;
 });
-var adoptable = (owner) => Effect25.gen(function* () {
+var adoptable = (owner) => Effect27.gen(function* () {
   if (yield* isCreate(owner.fqn, owner.instanceId))
     return true;
   return yield* unfinished(owner.instanceId);
 });
-var adoptsAtApply = (owner) => Effect25.gen(function* () {
+var adoptsAtApply = (owner) => Effect27.gen(function* () {
   if (!(yield* adoptEnabled(owner.fqn)))
     return false;
   return yield* adoptable(owner);
 });
-var refuseTakeover = (owner, what) => Effect25.gen(function* () {
+var refuseTakeover = (owner, what) => Effect27.gen(function* () {
   if (owner.output !== undefined)
     return;
   if (yield* resumes(owner.instanceId))
@@ -1273,25 +2305,25 @@ var refuseTakeover = (owner, what) => Effect25.gen(function* () {
     return;
   yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
   const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
-  return yield* Effect25.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+  return yield* Effect27.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
 });
 var claimFor = (owner) => (what) => refuseTakeover(owner, what);
 
 // src/ownership/probe.ts
 import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
-import * as Effect26 from "effect/Effect";
-var provenOurs = (ask, settled2) => Effect26.gen(function* () {
+import * as Effect28 from "effect/Effect";
+var provenOurs = (ask, settled2) => Effect28.gen(function* () {
   const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
   if (recorded === "absent")
     return false;
   if (recorded === "partial") {
-    yield* Effect26.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
+    yield* Effect28.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
     return false;
   }
-  const unproven = (reason) => Effect26.as(Effect26.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
-  return yield* settled2.pipe(Effect26.catch(unproven), Effect26.catchDefect(unproven));
+  const unproven = (reason) => Effect28.as(Effect28.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
+  return yield* settled2.pipe(Effect28.catch(unproven), Effect28.catchDefect(unproven));
 });
-var ownedRead = (ask, found, settled2) => Effect26.gen(function* () {
+var ownedRead = (ask, found, settled2) => Effect28.gen(function* () {
   if (found === undefined || ask.output !== undefined)
     return found;
   return (yield* provenOurs(ask, settled2)) ? found : Unowned2(found);
@@ -1746,11 +2778,11 @@ var identityRefusals = (news, olds, output) => {
 };
 
 // src/proxmox/lxc-adoption.ts
-import * as Effect30 from "effect/Effect";
+import * as Effect32 from "effect/Effect";
 
 // src/ownership/adopting.ts
-import * as Effect27 from "effect/Effect";
-var adopting = (owner, settled2) => Effect27.gen(function* () {
+import * as Effect29 from "effect/Effect";
+var adopting = (owner, settled2) => Effect29.gen(function* () {
   if (owner.output === undefined)
     return false;
   const generation = yield* recordedGeneration(owner.fqn, owner.instanceId);
@@ -1762,11 +2794,11 @@ var adopting = (owner, settled2) => Effect27.gen(function* () {
 });
 
 // src/proxmox/lxc-lifecycle.ts
-import * as Effect29 from "effect/Effect";
+import * as Effect31 from "effect/Effect";
 
 // src/proxmox/network-apply-read.ts
-import * as Effect28 from "effect/Effect";
-var stagedDiff = (target, node) => Effect28.gen(function* () {
+import * as Effect30 from "effect/Effect";
+var stagedDiff = (target, node) => Effect30.gen(function* () {
   const path = `nodes/${node}/network`;
   const credential = yield* leased(target, "read");
   const envelope = yield* pveEnvelopeWith(target, credential, "GET", path);
@@ -1779,8 +2811,8 @@ var pendingLines = (diff) => {
 `).filter((line) => (line.startsWith("+") || line.startsWith("-")) && !line.startsWith("+++") && !line.startsWith("---")).length;
   return Math.max(changed, 1);
 };
-var pendingCount = (target, node) => stagedDiff(target, node).pipe(Effect28.map(pendingLines));
-var clusterHealth = (target) => pve(target, "read", "GET", "cluster/status").pipe(Effect28.map((rows) => {
+var pendingCount = (target, node) => stagedDiff(target, node).pipe(Effect30.map(pendingLines));
+var clusterHealth = (target) => pve(target, "read", "GET", "cluster/status").pipe(Effect30.map((rows) => {
   const all = rows ?? [];
   const cluster = all.find((row) => row.type === "cluster");
   return {
@@ -1788,21 +2820,21 @@ var clusterHealth = (target) => pve(target, "read", "GET", "cluster/status").pip
     quorate: cluster === undefined ? true : bool(cluster.quorate)
   };
 }));
-var degradedReason = (target) => clusterHealth(target).pipe(Effect28.map((health) => health.quorate && health.offline.length === 0 ? undefined : `quorate=${String(health.quorate)} offline=[${health.offline.join(", ")}]`));
+var degradedReason = (target) => clusterHealth(target).pipe(Effect30.map((health) => health.quorate && health.offline.length === 0 ? undefined : `quorate=${String(health.quorate)} offline=[${health.offline.join(", ")}]`));
 var UNREACHABLE = "the task could not be read -- the node stopped answering, or this lease cannot see it";
 var STILL_RUNNING = "still running when this provider stopped waiting";
 var ATTEMPTS = 30;
-var awaitTask = (target, credential, node, upid, attempts = ATTEMPTS) => Effect28.gen(function* () {
+var awaitTask = (target, credential, node, upid, attempts = ATTEMPTS) => Effect30.gen(function* () {
   const path = `nodes/${node}/tasks/${upid}/status`;
   for (let attempt = 0;attempt < attempts; attempt += 1) {
-    const status = yield* pveWith(target, credential, "GET", path).pipe(Effect28.orElseSucceed(() => {
+    const status = yield* pveWith(target, credential, "GET", path).pipe(Effect30.orElseSucceed(() => {
       return;
     }));
     if (status === undefined)
       return UNREACHABLE;
     if (status.status === "stopped")
       return text(status.exitstatus, "stopped with no exitstatus");
-    yield* Effect28.sleep("1 second");
+    yield* Effect30.sleep("1 second");
   }
   return STILL_RUNNING;
 });
@@ -1812,20 +2844,25 @@ class LxcRefusedError extends Error {
   name = "LxcRefusedError";
 }
 var guestPath = (where) => `nodes/${where.node}/lxc/${String(where.vmid)}`;
+var LXC_ENDPOINTS = {
+  create: "pve:POST /nodes/{node}/lxc",
+  resize: "pve:PUT /nodes/{node}/lxc/{vmid}/resize",
+  update: "pve:PUT /nodes/{node}/lxc/{vmid}/config"
+};
 var CREATE_POLLS = 180;
 var TASK_POLLS = 60;
 var isServerError = (error) => error instanceof PveError && error.status === 500;
-var readLive = (where) => Effect29.gen(function* () {
-  const answer = yield* pve(where.target, "read", "GET", `${guestPath(where)}/config`).pipe(Effect29.map((data) => ({ data, error: undefined })), Effect29.catchIf(isServerError, (error) => Effect29.succeed({ data: undefined, error })));
+var readLive = (where) => Effect31.gen(function* () {
+  const answer = yield* pve(where.target, "read", "GET", `${guestPath(where)}/config`).pipe(Effect31.map((data) => ({ data, error: undefined })), Effect31.catchIf(isServerError, (error) => Effect31.succeed({ data: undefined, error })));
   if (answer.data !== undefined && answer.data !== null)
     return answer.data;
   const rows = yield* pve(where.target, "read", "GET", "cluster/resources?type=vm");
   const found = (rows ?? []).find((row) => Number(row.vmid) === where.vmid);
   if (found !== undefined && found.node === where.node && found.type === "lxc") {
-    return yield* Effect29.fail(answer.error ?? new LxcRefusedError(`CT ${String(where.vmid)} is listed but its config read empty.`));
+    return yield* Effect31.fail(answer.error ?? new LxcRefusedError(`CT ${String(where.vmid)} is listed but its config read empty.`));
   }
   if (found !== undefined) {
-    return yield* Effect29.fail(new LxcRefusedError(`vmid ${String(where.vmid)} is a ${text(found.type, "guest")} on ` + `${text(found.node, "?")}, not a container on ${where.node}. A migration is not an ` + "update and vmids are cluster-wide: declare the node it is on, or pick a free vmid."));
+    return yield* Effect31.fail(new LxcRefusedError(`vmid ${String(where.vmid)} is a ${text(found.type, "guest")} on ` + `${text(found.node, "?")}, not a container on ${where.node}. A migration is not an ` + "update and vmids are cluster-wide: declare the node it is on, or pick a free vmid."));
   }
   return;
 });
@@ -1835,54 +2872,61 @@ var attributesOf = (where, live) => ({
   rawKeys: rawKeysOf(live),
   vmid: where.vmid
 });
-var task = (where, method, path, what, polls, form) => Effect29.gen(function* () {
+var task = (where, method, path, what, polls, form) => Effect31.gen(function* () {
   const credential = yield* mint(where.target, "provision");
   const upid = text(yield* pveWith(where.target, credential, method, path, form));
   if (upid === "") {
-    return yield* Effect29.fail(new LxcRefusedError(`${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`));
+    return yield* Effect31.fail(new LxcRefusedError(`${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`));
   }
   const exit = yield* awaitTask(where.target, credential, where.node, upid, polls);
   if (exit !== "OK") {
-    return yield* Effect29.fail(new LxcRefusedError(`${what}: task ${upid} ended "${exit}". Read \`pvesh get /nodes/${where.node}/tasks/` + `${upid}/log\` before running the deploy again.`));
+    return yield* Effect31.fail(new LxcRefusedError(`${what}: task ${upid} ended "${exit}". Read \`pvesh get /nodes/${where.node}/tasks/` + `${upid}/log\` before running the deploy again.`));
   }
 });
-var createGuest = (props) => task(props, "POST", `nodes/${props.node}/lxc`, `create CT ${String(props.vmid)}`, CREATE_POLLS, createForm3(props));
-var updateGuest = (props, change, digest) => Effect29.gen(function* () {
+var createGuest = (props) => Effect31.gen(function* () {
+  const form = createForm3(props);
+  yield* guardForm(LXC_ENDPOINTS.create, form, true);
+  return yield* task(props, "POST", `nodes/${props.node}/lxc`, `create CT ${String(props.vmid)}`, CREATE_POLLS, form);
+});
+var updateGuest = (props, change, digest) => Effect31.gen(function* () {
   if (Object.keys(change.put).length > 0 || change.clear.length > 0) {
     const form = withClears({ ...change.put, ...digest === "" ? {} : { digest } }, change.clear);
+    yield* guardForm(LXC_ENDPOINTS.update, form, false);
     yield* pve(props.target, "provision", "PUT", `${guestPath(props)}/config`, form);
   }
   for (const grow of change.resize) {
-    yield* task(props, "PUT", `${guestPath(props)}/resize`, `grow ${grow.disk} of CT ${String(props.vmid)} to ${grow.size}`, TASK_POLLS, { disk: grow.disk, size: grow.size });
+    const grown = { disk: grow.disk, size: grow.size };
+    yield* guardForm(LXC_ENDPOINTS.resize, grown, true);
+    yield* task(props, "PUT", `${guestPath(props)}/resize`, `grow ${grow.disk} of CT ${String(props.vmid)} to ${grow.size}`, TASK_POLLS, grown);
   }
 });
-var destroyGuest = (where, declared) => Effect29.gen(function* () {
+var destroyGuest = (where, declared) => Effect31.gen(function* () {
   const live = yield* readLive(where);
   if (live === undefined)
     return;
   const drift = judge(declared, live).drift;
   if (drift.length > 0) {
-    return yield* Effect29.fail(new LxcRefusedError(`destroy CT ${String(where.vmid)}: the guest on ${where.node} no longer matches its last ` + `declaration (${drift.join(", ")}), so it may not be the guest this stack made. ` + "Nothing was deleted. Delete it by hand if it should go, or declare it again."));
+    return yield* Effect31.fail(new LxcRefusedError(`destroy CT ${String(where.vmid)}: the guest on ${where.node} no longer matches its last ` + `declaration (${drift.join(", ")}), so it may not be the guest this stack made. ` + "Nothing was deleted. Delete it by hand if it should go, or declare it again."));
   }
   yield* task(where, "DELETE", guestPath(where), `destroy CT ${String(where.vmid)}`, TASK_POLLS);
 });
 
 // src/proxmox/lxc-adoption.ts
 var adoptionRefusal = (props, drift) => `CT ${String(props.vmid)} on ${props.node}: adopting it would change ${drift.join(", ")}. An ` + "adoption never changes a guest, so nothing is written. Declare what is live for these keys " + "(the plan names keys, never values) and plan again; change them after the adoption, as an " + "update.";
-var refuseAdoptedDrift = (owner, props, live, change) => Effect30.gen(function* () {
+var refuseAdoptedDrift = (owner, props, live, change) => Effect32.gen(function* () {
   if (change.drift.length === 0)
     return;
-  const settled2 = (recorded) => Effect30.sync(() => judge(recorded, live).drift.length === 0);
+  const settled2 = (recorded) => Effect32.sync(() => judge(recorded, live).drift.length === 0);
   if (!(yield* adopting(owner, settled2)))
     return;
-  return yield* Effect30.fail(new LxcRefusedError(adoptionRefusal(props, change.drift)));
+  return yield* Effect32.fail(new LxcRefusedError(adoptionRefusal(props, change.drift)));
 });
 
 // src/proxmox/lxc.ts
 var ProxmoxLxc = Resource13("Proxmox.Lxc", { defaultRemovalPolicy: "retain" });
-var refused = (reasons) => Effect31.fail(new LxcRefusedError(reasons.join(`
+var refused = (reasons) => Effect33.fail(new LxcRefusedError(reasons.join(`
 `)));
-var diff = (owner, news, olds) => Effect31.gen(function* () {
+var diff = (owner, news, olds) => Effect33.gen(function* () {
   const { output } = owner;
   const identity2 = identityRefusals(news, olds, output);
   if (identity2.length > 0)
@@ -1896,7 +2940,7 @@ var diff = (owner, news, olds) => Effect31.gen(function* () {
     const refusals = createRefusals(news);
     if (refusals.length > 0)
       return yield* refused(refusals);
-    yield* Effect31.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: the cluster lists no guest with this ` + "vmid -- a deploy CREATES it again from ostemplate, with new, empty volumes.");
+    yield* Effect33.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: the cluster lists no guest with this ` + "vmid -- a deploy CREATES it again from ostemplate, with new, empty volumes.");
     return { action: "update" };
   }
   const change = judge(news, live);
@@ -1907,10 +2951,10 @@ var diff = (owner, news, olds) => Effect31.gen(function* () {
   if (change.drift.length === 0 && !moved)
     return { action: "noop" };
   const what = change.drift.length === 0 ? `the guest is on ${news.node} now, not ${output.node} -- a deploy re-records it, ` + "writing nothing." : `live config differs from the declaration in ${change.drift.join(", ")} -- a ` + "deploy writes these.";
-  yield* Effect31.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: ${what}`);
+  yield* Effect33.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: ${what}`);
   return { action: "update" };
 });
-var reconcile = (owner, news) => Effect31.gen(function* () {
+var reconcile = (owner, news) => Effect33.gen(function* () {
   const { output } = owner;
   const identity2 = identityRefusals(news, news, output);
   if (identity2.length > 0)
@@ -1956,12 +3000,12 @@ var whereOf = (olds, output) => ({
   target: olds.target,
   vmid: output?.vmid ?? olds.vmid
 });
-var read = (owner, olds) => Effect31.gen(function* () {
+var read = (owner, olds) => Effect33.gen(function* () {
   const where = whereOf(olds, owner.output);
   const live = yield* readLive(where);
   if (live === undefined)
     return;
-  const settled2 = Effect31.sync(() => judge(olds, live).drift.length === 0);
+  const settled2 = Effect33.sync(() => judge(olds, live).drift.length === 0);
   return yield* ownedRead(owner, attributesOf(where, live), settled2);
 });
 var handlers10 = {
@@ -1973,7 +3017,7 @@ var handlers10 = {
     olds,
     output
   }) => diff({ fqn, instanceId, output }, news, olds),
-  list: () => Effect31.succeed([]),
+  list: () => Effect33.succeed([]),
   read: ({
     fqn,
     instanceId,
@@ -1987,11 +3031,11 @@ var handlers10 = {
     output
   }) => reconcile({ fqn, instanceId, output }, news)
 };
-var ProxmoxLxcProvider = () => Provider13.effect(ProxmoxLxc, Effect31.succeed(ProxmoxLxc.Provider.of(handlers10)).pipe(Effect31.map(provingResumes)));
+var ProxmoxLxcProvider = () => Provider13.effect(ProxmoxLxc, Effect33.succeed(ProxmoxLxc.Provider.of(handlers10)).pipe(Effect33.map(provingResumes)));
 // src/proxmox/metric-server.ts
 import { Resource as Resource14 } from "alchemy";
 import * as Provider14 from "alchemy/Provider";
-import * as Effect32 from "effect/Effect";
+import * as Effect34 from "effect/Effect";
 
 // src/proxmox/metric-server-form.ts
 var UNSET2 = -1;
@@ -2048,6 +3092,7 @@ var update = (props) => {
   const clear = Object.entries(optional2(props)).filter(([, value]) => value === undefined).map(([option]) => option);
   return withClears(body3(props), clear);
 };
+var createBody2 = (props) => ({ ...body3(props), type: props.type });
 
 // src/proxmox/metric-server-otel.ts
 var otelAttributes = (live) => ({
@@ -2094,27 +3139,39 @@ var handlers11 = pveHandlers({
     };
   },
   collection: (props) => `cluster/metrics/server/${props.id}`,
-  createForm: (props) => ({ ...body3(props), type: props.type }),
+  createForm: createBody2,
+  endpoint: {
+    create: "pve:POST /cluster/metrics/server/{id}",
+    update: "pve:PUT /cluster/metrics/server/{id}"
+  },
   matches: (attributes, props) => attributes.server === props.server && attributes.port === props.port && attributes.disable === (props.disable === true) && matchesType(attributes, props),
   path: (props) => `cluster/metrics/server/${props.id}`,
   updateForm: update
 });
-var ProxmoxMetricServerProvider = () => Provider14.effect(ProxmoxMetricServer, Effect32.succeed(ProxmoxMetricServer.Provider.of(handlers11)));
+var ProxmoxMetricServerProvider = () => Provider14.effect(ProxmoxMetricServer, Effect34.succeed(ProxmoxMetricServer.Provider.of(handlers11)));
 // src/proxmox/network-apply.ts
 import { Resource as Resource15 } from "alchemy";
 import { isResolved as isResolved7 } from "alchemy/Diff";
 import * as Provider15 from "alchemy/Provider";
-import * as Effect33 from "effect/Effect";
+import * as Effect35 from "effect/Effect";
+
+// src/proxmox/apply-endpoints.ts
+var NETWORK_APPLY_ENDPOINT = "pve:PUT /nodes/{node}/network";
+var SDN_APPLY_ENDPOINT = "pve:PUT /cluster/sdn";
+var guardNetworkApply = guardForm(NETWORK_APPLY_ENDPOINT, {}, true);
+var guardSdnApply = guardForm(SDN_APPLY_ENDPOINT, {}, true);
+
+// src/proxmox/network-apply.ts
 var ProxmoxNetworkApply = Resource15("Proxmox.NetworkApply");
-var read2 = (props) => pendingCount(props.target, props.node).pipe(Effect33.map((pending) => ({ node: props.node, pending })));
-var diff2 = (news) => Effect33.gen(function* () {
+var read2 = (props) => pendingCount(props.target, props.node).pipe(Effect35.map((pending) => ({ node: props.node, pending })));
+var diff2 = (news) => Effect35.gen(function* () {
   if (!isResolved7(news))
     return;
   const { pending } = yield* read2(news);
   return pending === 0 ? { action: "noop" } : { action: "update" };
 });
-var refuse = (node, why) => Effect33.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));
-var apply = (props) => Effect33.gen(function* () {
+var refuse = (node, why) => Effect35.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));
+var apply = (props) => Effect35.gen(function* () {
   const node = props.node;
   const staged = yield* pendingCount(props.target, node);
   if (staged === 0)
@@ -2123,6 +3180,7 @@ var apply = (props) => Effect33.gen(function* () {
   if (before !== undefined) {
     return yield* refuse(node, `refusing to reload networking on a cluster that is already degraded (${before}). ` + "Ceph spans these nodes -- fix the cluster first, then re-run the deploy.");
   }
+  yield* guardNetworkApply;
   const credential = yield* mint(props.target, "provision");
   const upid = yield* pveWith(props.target, credential, "PUT", `nodes/${node}/network`);
   if (upid === undefined) {
@@ -2143,17 +3201,17 @@ var apply = (props) => Effect33.gen(function* () {
   return { node, pending: left };
 });
 var handlers12 = {
-  delete: () => Effect33.void,
+  delete: () => Effect35.void,
   diff: ({ news }) => diff2(news),
-  list: () => Effect33.succeed([]),
+  list: () => Effect35.succeed([]),
   read: ({ olds }) => read2(olds),
   reconcile: ({ news }) => apply(news)
 };
-var ProxmoxNetworkApplyProvider = () => Provider15.effect(ProxmoxNetworkApply, Effect33.succeed(ProxmoxNetworkApply.Provider.of(handlers12)));
+var ProxmoxNetworkApplyProvider = () => Provider15.effect(ProxmoxNetworkApply, Effect35.succeed(ProxmoxNetworkApply.Provider.of(handlers12)));
 // src/proxmox/node-network.ts
 import { Resource as Resource16 } from "alchemy";
 import * as Provider16 from "alchemy/Provider";
-import * as Effect34 from "effect/Effect";
+import * as Effect36 from "effect/Effect";
 
 // src/proxmox/node-network-form.ts
 var UNSET3 = -1;
@@ -2180,6 +3238,10 @@ var body4 = (props) => ({
   ...field3("vlan-raw-device", props["vlan-raw-device"]),
   type: props.type
 });
+var createBody3 = (props) => ({
+  ...body4(props),
+  iface: props.iface
+});
 var updateBody2 = (props) => {
   const clear = [
     ...props.cidr === undefined ? ["cidr"] : [],
@@ -2228,16 +3290,20 @@ var ProxmoxNodeNetwork = Resource16("Proxmox.NodeNetwork", {
 var handlers13 = pveHandlers({
   attributes: readAttributes,
   collection: (props) => `nodes/${props.node}/network`,
-  createForm: body4,
+  createForm: createBody3,
+  endpoint: {
+    create: "pve:POST /nodes/{node}/network",
+    update: "pve:PUT /nodes/{node}/network/{iface}"
+  },
   matches: (attributes, props) => attributes.cidr === (props.cidr ?? "") && same2(props.gateway, attributes.gateway) && same2(props.autostart, attributes.autostart) && same2(props.mtu, attributes.mtu) && sameComment(props.comments, attributes.comments) && sameList(props.bridge_ports, attributes.bridge_ports) && sameList(props.bridge_vids, attributes.bridge_vids) && same2(props.bridge_vlan_aware, attributes.bridge_vlan_aware) && sameList(props.slaves, attributes.slaves) && same2(props.bond_mode, attributes.bond_mode) && same2(props.bond_xmit_hash_policy, attributes.bond_xmit_hash_policy) && same2(props["bond-primary"], attributes["bond-primary"]) && same2(props["vlan-id"], attributes["vlan-id"]) && same2(props["vlan-raw-device"], attributes["vlan-raw-device"]),
   path: (props) => `nodes/${props.node}/network/${props.iface}`,
   updateForm: updateBody2
 });
-var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Effect34.succeed(ProxmoxNodeNetwork.Provider.of(handlers13)));
+var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Effect36.succeed(ProxmoxNodeNetwork.Provider.of(handlers13)));
 // src/proxmox/notification-matcher.ts
 import { Resource as Resource17 } from "alchemy";
 import * as Provider17 from "alchemy/Provider";
-import * as Effect35 from "effect/Effect";
+import * as Effect37 from "effect/Effect";
 
 // src/proxmox/notification-matcher-form.ts
 var list = (value) => Array.isArray(value) ? value.map((item) => String(item)) : [];
@@ -2319,15 +3385,40 @@ var handlers14 = pveHandlers({
   attributes: (live, props) => matcherAttributes(live, props.name),
   collection: () => "cluster/notifications/matchers",
   createForm: matcherCreateForm,
+  endpoint: {
+    create: "pve:POST /cluster/notifications/matchers",
+    update: "pve:PUT /cluster/notifications/matchers/{name}"
+  },
   matches: matcherMatches,
   path: (props) => `cluster/notifications/matchers/${props.name}`,
   updateForm: matcherUpdateForm
 });
-var ProxmoxNotificationMatcherProvider = () => Provider17.effect(ProxmoxNotificationMatcher, Effect35.succeed(ProxmoxNotificationMatcher.Provider.of(handlers14)));
+var ProxmoxNotificationMatcherProvider = () => Provider17.effect(ProxmoxNotificationMatcher, Effect37.succeed(ProxmoxNotificationMatcher.Provider.of(handlers14)));
 // src/proxmox/notification-target.ts
 import { Resource as Resource18 } from "alchemy";
 import * as Provider18 from "alchemy/Provider";
-import * as Effect36 from "effect/Effect";
+import * as Effect38 from "effect/Effect";
+
+// src/proxmox/notification-target-endpoint.ts
+var ENDPOINTS = {
+  gotify: {
+    create: "pve:POST /cluster/notifications/endpoints/gotify",
+    update: "pve:PUT /cluster/notifications/endpoints/gotify/{name}"
+  },
+  sendmail: {
+    create: "pve:POST /cluster/notifications/endpoints/sendmail",
+    update: "pve:PUT /cluster/notifications/endpoints/sendmail/{name}"
+  },
+  smtp: {
+    create: "pve:POST /cluster/notifications/endpoints/smtp",
+    update: "pve:PUT /cluster/notifications/endpoints/smtp/{name}"
+  },
+  webhook: {
+    create: "pve:POST /cluster/notifications/endpoints/webhook",
+    update: "pve:PUT /cluster/notifications/endpoints/webhook/{name}"
+  }
+};
+var targetEndpoint = (props) => ENDPOINTS[props.type];
 
 // src/proxmox/notification-target-form.ts
 var REPEATED_KEY = "\x00";
@@ -2355,6 +3446,10 @@ var shape4 = (props) => ({
   ...set("url", props.url),
   ...set("username", props.username)
 });
+var createShape = (props) => ({
+  ...shape4(props),
+  name: props.name
+});
 
 // src/proxmox/notification-target.ts
 var ProxmoxNotificationTarget = Resource18("Proxmox.NotificationTarget");
@@ -2378,20 +3473,21 @@ var handlers15 = pveHandlers({
     username: text(live["username"])
   }),
   collection: (props) => `cluster/notifications/endpoints/${props.type}`,
-  createForm: (props) => ({ ...shape4(props), name: props.name }),
+  createForm: createShape,
+  endpoint: targetEndpoint,
   matches: (attributes, props) => attributes.disable === (props.disable === true) && (props.comment === undefined || attributes.comment === props.comment) && (props.server === undefined || attributes.server === props.server) && (props.port === undefined || attributes.port === props.port) && (props.mode === undefined || attributes.mode === props.mode) && (props.username === undefined || attributes.username === props.username) && (props["from-address"] === undefined || attributes["from-address"] === props["from-address"]) && (props.author === undefined || attributes.author === props.author) && (props.url === undefined || attributes.url === props.url) && (props.method === undefined || attributes.method === props.method) && (props.body === undefined || attributes.body === props.body) && (props.mailto === undefined || attributes.mailto === addressList(props.mailto)) && (props["mailto-user"] === undefined || attributes["mailto-user"] === addressList(props["mailto-user"])) && (props.header === undefined || attributes.header === headerList(props.header)),
   path: (props) => `cluster/notifications/endpoints/${props.type}/${props.name}`,
   updateForm: shape4
 });
-var ProxmoxNotificationTargetProvider = () => Provider18.effect(ProxmoxNotificationTarget, Effect36.succeed(ProxmoxNotificationTarget.Provider.of(handlers15)));
+var ProxmoxNotificationTargetProvider = () => Provider18.effect(ProxmoxNotificationTarget, Effect38.succeed(ProxmoxNotificationTarget.Provider.of(handlers15)));
 // src/proxmox/pbs-datastore.ts
 import { Resource as Resource19 } from "alchemy";
 import { isResolved as isResolved8 } from "alchemy/Diff";
 import * as Provider19 from "alchemy/Provider";
-import * as Effect39 from "effect/Effect";
+import * as Effect42 from "effect/Effect";
 
 // src/proxmox/pbs-datastore-form.ts
-import * as Effect37 from "effect/Effect";
+import * as Effect39 from "effect/Effect";
 var attributes = (live, props) => ({
   backend: propertyString(live["backend"]),
   comment: text(live["comment"]),
@@ -2443,37 +3539,51 @@ var createForm4 = (props) => ({
 });
 var updateForm = (props) => mutable(props);
 var object2 = (props) => `config/datastore/${props.name}`;
-var readOne = (props) => pve(props.target, "read", "GET", object2(props)).pipe(Effect37.map((live) => live === undefined || typeof live["name"] !== "string" ? undefined : attributes(live, props)), Effect37.orElseSucceed(() => {
+var readOne = (props) => pve(props.target, "read", "GET", object2(props)).pipe(Effect39.map((live) => live === undefined || typeof live["name"] !== "string" ? undefined : attributes(live, props)), Effect39.orElseSucceed(() => {
   return;
 }));
 
 // src/proxmox/pbs-datastore-guard.ts
-import * as Effect38 from "effect/Effect";
+import * as Effect40 from "effect/Effect";
 var samePath = (left, right) => {
   const trim = (value) => value.length > 1 ? value.replace(/\/+$/, "") : value;
   return trim(left) === trim(right);
 };
-var guardPath = (live, props) => live.path === "" || samePath(live.path, props.path) ? Effect38.void : Effect38.die(new Error(`${object2(props)}: declared path ${props.path} but PBS holds ${live.path}. \`path\` ` + "is create-only, so this cannot be reconciled and will NOT be planned as a silent " + "noop: backups would keep landing in the old directory behind a green plan. Correct " + "the declaration, or remove the datastore and declare a new one -- the contents live, " + "because `destroy-data` is never sent."));
-var guardBackend = (live, props) => props.backend === undefined || propertyString(props.backend) === live.backend ? Effect38.void : Effect38.die(new Error(`${object2(props)}: declared backend ${props.backend} but PBS holds ` + `${live.backend === "" ? "(none — a local datastore)" : live.backend}. \`backend\` ` + "is create-only: PBS has no update for it, so this cannot be reconciled and will NOT " + "be planned as a silent noop. Correct the declaration to match what is really there, " + "or remove the datastore and declare a new one -- the contents live, because " + "`destroy-data` is never sent."));
-var settle3 = (read3, done) => Effect38.gen(function* () {
+var guardPath = (live, props) => live.path === "" || samePath(live.path, props.path) ? Effect40.void : Effect40.die(new Error(`${object2(props)}: declared path ${props.path} but PBS holds ${live.path}. \`path\` ` + "is create-only, so this cannot be reconciled and will NOT be planned as a silent " + "noop: backups would keep landing in the old directory behind a green plan. Correct " + "the declaration, or remove the datastore and declare a new one -- the contents live, " + "because `destroy-data` is never sent."));
+var guardBackend = (live, props) => props.backend === undefined || propertyString(props.backend) === live.backend ? Effect40.void : Effect40.die(new Error(`${object2(props)}: declared backend ${props.backend} but PBS holds ` + `${live.backend === "" ? "(none — a local datastore)" : live.backend}. \`backend\` ` + "is create-only: PBS has no update for it, so this cannot be reconciled and will NOT " + "be planned as a silent noop. Correct the declaration to match what is really there, " + "or remove the datastore and declare a new one -- the contents live, because " + "`destroy-data` is never sent."));
+var settle3 = (read3, done) => Effect40.gen(function* () {
   for (let attempt = 0;attempt < 60; attempt += 1) {
     const live = yield* read3;
     if (done(live))
       return live;
-    yield* Effect38.sleep("2 seconds");
+    yield* Effect40.sleep("2 seconds");
   }
   return yield* read3;
 });
 
+// src/proxmox/pbs-datastore-endpoint.ts
+import * as Effect41 from "effect/Effect";
+var DATASTORE_ENDPOINT = {
+  create: "pbs:POST /config/datastore",
+  update: "pbs:PUT /config/datastore/{name}"
+};
+var guardDatastoreForms = (props) => Effect41.gen(function* () {
+  yield* guardForm(DATASTORE_ENDPOINT.create, createForm4(props), true);
+  yield* guardForm(DATASTORE_ENDPOINT.update, updateForm(props), false);
+});
+
 // src/proxmox/pbs-datastore.ts
 var PbsDatastore = Resource19("Pbs.Datastore", {
   defaultRemovalPolicy: "retain"
 });
-var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect39.succeed(PbsDatastore.Provider.of({
-  list: () => Effect39.succeed([]),
+var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect42.succeed(PbsDatastore.Provider.of({
+  list: () => Effect42.succeed([]),
   read: ({ olds }) => readOne(olds),
-  diff: ({ news, output }) => Effect39.gen(function* () {
-    if (output === undefined || !isResolved8(news))
+  diff: ({ news, output }) => Effect42.gen(function* () {
+    if (!isResolved8(news))
+      return;
+    yield* guardDatastoreForms(news);
+    if (output === undefined)
       return;
     const live = yield* readOne(news);
     if (live === undefined)
@@ -2482,7 +3592,8 @@ var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect39.succee
     yield* guardBackend(live, news);
     return matches(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect39.fn(function* ({ news }) {
+  reconcile: Effect42.fn(function* ({ news }) {
+    yield* guardDatastoreForms(news);
     const live = yield* readOne(news);
     let upid;
     if (live === undefined) {
@@ -2497,40 +3608,61 @@ var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect39.succee
     }
     const after = yield* settle3(readOne(news), (row) => row !== undefined && matches(row, news));
     if (after === undefined || !matches(after, news)) {
-      return yield* Effect39.die(new Error(`${object2(news)}: the write returned no error but the datastore still does not ` + `match the declaration after 120s. PBS answered with task ${upid ?? "(none)"} ` + "-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a " + "plausible cause (see `settle`); a create over an existing chunk store is not, " + "because PBS refuses that outright rather than timing out."));
+      return yield* Effect42.die(new Error(`${object2(news)}: the write returned no error but the datastore still does not ` + `match the declaration after 120s. PBS answered with task ${upid ?? "(none)"} ` + "-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a " + "plausible cause (see `settle`); a create over an existing chunk store is not, " + "because PBS refuses that outright rather than timing out."));
     }
     return after;
   }),
-  delete: Effect39.fn(function* ({ olds }) {
+  delete: Effect42.fn(function* ({ olds }) {
     yield* pve(olds.target, "provision", "DELETE", object2(olds));
     const left = yield* settle3(readOne(olds), (row) => row === undefined);
     if (left !== undefined) {
-      return yield* Effect39.die(new Error(`${object2(olds)}: the DELETE returned no error but the datastore is still in ` + "datastore.cfg after 120s. Either a backup, verify or GC task still holds it, " + "or the provision role lacks Datastore.Allocate on /datastore/" + `${olds.name}. Read the task log with \`proxmox-backup-manager task log <upid>\`.`));
+      return yield* Effect42.die(new Error(`${object2(olds)}: the DELETE returned no error but the datastore is still in ` + "datastore.cfg after 120s. Either a backup, verify or GC task still holds it, " + "or the provision role lacks Datastore.Allocate on /datastore/" + `${olds.name}. Read the task log with \`proxmox-backup-manager task log <upid>\`.`));
     }
   })
 })));
 // src/proxmox/pbs-notification-matcher.ts
 import { Resource as Resource20 } from "alchemy";
 import * as Provider20 from "alchemy/Provider";
-import * as Effect40 from "effect/Effect";
+import * as Effect43 from "effect/Effect";
 var PbsNotificationMatcher = Resource20("Pbs.NotificationMatcher");
 var handlers16 = pveHandlers({
   attributes: (live, props) => matcherAttributes(live, props.name),
   collection: () => "config/notifications/matchers",
   createForm: matcherCreateForm,
+  endpoint: {
+    create: "pbs:POST /config/notifications/matchers",
+    update: "pbs:PUT /config/notifications/matchers/{name}"
+  },
   matches: matcherMatches,
   path: (props) => `config/notifications/matchers/${props.name}`,
   updateForm: matcherUpdateForm
 });
-var PbsNotificationMatcherProvider = () => Provider20.effect(PbsNotificationMatcher, Effect40.succeed(PbsNotificationMatcher.Provider.of(handlers16)));
+var PbsNotificationMatcherProvider = () => Provider20.effect(PbsNotificationMatcher, Effect43.succeed(PbsNotificationMatcher.Provider.of(handlers16)));
 // src/proxmox/pbs-notification-target.ts
 import { Resource as Resource21 } from "alchemy";
 import * as Provider21 from "alchemy/Provider";
-import * as Effect42 from "effect/Effect";
+import * as Effect45 from "effect/Effect";
 
 // src/proxmox/pbs-notification-target-lifecycle.ts
 import { isResolved as isResolved9 } from "alchemy/Diff";
-import * as Effect41 from "effect/Effect";
+import * as Effect44 from "effect/Effect";
+
+// src/proxmox/pbs-notification-target-endpoint.ts
+var ENDPOINTS2 = {
+  sendmail: {
+    create: "pbs:POST /config/notifications/endpoints/sendmail",
+    update: "pbs:PUT /config/notifications/endpoints/sendmail/{name}"
+  },
+  smtp: {
+    create: "pbs:POST /config/notifications/endpoints/smtp",
+    update: "pbs:PUT /config/notifications/endpoints/smtp/{name}"
+  },
+  webhook: {
+    create: "pbs:POST /config/notifications/endpoints/webhook",
+    update: "pbs:PUT /config/notifications/endpoints/webhook/{name}"
+  }
+};
+var pbsTargetEndpoint = (props) => ENDPOINTS2[props.type];
 
 // src/proxmox/credential-literals.ts
 var READS_SECRET = /\{\{[^}]*\bsecrets\./;
@@ -2790,12 +3922,12 @@ var targetForm = (props, groups, carry, mode) => {
 
 // src/proxmox/pbs-notification-target-lifecycle.ts
 var path = (props) => `config/notifications/endpoints/${props.type}/${props.name}`;
-var readLive2 = (props) => pve(props.target, "read", "GET", path(props)).pipe(Effect41.map((data) => data == null ? undefined : targetAttributes(data, props)), Effect41.orElseSucceed(() => {
+var readLive2 = (props) => pve(props.target, "read", "GET", path(props)).pipe(Effect44.map((data) => data == null ? undefined : targetAttributes(data, props)), Effect44.orElseSucceed(() => {
   return;
 }));
 var refuse2 = (props) => {
   const reasons = refusals(props);
-  return reasons.length === 0 ? Effect41.void : Effect41.die(new Error(`${path(props)}: ${reasons.join("; ")}.`));
+  return reasons.length === 0 ? Effect44.void : Effect44.die(new Error(`${path(props)}: ${reasons.join("; ")}.`));
 };
 var toCarry = (live, props, groups, sealed) => {
   const header = headerState(live, props, groups) === "stale";
@@ -2807,16 +3939,16 @@ var requireValues = (props, groups, carry) => {
     ...carry.header ? groups.header.missing : [],
     ...carry.sealed ? groups.sealed.missing : []
   ];
-  return missing.length === 0 ? Effect41.void : Effect41.die(new Error(`${path(props)}: this write must send write-only values, and ${missing.join(", ")} ` + "is unset or empty in the deploying environment. Export it and deploy again."));
+  return missing.length === 0 ? Effect44.void : Effect44.die(new Error(`${path(props)}: this write must send write-only values, and ${missing.join(", ")} ` + "is unset or empty in the deploying environment. Export it and deploy again."));
 };
 var handlers17 = {
-  list: () => Effect41.succeed([]),
-  read: ({ olds, output }) => (output === undefined ? refuse2(olds) : Effect41.void).pipe(Effect41.andThen(readLive2(olds)), Effect41.map((live) => live === undefined ? undefined : { ...live, sealed: output?.sealed ?? "" })),
+  list: () => Effect44.succeed([]),
+  read: ({ olds, output }) => (output === undefined ? refuse2(olds) : Effect44.void).pipe(Effect44.andThen(readLive2(olds)), Effect44.map((live) => live === undefined ? undefined : { ...live, sealed: output?.sealed ?? "" })),
   diff: ({
     news,
     olds,
     output
-  }) => Effect41.gen(function* () {
+  }) => Effect44.gen(function* () {
     if (output === undefined || !isResolved9(news))
       return;
     if (olds !== undefined && (olds.type !== news.type || olds.name !== news.name)) {
@@ -2828,7 +3960,7 @@ var handlers17 = {
       return { action: "update" };
     return toCarry(live, news, resolveGroups(news), output.sealed) === undefined ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: ({ news, output }) => Effect41.gen(function* () {
+  reconcile: ({ news, output }) => Effect44.gen(function* () {
     yield* refuse2(news);
     const groups = resolveGroups(news);
     const live = yield* readLive2(news);
@@ -2837,20 +3969,24 @@ var handlers17 = {
       const carry = { header: true, sealed: true };
       yield* requireValues(news, groups, carry);
       const collection2 = `config/notifications/endpoints/${news.type}`;
-      yield* pve(news.target, "provision", "POST", collection2, targetForm(news, groups, carry, "create"));
+      const form = targetForm(news, groups, carry, "create");
+      yield* guardForm(pbsTargetEndpoint(news).create, form, true);
+      yield* pve(news.target, "provision", "POST", collection2, form);
       sealed = seal(groups.sealed.values);
     } else {
       const carry = toCarry(live, news, groups, sealed);
       if (carry !== undefined) {
         yield* requireValues(news, groups, carry);
-        yield* pve(news.target, "provision", "PUT", path(news), targetForm(news, groups, carry, "update"));
+        const form = targetForm(news, groups, carry, "update");
+        yield* guardForm(pbsTargetEndpoint(news).update, form, false);
+        yield* pve(news.target, "provision", "PUT", path(news), form);
         if (carry.sealed)
           sealed = seal(groups.sealed.values);
       }
     }
     const after = yield* readLive2(news);
     if (after === undefined) {
-      return yield* Effect41.die(new Error(`${path(news)}: the write returned no error but the target is still absent.`));
+      return yield* Effect44.die(new Error(`${path(news)}: the write returned no error but the target is still absent.`));
     }
     return { ...after, sealed };
   }),
@@ -2859,11 +3995,11 @@ var handlers17 = {
 
 // src/proxmox/pbs-notification-target.ts
 var PbsNotificationTarget = Resource21("Pbs.NotificationTarget");
-var PbsNotificationTargetProvider = () => Provider21.effect(PbsNotificationTarget, Effect42.succeed(PbsNotificationTarget.Provider.of(handlers17)));
+var PbsNotificationTargetProvider = () => Provider21.effect(PbsNotificationTarget, Effect45.succeed(PbsNotificationTarget.Provider.of(handlers17)));
 // src/proxmox/pbs-prune-job.ts
 import { Resource as Resource22 } from "alchemy";
 import * as Provider22 from "alchemy/Provider";
-import * as Effect43 from "effect/Effect";
+import * as Effect46 from "effect/Effect";
 
 // src/proxmox/pbs-prune-job-form.ts
 var KEEP_KEYS = [
@@ -2909,7 +4045,7 @@ var shape5 = (props) => ({
   schedule: props.schedule,
   store: props.store
 });
-var createBody2 = (props) => {
+var createBody4 = (props) => {
   requireKeeps(props);
   return { ...shape5(props), id: props.id };
 };
@@ -2933,16 +4069,17 @@ var handlers18 = pveHandlers({
     store: text(live["store"], props.store)
   }),
   collection: () => "config/prune",
-  createForm: createBody2,
+  createForm: createBody4,
+  endpoint: { create: "pbs:POST /config/prune", update: "pbs:PUT /config/prune/{id}" },
   matches: (attributes2, props) => attributes2.schedule === props.schedule && attributes2.store === props.store && same6(props.ns, attributes2.ns) && same6(props["max-depth"], attributes2["max-depth"]) && same6(props.disable, attributes2.disable) && same6(props.comment, attributes2.comment) && keepsMatch(attributes2, props),
   path: (props) => `config/prune/${props.id}`,
   updateForm: updateBody3
 });
-var PbsPruneJobProvider = () => Provider22.effect(PbsPruneJob, Effect43.succeed(PbsPruneJob.Provider.of(handlers18)));
+var PbsPruneJobProvider = () => Provider22.effect(PbsPruneJob, Effect46.succeed(PbsPruneJob.Provider.of(handlers18)));
 // src/proxmox/pbs-sync-job.ts
 import { Resource as Resource23 } from "alchemy";
 import * as Provider23 from "alchemy/Provider";
-import * as Effect44 from "effect/Effect";
+import * as Effect47 from "effect/Effect";
 
 // src/proxmox/pbs-sync-job-form.ts
 var UNSET4 = -1;
@@ -2984,7 +4121,7 @@ var shape6 = (props) => ({
   ...props["verified-only"] === undefined ? {} : { "verified-only": props["verified-only"] ? "1" : "0" },
   ...props["transfer-last"] === undefined ? {} : { "transfer-last": String(props["transfer-last"]) }
 });
-var createBody3 = (props) => ({
+var createBody5 = (props) => ({
   ...shape6(props),
   id: props.id,
   ...props["sync-direction"] === undefined ? {} : { "sync-direction": props["sync-direction"] }
@@ -3010,7 +4147,8 @@ var handlers19 = pveHandlers({
     "transfer-last": int(live["transfer-last"], UNSET4)
   }),
   collection: () => "config/sync",
-  createForm: createBody3,
+  createForm: createBody5,
+  endpoint: { create: "pbs:POST /config/sync", update: "pbs:PUT /config/sync/{id}" },
   matches: (attributes2, props) => attributes2["remove-vanished"] === (props["remove-vanished"] === true) && attributes2.store === props.store && attributes2["remote-store"] === props["remote-store"] && (props.remote === undefined || attributes2.remote === props.remote) && (props.ns === undefined || attributes2.ns === props.ns) && (props["remote-ns"] === undefined || attributes2["remote-ns"] === props["remote-ns"]) && (props.schedule === undefined || attributes2.schedule === props.schedule) && (props.comment === undefined || attributes2.comment === props.comment) && (props.owner === undefined || attributes2.owner === props.owner) && (props["verified-only"] === undefined || attributes2["verified-only"] === props["verified-only"]) && (props["rate-in"] === undefined || attributes2["rate-in"] === props["rate-in"]) && (props["max-depth"] === undefined || attributes2["max-depth"] === props["max-depth"]) && (props["transfer-last"] === undefined || attributes2["transfer-last"] === props["transfer-last"]),
   path: (props) => `config/sync/${props.id}`,
   updateForm: updateBody4
@@ -3018,11 +4156,11 @@ var handlers19 = pveHandlers({
 
 // src/proxmox/pbs-sync-job.ts
 var PbsSyncJob = Resource23("Pbs.SyncJob");
-var PbsSyncJobProvider = () => Provider23.effect(PbsSyncJob, Effect44.succeed(PbsSyncJob.Provider.of(handlers19)));
+var PbsSyncJobProvider = () => Provider23.effect(PbsSyncJob, Effect47.succeed(PbsSyncJob.Provider.of(handlers19)));
 // src/proxmox/pbs-verify-job.ts
 import { Resource as Resource24 } from "alchemy";
 import * as Provider24 from "alchemy/Provider";
-import * as Effect45 from "effect/Effect";
+import * as Effect48 from "effect/Effect";
 
 // src/proxmox/pbs-verify-job-form.ts
 var rechecks = (ignoreVerified, outdatedAfter) => {
@@ -3062,15 +4200,16 @@ var handlers20 = pveHandlers({
   },
   collection: () => "config/verify",
   createForm: (props) => ({ ...shape7(props), id: props.id }),
+  endpoint: { create: "pbs:POST /config/verify", update: "pbs:PUT /config/verify/{id}" },
   matches: (attributes2, props) => attributes2.store === props.store && attributes2.schedule === (props.schedule ?? "") && attributes2["ignore-verified"] === (props["ignore-verified"] !== false) && (props["outdated-after"] === undefined || attributes2["outdated-after"] === props["outdated-after"]) && (props["max-depth"] === undefined || attributes2["max-depth"] === props["max-depth"]) && (props.ns === undefined || attributes2.ns === props.ns) && (props.comment === undefined || attributes2.comment === props.comment),
   path: (props) => `config/verify/${props.id}`,
   updateForm: shape7
 });
-var PbsVerifyJobProvider = () => Provider24.effect(PbsVerifyJob, Effect45.succeed(PbsVerifyJob.Provider.of(handlers20)));
+var PbsVerifyJobProvider = () => Provider24.effect(PbsVerifyJob, Effect48.succeed(PbsVerifyJob.Provider.of(handlers20)));
 // src/proxmox/pool.ts
 import { Resource as Resource25 } from "alchemy";
 import * as Provider25 from "alchemy/Provider";
-import * as Effect46 from "effect/Effect";
+import * as Effect49 from "effect/Effect";
 var ProxmoxPool = Resource25("Proxmox.Pool");
 var poolCreateForm = (props) => ({
   comment: props.comment ?? "",
@@ -3090,11 +4229,12 @@ var handlers21 = pveHandlers({
   },
   collection: () => "pools",
   createForm: poolCreateForm,
+  endpoint: { create: "pve:POST /pools", update: "pve:PUT /pools/{poolid}" },
   matches: (attributes2, props) => attributes2.comment === (props.comment ?? ""),
   path: (props) => `pools/${props.poolid}`,
   updateForm: poolUpdateForm
 });
-var ProxmoxPoolProvider = () => Provider25.effect(ProxmoxPool, Effect46.succeed(ProxmoxPool.Provider.of(handlers21)));
+var ProxmoxPoolProvider = () => Provider25.effect(ProxmoxPool, Effect49.succeed(ProxmoxPool.Provider.of(handlers21)));
 // src/proxmox/provision-baseline.ts
 var PROVISION_PRIVILEGES = Object.freeze([
   "Datastore.Allocate",
@@ -3135,8 +4275,8 @@ var PROVISION_DEFAULTS = Object.freeze({
 });
 var ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 var USERID = /^[A-Za-z0-9][A-Za-z0-9._-]*@[A-Za-z][A-Za-z0-9._-]*$/;
-var COMMENT = /^[A-Za-z0-9 ._,()@/+-]*$/;
-var problems2 = (names2) => {
+var COMMENT = /^[A-Za-z0-9 ._,:()@/+-]*$/;
+var problems2 = (names2, comments, given) => {
   const found = [];
   if (!ID.test(names2.role))
     found.push(`role \`${names2.role}\` is not a PVE role id`);
@@ -3154,17 +4294,36 @@ var problems2 = (names2) => {
   }
   if (names2.readUser === names2.provisionUser)
     found.push("readUser and provisionUser are one user");
-  if (!COMMENT.test(names2.comment))
-    found.push("comment holds a character the bootstrap will not quote");
+  const source = (override, field6) => override === undefined ? "comment" : field6;
+  const checked = [
+    [source(given.groupComment, "groupComment"), comments.group],
+    [source(given.provisionComment, "provisionComment"), comments.provision]
+  ];
+  if (names2.readUser !== null) {
+    checked.push([source(given.readComment, "readComment"), comments.read]);
+  }
+  const said = new Set;
+  for (const [field6, comment3] of checked) {
+    if (COMMENT.test(comment3) || said.has(field6))
+      continue;
+    said.add(field6);
+    found.push(`${field6} holds a character the bootstrap will not quote`);
+  }
   return found;
 };
 var provisionBaseline = (names2 = {}) => {
-  const given = Object.entries(names2).filter(([, value]) => value !== undefined);
+  const { groupComment, provisionComment, readComment, ...core } = names2;
+  const given = Object.entries(core).filter(([, value]) => value !== undefined);
   const resolved = {
     ...PROVISION_DEFAULTS,
     ...Object.fromEntries(given)
   };
-  const found = problems2(resolved);
+  const comments = {
+    group: groupComment ?? resolved.comment,
+    provision: provisionComment ?? resolved.comment,
+    read: readComment ?? resolved.comment
+  };
+  const found = problems2(resolved, comments, names2);
   if (found.length > 0)
     throw new Error(`provision baseline: ${found.join("; ")}`);
   const lanes = [
@@ -3174,10 +4333,10 @@ var provisionBaseline = (names2 = {}) => {
     lanes.push(["read", resolved.readUser, resolved.readRole]);
   return {
     grants: lanes.map(([lane, userid, roleid]) => ({ lane, roleid, userid })),
-    group: { comment: resolved.comment, groupid: resolved.mintGroup },
+    group: { comment: comments.group, groupid: resolved.mintGroup },
     role: { privs: PROVISION_PRIVILEGES, roleid: resolved.role },
     users: lanes.map(([lane, userid]) => ({
-      comment: resolved.comment,
+      comment: comments[lane],
       groups: [resolved.mintGroup],
       lane,
       userid
@@ -3268,12 +4427,12 @@ echo 'provision baseline: done. Next: point the OpenBao proxmox mount at these u
 // src/proxmox/provision-declare.ts
 import { adopt } from "alchemy/AdoptPolicy";
 import * as RemovalPolicy from "alchemy/RemovalPolicy";
-import * as Effect49 from "effect/Effect";
+import * as Effect52 from "effect/Effect";
 
 // src/proxmox/role.ts
 import { Resource as Resource26 } from "alchemy";
 import * as Provider26 from "alchemy/Provider";
-import * as Effect47 from "effect/Effect";
+import * as Effect50 from "effect/Effect";
 var ProxmoxRole = Resource26("Proxmox.Role");
 var canonical2 = (privs) => [...new Set(privs.map((priv) => priv.trim()).filter((priv) => priv.length > 0))].sort();
 var livePrivs = (live) => {
@@ -3286,16 +4445,17 @@ var handlers22 = pveHandlers({
   attributes: (live, props) => ({ privs: livePrivs(live), roleid: props.roleid }),
   collection: () => "access/roles",
   createForm: (props) => ({ privs: canonical2(props.privs).join(","), roleid: props.roleid }),
+  endpoint: { create: "pve:POST /access/roles", update: "pve:PUT /access/roles/{roleid}" },
   matches: (attributes2, props) => canonical2(attributes2.privs).join(",") === canonical2(props.privs).join(","),
   path: (props) => `access/roles/${props.roleid}`,
   updateForm: (props) => ({ privs: canonical2(props.privs).join(",") })
 });
-var ProxmoxRoleProvider = () => Provider26.effect(ProxmoxRole, Effect47.succeed(ProxmoxRole.Provider.of(handlers22)));
+var ProxmoxRoleProvider = () => Provider26.effect(ProxmoxRole, Effect50.succeed(ProxmoxRole.Provider.of(handlers22)));
 
 // src/proxmox/user.ts
 import { Resource as Resource27 } from "alchemy";
 import * as Provider27 from "alchemy/Provider";
-import * as Effect48 from "effect/Effect";
+import * as Effect51 from "effect/Effect";
 var ProxmoxUser = Resource27("Proxmox.User");
 var str2 = (value) => typeof value === "string" ? value : "";
 var int2 = (value) => {
@@ -3331,15 +4491,16 @@ var handlers23 = pveHandlers({
   }),
   collection: () => "access/users",
   createForm: (props) => ({ ...shape8(props), userid: props.userid }),
+  endpoint: { create: "pve:POST /access/users", update: "pve:PUT /access/users/{userid}" },
   matches: (attributes2, props) => attributes2.comment === (props.comment ?? "") && attributes2.email === (props.email ?? "") && attributes2.enable === (props.enable !== false) && attributes2.expire === (props.expire ?? 0) && attributes2.firstname === (props.firstname ?? "") && attributes2.lastname === (props.lastname ?? "") && attributes2.groups.join(",") === groupSet(props.groups).join(","),
   path: (props) => `access/users/${props.userid}`,
   updateForm: shape8
 });
-var ProxmoxUserProvider = () => Provider27.effect(ProxmoxUser, Effect48.succeed(ProxmoxUser.Provider.of(handlers23)));
+var ProxmoxUserProvider = () => Provider27.effect(ProxmoxUser, Effect51.succeed(ProxmoxUser.Provider.of(handlers23)));
 
 // src/proxmox/provision-declare.ts
-var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect49.gen(function* () {
-  const baseline = yield* Effect49.try({
+var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect52.gen(function* () {
+  const baseline = yield* Effect52.try({
     catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
     try: () => provisionBaseline(names2)
   });
@@ -3353,13 +4514,13 @@ var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect
     target
   }));
   const group = yield* owned(ProxmoxGroup(`${id}-mint-group`, { ...baseline.group, target }));
-  const users = yield* Effect49.all(baseline.users.map((user) => owned(ProxmoxUser(`${id}-${user.lane}-user`, {
+  const users = yield* Effect52.all(baseline.users.map((user) => owned(ProxmoxUser(`${id}-${user.lane}-user`, {
     comment: user.comment,
     groups: [...user.groups],
     target,
     userid: user.userid
   }))));
-  const grants = yield* Effect49.all(baseline.grants.map((grant) => owned(ProxmoxAcl(`${id}-${grant.lane}-grant`, {
+  const grants = yield* Effect52.all(baseline.grants.map((grant) => owned(ProxmoxAcl(`${id}-${grant.lane}-grant`, {
     path: "/",
     propagate: true,
     roleid: grant.roleid,
@@ -3372,8 +4533,9 @@ var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect
 // src/proxmox/qemu.ts
 import { Resource as Resource28 } from "alchemy";
 import * as Provider28 from "alchemy/Provider";
-import * as Effect50 from "effect/Effect";
+import * as Effect53 from "effect/Effect";
 var ProxmoxVm = Resource28("Proxmox.Vm");
+var createForm5 = (props) => ({ ...shape9(props), vmid: String(props.vmid) });
 var shape9 = (props) => ({
   cores: String(props.cores ?? 1),
   memory: String(props.memory ?? 512),
@@ -3393,16 +4555,20 @@ var handlers24 = pveHandlers({
     vmid: props.vmid
   }),
   collection: (props) => `nodes/${props.node}/qemu`,
-  createForm: (props) => ({ ...shape9(props), vmid: String(props.vmid) }),
+  createForm: createForm5,
+  endpoint: {
+    create: "pve:POST /nodes/{node}/qemu",
+    update: "pve:PUT /nodes/{node}/qemu/{vmid}/config"
+  },
   matches: (attributes2, props) => attributes2.name === (props.name ?? `vm${String(props.vmid)}`) && attributes2.memory === (props.memory ?? 512) && attributes2.cores === (props.cores ?? 1) && attributes2.sockets === (props.sockets ?? 1) && attributes2.onboot === (props.onboot === true),
   path: (props) => `nodes/${props.node}/qemu/${String(props.vmid)}/config`,
   updateForm: shape9
 });
-var ProxmoxVmProvider = () => Provider28.effect(ProxmoxVm, Effect50.succeed(ProxmoxVm.Provider.of(handlers24)));
+var ProxmoxVmProvider = () => Provider28.effect(ProxmoxVm, Effect53.succeed(ProxmoxVm.Provider.of(handlers24)));
 // src/proxmox/replication-job.ts
 import { Resource as Resource29 } from "alchemy";
 import * as Provider29 from "alchemy/Provider";
-import * as Effect51 from "effect/Effect";
+import * as Effect54 from "effect/Effect";
 
 // src/proxmox/replication-job-form.ts
 var DEFAULT_SCHEDULE = "*/15";
@@ -3413,7 +4579,7 @@ var shape10 = (props) => ({
   schedule: props.schedule ?? DEFAULT_SCHEDULE,
   ...props.rate === undefined ? {} : { rate: String(props.rate) }
 });
-var createBody4 = (props) => ({
+var createBody6 = (props) => ({
   ...shape10(props),
   id: jobId(props),
   target: props.targetNode,
@@ -3447,20 +4613,24 @@ var handlers25 = pveHandlers({
     type: text(live["type"], "local")
   }),
   collection: () => "cluster/replication",
-  createForm: createBody4,
+  createForm: createBody6,
+  endpoint: {
+    create: "pve:POST /cluster/replication",
+    update: "pve:PUT /cluster/replication/{id}"
+  },
   matches: (attributes2, props) => attributes2.remove_job === "" && attributes2.schedule === (props.schedule ?? DEFAULT_SCHEDULE) && attributes2.disable === (props.disable === true) && attributes2.comment === (props.comment ?? "") && (props.rate === undefined || attributes2.rate === props.rate),
   path: (props) => `cluster/replication/${jobId(props)}`,
   updateForm: updateBody5
 });
-var ProxmoxReplicationJobProvider = () => Provider29.effect(ProxmoxReplicationJob, Effect51.succeed(ProxmoxReplicationJob.Provider.of(handlers25)));
+var ProxmoxReplicationJobProvider = () => Provider29.effect(ProxmoxReplicationJob, Effect54.succeed(ProxmoxReplicationJob.Provider.of(handlers25)));
 // src/proxmox/sdn-apply.ts
 import { Resource as Resource30 } from "alchemy";
 import { isResolved as isResolved10 } from "alchemy/Diff";
 import * as Provider30 from "alchemy/Provider";
-import * as Effect53 from "effect/Effect";
+import * as Effect56 from "effect/Effect";
 
 // src/proxmox/sdn-apply-read.ts
-import * as Effect52 from "effect/Effect";
+import * as Effect55 from "effect/Effect";
 var MARKED = [
   "cluster/sdn/zones",
   "cluster/sdn/vnets",
@@ -3469,7 +4639,7 @@ var MARKED = [
   "cluster/sdn/route-maps"
 ];
 var subsystemAbsent = (error) => error instanceof PveError && error.status === 501;
-var markedPending = (target) => Effect52.all(MARKED.map((collection2) => pve(target, "read", "GET", `${collection2}?pending=1`).pipe(Effect52.map((rows) => (rows ?? []).filter((row) => row.state !== undefined).length), Effect52.catchIf(subsystemAbsent, () => Effect52.succeed(0)))), { concurrency: "unbounded" }).pipe(Effect52.map((counts) => counts.reduce((total, count2) => total + count2, 0)));
+var markedPending = (target) => Effect55.all(MARKED.map((collection2) => pve(target, "read", "GET", `${collection2}?pending=1`).pipe(Effect55.map((rows) => (rows ?? []).filter((row) => row.state !== undefined).length), Effect55.catchIf(subsystemAbsent, () => Effect55.succeed(0)))), { concurrency: "unbounded" }).pipe(Effect55.map((counts) => counts.reduce((total, count2) => total + count2, 0)));
 var fabricStaged = (staged, running) => {
   if (staged === undefined && running === undefined)
     return 0;
@@ -3477,9 +4647,9 @@ var fabricStaged = (staged, running) => {
     return "inconsistent";
   return staged === running ? 0 : 1;
 };
-var fabricPending = (target) => Effect52.all(["pending", "running"].map((view) => pve(target, "read", "GET", `cluster/sdn/fabrics/all?${view}=1`).pipe(Effect52.map(canonical3), Effect52.catchIf(subsystemAbsent, () => Effect52.succeed(undefined)))), { concurrency: "unbounded" }).pipe(Effect52.flatMap(([staged, running]) => {
+var fabricPending = (target) => Effect55.all(["pending", "running"].map((view) => pve(target, "read", "GET", `cluster/sdn/fabrics/all?${view}=1`).pipe(Effect55.map(canonical3), Effect55.catchIf(subsystemAbsent, () => Effect55.succeed(undefined)))), { concurrency: "unbounded" }).pipe(Effect55.flatMap(([staged, running]) => {
   const verdict = fabricStaged(staged, running);
-  return verdict === "inconsistent" ? Effect52.die(new Error("cluster/sdn/fabrics/all answered 501 for one of ?pending=1 and ?running=1 and not " + "the other. Refusing to read that as a staged fabric change.")) : Effect52.succeed(verdict);
+  return verdict === "inconsistent" ? Effect55.die(new Error("cluster/sdn/fabrics/all answered 501 for one of ?pending=1 and ?running=1 and not " + "the other. Refusing to read that as a staged fabric change.")) : Effect55.succeed(verdict);
 }));
 var canonical3 = (value) => JSON.stringify(sortDeep(value));
 var sortDeep = (value) => {
@@ -3492,39 +4662,40 @@ var sortDeep = (value) => {
   }
   return value;
 };
-var sdnPendingCount = (target) => Effect52.all([markedPending(target), fabricPending(target)], { concurrency: "unbounded" }).pipe(Effect52.map(([marked, fabric]) => marked + fabric));
+var sdnPendingCount = (target) => Effect55.all([markedPending(target), fabricPending(target)], { concurrency: "unbounded" }).pipe(Effect55.map(([marked, fabric]) => marked + fabric));
 
 // src/proxmox/sdn-apply.ts
 var ProxmoxSdnApply = Resource30("Proxmox.SdnApply");
-var read3 = (props) => sdnPendingCount(props.target).pipe(Effect53.map((pending) => ({ pending })));
-var ProxmoxSdnApplyProvider = () => Provider30.effect(ProxmoxSdnApply, Effect53.succeed(ProxmoxSdnApply.Provider.of({
-  list: () => Effect53.succeed([]),
-  read: Effect53.fn(function* ({ olds }) {
+var read3 = (props) => sdnPendingCount(props.target).pipe(Effect56.map((pending) => ({ pending })));
+var ProxmoxSdnApplyProvider = () => Provider30.effect(ProxmoxSdnApply, Effect56.succeed(ProxmoxSdnApply.Provider.of({
+  list: () => Effect56.succeed([]),
+  read: Effect56.fn(function* ({ olds }) {
     return yield* read3(olds);
   }),
-  diff: Effect53.fn(function* ({ news }) {
+  diff: Effect56.fn(function* ({ news }) {
     if (!isResolved10(news))
       return;
     const { pending } = yield* read3(news);
     return pending === 0 ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect53.fn(function* ({ news }) {
+  reconcile: Effect56.fn(function* ({ news }) {
     const staged = yield* read3(news);
     if (staged.pending === 0)
       return staged;
+    yield* guardSdnApply;
     yield* pve(news.target, "provision", "PUT", "cluster/sdn");
     const after = yield* read3(news);
     if (after.pending !== 0) {
-      return yield* Effect53.die(new Error(`PUT /cluster/sdn returned no error but ${String(after.pending)} SDN object(s) ` + "are still staged. The running config does not match the declared one -- check " + "`pvesh get /cluster/sdn/zones --pending 1` for the objects PVE refused."));
+      return yield* Effect56.die(new Error(`PUT /cluster/sdn returned no error but ${String(after.pending)} SDN object(s) ` + "are still staged. The running config does not match the declared one -- check " + "`pvesh get /cluster/sdn/zones --pending 1` for the objects PVE refused."));
     }
     return after;
   }),
-  delete: () => Effect53.void
+  delete: () => Effect56.void
 })));
 // src/proxmox/sdn-subnet.ts
 import { Resource as Resource31 } from "alchemy";
 import * as Provider31 from "alchemy/Provider";
-import * as Effect54 from "effect/Effect";
+import * as Effect57 from "effect/Effect";
 
 // src/proxmox/sdn-subnet-form.ts
 var subnetId = (props) => `${props.zone}-${props.cidr.replace("/", "-")}`;
@@ -3543,7 +4714,7 @@ var body5 = (props) => ({
   vnet: props.vnet,
   ...Object.fromEntries(Object.entries(optional3(props)).filter((entry) => entry[1] !== undefined))
 });
-var createForm5 = (props) => ({
+var createForm6 = (props) => ({
   ...body5(props),
   subnet: props.cidr,
   type: "subnet"
@@ -3575,16 +4746,20 @@ var handlers26 = pveHandlers({
     };
   },
   collection: (props) => `cluster/sdn/vnets/${props.vnet}/subnets`,
-  createForm: createForm5,
+  createForm: createForm6,
+  endpoint: {
+    create: "pve:POST /cluster/sdn/vnets/{vnet}/subnets",
+    update: "pve:PUT /cluster/sdn/vnets/{vnet}/subnets/{subnet}"
+  },
   matches: (attributes2, props) => attributes2.gateway === (props.gateway ?? "") && attributes2.snat === (props.snat === true) && attributes2.dnszoneprefix === (props.dnszoneprefix ?? "") && attributes2.dhcpDnsServer === (props.dhcpDnsServer ?? "") && attributes2.dhcpRange === declaredRanges(props.dhcpRange),
   path: (props) => `cluster/sdn/vnets/${props.vnet}/subnets/${subnetId(props)}`,
   updateForm: updateForm2
 });
-var ProxmoxSdnSubnetProvider = () => Provider31.effect(ProxmoxSdnSubnet, Effect54.succeed(ProxmoxSdnSubnet.Provider.of(handlers26)));
+var ProxmoxSdnSubnetProvider = () => Provider31.effect(ProxmoxSdnSubnet, Effect57.succeed(ProxmoxSdnSubnet.Provider.of(handlers26)));
 // src/proxmox/sdn-vnet.ts
 import { Resource as Resource32 } from "alchemy";
 import * as Provider32 from "alchemy/Provider";
-import * as Effect55 from "effect/Effect";
+import * as Effect58 from "effect/Effect";
 var ProxmoxSdnVnet = Resource32("Proxmox.SdnVnet");
 var tagOf = (value) => typeof value === "number" ? value : undefined;
 var shape11 = (props) => {
@@ -3617,15 +4792,16 @@ var handlers27 = pveHandlers({
   }),
   collection: () => "cluster/sdn/vnets",
   createForm: (props) => ({ ...shape11(props), vnet: props.vnet }),
+  endpoint: { create: "pve:POST /cluster/sdn/vnets", update: "pve:PUT /cluster/sdn/vnets/{vnet}" },
   matches: (attributes2, props) => attributes2.zone === props.zone && attributes2.alias === (props.alias ?? "") && attributes2.tag === props.tag && attributes2.vlanaware === (props.vlanaware === true) && attributes2.isolatePorts === (props.isolatePorts === true),
   path: (props) => `cluster/sdn/vnets/${props.vnet}`,
   updateForm: updateForm3
 });
-var ProxmoxSdnVnetProvider = () => Provider32.effect(ProxmoxSdnVnet, Effect55.succeed(ProxmoxSdnVnet.Provider.of(handlers27)));
+var ProxmoxSdnVnetProvider = () => Provider32.effect(ProxmoxSdnVnet, Effect58.succeed(ProxmoxSdnVnet.Provider.of(handlers27)));
 // src/proxmox/sdn-zone.ts
 import { Resource as Resource33 } from "alchemy";
 import * as Provider33 from "alchemy/Provider";
-import * as Effect56 from "effect/Effect";
+import * as Effect59 from "effect/Effect";
 var ProxmoxSdnZone = Resource33("Proxmox.SdnZone");
 var sameIpam = (live, declared2) => (live === "" ? "pve" : live) === (declared2 === undefined || declared2 === "" ? "pve" : declared2);
 var body6 = (props) => ({
@@ -3669,6 +4845,7 @@ var handlers28 = pveHandlers({
   },
   collection: () => "cluster/sdn/zones",
   createForm: (props) => ({ ...body6(props), type: props.type, zone: props.zone }),
+  endpoint: { create: "pve:POST /cluster/sdn/zones", update: "pve:PUT /cluster/sdn/zones/{zone}" },
   matches: (attributes2, props) => attributes2.mtu === (props.mtu ?? 0) && attributes2.nodes === csv(props.nodes) && sameIpam(attributes2.ipam, props.ipam) && attributes2.dns === (props.dns ?? "") && attributes2.dnszone === (props.dnszone ?? "") && attributes2.peers === csv(props.peers) && attributes2["vrf-vxlan"] === (props["vrf-vxlan"] ?? 0) && attributes2.tag === (props.tag ?? 0) && attributes2.bridge === (props.bridge ?? ""),
   path: (props) => `cluster/sdn/zones/${props.zone}`,
   updateForm: (props) => {
@@ -3677,11 +4854,11 @@ var handlers28 = pveHandlers({
     return withClears(fields, clear);
   }
 });
-var ProxmoxSdnZoneProvider = () => Provider33.effect(ProxmoxSdnZone, Effect56.succeed(ProxmoxSdnZone.Provider.of(handlers28)));
+var ProxmoxSdnZoneProvider = () => Provider33.effect(ProxmoxSdnZone, Effect59.succeed(ProxmoxSdnZone.Provider.of(handlers28)));
 // src/proxmox/storage.ts
 import { Resource as Resource34 } from "alchemy";
 import * as Provider34 from "alchemy/Provider";
-import * as Effect57 from "effect/Effect";
+import * as Effect60 from "effect/Effect";
 var ProxmoxStorage = Resource34("Proxmox.Storage", {
   defaultRemovalPolicy: "retain"
 });
@@ -3722,19 +4899,21 @@ var handlers29 = pveHandlers({
     storage: props.storage,
     type: props.type
   }),
+  endpoint: { create: "pve:POST /storage", update: "pve:PUT /storage/{storage}" },
   matches: (attributes2, props) => sameList2(props.content, attributes2.content) && sameList2(props.nodes, attributes2.nodes) && sameList2(props["prune-backups"], attributes2["prune-backups"]) && same7(props.disable, attributes2.disable) && same7(props.shared, attributes2.shared) && same7(props.preallocation, attributes2.preallocation) && same7(props.comment, attributes2.comment) && same7(props.maxfiles, attributes2.maxfiles),
   path: (props) => `storage/${props.storage}`,
   updateForm: mutable2
 });
-var ProxmoxStorageProvider = () => Provider34.effect(ProxmoxStorage, Effect57.succeed(ProxmoxStorage.Provider.of(handlers29)));
+var ProxmoxStorageProvider = () => Provider34.effect(ProxmoxStorage, Effect60.succeed(ProxmoxStorage.Provider.of(handlers29)));
 // src/proxmox/zfs-pool.ts
 import { Resource as Resource35 } from "alchemy";
 import * as Provider35 from "alchemy/Provider";
-import * as Effect59 from "effect/Effect";
+import * as Effect62 from "effect/Effect";
 
 // src/proxmox/zfs-pool-write.ts
-import * as Effect58 from "effect/Effect";
-var createForm6 = (props) => ({
+import * as Effect61 from "effect/Effect";
+var ZFS_POOL_ENDPOINT = { create: "pve:POST /nodes/{node}/disks/zfs" };
+var createForm7 = (props) => ({
   devices: props.devices.join(","),
   name: props.name,
   raidlevel: props.raidlevel,
@@ -3743,21 +4922,21 @@ var createForm6 = (props) => ({
   ...props["draid-config"] === undefined ? {} : { "draid-config": props["draid-config"] }
 });
 var SETTLE_ATTEMPTS = 30;
-var createPool = (props, collection2, path2, read4) => Effect58.gen(function* () {
+var createPool = (props, collection2, path2, read4) => Effect61.gen(function* () {
   const existing = yield* read4(props);
   if (existing !== undefined)
     return existing;
-  const upid = yield* pve(props.target, "provision", "POST", collection2, createForm6(props));
-  const settle4 = (attempts) => Effect58.gen(function* () {
+  const upid = yield* pve(props.target, "provision", "POST", collection2, createForm7(props));
+  const settle4 = (attempts) => Effect61.gen(function* () {
     const live = yield* read4(props);
     if (live !== undefined || attempts <= 0)
       return live;
-    yield* Effect58.sleep("2 seconds");
+    yield* Effect61.sleep("2 seconds");
     return yield* settle4(attempts - 1);
   });
   const after = yield* settle4(SETTLE_ATTEMPTS);
   if (after === undefined) {
-    return yield* Effect58.die(new Error(`${path2}: POST returned ${text(upid, "(no UPID)")} but the pool has not appeared. That ` + "POST only forks a `zfscreate` worker, so the task holds the real error -- read it " + `with \`pvesh get /nodes/${props.node}/tasks/<upid>/log\`. NOTHING WAS RETRIED AND ` + "NOTHING WAS CLEANED UP: if the worker reached `zpool create`, the declared devices " + "have already been written to."));
+    return yield* Effect61.die(new Error(`${path2}: POST returned ${text(upid, "(no UPID)")} but the pool has not appeared. That ` + "POST only forks a `zfscreate` worker, so the task holds the real error -- read it " + `with \`pvesh get /nodes/${props.node}/tasks/<upid>/log\`. NOTHING WAS RETRIED AND ` + "NOTHING WAS CLEANED UP: if the worker reached `zpool create`, the declared devices " + "have already been written to."));
   }
   return after;
 });
@@ -3785,19 +4964,20 @@ var spec2 = {
     };
   },
   collection: (props) => `nodes/${props.node}/disks/zfs`,
-  createForm: createForm6,
+  createForm: createForm7,
+  endpoint: ZFS_POOL_ENDPOINT,
   matches: () => true,
   path: (props) => `nodes/${props.node}/disks/zfs/${props.name}`
 };
 var ops5 = pveOperations(spec2);
 var handlers30 = {
   ...pveHandlers(spec2),
-  delete: Effect59.fn(function* ({ olds }) {
+  delete: Effect62.fn(function* ({ olds }) {
     yield* destroyPool(olds, spec2.path(olds));
   }),
   reconcile: ({ news }) => createPool(news, spec2.collection(news), spec2.path(news), ops5.read)
 };
-var ProxmoxZfsPoolProvider = () => Provider35.effect(ProxmoxZfsPool, Effect59.succeed(ProxmoxZfsPool.Provider.of(handlers30)));
+var ProxmoxZfsPoolProvider = () => Provider35.effect(ProxmoxZfsPool, Effect62.succeed(ProxmoxZfsPool.Provider.of(handlers30)));
 export {
   PROVISION_DEFAULTS,
   PROVISION_PRIVILEGES,
@@ -3861,10 +5041,13 @@ export {
   ProxmoxVmProvider,
   ProxmoxZfsPoolProvider,
   alertmanagerAlertBody,
+  constraintsFor,
   declareProvisionBaseline,
+  formViolations,
   provisionBaseline,
-  provisionBootstrap
+  provisionBootstrap,
+  violations
 };
 
-//# debugId=98691C143D2F953764756E2164756E21
+//# debugId=35B6C615E87D256B64756E2164756E21
 //# sourceMappingURL=index.js.map