@homeflare/alchemy 0.28.0 → 0.29.0

package/dist/proxmox/index.js

@@ -1,235 +1,12 @@
 // src/proxmox/acl.ts
 import { Resource } from "alchemy";
-import { isResolved as isResolved2 } from "alchemy/Diff";
-import * as Provider from "alchemy/Provider";
-import * as Effect8 from "effect/Effect";
-
-// src/proxmox/client.ts
-import * as Effect4 from "effect/Effect";
-import * as HttpClient5 from "effect/unstable/http/HttpClient";
-import * as HttpClientRequest2 from "effect/unstable/http/HttpClientRequest";
-
-// src/proxmox/credentials.ts
-import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Headers from "effect/unstable/http/Headers";
-import * as HttpClient from "effect/unstable/http/HttpClient";
-import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
-var baoVariable = (env, name) => env[`BAO_${name}`] ?? env[`VAULT_${name}`] ?? "";
-var mint = (target, role, env = process.env) => Effect.gen(function* () {
-  const path = `${target.mount}/creds/${role}`;
-  const refuse = (status2, detail) => new Error(`OpenBao GET /v1/${path} -> ${status2 === 0 ? "no response" : status2}: ${detail}`);
-  const address = baoVariable(env, "AGENT_ADDR") || baoVariable(env, "ADDR") || "https://127.0.0.1:8200";
-  const socket = address.startsWith("unix://") ? address.slice("unix://".length) : undefined;
-  const base = socket === undefined ? address.replace(/\/+$/, "") : "http://localhost";
-  const headers = { "X-Vault-Request": "true" };
-  const namespace = baoVariable(env, "NAMESPACE");
-  if (namespace !== "")
-    headers["X-Vault-Namespace"] = namespace;
-  const token = baoVariable(env, "TOKEN");
-  if (token !== "")
-    headers["X-Vault-Token"] = token;
-  if (socket !== undefined && !("Bun" in globalThis)) {
-    return yield* Effect.fail(refuse(0, "a unix:// address needs Bun fetch; this is not Bun"));
-  }
-  const client = yield* HttpClient.HttpClient;
-  const redacted = yield* Headers.CurrentRedactedNames;
-  const defaults = Option.getOrElse(yield* Effect.serviceOption(FetchHttpClient.RequestInit), () => ({}));
-  const request = HttpClientRequest.get(`${base}/v1/${path}`).pipe(HttpClientRequest.setHeaders(headers));
-  const exchange = client.execute(request).pipe(Effect.flatMap((response) => Effect.map(response.text, (text2) => ({ status: response.status, text: text2 }))), Effect.timeout("60 seconds"), Effect.provideService(Headers.CurrentRedactedNames, [...redacted, "x-vault-token"]));
-  const init = { ...defaults, unix: socket };
-  const { status, text } = yield* (socket === undefined ? exchange : Effect.provideService(exchange, FetchHttpClient.RequestInit, init)).pipe(Effect.mapError((cause) => refuse(0, cause.message)));
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-    parsed = undefined;
-  }
-  if (status < 200 || status >= 300) {
-    const errors = parsed?.errors;
-    const detail = Array.isArray(errors) ? errors.map(String).join("; ") : "not an OpenBao error body";
-    return yield* Effect.fail(refuse(status, detail || "(no errors given)"));
-  }
-  const tokenId = parsed?.data?.token_id;
-  const secret = parsed?.data?.secret;
-  if (typeof tokenId !== "string" || typeof secret !== "string") {
-    return yield* Effect.fail(new Error(`${target.mount}/creds/${role} returned no token_id/secret. Either this approle lacks ` + `the grant, or the mount is not ${target.mount}. Say which mount and role you needed ` + `than falling back to a stored credential -- every stored PVE token is read-only.`));
-  }
-  const lease = parsed?.lease_duration;
-  const leaseSeconds = typeof lease === "number" ? lease : 0;
-  return { leaseSeconds, secret, tokenId };
-});
-var authorization = (credential, target) => target.scheme === "pbs" ? `PBSAPIToken=${credential.tokenId}:${credential.secret}` : `PVEAPIToken=${credential.tokenId}=${credential.secret}`;
-
-// src/proxmox/lease-cache.ts
-import * as Cache from "effect/Cache";
-import * as Duration from "effect/Duration";
-import * as Effect2 from "effect/Effect";
-import * as Exit from "effect/Exit";
-var REMINT_MARGIN_SECONDS = 60;
-var keyOf = (target, role) => ({
-  mount: target.mount,
-  role,
-  scheme: target.scheme
-});
-var timeToLive = (exit) => Exit.isSuccess(exit) && exit.value.leaseSeconds > REMINT_MARGIN_SECONDS ? Duration.seconds(exit.value.leaseSeconds - REMINT_MARGIN_SECONDS) : Duration.zero;
-var makeLeases = (mintFor) => Cache.makeWith(mintFor, { capacity: 64, requireServicesAt: "lookup", timeToLive });
-var targetForKey = (key) => key.scheme === "pbs" ? { api: "https://pbs.invalid/api2/json", mount: key.mount, scheme: "pbs" } : { members: [], mount: key.mount, scheme: "pve" };
-var leases = Effect2.runSync(makeLeases((key) => mint(targetForKey(key), key.role)));
-var leased = (target, role) => Cache.get(leases, keyOf(target, role));
-
-// src/proxmox/members.ts
-import * as Effect3 from "effect/Effect";
-import * as Result from "effect/Result";
-import * as HttpClient3 from "effect/unstable/http/HttpClient";
-import * as HttpClientError from "effect/unstable/http/HttpClientError";
-var PVE_API_PORT = 8006;
-var pveApiBase = (member) => `https://${member}:${String(PVE_API_PORT)}/api2/json`;
-var lastGoodByMount = new Map;
-var noteGoodMember = (target, member) => {
-  lastGoodByMount.set(target.mount, member);
-};
-var orderedMembers = (target) => {
-  const preferred = lastGoodByMount.get(target.mount);
-  if (preferred === undefined || !target.members.includes(preferred))
-    return target.members;
-  return [preferred, ...target.members.filter((member) => member !== preferred)];
-};
-var errorCode = (cause) => {
-  if (cause !== null && typeof cause === "object") {
-    if ("code" in cause && typeof cause.code === "string")
-      return cause.code;
-    if ("cause" in cause)
-      return errorCode(cause.cause);
-  }
-  return;
-};
-var isTimeoutCause = (cause) => {
-  const code = errorCode(cause);
-  if (code === "AbortError" || code === "ETIMEDOUT" || code === "UND_ERR_CONNECT_TIMEOUT") {
-    return true;
-  }
-  return cause instanceof Error && /timed out|timeout/i.test(cause.message);
-};
-var PRE_SEND_CODES = new Set(["ConnectionRefused", "ECONNREFUSED", "ENOTFOUND", "EAI_AGAIN"]);
-var isCertificateCode = (code) => /^(ERR_TLS_CERT_|CERT_|UNABLE_TO_VERIFY_|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT)/.test(code);
-var isPreSendCause = (cause) => {
-  const code = errorCode(cause);
-  return code !== undefined && (PRE_SEND_CODES.has(code) || isCertificateCode(code));
-};
-var isTransportFailure = (cause) => {
-  if (!HttpClientError.isHttpClientError(cause))
-    return false;
-  const tag = cause.reason._tag;
-  return tag === "TransportError" || tag === "InvalidUrlError" || tag === "EncodeError";
-};
-var isPreSendTransport = (cause) => {
-  if (!HttpClientError.isHttpClientError(cause))
-    return false;
-  const { reason } = cause;
-  if (reason._tag === "InvalidUrlError" || reason._tag === "EncodeError")
-    return true;
-  if (reason._tag === "TransportError") {
-    if (isTimeoutCause(reason.cause))
-      return false;
-    return isPreSendCause(reason.cause);
-  }
-  return false;
-};
-var describeTransport = (cause) => {
-  if (HttpClientError.isHttpClientError(cause))
-    return cause.message;
-  return String(cause);
-};
-var executeOnCluster = (target, method, path, build) => Effect3.gen(function* () {
-  const client = yield* HttpClient3.HttpClient;
-  const isWrite = method !== "GET";
-  const attempts = [];
-  for (const member of orderedMembers(target)) {
-    const outcome = yield* client.execute(build(pveApiBase(member))).pipe(Effect3.result);
-    if (Result.isSuccess(outcome)) {
-      noteGoodMember(target, member);
-      return outcome.success;
-    }
-    const why = describeTransport(outcome.failure);
-    attempts.push({ member, why });
-    const mayRetry = isWrite ? isPreSendTransport(outcome.failure) : isTransportFailure(outcome.failure);
-    if (!mayRetry) {
-      return yield* Effect3.fail({ attempts, method, path, tag: "cluster" });
-    }
-  }
-  return yield* Effect3.fail({ attempts, method, path, tag: "cluster" });
-});
-
-// src/proxmox/client.ts
-class PveError extends Error {
-  status;
-  method;
-  path;
-  constructor(status, method, path, detail) {
-    super(`PVE ${method} ${path} -> ${String(status)}: ${detail}`);
-    this.status = status;
-    this.method = method;
-    this.path = path;
-    this.name = "PveError";
-  }
-}
-var clusterExhausted = (method, path, attempts) => new PveError(0, method, path, `all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join("; ")}`);
-var encode = (form) => {
-  const params = new URLSearchParams;
-  for (const [key, value] of Object.entries(form)) {
-    if (typeof value === "string")
-      params.append(key, value);
-    else
-      for (const item of value)
-        params.append(key, item);
-  }
-  return params.toString();
-};
-var buildRequest = (method, apiBase, path, credential, target, form) => {
-  const url = `${apiBase}/${path}`;
-  return HttpClientRequest2.make(method)(url).pipe(HttpClientRequest2.setHeaders({ Authorization: authorization(credential, target) }), form === undefined ? (self) => self : HttpClientRequest2.bodyText(encode(form), "application/x-www-form-urlencoded"));
-};
-var executeOne = (target, credential, method, path, form, apiBase) => Effect4.gen(function* () {
-  const client = yield* HttpClient5.HttpClient;
-  const request = buildRequest(method, apiBase, path, credential, target, form);
-  return yield* client.execute(request).pipe(Effect4.mapError((cause) => new PveError(0, method, path, String(cause))));
-});
-var readResponse = (response, method, path) => Effect4.gen(function* () {
-  if (response.status < 200 || response.status >= 300) {
-    const detail = yield* response.text.pipe(Effect4.orElseSucceed(() => ""));
-    return yield* Effect4.fail(new PveError(response.status, method, path, detail.slice(0, 300)));
-  }
-  const body = yield* response.json.pipe(Effect4.mapError((cause) => new PveError(0, method, path, String(cause))));
-  return body.data;
-});
-var pveWith = (target, credential, method, path, form) => Effect4.gen(function* () {
-  const response = target.scheme === "pve" ? yield* executeOnCluster(target, method, path, (apiBase) => buildRequest(method, apiBase, path, credential, target, form)).pipe(Effect4.mapError((failure) => failure.tag === "cluster" ? clusterExhausted(failure.method, failure.path, failure.attempts) : new PveError(0, method, path, String(failure)))) : yield* executeOne(target, credential, method, path, form, target.api);
-  return yield* readResponse(response, method, path);
-});
-var pveEnvelopeWith = (target, credential, method, path) => Effect4.gen(function* () {
-  const response = yield* executeOnCluster(target, method, path, (apiBase) => buildRequest(method, apiBase, path, credential, target)).pipe(Effect4.mapError((failure) => failure.tag === "cluster" ? clusterExhausted(failure.method, failure.path, failure.attempts) : new PveError(0, method, path, String(failure))));
-  if (response.status < 200 || response.status >= 300) {
-    const detail = yield* response.text.pipe(Effect4.orElseSucceed(() => ""));
-    return yield* Effect4.fail(new PveError(response.status, method, path, detail.slice(0, 300)));
-  }
-  return yield* response.json.pipe(Effect4.mapError((cause) => new PveError(0, method, path, String(cause))));
-});
-var pve = (target, role, method, path, form) => Effect4.gen(function* () {
-  const credential = yield* leased(target, role);
-  return yield* pveWith(target, credential, method, path, form);
-});
-
-// src/proxmox/resource.ts
 import { isResolved } from "alchemy/Diff";
-import * as Effect7 from "effect/Effect";
-
-// src/proxmox/resource-guard.ts
+import * as Provider from "alchemy/Provider";
+import * as access from "@distilled.cloud/proxmox/access";
 import * as Effect6 from "effect/Effect";
 
 // src/proxmox/constraint-guard.ts
-import * as Effect5 from "effect/Effect";
+import * as Effect from "effect/Effect";
 
 // src/proxmox/constraints.ts
 var lengthOf = (value) => [...value].length;
@@ -1187,151 +964,283 @@ var constraintsFor = (key) => {
   return table;
 };
 var formViolations = (key, form, presence) => violations(constraintsFor(key), form, { presence });
-var guardForm = (key, form, presence) => Effect5.suspend(() => {
+var guardForm = (key, form, presence) => Effect.suspend(() => {
   if (key === undefined)
-    return Effect5.void;
+    return Effect.void;
   const found = formViolations(key, form, presence);
-  return found.length === 0 ? Effect5.void : Effect5.die(new Error(refusal(key, found)));
+  return found.length === 0 ? Effect.void : Effect.die(new Error(refusal(key, found)));
 });
 
-// src/proxmox/resource-guard.ts
-var specGuards = (spec) => {
-  const endpointsOf = (props) => typeof spec.endpoint === "function" ? spec.endpoint(props) : spec.endpoint;
-  const guardCreate = (props, presence) => Effect6.suspend(() => {
-    const create = endpointsOf(props)?.create;
-    return create === undefined ? Effect6.void : guardForm(create, spec.createForm(props), presence);
-  });
-  const guardUpdate = (props) => Effect6.suspend(() => {
-    const update = endpointsOf(props)?.update;
-    if (update === undefined)
-      return Effect6.void;
-    const form = spec.updateForm?.(props);
-    return form === undefined ? Effect6.void : guardForm(update, form, false);
-  });
-  return { guardCreate, guardUpdate };
-};
+// src/proxmox/distilled-pve.ts
+import * as Effect5 from "effect/Effect";
+import * as Result2 from "effect/Result";
+import { credentials as distilledPveCredentials } from "@distilled.cloud/proxmox/Credentials";
+import * as ProxmoxRetry from "@distilled.cloud/proxmox/Retry";
 
-// src/proxmox/update-guard.ts
-var formToSend = (matches, live, props, form) => matches(live, props) || Object.keys(form).length === 0 ? undefined : form;
+// src/proxmox/lease-cache.ts
+import * as Cache from "effect/Cache";
+import * as Duration from "effect/Duration";
+import * as Effect3 from "effect/Effect";
+import * as Exit from "effect/Exit";
 
-// src/proxmox/resource.ts
-var pveOperations = (spec) => {
-  const { guardCreate, guardUpdate } = specGuards(spec);
-  const read = (props) => pve(props.target, spec.readRole ?? "read", "GET", spec.path(props)).pipe(Effect7.map((data) => data == null ? undefined : spec.attributes(data, props)), Effect7.orElseSucceed(() => {
-    return;
-  }));
-  return {
-    guardCreate,
-    guardUpdate,
-    read,
-    diff: (news, output) => Effect7.gen(function* () {
-      if (!isResolved(news))
-        return;
-      yield* guardCreate(news, output === undefined);
-      yield* guardUpdate(news);
-      if (output === undefined)
-        return;
-      const live = yield* read(news);
-      if (live === undefined) {
-        yield* guardCreate(news, true);
-        return { action: "update" };
-      }
-      if (spec.matches(live, news))
-        return { action: "noop" };
-      return spec.updateForm === undefined ? { action: "replace" } : { action: "update" };
-    }),
-    reconcile: (news) => Effect7.gen(function* () {
-      const live = yield* read(news);
-      yield* guardCreate(news, live === undefined);
-      yield* guardUpdate(news);
-      if (live === undefined) {
-        yield* pve(news.target, "provision", "POST", spec.collection(news), spec.createForm(news));
-      } else if (spec.updateForm !== undefined) {
-        const form = formToSend(spec.matches, live, news, spec.updateForm(news));
-        if (form !== undefined) {
-          yield* pve(news.target, "provision", "PUT", spec.path(news), form);
-        }
-      }
-      const after = yield* read(news);
-      if (after === undefined) {
-        return yield* Effect7.die(new Error(`${spec.path(news)}: the write returned no error but the object is still absent. ` + 'PVE wraps every answer in {"data":...} and can report success on a call that did ' + "nothing -- read back rather than trusting the status code."));
-      }
-      return after;
-    }),
-    destroy: (olds) => pve(olds.target, "provision", "DELETE", spec.path(olds))
-  };
+// src/proxmox/credentials.ts
+import * as Effect2 from "effect/Effect";
+import * as Option from "effect/Option";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Headers from "effect/unstable/http/Headers";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+var baoVariable = (env, name) => env[`BAO_${name}`] ?? env[`VAULT_${name}`] ?? "";
+var mint = (target, role, env = process.env) => Effect2.gen(function* () {
+  const path = `${target.mount}/creds/${role}`;
+  const refuse = (status2, detail) => new Error(`OpenBao GET /v1/${path} -> ${status2 === 0 ? "no response" : status2}: ${detail}`);
+  const address = baoVariable(env, "AGENT_ADDR") || baoVariable(env, "ADDR") || "https://127.0.0.1:8200";
+  const socket = address.startsWith("unix://") ? address.slice("unix://".length) : undefined;
+  const base = socket === undefined ? address.replace(/\/+$/, "") : "http://localhost";
+  const headers = { "X-Vault-Request": "true" };
+  const namespace = baoVariable(env, "NAMESPACE");
+  if (namespace !== "")
+    headers["X-Vault-Namespace"] = namespace;
+  const token = baoVariable(env, "TOKEN");
+  if (token !== "")
+    headers["X-Vault-Token"] = token;
+  if (socket !== undefined && !("Bun" in globalThis)) {
+    return yield* Effect2.fail(refuse(0, "a unix:// address needs Bun fetch; this is not Bun"));
+  }
+  const client = yield* HttpClient.HttpClient;
+  const redacted = yield* Headers.CurrentRedactedNames;
+  const defaults = Option.getOrElse(yield* Effect2.serviceOption(FetchHttpClient.RequestInit), () => ({}));
+  const request = HttpClientRequest.get(`${base}/v1/${path}`).pipe(HttpClientRequest.setHeaders(headers));
+  const exchange = client.execute(request).pipe(Effect2.flatMap((response) => Effect2.map(response.text, (text2) => ({ status: response.status, text: text2 }))), Effect2.timeout("60 seconds"), Effect2.provideService(Headers.CurrentRedactedNames, [...redacted, "x-vault-token"]));
+  const init = { ...defaults, unix: socket };
+  const { status, text } = yield* (socket === undefined ? exchange : Effect2.provideService(exchange, FetchHttpClient.RequestInit, init)).pipe(Effect2.mapError((cause) => refuse(0, cause.message)));
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    parsed = undefined;
+  }
+  if (status < 200 || status >= 300) {
+    const errors = parsed?.errors;
+    const detail = Array.isArray(errors) ? errors.map(String).join("; ") : "not an OpenBao error body";
+    return yield* Effect2.fail(refuse(status, detail || "(no errors given)"));
+  }
+  const tokenId = parsed?.data?.token_id;
+  const secret = parsed?.data?.secret;
+  if (typeof tokenId !== "string" || typeof secret !== "string") {
+    return yield* Effect2.fail(new Error(`${target.mount}/creds/${role} returned no token_id/secret. Either this approle lacks ` + `the grant, or the mount is not ${target.mount}. Say which mount and role you needed ` + `than falling back to a stored credential -- every stored PVE token is read-only.`));
+  }
+  const lease = parsed?.lease_duration;
+  const leaseSeconds = typeof lease === "number" ? lease : 0;
+  return { leaseSeconds, secret, tokenId };
+});
+var authorization = (credential, target) => target.scheme === "pbs" ? `PBSAPIToken=${credential.tokenId}:${credential.secret}` : `PVEAPIToken=${credential.tokenId}=${credential.secret}`;
+
+// src/proxmox/lease-cache.ts
+var REMINT_MARGIN_SECONDS = 60;
+var keyOf = (target, role) => ({
+  mount: target.mount,
+  role,
+  scheme: target.scheme
+});
+var timeToLive = (exit) => Exit.isSuccess(exit) && exit.value.leaseSeconds > REMINT_MARGIN_SECONDS ? Duration.seconds(exit.value.leaseSeconds - REMINT_MARGIN_SECONDS) : Duration.zero;
+var makeLeases = (mintFor) => Cache.makeWith(mintFor, { capacity: 64, requireServicesAt: "lookup", timeToLive });
+var targetForKey = (key) => key.scheme === "pbs" ? { api: "https://pbs.invalid/api2/json", mount: key.mount, scheme: "pbs" } : { members: [], mount: key.mount, scheme: "pve" };
+var leases = Effect3.runSync(makeLeases((key) => mint(targetForKey(key), key.role)));
+var leased = (target, role) => Cache.get(leases, keyOf(target, role));
+
+// src/proxmox/members.ts
+import * as Cause from "effect/Cause";
+import * as Effect4 from "effect/Effect";
+import * as Result from "effect/Result";
+import * as HttpClient3 from "effect/unstable/http/HttpClient";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+var PVE_API_PORT = 8006;
+var pveApiBase = (member) => `https://${member}:${String(PVE_API_PORT)}/api2/json`;
+var MEMBER_TIMEOUT = "20 seconds";
+var lastGoodByMount = new Map;
+var noteGoodMember = (target, member) => {
+  lastGoodByMount.set(target.mount, member);
 };
-var pveHandlers = (spec) => {
-  const ops = pveOperations(spec);
-  return {
-    list: () => Effect7.succeed([]),
-    read: ({ olds }) => ops.read(olds),
-    diff: ({ news, output }) => ops.diff(news, output),
-    reconcile: ({ news }) => ops.reconcile(news),
-    delete: ({ olds }) => ops.destroy(olds)
-  };
+var orderedMembers = (target) => {
+  const preferred = lastGoodByMount.get(target.mount);
+  if (preferred === undefined || !target.members.includes(preferred))
+    return target.members;
+  return [preferred, ...target.members.filter((member) => member !== preferred)];
 };
+var errorCode = (cause) => {
+  if (cause !== null && typeof cause === "object") {
+    if ("code" in cause && typeof cause.code === "string")
+      return cause.code;
+    if ("cause" in cause)
+      return errorCode(cause.cause);
+  }
+  return;
+};
+var isTimeoutCause = (cause) => {
+  const code = errorCode(cause);
+  if (code === "AbortError" || code === "ETIMEDOUT" || code === "UND_ERR_CONNECT_TIMEOUT") {
+    return true;
+  }
+  return cause instanceof Error && /timed out|timeout/i.test(cause.message);
+};
+var PRE_SEND_CODES = new Set(["ConnectionRefused", "ECONNREFUSED", "ENOTFOUND", "EAI_AGAIN"]);
+var isCertificateCode = (code) => /^(ERR_TLS_CERT_|CERT_|UNABLE_TO_VERIFY_|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT)/.test(code);
+var isPreSendCause = (cause) => {
+  const code = errorCode(cause);
+  return code !== undefined && (PRE_SEND_CODES.has(code) || isCertificateCode(code));
+};
+var isTransportFailure = (cause) => {
+  if (Cause.isTimeoutError(cause))
+    return true;
+  if (!HttpClientError.isHttpClientError(cause))
+    return false;
+  const tag = cause.reason._tag;
+  return tag === "TransportError" || tag === "InvalidUrlError" || tag === "EncodeError";
+};
+var isPreSendTransport = (cause) => {
+  if (!HttpClientError.isHttpClientError(cause))
+    return false;
+  const { reason } = cause;
+  if (reason._tag === "InvalidUrlError" || reason._tag === "EncodeError")
+    return true;
+  if (reason._tag === "TransportError") {
+    if (isTimeoutCause(reason.cause))
+      return false;
+    return isPreSendCause(reason.cause);
+  }
+  return false;
+};
+var describeTransport = (cause) => {
+  if (Cause.isTimeoutError(cause))
+    return `timed out after ${String(MEMBER_TIMEOUT)}`;
+  if (HttpClientError.isHttpClientError(cause))
+    return cause.message;
+  return String(cause);
+};
+var executeOnCluster = (target, method, path, build, timeout3 = MEMBER_TIMEOUT) => Effect4.gen(function* () {
+  const client = yield* HttpClient3.HttpClient;
+  const isWrite = method !== "GET";
+  const attempts = [];
+  for (const member of orderedMembers(target)) {
+    const outcome = yield* client.execute(build(pveApiBase(member))).pipe(Effect4.timeout(timeout3), Effect4.result);
+    if (Result.isSuccess(outcome)) {
+      noteGoodMember(target, member);
+      return outcome.success;
+    }
+    const why = describeTransport(outcome.failure);
+    attempts.push({ member, why });
+    const mayRetry = isWrite ? isPreSendTransport(outcome.failure) : isTransportFailure(outcome.failure);
+    if (!mayRetry) {
+      return yield* Effect4.fail({ attempts, method, path, tag: "cluster" });
+    }
+  }
+  return yield* Effect4.fail({ attempts, method, path, tag: "cluster" });
+});
+
+// src/proxmox/distilled-pve.ts
+class PveClusterExhausted extends Error {
+  attempts;
+  constructor(attempts) {
+    super(`all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join("; ")}`);
+    this.attempts = attempts;
+    this.name = "PveClusterExhausted";
+  }
+}
+var runPveWith = (target, credential, isWrite, op, timeout4 = MEMBER_TIMEOUT) => Effect5.gen(function* () {
+  const attempts = [];
+  for (const member of orderedMembers(target)) {
+    const credLayer = distilledPveCredentials({
+      baseUrl: pveApiBase(member),
+      secret: credential.secret,
+      tokenId: credential.tokenId
+    });
+    const outcome = yield* op.pipe(ProxmoxRetry.none, Effect5.provide(credLayer), Effect5.timeout(timeout4), Effect5.result);
+    if (Result2.isSuccess(outcome)) {
+      noteGoodMember(target, member);
+      return outcome.success;
+    }
+    const mayRetry = isWrite ? isPreSendTransport(outcome.failure) : isTransportFailure(outcome.failure);
+    if (!mayRetry)
+      return yield* Effect5.fail(outcome.failure);
+    attempts.push({ member, why: describeTransport(outcome.failure) });
+  }
+  return yield* Effect5.fail(new PveClusterExhausted(attempts));
+});
+var runPve = (target, role, isWrite, op) => Effect5.gen(function* () {
+  const credential = yield* leased(target, role);
+  return yield* runPveWith(target, credential, isWrite, op);
+});
 
 // src/proxmox/acl.ts
 var ProxmoxAcl = Resource("Proxmox.Acl");
 var normalize = (raw) => `/${raw.split("/").filter(Boolean).join("/")}`;
 var SUBJECT_FIELD = { group: "groups", token: "tokens", user: "users" };
+var ENDPOINT = "pve:PUT /access/acl";
 var tuple = (props) => ({
   path: normalize(props.path),
   roles: props.roleid,
   [SUBJECT_FIELD[props.type]]: props.ugid
 });
 var bind = (props) => ({
-  propagate: props.propagate === false ? "0" : "1",
-  ...tuple(props)
+  ...tuple(props),
+  propagate: props.propagate === false ? "0" : "1"
 });
+var asForm = (body) => Object.fromEntries(Object.entries(body).filter((e) => e[1] !== undefined));
+var guardWrite = (props) => guardForm(ENDPOINT, asForm(bind(props)), true);
 var identity = (grant) => [normalize(grant.path), grant.type, grant.ugid, grant.roleid].join(" ");
-var find = (live, props) => (Array.isArray(live) ? live : []).filter((row) => typeof row === "object" && row !== null).find((row) => row["path"] === normalize(props.path) && row["type"] === props.type && row["ugid"] === props.ugid && row["roleid"] === props.roleid);
+var find = (rows, props) => rows.find((row) => row.path === normalize(props.path) && row.type === props.type && row.ugid === props.ugid && row.roleid === props.roleid);
 var propagates = (row) => {
-  const value = row["propagate"];
+  const value = row.propagate;
   return value === undefined || value === 1 || value === true || value === "1";
 };
-var ops = pveOperations({
-  attributes: (live, props) => {
-    const row = find(live, props);
-    return {
-      bound: row !== undefined,
-      path: normalize(props.path),
-      propagate: row !== undefined && propagates(row),
-      roleid: props.roleid,
-      type: props.type,
-      ugid: props.ugid
-    };
-  },
-  readRole: "provision",
-  collection: () => "access/acl",
-  createForm: bind,
-  endpoint: { create: "pve:PUT /access/acl", update: "pve:PUT /access/acl" },
-  matches: (attributes, props) => attributes.bound && attributes.propagate === (props.propagate !== false),
-  path: () => "access/acl",
-  updateForm: bind
-});
-var ProxmoxAclProvider = () => Provider.effect(ProxmoxAcl, Effect8.succeed(ProxmoxAcl.Provider.of({
-  list: () => Effect8.succeed([]),
-  read: Effect8.fn(function* ({ olds }) {
-    return yield* ops.read(olds);
+var attributesOf = (rows, props) => {
+  const row = find(rows, props);
+  return {
+    bound: row !== undefined,
+    path: normalize(props.path),
+    propagate: row !== undefined && propagates(row),
+    roleid: props.roleid,
+    type: props.type,
+    ugid: props.ugid
+  };
+};
+var matches = (attributes, props) => attributes.bound && attributes.propagate === (props.propagate !== false);
+var readAttributes = (props) => runPve(props.target, "provision", false, access.listAccessAcl({})).pipe(Effect6.map((rows) => attributesOf(rows, props)), Effect6.orElseSucceed(() => {
+  return;
+}));
+var ProxmoxAclProvider = () => Provider.effect(ProxmoxAcl, Effect6.succeed(ProxmoxAcl.Provider.of({
+  list: () => Effect6.succeed([]),
+  read: Effect6.fn(function* ({ olds }) {
+    return yield* readAttributes(olds);
   }),
-  diff: Effect8.fn(function* ({ news, output }) {
-    if (output !== undefined && isResolved2(news) && identity(news) !== identity(output)) {
+  diff: Effect6.fn(function* ({ news, output }) {
+    if (output !== undefined && isResolved(news) && identity(news) !== identity(output)) {
       return { action: "replace" };
     }
-    return yield* ops.diff(news, output);
+    if (!isResolved(news))
+      return;
+    yield* guardWrite(news);
+    if (output === undefined)
+      return;
+    const live = yield* readAttributes(news);
+    return live !== undefined && matches(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect8.fn(function* ({ news }) {
-    const after = yield* ops.reconcile(news);
-    if (!after.bound) {
-      return yield* Effect8.die(new Error(`access/acl: the write returned no error but ${identity(news)} is still not ` + "bound. Either the PUT did nothing, or the read credential cannot see the " + "grant -- GET /access/acl is filtered to paths you may MODIFY permissions on, " + "so a read-only role is answered [] rather than 403."));
+  reconcile: Effect6.fn(function* ({ news }) {
+    const before = yield* readAttributes(news);
+    yield* guardWrite(news);
+    if (before === undefined || !matches(before, news)) {
+      yield* runPve(news.target, "provision", true, access.putAccessAcl(bind(news)));
+    }
+    const after = yield* readAttributes(news);
+    if (after === undefined || !after.bound) {
+      return yield* Effect6.die(new Error(`access/acl: the write returned no error but ${identity(news)} is still not ` + "bound. Either the PUT did nothing, or the read credential cannot see the " + "grant -- GET /access/acl is filtered to paths you may MODIFY permissions on, " + "so a read-only role is answered [] rather than 403."));
     }
     return after;
   }),
-  delete: Effect8.fn(function* ({ olds }) {
-    const removal = { delete: "1", ...tuple(olds) };
-    yield* pve(olds.target, "provision", "PUT", "access/acl", removal);
+  delete: Effect6.fn(function* ({ olds }) {
+    const removal = { ...tuple(olds), delete: "1" };
+    yield* runPve(olds.target, "provision", true, access.putAccessAcl(removal));
   })
 })));
 // src/proxmox/alertmanager-body.ts
@@ -1387,7 +1296,7 @@ var alertmanagerAlertBody = (options = {}) => {
 // src/proxmox/api-token.ts
 import { Resource as Resource2 } from "alchemy";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect9 from "effect/Effect";
+import * as Effect10 from "effect/Effect";
 
 // src/proxmox/values.ts
 var num = (value, fallback) => typeof value === "number" ? value : fallback;
@@ -1464,26 +1373,171 @@ var apiTokenSpec = {
   updateForm: shape
 };
 
+// src/proxmox/resource.ts
+import { isResolved as isResolved2 } from "alchemy/Diff";
+import * as Effect9 from "effect/Effect";
+
+// src/proxmox/client.ts
+import * as Effect7 from "effect/Effect";
+import * as HttpClient5 from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest2 from "effect/unstable/http/HttpClientRequest";
+class PveError extends Error {
+  status;
+  method;
+  path;
+  constructor(status, method, path, detail) {
+    super(`PVE ${method} ${path} -> ${String(status)}: ${detail}`);
+    this.status = status;
+    this.method = method;
+    this.path = path;
+    this.name = "PveError";
+  }
+}
+var clusterExhausted = (method, path, attempts) => new PveError(0, method, path, `all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join("; ")}`);
+var encode = (form) => {
+  const params = new URLSearchParams;
+  for (const [key, value] of Object.entries(form)) {
+    if (typeof value === "string")
+      params.append(key, value);
+    else
+      for (const item of value)
+        params.append(key, item);
+  }
+  return params.toString();
+};
+var buildRequest = (method, apiBase, path, credential, target, form) => {
+  const url = `${apiBase}/${path}`;
+  return HttpClientRequest2.make(method)(url).pipe(HttpClientRequest2.setHeaders({ Authorization: authorization(credential, target) }), form === undefined ? (self) => self : HttpClientRequest2.bodyText(encode(form), "application/x-www-form-urlencoded"));
+};
+var executeOne = (target, credential, method, path, form, apiBase) => Effect7.gen(function* () {
+  const client = yield* HttpClient5.HttpClient;
+  const request = buildRequest(method, apiBase, path, credential, target, form);
+  return yield* client.execute(request).pipe(Effect7.mapError((cause) => new PveError(0, method, path, String(cause))));
+});
+var readResponse = (response, method, path) => Effect7.gen(function* () {
+  if (response.status < 200 || response.status >= 300) {
+    const detail = yield* response.text.pipe(Effect7.orElseSucceed(() => ""));
+    return yield* Effect7.fail(new PveError(response.status, method, path, detail.slice(0, 300)));
+  }
+  const body = yield* response.json.pipe(Effect7.mapError((cause) => new PveError(0, method, path, String(cause))));
+  return body.data;
+});
+var pveWith = (target, credential, method, path, form) => Effect7.gen(function* () {
+  const response = target.scheme === "pve" ? yield* executeOnCluster(target, method, path, (apiBase) => buildRequest(method, apiBase, path, credential, target, form)).pipe(Effect7.mapError((failure) => failure.tag === "cluster" ? clusterExhausted(failure.method, failure.path, failure.attempts) : new PveError(0, method, path, String(failure)))) : yield* executeOne(target, credential, method, path, form, target.api);
+  return yield* readResponse(response, method, path);
+});
+var pveEnvelopeWith = (target, credential, method, path) => Effect7.gen(function* () {
+  const response = yield* executeOnCluster(target, method, path, (apiBase) => buildRequest(method, apiBase, path, credential, target)).pipe(Effect7.mapError((failure) => failure.tag === "cluster" ? clusterExhausted(failure.method, failure.path, failure.attempts) : new PveError(0, method, path, String(failure))));
+  if (response.status < 200 || response.status >= 300) {
+    const detail = yield* response.text.pipe(Effect7.orElseSucceed(() => ""));
+    return yield* Effect7.fail(new PveError(response.status, method, path, detail.slice(0, 300)));
+  }
+  return yield* response.json.pipe(Effect7.mapError((cause) => new PveError(0, method, path, String(cause))));
+});
+var pve = (target, role, method, path, form) => Effect7.gen(function* () {
+  const credential = yield* leased(target, role);
+  return yield* pveWith(target, credential, method, path, form);
+});
+
+// src/proxmox/resource-guard.ts
+import * as Effect8 from "effect/Effect";
+var specGuards = (spec) => {
+  const endpointsOf = (props) => typeof spec.endpoint === "function" ? spec.endpoint(props) : spec.endpoint;
+  const guardCreate = (props, presence) => Effect8.suspend(() => {
+    const create = endpointsOf(props)?.create;
+    return create === undefined ? Effect8.void : guardForm(create, spec.createForm(props), presence);
+  });
+  const guardUpdate = (props) => Effect8.suspend(() => {
+    const update = endpointsOf(props)?.update;
+    if (update === undefined)
+      return Effect8.void;
+    const form = spec.updateForm?.(props);
+    return form === undefined ? Effect8.void : guardForm(update, form, false);
+  });
+  return { guardCreate, guardUpdate };
+};
+
+// src/proxmox/update-guard.ts
+var formToSend = (matches2, live, props, form) => matches2(live, props) || Object.keys(form).length === 0 ? undefined : form;
+
+// src/proxmox/resource.ts
+var pveOperations = (spec) => {
+  const { guardCreate, guardUpdate } = specGuards(spec);
+  const read = (props) => pve(props.target, spec.readRole ?? "read", "GET", spec.path(props)).pipe(Effect9.map((data) => data == null ? undefined : spec.attributes(data, props)), Effect9.orElseSucceed(() => {
+    return;
+  }));
+  return {
+    guardCreate,
+    guardUpdate,
+    read,
+    diff: (news, output) => Effect9.gen(function* () {
+      if (!isResolved2(news))
+        return;
+      yield* guardCreate(news, output === undefined);
+      yield* guardUpdate(news);
+      if (output === undefined)
+        return;
+      const live = yield* read(news);
+      if (live === undefined) {
+        yield* guardCreate(news, true);
+        return { action: "update" };
+      }
+      if (spec.matches(live, news))
+        return { action: "noop" };
+      return spec.updateForm === undefined ? { action: "replace" } : { action: "update" };
+    }),
+    reconcile: (news) => Effect9.gen(function* () {
+      const live = yield* read(news);
+      yield* guardCreate(news, live === undefined);
+      yield* guardUpdate(news);
+      if (live === undefined) {
+        yield* pve(news.target, "provision", "POST", spec.collection(news), spec.createForm(news));
+      } else if (spec.updateForm !== undefined) {
+        const form = formToSend(spec.matches, live, news, spec.updateForm(news));
+        if (form !== undefined) {
+          yield* pve(news.target, "provision", "PUT", spec.path(news), form);
+        }
+      }
+      const after = yield* read(news);
+      if (after === undefined) {
+        return yield* Effect9.die(new Error(`${spec.path(news)}: the write returned no error but the object is still absent. ` + 'PVE wraps every answer in {"data":...} and can report success on a call that did ' + "nothing -- read back rather than trusting the status code."));
+      }
+      return after;
+    }),
+    destroy: (olds) => pve(olds.target, "provision", "DELETE", spec.path(olds))
+  };
+};
+var pveHandlers = (spec) => {
+  const ops = pveOperations(spec);
+  return {
+    list: () => Effect9.succeed([]),
+    read: ({ olds }) => ops.read(olds),
+    diff: ({ news, output }) => ops.diff(news, output),
+    reconcile: ({ news }) => ops.reconcile(news),
+    delete: ({ olds }) => ops.destroy(olds)
+  };
+};
+
 // src/proxmox/api-token.ts
 var ProxmoxApiToken = Resource2("Proxmox.ApiToken", {
   defaultRemovalPolicy: "retain"
 });
-var ops2 = pveOperations(apiTokenSpec);
+var ops = pveOperations(apiTokenSpec);
 var handlers = {
   ...pveHandlers(apiTokenSpec),
-  reconcile: Effect9.fn(function* ({ news }) {
-    const live = yield* ops2.read(news);
+  reconcile: Effect10.fn(function* ({ news }) {
+    const live = yield* ops.read(news);
     if (live === undefined) {
-      return yield* Effect9.die(new Error(`${news.userid}!${news.tokenid}: this resource does not create API tokens. PVE returns ` + "the secret only in the create response and it cannot be stored, so a token made here " + "would be a live credential nobody holds. Create it with `pveum user token add` and " + "capture the value, or mint a short-lived one from the OpenBao proxmox mount " + "(`bao read proxmox-c1/creds/<role>`) -- then declare it here to manage it."));
+      return yield* Effect10.die(new Error(`${news.userid}!${news.tokenid}: this resource does not create API tokens. PVE returns ` + "the secret only in the create response and it cannot be stored, so a token made here " + "would be a live credential nobody holds. Create it with `pveum user token add` and " + "capture the value, or mint a short-lived one from the OpenBao proxmox mount " + "(`bao read proxmox-c1/creds/<role>`) -- then declare it here to manage it."));
     }
-    return yield* ops2.reconcile(news);
+    return yield* ops.reconcile(news);
   })
 };
-var ProxmoxApiTokenProvider = () => Provider2.effect(ProxmoxApiToken, Effect9.succeed(ProxmoxApiToken.Provider.of(handlers)));
+var ProxmoxApiTokenProvider = () => Provider2.effect(ProxmoxApiToken, Effect10.succeed(ProxmoxApiToken.Provider.of(handlers)));
 // src/proxmox/backup-job.ts
 import { Resource as Resource3 } from "alchemy";
 import * as Provider3 from "alchemy/Provider";
-import * as Effect10 from "effect/Effect";
+import * as Effect11 from "effect/Effect";
 var ProxmoxBackupJob = Resource3("Proxmox.BackupJob");
 var shape2 = (props) => ({
   all: props.all === true ? "1" : "0",
@@ -1527,11 +1581,11 @@ var handlers2 = pveHandlers({
   path: (props) => `cluster/backup/${props.id}`,
   updateForm: shape2
 });
-var ProxmoxBackupJobProvider = () => Provider3.effect(ProxmoxBackupJob, Effect10.succeed(ProxmoxBackupJob.Provider.of(handlers2)));
+var ProxmoxBackupJobProvider = () => Provider3.effect(ProxmoxBackupJob, Effect11.succeed(ProxmoxBackupJob.Provider.of(handlers2)));
 // src/proxmox/ceph-daemon.ts
 import { Resource as Resource4 } from "alchemy";
 import * as Provider4 from "alchemy/Provider";
-import * as Effect11 from "effect/Effect";
+import * as Effect12 from "effect/Effect";
 
 // src/proxmox/ceph-daemon-form.ts
 var DAEMON_ENDPOINTS = {
@@ -1582,14 +1636,14 @@ var handlers3 = pveHandlers({
   matches: () => true,
   path: collectionPath
 });
-var ProxmoxCephDaemonProvider = () => Provider4.effect(ProxmoxCephDaemon, Effect11.succeed(ProxmoxCephDaemon.Provider.of({
+var ProxmoxCephDaemonProvider = () => Provider4.effect(ProxmoxCephDaemon, Effect12.succeed(ProxmoxCephDaemon.Provider.of({
   ...handlers3,
   delete: ({ olds }) => pve(olds.target, "provision", "DELETE", daemonPath(olds))
 })));
 // src/proxmox/ceph-flag.ts
 import { Resource as Resource5 } from "alchemy";
 import * as Provider5 from "alchemy/Provider";
-import * as Effect12 from "effect/Effect";
+import * as Effect13 from "effect/Effect";
 var ProxmoxCephFlag = Resource5("Proxmox.CephFlag");
 var handlers4 = pveHandlers({
   attributes: (live, props) => ({ flag: props.flag, value: bool(live) }),
@@ -1600,13 +1654,13 @@ var handlers4 = pveHandlers({
   path: (props) => `cluster/ceph/flags/${props.flag}`,
   updateForm: (props) => ({ value: flag(props.value) ?? "0" })
 });
-var ProxmoxCephFlagProvider = () => Provider5.effect(ProxmoxCephFlag, Effect12.succeed(ProxmoxCephFlag.Provider.of({
+var ProxmoxCephFlagProvider = () => Provider5.effect(ProxmoxCephFlag, Effect13.succeed(ProxmoxCephFlag.Provider.of({
   ...handlers4,
-  delete: () => Effect12.void,
-  reconcile: Effect12.fn(function* ({ news }) {
+  delete: () => Effect13.void,
+  reconcile: Effect13.fn(function* ({ news }) {
     const after = yield* handlers4.reconcile({ news });
     if (after.value !== news.value) {
-      return yield* Effect12.die(new Error(`cluster/ceph/flags/${news.flag}: the PUT returned no error but ceph still ` + `reports the flag ${after.value ? "set" : "clear"} rather than ` + `${news.value ? "set" : "clear"}. This endpoint's success is documented as a ` + "null body, so the status code proves nothing -- check `ceph osd dump | " + "head -1` and the cluster log. `pause` in particular is two ceph flags read " + "as one; see the header."));
+      return yield* Effect13.die(new Error(`cluster/ceph/flags/${news.flag}: the PUT returned no error but ceph still ` + `reports the flag ${after.value ? "set" : "clear"} rather than ` + `${news.value ? "set" : "clear"}. This endpoint's success is documented as a ` + "null body, so the status code proves nothing -- check `ceph osd dump | " + "head -1` and the cluster log. `pause` in particular is two ceph flags read " + "as one; see the header."));
     }
     return after;
   })
@@ -1615,10 +1669,10 @@ var ProxmoxCephFlagProvider = () => Provider5.effect(ProxmoxCephFlag, Effect12.s
 import { Resource as Resource6 } from "alchemy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 import * as Provider6 from "alchemy/Provider";
-import * as Effect14 from "effect/Effect";
+import * as Effect15 from "effect/Effect";
 
 // src/proxmox/ceph-fs-wire.ts
-import * as Effect13 from "effect/Effect";
+import * as Effect14 from "effect/Effect";
 var readRow = (live, props) => {
   const row = (Array.isArray(live) ? live : []).filter((entry) => typeof entry === "object" && entry !== null).find((entry) => entry["name"] === props.name);
   if (row === undefined)
@@ -1646,29 +1700,29 @@ var destroyPath = (props) => {
   ].filter((part) => part !== undefined);
   return query.length === 0 ? objectPath(props) : `${objectPath(props)}?${query.join("&")}`;
 };
-var settle = (target, node, upid, what) => Effect13.gen(function* () {
+var settle = (target, node, upid, what) => Effect14.gen(function* () {
   for (let attempt = 0;attempt < POLL_ATTEMPTS; attempt += 1) {
-    const status = yield* pve(target, "read", "GET", `nodes/${node}/tasks/${encodeURIComponent(upid)}/status`).pipe(Effect13.orElseSucceed(() => {
+    const status = yield* pve(target, "read", "GET", `nodes/${node}/tasks/${encodeURIComponent(upid)}/status`).pipe(Effect14.orElseSucceed(() => {
       return;
     }));
     if (status?.status === "stopped") {
       const exit = text(status.exitstatus);
       if (exit === "OK")
         return;
-      return yield* Effect13.die(new Error(`${what}: PVE task ${upid} finished with "${exit === "" ? "no exit status" : exit}". ` + "The write returned HTTP 200 because it only forked the worker -- the real error is " + `in \`pvesh get /nodes/${node}/tasks/${upid}/log\`.`));
+      return yield* Effect14.die(new Error(`${what}: PVE task ${upid} finished with "${exit === "" ? "no exit status" : exit}". ` + "The write returned HTTP 200 because it only forked the worker -- the real error is " + `in \`pvesh get /nodes/${node}/tasks/${upid}/log\`.`));
     }
-    yield* Effect13.sleep(POLL_SECONDS * 1000);
+    yield* Effect14.sleep(POLL_SECONDS * 1000);
   }
-  return yield* Effect13.die(new Error(`${what}: PVE task ${upid} was still running after ` + `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its ` + "status could not be read. Check the task log, and check that the `read` role holds " + `Sys.Audit on /nodes/${node} -- each call mints a new token, so the poller is never the ` + "task owner and is answered 403 rather than told to wait."));
+  return yield* Effect14.die(new Error(`${what}: PVE task ${upid} was still running after ` + `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its ` + "status could not be read. Check the task log, and check that the `read` role holds " + `Sys.Audit on /nodes/${node} -- each call mints a new token, so the poller is never the ` + "task owner and is answered 403 rather than told to wait."));
 });
-var createFs = (props) => Effect13.gen(function* () {
+var createFs = (props) => Effect14.gen(function* () {
   const upid = text(yield* pve(props.target, "provision", "POST", objectPath(props), createForm2(props)));
   if (upid === "") {
-    return yield* Effect13.die(new Error(`${objectPath(props)}: POST returned no task id. PVE wraps every answer in ` + '{"data":...} and can report success on a call that did nothing.'));
+    return yield* Effect14.die(new Error(`${objectPath(props)}: POST returned no task id. PVE wraps every answer in ` + '{"data":...} and can report success on a call that did nothing.'));
   }
   yield* settle(props.target, props.node, upid, objectPath(props));
 });
-var destroyFs = (props) => Effect13.gen(function* () {
+var destroyFs = (props) => Effect14.gen(function* () {
   const upid = text(yield* pve(props.target, "provision", "DELETE", destroyPath(props)));
   if (upid !== "")
     yield* settle(props.target, props.node, upid, destroyPath(props));
@@ -1680,7 +1734,7 @@ var notDestroyed = (props) => new Error(`${objectPath(props)}: the destroy task
 var ProxmoxCephFs = Resource6("Proxmox.CephFs", {
   defaultRemovalPolicy: "retain"
 });
-var ops3 = pveOperations({
+var ops2 = pveOperations({
   attributes: readRow,
   collection: objectPath,
   createForm: createForm2,
@@ -1688,44 +1742,44 @@ var ops3 = pveOperations({
   matches: () => true,
   path: (props) => `nodes/${props.node}/ceph/fs`
 });
-var ProxmoxCephFsProvider = () => Provider6.effect(ProxmoxCephFs, Effect14.succeed(ProxmoxCephFs.Provider.of({
-  list: () => Effect14.succeed([]),
-  read: Effect14.fn(function* ({ olds }) {
-    return yield* ops3.read(olds);
+var ProxmoxCephFsProvider = () => Provider6.effect(ProxmoxCephFs, Effect15.succeed(ProxmoxCephFs.Provider.of({
+  list: () => Effect15.succeed([]),
+  read: Effect15.fn(function* ({ olds }) {
+    return yield* ops2.read(olds);
   }),
-  diff: Effect14.fn(function* ({ news, output }) {
+  diff: Effect15.fn(function* ({ news, output }) {
     if (output !== undefined && isResolved3(news) && news.name !== output.name) {
       return { action: "replace" };
     }
-    return yield* ops3.diff(news, output);
+    return yield* ops2.diff(news, output);
   }),
-  reconcile: Effect14.fn(function* ({ news }) {
-    const live = yield* ops3.read(news);
+  reconcile: Effect15.fn(function* ({ news }) {
+    const live = yield* ops2.read(news);
     if (live !== undefined)
       return live;
     yield* createFs(news);
-    const after = yield* ops3.read(news);
+    const after = yield* ops2.read(news);
     if (after === undefined)
-      return yield* Effect14.die(notCreated(news));
+      return yield* Effect15.die(notCreated(news));
     return after;
   }),
-  delete: Effect14.fn(function* ({ olds }) {
-    if ((yield* ops3.read(olds)) === undefined)
+  delete: Effect15.fn(function* ({ olds }) {
+    if ((yield* ops2.read(olds)) === undefined)
       return;
     yield* destroyFs(olds);
-    const after = yield* ops3.read(olds);
+    const after = yield* ops2.read(olds);
     if (after !== undefined)
-      return yield* Effect14.die(notDestroyed(olds));
+      return yield* Effect15.die(notDestroyed(olds));
   })
 })));
 // src/proxmox/ceph-osd.ts
 import { Resource as Resource7 } from "alchemy";
 import { isResolved as isResolved4 } from "alchemy/Diff";
 import * as Provider7 from "alchemy/Provider";
-import * as Effect17 from "effect/Effect";
+import * as Effect18 from "effect/Effect";
 
 // src/proxmox/ceph-osd-tree.ts
-import * as Effect15 from "effect/Effect";
+import * as Effect16 from "effect/Effect";
 var branches = (node) => (Array.isArray(node["children"]) ? node["children"] : []).filter((child) => typeof child === "object" && child !== null);
 var osdLeaves = (tree) => {
   const root = tree["root"];
@@ -1751,29 +1805,29 @@ var osdAttributes = (leaf, props) => ({
   status: text(leaf["status"]),
   total_space: num(leaf["total_space"], 0)
 });
-var readOsd = (props) => pve(props.target, "read", "GET", `nodes/${props.node}/ceph/osd`).pipe(Effect15.map((t) => {
+var readOsd = (props) => pve(props.target, "read", "GET", `nodes/${props.node}/ceph/osd`).pipe(Effect16.map((t) => {
   const leaf = t === undefined ? undefined : findOsd(t, props.osdid);
   return leaf === undefined ? undefined : osdAttributes(leaf, props);
 }));
 
 // src/proxmox/ceph-osd-write.ts
-import * as Effect16 from "effect/Effect";
+import * as Effect17 from "effect/Effect";
 var OSD_CREATE_ENDPOINT = "pve:POST /nodes/{node}/ceph/osd";
 var describe = (props) => `osd.${String(props.osdid)} on ${props.node}`;
 var createOsdForm = (props, dev) => ({
   dev,
   ...props.device_class === undefined ? {} : { "crush-device-class": props.device_class }
 });
-var createOsd = Effect16.fn(function* (news) {
+var createOsd = Effect17.fn(function* (news) {
   if (news.dev === undefined) {
-    return yield* Effect16.die(new Error(`${describe(news)}: no such OSD in the CRUSH tree, and no \`dev\` was declared. ` + "Without a device this resource is an ASSERTION over an OSD that must already " + "exist. Declare `dev` to let it create one -- which WIPES that device -- or fix " + "the declaration; if the disk was there yesterday, a replica is missing and Ceph " + "is degraded."));
+    return yield* Effect17.die(new Error(`${describe(news)}: no such OSD in the CRUSH tree, and no \`dev\` was declared. ` + "Without a device this resource is an ASSERTION over an OSD that must already " + "exist. Declare `dev` to let it create one -- which WIPES that device -- or fix " + "the declaration; if the disk was there yesterday, a replica is missing and Ceph " + "is degraded."));
   }
   const form = createOsdForm(news, news.dev);
   yield* guardForm(OSD_CREATE_ENDPOINT, form, true);
   yield* pve(news.target, "provision", "POST", `nodes/${news.node}/ceph/osd`, form);
   const created = yield* readOsd(news);
   if (created === undefined) {
-    return yield* Effect16.die(new Error(`${describe(news)}: the create returned no error but osd.${String(news.osdid)} is ` + "still absent. Ceph allocates OSD ids and cannot be told which to use, so it most " + "likely assigned a different number -- check `ceph osd tree`, and declare the id it " + "actually gave the device rather than deploying again."));
+    return yield* Effect17.die(new Error(`${describe(news)}: the create returned no error but osd.${String(news.osdid)} is ` + "still absent. Ceph allocates OSD ids and cannot be told which to use, so it most " + "likely assigned a different number -- check `ceph osd tree`, and declare the id it " + "actually gave the device rather than deploying again."));
   }
   return created;
 });
@@ -1786,11 +1840,11 @@ var ProxmoxCephOsd = Resource7("Proxmox.CephOsd", {
 var settled = (live, props) => (props.host === undefined || props.host === live.host) && (props.device_class === undefined || props.device_class === live.device_class);
 var describe2 = (props) => `osd.${String(props.osdid)} (read via nodes/${props.node}/ceph/osd)`;
 var handlers5 = {
-  list: () => Effect17.succeed([]),
-  read: Effect17.fn(function* ({ olds }) {
+  list: () => Effect18.succeed([]),
+  read: Effect18.fn(function* ({ olds }) {
     return yield* readOsd(olds);
   }),
-  diff: Effect17.fn(function* ({
+  diff: Effect18.fn(function* ({
     news,
     output
   }) {
@@ -1803,25 +1857,25 @@ var handlers5 = {
       return { action: "update" };
     return settled(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect17.fn(function* ({ news }) {
+  reconcile: Effect18.fn(function* ({ news }) {
     const live = yield* readOsd(news);
     if (live === undefined) {
       return yield* createOsd(news);
     }
     if (!settled(live, news)) {
-      return yield* Effect17.die(new Error(`${describe2(news)}: exists but not as declared -- live host=${live.host} ` + `device_class=${live.device_class}. Nothing here moves an OSD between hosts or ` + "reclassifies it; fix the declaration, or move it deliberately with `ceph osd crush " + "move` / `ceph osd crush set-device-class` and deploy again."));
+      return yield* Effect18.die(new Error(`${describe2(news)}: exists but not as declared -- live host=${live.host} ` + `device_class=${live.device_class}. Nothing here moves an OSD between hosts or ` + "reclassifies it; fix the declaration, or move it deliberately with `ceph osd crush " + "move` / `ceph osd crush set-device-class` and deploy again."));
     }
     return live;
   }),
-  delete: Effect17.fn(function* ({ olds }) {
+  delete: Effect18.fn(function* ({ olds }) {
     yield* destroyOsd(olds);
   })
 };
-var ProxmoxCephOsdProvider = () => Provider7.effect(ProxmoxCephOsd, Effect17.succeed(ProxmoxCephOsd.Provider.of(handlers5)));
+var ProxmoxCephOsdProvider = () => Provider7.effect(ProxmoxCephOsd, Effect18.succeed(ProxmoxCephOsd.Provider.of(handlers5)));
 // src/proxmox/ceph-pool.ts
 import { Resource as Resource8 } from "alchemy";
 import * as Provider8 from "alchemy/Provider";
-import * as Effect19 from "effect/Effect";
+import * as Effect20 from "effect/Effect";
 
 // src/proxmox/ceph-pool-form.ts
 var object = (props) => `nodes/${props.node}/ceph/pool/${props.name}`;
@@ -1850,14 +1904,14 @@ var createBody = (props) => ({
 });
 
 // src/proxmox/ceph-pool-settle.ts
-import * as Effect18 from "effect/Effect";
-var confirmAbsent = (props, collection2, describe3) => pve(props.target, "read", "GET", collection2).pipe(Effect18.flatMap((rows) => (rows ?? []).some((row) => row.pool_name === props.name) ? Effect18.die(new Error(`${describe3}: the cluster lists this pool but its status could not be read, ` + "so this deploy will NOT create over it. Check that the node is up and that the " + "read role holds Sys.Audit or Datastore.Audit on / -- a create here would apply " + "pg_num to a live pool and start a PG merge.")) : Effect18.void));
-var settle2 = (props, read, done) => Effect18.gen(function* () {
+import * as Effect19 from "effect/Effect";
+var confirmAbsent = (props, collection2, describe3) => pve(props.target, "read", "GET", collection2).pipe(Effect19.flatMap((rows) => (rows ?? []).some((row) => row.pool_name === props.name) ? Effect19.die(new Error(`${describe3}: the cluster lists this pool but its status could not be read, ` + "so this deploy will NOT create over it. Check that the node is up and that the " + "read role holds Sys.Audit or Datastore.Audit on / -- a create here would apply " + "pg_num to a live pool and start a PG merge.")) : Effect19.void));
+var settle2 = (props, read, done) => Effect19.gen(function* () {
   for (let attempt = 0;attempt < 30; attempt += 1) {
     const live = yield* read(props);
     if (done(live))
       return live;
-    yield* Effect18.sleep("2 seconds");
+    yield* Effect19.sleep("2 seconds");
   }
   return yield* read(props);
 });
@@ -1898,36 +1952,36 @@ var spec = {
   path: (props) => `${object(props)}/status?verbose=1`,
   updateForm: updateBody
 };
-var ops4 = pveOperations(spec);
-var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect19.succeed(ProxmoxCephPool.Provider.of({
-  list: () => Effect19.succeed([]),
-  read: ({ olds }) => ops4.read(olds),
-  diff: ({ news, output }) => ops4.diff(news, output),
-  reconcile: Effect19.fn(function* ({ news }) {
-    const live = yield* ops4.read(news);
+var ops3 = pveOperations(spec);
+var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect20.succeed(ProxmoxCephPool.Provider.of({
+  list: () => Effect20.succeed([]),
+  read: ({ olds }) => ops3.read(olds),
+  diff: ({ news, output }) => ops3.diff(news, output),
+  reconcile: Effect20.fn(function* ({ news }) {
+    const live = yield* ops3.read(news);
     let upid;
     if (live === undefined) {
-      yield* ops4.guardCreate(news, true);
+      yield* ops3.guardCreate(news, true);
       yield* confirmAbsent(news, spec.collection(news), object(news));
       upid = yield* pve(news.target, "provision", "POST", collection(news), createBody(news));
     } else {
       const form = formToSend(spec.matches, live, news, updateBody(news));
       if (form !== undefined) {
-        yield* ops4.guardUpdate(news);
+        yield* ops3.guardUpdate(news);
         upid = yield* pve(news.target, "provision", "PUT", object(news), form);
       }
     }
-    const after = yield* settle2(news, ops4.read, (row) => row !== undefined && spec.matches(row, news));
+    const after = yield* settle2(news, ops3.read, (row) => row !== undefined && spec.matches(row, news));
     if (after === undefined || !spec.matches(after, news)) {
-      return yield* Effect19.die(new Error(`${object(news)}: the write returned no error but the pool still does not match ` + `the declaration after 60s. PVE answered with task ${upid ?? "(none)"} -- read ` + "its log with `pvesh get /nodes/<node>/tasks/<upid>/log` to see what Ceph " + "refused."));
+      return yield* Effect20.die(new Error(`${object(news)}: the write returned no error but the pool still does not match ` + `the declaration after 60s. PVE answered with task ${upid ?? "(none)"} -- read ` + "its log with `pvesh get /nodes/<node>/tasks/<upid>/log` to see what Ceph " + "refused."));
     }
     return after;
   }),
-  delete: Effect19.fn(function* ({ olds }) {
+  delete: Effect20.fn(function* ({ olds }) {
     yield* pve(olds.target, "provision", "DELETE", object(olds));
-    const left = yield* settle2(olds, ops4.read, (row) => row === undefined);
+    const left = yield* settle2(olds, ops3.read, (row) => row === undefined);
     if (left !== undefined) {
-      return yield* Effect19.die(new Error(`${object(olds)}: the DELETE returned no error but the pool is still there after ` + "60s. Either a storage on it still holds RBD images, or the mons are running " + "with mon_allow_pool_delete false."));
+      return yield* Effect20.die(new Error(`${object(olds)}: the DELETE returned no error but the pool is still there after ` + "60s. Either a storage on it still holds RBD images, or the mons are running " + "with mon_allow_pool_delete false."));
     }
   })
 })));
@@ -1935,7 +1989,7 @@ var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect19.s
 import { Resource as Resource9 } from "alchemy";
 import { isResolved as isResolved5 } from "alchemy/Diff";
 import * as Provider9 from "alchemy/Provider";
-import * as Effect20 from "effect/Effect";
+import * as Effect21 from "effect/Effect";
 
 // src/proxmox/firewall-alias-form.ts
 var fold = (name) => name.trim().toLowerCase();
@@ -1975,9 +2029,9 @@ var handlers6 = pveHandlers({
   path: (props) => `cluster/firewall/aliases/${props.name}`,
   updateForm: body
 });
-var ProxmoxFirewallAliasProvider = () => Provider9.effect(ProxmoxFirewallAlias, Effect20.succeed(ProxmoxFirewallAlias.Provider.of({
+var ProxmoxFirewallAliasProvider = () => Provider9.effect(ProxmoxFirewallAlias, Effect21.succeed(ProxmoxFirewallAlias.Provider.of({
   ...handlers6,
-  diff: Effect20.fn(function* ({ news, output }) {
+  diff: Effect21.fn(function* ({ news, output }) {
     if (output !== undefined && isResolved5(news) && fold(news.name) !== fold(output.name)) {
       return { action: "replace" };
     }
@@ -1987,7 +2041,7 @@ var ProxmoxFirewallAliasProvider = () => Provider9.effect(ProxmoxFirewallAlias,
 // src/proxmox/group.ts
 import { Resource as Resource10 } from "alchemy";
 import * as Provider10 from "alchemy/Provider";
-import * as Effect21 from "effect/Effect";
+import * as Effect22 from "effect/Effect";
 var ProxmoxGroup = Resource10("Proxmox.Group", {
   defaultRemovalPolicy: "retain"
 });
@@ -2012,11 +2066,11 @@ var handlers7 = pveHandlers({
   path: (props) => `access/groups/${props.groupid}`,
   updateForm: (props) => ({ comment: storedComment(props.comment) })
 });
-var ProxmoxGroupProvider = () => Provider10.effect(ProxmoxGroup, Effect21.succeed(ProxmoxGroup.Provider.of(handlers7)));
+var ProxmoxGroupProvider = () => Provider10.effect(ProxmoxGroup, Effect22.succeed(ProxmoxGroup.Provider.of(handlers7)));
 // src/proxmox/ha-resource.ts
 import { Resource as Resource11 } from "alchemy";
 import * as Provider11 from "alchemy/Provider";
-import * as Effect22 from "effect/Effect";
+import * as Effect23 from "effect/Effect";
 var ProxmoxHaResource = Resource11("Proxmox.HaResource");
 var kind = (sid) => sid.split(":")[0] ?? "";
 var shape3 = (props) => ({
@@ -2044,11 +2098,11 @@ var handlers8 = pveHandlers({
   path: (props) => `cluster/ha/resources/${props.sid}`,
   updateForm: shape3
 });
-var ProxmoxHaResourceProvider = () => Provider11.effect(ProxmoxHaResource, Effect22.succeed(ProxmoxHaResource.Provider.of(handlers8)));
+var ProxmoxHaResourceProvider = () => Provider11.effect(ProxmoxHaResource, Effect23.succeed(ProxmoxHaResource.Provider.of(handlers8)));
 // src/proxmox/ha-rule.ts
 import { Resource as Resource12 } from "alchemy";
 import * as Provider12 from "alchemy/Provider";
-import * as Effect23 from "effect/Effect";
+import * as Effect24 from "effect/Effect";
 
 // src/proxmox/ha-rule-form.ts
 var nodeList = (value) => {
@@ -2125,43 +2179,43 @@ var handlers9 = pveHandlers({
     return withClears(fields, clear);
   }
 });
-var ProxmoxHaRuleProvider = () => Provider12.effect(ProxmoxHaRule, Effect23.succeed(ProxmoxHaRule.Provider.of(handlers9)));
+var ProxmoxHaRuleProvider = () => Provider12.effect(ProxmoxHaRule, Effect24.succeed(ProxmoxHaRule.Provider.of(handlers9)));
 // src/proxmox/lxc.ts
 import { Resource as Resource13 } from "alchemy";
 import { isResolved as isResolved6 } from "alchemy/Diff";
 import * as Provider13 from "alchemy/Provider";
-import * as Effect33 from "effect/Effect";
+import * as Effect34 from "effect/Effect";
 
 // src/ownership/adopt.ts
 import { AdoptPolicy } from "alchemy/AdoptPolicy";
 import { AlchemyContext } from "alchemy/AlchemyContext";
 import { Stack as Stack3 } from "alchemy/Stack";
-import * as Effect27 from "effect/Effect";
+import * as Effect28 from "effect/Effect";
 import * as Option5 from "effect/Option";
 
 // src/ownership/resume.ts
 import { Unowned } from "alchemy/AdoptPolicy";
 import { Artifacts } from "alchemy/Artifacts";
-import * as Effect24 from "effect/Effect";
+import * as Effect25 from "effect/Effect";
 import * as Option2 from "effect/Option";
 var PROVEN = "homeflare/ownership/resumes";
 var UNFINISHED = "homeflare/ownership/unfinished";
-var note = (key, instanceId) => Effect24.gen(function* () {
-  const bag = yield* Effect24.serviceOption(Artifacts);
+var note = (key, instanceId) => Effect25.gen(function* () {
+  const bag = yield* Effect25.serviceOption(Artifacts);
   if (Option2.isSome(bag))
     yield* bag.value.set(key, instanceId);
 });
-var noted = (key, instanceId) => Effect24.gen(function* () {
-  const bag = yield* Effect24.serviceOption(Artifacts);
+var noted = (key, instanceId) => Effect25.gen(function* () {
+  const bag = yield* Effect25.serviceOption(Artifacts);
   if (Option2.isNone(bag))
     return false;
   return (yield* bag.value.get(key)) === instanceId;
 });
-var noteUnfinished = (instanceId) => Effect24.as(note(UNFINISHED, instanceId), undefined);
-var noteResume = (instanceId, recovered) => Effect24.gen(function* () {
+var noteUnfinished = (instanceId) => Effect25.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect25.gen(function* () {
   yield* noteUnfinished(instanceId);
-  const unproven = () => Effect24.succeed(undefined);
-  const found = yield* recovered.pipe(Effect24.catch(unproven), Effect24.catchDefect(unproven));
+  const unproven = () => Effect25.succeed(undefined);
+  const found = yield* recovered.pipe(Effect25.catch(unproven), Effect25.catchDefect(unproven));
   if (found === undefined || found === null || Unowned.is(found))
     return;
   yield* note(PROVEN, instanceId);
@@ -2172,7 +2226,7 @@ var provingResumes = (service) => {
   const { diff, read } = service;
   if (diff === undefined || read === undefined)
     return service;
-  const proving = (input) => Effect24.gen(function* () {
+  const proving = (input) => Effect25.gen(function* () {
     if (input.output === undefined) {
       yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
     }
@@ -2184,12 +2238,12 @@ var provingResumes = (service) => {
 // src/ownership/rows.ts
 import { Stack as Stack2 } from "alchemy/Stack";
 import { State, isActionState } from "alchemy/State/State";
-import * as Effect26 from "effect/Effect";
+import * as Effect27 from "effect/Effect";
 import * as Option4 from "effect/Option";
 
 // src/ownership/whole.ts
 import { Stack } from "alchemy/Stack";
-import * as Effect25 from "effect/Effect";
+import * as Effect26 from "effect/Effect";
 import * as Option3 from "effect/Option";
 var absent = (value) => value === undefined || value === null;
 var isPlainObject = (value) => {
@@ -2215,22 +2269,22 @@ var carries = (declared, recorded) => {
   }
   return true;
 };
-var wholeDeclaration = (fqn, props) => Effect25.map(Effect25.serviceOption(Stack), (stack) => {
+var wholeDeclaration = (fqn, props) => Effect26.map(Effect26.serviceOption(Stack), (stack) => {
   const declared = Option3.isSome(stack) ? stack.value.resources[fqn] : undefined;
   return declared !== undefined && carries(declared.Props, props);
 });
 
 // src/ownership/rows.ts
-var storeOf = Effect26.gen(function* () {
-  const stack = yield* Effect26.serviceOption(Stack2);
-  const state = yield* Effect26.serviceOption(State);
+var storeOf = Effect27.gen(function* () {
+  const stack = yield* Effect27.serviceOption(Stack2);
+  const state = yield* Effect27.serviceOption(State);
   if (Option4.isNone(stack) || Option4.isNone(state))
     return;
   const store = yield* state.value;
   const where = { stack: stack.value.name, stage: stack.value.stage };
   return { resources: stack.value.resources, store, where };
 });
-var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect26.orElseSucceed(() => {
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect27.orElseSucceed(() => {
   return;
 }));
 var generationOf = (row, instanceId) => {
@@ -2243,7 +2297,7 @@ var generationOf = (row, instanceId) => {
   }
   return;
 };
-var recordedGeneration = (fqn, instanceId) => Effect26.gen(function* () {
+var recordedGeneration = (fqn, instanceId) => Effect27.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return;
@@ -2254,14 +2308,14 @@ var recordedGeneration = (fqn, instanceId) => Effect26.gen(function* () {
   }
   return;
 });
-var recordedInstance = (fqn, instanceId) => Effect26.gen(function* () {
+var recordedInstance = (fqn, instanceId) => Effect27.gen(function* () {
   const generation = yield* recordedGeneration(fqn, instanceId);
   if (generation === undefined)
     return "absent";
   return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
 });
-var isCreate = (fqn, instanceId) => Effect26.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
-var forgetRefusedCreate = (fqn, instanceId) => Effect26.gen(function* () {
+var isCreate = (fqn, instanceId) => Effect27.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var forgetRefusedCreate = (fqn, instanceId) => Effect27.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return;
@@ -2270,32 +2324,32 @@ var forgetRefusedCreate = (fqn, instanceId) => Effect26.gen(function* () {
   if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
     return;
   }
-  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect26.ignore);
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect27.ignore);
 });
 
 // src/ownership/adopt.ts
-var adoptEnabled = (fqn) => Effect27.gen(function* () {
-  const stack = yield* Effect27.serviceOption(Stack3);
+var adoptEnabled = (fqn) => Effect28.gen(function* () {
+  const stack = yield* Effect28.serviceOption(Stack3);
   const scoped = Option5.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
   if (scoped !== undefined)
     return scoped;
-  const policy = yield* Effect27.serviceOption(AdoptPolicy);
+  const policy = yield* Effect28.serviceOption(AdoptPolicy);
   if (Option5.isSome(policy))
     return policy.value;
-  const context = yield* Effect27.serviceOption(AlchemyContext);
+  const context = yield* Effect28.serviceOption(AlchemyContext);
   return Option5.isSome(context) ? context.value.adopt : false;
 });
-var adoptable = (owner) => Effect27.gen(function* () {
+var adoptable = (owner) => Effect28.gen(function* () {
   if (yield* isCreate(owner.fqn, owner.instanceId))
     return true;
   return yield* unfinished(owner.instanceId);
 });
-var adoptsAtApply = (owner) => Effect27.gen(function* () {
+var adoptsAtApply = (owner) => Effect28.gen(function* () {
   if (!(yield* adoptEnabled(owner.fqn)))
     return false;
   return yield* adoptable(owner);
 });
-var refuseTakeover = (owner, what) => Effect27.gen(function* () {
+var refuseTakeover = (owner, what) => Effect28.gen(function* () {
   if (owner.output !== undefined)
     return;
   if (yield* resumes(owner.instanceId))
@@ -2305,25 +2359,25 @@ var refuseTakeover = (owner, what) => Effect27.gen(function* () {
     return;
   yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
   const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
-  return yield* Effect27.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+  return yield* Effect28.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
 });
 var claimFor = (owner) => (what) => refuseTakeover(owner, what);
 
 // src/ownership/probe.ts
 import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
-import * as Effect28 from "effect/Effect";
-var provenOurs = (ask, settled2) => Effect28.gen(function* () {
+import * as Effect29 from "effect/Effect";
+var provenOurs = (ask, settled2) => Effect29.gen(function* () {
   const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
   if (recorded === "absent")
     return false;
   if (recorded === "partial") {
-    yield* Effect28.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
+    yield* Effect29.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
     return false;
   }
-  const unproven = (reason) => Effect28.as(Effect28.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
-  return yield* settled2.pipe(Effect28.catch(unproven), Effect28.catchDefect(unproven));
+  const unproven = (reason) => Effect29.as(Effect29.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
+  return yield* settled2.pipe(Effect29.catch(unproven), Effect29.catchDefect(unproven));
 });
-var ownedRead = (ask, found, settled2) => Effect28.gen(function* () {
+var ownedRead = (ask, found, settled2) => Effect29.gen(function* () {
   if (found === undefined || ask.output !== undefined)
     return found;
   return (yield* provenOurs(ask, settled2)) ? found : Unowned2(found);
@@ -2381,8 +2435,8 @@ var optionMap = (value, family, defaultKey) => {
   return out;
 };
 var sameMap = (left, right) => left.size === right.size && [...left].every(([key, value]) => right.get(key) === value);
-var sortedForm = (map6) => [...map6].map(([key, value]) => `${key}=${value}`).sort().join(",");
-var printMap = (map6, lead = []) => [...lead.filter((key) => map6.has(key)), ...[...map6.keys()].filter((k) => !lead.includes(k))].map((key) => `${key}=${map6.get(key) ?? ""}`).join(",");
+var sortedForm = (map7) => [...map7].map(([key, value]) => `${key}=${value}`).sort().join(",");
+var printMap = (map7, lead = []) => [...lead.filter((key) => map7.has(key)), ...[...map7.keys()].filter((k) => !lead.includes(k))].map((key) => `${key}=${map7.get(key) ?? ""}`).join(",");
 var netMaps = (declared, live) => {
   const want = optionMap(declared, "net");
   const have = optionMap(live, "net");
@@ -2778,11 +2832,11 @@ var identityRefusals = (news, olds, output) => {
 };
 
 // src/proxmox/lxc-adoption.ts
-import * as Effect32 from "effect/Effect";
+import * as Effect33 from "effect/Effect";
 
 // src/ownership/adopting.ts
-import * as Effect29 from "effect/Effect";
-var adopting = (owner, settled2) => Effect29.gen(function* () {
+import * as Effect30 from "effect/Effect";
+var adopting = (owner, settled2) => Effect30.gen(function* () {
   if (owner.output === undefined)
     return false;
   const generation = yield* recordedGeneration(owner.fqn, owner.instanceId);
@@ -2794,11 +2848,11 @@ var adopting = (owner, settled2) => Effect29.gen(function* () {
 });
 
 // src/proxmox/lxc-lifecycle.ts
-import * as Effect31 from "effect/Effect";
+import * as Effect32 from "effect/Effect";
 
 // src/proxmox/network-apply-read.ts
-import * as Effect30 from "effect/Effect";
-var stagedDiff = (target, node) => Effect30.gen(function* () {
+import * as Effect31 from "effect/Effect";
+var stagedDiff = (target, node) => Effect31.gen(function* () {
   const path = `nodes/${node}/network`;
   const credential = yield* leased(target, "read");
   const envelope = yield* pveEnvelopeWith(target, credential, "GET", path);
@@ -2811,8 +2865,8 @@ var pendingLines = (diff) => {
 `).filter((line) => (line.startsWith("+") || line.startsWith("-")) && !line.startsWith("+++") && !line.startsWith("---")).length;
   return Math.max(changed, 1);
 };
-var pendingCount = (target, node) => stagedDiff(target, node).pipe(Effect30.map(pendingLines));
-var clusterHealth = (target) => pve(target, "read", "GET", "cluster/status").pipe(Effect30.map((rows) => {
+var pendingCount = (target, node) => stagedDiff(target, node).pipe(Effect31.map(pendingLines));
+var clusterHealth = (target) => pve(target, "read", "GET", "cluster/status").pipe(Effect31.map((rows) => {
   const all = rows ?? [];
   const cluster = all.find((row) => row.type === "cluster");
   return {
@@ -2820,21 +2874,21 @@ var clusterHealth = (target) => pve(target, "read", "GET", "cluster/status").pip
     quorate: cluster === undefined ? true : bool(cluster.quorate)
   };
 }));
-var degradedReason = (target) => clusterHealth(target).pipe(Effect30.map((health) => health.quorate && health.offline.length === 0 ? undefined : `quorate=${String(health.quorate)} offline=[${health.offline.join(", ")}]`));
+var degradedReason = (target) => clusterHealth(target).pipe(Effect31.map((health) => health.quorate && health.offline.length === 0 ? undefined : `quorate=${String(health.quorate)} offline=[${health.offline.join(", ")}]`));
 var UNREACHABLE = "the task could not be read -- the node stopped answering, or this lease cannot see it";
 var STILL_RUNNING = "still running when this provider stopped waiting";
 var ATTEMPTS = 30;
-var awaitTask = (target, credential, node, upid, attempts = ATTEMPTS) => Effect30.gen(function* () {
+var awaitTask = (target, credential, node, upid, attempts = ATTEMPTS) => Effect31.gen(function* () {
   const path = `nodes/${node}/tasks/${upid}/status`;
   for (let attempt = 0;attempt < attempts; attempt += 1) {
-    const status = yield* pveWith(target, credential, "GET", path).pipe(Effect30.orElseSucceed(() => {
+    const status = yield* pveWith(target, credential, "GET", path).pipe(Effect31.orElseSucceed(() => {
       return;
     }));
     if (status === undefined)
       return UNREACHABLE;
     if (status.status === "stopped")
       return text(status.exitstatus, "stopped with no exitstatus");
-    yield* Effect30.sleep("1 second");
+    yield* Effect31.sleep("1 second");
   }
   return STILL_RUNNING;
 });
@@ -2852,43 +2906,43 @@ var LXC_ENDPOINTS = {
 var CREATE_POLLS = 180;
 var TASK_POLLS = 60;
 var isServerError = (error) => error instanceof PveError && error.status === 500;
-var readLive = (where) => Effect31.gen(function* () {
-  const answer = yield* pve(where.target, "read", "GET", `${guestPath(where)}/config`).pipe(Effect31.map((data) => ({ data, error: undefined })), Effect31.catchIf(isServerError, (error) => Effect31.succeed({ data: undefined, error })));
+var readLive = (where) => Effect32.gen(function* () {
+  const answer = yield* pve(where.target, "read", "GET", `${guestPath(where)}/config`).pipe(Effect32.map((data) => ({ data, error: undefined })), Effect32.catchIf(isServerError, (error) => Effect32.succeed({ data: undefined, error })));
   if (answer.data !== undefined && answer.data !== null)
     return answer.data;
   const rows = yield* pve(where.target, "read", "GET", "cluster/resources?type=vm");
   const found = (rows ?? []).find((row) => Number(row.vmid) === where.vmid);
   if (found !== undefined && found.node === where.node && found.type === "lxc") {
-    return yield* Effect31.fail(answer.error ?? new LxcRefusedError(`CT ${String(where.vmid)} is listed but its config read empty.`));
+    return yield* Effect32.fail(answer.error ?? new LxcRefusedError(`CT ${String(where.vmid)} is listed but its config read empty.`));
   }
   if (found !== undefined) {
-    return yield* Effect31.fail(new LxcRefusedError(`vmid ${String(where.vmid)} is a ${text(found.type, "guest")} on ` + `${text(found.node, "?")}, not a container on ${where.node}. A migration is not an ` + "update and vmids are cluster-wide: declare the node it is on, or pick a free vmid."));
+    return yield* Effect32.fail(new LxcRefusedError(`vmid ${String(where.vmid)} is a ${text(found.type, "guest")} on ` + `${text(found.node, "?")}, not a container on ${where.node}. A migration is not an ` + "update and vmids are cluster-wide: declare the node it is on, or pick a free vmid."));
   }
   return;
 });
-var attributesOf = (where, live) => ({
+var attributesOf2 = (where, live) => ({
   config: storedConfig(live),
   node: where.node,
   rawKeys: rawKeysOf(live),
   vmid: where.vmid
 });
-var task = (where, method, path, what, polls, form) => Effect31.gen(function* () {
+var task = (where, method, path, what, polls, form) => Effect32.gen(function* () {
   const credential = yield* mint(where.target, "provision");
   const upid = text(yield* pveWith(where.target, credential, method, path, form));
   if (upid === "") {
-    return yield* Effect31.fail(new LxcRefusedError(`${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`));
+    return yield* Effect32.fail(new LxcRefusedError(`${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`));
   }
   const exit = yield* awaitTask(where.target, credential, where.node, upid, polls);
   if (exit !== "OK") {
-    return yield* Effect31.fail(new LxcRefusedError(`${what}: task ${upid} ended "${exit}". Read \`pvesh get /nodes/${where.node}/tasks/` + `${upid}/log\` before running the deploy again.`));
+    return yield* Effect32.fail(new LxcRefusedError(`${what}: task ${upid} ended "${exit}". Read \`pvesh get /nodes/${where.node}/tasks/` + `${upid}/log\` before running the deploy again.`));
   }
 });
-var createGuest = (props) => Effect31.gen(function* () {
+var createGuest = (props) => Effect32.gen(function* () {
   const form = createForm3(props);
   yield* guardForm(LXC_ENDPOINTS.create, form, true);
   return yield* task(props, "POST", `nodes/${props.node}/lxc`, `create CT ${String(props.vmid)}`, CREATE_POLLS, form);
 });
-var updateGuest = (props, change, digest) => Effect31.gen(function* () {
+var updateGuest = (props, change, digest) => Effect32.gen(function* () {
   if (Object.keys(change.put).length > 0 || change.clear.length > 0) {
     const form = withClears({ ...change.put, ...digest === "" ? {} : { digest } }, change.clear);
     yield* guardForm(LXC_ENDPOINTS.update, form, false);
@@ -2900,33 +2954,33 @@ var updateGuest = (props, change, digest) => Effect31.gen(function* () {
     yield* task(props, "PUT", `${guestPath(props)}/resize`, `grow ${grow.disk} of CT ${String(props.vmid)} to ${grow.size}`, TASK_POLLS, grown);
   }
 });
-var destroyGuest = (where, declared) => Effect31.gen(function* () {
+var destroyGuest = (where, declared) => Effect32.gen(function* () {
   const live = yield* readLive(where);
   if (live === undefined)
     return;
   const drift = judge(declared, live).drift;
   if (drift.length > 0) {
-    return yield* Effect31.fail(new LxcRefusedError(`destroy CT ${String(where.vmid)}: the guest on ${where.node} no longer matches its last ` + `declaration (${drift.join(", ")}), so it may not be the guest this stack made. ` + "Nothing was deleted. Delete it by hand if it should go, or declare it again."));
+    return yield* Effect32.fail(new LxcRefusedError(`destroy CT ${String(where.vmid)}: the guest on ${where.node} no longer matches its last ` + `declaration (${drift.join(", ")}), so it may not be the guest this stack made. ` + "Nothing was deleted. Delete it by hand if it should go, or declare it again."));
   }
   yield* task(where, "DELETE", guestPath(where), `destroy CT ${String(where.vmid)}`, TASK_POLLS);
 });
 
 // src/proxmox/lxc-adoption.ts
 var adoptionRefusal = (props, drift) => `CT ${String(props.vmid)} on ${props.node}: adopting it would change ${drift.join(", ")}. An ` + "adoption never changes a guest, so nothing is written. Declare what is live for these keys " + "(the plan names keys, never values) and plan again; change them after the adoption, as an " + "update.";
-var refuseAdoptedDrift = (owner, props, live, change) => Effect32.gen(function* () {
+var refuseAdoptedDrift = (owner, props, live, change) => Effect33.gen(function* () {
   if (change.drift.length === 0)
     return;
-  const settled2 = (recorded) => Effect32.sync(() => judge(recorded, live).drift.length === 0);
+  const settled2 = (recorded) => Effect33.sync(() => judge(recorded, live).drift.length === 0);
   if (!(yield* adopting(owner, settled2)))
     return;
-  return yield* Effect32.fail(new LxcRefusedError(adoptionRefusal(props, change.drift)));
+  return yield* Effect33.fail(new LxcRefusedError(adoptionRefusal(props, change.drift)));
 });
 
 // src/proxmox/lxc.ts
 var ProxmoxLxc = Resource13("Proxmox.Lxc", { defaultRemovalPolicy: "retain" });
-var refused = (reasons) => Effect33.fail(new LxcRefusedError(reasons.join(`
+var refused = (reasons) => Effect34.fail(new LxcRefusedError(reasons.join(`
 `)));
-var diff = (owner, news, olds) => Effect33.gen(function* () {
+var diff = (owner, news, olds) => Effect34.gen(function* () {
   const { output } = owner;
   const identity2 = identityRefusals(news, olds, output);
   if (identity2.length > 0)
@@ -2940,7 +2994,7 @@ var diff = (owner, news, olds) => Effect33.gen(function* () {
     const refusals = createRefusals(news);
     if (refusals.length > 0)
       return yield* refused(refusals);
-    yield* Effect33.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: the cluster lists no guest with this ` + "vmid -- a deploy CREATES it again from ostemplate, with new, empty volumes.");
+    yield* Effect34.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: the cluster lists no guest with this ` + "vmid -- a deploy CREATES it again from ostemplate, with new, empty volumes.");
     return { action: "update" };
   }
   const change = judge(news, live);
@@ -2951,10 +3005,10 @@ var diff = (owner, news, olds) => Effect33.gen(function* () {
   if (change.drift.length === 0 && !moved)
     return { action: "noop" };
   const what = change.drift.length === 0 ? `the guest is on ${news.node} now, not ${output.node} -- a deploy re-records it, ` + "writing nothing." : `live config differs from the declaration in ${change.drift.join(", ")} -- a ` + "deploy writes these.";
-  yield* Effect33.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: ${what}`);
+  yield* Effect34.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: ${what}`);
   return { action: "update" };
 });
-var reconcile = (owner, news) => Effect33.gen(function* () {
+var reconcile = (owner, news) => Effect34.gen(function* () {
   const { output } = owner;
   const identity2 = identityRefusals(news, news, output);
   if (identity2.length > 0)
@@ -2993,20 +3047,20 @@ var reconcile = (owner, news) => Effect33.gen(function* () {
       `CT ${String(news.vmid)}: after the write, ${left.join(", ")} still differ from the ` + "declaration. PVE may have normalised the value (tags are lower-cased by default) -- " + "declare what it stores."
     ]);
   }
-  return attributesOf(news, after);
+  return attributesOf2(news, after);
 });
 var whereOf = (olds, output) => ({
   node: output?.node ?? olds.node,
   target: olds.target,
   vmid: output?.vmid ?? olds.vmid
 });
-var read = (owner, olds) => Effect33.gen(function* () {
+var read = (owner, olds) => Effect34.gen(function* () {
   const where = whereOf(olds, owner.output);
   const live = yield* readLive(where);
   if (live === undefined)
     return;
-  const settled2 = Effect33.sync(() => judge(olds, live).drift.length === 0);
-  return yield* ownedRead(owner, attributesOf(where, live), settled2);
+  const settled2 = Effect34.sync(() => judge(olds, live).drift.length === 0);
+  return yield* ownedRead(owner, attributesOf2(where, live), settled2);
 });
 var handlers10 = {
   delete: ({ olds, output }) => destroyGuest(whereOf(olds, output), olds),
@@ -3017,7 +3071,7 @@ var handlers10 = {
     olds,
     output
   }) => diff({ fqn, instanceId, output }, news, olds),
-  list: () => Effect33.succeed([]),
+  list: () => Effect34.succeed([]),
   read: ({
     fqn,
     instanceId,
@@ -3031,11 +3085,11 @@ var handlers10 = {
     output
   }) => reconcile({ fqn, instanceId, output }, news)
 };
-var ProxmoxLxcProvider = () => Provider13.effect(ProxmoxLxc, Effect33.succeed(ProxmoxLxc.Provider.of(handlers10)).pipe(Effect33.map(provingResumes)));
+var ProxmoxLxcProvider = () => Provider13.effect(ProxmoxLxc, Effect34.succeed(ProxmoxLxc.Provider.of(handlers10)).pipe(Effect34.map(provingResumes)));
 // src/proxmox/metric-server.ts
 import { Resource as Resource14 } from "alchemy";
 import * as Provider14 from "alchemy/Provider";
-import * as Effect34 from "effect/Effect";
+import * as Effect35 from "effect/Effect";
 
 // src/proxmox/metric-server-form.ts
 var UNSET2 = -1;
@@ -3148,12 +3202,12 @@ var handlers11 = pveHandlers({
   path: (props) => `cluster/metrics/server/${props.id}`,
   updateForm: update
 });
-var ProxmoxMetricServerProvider = () => Provider14.effect(ProxmoxMetricServer, Effect34.succeed(ProxmoxMetricServer.Provider.of(handlers11)));
+var ProxmoxMetricServerProvider = () => Provider14.effect(ProxmoxMetricServer, Effect35.succeed(ProxmoxMetricServer.Provider.of(handlers11)));
 // src/proxmox/network-apply.ts
 import { Resource as Resource15 } from "alchemy";
 import { isResolved as isResolved7 } from "alchemy/Diff";
 import * as Provider15 from "alchemy/Provider";
-import * as Effect35 from "effect/Effect";
+import * as Effect36 from "effect/Effect";
 
 // src/proxmox/apply-endpoints.ts
 var NETWORK_APPLY_ENDPOINT = "pve:PUT /nodes/{node}/network";
@@ -3163,15 +3217,15 @@ var guardSdnApply = guardForm(SDN_APPLY_ENDPOINT, {}, true);
 
 // src/proxmox/network-apply.ts
 var ProxmoxNetworkApply = Resource15("Proxmox.NetworkApply");
-var read2 = (props) => pendingCount(props.target, props.node).pipe(Effect35.map((pending) => ({ node: props.node, pending })));
-var diff2 = (news) => Effect35.gen(function* () {
+var read2 = (props) => pendingCount(props.target, props.node).pipe(Effect36.map((pending) => ({ node: props.node, pending })));
+var diff2 = (news) => Effect36.gen(function* () {
   if (!isResolved7(news))
     return;
   const { pending } = yield* read2(news);
   return pending === 0 ? { action: "noop" } : { action: "update" };
 });
-var refuse = (node, why) => Effect35.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));
-var apply = (props) => Effect35.gen(function* () {
+var refuse = (node, why) => Effect36.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));
+var apply = (props) => Effect36.gen(function* () {
   const node = props.node;
   const staged = yield* pendingCount(props.target, node);
   if (staged === 0)
@@ -3201,17 +3255,17 @@ var apply = (props) => Effect35.gen(function* () {
   return { node, pending: left };
 });
 var handlers12 = {
-  delete: () => Effect35.void,
+  delete: () => Effect36.void,
   diff: ({ news }) => diff2(news),
-  list: () => Effect35.succeed([]),
+  list: () => Effect36.succeed([]),
   read: ({ olds }) => read2(olds),
   reconcile: ({ news }) => apply(news)
 };
-var ProxmoxNetworkApplyProvider = () => Provider15.effect(ProxmoxNetworkApply, Effect35.succeed(ProxmoxNetworkApply.Provider.of(handlers12)));
+var ProxmoxNetworkApplyProvider = () => Provider15.effect(ProxmoxNetworkApply, Effect36.succeed(ProxmoxNetworkApply.Provider.of(handlers12)));
 // src/proxmox/node-network.ts
 import { Resource as Resource16 } from "alchemy";
 import * as Provider16 from "alchemy/Provider";
-import * as Effect36 from "effect/Effect";
+import * as Effect37 from "effect/Effect";
 
 // src/proxmox/node-network-form.ts
 var UNSET3 = -1;
@@ -3250,7 +3304,7 @@ var updateBody2 = (props) => {
   const fields = body4(props);
   return withClears(fields, clear);
 };
-var readAttributes = (live, props) => {
+var readAttributes2 = (live, props) => {
   const liveType = text(live["type"]);
   if (liveType !== "" && liveType !== props.type)
     return;
@@ -3288,7 +3342,7 @@ var ProxmoxNodeNetwork = Resource16("Proxmox.NodeNetwork", {
   defaultRemovalPolicy: "retain"
 });
 var handlers13 = pveHandlers({
-  attributes: readAttributes,
+  attributes: readAttributes2,
   collection: (props) => `nodes/${props.node}/network`,
   createForm: createBody3,
   endpoint: {
@@ -3299,11 +3353,11 @@ var handlers13 = pveHandlers({
   path: (props) => `nodes/${props.node}/network/${props.iface}`,
   updateForm: updateBody2
 });
-var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Effect36.succeed(ProxmoxNodeNetwork.Provider.of(handlers13)));
+var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Effect37.succeed(ProxmoxNodeNetwork.Provider.of(handlers13)));
 // src/proxmox/notification-matcher.ts
 import { Resource as Resource17 } from "alchemy";
 import * as Provider17 from "alchemy/Provider";
-import * as Effect37 from "effect/Effect";
+import * as Effect38 from "effect/Effect";
 
 // src/proxmox/notification-matcher-form.ts
 var list = (value) => Array.isArray(value) ? value.map((item) => String(item)) : [];
@@ -3393,11 +3447,11 @@ var handlers14 = pveHandlers({
   path: (props) => `cluster/notifications/matchers/${props.name}`,
   updateForm: matcherUpdateForm
 });
-var ProxmoxNotificationMatcherProvider = () => Provider17.effect(ProxmoxNotificationMatcher, Effect37.succeed(ProxmoxNotificationMatcher.Provider.of(handlers14)));
+var ProxmoxNotificationMatcherProvider = () => Provider17.effect(ProxmoxNotificationMatcher, Effect38.succeed(ProxmoxNotificationMatcher.Provider.of(handlers14)));
 // src/proxmox/notification-target.ts
 import { Resource as Resource18 } from "alchemy";
 import * as Provider18 from "alchemy/Provider";
-import * as Effect38 from "effect/Effect";
+import * as Effect39 from "effect/Effect";
 
 // src/proxmox/notification-target-endpoint.ts
 var ENDPOINTS = {
@@ -3479,15 +3533,15 @@ var handlers15 = pveHandlers({
   path: (props) => `cluster/notifications/endpoints/${props.type}/${props.name}`,
   updateForm: shape4
 });
-var ProxmoxNotificationTargetProvider = () => Provider18.effect(ProxmoxNotificationTarget, Effect38.succeed(ProxmoxNotificationTarget.Provider.of(handlers15)));
+var ProxmoxNotificationTargetProvider = () => Provider18.effect(ProxmoxNotificationTarget, Effect39.succeed(ProxmoxNotificationTarget.Provider.of(handlers15)));
 // src/proxmox/pbs-datastore.ts
 import { Resource as Resource19 } from "alchemy";
 import { isResolved as isResolved8 } from "alchemy/Diff";
 import * as Provider19 from "alchemy/Provider";
-import * as Effect42 from "effect/Effect";
+import * as Effect43 from "effect/Effect";
 
 // src/proxmox/pbs-datastore-form.ts
-import * as Effect39 from "effect/Effect";
+import * as Effect40 from "effect/Effect";
 var attributes = (live, props) => ({
   backend: propertyString(live["backend"]),
   comment: text(live["comment"]),
@@ -3510,7 +3564,7 @@ var attributes = (live, props) => ({
   "verify-new": bool(live["verify-new"])
 });
 var same4 = (declared, live) => declared === undefined || declared === live;
-var matches = (live, props) => same4(props.comment, live.comment) && same4(props["gc-schedule"]?.trim(), live["gc-schedule"]) && same4(props["prune-schedule"]?.trim(), live["prune-schedule"]) && same4(props["keep-last"], live["keep-last"]) && same4(props["keep-hourly"], live["keep-hourly"]) && same4(props["keep-daily"], live["keep-daily"]) && same4(props["keep-weekly"], live["keep-weekly"]) && same4(props["keep-monthly"], live["keep-monthly"]) && same4(props["keep-yearly"], live["keep-yearly"]) && same4(props["notify-user"], live["notify-user"]) && same4(props["counter-reset-schedule"]?.trim(), live["counter-reset-schedule"]) && (props["notification-thresholds"] === undefined || propertyString(props["notification-thresholds"]) === live["notification-thresholds"]) && same4(props["verify-new"], live["verify-new"]) && (props.notify === undefined || propertyString(props.notify) === live.notify) && (props.tuning === undefined || propertyString(props.tuning) === live.tuning) && (props["maintenance-mode"] === undefined || propertyString(props["maintenance-mode"], "type") === live["maintenance-mode"]);
+var matches2 = (live, props) => same4(props.comment, live.comment) && same4(props["gc-schedule"]?.trim(), live["gc-schedule"]) && same4(props["prune-schedule"]?.trim(), live["prune-schedule"]) && same4(props["keep-last"], live["keep-last"]) && same4(props["keep-hourly"], live["keep-hourly"]) && same4(props["keep-daily"], live["keep-daily"]) && same4(props["keep-weekly"], live["keep-weekly"]) && same4(props["keep-monthly"], live["keep-monthly"]) && same4(props["keep-yearly"], live["keep-yearly"]) && same4(props["notify-user"], live["notify-user"]) && same4(props["counter-reset-schedule"]?.trim(), live["counter-reset-schedule"]) && (props["notification-thresholds"] === undefined || propertyString(props["notification-thresholds"]) === live["notification-thresholds"]) && same4(props["verify-new"], live["verify-new"]) && (props.notify === undefined || propertyString(props.notify) === live.notify) && (props.tuning === undefined || propertyString(props.tuning) === live.tuning) && (props["maintenance-mode"] === undefined || propertyString(props["maintenance-mode"], "type") === live["maintenance-mode"]);
 var set2 = (key, value) => value === undefined ? {} : { [key]: value };
 var count = (value) => value === undefined ? undefined : String(value);
 var mutable = (props) => ({
@@ -3539,35 +3593,35 @@ var createForm4 = (props) => ({
 });
 var updateForm = (props) => mutable(props);
 var object2 = (props) => `config/datastore/${props.name}`;
-var readOne = (props) => pve(props.target, "read", "GET", object2(props)).pipe(Effect39.map((live) => live === undefined || typeof live["name"] !== "string" ? undefined : attributes(live, props)), Effect39.orElseSucceed(() => {
+var readOne = (props) => pve(props.target, "read", "GET", object2(props)).pipe(Effect40.map((live) => live === undefined || typeof live["name"] !== "string" ? undefined : attributes(live, props)), Effect40.orElseSucceed(() => {
   return;
 }));
 
 // src/proxmox/pbs-datastore-guard.ts
-import * as Effect40 from "effect/Effect";
+import * as Effect41 from "effect/Effect";
 var samePath = (left, right) => {
   const trim = (value) => value.length > 1 ? value.replace(/\/+$/, "") : value;
   return trim(left) === trim(right);
 };
-var guardPath = (live, props) => live.path === "" || samePath(live.path, props.path) ? Effect40.void : Effect40.die(new Error(`${object2(props)}: declared path ${props.path} but PBS holds ${live.path}. \`path\` ` + "is create-only, so this cannot be reconciled and will NOT be planned as a silent " + "noop: backups would keep landing in the old directory behind a green plan. Correct " + "the declaration, or remove the datastore and declare a new one -- the contents live, " + "because `destroy-data` is never sent."));
-var guardBackend = (live, props) => props.backend === undefined || propertyString(props.backend) === live.backend ? Effect40.void : Effect40.die(new Error(`${object2(props)}: declared backend ${props.backend} but PBS holds ` + `${live.backend === "" ? "(none — a local datastore)" : live.backend}. \`backend\` ` + "is create-only: PBS has no update for it, so this cannot be reconciled and will NOT " + "be planned as a silent noop. Correct the declaration to match what is really there, " + "or remove the datastore and declare a new one -- the contents live, because " + "`destroy-data` is never sent."));
-var settle3 = (read3, done) => Effect40.gen(function* () {
+var guardPath = (live, props) => live.path === "" || samePath(live.path, props.path) ? Effect41.void : Effect41.die(new Error(`${object2(props)}: declared path ${props.path} but PBS holds ${live.path}. \`path\` ` + "is create-only, so this cannot be reconciled and will NOT be planned as a silent " + "noop: backups would keep landing in the old directory behind a green plan. Correct " + "the declaration, or remove the datastore and declare a new one -- the contents live, " + "because `destroy-data` is never sent."));
+var guardBackend = (live, props) => props.backend === undefined || propertyString(props.backend) === live.backend ? Effect41.void : Effect41.die(new Error(`${object2(props)}: declared backend ${props.backend} but PBS holds ` + `${live.backend === "" ? "(none — a local datastore)" : live.backend}. \`backend\` ` + "is create-only: PBS has no update for it, so this cannot be reconciled and will NOT " + "be planned as a silent noop. Correct the declaration to match what is really there, " + "or remove the datastore and declare a new one -- the contents live, because " + "`destroy-data` is never sent."));
+var settle3 = (read3, done) => Effect41.gen(function* () {
   for (let attempt = 0;attempt < 60; attempt += 1) {
     const live = yield* read3;
     if (done(live))
       return live;
-    yield* Effect40.sleep("2 seconds");
+    yield* Effect41.sleep("2 seconds");
   }
   return yield* read3;
 });
 
 // src/proxmox/pbs-datastore-endpoint.ts
-import * as Effect41 from "effect/Effect";
+import * as Effect42 from "effect/Effect";
 var DATASTORE_ENDPOINT = {
   create: "pbs:POST /config/datastore",
   update: "pbs:PUT /config/datastore/{name}"
 };
-var guardDatastoreForms = (props) => Effect41.gen(function* () {
+var guardDatastoreForms = (props) => Effect42.gen(function* () {
   yield* guardForm(DATASTORE_ENDPOINT.create, createForm4(props), true);
   yield* guardForm(DATASTORE_ENDPOINT.update, updateForm(props), false);
 });
@@ -3576,10 +3630,10 @@ var guardDatastoreForms = (props) => Effect41.gen(function* () {
 var PbsDatastore = Resource19("Pbs.Datastore", {
   defaultRemovalPolicy: "retain"
 });
-var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect42.succeed(PbsDatastore.Provider.of({
-  list: () => Effect42.succeed([]),
+var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect43.succeed(PbsDatastore.Provider.of({
+  list: () => Effect43.succeed([]),
   read: ({ olds }) => readOne(olds),
-  diff: ({ news, output }) => Effect42.gen(function* () {
+  diff: ({ news, output }) => Effect43.gen(function* () {
     if (!isResolved8(news))
       return;
     yield* guardDatastoreForms(news);
@@ -3590,9 +3644,9 @@ var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect42.succee
       return { action: "update" };
     yield* guardPath(live, news);
     yield* guardBackend(live, news);
-    return matches(live, news) ? { action: "noop" } : { action: "update" };
+    return matches2(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect42.fn(function* ({ news }) {
+  reconcile: Effect43.fn(function* ({ news }) {
     yield* guardDatastoreForms(news);
     const live = yield* readOne(news);
     let upid;
@@ -3601,29 +3655,29 @@ var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect42.succee
     } else {
       yield* guardPath(live, news);
       yield* guardBackend(live, news);
-      const form = formToSend(matches, live, news, updateForm(news));
+      const form = formToSend(matches2, live, news, updateForm(news));
       if (form !== undefined) {
         yield* pve(news.target, "provision", "PUT", object2(news), form);
       }
     }
-    const after = yield* settle3(readOne(news), (row) => row !== undefined && matches(row, news));
-    if (after === undefined || !matches(after, news)) {
-      return yield* Effect42.die(new Error(`${object2(news)}: the write returned no error but the datastore still does not ` + `match the declaration after 120s. PBS answered with task ${upid ?? "(none)"} ` + "-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a " + "plausible cause (see `settle`); a create over an existing chunk store is not, " + "because PBS refuses that outright rather than timing out."));
+    const after = yield* settle3(readOne(news), (row) => row !== undefined && matches2(row, news));
+    if (after === undefined || !matches2(after, news)) {
+      return yield* Effect43.die(new Error(`${object2(news)}: the write returned no error but the datastore still does not ` + `match the declaration after 120s. PBS answered with task ${upid ?? "(none)"} ` + "-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a " + "plausible cause (see `settle`); a create over an existing chunk store is not, " + "because PBS refuses that outright rather than timing out."));
     }
     return after;
   }),
-  delete: Effect42.fn(function* ({ olds }) {
+  delete: Effect43.fn(function* ({ olds }) {
     yield* pve(olds.target, "provision", "DELETE", object2(olds));
     const left = yield* settle3(readOne(olds), (row) => row === undefined);
     if (left !== undefined) {
-      return yield* Effect42.die(new Error(`${object2(olds)}: the DELETE returned no error but the datastore is still in ` + "datastore.cfg after 120s. Either a backup, verify or GC task still holds it, " + "or the provision role lacks Datastore.Allocate on /datastore/" + `${olds.name}. Read the task log with \`proxmox-backup-manager task log <upid>\`.`));
+      return yield* Effect43.die(new Error(`${object2(olds)}: the DELETE returned no error but the datastore is still in ` + "datastore.cfg after 120s. Either a backup, verify or GC task still holds it, " + "or the provision role lacks Datastore.Allocate on /datastore/" + `${olds.name}. Read the task log with \`proxmox-backup-manager task log <upid>\`.`));
     }
   })
 })));
 // src/proxmox/pbs-notification-matcher.ts
 import { Resource as Resource20 } from "alchemy";
 import * as Provider20 from "alchemy/Provider";
-import * as Effect43 from "effect/Effect";
+import * as Effect44 from "effect/Effect";
 var PbsNotificationMatcher = Resource20("Pbs.NotificationMatcher");
 var handlers16 = pveHandlers({
   attributes: (live, props) => matcherAttributes(live, props.name),
@@ -3637,15 +3691,15 @@ var handlers16 = pveHandlers({
   path: (props) => `config/notifications/matchers/${props.name}`,
   updateForm: matcherUpdateForm
 });
-var PbsNotificationMatcherProvider = () => Provider20.effect(PbsNotificationMatcher, Effect43.succeed(PbsNotificationMatcher.Provider.of(handlers16)));
+var PbsNotificationMatcherProvider = () => Provider20.effect(PbsNotificationMatcher, Effect44.succeed(PbsNotificationMatcher.Provider.of(handlers16)));
 // src/proxmox/pbs-notification-target.ts
 import { Resource as Resource21 } from "alchemy";
 import * as Provider21 from "alchemy/Provider";
-import * as Effect45 from "effect/Effect";
+import * as Effect46 from "effect/Effect";
 
 // src/proxmox/pbs-notification-target-lifecycle.ts
 import { isResolved as isResolved9 } from "alchemy/Diff";
-import * as Effect44 from "effect/Effect";
+import * as Effect45 from "effect/Effect";
 
 // src/proxmox/pbs-notification-target-endpoint.ts
 var ENDPOINTS2 = {
@@ -3922,12 +3976,12 @@ var targetForm = (props, groups, carry, mode) => {
 
 // src/proxmox/pbs-notification-target-lifecycle.ts
 var path = (props) => `config/notifications/endpoints/${props.type}/${props.name}`;
-var readLive2 = (props) => pve(props.target, "read", "GET", path(props)).pipe(Effect44.map((data) => data == null ? undefined : targetAttributes(data, props)), Effect44.orElseSucceed(() => {
+var readLive2 = (props) => pve(props.target, "read", "GET", path(props)).pipe(Effect45.map((data) => data == null ? undefined : targetAttributes(data, props)), Effect45.orElseSucceed(() => {
   return;
 }));
 var refuse2 = (props) => {
   const reasons = refusals(props);
-  return reasons.length === 0 ? Effect44.void : Effect44.die(new Error(`${path(props)}: ${reasons.join("; ")}.`));
+  return reasons.length === 0 ? Effect45.void : Effect45.die(new Error(`${path(props)}: ${reasons.join("; ")}.`));
 };
 var toCarry = (live, props, groups, sealed) => {
   const header = headerState(live, props, groups) === "stale";
@@ -3939,16 +3993,16 @@ var requireValues = (props, groups, carry) => {
     ...carry.header ? groups.header.missing : [],
     ...carry.sealed ? groups.sealed.missing : []
   ];
-  return missing.length === 0 ? Effect44.void : Effect44.die(new Error(`${path(props)}: this write must send write-only values, and ${missing.join(", ")} ` + "is unset or empty in the deploying environment. Export it and deploy again."));
+  return missing.length === 0 ? Effect45.void : Effect45.die(new Error(`${path(props)}: this write must send write-only values, and ${missing.join(", ")} ` + "is unset or empty in the deploying environment. Export it and deploy again."));
 };
 var handlers17 = {
-  list: () => Effect44.succeed([]),
-  read: ({ olds, output }) => (output === undefined ? refuse2(olds) : Effect44.void).pipe(Effect44.andThen(readLive2(olds)), Effect44.map((live) => live === undefined ? undefined : { ...live, sealed: output?.sealed ?? "" })),
+  list: () => Effect45.succeed([]),
+  read: ({ olds, output }) => (output === undefined ? refuse2(olds) : Effect45.void).pipe(Effect45.andThen(readLive2(olds)), Effect45.map((live) => live === undefined ? undefined : { ...live, sealed: output?.sealed ?? "" })),
   diff: ({
     news,
     olds,
     output
-  }) => Effect44.gen(function* () {
+  }) => Effect45.gen(function* () {
     if (output === undefined || !isResolved9(news))
       return;
     if (olds !== undefined && (olds.type !== news.type || olds.name !== news.name)) {
@@ -3960,7 +4014,7 @@ var handlers17 = {
       return { action: "update" };
     return toCarry(live, news, resolveGroups(news), output.sealed) === undefined ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: ({ news, output }) => Effect44.gen(function* () {
+  reconcile: ({ news, output }) => Effect45.gen(function* () {
     yield* refuse2(news);
     const groups = resolveGroups(news);
     const live = yield* readLive2(news);
@@ -3986,7 +4040,7 @@ var handlers17 = {
     }
     const after = yield* readLive2(news);
     if (after === undefined) {
-      return yield* Effect44.die(new Error(`${path(news)}: the write returned no error but the target is still absent.`));
+      return yield* Effect45.die(new Error(`${path(news)}: the write returned no error but the target is still absent.`));
     }
     return { ...after, sealed };
   }),
@@ -3995,11 +4049,11 @@ var handlers17 = {
 
 // src/proxmox/pbs-notification-target.ts
 var PbsNotificationTarget = Resource21("Pbs.NotificationTarget");
-var PbsNotificationTargetProvider = () => Provider21.effect(PbsNotificationTarget, Effect45.succeed(PbsNotificationTarget.Provider.of(handlers17)));
+var PbsNotificationTargetProvider = () => Provider21.effect(PbsNotificationTarget, Effect46.succeed(PbsNotificationTarget.Provider.of(handlers17)));
 // src/proxmox/pbs-prune-job.ts
 import { Resource as Resource22 } from "alchemy";
 import * as Provider22 from "alchemy/Provider";
-import * as Effect46 from "effect/Effect";
+import * as Effect47 from "effect/Effect";
 
 // src/proxmox/pbs-prune-job-form.ts
 var KEEP_KEYS = [
@@ -4075,11 +4129,11 @@ var handlers18 = pveHandlers({
   path: (props) => `config/prune/${props.id}`,
   updateForm: updateBody3
 });
-var PbsPruneJobProvider = () => Provider22.effect(PbsPruneJob, Effect46.succeed(PbsPruneJob.Provider.of(handlers18)));
+var PbsPruneJobProvider = () => Provider22.effect(PbsPruneJob, Effect47.succeed(PbsPruneJob.Provider.of(handlers18)));
 // src/proxmox/pbs-sync-job.ts
 import { Resource as Resource23 } from "alchemy";
 import * as Provider23 from "alchemy/Provider";
-import * as Effect47 from "effect/Effect";
+import * as Effect48 from "effect/Effect";
 
 // src/proxmox/pbs-sync-job-form.ts
 var UNSET4 = -1;
@@ -4156,11 +4210,11 @@ var handlers19 = pveHandlers({
 
 // src/proxmox/pbs-sync-job.ts
 var PbsSyncJob = Resource23("Pbs.SyncJob");
-var PbsSyncJobProvider = () => Provider23.effect(PbsSyncJob, Effect47.succeed(PbsSyncJob.Provider.of(handlers19)));
+var PbsSyncJobProvider = () => Provider23.effect(PbsSyncJob, Effect48.succeed(PbsSyncJob.Provider.of(handlers19)));
 // src/proxmox/pbs-verify-job.ts
 import { Resource as Resource24 } from "alchemy";
 import * as Provider24 from "alchemy/Provider";
-import * as Effect48 from "effect/Effect";
+import * as Effect49 from "effect/Effect";
 
 // src/proxmox/pbs-verify-job-form.ts
 var rechecks = (ignoreVerified, outdatedAfter) => {
@@ -4205,11 +4259,11 @@ var handlers20 = pveHandlers({
   path: (props) => `config/verify/${props.id}`,
   updateForm: shape7
 });
-var PbsVerifyJobProvider = () => Provider24.effect(PbsVerifyJob, Effect48.succeed(PbsVerifyJob.Provider.of(handlers20)));
+var PbsVerifyJobProvider = () => Provider24.effect(PbsVerifyJob, Effect49.succeed(PbsVerifyJob.Provider.of(handlers20)));
 // src/proxmox/pool.ts
 import { Resource as Resource25 } from "alchemy";
 import * as Provider25 from "alchemy/Provider";
-import * as Effect49 from "effect/Effect";
+import * as Effect50 from "effect/Effect";
 var ProxmoxPool = Resource25("Proxmox.Pool");
 var poolCreateForm = (props) => ({
   comment: props.comment ?? "",
@@ -4234,7 +4288,7 @@ var handlers21 = pveHandlers({
   path: (props) => `pools/${props.poolid}`,
   updateForm: poolUpdateForm
 });
-var ProxmoxPoolProvider = () => Provider25.effect(ProxmoxPool, Effect49.succeed(ProxmoxPool.Provider.of(handlers21)));
+var ProxmoxPoolProvider = () => Provider25.effect(ProxmoxPool, Effect50.succeed(ProxmoxPool.Provider.of(handlers21)));
 // src/proxmox/provision-baseline.ts
 var PROVISION_PRIVILEGES = Object.freeze([
   "Datastore.Allocate",
@@ -4427,12 +4481,12 @@ echo 'provision baseline: done. Next: point the OpenBao proxmox mount at these u
 // src/proxmox/provision-declare.ts
 import { adopt } from "alchemy/AdoptPolicy";
 import * as RemovalPolicy from "alchemy/RemovalPolicy";
-import * as Effect52 from "effect/Effect";
+import * as Effect53 from "effect/Effect";
 
 // src/proxmox/role.ts
 import { Resource as Resource26 } from "alchemy";
 import * as Provider26 from "alchemy/Provider";
-import * as Effect50 from "effect/Effect";
+import * as Effect51 from "effect/Effect";
 var ProxmoxRole = Resource26("Proxmox.Role");
 var canonical2 = (privs) => [...new Set(privs.map((priv) => priv.trim()).filter((priv) => priv.length > 0))].sort();
 var livePrivs = (live) => {
@@ -4450,12 +4504,12 @@ var handlers22 = pveHandlers({
   path: (props) => `access/roles/${props.roleid}`,
   updateForm: (props) => ({ privs: canonical2(props.privs).join(",") })
 });
-var ProxmoxRoleProvider = () => Provider26.effect(ProxmoxRole, Effect50.succeed(ProxmoxRole.Provider.of(handlers22)));
+var ProxmoxRoleProvider = () => Provider26.effect(ProxmoxRole, Effect51.succeed(ProxmoxRole.Provider.of(handlers22)));
 
 // src/proxmox/user.ts
 import { Resource as Resource27 } from "alchemy";
 import * as Provider27 from "alchemy/Provider";
-import * as Effect51 from "effect/Effect";
+import * as Effect52 from "effect/Effect";
 var ProxmoxUser = Resource27("Proxmox.User");
 var str2 = (value) => typeof value === "string" ? value : "";
 var int2 = (value) => {
@@ -4496,11 +4550,11 @@ var handlers23 = pveHandlers({
   path: (props) => `access/users/${props.userid}`,
   updateForm: shape8
 });
-var ProxmoxUserProvider = () => Provider27.effect(ProxmoxUser, Effect51.succeed(ProxmoxUser.Provider.of(handlers23)));
+var ProxmoxUserProvider = () => Provider27.effect(ProxmoxUser, Effect52.succeed(ProxmoxUser.Provider.of(handlers23)));
 
 // src/proxmox/provision-declare.ts
-var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect52.gen(function* () {
-  const baseline = yield* Effect52.try({
+var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect53.gen(function* () {
+  const baseline = yield* Effect53.try({
     catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
     try: () => provisionBaseline(names2)
   });
@@ -4514,13 +4568,13 @@ var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect
     target
   }));
   const group = yield* owned(ProxmoxGroup(`${id}-mint-group`, { ...baseline.group, target }));
-  const users = yield* Effect52.all(baseline.users.map((user) => owned(ProxmoxUser(`${id}-${user.lane}-user`, {
+  const users = yield* Effect53.all(baseline.users.map((user) => owned(ProxmoxUser(`${id}-${user.lane}-user`, {
     comment: user.comment,
     groups: [...user.groups],
     target,
     userid: user.userid
   }))));
-  const grants = yield* Effect52.all(baseline.grants.map((grant) => owned(ProxmoxAcl(`${id}-${grant.lane}-grant`, {
+  const grants = yield* Effect53.all(baseline.grants.map((grant) => owned(ProxmoxAcl(`${id}-${grant.lane}-grant`, {
     path: "/",
     propagate: true,
     roleid: grant.roleid,
@@ -4533,7 +4587,7 @@ var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect
 // src/proxmox/qemu.ts
 import { Resource as Resource28 } from "alchemy";
 import * as Provider28 from "alchemy/Provider";
-import * as Effect53 from "effect/Effect";
+import * as Effect54 from "effect/Effect";
 var ProxmoxVm = Resource28("Proxmox.Vm");
 var createForm5 = (props) => ({ ...shape9(props), vmid: String(props.vmid) });
 var shape9 = (props) => ({
@@ -4564,11 +4618,11 @@ var handlers24 = pveHandlers({
   path: (props) => `nodes/${props.node}/qemu/${String(props.vmid)}/config`,
   updateForm: shape9
 });
-var ProxmoxVmProvider = () => Provider28.effect(ProxmoxVm, Effect53.succeed(ProxmoxVm.Provider.of(handlers24)));
+var ProxmoxVmProvider = () => Provider28.effect(ProxmoxVm, Effect54.succeed(ProxmoxVm.Provider.of(handlers24)));
 // src/proxmox/replication-job.ts
 import { Resource as Resource29 } from "alchemy";
 import * as Provider29 from "alchemy/Provider";
-import * as Effect54 from "effect/Effect";
+import * as Effect55 from "effect/Effect";
 
 // src/proxmox/replication-job-form.ts
 var DEFAULT_SCHEDULE = "*/15";
@@ -4622,15 +4676,15 @@ var handlers25 = pveHandlers({
   path: (props) => `cluster/replication/${jobId(props)}`,
   updateForm: updateBody5
 });
-var ProxmoxReplicationJobProvider = () => Provider29.effect(ProxmoxReplicationJob, Effect54.succeed(ProxmoxReplicationJob.Provider.of(handlers25)));
+var ProxmoxReplicationJobProvider = () => Provider29.effect(ProxmoxReplicationJob, Effect55.succeed(ProxmoxReplicationJob.Provider.of(handlers25)));
 // src/proxmox/sdn-apply.ts
 import { Resource as Resource30 } from "alchemy";
 import { isResolved as isResolved10 } from "alchemy/Diff";
 import * as Provider30 from "alchemy/Provider";
-import * as Effect56 from "effect/Effect";
+import * as Effect57 from "effect/Effect";
 
 // src/proxmox/sdn-apply-read.ts
-import * as Effect55 from "effect/Effect";
+import * as Effect56 from "effect/Effect";
 var MARKED = [
   "cluster/sdn/zones",
   "cluster/sdn/vnets",
@@ -4639,7 +4693,7 @@ var MARKED = [
   "cluster/sdn/route-maps"
 ];
 var subsystemAbsent = (error) => error instanceof PveError && error.status === 501;
-var markedPending = (target) => Effect55.all(MARKED.map((collection2) => pve(target, "read", "GET", `${collection2}?pending=1`).pipe(Effect55.map((rows) => (rows ?? []).filter((row) => row.state !== undefined).length), Effect55.catchIf(subsystemAbsent, () => Effect55.succeed(0)))), { concurrency: "unbounded" }).pipe(Effect55.map((counts) => counts.reduce((total, count2) => total + count2, 0)));
+var markedPending = (target) => Effect56.all(MARKED.map((collection2) => pve(target, "read", "GET", `${collection2}?pending=1`).pipe(Effect56.map((rows) => (rows ?? []).filter((row) => row.state !== undefined).length), Effect56.catchIf(subsystemAbsent, () => Effect56.succeed(0)))), { concurrency: "unbounded" }).pipe(Effect56.map((counts) => counts.reduce((total, count2) => total + count2, 0)));
 var fabricStaged = (staged, running) => {
   if (staged === undefined && running === undefined)
     return 0;
@@ -4647,9 +4701,9 @@ var fabricStaged = (staged, running) => {
     return "inconsistent";
   return staged === running ? 0 : 1;
 };
-var fabricPending = (target) => Effect55.all(["pending", "running"].map((view) => pve(target, "read", "GET", `cluster/sdn/fabrics/all?${view}=1`).pipe(Effect55.map(canonical3), Effect55.catchIf(subsystemAbsent, () => Effect55.succeed(undefined)))), { concurrency: "unbounded" }).pipe(Effect55.flatMap(([staged, running]) => {
+var fabricPending = (target) => Effect56.all(["pending", "running"].map((view) => pve(target, "read", "GET", `cluster/sdn/fabrics/all?${view}=1`).pipe(Effect56.map(canonical3), Effect56.catchIf(subsystemAbsent, () => Effect56.succeed(undefined)))), { concurrency: "unbounded" }).pipe(Effect56.flatMap(([staged, running]) => {
   const verdict = fabricStaged(staged, running);
-  return verdict === "inconsistent" ? Effect55.die(new Error("cluster/sdn/fabrics/all answered 501 for one of ?pending=1 and ?running=1 and not " + "the other. Refusing to read that as a staged fabric change.")) : Effect55.succeed(verdict);
+  return verdict === "inconsistent" ? Effect56.die(new Error("cluster/sdn/fabrics/all answered 501 for one of ?pending=1 and ?running=1 and not " + "the other. Refusing to read that as a staged fabric change.")) : Effect56.succeed(verdict);
 }));
 var canonical3 = (value) => JSON.stringify(sortDeep(value));
 var sortDeep = (value) => {
@@ -4662,23 +4716,23 @@ var sortDeep = (value) => {
   }
   return value;
 };
-var sdnPendingCount = (target) => Effect55.all([markedPending(target), fabricPending(target)], { concurrency: "unbounded" }).pipe(Effect55.map(([marked, fabric]) => marked + fabric));
+var sdnPendingCount = (target) => Effect56.all([markedPending(target), fabricPending(target)], { concurrency: "unbounded" }).pipe(Effect56.map(([marked, fabric]) => marked + fabric));
 
 // src/proxmox/sdn-apply.ts
 var ProxmoxSdnApply = Resource30("Proxmox.SdnApply");
-var read3 = (props) => sdnPendingCount(props.target).pipe(Effect56.map((pending) => ({ pending })));
-var ProxmoxSdnApplyProvider = () => Provider30.effect(ProxmoxSdnApply, Effect56.succeed(ProxmoxSdnApply.Provider.of({
-  list: () => Effect56.succeed([]),
-  read: Effect56.fn(function* ({ olds }) {
+var read3 = (props) => sdnPendingCount(props.target).pipe(Effect57.map((pending) => ({ pending })));
+var ProxmoxSdnApplyProvider = () => Provider30.effect(ProxmoxSdnApply, Effect57.succeed(ProxmoxSdnApply.Provider.of({
+  list: () => Effect57.succeed([]),
+  read: Effect57.fn(function* ({ olds }) {
     return yield* read3(olds);
   }),
-  diff: Effect56.fn(function* ({ news }) {
+  diff: Effect57.fn(function* ({ news }) {
     if (!isResolved10(news))
       return;
     const { pending } = yield* read3(news);
     return pending === 0 ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect56.fn(function* ({ news }) {
+  reconcile: Effect57.fn(function* ({ news }) {
     const staged = yield* read3(news);
     if (staged.pending === 0)
       return staged;
@@ -4686,16 +4740,16 @@ var ProxmoxSdnApplyProvider = () => Provider30.effect(ProxmoxSdnApply, Effect56.
     yield* pve(news.target, "provision", "PUT", "cluster/sdn");
     const after = yield* read3(news);
     if (after.pending !== 0) {
-      return yield* Effect56.die(new Error(`PUT /cluster/sdn returned no error but ${String(after.pending)} SDN object(s) ` + "are still staged. The running config does not match the declared one -- check " + "`pvesh get /cluster/sdn/zones --pending 1` for the objects PVE refused."));
+      return yield* Effect57.die(new Error(`PUT /cluster/sdn returned no error but ${String(after.pending)} SDN object(s) ` + "are still staged. The running config does not match the declared one -- check " + "`pvesh get /cluster/sdn/zones --pending 1` for the objects PVE refused."));
     }
     return after;
   }),
-  delete: () => Effect56.void
+  delete: () => Effect57.void
 })));
 // src/proxmox/sdn-subnet.ts
 import { Resource as Resource31 } from "alchemy";
 import * as Provider31 from "alchemy/Provider";
-import * as Effect57 from "effect/Effect";
+import * as Effect58 from "effect/Effect";
 
 // src/proxmox/sdn-subnet-form.ts
 var subnetId = (props) => `${props.zone}-${props.cidr.replace("/", "-")}`;
@@ -4755,11 +4809,11 @@ var handlers26 = pveHandlers({
   path: (props) => `cluster/sdn/vnets/${props.vnet}/subnets/${subnetId(props)}`,
   updateForm: updateForm2
 });
-var ProxmoxSdnSubnetProvider = () => Provider31.effect(ProxmoxSdnSubnet, Effect57.succeed(ProxmoxSdnSubnet.Provider.of(handlers26)));
+var ProxmoxSdnSubnetProvider = () => Provider31.effect(ProxmoxSdnSubnet, Effect58.succeed(ProxmoxSdnSubnet.Provider.of(handlers26)));
 // src/proxmox/sdn-vnet.ts
 import { Resource as Resource32 } from "alchemy";
 import * as Provider32 from "alchemy/Provider";
-import * as Effect58 from "effect/Effect";
+import * as Effect59 from "effect/Effect";
 var ProxmoxSdnVnet = Resource32("Proxmox.SdnVnet");
 var tagOf = (value) => typeof value === "number" ? value : undefined;
 var shape11 = (props) => {
@@ -4797,11 +4851,11 @@ var handlers27 = pveHandlers({
   path: (props) => `cluster/sdn/vnets/${props.vnet}`,
   updateForm: updateForm3
 });
-var ProxmoxSdnVnetProvider = () => Provider32.effect(ProxmoxSdnVnet, Effect58.succeed(ProxmoxSdnVnet.Provider.of(handlers27)));
+var ProxmoxSdnVnetProvider = () => Provider32.effect(ProxmoxSdnVnet, Effect59.succeed(ProxmoxSdnVnet.Provider.of(handlers27)));
 // src/proxmox/sdn-zone.ts
 import { Resource as Resource33 } from "alchemy";
 import * as Provider33 from "alchemy/Provider";
-import * as Effect59 from "effect/Effect";
+import * as Effect60 from "effect/Effect";
 var ProxmoxSdnZone = Resource33("Proxmox.SdnZone");
 var sameIpam = (live, declared2) => (live === "" ? "pve" : live) === (declared2 === undefined || declared2 === "" ? "pve" : declared2);
 var body6 = (props) => ({
@@ -4854,11 +4908,11 @@ var handlers28 = pveHandlers({
     return withClears(fields, clear);
   }
 });
-var ProxmoxSdnZoneProvider = () => Provider33.effect(ProxmoxSdnZone, Effect59.succeed(ProxmoxSdnZone.Provider.of(handlers28)));
+var ProxmoxSdnZoneProvider = () => Provider33.effect(ProxmoxSdnZone, Effect60.succeed(ProxmoxSdnZone.Provider.of(handlers28)));
 // src/proxmox/storage.ts
 import { Resource as Resource34 } from "alchemy";
 import * as Provider34 from "alchemy/Provider";
-import * as Effect60 from "effect/Effect";
+import * as Effect61 from "effect/Effect";
 var ProxmoxStorage = Resource34("Proxmox.Storage", {
   defaultRemovalPolicy: "retain"
 });
@@ -4904,14 +4958,14 @@ var handlers29 = pveHandlers({
   path: (props) => `storage/${props.storage}`,
   updateForm: mutable2
 });
-var ProxmoxStorageProvider = () => Provider34.effect(ProxmoxStorage, Effect60.succeed(ProxmoxStorage.Provider.of(handlers29)));
+var ProxmoxStorageProvider = () => Provider34.effect(ProxmoxStorage, Effect61.succeed(ProxmoxStorage.Provider.of(handlers29)));
 // src/proxmox/zfs-pool.ts
 import { Resource as Resource35 } from "alchemy";
 import * as Provider35 from "alchemy/Provider";
-import * as Effect62 from "effect/Effect";
+import * as Effect63 from "effect/Effect";
 
 // src/proxmox/zfs-pool-write.ts
-import * as Effect61 from "effect/Effect";
+import * as Effect62 from "effect/Effect";
 var ZFS_POOL_ENDPOINT = { create: "pve:POST /nodes/{node}/disks/zfs" };
 var zfsPoolEndpoint = (props) => props.devices === undefined || props.raidlevel === undefined ? {} : ZFS_POOL_ENDPOINT;
 var createForm7 = (props) => ({
@@ -4923,24 +4977,24 @@ var createForm7 = (props) => ({
   ...props["draid-config"] === undefined ? {} : { "draid-config": props["draid-config"] }
 });
 var SETTLE_ATTEMPTS = 30;
-var createPool = (props, collection2, path2, read4) => Effect61.gen(function* () {
+var createPool = (props, collection2, path2, read4) => Effect62.gen(function* () {
   const existing = yield* read4(props);
   if (existing !== undefined)
     return existing;
   if (props.devices === undefined || props.raidlevel === undefined) {
-    return yield* Effect61.die(new Error(`${props.node}/${props.name}: this is an adopt-only declaration (no \`devices\` or ` + "`raidlevel`) and the pool is not there to adopt. An adopt-only Proxmox.ZfsPool never " + "creates -- declare both fields for a pool this resource should build, or point this " + "declaration at a pool that already exists on this node."));
+    return yield* Effect62.die(new Error(`${props.node}/${props.name}: this is an adopt-only declaration (no \`devices\` or ` + "`raidlevel`) and the pool is not there to adopt. An adopt-only Proxmox.ZfsPool never " + "creates -- declare both fields for a pool this resource should build, or point this " + "declaration at a pool that already exists on this node."));
   }
   const upid = yield* pve(props.target, "provision", "POST", collection2, createForm7(props));
-  const settle4 = (attempts) => Effect61.gen(function* () {
+  const settle4 = (attempts) => Effect62.gen(function* () {
     const live = yield* read4(props);
     if (live !== undefined || attempts <= 0)
       return live;
-    yield* Effect61.sleep("2 seconds");
+    yield* Effect62.sleep("2 seconds");
     return yield* settle4(attempts - 1);
   });
   const after = yield* settle4(SETTLE_ATTEMPTS);
   if (after === undefined) {
-    return yield* Effect61.die(new Error(`${path2}: POST returned ${text(upid, "(no UPID)")} but the pool has not appeared. That ` + "POST only forks a `zfscreate` worker, so the task holds the real error -- read it " + `with \`pvesh get /nodes/${props.node}/tasks/<upid>/log\`. NOTHING WAS RETRIED AND ` + "NOTHING WAS CLEANED UP: if the worker reached `zpool create`, the declared devices " + "have already been written to."));
+    return yield* Effect62.die(new Error(`${path2}: POST returned ${text(upid, "(no UPID)")} but the pool has not appeared. That ` + "POST only forks a `zfscreate` worker, so the task holds the real error -- read it " + `with \`pvesh get /nodes/${props.node}/tasks/<upid>/log\`. NOTHING WAS RETRIED AND ` + "NOTHING WAS CLEANED UP: if the worker reached `zpool create`, the declared devices " + "have already been written to."));
   }
   return after;
 });
@@ -4975,15 +5029,15 @@ var spec2 = {
 var ProxmoxZfsPool = Resource35("Proxmox.ZfsPool", {
   defaultRemovalPolicy: "retain"
 });
-var ops5 = pveOperations(spec2);
+var ops4 = pveOperations(spec2);
 var handlers30 = {
   ...pveHandlers(spec2),
-  delete: Effect62.fn(function* ({ olds }) {
+  delete: Effect63.fn(function* ({ olds }) {
     yield* destroyPool(olds, spec2.path(olds));
   }),
-  reconcile: ({ news }) => createPool(news, spec2.collection(news), spec2.path(news), ops5.read)
+  reconcile: ({ news }) => createPool(news, spec2.collection(news), spec2.path(news), ops4.read)
 };
-var ProxmoxZfsPoolProvider = () => Provider35.effect(ProxmoxZfsPool, Effect62.succeed(ProxmoxZfsPool.Provider.of(handlers30)));
+var ProxmoxZfsPoolProvider = () => Provider35.effect(ProxmoxZfsPool, Effect63.succeed(ProxmoxZfsPool.Provider.of(handlers30)));
 export {
   PROVISION_DEFAULTS,
   PROVISION_PRIVILEGES,
@@ -5060,5 +5114,5 @@ export {
   violations
 };
 
-//# debugId=F5942CE0240303BA64756E2164756E21
+//# debugId=FBBA36EF988E48B764756E2164756E21
 //# sourceMappingURL=index.js.map