@homeflare/alchemy 0.37.1 → 0.37.3

package/dist/proxmox/index.js

@@ -1440,89 +1440,23 @@ var ProxmoxApiTokenProvider = () => Provider2.effect(ProxmoxApiToken, Effect8.su
 })));
 // src/proxmox/backup-job.ts
 import { Resource as Resource3 } from "alchemy";
-import * as Provider3 from "alchemy/Provider";
-import * as Effect12 from "effect/Effect";
-
-// src/proxmox/resource.ts
 import { isResolved as isResolved3 } from "alchemy/Diff";
-import * as Effect11 from "effect/Effect";
-
-// src/proxmox/client.ts
-import * as Effect9 from "effect/Effect";
-import * as HttpClient5 from "effect/unstable/http/HttpClient";
-import * as HttpClientRequest2 from "effect/unstable/http/HttpClientRequest";
-class PveError extends Error {
-  status;
-  method;
-  path;
-  constructor(status, method, path, detail) {
-    super(`PVE ${method} ${path} -> ${String(status)}: ${detail}`);
-    this.status = status;
-    this.method = method;
-    this.path = path;
-    this.name = "PveError";
-  }
-}
-var clusterExhausted = (method, path, attempts) => new PveError(0, method, path, `all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join("; ")}`);
-var encode = (form) => {
-  const params = new URLSearchParams;
-  for (const [key, value] of Object.entries(form)) {
-    if (typeof value === "string")
-      params.append(key, value);
-    else
-      for (const item of value)
-        params.append(key, item);
-  }
-  return params.toString();
-};
-var buildRequest = (method, apiBase, path, credential, target, form) => {
-  const url = `${apiBase}/${path}`;
-  return HttpClientRequest2.make(method)(url).pipe(HttpClientRequest2.setHeaders({ Authorization: authorization(credential, target) }), form === undefined ? (self) => self : HttpClientRequest2.bodyText(encode(form), "application/x-www-form-urlencoded"));
-};
-var executeOne = (target, credential, method, path, form, apiBase) => Effect9.gen(function* () {
-  const client = yield* HttpClient5.HttpClient;
-  const request = buildRequest(method, apiBase, path, credential, target, form);
-  return yield* client.execute(request).pipe(Effect9.mapError((cause) => new PveError(0, method, path, String(cause))));
-});
-var readResponse = (response, method, path) => Effect9.gen(function* () {
-  if (response.status < 200 || response.status >= 300) {
-    const detail = yield* response.text.pipe(Effect9.orElseSucceed(() => ""));
-    return yield* Effect9.fail(new PveError(response.status, method, path, detail.slice(0, 300)));
-  }
-  const body = yield* response.json.pipe(Effect9.mapError((cause) => new PveError(0, method, path, String(cause))));
-  return body.data;
-});
-var pveWith = (target, credential, method, path, form) => Effect9.gen(function* () {
-  const response = target.scheme === "pve" ? yield* executeOnCluster(target, method, path, (apiBase) => buildRequest(method, apiBase, path, credential, target, form)).pipe(Effect9.mapError((failure) => failure.tag === "cluster" ? clusterExhausted(failure.method, failure.path, failure.attempts) : new PveError(0, method, path, String(failure)))) : yield* executeOne(target, credential, method, path, form, target.api);
-  return yield* readResponse(response, method, path);
-});
-var pveEnvelopeWith = (target, credential, method, path) => Effect9.gen(function* () {
-  const response = yield* executeOnCluster(target, method, path, (apiBase) => buildRequest(method, apiBase, path, credential, target)).pipe(Effect9.mapError((failure) => failure.tag === "cluster" ? clusterExhausted(failure.method, failure.path, failure.attempts) : new PveError(0, method, path, String(failure))));
-  if (response.status < 200 || response.status >= 300) {
-    const detail = yield* response.text.pipe(Effect9.orElseSucceed(() => ""));
-    return yield* Effect9.fail(new PveError(response.status, method, path, detail.slice(0, 300)));
-  }
-  return yield* response.json.pipe(Effect9.mapError((cause) => new PveError(0, method, path, String(cause))));
-});
-var pve = (target, role, method, path, form) => Effect9.gen(function* () {
-  const credential = yield* leased(target, role);
-  return yield* pveWith(target, credential, method, path, form);
-});
+import * as cluster2 from "@distilled.cloud/proxmox/cluster";
 
 // src/proxmox/resource-guard.ts
-import * as Effect10 from "effect/Effect";
+import * as Effect9 from "effect/Effect";
 var specGuards = (spec) => {
   const endpointsOf = (props) => typeof spec.endpoint === "function" ? spec.endpoint(props) : spec.endpoint;
-  const guardCreate = (props, presence) => Effect10.suspend(() => {
+  const guardCreate = (props, presence) => Effect9.suspend(() => {
     const create = endpointsOf(props)?.create;
-    return create === undefined ? Effect10.void : guardForm(create, spec.createForm(props), presence);
+    return create === undefined ? Effect9.void : guardForm(create, spec.createForm(props), presence);
   });
-  const guardUpdate = (props) => Effect10.suspend(() => {
+  const guardUpdate = (props) => Effect9.suspend(() => {
     const update = endpointsOf(props)?.update;
     if (update === undefined)
-      return Effect10.void;
+      return Effect9.void;
     const form = spec.updateForm?.(props);
-    return form === undefined ? Effect10.void : guardForm(update, form, false);
+    return form === undefined ? Effect9.void : guardForm(update, form, false);
   });
   return { guardCreate, guardUpdate };
 };
@@ -1530,66 +1464,7 @@ var specGuards = (spec) => {
 // src/proxmox/update-guard.ts
 var formToSend = (matches3, live, props, form) => matches3(live, props) || Object.keys(form).length === 0 ? undefined : form;
 
-// src/proxmox/resource.ts
-var pveOperations = (spec) => {
-  const { guardCreate, guardUpdate } = specGuards(spec);
-  const read = (props) => pve(props.target, spec.readRole ?? "read", "GET", spec.path(props)).pipe(Effect11.map((data) => data == null ? undefined : spec.attributes(data, props)), Effect11.orElseSucceed(() => {
-    return;
-  }));
-  return {
-    guardCreate,
-    guardUpdate,
-    read,
-    diff: (news, output) => Effect11.gen(function* () {
-      if (!isResolved3(news))
-        return;
-      yield* guardCreate(news, output === undefined);
-      yield* guardUpdate(news);
-      if (output === undefined)
-        return;
-      const live = yield* read(news);
-      if (live === undefined) {
-        yield* guardCreate(news, true);
-        return { action: "update" };
-      }
-      if (spec.matches(live, news))
-        return { action: "noop" };
-      return spec.updateForm === undefined ? { action: "replace" } : { action: "update" };
-    }),
-    reconcile: (news) => Effect11.gen(function* () {
-      const live = yield* read(news);
-      yield* guardCreate(news, live === undefined);
-      yield* guardUpdate(news);
-      if (live === undefined) {
-        yield* pve(news.target, "provision", "POST", spec.collection(news), spec.createForm(news));
-      } else if (spec.updateForm !== undefined) {
-        const form = formToSend(spec.matches, live, news, spec.updateForm(news));
-        if (form !== undefined) {
-          yield* pve(news.target, "provision", "PUT", spec.path(news), form);
-        }
-      }
-      const after = yield* read(news);
-      if (after === undefined) {
-        return yield* Effect11.die(new Error(`${spec.path(news)}: the write returned no error but the object is still absent. ` + 'PVE wraps every answer in {"data":...} and can report success on a call that did ' + "nothing -- read back rather than trusting the status code."));
-      }
-      return after;
-    }),
-    destroy: (olds) => pve(olds.target, "provision", "DELETE", spec.path(olds))
-  };
-};
-var pveHandlers = (spec) => {
-  const ops = pveOperations(spec);
-  return {
-    list: () => Effect11.succeed([]),
-    read: ({ olds }) => ops.read(olds),
-    diff: ({ news, output }) => ops.diff(news, output),
-    reconcile: ({ news }) => ops.reconcile(news),
-    delete: ({ olds }) => ops.destroy(olds)
-  };
-};
-
-// src/proxmox/backup-job.ts
-var ProxmoxBackupJob = Resource3("Proxmox.BackupJob");
+// src/proxmox/backup-job-config.ts
 var shape2 = (props) => ({
   all: props.all === true ? "1" : "0",
   enabled: props.enabled === false ? "0" : "1",
@@ -1606,7 +1481,7 @@ var shape2 = (props) => ({
   ...props.storage === undefined ? {} : { storage: props.storage },
   ...props.vmid === undefined ? {} : { vmid: guestList(props.vmid) }
 });
-var handlers = pveHandlers({
+var backupJobSpec = {
   attributes: (live, props) => ({
     all: bool(live["all"], false),
     comment: text(live["comment"], ""),
@@ -1631,13 +1506,95 @@ var handlers = pveHandlers({
   matches: (attributes, props) => attributes.schedule === props.schedule && attributes.enabled === (props.enabled !== false) && attributes.all === (props.all === true) && attributes.mode === (props.mode ?? "snapshot") && attributes["notification-mode"] === (props["notification-mode"] ?? "auto") && attributes["repeat-missed"] === (props["repeat-missed"] === true) && (props.storage === undefined || attributes.storage === props.storage) && (props.pool === undefined || attributes.pool === props.pool) && (props.comment === undefined || attributes.comment === props.comment) && (props.vmid === undefined || attributes.vmid === guestList(props.vmid)) && (props.exclude === undefined || attributes.exclude === guestList(props.exclude)) && (props["notes-template"] === undefined || attributes["notes-template"] === props["notes-template"]) && (props["prune-backups"] === undefined || attributes["prune-backups"] === propertyString(props["prune-backups"])) && (props.fleecing === undefined || attributes.fleecing === propertyString(props.fleecing, "enabled")),
   path: (props) => `cluster/backup/${props.id}`,
   updateForm: shape2
-});
-var ProxmoxBackupJobProvider = () => Provider3.effect(ProxmoxBackupJob, Effect12.succeed(ProxmoxBackupJob.Provider.of(handlers)));
+};
+
+// src/proxmox/backup-job-distilled.ts
+import * as cluster from "@distilled.cloud/proxmox/cluster";
+import * as Effect10 from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { ProxmoxParseError } from "@distilled.cloud/proxmox/Errors";
+var backupJobRequest = (props, form = backupJobSpec.updateForm(props)) => {
+  const {
+    "notes-template": notes_template,
+    "notification-mode": notification_mode,
+    "prune-backups": prune_backups,
+    "repeat-missed": repeat_missed,
+    ...fields
+  } = form;
+  return {
+    ...fields,
+    id: props.id,
+    notification_mode,
+    repeat_missed,
+    ...notes_template === undefined ? {} : { notes_template },
+    ...prune_backups === undefined ? {} : { prune_backups }
+  };
+};
+var readBackupJob = (props) => runPve(props.target, "read", false, cluster.getClusterBackup({ id: props.id })).pipe(Effect10.flatMap((live) => Schema.decodeUnknownEffect(Schema.toType(cluster.GetClusterBackupResponse))({
+  ...live,
+  prune_backups: undefined,
+  fleecing: undefined
+}).pipe(Effect10.mapError(() => new ProxmoxParseError({
+  body: undefined,
+  cause: "Backup job response does not match its vendor schema"
+})), Effect10.as(live))), Effect10.map((live) => backupJobSpec.attributes({
+  ...live,
+  "next-run": live.next_run,
+  "notes-template": live.notes_template,
+  "notification-mode": live.notification_mode,
+  "prune-backups": typeof live.prune_backups === "object" && live.prune_backups !== null ? Object.fromEntries(Object.entries(live.prune_backups).map(([key, value]) => [
+    key.replaceAll("_", "-"),
+    value
+  ])) : live.prune_backups,
+  "repeat-missed": live.repeat_missed
+}, props)), Effect10.catchTag("BackupJobNotFound", () => Effect10.succeed(undefined)), Effect10.catchTag("NotFound", () => Effect10.succeed(undefined)));
+var deleteBackupJob = (props) => runPve(props.target, "provision", true, cluster.deleteClusterBackup({ id: props.id })).pipe(Effect10.catchTag("BackupJobNotFound", () => Effect10.void), Effect10.catchTag("NotFound", () => Effect10.void));
+
+// src/proxmox/backup-job.ts
+import * as Provider3 from "alchemy/Provider";
+import * as Effect11 from "effect/Effect";
+var ProxmoxBackupJob = Resource3("Proxmox.BackupJob");
+var { guardCreate, guardUpdate } = specGuards(backupJobSpec);
+var ProxmoxBackupJobProvider = () => Provider3.effect(ProxmoxBackupJob, Effect11.succeed(ProxmoxBackupJob.Provider.of({
+  list: () => Effect11.succeed([]),
+  read: ({ olds }) => readBackupJob(olds),
+  diff: Effect11.fn(function* ({ news, output }) {
+    if (!isResolved3(news))
+      return;
+    yield* guardCreate(news, output === undefined);
+    yield* guardUpdate(news);
+    if (output === undefined)
+      return;
+    const live = yield* readBackupJob(news);
+    if (live === undefined) {
+      yield* guardCreate(news, true);
+      return { action: "update" };
+    }
+    return { action: backupJobSpec.matches(live, news) ? "noop" : "update" };
+  }),
+  reconcile: Effect11.fn(function* ({ news }) {
+    const live = yield* readBackupJob(news);
+    yield* guardCreate(news, live === undefined);
+    yield* guardUpdate(news);
+    if (live === undefined) {
+      yield* runPve(news.target, "provision", true, cluster2.createClusterBackup(backupJobRequest(news)));
+    } else {
+      const form = formToSend(backupJobSpec.matches, live, news, backupJobSpec.updateForm(news));
+      if (form !== undefined)
+        yield* runPve(news.target, "provision", true, cluster2.putClusterBackup(backupJobRequest(news, form)));
+    }
+    const after = yield* readBackupJob(news);
+    if (after === undefined)
+      return yield* Effect11.fail(new Error(`${backupJobSpec.path(news)}: write returned success but the resource is still absent`));
+    return after;
+  }),
+  delete: ({ olds }) => deleteBackupJob(olds)
+})));
 // src/proxmox/ceph-daemon.ts
 import { Resource as Resource4 } from "alchemy";
 import { isResolved as isResolved4 } from "alchemy/Diff";
 import * as Provider4 from "alchemy/Provider";
-import * as Effect14 from "effect/Effect";
+import * as Effect13 from "effect/Effect";
 
 // src/proxmox/ceph-daemon-form.ts
 var DAEMON_ENDPOINTS = {
@@ -1678,19 +1635,19 @@ var daemonAttributes = (live, props) => {
 
 // src/proxmox/ceph-daemon-wire.ts
 import * as nodes from "@distilled.cloud/proxmox/nodes";
-import * as Effect13 from "effect/Effect";
+import * as Effect12 from "effect/Effect";
 var listRows = (props) => {
   const node = props.node;
   switch (props.kind) {
     case "mon":
-      return runPve(props.target, "read", false, nodes.listNodeCephMon({ node })).pipe(Effect13.map((rows) => rows));
+      return runPve(props.target, "read", false, nodes.listNodeCephMon({ node })).pipe(Effect12.map((rows) => rows));
     case "mgr":
-      return runPve(props.target, "read", false, nodes.listNodeCephMgr({ node })).pipe(Effect13.map((rows) => rows));
+      return runPve(props.target, "read", false, nodes.listNodeCephMgr({ node })).pipe(Effect12.map((rows) => rows));
     case "mds":
-      return runPve(props.target, "read", false, nodes.listNodeCephMds({ node })).pipe(Effect13.map((rows) => rows));
+      return runPve(props.target, "read", false, nodes.listNodeCephMds({ node })).pipe(Effect12.map((rows) => rows));
   }
 };
-var readDaemon = (props) => listRows(props).pipe(Effect13.map((rows) => daemonAttributes(rows, props)));
+var readDaemon = (props) => listRows(props).pipe(Effect12.map((rows) => daemonAttributes(rows, props)));
 var createDaemon = (props) => {
   const node = props.node;
   const id = daemonId(props);
@@ -1729,7 +1686,7 @@ var notCreated = (props) => new Error(`${daemonPath(props)}: no ${props.kind} na
 var ProxmoxCephDaemon = Resource4("Proxmox.CephDaemon", {
   defaultRemovalPolicy: "retain"
 });
-var reconcileDaemon = Effect14.fn(function* ({ news }) {
+var reconcileDaemon = Effect13.fn(function* ({ news }) {
   const live = yield* readDaemon(news);
   yield* guardWrite2(DAEMON_ENDPOINTS[news.kind], createForm(news), live === undefined);
   if (live !== undefined)
@@ -1737,13 +1694,13 @@ var reconcileDaemon = Effect14.fn(function* ({ news }) {
   yield* createDaemon(news);
   const after = yield* readDaemon(news);
   if (after === undefined)
-    return yield* Effect14.die(notCreated(news));
+    return yield* Effect13.die(notCreated(news));
   return after;
 });
-var ProxmoxCephDaemonProvider = () => Provider4.effect(ProxmoxCephDaemon, Effect14.succeed(ProxmoxCephDaemon.Provider.of({
-  list: () => Effect14.succeed([]),
+var ProxmoxCephDaemonProvider = () => Provider4.effect(ProxmoxCephDaemon, Effect13.succeed(ProxmoxCephDaemon.Provider.of({
+  list: () => Effect13.succeed([]),
   read: ({ olds }) => readDaemon(olds),
-  diff: Effect14.fn(function* ({ news, output }) {
+  diff: Effect13.fn(function* ({ news, output }) {
     if (!isResolved4(news))
       return;
     yield* guardWrite2(DAEMON_ENDPOINTS[news.kind], createForm(news), output === undefined);
@@ -1762,9 +1719,135 @@ var ProxmoxCephDaemonProvider = () => Provider4.effect(ProxmoxCephDaemon, Effect
 // src/proxmox/ceph-flag.ts
 import { Resource as Resource5 } from "alchemy";
 import * as Provider5 from "alchemy/Provider";
+import * as Effect16 from "effect/Effect";
+
+// src/proxmox/resource.ts
+import { isResolved as isResolved5 } from "alchemy/Diff";
 import * as Effect15 from "effect/Effect";
+
+// src/proxmox/client.ts
+import * as Effect14 from "effect/Effect";
+import * as HttpClient5 from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest2 from "effect/unstable/http/HttpClientRequest";
+class PveError extends Error {
+  status;
+  method;
+  path;
+  constructor(status, method, path, detail) {
+    super(`PVE ${method} ${path} -> ${String(status)}: ${detail}`);
+    this.status = status;
+    this.method = method;
+    this.path = path;
+    this.name = "PveError";
+  }
+}
+var clusterExhausted = (method, path, attempts) => new PveError(0, method, path, `all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join("; ")}`);
+var encode = (form) => {
+  const params = new URLSearchParams;
+  for (const [key, value] of Object.entries(form)) {
+    if (typeof value === "string")
+      params.append(key, value);
+    else
+      for (const item of value)
+        params.append(key, item);
+  }
+  return params.toString();
+};
+var buildRequest = (method, apiBase, path, credential, target, form) => {
+  const url = `${apiBase}/${path}`;
+  return HttpClientRequest2.make(method)(url).pipe(HttpClientRequest2.setHeaders({ Authorization: authorization(credential, target) }), form === undefined ? (self) => self : HttpClientRequest2.bodyText(encode(form), "application/x-www-form-urlencoded"));
+};
+var executeOne = (target, credential, method, path, form, apiBase) => Effect14.gen(function* () {
+  const client = yield* HttpClient5.HttpClient;
+  const request = buildRequest(method, apiBase, path, credential, target, form);
+  return yield* client.execute(request).pipe(Effect14.mapError((cause) => new PveError(0, method, path, String(cause))));
+});
+var readResponse = (response, method, path) => Effect14.gen(function* () {
+  if (response.status < 200 || response.status >= 300) {
+    const detail = yield* response.text.pipe(Effect14.orElseSucceed(() => ""));
+    return yield* Effect14.fail(new PveError(response.status, method, path, detail.slice(0, 300)));
+  }
+  const body = yield* response.json.pipe(Effect14.mapError((cause) => new PveError(0, method, path, String(cause))));
+  return body.data;
+});
+var pveWith = (target, credential, method, path, form) => Effect14.gen(function* () {
+  const response = target.scheme === "pve" ? yield* executeOnCluster(target, method, path, (apiBase) => buildRequest(method, apiBase, path, credential, target, form)).pipe(Effect14.mapError((failure) => failure.tag === "cluster" ? clusterExhausted(failure.method, failure.path, failure.attempts) : new PveError(0, method, path, String(failure)))) : yield* executeOne(target, credential, method, path, form, target.api);
+  return yield* readResponse(response, method, path);
+});
+var pveEnvelopeWith = (target, credential, method, path) => Effect14.gen(function* () {
+  const response = yield* executeOnCluster(target, method, path, (apiBase) => buildRequest(method, apiBase, path, credential, target)).pipe(Effect14.mapError((failure) => failure.tag === "cluster" ? clusterExhausted(failure.method, failure.path, failure.attempts) : new PveError(0, method, path, String(failure))));
+  if (response.status < 200 || response.status >= 300) {
+    const detail = yield* response.text.pipe(Effect14.orElseSucceed(() => ""));
+    return yield* Effect14.fail(new PveError(response.status, method, path, detail.slice(0, 300)));
+  }
+  return yield* response.json.pipe(Effect14.mapError((cause) => new PveError(0, method, path, String(cause))));
+});
+var pve = (target, role, method, path, form) => Effect14.gen(function* () {
+  const credential = yield* leased(target, role);
+  return yield* pveWith(target, credential, method, path, form);
+});
+
+// src/proxmox/resource.ts
+var pveOperations = (spec) => {
+  const { guardCreate: guardCreate2, guardUpdate: guardUpdate2 } = specGuards(spec);
+  const read = (props) => pve(props.target, spec.readRole ?? "read", "GET", spec.path(props)).pipe(Effect15.map((data) => data == null ? undefined : spec.attributes(data, props)), Effect15.orElseSucceed(() => {
+    return;
+  }));
+  return {
+    guardCreate: guardCreate2,
+    guardUpdate: guardUpdate2,
+    read,
+    diff: (news, output) => Effect15.gen(function* () {
+      if (!isResolved5(news))
+        return;
+      yield* guardCreate2(news, output === undefined);
+      yield* guardUpdate2(news);
+      if (output === undefined)
+        return;
+      const live = yield* read(news);
+      if (live === undefined) {
+        yield* guardCreate2(news, true);
+        return { action: "update" };
+      }
+      if (spec.matches(live, news))
+        return { action: "noop" };
+      return spec.updateForm === undefined ? { action: "replace" } : { action: "update" };
+    }),
+    reconcile: (news) => Effect15.gen(function* () {
+      const live = yield* read(news);
+      yield* guardCreate2(news, live === undefined);
+      yield* guardUpdate2(news);
+      if (live === undefined) {
+        yield* pve(news.target, "provision", "POST", spec.collection(news), spec.createForm(news));
+      } else if (spec.updateForm !== undefined) {
+        const form = formToSend(spec.matches, live, news, spec.updateForm(news));
+        if (form !== undefined) {
+          yield* pve(news.target, "provision", "PUT", spec.path(news), form);
+        }
+      }
+      const after = yield* read(news);
+      if (after === undefined) {
+        return yield* Effect15.die(new Error(`${spec.path(news)}: the write returned no error but the object is still absent. ` + 'PVE wraps every answer in {"data":...} and can report success on a call that did ' + "nothing -- read back rather than trusting the status code."));
+      }
+      return after;
+    }),
+    destroy: (olds) => pve(olds.target, "provision", "DELETE", spec.path(olds))
+  };
+};
+var pveHandlers = (spec) => {
+  const ops = pveOperations(spec);
+  return {
+    list: () => Effect15.succeed([]),
+    read: ({ olds }) => ops.read(olds),
+    diff: ({ news, output }) => ops.diff(news, output),
+    reconcile: ({ news }) => ops.reconcile(news),
+    delete: ({ olds }) => ops.destroy(olds)
+  };
+};
+
+// src/proxmox/ceph-flag.ts
 var ProxmoxCephFlag = Resource5("Proxmox.CephFlag");
-var handlers2 = pveHandlers({
+var handlers = pveHandlers({
   attributes: (live, props) => ({ flag: props.flag, value: bool(live) }),
   collection: () => "cluster/ceph/flags",
   createForm: (props) => ({ [props.flag]: flag(props.value) ?? "0" }),
@@ -1773,20 +1856,20 @@ var handlers2 = pveHandlers({
   path: (props) => `cluster/ceph/flags/${props.flag}`,
   updateForm: (props) => ({ value: flag(props.value) ?? "0" })
 });
-var ProxmoxCephFlagProvider = () => Provider5.effect(ProxmoxCephFlag, Effect15.succeed(ProxmoxCephFlag.Provider.of({
-  ...handlers2,
-  delete: () => Effect15.void,
-  reconcile: Effect15.fn(function* ({ news }) {
-    const after = yield* handlers2.reconcile({ news });
+var ProxmoxCephFlagProvider = () => Provider5.effect(ProxmoxCephFlag, Effect16.succeed(ProxmoxCephFlag.Provider.of({
+  ...handlers,
+  delete: () => Effect16.void,
+  reconcile: Effect16.fn(function* ({ news }) {
+    const after = yield* handlers.reconcile({ news });
     if (after.value !== news.value) {
-      return yield* Effect15.die(new Error(`cluster/ceph/flags/${news.flag}: the PUT returned no error but ceph still ` + `reports the flag ${after.value ? "set" : "clear"} rather than ` + `${news.value ? "set" : "clear"}. This endpoint's success is documented as a ` + "null body, so the status code proves nothing -- check `ceph osd dump | " + "head -1` and the cluster log. `pause` in particular is two ceph flags read " + "as one; see the header."));
+      return yield* Effect16.die(new Error(`cluster/ceph/flags/${news.flag}: the PUT returned no error but ceph still ` + `reports the flag ${after.value ? "set" : "clear"} rather than ` + `${news.value ? "set" : "clear"}. This endpoint's success is documented as a ` + "null body, so the status code proves nothing -- check `ceph osd dump | " + "head -1` and the cluster log. `pause` in particular is two ceph flags read " + "as one; see the header."));
     }
     return after;
   })
 })));
 // src/proxmox/ceph-fs.ts
 import { Resource as Resource6 } from "alchemy";
-import { isResolved as isResolved5 } from "alchemy/Diff";
+import { isResolved as isResolved6 } from "alchemy/Diff";
 import * as Provider6 from "alchemy/Provider";
 import * as Effect18 from "effect/Effect";
 
@@ -1795,7 +1878,6 @@ import * as nodes2 from "@distilled.cloud/proxmox/nodes";
 import * as Effect17 from "effect/Effect";
 
 // src/proxmox/ceph-fs-wire.ts
-import * as Effect16 from "effect/Effect";
 var readRow = (live, props) => {
   const row = (Array.isArray(live) ? live : []).filter((entry) => typeof entry === "object" && entry !== null).find((entry) => entry["name"] === props.name);
   if (row === undefined)
@@ -1817,33 +1899,6 @@ var createForm2 = (props) => ({
   ...field("add-storage", flag(props["add-storage"])),
   ...field("pg_num", props.pg_num === undefined ? undefined : String(props.pg_num))
 });
-var destroyPath = (props) => {
-  const query = [
-    props["remove-pools"] === true ? "remove-pools=1" : undefined,
-    props["remove-storages"] === true ? "remove-storages=1" : undefined
-  ].filter((part) => part !== undefined);
-  return query.length === 0 ? objectPath(props) : `${objectPath(props)}?${query.join("&")}`;
-};
-var settle = (target, node, upid, what) => Effect16.gen(function* () {
-  for (let attempt = 0;attempt < POLL_ATTEMPTS; attempt += 1) {
-    const status = yield* pve(target, "read", "GET", `nodes/${node}/tasks/${encodeURIComponent(upid)}/status`).pipe(Effect16.orElseSucceed(() => {
-      return;
-    }));
-    if (status?.status === "stopped") {
-      const exit = text(status.exitstatus);
-      if (exit === "OK")
-        return;
-      return yield* Effect16.die(new Error(`${what}: PVE task ${upid} finished with "${exit === "" ? "no exit status" : exit}". ` + "The write returned HTTP 200 because it only forked the worker -- the real error is " + `in \`pvesh get /nodes/${node}/tasks/${upid}/log\`.`));
-    }
-    yield* Effect16.sleep(POLL_SECONDS * 1000);
-  }
-  return yield* Effect16.die(new Error(`${what}: PVE task ${upid} was still running after ` + `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its ` + "status could not be read. Check the task log, and check that the `read` role holds " + `Sys.Audit on /nodes/${node} -- each call mints a new token, so the poller is never the ` + "task owner and is answered 403 rather than told to wait."));
-});
-var destroyFs = (props) => Effect16.gen(function* () {
-  const upid = text(yield* pve(props.target, "provision", "DELETE", destroyPath(props)));
-  if (upid !== "")
-    yield* settle(props.target, props.node, upid, destroyPath(props));
-});
 var notCreated2 = (props) => new Error(`${objectPath(props)}: the create task finished but the filesystem is not in ` + `GET nodes/${props.node}/ceph/fs. Check the task log -- a PVE worker can exit having ` + "rolled back the pools it had just made.");
 var notDestroyed = (props) => new Error(`${objectPath(props)}: the destroy task finished but the filesystem is still in ` + `GET nodes/${props.node}/ceph/fs. PVE refuses to destroy a CephFS while a PVE storage entry ` + "of type cephfs still references it and is not disabled.");
 
@@ -1854,7 +1909,7 @@ var toDistilledCreate = (props) => ({
   name: props.name,
   node: props.node
 });
-var settleCreate = (props, upid) => Effect17.gen(function* () {
+var settleTask = (props, upid) => Effect17.gen(function* () {
   for (let attempt = 0;attempt < POLL_ATTEMPTS; attempt += 1) {
     const status = yield* runPve(props.target, "read", false, nodes2.getNodeTaskStatus({ node: props.node, upid })).pipe(Effect17.orElseSucceed(() => {
       return;
@@ -1873,7 +1928,17 @@ var createFs = (props) => Effect17.gen(function* () {
   if (upid === "") {
     return yield* Effect17.die(new Error(`${objectPath(props)}: POST returned no task id. PVE wraps every answer in ` + '{"data":...} and can report success on a call that did nothing.'));
   }
-  yield* settleCreate(props, upid);
+  yield* settleTask(props, upid);
+});
+var destroyFs = (props) => Effect17.gen(function* () {
+  const upid = yield* runPve(props.target, "provision", true, nodes2.deleteNodeCephFs({
+    node: props.node,
+    name: props.name,
+    ...props["remove-pools"] === true ? { remove_pools: "1" } : {},
+    ...props["remove-storages"] === true ? { remove_storages: "1" } : {}
+  })).pipe(Effect17.catchTag("CephFsNotFound", () => Effect17.succeed("")));
+  if (upid !== "")
+    yield* settleTask(props, upid);
 });
 
 // src/proxmox/ceph-fs.ts
@@ -1886,7 +1951,7 @@ var ProxmoxCephFsProvider = () => Provider6.effect(ProxmoxCephFs, Effect18.succe
     return yield* readFs(olds);
   }),
   diff: Effect18.fn(function* ({ news, output }) {
-    if (!isResolved5(news))
+    if (!isResolved6(news))
       return;
     yield* guardWrite2(CEPH_FS_CREATE, createForm2(news), output === undefined);
     if (output !== undefined && news.name !== output.name) {
@@ -1922,7 +1987,7 @@ var ProxmoxCephFsProvider = () => Provider6.effect(ProxmoxCephFs, Effect18.succe
 })));
 // src/proxmox/ceph-osd.ts
 import { Resource as Resource7 } from "alchemy";
-import { isResolved as isResolved6 } from "alchemy/Diff";
+import { isResolved as isResolved7 } from "alchemy/Diff";
 import * as Provider7 from "alchemy/Provider";
 import * as Effect21 from "effect/Effect";
 
@@ -1997,7 +2062,7 @@ var ProxmoxCephOsd = Resource7("Proxmox.CephOsd", {
 });
 var settled = (live, props) => (props.host === undefined || props.host === live.host) && (props.device_class === undefined || props.device_class === live.device_class);
 var describe2 = (props) => `osd.${String(props.osdid)} (read via nodes/${props.node}/ceph/osd)`;
-var handlers3 = {
+var handlers2 = {
   list: () => Effect21.succeed([]),
   read: Effect21.fn(function* ({ olds }) {
     return yield* readOsd(olds);
@@ -2006,7 +2071,7 @@ var handlers3 = {
     news,
     output
   }) {
-    if (output === undefined || !isResolved6(news))
+    if (output === undefined || !isResolved7(news))
       return;
     const live = yield* readOsd(news);
     if (live === undefined)
@@ -2029,10 +2094,10 @@ var handlers3 = {
     yield* destroyOsd(olds);
   })
 };
-var ProxmoxCephOsdProvider = () => Provider7.effect(ProxmoxCephOsd, Effect21.succeed(ProxmoxCephOsd.Provider.of(handlers3)));
+var ProxmoxCephOsdProvider = () => Provider7.effect(ProxmoxCephOsd, Effect21.succeed(ProxmoxCephOsd.Provider.of(handlers2)));
 // src/proxmox/ceph-pool.ts
 import { Resource as Resource8 } from "alchemy";
-import { isResolved as isResolved7 } from "alchemy/Diff";
+import { isResolved as isResolved8 } from "alchemy/Diff";
 import * as Provider8 from "alchemy/Provider";
 import * as nodes7 from "@distilled.cloud/proxmox/nodes";
 import * as Effect24 from "effect/Effect";
@@ -2066,7 +2131,7 @@ var createBody = (props) => ({
 import * as nodes5 from "@distilled.cloud/proxmox/nodes";
 import * as Effect22 from "effect/Effect";
 var confirmAbsent = (props, describe3) => runPve(props.target, "read", false, nodes5.listNodeCephPool({ node: props.node })).pipe(Effect22.flatMap((rows) => rows.some((row) => row.pool_name === props.name) ? Effect22.die(new Error(`${describe3}: the cluster lists this pool but its status could not be read, ` + "so this deploy will NOT create over it. Check that the node is up and that the " + "read role holds Sys.Audit or Datastore.Audit on / -- a create here would apply " + "pg_num to a live pool and start a PG merge.")) : Effect22.void));
-var settle2 = (props, read, done) => Effect22.gen(function* () {
+var settle = (props, read, done) => Effect22.gen(function* () {
   for (let attempt = 0;attempt < 30; attempt += 1) {
     const live = yield* read(props);
     if (done(live))
@@ -2123,7 +2188,7 @@ var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect24.s
   list: () => Effect24.succeed([]),
   read: ({ olds }) => readPoolStatus(olds),
   diff: Effect24.fn(function* ({ news, output }) {
-    if (!isResolved7(news))
+    if (!isResolved8(news))
       return;
     yield* guardWrite2(CEPH_POOL_CREATE, createBody(news), output === undefined);
     yield* guardWrite2(CEPH_POOL_UPDATE, updateBody(news), false);
@@ -2150,7 +2215,7 @@ var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect24.s
         upid = yield* runPve(news.target, "provision", true, nodes7.putNodeCephPool(toDistilledUpdate(news)));
       }
     }
-    const after = yield* settle2(news, readPoolStatus, (row) => row !== undefined && matches3(row, news));
+    const after = yield* settle(news, readPoolStatus, (row) => row !== undefined && matches3(row, news));
     if (after === undefined || !matches3(after, news)) {
       return yield* Effect24.die(new Error(`${object(news)}: the write returned no error but the pool still does not match ` + `the declaration after 60s. PVE answered with task ${upid ?? "(none)"} -- read ` + "its log with `pvesh get /nodes/<node>/tasks/<upid>/log` to see what Ceph " + "refused."));
     }
@@ -2158,7 +2223,7 @@ var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect24.s
   }),
   delete: Effect24.fn(function* ({ olds }) {
     yield* runPve(olds.target, "provision", true, nodes7.deleteNodeCephPool({ name: olds.name, node: olds.node }));
-    const left = yield* settle2(olds, readPoolStatus, (row) => row === undefined);
+    const left = yield* settle(olds, readPoolStatus, (row) => row === undefined);
     if (left !== undefined) {
       return yield* Effect24.die(new Error(`${object(olds)}: the DELETE returned no error but the pool is still there after ` + "60s. Either a storage on it still holds RBD images, or the mons are running " + "with mon_allow_pool_delete false."));
     }
@@ -2166,7 +2231,7 @@ var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect24.s
 })));
 // src/proxmox/firewall-alias.ts
 import { Resource as Resource9 } from "alchemy";
-import { isResolved as isResolved8 } from "alchemy/Diff";
+import { isResolved as isResolved9 } from "alchemy/Diff";
 import * as Provider9 from "alchemy/Provider";
 import * as Effect25 from "effect/Effect";
 
@@ -2188,7 +2253,7 @@ var body = (props) => {
 
 // src/proxmox/firewall-alias.ts
 var ProxmoxFirewallAlias = Resource9("Proxmox.FirewallAlias");
-var handlers4 = pveHandlers({
+var handlers3 = pveHandlers({
   attributes: (live, props) => {
     const address = cidr(live["cidr"]);
     return address === "" ? undefined : {
@@ -2209,17 +2274,17 @@ var handlers4 = pveHandlers({
   updateForm: body
 });
 var ProxmoxFirewallAliasProvider = () => Provider9.effect(ProxmoxFirewallAlias, Effect25.succeed(ProxmoxFirewallAlias.Provider.of({
-  ...handlers4,
+  ...handlers3,
   diff: Effect25.fn(function* ({ news, output }) {
-    if (output !== undefined && isResolved8(news) && fold(news.name) !== fold(output.name)) {
+    if (output !== undefined && isResolved9(news) && fold(news.name) !== fold(output.name)) {
       return { action: "replace" };
     }
-    return yield* handlers4.diff({ news, output });
+    return yield* handlers3.diff({ news, output });
   })
 })));
 // src/proxmox/group.ts
 import { Resource as Resource10 } from "alchemy";
-import { isResolved as isResolved9 } from "alchemy/Diff";
+import { isResolved as isResolved10 } from "alchemy/Diff";
 import * as Provider10 from "alchemy/Provider";
 import * as access4 from "@distilled.cloud/proxmox/access";
 import * as Effect27 from "effect/Effect";
@@ -2265,7 +2330,7 @@ var ProxmoxGroupProvider = () => Provider10.effect(ProxmoxGroup, Effect27.succee
     return dropUnreadable3(yield* output === undefined ? readGroup(olds) : readGroupOrFail(olds));
   }),
   diff: Effect27.fn(function* ({ news, output }) {
-    if (!isResolved9(news))
+    if (!isResolved10(news))
       return;
     yield* guardWrite2(GROUP_CREATE, createForm3(news), output === undefined);
     yield* guardWrite2(GROUP_UPDATE, updateForm(news), false);
@@ -2313,7 +2378,7 @@ var shape3 = (props) => ({
   max_restart: String(props.max_restart ?? 1),
   state: props.state ?? "started"
 });
-var handlers5 = pveHandlers({
+var handlers4 = pveHandlers({
   attributes: (live, props) => ({
     comment: typeof live["comment"] === "string" ? live["comment"] : "",
     max_relocate: num(live["max_relocate"], 1),
@@ -2332,7 +2397,7 @@ var handlers5 = pveHandlers({
   path: (props) => `cluster/ha/resources/${props.sid}`,
   updateForm: shape3
 });
-var ProxmoxHaResourceProvider = () => Provider11.effect(ProxmoxHaResource, Effect28.succeed(ProxmoxHaResource.Provider.of(handlers5)));
+var ProxmoxHaResourceProvider = () => Provider11.effect(ProxmoxHaResource, Effect28.succeed(ProxmoxHaResource.Provider.of(handlers4)));
 // src/proxmox/ha-rule.ts
 import { Resource as Resource12 } from "alchemy";
 import * as Provider12 from "alchemy/Provider";
@@ -2384,7 +2449,7 @@ var clearList = (props) => Object.entries(optional(props)).filter(([, value]) =>
 
 // src/proxmox/ha-rule.ts
 var ProxmoxHaRule = Resource12("Proxmox.HaRule");
-var handlers6 = pveHandlers({
+var handlers5 = pveHandlers({
   attributes: (live, props) => {
     const liveType = text(live["type"]);
     if (liveType !== "" && liveType !== props.type)
@@ -2413,10 +2478,10 @@ var handlers6 = pveHandlers({
     return withClears(fields, clear);
   }
 });
-var ProxmoxHaRuleProvider = () => Provider12.effect(ProxmoxHaRule, Effect29.succeed(ProxmoxHaRule.Provider.of(handlers6)));
+var ProxmoxHaRuleProvider = () => Provider12.effect(ProxmoxHaRule, Effect29.succeed(ProxmoxHaRule.Provider.of(handlers5)));
 // src/proxmox/lxc.ts
 import { Resource as Resource13 } from "alchemy";
-import { isResolved as isResolved10 } from "alchemy/Diff";
+import { isResolved as isResolved11 } from "alchemy/Diff";
 import * as Provider13 from "alchemy/Provider";
 import * as Effect39 from "effect/Effect";
 
@@ -2669,8 +2734,8 @@ var optionMap = (value, family, defaultKey) => {
   return out;
 };
 var sameMap = (left, right) => left.size === right.size && [...left].every(([key, value]) => right.get(key) === value);
-var sortedForm = (map12) => [...map12].map(([key, value]) => `${key}=${value}`).sort().join(",");
-var printMap = (map12, lead = []) => [...lead.filter((key) => map12.has(key)), ...[...map12.keys()].filter((k) => !lead.includes(k))].map((key) => `${key}=${map12.get(key) ?? ""}`).join(",");
+var sortedForm = (map13) => [...map13].map(([key, value]) => `${key}=${value}`).sort().join(",");
+var printMap = (map13, lead = []) => [...lead.filter((key) => map13.has(key)), ...[...map13.keys()].filter((k) => !lead.includes(k))].map((key) => `${key}=${map13.get(key) ?? ""}`).join(",");
 var netMaps = (declared, live) => {
   const want = optionMap(declared, "net");
   const have = optionMap(live, "net");
@@ -3102,10 +3167,10 @@ var pendingLines = (diff) => {
 var pendingCount = (target, node) => stagedDiff(target, node).pipe(Effect36.map(pendingLines));
 var clusterHealth = (target) => pve(target, "read", "GET", "cluster/status").pipe(Effect36.map((rows) => {
   const all = rows ?? [];
-  const cluster = all.find((row) => row.type === "cluster");
+  const cluster3 = all.find((row) => row.type === "cluster");
   return {
     offline: all.filter((row) => row.type === "node" && !bool(row.online)).map((row) => text(row.name, "<unnamed>")),
-    quorate: cluster === undefined ? true : bool(cluster.quorate)
+    quorate: cluster3 === undefined ? true : bool(cluster3.quorate)
   };
 }));
 var degradedReason = (target) => clusterHealth(target).pipe(Effect36.map((health) => health.quorate && health.offline.length === 0 ? undefined : `quorate=${String(health.quorate)} offline=[${health.offline.join(", ")}]`));
@@ -3221,7 +3286,7 @@ var diff = (owner, news, olds) => Effect39.gen(function* () {
     return yield* refused(identity2);
   if (output === undefined)
     return;
-  if (!isResolved10(news))
+  if (!isResolved11(news))
     return;
   const live = yield* readLive(news);
   if (live === undefined) {
@@ -3296,7 +3361,7 @@ var read = (owner, olds) => Effect39.gen(function* () {
   const settled2 = Effect39.sync(() => judge(olds, live).drift.length === 0);
   return yield* ownedRead(owner, attributesOf5(where, live), settled2);
 });
-var handlers7 = {
+var handlers6 = {
   delete: ({ olds, output }) => destroyGuest(whereOf(olds, output), olds),
   diff: ({
     fqn,
@@ -3319,11 +3384,11 @@ var handlers7 = {
     output
   }) => reconcile({ fqn, instanceId, output }, news)
 };
-var ProxmoxLxcProvider = () => Provider13.effect(ProxmoxLxc, Effect39.succeed(ProxmoxLxc.Provider.of(handlers7)).pipe(Effect39.map(provingResumes)));
+var ProxmoxLxcProvider = () => Provider13.effect(ProxmoxLxc, Effect39.succeed(ProxmoxLxc.Provider.of(handlers6)).pipe(Effect39.map(provingResumes)));
 // src/proxmox/metric-server.ts
 import { Resource as Resource14 } from "alchemy";
-import * as Provider14 from "alchemy/Provider";
-import * as Effect40 from "effect/Effect";
+import { isResolved as isResolved12 } from "alchemy/Diff";
+import * as cluster4 from "@distilled.cloud/proxmox/cluster";
 
 // src/proxmox/metric-server-form.ts
 var UNSET2 = -1;
@@ -3393,8 +3458,7 @@ var otelAttributes = (live) => ({
 });
 var otelMatches = (attributes, props) => attributes["otel-compression"] === (props["otel-compression"] ?? "") && attributes["otel-max-body-size"] === (props["otel-max-body-size"] ?? UNSET2) && attributes["otel-path"] === (props["otel-path"] ?? "") && attributes["otel-protocol"] === (props["otel-protocol"] ?? "") && attributes["otel-timeout"] === (props["otel-timeout"] ?? UNSET2) && attributes["otel-verify-ssl"] === (props["otel-verify-ssl"] !== false);
 
-// src/proxmox/metric-server.ts
-var ProxmoxMetricServer = Resource14("Proxmox.MetricServer");
+// src/proxmox/metric-server-config.ts
 var matchesType = (attributes, props) => {
   if (props.type === "opentelemetry")
     return otelMatches(attributes, props);
@@ -3403,7 +3467,7 @@ var matchesType = (attributes, props) => {
     return socket && attributes.path === (props.path ?? "");
   return socket && attributes.influxdbproto === (props.influxdbproto ?? "") && attributes.organization === (props.organization ?? "") && attributes.bucket === (props.bucket ?? "") && attributes["api-path-prefix"] === (props["api-path-prefix"] ?? "") && attributes["max-body-size"] === (props["max-body-size"] ?? UNSET2) && attributes["verify-certificate"] === (props["verify-certificate"] !== false);
 };
-var handlers8 = pveHandlers({
+var metricServerSpec = {
   attributes: (live, props) => {
     const liveType = text(live["type"]);
     if (liveType !== "" && liveType !== props.type)
@@ -3435,13 +3499,96 @@ var handlers8 = pveHandlers({
   matches: (attributes, props) => attributes.server === props.server && attributes.port === props.port && attributes.disable === (props.disable === true) && matchesType(attributes, props),
   path: (props) => `cluster/metrics/server/${props.id}`,
   updateForm: update
+};
+
+// src/proxmox/metric-server-distilled.ts
+import * as cluster3 from "@distilled.cloud/proxmox/cluster";
+import { ProxmoxParseError as ProxmoxParseError2 } from "@distilled.cloud/proxmox/Errors";
+import * as Effect40 from "effect/Effect";
+import * as Schema2 from "effect/Schema";
+var readMetricServerRow = (props) => runPve(props.target, "read", false, cluster3.getClusterMetricsServer({ id: props.id })).pipe(Effect40.flatMap((body4) => Schema2.decodeUnknownEffect(Schema2.Record(Schema2.String, Schema2.Unknown))(body4).pipe(Effect40.mapError(() => new ProxmoxParseError2({
+  body: undefined,
+  cause: "Metric server response must be an object"
+})))), Effect40.catchTag("MetricServerNotFound", () => Effect40.succeed(undefined)), Effect40.catchTag("NotFound", () => Effect40.succeed(undefined)));
+var readMetricServer = (props) => readMetricServerRow(props).pipe(Effect40.map((row) => row === undefined ? undefined : metricServerSpec.attributes(row, props)));
+var metricServerRequest = (props, form) => ({
+  ...asForm2({
+    api_path_prefix: form["api-path-prefix"],
+    bucket: form["bucket"],
+    delete: form["delete"],
+    disable: form["disable"],
+    influxdbproto: form["influxdbproto"],
+    max_body_size: form["max-body-size"],
+    mtu: form["mtu"],
+    organization: form["organization"],
+    otel_compression: form["otel-compression"],
+    otel_max_body_size: form["otel-max-body-size"],
+    otel_path: form["otel-path"],
+    otel_protocol: form["otel-protocol"],
+    otel_timeout: form["otel-timeout"],
+    otel_verify_ssl: form["otel-verify-ssl"],
+    path: form["path"],
+    timeout: form["timeout"],
+    verify_certificate: form["verify-certificate"]
+  }),
+  id: props.id,
+  port: String(props.port),
+  server: props.server
 });
-var ProxmoxMetricServerProvider = () => Provider14.effect(ProxmoxMetricServer, Effect40.succeed(ProxmoxMetricServer.Provider.of(handlers8)));
+var deleteMetricServer = (props) => Effect40.gen(function* () {
+  if ((yield* readMetricServerRow(props)) === undefined)
+    return;
+  yield* runPve(props.target, "provision", true, cluster3.deleteClusterMetricsServer({ id: props.id }));
+});
+
+// src/proxmox/metric-server.ts
+import * as Provider14 from "alchemy/Provider";
+import * as Effect41 from "effect/Effect";
+var ProxmoxMetricServer = Resource14("Proxmox.MetricServer");
+var { guardCreate: guardCreate2, guardUpdate: guardUpdate2 } = specGuards(metricServerSpec);
+var ProxmoxMetricServerProvider = () => Provider14.effect(ProxmoxMetricServer, Effect41.succeed(ProxmoxMetricServer.Provider.of({
+  list: () => Effect41.succeed([]),
+  read: ({ olds }) => readMetricServer(olds),
+  diff: Effect41.fn(function* ({ news, output }) {
+    if (!isResolved12(news))
+      return;
+    yield* guardCreate2(news, output === undefined);
+    yield* guardUpdate2(news);
+    if (output === undefined)
+      return;
+    const live = yield* readMetricServer(news);
+    if (live === undefined) {
+      yield* guardCreate2(news, true);
+      return { action: "update" };
+    }
+    return { action: metricServerSpec.matches(live, news) ? "noop" : "update" };
+  }),
+  reconcile: Effect41.fn(function* ({ news }) {
+    const live = yield* readMetricServer(news);
+    yield* guardCreate2(news, live === undefined);
+    yield* guardUpdate2(news);
+    if (live === undefined) {
+      yield* runPve(news.target, "provision", true, cluster4.updateClusterMetricsServer({
+        ...metricServerRequest(news, metricServerSpec.createForm(news)),
+        type: news.type
+      }));
+    } else {
+      const form = formToSend(metricServerSpec.matches, live, news, metricServerSpec.updateForm(news));
+      if (form !== undefined)
+        yield* runPve(news.target, "provision", true, cluster4.putClusterMetricsServer(metricServerRequest(news, form)));
+    }
+    const after = yield* readMetricServer(news);
+    if (after === undefined)
+      return yield* Effect41.fail(new Error(`${metricServerSpec.path(news)}: write returned success but the resource is still absent`));
+    return after;
+  }),
+  delete: ({ olds }) => deleteMetricServer(olds)
+})));
 // src/proxmox/network-apply.ts
 import { Resource as Resource15 } from "alchemy";
-import { isResolved as isResolved11 } from "alchemy/Diff";
+import { isResolved as isResolved13 } from "alchemy/Diff";
 import * as Provider15 from "alchemy/Provider";
-import * as Effect41 from "effect/Effect";
+import * as Effect42 from "effect/Effect";
 
 // src/proxmox/apply-endpoints.ts
 var NETWORK_APPLY_ENDPOINT = "pve:PUT /nodes/{node}/network";
@@ -3451,15 +3598,15 @@ var guardSdnApply = guardForm(SDN_APPLY_ENDPOINT, {}, true);
 
 // src/proxmox/network-apply.ts
 var ProxmoxNetworkApply = Resource15("Proxmox.NetworkApply");
-var read2 = (props) => pendingCount(props.target, props.node).pipe(Effect41.map((pending) => ({ node: props.node, pending })));
-var diff2 = (news) => Effect41.gen(function* () {
-  if (!isResolved11(news))
+var read2 = (props) => pendingCount(props.target, props.node).pipe(Effect42.map((pending) => ({ node: props.node, pending })));
+var diff2 = (news) => Effect42.gen(function* () {
+  if (!isResolved13(news))
     return;
   const { pending } = yield* read2(news);
   return pending === 0 ? { action: "noop" } : { action: "update" };
 });
-var refuse = (node, why) => Effect41.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));
-var apply = (props) => Effect41.gen(function* () {
+var refuse = (node, why) => Effect42.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));
+var apply = (props) => Effect42.gen(function* () {
   const node = props.node;
   const staged = yield* pendingCount(props.target, node);
   if (staged === 0)
@@ -3488,20 +3635,20 @@ var apply = (props) => Effect41.gen(function* () {
   }
   return { node, pending: left };
 });
-var handlers9 = {
-  delete: () => Effect41.void,
+var handlers7 = {
+  delete: () => Effect42.void,
   diff: ({ news }) => diff2(news),
-  list: () => Effect41.succeed([]),
+  list: () => Effect42.succeed([]),
   read: ({ olds }) => read2(olds),
   reconcile: ({ news }) => apply(news)
 };
-var ProxmoxNetworkApplyProvider = () => Provider15.effect(ProxmoxNetworkApply, Effect41.succeed(ProxmoxNetworkApply.Provider.of(handlers9)));
+var ProxmoxNetworkApplyProvider = () => Provider15.effect(ProxmoxNetworkApply, Effect42.succeed(ProxmoxNetworkApply.Provider.of(handlers7)));
 // src/proxmox/node-network.ts
 import { Resource as Resource16 } from "alchemy";
-import { isResolved as isResolved12 } from "alchemy/Diff";
+import { isResolved as isResolved14 } from "alchemy/Diff";
 import * as Provider16 from "alchemy/Provider";
 import * as nodes9 from "@distilled.cloud/proxmox/nodes";
-import * as Effect43 from "effect/Effect";
+import * as Effect44 from "effect/Effect";
 
 // src/proxmox/node-network-form.ts
 var NODE_NETWORK_CREATE = "pve:POST /nodes/{node}/network";
@@ -3544,7 +3691,7 @@ var updateForm2 = (props) => {
 
 // src/proxmox/node-network-wire.ts
 import * as nodes8 from "@distilled.cloud/proxmox/nodes";
-import * as Effect42 from "effect/Effect";
+import * as Effect43 from "effect/Effect";
 var attributesOf6 = (live, props) => {
   const data = live;
   const liveType = text(data["type"]);
@@ -3578,12 +3725,12 @@ var attributesOf6 = (live, props) => {
     "vlan-raw-device": text(data["vlan-raw-device"])
   };
 };
-var readInterfaceOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, nodes8.getNodeNetwork({ iface: props.iface, node: props.node })).pipe(Effect42.catchTag("ParameterVerificationFailed", (error) => error.errors["iface"] === "interface does not exist" ? Effect42.succeed(undefined) : Effect42.fail(error)))).pipe(Effect42.map((live) => {
+var readInterfaceOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, nodes8.getNodeNetwork({ iface: props.iface, node: props.node })).pipe(Effect43.catchTag("ParameterVerificationFailed", (error) => error.errors["iface"] === "interface does not exist" ? Effect43.succeed(undefined) : Effect43.fail(error)))).pipe(Effect43.map((live) => {
   if (live === UNREADABLE)
     return UNREADABLE;
   return live === undefined ? undefined : attributesOf6(live, props);
 }));
-var readInterface = (props) => readInterfaceOrFail(props).pipe(Effect42.orElseSucceed(() => {
+var readInterface = (props) => readInterfaceOrFail(props).pipe(Effect43.orElseSucceed(() => {
   return;
 }));
 var dropUnreadable4 = (live) => live === UNREADABLE ? undefined : live;
@@ -3608,13 +3755,13 @@ var toDistilledUpdate2 = (props) => ({
   iface: props.iface,
   node: props.node
 });
-var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Effect43.succeed(ProxmoxNodeNetwork.Provider.of({
-  list: () => Effect43.succeed([]),
-  read: Effect43.fn(function* ({ olds, output }) {
+var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Effect44.succeed(ProxmoxNodeNetwork.Provider.of({
+  list: () => Effect44.succeed([]),
+  read: Effect44.fn(function* ({ olds, output }) {
     return dropUnreadable4(yield* output === undefined ? readInterface(olds) : readInterfaceOrFail(olds));
   }),
-  diff: Effect43.fn(function* ({ news, output }) {
-    if (!isResolved12(news))
+  diff: Effect44.fn(function* ({ news, output }) {
+    if (!isResolved14(news))
       return;
     yield* guardWrite2(NODE_NETWORK_CREATE, createForm5(news), output === undefined);
     yield* guardWrite2(NODE_NETWORK_UPDATE, updateForm2(news), false);
@@ -3631,7 +3778,7 @@ var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Eff
     }
     return matches5(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect43.fn(function* ({ news }) {
+  reconcile: Effect44.fn(function* ({ news }) {
     const before = dropUnreadable4(yield* readInterface(news));
     yield* guardWrite2(NODE_NETWORK_CREATE, createForm5(news), before === undefined);
     yield* guardWrite2(NODE_NETWORK_UPDATE, updateForm2(news), false);
@@ -3642,18 +3789,22 @@ var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Eff
     }
     const after = dropUnreadable4(yield* readInterface(news));
     if (after === undefined) {
-      return yield* Effect43.die(new Error(`nodes/${news.node}/network/${news.iface}: wrote with no error, but the ` + 'interface is still absent -- PVE wraps every answer in {"data":...} and can ' + "report success on a call that did nothing, so read back rather than trust it."));
+      return yield* Effect44.die(new Error(`nodes/${news.node}/network/${news.iface}: wrote with no error, but the ` + 'interface is still absent -- PVE wraps every answer in {"data":...} and can ' + "report success on a call that did nothing, so read back rather than trust it."));
     }
     return after;
   }),
-  delete: Effect43.fn(function* ({ olds }) {
+  delete: Effect44.fn(function* ({ olds }) {
     yield* runPve(olds.target, "provision", true, nodes9.deleteNodeNetwork2({ iface: olds.iface, node: olds.node }));
   })
 })));
 // src/proxmox/notification-matcher.ts
 import { Resource as Resource17 } from "alchemy";
 import * as Provider17 from "alchemy/Provider";
-import * as Effect44 from "effect/Effect";
+import * as Effect48 from "effect/Effect";
+
+// src/proxmox/notification-matcher-lifecycle.ts
+import { isResolved as isResolved15 } from "alchemy/Diff";
+import * as Effect47 from "effect/Effect";
 
 // src/proxmox/notification-matcher-form.ts
 var list = (value) => Array.isArray(value) ? value.map((item) => String(item)) : [];
@@ -3729,25 +3880,99 @@ var matcherUpdateForm = (fields) => {
   };
 };
 
+// src/proxmox/notification-matcher-distilled.ts
+import * as cluster5 from "@distilled.cloud/proxmox/cluster";
+import * as Effect46 from "effect/Effect";
+
+// src/proxmox/notification-sdk-input.ts
+import { ProxmoxParseError as ProxmoxParseError3 } from "@distilled.cloud/proxmox/Errors";
+import * as Data2 from "effect/Data";
+import * as Effect45 from "effect/Effect";
+import * as Schema3 from "effect/Schema";
+
+class NotificationRequestInvalid extends Data2.TaggedError("NotificationRequestInvalid") {
+}
+var notificationRequest = (schema, fields) => Schema3.decodeUnknownEffect(Schema3.toType(schema), { onExcessProperty: "error" })(Object.fromEntries(Object.entries(fields).map(([key, value]) => [key.replaceAll("-", "_"), value]))).pipe(Effect45.mapError(() => new NotificationRequestInvalid({ operation: "PVE notification write" })));
+var notificationResponse = (schema) => (body5) => Schema3.decodeUnknownEffect(Schema3.toType(schema))(body5).pipe(Effect45.as(body5), Effect45.mapError(() => new ProxmoxParseError3({
+  body: undefined,
+  cause: "PVE notification response does not match its SDK schema"
+})));
+
+// src/proxmox/notification-matcher-distilled.ts
+var readMatcher = (props) => runPve(props.target, "read", false, cluster5.getClusterNotificationMatcher({ name: props.name })).pipe(Effect46.flatMap(notificationResponse(cluster5.GetClusterNotificationMatcherResponse)), Effect46.map((live) => matcherAttributes({
+  ...live,
+  "invert-match": live.invert_match,
+  "match-calendar": live.match_calendar,
+  "match-field": live.match_field,
+  "match-severity": live.match_severity
+}, props.name)), Effect46.catchTag("NotFound", () => Effect46.succeed(undefined)));
+var createMatcher = (props) => Effect46.gen(function* () {
+  const input = yield* notificationRequest(cluster5.CreateClusterNotificationMatcherRequest, matcherCreateForm(props));
+  yield* runPve(props.target, "provision", true, cluster5.createClusterNotificationMatcher(input));
+});
+var updateMatcher = (props) => Effect46.gen(function* () {
+  const input = yield* notificationRequest(cluster5.PutClusterNotificationMatcherRequest, {
+    ...matcherUpdateForm(props),
+    name: props.name
+  });
+  yield* runPve(props.target, "provision", true, cluster5.putClusterNotificationMatcher(input));
+});
+var deleteMatcher = (props) => runPve(props.target, "provision", true, cluster5.deleteClusterNotificationMatcher({ name: props.name })).pipe(Effect46.catchTag("NotFound", () => Effect46.void));
+
+// src/proxmox/notification-matcher-lifecycle.ts
+var guard = (props, create) => guardForm("pve:POST /cluster/notifications/matchers", matcherCreateForm(props), create).pipe(Effect47.andThen(guardForm("pve:PUT /cluster/notifications/matchers/{name}", matcherUpdateForm(props), false)));
+var matcherHandlers = {
+  list: () => Effect47.succeed([]),
+  read: ({ olds }) => Effect47.gen(function* () {
+    const live = yield* readMatcher(olds);
+    yield* guard(olds, live === undefined);
+    return live;
+  }),
+  diff: ({
+    news,
+    olds,
+    output
+  }) => Effect47.gen(function* () {
+    if (!isResolved15(news))
+      return;
+    if (olds.name !== news.name)
+      return { action: "replace" };
+    yield* guard(news, output === undefined);
+    if (output === undefined)
+      return;
+    const live = yield* readMatcher(news);
+    if (live === undefined) {
+      yield* guard(news, true);
+      return { action: "update" };
+    }
+    return { action: matcherMatches(live, news) ? "noop" : "update" };
+  }),
+  reconcile: ({ news }) => Effect47.gen(function* () {
+    const live = yield* readMatcher(news);
+    yield* guard(news, live === undefined);
+    if (live === undefined)
+      yield* createMatcher(news);
+    else if (!matcherMatches(live, news))
+      yield* updateMatcher(news);
+    const after = yield* readMatcher(news);
+    if (after === undefined)
+      return yield* Effect47.die(new Error(`Notification matcher ${news.name}: write returned but read-back is absent.`));
+    return after;
+  }),
+  delete: ({ olds }) => deleteMatcher(olds)
+};
+
 // src/proxmox/notification-matcher.ts
 var ProxmoxNotificationMatcher = Resource17("Proxmox.NotificationMatcher");
-var handlers10 = pveHandlers({
-  attributes: (live, props) => matcherAttributes(live, props.name),
-  collection: () => "cluster/notifications/matchers",
-  createForm: matcherCreateForm,
-  endpoint: {
-    create: "pve:POST /cluster/notifications/matchers",
-    update: "pve:PUT /cluster/notifications/matchers/{name}"
-  },
-  matches: matcherMatches,
-  path: (props) => `cluster/notifications/matchers/${props.name}`,
-  updateForm: matcherUpdateForm
-});
-var ProxmoxNotificationMatcherProvider = () => Provider17.effect(ProxmoxNotificationMatcher, Effect44.succeed(ProxmoxNotificationMatcher.Provider.of(handlers10)));
+var ProxmoxNotificationMatcherProvider = () => Provider17.effect(ProxmoxNotificationMatcher, Effect48.succeed(ProxmoxNotificationMatcher.Provider.of(matcherHandlers)));
 // src/proxmox/notification-target.ts
 import { Resource as Resource18 } from "alchemy";
 import * as Provider18 from "alchemy/Provider";
-import * as Effect45 from "effect/Effect";
+import * as Effect51 from "effect/Effect";
+
+// src/proxmox/notification-target-lifecycle.ts
+import { isResolved as isResolved16 } from "alchemy/Diff";
+import * as Effect50 from "effect/Effect";
 
 // src/proxmox/notification-target-endpoint.ts
 var ENDPOINTS = {
@@ -3801,9 +4026,8 @@ var createShape = (props) => ({
   name: props.name
 });
 
-// src/proxmox/notification-target.ts
-var ProxmoxNotificationTarget = Resource18("Proxmox.NotificationTarget");
-var handlers11 = pveHandlers({
+// src/proxmox/notification-target-spec.ts
+var targetSpec = {
   attributes: (live, props) => ({
     author: text(live["author"]),
     body: text(live["body"]),
@@ -3828,16 +4052,155 @@ var handlers11 = pveHandlers({
   matches: (attributes, props) => attributes.disable === (props.disable === true) && (props.comment === undefined || attributes.comment === props.comment) && (props.server === undefined || attributes.server === props.server) && (props.port === undefined || attributes.port === props.port) && (props.mode === undefined || attributes.mode === props.mode) && (props.username === undefined || attributes.username === props.username) && (props["from-address"] === undefined || attributes["from-address"] === props["from-address"]) && (props.author === undefined || attributes.author === props.author) && (props.url === undefined || attributes.url === props.url) && (props.method === undefined || attributes.method === props.method) && (props.body === undefined || attributes.body === props.body) && (props.mailto === undefined || attributes.mailto === addressList(props.mailto)) && (props["mailto-user"] === undefined || attributes["mailto-user"] === addressList(props["mailto-user"])) && (props.header === undefined || attributes.header === headerList(props.header)),
   path: (props) => `cluster/notifications/endpoints/${props.type}/${props.name}`,
   updateForm: shape4
-});
-var ProxmoxNotificationTargetProvider = () => Provider18.effect(ProxmoxNotificationTarget, Effect45.succeed(ProxmoxNotificationTarget.Provider.of(handlers11)));
+};
+
+// src/proxmox/notification-target-distilled.ts
+import * as cluster6 from "@distilled.cloud/proxmox/cluster";
+import * as Effect49 from "effect/Effect";
+var read3 = (props) => {
+  const request = { name: props.name };
+  switch (props.type) {
+    case "gotify":
+      return cluster6.getClusterNotificationEndpointGotify(request).pipe(Effect49.flatMap(notificationResponse(cluster6.GetClusterNotificationEndpointGotifyResponse)), Effect49.map((row) => ({ ...row })));
+    case "sendmail":
+      return cluster6.getClusterNotificationEndpointSendmail(request).pipe(Effect49.flatMap(notificationResponse(cluster6.GetClusterNotificationEndpointSendmailResponse)), Effect49.map((row) => ({
+        ...row,
+        "from-address": row.from_address,
+        "mailto-user": row.mailto_user
+      })));
+    case "smtp":
+      return cluster6.getClusterNotificationEndpointSmtp(request).pipe(Effect49.flatMap(notificationResponse(cluster6.GetClusterNotificationEndpointSmtpResponse)), Effect49.map((row) => ({
+        ...row,
+        "from-address": row.from_address,
+        "mailto-user": row.mailto_user
+      })));
+    case "webhook":
+      return cluster6.getClusterNotificationEndpointWebhook(request).pipe(Effect49.flatMap(notificationResponse(cluster6.GetClusterNotificationEndpointWebhookResponse)), Effect49.map((row) => ({ ...row })));
+  }
+};
+var readTarget = (props) => runPve(props.target, "read", false, read3(props)).pipe(Effect49.map((row) => targetSpec.attributes(row, props)), Effect49.catchTag("NotFound", () => Effect49.succeed(undefined)));
+var fields = (props, create) => {
+  const form = {
+    ...create ? createShape(props) : shape4(props),
+    name: props.name
+  };
+  const cleared = [];
+  for (const [key, values] of [
+    ["header", props.header === undefined ? undefined : [...props.header]],
+    [
+      "mailto",
+      props.mailto === undefined ? undefined : addressList(props.mailto).split(",").filter(Boolean)
+    ],
+    [
+      "mailto-user",
+      props["mailto-user"] === undefined ? undefined : addressList(props["mailto-user"]).split(",").filter(Boolean)
+    ]
+  ]) {
+    if (values === undefined)
+      continue;
+    if (values.length > 0)
+      form[key] = values;
+    else {
+      delete form[key];
+      if (!create)
+        cleared.push(key);
+    }
+  }
+  if (cleared.length > 0)
+    form.delete = cleared;
+  return form;
+};
+var validateTargetWrite = (props, create) => {
+  const schema = create ? {
+    sendmail: cluster6.CreateClusterNotificationEndpointSendmailRequest,
+    smtp: cluster6.CreateClusterNotificationEndpointSmtpRequest,
+    gotify: cluster6.CreateClusterNotificationEndpointGotifyRequest,
+    webhook: cluster6.CreateClusterNotificationEndpointWebhookRequest
+  }[props.type] : {
+    sendmail: cluster6.PutClusterNotificationEndpointSendmailRequest,
+    smtp: cluster6.PutClusterNotificationEndpointSmtpRequest,
+    gotify: cluster6.PutClusterNotificationEndpointGotifyRequest,
+    webhook: cluster6.PutClusterNotificationEndpointWebhookRequest
+  }[props.type];
+  return notificationRequest(schema, fields(props, create)).pipe(Effect49.asVoid);
+};
+var createTarget = (props) => {
+  const form = fields(props, true);
+  const operation = props.type === "sendmail" ? notificationRequest(cluster6.CreateClusterNotificationEndpointSendmailRequest, form).pipe(Effect49.flatMap(cluster6.createClusterNotificationEndpointSendmail)) : props.type === "smtp" ? notificationRequest(cluster6.CreateClusterNotificationEndpointSmtpRequest, form).pipe(Effect49.flatMap(cluster6.createClusterNotificationEndpointSmtp)) : props.type === "gotify" ? notificationRequest(cluster6.CreateClusterNotificationEndpointGotifyRequest, form).pipe(Effect49.flatMap(cluster6.createClusterNotificationEndpointGotify)) : notificationRequest(cluster6.CreateClusterNotificationEndpointWebhookRequest, form).pipe(Effect49.flatMap(cluster6.createClusterNotificationEndpointWebhook));
+  return runPve(props.target, "provision", true, operation);
+};
+var updateTarget = (props) => {
+  const form = fields(props, false);
+  const operation = props.type === "sendmail" ? notificationRequest(cluster6.PutClusterNotificationEndpointSendmailRequest, form).pipe(Effect49.flatMap(cluster6.putClusterNotificationEndpointSendmail)) : props.type === "smtp" ? notificationRequest(cluster6.PutClusterNotificationEndpointSmtpRequest, form).pipe(Effect49.flatMap(cluster6.putClusterNotificationEndpointSmtp)) : props.type === "gotify" ? notificationRequest(cluster6.PutClusterNotificationEndpointGotifyRequest, form).pipe(Effect49.flatMap(cluster6.putClusterNotificationEndpointGotify)) : notificationRequest(cluster6.PutClusterNotificationEndpointWebhookRequest, form).pipe(Effect49.flatMap(cluster6.putClusterNotificationEndpointWebhook));
+  return runPve(props.target, "provision", true, operation);
+};
+var deleteTarget = (props) => {
+  const request = { name: props.name };
+  const operation = props.type === "sendmail" ? cluster6.deleteClusterNotificationEndpointSendmail(request) : props.type === "smtp" ? cluster6.deleteClusterNotificationEndpointSmtp(request) : props.type === "gotify" ? cluster6.deleteClusterNotificationEndpointGotify(request) : cluster6.deleteClusterNotificationEndpointWebhook(request);
+  return runPve(props.target, "provision", true, operation).pipe(Effect49.catchTag("NotFound", () => Effect49.void));
+};
+
+// src/proxmox/notification-target-lifecycle.ts
+var { guardCreate: guardCreate3, guardUpdate: guardUpdate3 } = specGuards(targetSpec);
+var guard2 = (props, create) => guardCreate3(props, create).pipe(Effect50.andThen(guardUpdate3(props)));
+var targetHandlers = {
+  list: () => Effect50.succeed([]),
+  read: ({ olds }) => Effect50.gen(function* () {
+    const live = yield* readTarget(olds);
+    yield* guard2(olds, live === undefined);
+    return live;
+  }),
+  diff: ({
+    news,
+    olds,
+    output
+  }) => Effect50.gen(function* () {
+    if (!isResolved16(news))
+      return;
+    if (olds.name !== news.name || olds.type !== news.type) {
+      const destination = yield* readTarget(news);
+      yield* guard2(news, destination === undefined);
+      yield* validateTargetWrite(news, destination === undefined);
+      return { action: "replace", deleteFirst: olds.name === news.name };
+    }
+    yield* guard2(news, output === undefined);
+    if (output === undefined)
+      return;
+    const live = yield* readTarget(news);
+    if (live === undefined) {
+      yield* guard2(news, true);
+      return { action: "update" };
+    }
+    return { action: targetSpec.matches(live, news) ? "noop" : "update" };
+  }),
+  reconcile: ({ news }) => Effect50.gen(function* () {
+    const live = yield* readTarget(news);
+    yield* guard2(news, live === undefined);
+    if (live === undefined)
+      yield* createTarget(news);
+    else if (!targetSpec.matches(live, news))
+      yield* updateTarget(news);
+    const after = yield* readTarget(news);
+    if (after === undefined)
+      return yield* Effect50.die(new Error(`Notification target ${news.name}: write returned but read-back is absent.`));
+    return after;
+  }),
+  delete: ({ olds }) => deleteTarget(olds)
+};
+
+// src/proxmox/notification-target.ts
+var ProxmoxNotificationTarget = Resource18("Proxmox.NotificationTarget");
+var ProxmoxNotificationTargetProvider = () => Provider18.effect(ProxmoxNotificationTarget, Effect51.succeed(ProxmoxNotificationTarget.Provider.of(targetHandlers)));
 // src/proxmox/pbs-datastore.ts
 import { Resource as Resource19 } from "alchemy";
-import { isResolved as isResolved13 } from "alchemy/Diff";
 import * as Provider19 from "alchemy/Provider";
-import * as Effect49 from "effect/Effect";
+import * as Effect57 from "effect/Effect";
+
+// src/proxmox/pbs-datastore-lifecycle.ts
+import { isResolved as isResolved17 } from "alchemy/Diff";
+import * as Effect56 from "effect/Effect";
 
 // src/proxmox/pbs-datastore-form.ts
-import * as Effect46 from "effect/Effect";
 var attributes = (live, props) => ({
   backend: propertyString(live["backend"]),
   comment: text(live["comment"]),
@@ -3889,48 +4252,117 @@ var createForm6 = (props) => ({
 });
 var updateForm3 = (props) => mutable(props);
 var object2 = (props) => `config/datastore/${props.name}`;
-var readOne = (props) => pve(props.target, "read", "GET", object2(props)).pipe(Effect46.map((live) => live === undefined || typeof live["name"] !== "string" ? undefined : attributes(live, props)), Effect46.orElseSucceed(() => {
-  return;
-}));
+
+// src/proxmox/pbs-datastore-wire.ts
+import * as config from "@distilled.cloud/proxmox-backup/config";
+import * as Effect53 from "effect/Effect";
+
+// src/proxmox/distilled-pbs.ts
+import { credentials } from "@distilled.cloud/proxmox-backup/Credentials";
+import * as Retry from "@distilled.cloud/proxmox-backup/Retry";
+import * as Effect52 from "effect/Effect";
+var runPbsWith = (target, credential, op, timeout5 = MEMBER_TIMEOUT) => op.pipe(Retry.none, Effect52.provide(credentials({
+  baseUrl: target.api,
+  secret: credential.secret,
+  tokenId: credential.tokenId
+})), Effect52.timeout(timeout5));
+var runPbs = (target, role, op) => Effect52.gen(function* () {
+  const credential = yield* leased(target, role);
+  return yield* runPbsWith(target, credential, op);
+});
+
+// src/proxmox/pbs-datastore-wire.ts
+var members = (form) => ({
+  ...form["comment"] === undefined ? {} : { comment: form["comment"] },
+  ...form["counter-reset-schedule"] === undefined ? {} : { counter_reset_schedule: form["counter-reset-schedule"] },
+  ...form["gc-schedule"] === undefined ? {} : { gc_schedule: form["gc-schedule"] },
+  ...form["keep-daily"] === undefined ? {} : { keep_daily: form["keep-daily"] },
+  ...form["keep-hourly"] === undefined ? {} : { keep_hourly: form["keep-hourly"] },
+  ...form["keep-last"] === undefined ? {} : { keep_last: form["keep-last"] },
+  ...form["keep-monthly"] === undefined ? {} : { keep_monthly: form["keep-monthly"] },
+  ...form["keep-weekly"] === undefined ? {} : { keep_weekly: form["keep-weekly"] },
+  ...form["keep-yearly"] === undefined ? {} : { keep_yearly: form["keep-yearly"] },
+  ...form["maintenance-mode"] === undefined ? {} : { maintenance_mode: form["maintenance-mode"] },
+  ...form["notification-thresholds"] === undefined ? {} : { notification_thresholds: form["notification-thresholds"] },
+  ...form["notify"] === undefined ? {} : { notify: form["notify"] },
+  ...form["notify-user"] === undefined ? {} : { notify_user: form["notify-user"] },
+  ...form["prune-schedule"] === undefined ? {} : { prune_schedule: form["prune-schedule"] },
+  ...form["tuning"] === undefined ? {} : { tuning: form["tuning"] },
+  ...form["verify-new"] === undefined ? {} : { verify_new: form["verify-new"] }
+});
+var createRequest = (props) => ({
+  ...members(createForm6(props)),
+  name: props.name,
+  path: props.path,
+  ...props.backend === undefined ? {} : { backend: props.backend }
+});
+var updateRequest = (props) => ({
+  ...members(updateForm3(props)),
+  name: props.name
+});
+var wire = (row) => ({
+  ...row,
+  "counter-reset-schedule": row.counter_reset_schedule,
+  "gc-schedule": row.gc_schedule,
+  "keep-daily": row.keep_daily,
+  "keep-hourly": row.keep_hourly,
+  "keep-last": row.keep_last,
+  "keep-monthly": row.keep_monthly,
+  "keep-weekly": row.keep_weekly,
+  "keep-yearly": row.keep_yearly,
+  "maintenance-mode": row.maintenance_mode,
+  "notification-thresholds": row.notification_thresholds,
+  "notify-user": row.notify_user,
+  "prune-schedule": row.prune_schedule,
+  "verify-new": row.verify_new
+});
+var readOne = (props) => runPbs(props.target, "read", config.getConfigDatastore({ name: props.name })).pipe(Effect53.map((live) => attributes(wire(live), props)), Effect53.catchTag("DatastoreNotFound", () => Effect53.succeed(undefined)));
+var createOne = (props) => runPbs(props.target, "provision", config.createConfigDatastore(createRequest(props)));
+var updateOne = (props) => runPbs(props.target, "provision", config.putConfigDatastore(updateRequest(props)));
+var deleteOne = (props) => Effect53.gen(function* () {
+  if ((yield* readOne(props)) === undefined)
+    return;
+  return yield* runPbs(props.target, "provision", config.deleteConfigDatastore({ name: props.name }));
+});
 
 // src/proxmox/pbs-datastore-guard.ts
-import * as Effect47 from "effect/Effect";
+import * as Effect54 from "effect/Effect";
 var samePath = (left, right) => {
   const trim = (value) => value.length > 1 ? value.replace(/\/+$/, "") : value;
   return trim(left) === trim(right);
 };
-var guardPath = (live, props) => live.path === "" || samePath(live.path, props.path) ? Effect47.void : Effect47.die(new Error(`${object2(props)}: declared path ${props.path} but PBS holds ${live.path}. \`path\` ` + "is create-only, so this cannot be reconciled and will NOT be planned as a silent " + "noop: backups would keep landing in the old directory behind a green plan. Correct " + "the declaration, or remove the datastore and declare a new one -- the contents live, " + "because `destroy-data` is never sent."));
-var guardBackend = (live, props) => props.backend === undefined || propertyString(props.backend) === live.backend ? Effect47.void : Effect47.die(new Error(`${object2(props)}: declared backend ${props.backend} but PBS holds ` + `${live.backend === "" ? "(none — a local datastore)" : live.backend}. \`backend\` ` + "is create-only: PBS has no update for it, so this cannot be reconciled and will NOT " + "be planned as a silent noop. Correct the declaration to match what is really there, " + "or remove the datastore and declare a new one -- the contents live, because " + "`destroy-data` is never sent."));
-var settle3 = (read3, done) => Effect47.gen(function* () {
+var guardPath = (live, props) => live.path === "" || samePath(live.path, props.path) ? Effect54.void : Effect54.die(new Error(`${object2(props)}: declared path ${props.path} but PBS holds ${live.path}. \`path\` ` + "is create-only, so this cannot be reconciled and will NOT be planned as a silent " + "noop: backups would keep landing in the old directory behind a green plan. Correct " + "the declaration, or remove the datastore and declare a new one -- the contents live, " + "because `destroy-data` is never sent."));
+var guardBackend = (live, props) => props.backend === undefined || propertyString(props.backend) === live.backend ? Effect54.void : Effect54.die(new Error(`${object2(props)}: declared backend ${props.backend} but PBS holds ` + `${live.backend === "" ? "(none — a local datastore)" : live.backend}. \`backend\` ` + "is create-only: PBS has no update for it, so this cannot be reconciled and will NOT " + "be planned as a silent noop. Correct the declaration to match what is really there, " + "or remove the datastore and declare a new one -- the contents live, because " + "`destroy-data` is never sent."));
+var settle2 = (read4, done) => Effect54.gen(function* () {
   for (let attempt = 0;attempt < 60; attempt += 1) {
-    const live = yield* read3;
+    const live = yield* read4;
     if (done(live))
       return live;
-    yield* Effect47.sleep("2 seconds");
+    yield* Effect54.sleep("2 seconds");
   }
-  return yield* read3;
+  return yield* read4;
 });
 
 // src/proxmox/pbs-datastore-endpoint.ts
-import * as Effect48 from "effect/Effect";
+import * as Effect55 from "effect/Effect";
 var DATASTORE_ENDPOINT = {
   create: "pbs:POST /config/datastore",
   update: "pbs:PUT /config/datastore/{name}"
 };
-var guardDatastoreForms = (props) => Effect48.gen(function* () {
+var guardDatastoreForms = (props) => Effect55.gen(function* () {
   yield* guardForm(DATASTORE_ENDPOINT.create, createForm6(props), true);
   yield* guardForm(DATASTORE_ENDPOINT.update, updateForm3(props), false);
 });
 
-// src/proxmox/pbs-datastore.ts
-var PbsDatastore = Resource19("Pbs.Datastore", {
-  defaultRemovalPolicy: "retain"
-});
-var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect49.succeed(PbsDatastore.Provider.of({
-  list: () => Effect49.succeed([]),
+// src/proxmox/pbs-datastore-lifecycle.ts
+var handlers8 = {
+  list: () => Effect56.succeed([]),
   read: ({ olds }) => readOne(olds),
-  diff: ({ news, output }) => Effect49.gen(function* () {
-    if (!isResolved13(news))
+  diff: ({
+    news,
+    output
+  }) => Effect56.gen(function* () {
+    if (!isResolved17(news))
       return;
     yield* guardDatastoreForms(news);
     if (output === undefined)
@@ -3942,106 +4374,135 @@ var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect49.succee
     yield* guardBackend(live, news);
     return matches6(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect49.fn(function* ({ news }) {
+  reconcile: Effect56.fn(function* ({ news }) {
     yield* guardDatastoreForms(news);
     const live = yield* readOne(news);
-    let upid;
     if (live === undefined) {
-      upid = yield* pve(news.target, "provision", "POST", "config/datastore", createForm6(news));
+      yield* createOne(news);
     } else {
       yield* guardPath(live, news);
       yield* guardBackend(live, news);
       const form = formToSend(matches6, live, news, updateForm3(news));
       if (form !== undefined) {
-        yield* pve(news.target, "provision", "PUT", object2(news), form);
+        yield* updateOne(news);
       }
     }
-    const after = yield* settle3(readOne(news), (row) => row !== undefined && matches6(row, news));
+    const after = yield* settle2(readOne(news), (row) => row !== undefined && matches6(row, news));
     if (after === undefined || !matches6(after, news)) {
-      return yield* Effect49.die(new Error(`${object2(news)}: the write returned no error but the datastore still does not ` + `match the declaration after 120s. PBS answered with task ${upid ?? "(none)"} ` + "-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a " + "plausible cause (see `settle`); a create over an existing chunk store is not, " + "because PBS refuses that outright rather than timing out."));
+      return yield* Effect56.die(new Error(`${object2(news)}: the write returned no error but the datastore still does not ` + "match the declaration after 120s. Check the PBS task list " + "-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a " + "plausible cause (see `settle`); a create over an existing chunk store is not, " + "because PBS refuses that outright rather than timing out."));
     }
     return after;
   }),
-  delete: Effect49.fn(function* ({ olds }) {
-    yield* pve(olds.target, "provision", "DELETE", object2(olds));
-    const left = yield* settle3(readOne(olds), (row) => row === undefined);
+  delete: Effect56.fn(function* ({ olds }) {
+    yield* deleteOne(olds);
+    const left = yield* settle2(readOne(olds), (row) => row === undefined);
     if (left !== undefined) {
-      return yield* Effect49.die(new Error(`${object2(olds)}: the DELETE returned no error but the datastore is still in ` + "datastore.cfg after 120s. Either a backup, verify or GC task still holds it, " + "or the provision role lacks Datastore.Allocate on /datastore/" + `${olds.name}. Read the task log with \`proxmox-backup-manager task log <upid>\`.`));
+      return yield* Effect56.die(new Error(`${object2(olds)}: the DELETE returned no error but the datastore is still in ` + "datastore.cfg after 120s. Either a backup, verify or GC task still holds it, " + "or the provision role lacks Datastore.Allocate on /datastore/" + `${olds.name}. Read the task log with \`proxmox-backup-manager task log <upid>\`.`));
     }
   })
-})));
+};
+
+// src/proxmox/pbs-datastore.ts
+var PbsDatastore = Resource19("Pbs.Datastore", {
+  defaultRemovalPolicy: "retain"
+});
+var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect57.succeed(PbsDatastore.Provider.of(handlers8)));
 // src/proxmox/pbs-notification-matcher.ts
 import { Resource as Resource20 } from "alchemy";
 import * as Provider20 from "alchemy/Provider";
-import * as Effect50 from "effect/Effect";
-var PbsNotificationMatcher = Resource20("Pbs.NotificationMatcher");
-var handlers12 = pveHandlers({
-  attributes: (live, props) => matcherAttributes(live, props.name),
-  collection: () => "config/notifications/matchers",
-  createForm: matcherCreateForm,
-  endpoint: {
-    create: "pbs:POST /config/notifications/matchers",
-    update: "pbs:PUT /config/notifications/matchers/{name}"
-  },
-  matches: matcherMatches,
-  path: (props) => `config/notifications/matchers/${props.name}`,
-  updateForm: matcherUpdateForm
+import { isResolved as isResolved18 } from "alchemy/Diff";
+import * as Effect60 from "effect/Effect";
+
+// src/proxmox/pbs-notification-matcher-distilled.ts
+import * as config2 from "@distilled.cloud/proxmox-backup/config";
+import * as Effect59 from "effect/Effect";
+
+// src/proxmox/pbs-notification-input.ts
+import * as Data3 from "effect/Data";
+import * as Effect58 from "effect/Effect";
+import * as Schema4 from "effect/Schema";
+
+class PbsNotificationInputRefusal extends Data3.TaggedError("PbsNotificationInputRefusal") {
+}
+var notificationInput = (schema, fields2) => Schema4.decodeUnknownEffect(Schema4.toType(schema))(fields2).pipe(Effect58.mapError(() => new PbsNotificationInputRefusal({
+  message: "PBS notification fields do not match the SDK request schema; no PBS request was sent."
+})));
+
+// src/proxmox/pbs-notification-matcher-distilled.ts
+var readMatcher2 = (props) => runPbs(props.target, "read", config2.getConfigNotificationMatcher({ name: props.name })).pipe(Effect59.map((row) => matcherAttributes({
+  ...row,
+  "invert-match": row.invert_match,
+  "match-calendar": row.match_calendar,
+  "match-field": row.match_field,
+  "match-severity": row.match_severity
+}, props.name)), Effect59.catchTag("NotFound", () => Effect59.succeed(undefined)));
+var requestFields = (props, form) => ({
+  ...form,
+  invert_match: form["invert-match"],
+  match_calendar: form["match-calendar"],
+  match_field: form["match-field"],
+  match_severity: form["match-severity"],
+  name: props.name
 });
-var PbsNotificationMatcherProvider = () => Provider20.effect(PbsNotificationMatcher, Effect50.succeed(PbsNotificationMatcher.Provider.of(handlers12)));
+var createMatcher2 = (props, form) => runPbs(props.target, "provision", notificationInput(config2.CreateConfigNotificationMatcherRequest, requestFields(props, form)).pipe(Effect59.flatMap(config2.createConfigNotificationMatcher)));
+var updateMatcher2 = (props, form) => runPbs(props.target, "provision", notificationInput(config2.PutConfigNotificationMatcherRequest, requestFields(props, form)).pipe(Effect59.flatMap(config2.putConfigNotificationMatcher)));
+var deleteMatcher2 = (props) => runPbs(props.target, "provision", config2.deleteConfigNotificationMatcher({ name: props.name })).pipe(Effect59.catchTag("NotFound", () => Effect59.void));
+
+// src/proxmox/pbs-notification-matcher.ts
+var PbsNotificationMatcher = Resource20("Pbs.NotificationMatcher");
+var guardCreate4 = (props, requirePresence) => guardForm("pbs:POST /config/notifications/matchers", matcherCreateForm(props), requirePresence);
+var guardUpdate4 = (props) => guardForm("pbs:PUT /config/notifications/matchers/{name}", matcherUpdateForm(props), false);
+var handlers9 = {
+  list: () => Effect60.succeed([]),
+  read: ({ olds }) => readMatcher2(olds),
+  diff: ({
+    news,
+    olds,
+    output
+  }) => Effect60.gen(function* () {
+    if (!isResolved18(news))
+      return;
+    yield* guardCreate4(news, output === undefined);
+    yield* guardUpdate4(news);
+    if (output === undefined)
+      return;
+    if (olds.name !== news.name)
+      return { action: "replace" };
+    const live = yield* readMatcher2(news);
+    if (live === undefined) {
+      yield* guardCreate4(news, true);
+      return { action: "update" };
+    }
+    return { action: matcherMatches(live, news) ? "noop" : "update" };
+  }),
+  reconcile: ({ news }) => Effect60.gen(function* () {
+    const live = yield* readMatcher2(news);
+    yield* guardCreate4(news, live === undefined);
+    yield* guardUpdate4(news);
+    if (live === undefined)
+      yield* createMatcher2(news, matcherCreateForm(news));
+    else if (!matcherMatches(live, news))
+      yield* updateMatcher2(news, matcherUpdateForm(news));
+    const after = yield* readMatcher2(news);
+    if (after === undefined)
+      return yield* Effect60.fail(new Error(`config/notifications/matchers/${news.name}: the write returned no error but the matcher is still absent.`));
+    return after;
+  }),
+  delete: ({ olds }) => deleteMatcher2(olds)
+};
+var PbsNotificationMatcherProvider = () => Provider20.effect(PbsNotificationMatcher, Effect60.succeed(PbsNotificationMatcher.Provider.of(handlers9)));
 // src/proxmox/pbs-notification-target.ts
 import { Resource as Resource21 } from "alchemy";
 import * as Provider21 from "alchemy/Provider";
-import * as Effect52 from "effect/Effect";
+import * as Effect63 from "effect/Effect";
 
 // src/proxmox/pbs-notification-target-lifecycle.ts
-import { isResolved as isResolved14 } from "alchemy/Diff";
-import * as Effect51 from "effect/Effect";
-
-// src/proxmox/pbs-notification-target-endpoint.ts
-var ENDPOINTS2 = {
-  sendmail: {
-    create: "pbs:POST /config/notifications/endpoints/sendmail",
-    update: "pbs:PUT /config/notifications/endpoints/sendmail/{name}"
-  },
-  smtp: {
-    create: "pbs:POST /config/notifications/endpoints/smtp",
-    update: "pbs:PUT /config/notifications/endpoints/smtp/{name}"
-  },
-  webhook: {
-    create: "pbs:POST /config/notifications/endpoints/webhook",
-    update: "pbs:PUT /config/notifications/endpoints/webhook/{name}"
-  }
-};
-var pbsTargetEndpoint = (props) => ENDPOINTS2[props.type];
+import { isResolved as isResolved19 } from "alchemy/Diff";
+import * as Effect62 from "effect/Effect";
 
-// src/proxmox/credential-literals.ts
-var READS_SECRET = /\{\{[^}]*\bsecrets\./;
-var CREDENTIAL_WORD = /(^|[-_])(api[-_]?key|apikey|key|token|secret|password|passwd|pwd|pass|auth|signature|sig|code)($|[-_])/i;
-var CREDENTIAL_HEADER = /^(proxy-authorization|authorization|cookie)$/i;
-var isCredentialName = (name) => CREDENTIAL_HEADER.test(name) || CREDENTIAL_WORD.test(name);
-var literal2 = (value) => value !== "" && !READS_SECRET.test(value);
-var literalCredentialHeaders = (header) => Object.entries(header ?? {}).filter(([name, value]) => typeof value === "string" && isCredentialName(name)).filter(([, value]) => literal2(value)).map(([name]) => name).sort();
-var literalCredentialsInUrl = (url) => {
-  if (url === undefined)
-    return [];
-  const out = [];
-  const authority = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i.exec(url)?.[1] ?? "";
-  const at = authority.lastIndexOf("@");
-  if (at >= 0) {
-    const userinfo = authority.slice(0, at);
-    const colon = userinfo.indexOf(":");
-    if (colon >= 0 && literal2(userinfo.slice(colon + 1)))
-      out.push("userinfo");
-  }
-  const params = url.replace(/^[^?#]*/, "");
-  for (const pair of params.split(/[?&#]/)) {
-    const eq = pair.indexOf("=");
-    const name = eq < 0 ? pair : pair.slice(0, eq);
-    if (eq >= 0 && isCredentialName(name) && literal2(pair.slice(eq + 1)))
-      out.push(`?${name}`);
-  }
-  return out;
-};
+// src/proxmox/pbs-notification-target-distilled.ts
+import * as config3 from "@distilled.cloud/proxmox-backup/config";
+import * as Effect61 from "effect/Effect";
 
 // src/proxmox/pbs-notification-target-wire.ts
 import { Buffer as Buffer2 } from "node:buffer";
@@ -4132,6 +4593,106 @@ var targetAttributes = (live, props) => {
   };
 };
 
+// src/proxmox/pbs-notification-target-distilled.ts
+var requestFields2 = (props, form) => ({
+  ...form,
+  from_address: form["from-address"],
+  mailto_user: form["mailto-user"],
+  name: props.name
+});
+var read4 = (props) => {
+  switch (props.type) {
+    case "sendmail":
+      return config3.getConfigNotificationEndpointSendmail({ name: props.name }).pipe(Effect61.map((row) => ({
+        ...row,
+        "from-address": row.from_address,
+        "mailto-user": row.mailto_user
+      })));
+    case "smtp":
+      return config3.getConfigNotificationEndpointSmtp({ name: props.name }).pipe(Effect61.map((row) => ({
+        ...row,
+        "from-address": row.from_address,
+        "mailto-user": row.mailto_user
+      })));
+    case "webhook":
+      return config3.getConfigNotificationEndpointWebhook({ name: props.name }).pipe(Effect61.map((row) => ({ ...row })));
+  }
+};
+var readTarget2 = (props) => runPbs(props.target, "read", read4(props)).pipe(Effect61.map((row) => targetAttributes(row, props)), Effect61.catchTag("NotFound", () => Effect61.succeed(undefined)));
+var validateTargetWrite2 = (props, form, mode) => {
+  const schema = mode === "create" ? {
+    sendmail: config3.CreateConfigNotificationEndpointSendmailRequest,
+    smtp: config3.CreateConfigNotificationEndpointSmtpRequest,
+    webhook: config3.CreateConfigNotificationEndpointWebhookRequest
+  }[props.type] : {
+    sendmail: config3.PutConfigNotificationEndpointSendmailRequest,
+    smtp: config3.PutConfigNotificationEndpointSmtpRequest,
+    webhook: config3.PutConfigNotificationEndpointWebhookRequest
+  }[props.type];
+  return notificationInput(schema, requestFields2(props, form)).pipe(Effect61.asVoid);
+};
+var createTarget2 = (props, form) => {
+  const fields2 = requestFields2(props, form);
+  const operation = props.type === "sendmail" ? notificationInput(config3.CreateConfigNotificationEndpointSendmailRequest, fields2).pipe(Effect61.flatMap(config3.createConfigNotificationEndpointSendmail)) : props.type === "smtp" ? notificationInput(config3.CreateConfigNotificationEndpointSmtpRequest, fields2).pipe(Effect61.flatMap(config3.createConfigNotificationEndpointSmtp)) : notificationInput(config3.CreateConfigNotificationEndpointWebhookRequest, fields2).pipe(Effect61.flatMap(config3.createConfigNotificationEndpointWebhook));
+  return runPbs(props.target, "provision", operation);
+};
+var updateTarget2 = (props, form) => {
+  const fields2 = requestFields2(props, form);
+  const operation = props.type === "sendmail" ? notificationInput(config3.PutConfigNotificationEndpointSendmailRequest, fields2).pipe(Effect61.flatMap(config3.putConfigNotificationEndpointSendmail)) : props.type === "smtp" ? notificationInput(config3.PutConfigNotificationEndpointSmtpRequest, fields2).pipe(Effect61.flatMap(config3.putConfigNotificationEndpointSmtp)) : notificationInput(config3.PutConfigNotificationEndpointWebhookRequest, fields2).pipe(Effect61.flatMap(config3.putConfigNotificationEndpointWebhook));
+  return runPbs(props.target, "provision", operation);
+};
+var deleteTarget2 = (props) => {
+  const request = { name: props.name };
+  const operation = props.type === "sendmail" ? config3.deleteConfigNotificationEndpointSendmail(request) : props.type === "smtp" ? config3.deleteConfigNotificationEndpointSmtp(request) : config3.deleteConfigNotificationEndpointWebhook(request);
+  return runPbs(props.target, "provision", operation).pipe(Effect61.catchTag("NotFound", () => Effect61.void));
+};
+
+// src/proxmox/pbs-notification-target-endpoint.ts
+var ENDPOINTS2 = {
+  sendmail: {
+    create: "pbs:POST /config/notifications/endpoints/sendmail",
+    update: "pbs:PUT /config/notifications/endpoints/sendmail/{name}"
+  },
+  smtp: {
+    create: "pbs:POST /config/notifications/endpoints/smtp",
+    update: "pbs:PUT /config/notifications/endpoints/smtp/{name}"
+  },
+  webhook: {
+    create: "pbs:POST /config/notifications/endpoints/webhook",
+    update: "pbs:PUT /config/notifications/endpoints/webhook/{name}"
+  }
+};
+var pbsTargetEndpoint = (props) => ENDPOINTS2[props.type];
+
+// src/proxmox/credential-literals.ts
+var READS_SECRET = /\{\{[^}]*\bsecrets\./;
+var CREDENTIAL_WORD = /(^|[-_])(api[-_]?key|apikey|key|token|secret|password|passwd|pwd|pass|auth|signature|sig|code)($|[-_])/i;
+var CREDENTIAL_HEADER = /^(proxy-authorization|authorization|cookie)$/i;
+var isCredentialName = (name) => CREDENTIAL_HEADER.test(name) || CREDENTIAL_WORD.test(name);
+var literal2 = (value) => value !== "" && !READS_SECRET.test(value);
+var literalCredentialHeaders = (header) => Object.entries(header ?? {}).filter(([name, value]) => typeof value === "string" && isCredentialName(name)).filter(([, value]) => literal2(value)).map(([name]) => name).sort();
+var literalCredentialsInUrl = (url) => {
+  if (url === undefined)
+    return [];
+  const out = [];
+  const authority = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i.exec(url)?.[1] ?? "";
+  const at = authority.lastIndexOf("@");
+  if (at >= 0) {
+    const userinfo = authority.slice(0, at);
+    const colon = userinfo.indexOf(":");
+    if (colon >= 0 && literal2(userinfo.slice(colon + 1)))
+      out.push("userinfo");
+  }
+  const params = url.replace(/^[^?#]*/, "");
+  for (const pair of params.split(/[?&#]/)) {
+    const eq = pair.indexOf("=");
+    const name = eq < 0 ? pair : pair.slice(0, eq);
+    if (eq >= 0 && isCredentialName(name) && literal2(pair.slice(eq + 1)))
+      out.push(`?${name}`);
+  }
+  return out;
+};
+
 // src/proxmox/pbs-notification-target-form.ts
 var OWNED = {
   author: ["sendmail", "smtp"],
@@ -4272,12 +4833,9 @@ var targetForm = (props, groups, carry, mode) => {
 
 // src/proxmox/pbs-notification-target-lifecycle.ts
 var path = (props) => `config/notifications/endpoints/${props.type}/${props.name}`;
-var readLive2 = (props) => pve(props.target, "read", "GET", path(props)).pipe(Effect51.map((data) => data == null ? undefined : targetAttributes(data, props)), Effect51.orElseSucceed(() => {
-  return;
-}));
 var refuse2 = (props) => {
   const reasons = refusals(props);
-  return reasons.length === 0 ? Effect51.void : Effect51.die(new Error(`${path(props)}: ${reasons.join("; ")}.`));
+  return reasons.length === 0 ? Effect62.void : Effect62.die(new Error(`${path(props)}: ${reasons.join("; ")}.`));
 };
 var toCarry = (live, props, groups, sealed) => {
   const header = headerState(live, props, groups) === "stale";
@@ -4289,39 +4847,48 @@ var requireValues = (props, groups, carry) => {
     ...carry.header ? groups.header.missing : [],
     ...carry.sealed ? groups.sealed.missing : []
   ];
-  return missing.length === 0 ? Effect51.void : Effect51.die(new Error(`${path(props)}: this write must send write-only values, and ${missing.join(", ")} ` + "is unset or empty in the deploying environment. Export it and deploy again."));
+  return missing.length === 0 ? Effect62.void : Effect62.die(new Error(`${path(props)}: this write must send write-only values, and ${missing.join(", ")} ` + "is unset or empty in the deploying environment. Export it and deploy again."));
 };
-var handlers13 = {
-  list: () => Effect51.succeed([]),
-  read: ({ olds, output }) => (output === undefined ? refuse2(olds) : Effect51.void).pipe(Effect51.andThen(readLive2(olds)), Effect51.map((live) => live === undefined ? undefined : { ...live, sealed: output?.sealed ?? "" })),
+var handlers10 = {
+  list: () => Effect62.succeed([]),
+  read: ({ olds, output }) => (output === undefined ? refuse2(olds) : Effect62.void).pipe(Effect62.andThen(readTarget2(olds)), Effect62.map((live) => live === undefined ? undefined : { ...live, sealed: output?.sealed ?? "" })),
   diff: ({
     news,
     olds,
     output
-  }) => Effect51.gen(function* () {
-    if (output === undefined || !isResolved14(news))
+  }) => Effect62.gen(function* () {
+    if (output === undefined || !isResolved19(news))
       return;
+    yield* refuse2(news);
     if (olds !== undefined && (olds.type !== news.type || olds.name !== news.name)) {
+      const destination = yield* readTarget2(news);
+      const groups = resolveGroups(news);
+      const carry = destination === undefined ? { header: true, sealed: true } : toCarry(destination, news, groups, "");
+      if (carry !== undefined) {
+        yield* requireValues(news, groups, carry);
+        const mode = destination === undefined ? "create" : "update";
+        const form = targetForm(news, groups, carry, mode);
+        yield* guardForm(pbsTargetEndpoint(news)[mode], form, destination === undefined);
+        yield* validateTargetWrite2(news, form, mode);
+      }
       return { action: "replace", deleteFirst: olds.name === news.name };
     }
-    yield* refuse2(news);
-    const live = yield* readLive2(news);
+    const live = yield* readTarget2(news);
     if (live === undefined)
       return { action: "update" };
     return toCarry(live, news, resolveGroups(news), output.sealed) === undefined ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: ({ news, output }) => Effect51.gen(function* () {
+  reconcile: ({ news, output }) => Effect62.gen(function* () {
     yield* refuse2(news);
     const groups = resolveGroups(news);
-    const live = yield* readLive2(news);
+    const live = yield* readTarget2(news);
     let sealed = output?.sealed ?? "";
     if (live === undefined) {
       const carry = { header: true, sealed: true };
       yield* requireValues(news, groups, carry);
-      const collection = `config/notifications/endpoints/${news.type}`;
       const form = targetForm(news, groups, carry, "create");
       yield* guardForm(pbsTargetEndpoint(news).create, form, true);
-      yield* pve(news.target, "provision", "POST", collection, form);
+      yield* createTarget2(news, form);
       sealed = seal(groups.sealed.values);
     } else {
       const carry = toCarry(live, news, groups, sealed);
@@ -4329,27 +4896,31 @@ var handlers13 = {
         yield* requireValues(news, groups, carry);
         const form = targetForm(news, groups, carry, "update");
         yield* guardForm(pbsTargetEndpoint(news).update, form, false);
-        yield* pve(news.target, "provision", "PUT", path(news), form);
+        yield* updateTarget2(news, form);
         if (carry.sealed)
           sealed = seal(groups.sealed.values);
       }
     }
-    const after = yield* readLive2(news);
+    const after = yield* readTarget2(news);
     if (after === undefined) {
-      return yield* Effect51.die(new Error(`${path(news)}: the write returned no error but the target is still absent.`));
+      return yield* Effect62.die(new Error(`${path(news)}: the write returned no error but the target is still absent.`));
     }
     return { ...after, sealed };
   }),
-  delete: ({ olds }) => pve(olds.target, "provision", "DELETE", path(olds))
+  delete: ({ olds }) => deleteTarget2(olds)
 };
 
 // src/proxmox/pbs-notification-target.ts
 var PbsNotificationTarget = Resource21("Pbs.NotificationTarget");
-var PbsNotificationTargetProvider = () => Provider21.effect(PbsNotificationTarget, Effect52.succeed(PbsNotificationTarget.Provider.of(handlers13)));
+var PbsNotificationTargetProvider = () => Provider21.effect(PbsNotificationTarget, Effect63.succeed(PbsNotificationTarget.Provider.of(handlers10)));
 // src/proxmox/pbs-prune-job.ts
 import { Resource as Resource22 } from "alchemy";
 import * as Provider22 from "alchemy/Provider";
-import * as Effect53 from "effect/Effect";
+import * as Effect66 from "effect/Effect";
+
+// src/proxmox/pbs-prune-job-lifecycle.ts
+import { isResolved as isResolved20 } from "alchemy/Diff";
+import * as Effect65 from "effect/Effect";
 
 // src/proxmox/pbs-prune-job-form.ts
 var KEEP_KEYS = [
@@ -4404,10 +4975,9 @@ var updateBody2 = (props) => {
   return shape5(props);
 };
 
-// src/proxmox/pbs-prune-job.ts
-var PbsPruneJob = Resource22("Pbs.PruneJob");
+// src/proxmox/pbs-prune-job-spec.ts
 var same6 = (declared2, live) => declared2 === undefined || declared2 === live;
-var handlers14 = pveHandlers({
+var spec = {
   attributes: (live, props) => ({
     comment: text(live["comment"], ""),
     disable: bool(live["disable"], false),
@@ -4424,12 +4994,104 @@ var handlers14 = pveHandlers({
   matches: (attributes2, props) => attributes2.schedule === props.schedule && attributes2.store === props.store && same6(props.ns, attributes2.ns) && same6(props["max-depth"], attributes2["max-depth"]) && same6(props.disable, attributes2.disable) && same6(props.comment, attributes2.comment) && keepsMatch(attributes2, props),
   path: (props) => `config/prune/${props.id}`,
   updateForm: updateBody2
+};
+
+// src/proxmox/pbs-prune-job-wire.ts
+import * as config4 from "@distilled.cloud/proxmox-backup/config";
+import * as Effect64 from "effect/Effect";
+var members2 = (form) => ({
+  ...form["comment"] === undefined ? {} : { comment: form["comment"] },
+  ...form["disable"] === undefined ? {} : { disable: form["disable"] },
+  ...form["keep-daily"] === undefined ? {} : { keep_daily: form["keep-daily"] },
+  ...form["keep-hourly"] === undefined ? {} : { keep_hourly: form["keep-hourly"] },
+  ...form["keep-last"] === undefined ? {} : { keep_last: form["keep-last"] },
+  ...form["keep-monthly"] === undefined ? {} : { keep_monthly: form["keep-monthly"] },
+  ...form["keep-weekly"] === undefined ? {} : { keep_weekly: form["keep-weekly"] },
+  ...form["keep-yearly"] === undefined ? {} : { keep_yearly: form["keep-yearly"] },
+  ...form["max-depth"] === undefined ? {} : { max_depth: form["max-depth"] },
+  ...form["ns"] === undefined ? {} : { ns: form["ns"] },
+  ...form["schedule"] === undefined ? {} : { schedule: form["schedule"] },
+  ...form["store"] === undefined ? {} : { store: form["store"] }
+});
+var createRequest2 = (props) => ({
+  ...members2(createBody3(props)),
+  id: props.id,
+  store: props.store,
+  schedule: props.schedule
+});
+var updateRequest2 = (props) => ({
+  ...members2(updateBody2(props)),
+  id: props.id
+});
+var wire2 = (row) => ({
+  ...row,
+  "keep-daily": row.keep_daily,
+  "keep-hourly": row.keep_hourly,
+  "keep-last": row.keep_last,
+  "keep-monthly": row.keep_monthly,
+  "keep-weekly": row.keep_weekly,
+  "keep-yearly": row.keep_yearly,
+  "max-depth": row.max_depth
+});
+var readOne2 = (props) => runPbs(props.target, "read", config4.getConfigPrune({ id: props.id })).pipe(Effect64.map((row) => spec.attributes(wire2(row), props)), Effect64.catchTag("PruneJobNotFound", () => Effect64.succeed(undefined)));
+var createOne2 = (props) => runPbs(props.target, "provision", config4.createConfigPrune(createRequest2(props)));
+var updateOne2 = (props) => runPbs(props.target, "provision", config4.putConfigPrune(updateRequest2(props)));
+var deleteOne2 = (props) => Effect64.gen(function* () {
+  if ((yield* readOne2(props)) === undefined)
+    return;
+  return yield* runPbs(props.target, "provision", config4.deleteConfigPrune({ id: props.id }));
 });
-var PbsPruneJobProvider = () => Provider22.effect(PbsPruneJob, Effect53.succeed(PbsPruneJob.Provider.of(handlers14)));
+
+// src/proxmox/pbs-prune-job-lifecycle.ts
+var { guardCreate: guardCreate5, guardUpdate: guardUpdate5 } = specGuards(spec);
+var handlers11 = {
+  list: () => Effect65.succeed([]),
+  read: ({ olds }) => readOne2(olds),
+  diff: ({
+    news,
+    output
+  }) => Effect65.gen(function* () {
+    if (!isResolved20(news))
+      return;
+    yield* guardCreate5(news, output === undefined);
+    yield* guardUpdate5(news);
+    if (output === undefined)
+      return;
+    const live = yield* readOne2(news);
+    if (live === undefined) {
+      yield* guardCreate5(news, true);
+      return { action: "update" };
+    }
+    return { action: spec.matches(live, news) ? "noop" : "update" };
+  }),
+  reconcile: ({ news }) => Effect65.gen(function* () {
+    const live = yield* readOne2(news);
+    yield* guardCreate5(news, live === undefined);
+    yield* guardUpdate5(news);
+    if (live === undefined)
+      yield* createOne2(news);
+    else if (!spec.matches(live, news))
+      yield* updateOne2(news);
+    const after = yield* readOne2(news);
+    if (after === undefined) {
+      return yield* Effect65.fail(new Error(`${spec.path(news)}: write succeeded but job is absent.`));
+    }
+    return after;
+  }),
+  delete: ({ olds }) => deleteOne2(olds)
+};
+
+// src/proxmox/pbs-prune-job.ts
+var PbsPruneJob = Resource22("Pbs.PruneJob");
+var PbsPruneJobProvider = () => Provider22.effect(PbsPruneJob, Effect66.succeed(PbsPruneJob.Provider.of(handlers11)));
 // src/proxmox/pbs-sync-job.ts
 import { Resource as Resource23 } from "alchemy";
 import * as Provider23 from "alchemy/Provider";
-import * as Effect54 from "effect/Effect";
+import * as Effect69 from "effect/Effect";
+
+// src/proxmox/pbs-sync-job-lifecycle.ts
+import { isResolved as isResolved21 } from "alchemy/Diff";
+import * as Effect68 from "effect/Effect";
 
 // src/proxmox/pbs-sync-job-form.ts
 var UNSET4 = -1;
@@ -4477,7 +5139,7 @@ var createBody4 = (props) => ({
   ...props["sync-direction"] === undefined ? {} : { "sync-direction": props["sync-direction"] }
 });
 var updateBody3 = (props) => shape6(props);
-var handlers15 = pveHandlers({
+var spec2 = {
   attributes: (live, props) => ({
     comment: text(live["comment"], ""),
     "group-filter": filters(live["group-filter"]),
@@ -4502,15 +5164,105 @@ var handlers15 = pveHandlers({
   matches: (attributes2, props) => attributes2["remove-vanished"] === (props["remove-vanished"] === true) && attributes2.store === props.store && attributes2["remote-store"] === props["remote-store"] && (props.remote === undefined || attributes2.remote === props.remote) && (props.ns === undefined || attributes2.ns === props.ns) && (props["remote-ns"] === undefined || attributes2["remote-ns"] === props["remote-ns"]) && (props.schedule === undefined || attributes2.schedule === props.schedule) && (props.comment === undefined || attributes2.comment === props.comment) && (props.owner === undefined || attributes2.owner === props.owner) && (props["verified-only"] === undefined || attributes2["verified-only"] === props["verified-only"]) && (props["rate-in"] === undefined || attributes2["rate-in"] === props["rate-in"]) && (props["max-depth"] === undefined || attributes2["max-depth"] === props["max-depth"]) && (props["transfer-last"] === undefined || attributes2["transfer-last"] === props["transfer-last"]),
   path: (props) => `config/sync/${props.id}`,
   updateForm: updateBody3
+};
+
+// src/proxmox/pbs-sync-job-wire.ts
+import * as config5 from "@distilled.cloud/proxmox-backup/config";
+import * as Effect67 from "effect/Effect";
+var members3 = (form) => ({
+  ...form["remote-store"] === undefined ? {} : { remote_store: form["remote-store"] },
+  ...form["remove-vanished"] === undefined ? {} : { remove_vanished: form["remove-vanished"] },
+  ...form["store"] === undefined ? {} : { store: form["store"] },
+  ...form["comment"] === undefined ? {} : { comment: form["comment"] },
+  ...form["max-depth"] === undefined ? {} : { max_depth: form["max-depth"] },
+  ...form["ns"] === undefined ? {} : { ns: form["ns"] },
+  ...form["owner"] === undefined ? {} : { owner: form["owner"] },
+  ...form["rate-in"] === undefined ? {} : { rate_in: form["rate-in"] },
+  ...form["remote"] === undefined ? {} : { remote: form["remote"] },
+  ...form["remote-ns"] === undefined ? {} : { remote_ns: form["remote-ns"] },
+  ...form["schedule"] === undefined ? {} : { schedule: form["schedule"] },
+  ...form["verified-only"] === undefined ? {} : { verified_only: form["verified-only"] },
+  ...form["transfer-last"] === undefined ? {} : { transfer_last: form["transfer-last"] },
+  ...form["sync-direction"] === undefined ? {} : { sync_direction: form["sync-direction"] }
+});
+var createRequest3 = (props) => ({
+  ...members3(createBody4(props)),
+  id: props.id,
+  store: props.store,
+  remote_store: props["remote-store"]
+});
+var updateRequest3 = (props) => ({
+  ...members3(updateBody3(props)),
+  id: props.id
+});
+var wire3 = (row) => ({
+  ...row,
+  "remote-store": row.remote_store,
+  "remove-vanished": row.remove_vanished,
+  "max-depth": row.max_depth,
+  "rate-in": row.rate_in,
+  "remote-ns": row.remote_ns,
+  "verified-only": row.verified_only,
+  "transfer-last": row.transfer_last,
+  "sync-direction": row.sync_direction,
+  "group-filter": row.group_filter
+});
+var readOne3 = (props) => runPbs(props.target, "read", config5.getConfigSync({ id: props.id })).pipe(Effect67.map((row) => spec2.attributes(wire3(row), props)), Effect67.catchTag("SyncJobNotFound", () => Effect67.succeed(undefined)));
+var createOne3 = (props) => runPbs(props.target, "provision", config5.syncConfig(createRequest3(props)));
+var updateOne3 = (props) => runPbs(props.target, "provision", config5.putConfigSync(updateRequest3(props)));
+var deleteOne3 = (props) => Effect67.gen(function* () {
+  if ((yield* readOne3(props)) === undefined)
+    return;
+  return yield* runPbs(props.target, "provision", config5.deleteConfigSync({ id: props.id }));
 });
 
+// src/proxmox/pbs-sync-job-lifecycle.ts
+var { guardCreate: guardCreate6, guardUpdate: guardUpdate6 } = specGuards(spec2);
+var handlers12 = {
+  list: () => Effect68.succeed([]),
+  read: ({ olds }) => readOne3(olds),
+  diff: ({ news, output }) => Effect68.gen(function* () {
+    if (!isResolved21(news))
+      return;
+    yield* guardCreate6(news, output === undefined);
+    yield* guardUpdate6(news);
+    if (output === undefined)
+      return;
+    const live = yield* readOne3(news);
+    if (live === undefined) {
+      yield* guardCreate6(news, true);
+      return { action: "update" };
+    }
+    return { action: spec2.matches(live, news) ? "noop" : "update" };
+  }),
+  reconcile: ({ news }) => Effect68.gen(function* () {
+    const live = yield* readOne3(news);
+    yield* guardCreate6(news, live === undefined);
+    yield* guardUpdate6(news);
+    if (live === undefined)
+      yield* createOne3(news);
+    else if (!spec2.matches(live, news))
+      yield* updateOne3(news);
+    const after = yield* readOne3(news);
+    if (after === undefined) {
+      return yield* Effect68.fail(new Error(`${spec2.path(news)}: write succeeded but job is absent.`));
+    }
+    return after;
+  }),
+  delete: ({ olds }) => deleteOne3(olds)
+};
+
 // src/proxmox/pbs-sync-job.ts
 var PbsSyncJob = Resource23("Pbs.SyncJob");
-var PbsSyncJobProvider = () => Provider23.effect(PbsSyncJob, Effect54.succeed(PbsSyncJob.Provider.of(handlers15)));
+var PbsSyncJobProvider = () => Provider23.effect(PbsSyncJob, Effect69.succeed(PbsSyncJob.Provider.of(handlers12)));
 // src/proxmox/pbs-verify-job.ts
 import { Resource as Resource24 } from "alchemy";
 import * as Provider24 from "alchemy/Provider";
-import * as Effect55 from "effect/Effect";
+import * as Effect72 from "effect/Effect";
+
+// src/proxmox/pbs-verify-job-lifecycle.ts
+import { isResolved as isResolved22 } from "alchemy/Diff";
+import * as Effect71 from "effect/Effect";
 
 // src/proxmox/pbs-verify-job-form.ts
 var rechecks = (ignoreVerified, outdatedAfter) => {
@@ -4530,9 +5282,8 @@ var shape7 = (props) => ({
   ...props["outdated-after"] === undefined ? {} : { "outdated-after": String(props["outdated-after"]) }
 });
 
-// src/proxmox/pbs-verify-job.ts
-var PbsVerifyJob = Resource24("Pbs.VerifyJob");
-var handlers16 = pveHandlers({
+// src/proxmox/pbs-verify-job-spec.ts
+var spec3 = {
   attributes: (live, props) => {
     const ignoreVerified = bool(live["ignore-verified"], true);
     const outdatedAfter = int(live["outdated-after"], -1);
@@ -4554,12 +5305,94 @@ var handlers16 = pveHandlers({
   matches: (attributes2, props) => attributes2.store === props.store && attributes2.schedule === (props.schedule ?? "") && attributes2["ignore-verified"] === (props["ignore-verified"] !== false) && (props["outdated-after"] === undefined || attributes2["outdated-after"] === props["outdated-after"]) && (props["max-depth"] === undefined || attributes2["max-depth"] === props["max-depth"]) && (props.ns === undefined || attributes2.ns === props.ns) && (props.comment === undefined || attributes2.comment === props.comment),
   path: (props) => `config/verify/${props.id}`,
   updateForm: shape7
+};
+
+// src/proxmox/pbs-verify-job-wire.ts
+import * as config6 from "@distilled.cloud/proxmox-backup/config";
+import * as Effect70 from "effect/Effect";
+var members4 = (form) => ({
+  ...form["ignore-verified"] === undefined ? {} : { ignore_verified: form["ignore-verified"] },
+  ...form["store"] === undefined ? {} : { store: form["store"] },
+  ...form["schedule"] === undefined ? {} : { schedule: form["schedule"] },
+  ...form["comment"] === undefined ? {} : { comment: form["comment"] },
+  ...form["max-depth"] === undefined ? {} : { max_depth: form["max-depth"] },
+  ...form["ns"] === undefined ? {} : { ns: form["ns"] },
+  ...form["outdated-after"] === undefined ? {} : { outdated_after: form["outdated-after"] }
+});
+var createRequest4 = (props) => ({
+  ...members4({ ...shape7(props), id: props.id }),
+  id: props.id,
+  store: props.store
+});
+var updateRequest4 = (props) => ({
+  ...members4(shape7(props)),
+  id: props.id
+});
+var wire4 = (row) => ({
+  ...row,
+  "ignore-verified": row.ignore_verified,
+  "max-depth": row.max_depth,
+  "outdated-after": row.outdated_after
+});
+var readOne4 = (props) => runPbs(props.target, "read", config6.getConfigVerify({ id: props.id })).pipe(Effect70.map((row) => spec3.attributes(wire4(row), props)), Effect70.catchTag("VerifyJobNotFound", () => Effect70.succeed(undefined)));
+var createOne4 = (props) => runPbs(props.target, "provision", config6.verifyConfig(createRequest4(props)));
+var updateOne4 = (props) => runPbs(props.target, "provision", config6.putConfigVerify(updateRequest4(props)));
+var deleteOne4 = (props) => Effect70.gen(function* () {
+  if ((yield* readOne4(props)) === undefined)
+    return;
+  return yield* runPbs(props.target, "provision", config6.deleteConfigVerify({ id: props.id }));
 });
-var PbsVerifyJobProvider = () => Provider24.effect(PbsVerifyJob, Effect55.succeed(PbsVerifyJob.Provider.of(handlers16)));
+
+// src/proxmox/pbs-verify-job-lifecycle.ts
+var { guardCreate: guardCreate7, guardUpdate: guardUpdate7 } = specGuards(spec3);
+var handlers13 = {
+  list: () => Effect71.succeed([]),
+  read: ({ olds }) => readOne4(olds),
+  diff: ({
+    news,
+    output
+  }) => Effect71.gen(function* () {
+    if (!isResolved22(news))
+      return;
+    yield* guardCreate7(news, output === undefined);
+    yield* guardUpdate7(news);
+    if (output === undefined)
+      return;
+    const live = yield* readOne4(news);
+    if (live === undefined) {
+      yield* guardCreate7(news, true);
+      return { action: "update" };
+    }
+    return { action: spec3.matches(live, news) ? "noop" : "update" };
+  }),
+  reconcile: ({ news }) => Effect71.gen(function* () {
+    const live = yield* readOne4(news);
+    yield* guardCreate7(news, live === undefined);
+    yield* guardUpdate7(news);
+    if (live === undefined)
+      yield* createOne4(news);
+    else if (!spec3.matches(live, news))
+      yield* updateOne4(news);
+    const after = yield* readOne4(news);
+    if (after === undefined) {
+      return yield* Effect71.fail(new Error(`${spec3.path(news)}: write succeeded but job is absent.`));
+    }
+    return after;
+  }),
+  delete: ({ olds }) => deleteOne4(olds)
+};
+
+// src/proxmox/pbs-verify-job.ts
+var PbsVerifyJob = Resource24("Pbs.VerifyJob");
+var PbsVerifyJobProvider = () => Provider24.effect(PbsVerifyJob, Effect72.succeed(PbsVerifyJob.Provider.of(handlers13)));
 // src/proxmox/pool.ts
 import { Resource as Resource25 } from "alchemy";
+import { isResolved as isResolved23 } from "alchemy/Diff";
 import * as Provider25 from "alchemy/Provider";
-import * as Effect56 from "effect/Effect";
+import * as pools from "@distilled.cloud/proxmox/pools";
+import { ProxmoxParseError as ProxmoxParseError4 } from "@distilled.cloud/proxmox/Errors";
+import * as Schema5 from "effect/Schema";
+import * as Effect73 from "effect/Effect";
 var ProxmoxPool = Resource25("Proxmox.Pool");
 var poolCreateForm = (props) => ({
   comment: props.comment ?? "",
@@ -4568,7 +5401,7 @@ var poolCreateForm = (props) => ({
 var poolUpdateForm = (props) => ({
   comment: props.comment ?? ""
 });
-var handlers17 = pveHandlers({
+var spec4 = {
   attributes: (live, props) => {
     const row = live;
     return {
@@ -4583,8 +5416,51 @@ var handlers17 = pveHandlers({
   matches: (attributes2, props) => attributes2.comment === (props.comment ?? ""),
   path: (props) => `pools/${props.poolid}`,
   updateForm: poolUpdateForm
-});
-var ProxmoxPoolProvider = () => Provider25.effect(ProxmoxPool, Effect56.succeed(ProxmoxPool.Provider.of(handlers17)));
+};
+var { guardCreate: guardCreate8, guardUpdate: guardUpdate8 } = specGuards(spec4);
+var readPool = (props) => runPve(props.target, "read", false, pools.getPool({ poolid: props.poolid })).pipe(Effect73.flatMap((live) => Schema5.decodeUnknownEffect(Schema5.toType(pools.GetPoolResponse))(live).pipe(Effect73.mapError(() => new ProxmoxParseError4({
+  body: undefined,
+  cause: "Pool response does not match its vendor schema"
+})), Effect73.as(live))), Effect73.map((live) => spec4.attributes({ ...live }, props)), Effect73.catchTag("PoolNotFound", () => Effect73.succeed(undefined)), Effect73.catchTag("NotFound", () => Effect73.succeed(undefined)));
+var deletePool2 = (props) => runPve(props.target, "provision", true, pools.deletePool({ poolid: props.poolid })).pipe(Effect73.catchTag("PoolNotFound", () => Effect73.void), Effect73.catchTag("NotFound", () => Effect73.void));
+var ProxmoxPoolProvider = () => Provider25.effect(ProxmoxPool, Effect73.succeed(ProxmoxPool.Provider.of({
+  list: () => Effect73.succeed([]),
+  read: ({ olds }) => readPool(olds),
+  diff: Effect73.fn(function* ({ news, output }) {
+    if (!isResolved23(news))
+      return;
+    yield* guardCreate8(news, output === undefined);
+    yield* guardUpdate8(news);
+    if (output === undefined)
+      return;
+    const live = yield* readPool(news);
+    if (live === undefined) {
+      yield* guardCreate8(news, true);
+      return { action: "update" };
+    }
+    return { action: spec4.matches(live, news) ? "noop" : "update" };
+  }),
+  reconcile: Effect73.fn(function* ({ news }) {
+    const live = yield* readPool(news);
+    yield* guardCreate8(news, live === undefined);
+    yield* guardUpdate8(news);
+    if (live === undefined) {
+      yield* runPve(news.target, "provision", true, pools.createPool(poolCreateForm(news)));
+    } else {
+      const form = formToSend(spec4.matches, live, news, poolUpdateForm(news));
+      if (form !== undefined)
+        yield* runPve(news.target, "provision", true, pools.putPool({
+          ...form,
+          poolid: news.poolid
+        }));
+    }
+    const after = yield* readPool(news);
+    if (after === undefined)
+      return yield* Effect73.fail(new Error(`pools/${news.poolid}: write returned success but the pool is still absent`));
+    return after;
+  }),
+  delete: ({ olds }) => deletePool2(olds)
+})));
 // src/proxmox/provision-baseline.ts
 var PROVISION_PRIVILEGES = Object.freeze([
   "Datastore.Allocate",
@@ -4736,15 +5612,15 @@ fi
 var userStep = (user) => {
   const groups = [...user.groups].sort().join(",");
   const want = `groups=${groups};enable=1;expire=0;email=;firstname=;lastname=;comment=${user.comment}`;
-  const fields = `--groups ${groups} --comment '${user.comment}'`;
+  const fields2 = `--groups ${groups} --comment '${user.comment}'`;
   return `
 # User ${user.userid} (the ${user.lane} lane): in ${groups}, enabled, no password.
 if have=$(get /access/users/${user.userid} '${USER_STATE}'); then
   if [ "$have" = '${want}' ]; then echo 'user ${user.userid}: ok'
   else echo 'user ${user.userid}: setting groups, comment and account fields'
-    pveum user modify ${user.userid} ${fields} --enable 1 --expire 0 --email '' --firstname '' --lastname ''; fi
+    pveum user modify ${user.userid} ${fields2} --enable 1 --expire 0 --email '' --firstname '' --lastname ''; fi
 else
-  echo 'user ${user.userid}: adding'; pveum user add ${user.userid} ${fields}
+  echo 'user ${user.userid}: adding'; pveum user add ${user.userid} ${fields2}
 fi
 `;
 };
@@ -4777,14 +5653,14 @@ echo 'provision baseline: done. Next: point the OpenBao proxmox mount at these u
 // src/proxmox/provision-declare.ts
 import { adopt } from "alchemy/AdoptPolicy";
 import * as RemovalPolicy from "alchemy/RemovalPolicy";
-import * as Effect60 from "effect/Effect";
+import * as Effect77 from "effect/Effect";
 
 // src/proxmox/role.ts
 import { Resource as Resource26 } from "alchemy";
-import { isResolved as isResolved15 } from "alchemy/Diff";
+import { isResolved as isResolved24 } from "alchemy/Diff";
 import * as Provider26 from "alchemy/Provider";
 import * as access5 from "@distilled.cloud/proxmox/access";
-import * as Effect57 from "effect/Effect";
+import * as Effect74 from "effect/Effect";
 
 // src/proxmox/role-wire.ts
 var ROLE_CREATE = "pve:POST /access/roles";
@@ -4807,20 +5683,20 @@ var matches7 = (attributes2, props) => canonical2(attributes2.privs).join(",") =
 
 // src/proxmox/role.ts
 var ProxmoxRole = Resource26("Proxmox.Role");
-var readRole = (props) => readOrUnreadable(runPve(props.target, "read", false, access5.listAccessRoles({}))).pipe(Effect57.map((rows) => {
+var readRole = (props) => readOrUnreadable(runPve(props.target, "read", false, access5.listAccessRoles({}))).pipe(Effect74.map((rows) => {
   if (rows === UNREADABLE)
     return UNREADABLE;
   const row = find2(rows, props.roleid);
   return row === undefined ? undefined : attributesOf7(row, props);
 }));
 var dropUnreadable5 = (live) => live === UNREADABLE ? undefined : live;
-var ProxmoxRoleProvider = () => Provider26.effect(ProxmoxRole, Effect57.succeed(ProxmoxRole.Provider.of({
-  list: () => Effect57.succeed([]),
-  read: Effect57.fn(function* ({ olds }) {
+var ProxmoxRoleProvider = () => Provider26.effect(ProxmoxRole, Effect74.succeed(ProxmoxRole.Provider.of({
+  list: () => Effect74.succeed([]),
+  read: Effect74.fn(function* ({ olds }) {
     return dropUnreadable5(yield* readRole(olds));
   }),
-  diff: Effect57.fn(function* ({ news, output }) {
-    if (!isResolved15(news))
+  diff: Effect74.fn(function* ({ news, output }) {
+    if (!isResolved24(news))
       return;
     yield* guardWrite2(ROLE_CREATE, createForm7(news), output === undefined);
     yield* guardWrite2(ROLE_UPDATE, updateForm4(news), false);
@@ -4837,7 +5713,7 @@ var ProxmoxRoleProvider = () => Provider26.effect(ProxmoxRole, Effect57.succeed(
     }
     return matches7(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect57.fn(function* ({ news }) {
+  reconcile: Effect74.fn(function* ({ news }) {
     const before = dropUnreadable5(yield* readRole(news));
     yield* guardWrite2(ROLE_CREATE, createForm7(news), before === undefined);
     yield* guardWrite2(ROLE_UPDATE, updateForm4(news), false);
@@ -4848,25 +5724,25 @@ var ProxmoxRoleProvider = () => Provider26.effect(ProxmoxRole, Effect57.succeed(
     }
     const after = dropUnreadable5(yield* readRole(news));
     if (after === undefined) {
-      return yield* Effect57.die(new Error(`access/roles/${news.roleid}: the write returned no error but the role is ` + 'still absent. PVE wraps every answer in {"data":...} and can report success ' + "on a call that did nothing -- read back rather than trusting the status code."));
+      return yield* Effect74.die(new Error(`access/roles/${news.roleid}: the write returned no error but the role is ` + 'still absent. PVE wraps every answer in {"data":...} and can report success ' + "on a call that did nothing -- read back rather than trusting the status code."));
     }
     return after;
   }),
-  delete: Effect57.fn(function* ({ olds }) {
+  delete: Effect74.fn(function* ({ olds }) {
     yield* runPve(olds.target, "provision", true, access5.deleteAccessRole({ roleid: olds.roleid }));
   })
 })));
 
 // src/proxmox/user.ts
 import { Resource as Resource27 } from "alchemy";
-import { isResolved as isResolved16 } from "alchemy/Diff";
+import { isResolved as isResolved25 } from "alchemy/Diff";
 import * as Provider27 from "alchemy/Provider";
 import * as access7 from "@distilled.cloud/proxmox/access";
-import * as Effect59 from "effect/Effect";
+import * as Effect76 from "effect/Effect";
 
 // src/proxmox/user-wire.ts
 import * as access6 from "@distilled.cloud/proxmox/access";
-import * as Effect58 from "effect/Effect";
+import * as Effect75 from "effect/Effect";
 var USER_CREATE = "pve:POST /access/users";
 var USER_UPDATE = "pve:PUT /access/users/{userid}";
 var int2 = (value) => {
@@ -4908,19 +5784,19 @@ var attributesOf8 = (live, props) => ({
   userid: props.userid
 });
 var matches8 = (attributes2, props) => attributes2.comment === (props.comment ?? "") && attributes2.email === (props.email ?? "") && attributes2.enable === (props.enable !== false) && attributes2.expire === (props.expire ?? 0) && attributes2.firstname === (props.firstname ?? "") && attributes2.lastname === (props.lastname ?? "") && attributes2.groups.join(",") === groupSet(props.groups).join(",");
-var readUserOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, access6.getAccessUser({ userid: props.userid }))).pipe(Effect58.map((live) => live === UNREADABLE ? UNREADABLE : attributesOf8(live, props)));
-var readUser = (props) => readUserOrFail(props).pipe(Effect58.catchTag("UserNotFound", () => Effect58.succeed(undefined)));
+var readUserOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, access6.getAccessUser({ userid: props.userid }))).pipe(Effect75.map((live) => live === UNREADABLE ? UNREADABLE : attributesOf8(live, props)));
+var readUser = (props) => readUserOrFail(props).pipe(Effect75.catchTag("UserNotFound", () => Effect75.succeed(undefined)));
 var dropUnreadable6 = (live) => live === UNREADABLE ? undefined : live;
 
 // src/proxmox/user.ts
 var ProxmoxUser = Resource27("Proxmox.User");
-var ProxmoxUserProvider = () => Provider27.effect(ProxmoxUser, Effect59.succeed(ProxmoxUser.Provider.of({
-  list: () => Effect59.succeed([]),
-  read: Effect59.fn(function* ({ olds, output }) {
+var ProxmoxUserProvider = () => Provider27.effect(ProxmoxUser, Effect76.succeed(ProxmoxUser.Provider.of({
+  list: () => Effect76.succeed([]),
+  read: Effect76.fn(function* ({ olds, output }) {
     return dropUnreadable6(yield* output === undefined ? readUser(olds) : readUserOrFail(olds));
   }),
-  diff: Effect59.fn(function* ({ news, output }) {
-    if (!isResolved16(news))
+  diff: Effect76.fn(function* ({ news, output }) {
+    if (!isResolved25(news))
       return;
     yield* guardWrite2(USER_CREATE, createForm8(news), output === undefined);
     yield* guardWrite2(USER_UPDATE, updateForm5(news), false);
@@ -4937,7 +5813,7 @@ var ProxmoxUserProvider = () => Provider27.effect(ProxmoxUser, Effect59.succeed(
     }
     return matches8(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect59.fn(function* ({ news }) {
+  reconcile: Effect76.fn(function* ({ news }) {
     const before = dropUnreadable6(yield* readUser(news));
     yield* guardWrite2(USER_CREATE, createForm8(news), before === undefined);
     yield* guardWrite2(USER_UPDATE, updateForm5(news), false);
@@ -4948,18 +5824,18 @@ var ProxmoxUserProvider = () => Provider27.effect(ProxmoxUser, Effect59.succeed(
     }
     const after = dropUnreadable6(yield* readUser(news));
     if (after === undefined) {
-      return yield* Effect59.die(new Error(`access/users/${news.userid}: the write returned no error but the account is ` + 'still absent. PVE wraps every answer in {"data":...} and can report success ' + "on a call that did nothing -- read back rather than trusting the status code."));
+      return yield* Effect76.die(new Error(`access/users/${news.userid}: the write returned no error but the account is ` + 'still absent. PVE wraps every answer in {"data":...} and can report success ' + "on a call that did nothing -- read back rather than trusting the status code."));
     }
     return after;
   }),
-  delete: Effect59.fn(function* ({ olds }) {
+  delete: Effect76.fn(function* ({ olds }) {
     yield* runPve(olds.target, "provision", true, access7.deleteAccessUser({ userid: olds.userid }));
   })
 })));
 
 // src/proxmox/provision-declare.ts
-var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect60.gen(function* () {
-  const baseline = yield* Effect60.try({
+var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect77.gen(function* () {
+  const baseline = yield* Effect77.try({
     catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
     try: () => provisionBaseline(names2)
   });
@@ -4973,13 +5849,13 @@ var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect
     target
   }));
   const group = yield* owned(ProxmoxGroup(`${id}-mint-group`, { ...baseline.group, target }));
-  const users = yield* Effect60.all(baseline.users.map((user) => owned(ProxmoxUser(`${id}-${user.lane}-user`, {
+  const users = yield* Effect77.all(baseline.users.map((user) => owned(ProxmoxUser(`${id}-${user.lane}-user`, {
     comment: user.comment,
     groups: [...user.groups],
     target,
     userid: user.userid
   }))));
-  const grants = yield* Effect60.all(baseline.grants.map((grant) => owned(ProxmoxAcl(`${id}-${grant.lane}-grant`, {
+  const grants = yield* Effect77.all(baseline.grants.map((grant) => owned(ProxmoxAcl(`${id}-${grant.lane}-grant`, {
     path: "/",
     propagate: true,
     roleid: grant.roleid,
@@ -4992,7 +5868,7 @@ var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect
 // src/proxmox/qemu.ts
 import { Resource as Resource28 } from "alchemy";
 import * as Provider28 from "alchemy/Provider";
-import * as Effect61 from "effect/Effect";
+import * as Effect78 from "effect/Effect";
 var ProxmoxVm = Resource28("Proxmox.Vm");
 var createForm9 = (props) => ({ ...shape9(props), vmid: String(props.vmid) });
 var shape9 = (props) => ({
@@ -5003,7 +5879,7 @@ var shape9 = (props) => ({
   sockets: String(props.sockets ?? 1),
   ...props.net0 === undefined ? {} : { net0: props.net0 }
 });
-var handlers18 = pveHandlers({
+var handlers14 = pveHandlers({
   attributes: (live, props) => ({
     cores: num(live["cores"], 1),
     memory: num(live["memory"], 512),
@@ -5023,11 +5899,11 @@ var handlers18 = pveHandlers({
   path: (props) => `nodes/${props.node}/qemu/${String(props.vmid)}/config`,
   updateForm: shape9
 });
-var ProxmoxVmProvider = () => Provider28.effect(ProxmoxVm, Effect61.succeed(ProxmoxVm.Provider.of(handlers18)));
+var ProxmoxVmProvider = () => Provider28.effect(ProxmoxVm, Effect78.succeed(ProxmoxVm.Provider.of(handlers14)));
 // src/proxmox/replication-job.ts
 import { Resource as Resource29 } from "alchemy";
 import * as Provider29 from "alchemy/Provider";
-import * as Effect62 from "effect/Effect";
+import * as Effect79 from "effect/Effect";
 
 // src/proxmox/replication-job-form.ts
 var DEFAULT_SCHEDULE = "*/15";
@@ -5057,7 +5933,7 @@ var rateOf = (value) => {
   const parsed = Number.parseFloat(text(value));
   return Number.isFinite(parsed) ? parsed : 0;
 };
-var handlers19 = pveHandlers({
+var handlers15 = pveHandlers({
   attributes: (live, props) => ({
     comment: text(live["comment"], ""),
     disable: bool(live["disable"], false),
@@ -5081,15 +5957,15 @@ var handlers19 = pveHandlers({
   path: (props) => `cluster/replication/${jobId(props)}`,
   updateForm: updateBody4
 });
-var ProxmoxReplicationJobProvider = () => Provider29.effect(ProxmoxReplicationJob, Effect62.succeed(ProxmoxReplicationJob.Provider.of(handlers19)));
+var ProxmoxReplicationJobProvider = () => Provider29.effect(ProxmoxReplicationJob, Effect79.succeed(ProxmoxReplicationJob.Provider.of(handlers15)));
 // src/proxmox/sdn-apply.ts
 import { Resource as Resource30 } from "alchemy";
-import { isResolved as isResolved17 } from "alchemy/Diff";
+import { isResolved as isResolved26 } from "alchemy/Diff";
 import * as Provider30 from "alchemy/Provider";
-import * as Effect64 from "effect/Effect";
+import * as Effect81 from "effect/Effect";
 
 // src/proxmox/sdn-apply-read.ts
-import * as Effect63 from "effect/Effect";
+import * as Effect80 from "effect/Effect";
 var MARKED = [
   "cluster/sdn/zones",
   "cluster/sdn/vnets",
@@ -5098,7 +5974,7 @@ var MARKED = [
   "cluster/sdn/route-maps"
 ];
 var subsystemAbsent = (error) => error instanceof PveError && error.status === 501;
-var markedPending = (target) => Effect63.all(MARKED.map((collection) => pve(target, "read", "GET", `${collection}?pending=1`).pipe(Effect63.map((rows) => (rows ?? []).filter((row) => row.state !== undefined).length), Effect63.catchIf(subsystemAbsent, () => Effect63.succeed(0)))), { concurrency: "unbounded" }).pipe(Effect63.map((counts) => counts.reduce((total, count2) => total + count2, 0)));
+var markedPending = (target) => Effect80.all(MARKED.map((collection) => pve(target, "read", "GET", `${collection}?pending=1`).pipe(Effect80.map((rows) => (rows ?? []).filter((row) => row.state !== undefined).length), Effect80.catchIf(subsystemAbsent, () => Effect80.succeed(0)))), { concurrency: "unbounded" }).pipe(Effect80.map((counts) => counts.reduce((total, count2) => total + count2, 0)));
 var fabricStaged = (staged, running) => {
   if (staged === undefined && running === undefined)
     return 0;
@@ -5106,9 +5982,9 @@ var fabricStaged = (staged, running) => {
     return "inconsistent";
   return staged === running ? 0 : 1;
 };
-var fabricPending = (target) => Effect63.all(["pending", "running"].map((view) => pve(target, "read", "GET", `cluster/sdn/fabrics/all?${view}=1`).pipe(Effect63.map(canonical3), Effect63.catchIf(subsystemAbsent, () => Effect63.succeed(undefined)))), { concurrency: "unbounded" }).pipe(Effect63.flatMap(([staged, running]) => {
+var fabricPending = (target) => Effect80.all(["pending", "running"].map((view) => pve(target, "read", "GET", `cluster/sdn/fabrics/all?${view}=1`).pipe(Effect80.map(canonical3), Effect80.catchIf(subsystemAbsent, () => Effect80.succeed(undefined)))), { concurrency: "unbounded" }).pipe(Effect80.flatMap(([staged, running]) => {
   const verdict = fabricStaged(staged, running);
-  return verdict === "inconsistent" ? Effect63.die(new Error("cluster/sdn/fabrics/all answered 501 for one of ?pending=1 and ?running=1 and not " + "the other. Refusing to read that as a staged fabric change.")) : Effect63.succeed(verdict);
+  return verdict === "inconsistent" ? Effect80.die(new Error("cluster/sdn/fabrics/all answered 501 for one of ?pending=1 and ?running=1 and not " + "the other. Refusing to read that as a staged fabric change.")) : Effect80.succeed(verdict);
 }));
 var canonical3 = (value) => JSON.stringify(sortDeep(value));
 var sortDeep = (value) => {
@@ -5121,40 +5997,40 @@ var sortDeep = (value) => {
   }
   return value;
 };
-var sdnPendingCount = (target) => Effect63.all([markedPending(target), fabricPending(target)], { concurrency: "unbounded" }).pipe(Effect63.map(([marked, fabric]) => marked + fabric));
+var sdnPendingCount = (target) => Effect80.all([markedPending(target), fabricPending(target)], { concurrency: "unbounded" }).pipe(Effect80.map(([marked, fabric]) => marked + fabric));
 
 // src/proxmox/sdn-apply.ts
 var ProxmoxSdnApply = Resource30("Proxmox.SdnApply");
-var read3 = (props) => sdnPendingCount(props.target).pipe(Effect64.map((pending) => ({ pending })));
-var ProxmoxSdnApplyProvider = () => Provider30.effect(ProxmoxSdnApply, Effect64.succeed(ProxmoxSdnApply.Provider.of({
-  list: () => Effect64.succeed([]),
-  read: Effect64.fn(function* ({ olds }) {
-    return yield* read3(olds);
+var read5 = (props) => sdnPendingCount(props.target).pipe(Effect81.map((pending) => ({ pending })));
+var ProxmoxSdnApplyProvider = () => Provider30.effect(ProxmoxSdnApply, Effect81.succeed(ProxmoxSdnApply.Provider.of({
+  list: () => Effect81.succeed([]),
+  read: Effect81.fn(function* ({ olds }) {
+    return yield* read5(olds);
   }),
-  diff: Effect64.fn(function* ({ news }) {
-    if (!isResolved17(news))
+  diff: Effect81.fn(function* ({ news }) {
+    if (!isResolved26(news))
       return;
-    const { pending } = yield* read3(news);
+    const { pending } = yield* read5(news);
     return pending === 0 ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect64.fn(function* ({ news }) {
-    const staged = yield* read3(news);
+  reconcile: Effect81.fn(function* ({ news }) {
+    const staged = yield* read5(news);
     if (staged.pending === 0)
       return staged;
     yield* guardSdnApply;
     yield* pve(news.target, "provision", "PUT", "cluster/sdn");
-    const after = yield* read3(news);
+    const after = yield* read5(news);
     if (after.pending !== 0) {
-      return yield* Effect64.die(new Error(`PUT /cluster/sdn returned no error but ${String(after.pending)} SDN object(s) ` + "are still staged. The running config does not match the declared one -- check " + "`pvesh get /cluster/sdn/zones --pending 1` for the objects PVE refused."));
+      return yield* Effect81.die(new Error(`PUT /cluster/sdn returned no error but ${String(after.pending)} SDN object(s) ` + "are still staged. The running config does not match the declared one -- check " + "`pvesh get /cluster/sdn/zones --pending 1` for the objects PVE refused."));
     }
     return after;
   }),
-  delete: () => Effect64.void
+  delete: () => Effect81.void
 })));
 // src/proxmox/sdn-subnet.ts
 import { Resource as Resource31 } from "alchemy";
 import * as Provider31 from "alchemy/Provider";
-import * as Effect65 from "effect/Effect";
+import * as Effect82 from "effect/Effect";
 
 // src/proxmox/sdn-subnet-form.ts
 var subnetId = (props) => `${props.zone}-${props.cidr.replace("/", "-")}`;
@@ -5185,7 +6061,7 @@ var updateForm6 = (props) => {
 
 // src/proxmox/sdn-subnet.ts
 var ProxmoxSdnSubnet = Resource31("Proxmox.SdnSubnet");
-var handlers20 = pveHandlers({
+var handlers16 = pveHandlers({
   attributes: (live, props) => {
     const liveVnet = text(live["vnet"]);
     if (liveVnet !== "" && liveVnet !== props.vnet)
@@ -5214,11 +6090,11 @@ var handlers20 = pveHandlers({
   path: (props) => `cluster/sdn/vnets/${props.vnet}/subnets/${subnetId(props)}`,
   updateForm: updateForm6
 });
-var ProxmoxSdnSubnetProvider = () => Provider31.effect(ProxmoxSdnSubnet, Effect65.succeed(ProxmoxSdnSubnet.Provider.of(handlers20)));
+var ProxmoxSdnSubnetProvider = () => Provider31.effect(ProxmoxSdnSubnet, Effect82.succeed(ProxmoxSdnSubnet.Provider.of(handlers16)));
 // src/proxmox/sdn-vnet.ts
 import { Resource as Resource32 } from "alchemy";
 import * as Provider32 from "alchemy/Provider";
-import * as Effect66 from "effect/Effect";
+import * as Effect83 from "effect/Effect";
 var ProxmoxSdnVnet = Resource32("Proxmox.SdnVnet");
 var tagOf = (value) => typeof value === "number" ? value : undefined;
 var shape11 = (props) => {
@@ -5238,7 +6114,7 @@ var updateForm7 = (props) => {
   ];
   return withClears(shape11(props), unset2);
 };
-var handlers21 = pveHandlers({
+var handlers17 = pveHandlers({
   readRole: "provision",
   attributes: (live, props) => ({
     alias: typeof live["alias"] === "string" ? live["alias"] : "",
@@ -5256,11 +6132,11 @@ var handlers21 = pveHandlers({
   path: (props) => `cluster/sdn/vnets/${props.vnet}`,
   updateForm: updateForm7
 });
-var ProxmoxSdnVnetProvider = () => Provider32.effect(ProxmoxSdnVnet, Effect66.succeed(ProxmoxSdnVnet.Provider.of(handlers21)));
+var ProxmoxSdnVnetProvider = () => Provider32.effect(ProxmoxSdnVnet, Effect83.succeed(ProxmoxSdnVnet.Provider.of(handlers17)));
 // src/proxmox/sdn-zone.ts
 import { Resource as Resource33 } from "alchemy";
 import * as Provider33 from "alchemy/Provider";
-import * as Effect67 from "effect/Effect";
+import * as Effect84 from "effect/Effect";
 var ProxmoxSdnZone = Resource33("Proxmox.SdnZone");
 var sameIpam = (live, declared2) => (live === "" ? "pve" : live) === (declared2 === undefined || declared2 === "" ? "pve" : declared2);
 var body6 = (props) => ({
@@ -5281,7 +6157,7 @@ var clearable = {
   vlan: ["dns", "dnszone", "ipam", "mtu", "nodes"],
   vxlan: ["dns", "dnszone", "ipam", "mtu", "nodes"]
 };
-var handlers22 = pveHandlers({
+var handlers18 = pveHandlers({
   readRole: "provision",
   attributes: (live, props) => {
     const liveType = text(live["type"]);
@@ -5308,18 +6184,18 @@ var handlers22 = pveHandlers({
   matches: (attributes2, props) => attributes2.mtu === (props.mtu ?? 0) && attributes2.nodes === csv(props.nodes) && sameIpam(attributes2.ipam, props.ipam) && attributes2.dns === (props.dns ?? "") && attributes2.dnszone === (props.dnszone ?? "") && attributes2.peers === csv(props.peers) && attributes2["vrf-vxlan"] === (props["vrf-vxlan"] ?? 0) && attributes2.tag === (props.tag ?? 0) && attributes2.bridge === (props.bridge ?? ""),
   path: (props) => `cluster/sdn/zones/${props.zone}`,
   updateForm: (props) => {
-    const fields = body6(props);
-    const clear = clearable[props.type].filter((option) => fields[option] === undefined);
-    return withClears(fields, clear);
+    const fields2 = body6(props);
+    const clear = clearable[props.type].filter((option) => fields2[option] === undefined);
+    return withClears(fields2, clear);
   }
 });
-var ProxmoxSdnZoneProvider = () => Provider33.effect(ProxmoxSdnZone, Effect67.succeed(ProxmoxSdnZone.Provider.of(handlers22)));
+var ProxmoxSdnZoneProvider = () => Provider33.effect(ProxmoxSdnZone, Effect84.succeed(ProxmoxSdnZone.Provider.of(handlers18)));
 // src/proxmox/storage.ts
 import { Resource as Resource34 } from "alchemy";
-import { isResolved as isResolved18 } from "alchemy/Diff";
+import { isResolved as isResolved27 } from "alchemy/Diff";
 import * as Provider34 from "alchemy/Provider";
 import * as storage2 from "@distilled.cloud/proxmox/storage";
-import * as Effect69 from "effect/Effect";
+import * as Effect86 from "effect/Effect";
 
 // src/proxmox/storage-form.ts
 var STORAGE_CREATE = "pve:POST /storage";
@@ -5351,7 +6227,7 @@ var toDistilledUpdate3 = (props) => underscored(updateForm8(props));
 
 // src/proxmox/storage-wire.ts
 import * as storage from "@distilled.cloud/proxmox/storage";
-import * as Effect68 from "effect/Effect";
+import * as Effect85 from "effect/Effect";
 var str2 = (value, fallback = "") => typeof value === "string" ? value : fallback;
 var tokens = (value) => value.split(",").map((part) => part.trim()).filter((part) => part !== "").sort().join(",");
 var sameList2 = (declared2, live) => declared2 === undefined || tokens(declared2) === tokens(live);
@@ -5370,8 +6246,8 @@ var attributesOf9 = (live, props) => {
     type: str2(data["type"], props.type)
   };
 };
-var readStorageOrFail = (props) => readOrUnreadable(runPve(props.target, "provision", false, storage.getStorage({ storage: props.storage }))).pipe(Effect68.map((live) => live === UNREADABLE ? UNREADABLE : attributesOf9(live, props)));
-var readStorage = (props) => readStorageOrFail(props).pipe(Effect68.catchTag("StorageNotFound", () => Effect68.succeed(undefined)));
+var readStorageOrFail = (props) => readOrUnreadable(runPve(props.target, "provision", false, storage.getStorage({ storage: props.storage }))).pipe(Effect85.map((live) => live === UNREADABLE ? UNREADABLE : attributesOf9(live, props)));
+var readStorage = (props) => readStorageOrFail(props).pipe(Effect85.catchTag("StorageNotFound", () => Effect85.succeed(undefined)));
 var dropUnreadable7 = (live) => live === UNREADABLE ? undefined : live;
 var matches9 = (attributes2, props) => sameList2(props.content, attributes2.content) && sameList2(props.nodes, attributes2.nodes) && sameList2(props["prune-backups"], attributes2["prune-backups"]) && same7(props.disable, attributes2.disable) && same7(props.shared, attributes2.shared) && same7(props.preallocation, attributes2.preallocation) && same7(props.comment, attributes2.comment);
 
@@ -5379,13 +6255,13 @@ var matches9 = (attributes2, props) => sameList2(props.content, attributes2.cont
 var ProxmoxStorage = Resource34("Proxmox.Storage", {
   defaultRemovalPolicy: "retain"
 });
-var ProxmoxStorageProvider = () => Provider34.effect(ProxmoxStorage, Effect69.succeed(ProxmoxStorage.Provider.of({
-  list: () => Effect69.succeed([]),
-  read: Effect69.fn(function* ({ olds, output }) {
+var ProxmoxStorageProvider = () => Provider34.effect(ProxmoxStorage, Effect86.succeed(ProxmoxStorage.Provider.of({
+  list: () => Effect86.succeed([]),
+  read: Effect86.fn(function* ({ olds, output }) {
     return dropUnreadable7(yield* output === undefined ? readStorage(olds) : readStorageOrFail(olds));
   }),
-  diff: Effect69.fn(function* ({ news, output }) {
-    if (!isResolved18(news))
+  diff: Effect86.fn(function* ({ news, output }) {
+    if (!isResolved27(news))
       return;
     yield* guardWrite2(STORAGE_CREATE, createForm11(news), output === undefined);
     yield* guardWrite2(STORAGE_UPDATE, updateForm8(news), false);
@@ -5402,7 +6278,7 @@ var ProxmoxStorageProvider = () => Provider34.effect(ProxmoxStorage, Effect69.su
     }
     return matches9(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect69.fn(function* ({ news }) {
+  reconcile: Effect86.fn(function* ({ news }) {
     const before = dropUnreadable7(yield* readStorage(news));
     yield* guardWrite2(STORAGE_CREATE, createForm11(news), before === undefined);
     yield* guardWrite2(STORAGE_UPDATE, updateForm8(news), false);
@@ -5413,23 +6289,23 @@ var ProxmoxStorageProvider = () => Provider34.effect(ProxmoxStorage, Effect69.su
     }
     const after = dropUnreadable7(yield* readStorage(news));
     if (after === undefined) {
-      return yield* Effect69.die(new Error(`storage/${news.storage}: the write returned no error but the storage is still ` + 'absent. PVE wraps every answer in {"data":...} and can report success on a ' + "call that did nothing -- read back rather than trusting the status code."));
+      return yield* Effect86.die(new Error(`storage/${news.storage}: the write returned no error but the storage is still ` + 'absent. PVE wraps every answer in {"data":...} and can report success on a ' + "call that did nothing -- read back rather than trusting the status code."));
     }
     return after;
   }),
-  delete: Effect69.fn(function* ({ olds }) {
+  delete: Effect86.fn(function* ({ olds }) {
     yield* runPve(olds.target, "provision", true, storage2.deleteStorage({ storage: olds.storage }));
   })
 })));
 // src/proxmox/zfs-pool.ts
 import { Resource as Resource35 } from "alchemy";
-import { isResolved as isResolved19 } from "alchemy/Diff";
+import { isResolved as isResolved28 } from "alchemy/Diff";
 import * as Provider35 from "alchemy/Provider";
-import * as Effect72 from "effect/Effect";
+import * as Effect89 from "effect/Effect";
 
 // src/proxmox/zfs-pool-wire.ts
 import * as nodes10 from "@distilled.cloud/proxmox/nodes";
-import * as Effect70 from "effect/Effect";
+import * as Effect87 from "effect/Effect";
 var leafDevices = (children) => Array.isArray(children) ? children.flatMap((entry) => {
   const vdev = entry;
   const nested = leafDevices(vdev.children);
@@ -5442,18 +6318,18 @@ var attributesOf10 = (live, props) => ({
   node: props.node,
   state: text(live.state, "unknown")
 });
-var readPoolOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, nodes10.getNodeDiskZfs({ name: props.name, node: props.node }))).pipe(Effect70.map((live) => {
+var readPoolOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, nodes10.getNodeDiskZfs({ name: props.name, node: props.node }))).pipe(Effect87.map((live) => {
   if (live === UNREADABLE)
     return UNREADABLE;
   return text(live.name) === "" ? undefined : attributesOf10(live, props);
 }));
-var readPool = (props) => readPoolOrFail(props).pipe(Effect70.orElseSucceed(() => {
+var readPool2 = (props) => readPoolOrFail(props).pipe(Effect87.orElseSucceed(() => {
   return;
 }));
 var dropUnreadable8 = (live) => live === UNREADABLE ? undefined : live;
 
 // src/proxmox/zfs-pool-form.ts
-import * as Effect71 from "effect/Effect";
+import * as Effect88 from "effect/Effect";
 import * as nodes11 from "@distilled.cloud/proxmox/nodes";
 var ZFS_POOL_CREATE = "pve:POST /nodes/{node}/disks/zfs";
 var zfsPoolCreateEndpoint = (props) => props.devices === undefined || props.raidlevel === undefined ? undefined : ZFS_POOL_CREATE;
@@ -5474,25 +6350,25 @@ var toDistilledCreate5 = (props) => {
   };
 };
 var SETTLE_ATTEMPTS = 30;
-var createPool = (props, read4) => Effect71.gen(function* () {
-  const existing = yield* read4(props);
+var createPool2 = (props, read6) => Effect88.gen(function* () {
+  const existing = yield* read6(props);
   if (existing !== undefined)
     return existing;
   if (props.devices === undefined || props.raidlevel === undefined) {
-    return yield* Effect71.die(new Error(`${props.node}/${props.name}: this is an adopt-only declaration (no \`devices\` or ` + "`raidlevel`) and the pool is not there to adopt. An adopt-only Proxmox.ZfsPool never " + "creates -- declare both fields for a pool this resource should build, or point this " + "declaration at a pool that already exists on this node."));
+    return yield* Effect88.die(new Error(`${props.node}/${props.name}: this is an adopt-only declaration (no \`devices\` or ` + "`raidlevel`) and the pool is not there to adopt. An adopt-only Proxmox.ZfsPool never " + "creates -- declare both fields for a pool this resource should build, or point this " + "declaration at a pool that already exists on this node."));
   }
   yield* guardForm(zfsPoolCreateEndpoint(props), asForm2(createForm12(props)), true);
   const upid = yield* runPve(props.target, "provision", true, nodes11.createNodeDiskZfs(toDistilledCreate5(props)));
-  const settle4 = (attempts) => Effect71.gen(function* () {
-    const live = yield* read4(props);
+  const settle3 = (attempts) => Effect88.gen(function* () {
+    const live = yield* read6(props);
     if (live !== undefined || attempts <= 0)
       return live;
-    yield* Effect71.sleep("2 seconds");
-    return yield* settle4(attempts - 1);
+    yield* Effect88.sleep("2 seconds");
+    return yield* settle3(attempts - 1);
   });
-  const after = yield* settle4(SETTLE_ATTEMPTS);
+  const after = yield* settle3(SETTLE_ATTEMPTS);
   if (after === undefined) {
-    return yield* Effect71.die(new Error(`nodes/${props.node}/disks/zfs/${props.name}: POST returned ${text(upid, "(no UPID)")} ` + "but the pool has not appeared. That POST only forks a `zfscreate` worker, so the task " + `holds the real error -- read it with \`pvesh get /nodes/${props.node}/tasks/<upid>/log\`. ` + "NOTHING WAS RETRIED AND NOTHING WAS CLEANED UP: if the worker reached `zpool create`, " + "the declared devices have already been written to. DO NOT RE-RUN THIS DEPLOY BEFORE " + 'READING THAT LOG: `read` cannot tell "the worker is still running" from "the pool is ' + 'genuinely gone", so a re-run this soon can POST a SECOND `zpool create` at the SAME ' + "devices while the first one is still mid-write -- confirm the task finished (one way " + "or the other) before trying again."));
+    return yield* Effect88.die(new Error(`nodes/${props.node}/disks/zfs/${props.name}: POST returned ${text(upid, "(no UPID)")} ` + "but the pool has not appeared. That POST only forks a `zfscreate` worker, so the task " + `holds the real error -- read it with \`pvesh get /nodes/${props.node}/tasks/<upid>/log\`. ` + "NOTHING WAS RETRIED AND NOTHING WAS CLEANED UP: if the worker reached `zpool create`, " + "the declared devices have already been written to. DO NOT RE-RUN THIS DEPLOY BEFORE " + 'READING THAT LOG: `read` cannot tell "the worker is still running" from "the pool is ' + 'genuinely gone", so a re-run this soon can POST a SECOND `zpool create` at the SAME ' + "devices while the first one is still mid-write -- confirm the task finished (one way " + "or the other) before trying again."));
   }
   return after;
 });
@@ -5502,13 +6378,13 @@ var destroyPool = (props) => runPve(props.target, "provision", true, nodes11.del
 var ProxmoxZfsPool = Resource35("Proxmox.ZfsPool", {
   defaultRemovalPolicy: "retain"
 });
-var ProxmoxZfsPoolProvider = () => Provider35.effect(ProxmoxZfsPool, Effect72.succeed(ProxmoxZfsPool.Provider.of({
-  list: () => Effect72.succeed([]),
-  read: Effect72.fn(function* ({ olds, output }) {
-    return dropUnreadable8(yield* output === undefined ? readPool(olds) : readPoolOrFail(olds));
+var ProxmoxZfsPoolProvider = () => Provider35.effect(ProxmoxZfsPool, Effect89.succeed(ProxmoxZfsPool.Provider.of({
+  list: () => Effect89.succeed([]),
+  read: Effect89.fn(function* ({ olds, output }) {
+    return dropUnreadable8(yield* output === undefined ? readPool2(olds) : readPoolOrFail(olds));
   }),
-  diff: Effect72.fn(function* ({ news, output }) {
-    if (!isResolved19(news))
+  diff: Effect89.fn(function* ({ news, output }) {
+    if (!isResolved28(news))
       return;
     yield* guardForm(zfsPoolCreateEndpoint(news), asForm2(createForm12(news)), output === undefined);
     if (output === undefined)
@@ -5524,10 +6400,10 @@ var ProxmoxZfsPoolProvider = () => Provider35.effect(ProxmoxZfsPool, Effect72.su
     }
     return { action: "noop" };
   }),
-  reconcile: Effect72.fn(function* ({ news }) {
-    return yield* createPool(news, (props) => readPool(props).pipe(Effect72.map(dropUnreadable8)));
+  reconcile: Effect89.fn(function* ({ news }) {
+    return yield* createPool2(news, (props) => readPool2(props).pipe(Effect89.map(dropUnreadable8)));
   }),
-  delete: Effect72.fn(function* ({ olds }) {
+  delete: Effect89.fn(function* ({ olds }) {
     yield* destroyPool(olds);
   })
 })));
@@ -5607,5 +6483,5 @@ export {
   violations
 };
 
-//# debugId=34DF7A874403817964756E2164756E21
+//# debugId=ECA89AEF81AD3AD164756E2164756E21
 //# sourceMappingURL=index.js.map