@homeflare/alchemy 0.41.0 → 0.43.0

package/dist/proxmox/index.js

@@ -1025,6 +1025,20 @@ import * as Duration from "effect/Duration";
 import * as Effect3 from "effect/Effect";
 import * as Exit from "effect/Exit";
 
+// src/proxmox/credentials.ts
+var VALID_TIER = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var mintTier = (target, role) => {
+  if (target.scheme !== "pve")
+    return role;
+  const tier = target.roles?.[role];
+  if (tier === undefined)
+    return role;
+  if (!VALID_TIER.test(tier)) {
+    throw new Error(`PveTarget.roles.${role} = ${JSON.stringify(tier)} is not a valid OpenBao tier name -- ` + 'it would be interpolated straight into "<mount>/creds/<tier>" and must be a plain name ' + '(letters, digits, ".", "_", "-", not starting with one of those and not "..").');
+  }
+  return tier;
+};
+
 // src/proxmox/mint.ts
 import * as Effect2 from "effect/Effect";
 import * as Option from "effect/Option";
@@ -1038,14 +1052,15 @@ import * as Data from "effect/Data";
 
 class PveCredentialDenied extends Data.TaggedError("PveCredentialDenied") {
   get message() {
-    return `OpenBao GET /v1/${this.mount}/creds/${this.role} -> 403: ${this.detail}. This identity's ` + "AppRole has no grant for this role -- a refused read, not evidence the object is gone.";
+    return `OpenBao GET /v1/${this.mount}/creds/${this.tier} -> 403: ${this.detail}. This identity's ` + "AppRole has no grant for this role -- a refused read, not evidence the object is gone.";
   }
 }
 
 // src/proxmox/mint.ts
 var baoVariable = (env, name) => env[`BAO_${name}`] ?? env[`VAULT_${name}`] ?? "";
 var mint = (target, role, env = process.env) => Effect2.gen(function* () {
-  const path = `${target.mount}/creds/${role}`;
+  const tier = mintTier(target, role);
+  const path = `${target.mount}/creds/${tier}`;
   const refuse = (status2, detail) => new Error(`OpenBao GET /v1/${path} -> ${status2 === 0 ? "no response" : status2}: ${detail}`);
   const address = baoVariable(env, "AGENT_ADDR") || baoVariable(env, "ADDR") || "https://127.0.0.1:8200";
   const socket = address.startsWith("unix://") ? address.slice("unix://".length) : undefined;
@@ -1078,14 +1093,14 @@ var mint = (target, role, env = process.env) => Effect2.gen(function* () {
     const isOpenBaoBody = Array.isArray(errors);
     const detail = isOpenBaoBody ? errors.map(String).join("; ") : "not an OpenBao error body";
     if (status === 403 && isOpenBaoBody) {
-      return yield* Effect2.fail(new PveCredentialDenied({ detail, mount: target.mount, role }));
+      return yield* Effect2.fail(new PveCredentialDenied({ detail, mount: target.mount, tier }));
     }
     return yield* Effect2.fail(refuse(status, detail || "(no errors given)"));
   }
   const tokenId = parsed?.data?.token_id;
   const secret = parsed?.data?.secret;
   if (typeof tokenId !== "string" || typeof secret !== "string") {
-    return yield* Effect2.fail(new Error(`${target.mount}/creds/${role} returned no token_id/secret. Either this approle lacks ` + `the grant, or the mount is not ${target.mount}. Say which mount and role you needed ` + `than falling back to a stored credential -- every stored PVE token is read-only.`));
+    return yield* Effect2.fail(new Error(`${target.mount}/creds/${tier} returned no token_id/secret. Either this approle lacks ` + `the grant, or the mount is not ${target.mount}. Say which mount and role you needed ` + `than falling back to a stored credential -- every stored PVE token is read-only.`));
   }
   const lease = parsed?.lease_duration;
   const leaseSeconds = typeof lease === "number" ? lease : 0;
@@ -1097,13 +1112,14 @@ var authorization = (credential, target) => target.scheme === "pbs" ? `PBSAPITok
 var REMINT_MARGIN_SECONDS = 60;
 var keyOf = (target, role) => ({
   mount: target.mount,
-  role,
-  scheme: target.scheme
+  scheme: target.scheme,
+  tier: mintTier(target, role)
 });
 var timeToLive = (exit) => Exit.isSuccess(exit) && exit.value.leaseSeconds > REMINT_MARGIN_SECONDS ? Duration.seconds(exit.value.leaseSeconds - REMINT_MARGIN_SECONDS) : Duration.zero;
 var makeLeases = (mintFor) => Cache.makeWith(mintFor, { capacity: 64, requireServicesAt: "lookup", timeToLive });
-var targetForKey = (key) => key.scheme === "pbs" ? { api: "https://pbs.invalid/api2/json", mount: key.mount, scheme: "pbs" } : { members: [], mount: key.mount, scheme: "pve" };
-var leases = Effect3.runSync(makeLeases((key) => mint(targetForKey(key), key.role)));
+var targetForKey = (key) => key.scheme === "pbs" ? { api: "https://pbs.invalid/api2/json", mount: key.mount, scheme: "pbs" } : { members: [], mount: key.mount, roles: { read: key.tier }, scheme: "pve" };
+var mintForKey = (key, env = process.env) => mint(targetForKey(key), key.scheme === "pbs" ? key.tier : "read", env);
+var leases = Effect3.runSync(makeLeases(mintForKey));
 var leased = (target, role) => Cache.get(leases, keyOf(target, role));
 
 // src/proxmox/members.ts
@@ -1233,7 +1249,7 @@ var runPve = (target, role, isWrite, op) => Effect5.gen(function* () {
 import * as Effect6 from "effect/Effect";
 var UNREADABLE = Symbol("pve-unreadable");
 var readOrUnreadable = (effect) => effect.pipe(Effect6.catchTag("PveCredentialDenied", () => Effect6.succeed(UNREADABLE)));
-var unreadableWarning = (type, identity2) => Effect6.logWarning(`${type} ${identity2}: the read was refused (no grant for this credential's role) -- ` + "reporting noop rather than forcing an update with nothing compared. Re-plan on a lane " + "that can read this object before trusting this row.");
+var unreadableWarning = (type, identity2, mount, tier) => Effect6.logWarning(`${type} ${identity2}: the read of ${mount}/creds/${tier} was refused (no grant for this ` + "credential's role) -- reporting noop rather than forcing an update with nothing compared. " + "Re-plan on a lane that can read this object before trusting this row.");
 
 // src/proxmox/acl.ts
 var ProxmoxAcl = Resource("Proxmox.Acl");
@@ -1255,7 +1271,7 @@ var ProxmoxAclProvider = () => Provider.effect(ProxmoxAcl, Effect7.succeed(Proxm
       return;
     const live = yield* readAttributes(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.Acl", identity(news));
+      yield* unreadableWarning("Proxmox.Acl", identity(news), news.target.mount, mintTier(news.target, "provision"));
       return { action: "noop" };
     }
     return live !== undefined && matches(live, news) ? { action: "noop" } : { action: "update" };
@@ -1425,7 +1441,7 @@ var ProxmoxApiTokenProvider = () => Provider2.effect(ProxmoxApiToken, Effect8.su
       return;
     const live = yield* readToken(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.ApiToken", `${news.userid}!${news.tokenid}`);
+      yield* unreadableWarning("Proxmox.ApiToken", `${news.userid}!${news.tokenid}`, news.target.mount, mintTier(news.target, "provision"));
       return { action: "noop" };
     }
     return live !== undefined && matches2(live, news) ? { action: "noop" } : { action: "update" };
@@ -1729,143 +1745,57 @@ var ProxmoxCephDaemonProvider = () => Provider4.effect(ProxmoxCephDaemon, Effect
 })));
 // src/proxmox/ceph-flag.ts
 import { Resource as Resource5 } from "alchemy";
-import * as Provider5 from "alchemy/Provider";
-import * as Effect16 from "effect/Effect";
-
-// src/proxmox/resource.ts
 import { isResolved as isResolved5 } from "alchemy/Diff";
+import * as Provider5 from "alchemy/Provider";
 import * as Effect15 from "effect/Effect";
 
-// src/proxmox/client.ts
+// src/proxmox/ceph-flag-wire.ts
+import * as cluster3 from "@distilled.cloud/proxmox/cluster";
 import * as Effect14 from "effect/Effect";
-import * as HttpClient5 from "effect/unstable/http/HttpClient";
-import * as HttpClientRequest2 from "effect/unstable/http/HttpClientRequest";
-class PveError extends Error {
-  status;
-  method;
-  path;
-  constructor(status, method, path, detail) {
-    super(`PVE ${method} ${path} -> ${String(status)}: ${detail}`);
-    this.status = status;
-    this.method = method;
-    this.path = path;
-    this.name = "PveError";
-  }
-}
-var clusterExhausted = (method, path, attempts) => new PveError(0, method, path, `all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join("; ")}`);
-var encode = (form) => {
-  const params = new URLSearchParams;
-  for (const [key, value] of Object.entries(form)) {
-    if (typeof value === "string")
-      params.append(key, value);
-    else
-      for (const item of value)
-        params.append(key, item);
-  }
-  return params.toString();
-};
-var buildRequest = (method, apiBase, path, credential, target, form) => {
-  const url = `${apiBase}/${path}`;
-  return HttpClientRequest2.make(method)(url).pipe(HttpClientRequest2.setHeaders({ Authorization: authorization(credential, target) }), form === undefined ? (self) => self : HttpClientRequest2.bodyText(encode(form), "application/x-www-form-urlencoded"));
-};
-var executeOne = (target, credential, method, path, form, apiBase) => Effect14.gen(function* () {
-  const client = yield* HttpClient5.HttpClient;
-  const request = buildRequest(method, apiBase, path, credential, target, form);
-  return yield* client.execute(request).pipe(Effect14.mapError((cause) => new PveError(0, method, path, String(cause))));
-});
-var readResponse = (response, method, path) => Effect14.gen(function* () {
-  if (response.status < 200 || response.status >= 300) {
-    const detail = yield* response.text.pipe(Effect14.orElseSucceed(() => ""));
-    return yield* Effect14.fail(new PveError(response.status, method, path, detail.slice(0, 300)));
-  }
-  const body = yield* response.json.pipe(Effect14.mapError((cause) => new PveError(0, method, path, String(cause))));
-  return body.data;
-});
-var pveWith = (target, credential, method, path, form) => Effect14.gen(function* () {
-  const response = target.scheme === "pve" ? yield* executeOnCluster(target, method, path, (apiBase) => buildRequest(method, apiBase, path, credential, target, form)).pipe(Effect14.mapError((failure) => failure.tag === "cluster" ? clusterExhausted(failure.method, failure.path, failure.attempts) : new PveError(0, method, path, String(failure)))) : yield* executeOne(target, credential, method, path, form, target.api);
-  return yield* readResponse(response, method, path);
+var CEPH_FLAG_UPDATE = "pve:PUT /cluster/ceph/flags/{flag}";
+var attributesOf3 = (live, props) => ({
+  flag: props.flag,
+  value: bool(live)
 });
-var pve = (target, role, method, path, form) => Effect14.gen(function* () {
-  const credential = yield* leased(target, role);
-  return yield* pveWith(target, credential, method, path, form);
-});
-
-// src/proxmox/resource.ts
-var pveOperations = (spec) => {
-  const { guardCreate: guardCreate2, guardUpdate: guardUpdate2 } = specGuards(spec);
-  const read = (props) => pve(props.target, spec.readRole ?? "read", "GET", spec.path(props)).pipe(Effect15.map((data) => data == null ? undefined : spec.attributes(data, props)), Effect15.orElseSucceed(() => {
-    return;
-  }));
-  return {
-    guardCreate: guardCreate2,
-    guardUpdate: guardUpdate2,
-    read,
-    diff: (news, output) => Effect15.gen(function* () {
-      if (!isResolved5(news))
-        return;
-      yield* guardCreate2(news, output === undefined);
-      yield* guardUpdate2(news);
-      if (output === undefined)
-        return;
-      const live = yield* read(news);
-      if (live === undefined) {
-        yield* guardCreate2(news, true);
-        return { action: "update" };
-      }
-      if (spec.matches(live, news))
-        return { action: "noop" };
-      return spec.updateForm === undefined ? { action: "replace" } : { action: "update" };
-    }),
-    reconcile: (news) => Effect15.gen(function* () {
-      const live = yield* read(news);
-      yield* guardCreate2(news, live === undefined);
-      yield* guardUpdate2(news);
-      if (live === undefined) {
-        yield* pve(news.target, "provision", "POST", spec.collection(news), spec.createForm(news));
-      } else if (spec.updateForm !== undefined) {
-        const form = formToSend(spec.matches, live, news, spec.updateForm(news));
-        if (form !== undefined) {
-          yield* pve(news.target, "provision", "PUT", spec.path(news), form);
-        }
-      }
-      const after = yield* read(news);
-      if (after === undefined) {
-        return yield* Effect15.die(new Error(`${spec.path(news)}: the write returned no error but the object is still absent. ` + 'PVE wraps every answer in {"data":...} and can report success on a call that did ' + "nothing -- read back rather than trusting the status code."));
-      }
-      return after;
-    }),
-    destroy: (olds) => pve(olds.target, "provision", "DELETE", spec.path(olds))
-  };
-};
-var pveHandlers = (spec) => {
-  const ops = pveOperations(spec);
-  return {
-    list: () => Effect15.succeed([]),
-    read: ({ olds }) => ops.read(olds),
-    diff: ({ news, output }) => ops.diff(news, output),
-    reconcile: ({ news }) => ops.reconcile(news),
-    delete: ({ olds }) => ops.destroy(olds)
-  };
+var scalarFlagOrDie = (live, props) => {
+  const scalar = typeof live === "boolean" || live === 0 || live === 1 || live === "0" || live === "1";
+  return scalar ? Effect14.succeed(live) : Effect14.die(new Error(`cluster/ceph/flags/${props.flag}: GET answered ${JSON.stringify(live)}, not a bare ` + "boolean. This endpoint's success is a scalar; an empty object is what the protocol " + 'substitutes for `{"data":null}`. Check `ceph osd dump | head -1` and the cluster ' + "log rather than trust a coerced `false`."));
 };
+var readClusterCephFlag = (props) => runPve(props.target, "read", false, cluster3.getClusterCephFlag({ flag: props.flag })).pipe(Effect14.flatMap((live) => scalarFlagOrDie(live, props)), Effect14.map((live) => attributesOf3(live, props)));
+var readClusterCephFlagForDiff = (props) => readOrUnreadable(readClusterCephFlag(props));
+var updateForm = (props) => ({ value: flag(props.value) ?? "0" });
+var writeClusterCephFlag = (props) => runPve(props.target, "provision", true, cluster3.putClusterCephFlag({ flag: props.flag, value: updateForm(props).value }));
 
 // src/proxmox/ceph-flag.ts
 var ProxmoxCephFlag = Resource5("Proxmox.CephFlag");
-var handlers = pveHandlers({
-  attributes: (live, props) => ({ flag: props.flag, value: bool(live) }),
-  collection: () => "cluster/ceph/flags",
-  createForm: (props) => ({ [props.flag]: flag(props.value) ?? "0" }),
-  endpoint: { update: "pve:PUT /cluster/ceph/flags/{flag}" },
-  matches: (attributes, props) => attributes.value === props.value,
-  path: (props) => `cluster/ceph/flags/${props.flag}`,
-  updateForm: (props) => ({ value: flag(props.value) ?? "0" })
-});
-var ProxmoxCephFlagProvider = () => Provider5.effect(ProxmoxCephFlag, Effect16.succeed(ProxmoxCephFlag.Provider.of({
-  ...handlers,
-  delete: () => Effect16.void,
-  reconcile: Effect16.fn(function* ({ news }) {
-    const after = yield* handlers.reconcile({ news });
+var matches3 = (attributes, props) => attributes.value === props.value;
+var ProxmoxCephFlagProvider = () => Provider5.effect(ProxmoxCephFlag, Effect15.succeed(ProxmoxCephFlag.Provider.of({
+  list: () => Effect15.succeed([]),
+  read: ({ olds }) => readClusterCephFlag(olds),
+  diff: Effect15.fn(function* ({ news, output }) {
+    if (!isResolved5(news))
+      return;
+    yield* guardWrite2(CEPH_FLAG_UPDATE, updateForm(news), false);
+    if (output === undefined)
+      return;
+    const live = yield* readClusterCephFlagForDiff(news);
+    if (live === UNREADABLE) {
+      yield* unreadableWarning("Proxmox.CephFlag", news.flag, news.target.mount, mintTier(news.target, "read"));
+      return { action: "noop" };
+    }
+    return { action: matches3(live, news) ? "noop" : "update" };
+  }),
+  delete: () => Effect15.void,
+  reconcile: Effect15.fn(function* ({ news }) {
+    const live = yield* readClusterCephFlag(news);
+    const form = formToSend(matches3, live, news, updateForm(news));
+    if (form !== undefined) {
+      yield* guardWrite2(CEPH_FLAG_UPDATE, updateForm(news), false);
+      yield* writeClusterCephFlag(news);
+    }
+    const after = yield* readClusterCephFlag(news);
     if (after.value !== news.value) {
-      return yield* Effect16.die(new Error(`cluster/ceph/flags/${news.flag}: the PUT returned no error but ceph still ` + `reports the flag ${after.value ? "set" : "clear"} rather than ` + `${news.value ? "set" : "clear"}. This endpoint's success is documented as a ` + "null body, so the status code proves nothing -- check `ceph osd dump | " + "head -1` and the cluster log. `pause` in particular is two ceph flags read " + "as one; see the header."));
+      return yield* Effect15.die(new Error(`cluster/ceph/flags/${news.flag}: the PUT returned no error but ceph still ` + `reports the flag ${after.value ? "set" : "clear"} rather than ` + `${news.value ? "set" : "clear"}. This endpoint's success is documented as a ` + "null body, so the status code proves nothing -- check `ceph osd dump | " + "head -1` and the cluster log. `pause` in particular is two ceph flags read " + "as one; see the header."));
     }
     return after;
   })
@@ -1874,11 +1804,11 @@ var ProxmoxCephFlagProvider = () => Provider5.effect(ProxmoxCephFlag, Effect16.s
 import { Resource as Resource6 } from "alchemy";
 import { isResolved as isResolved6 } from "alchemy/Diff";
 import * as Provider6 from "alchemy/Provider";
-import * as Effect18 from "effect/Effect";
+import * as Effect17 from "effect/Effect";
 
 // src/proxmox/ceph-fs-distilled.ts
 import * as nodes2 from "@distilled.cloud/proxmox/nodes";
-import * as Effect17 from "effect/Effect";
+import * as Effect16 from "effect/Effect";
 
 // src/proxmox/ceph-fs-wire.ts
 var readRow = (live, props) => {
@@ -1906,40 +1836,40 @@ var notCreated2 = (props) => new Error(`${objectPath(props)}: the create task fi
 var notDestroyed = (props) => new Error(`${objectPath(props)}: the destroy task finished but the filesystem is still in ` + `GET nodes/${props.node}/ceph/fs. PVE refuses to destroy a CephFS while a PVE storage entry ` + "of type cephfs still references it and is not disabled.");
 
 // src/proxmox/ceph-fs-distilled.ts
-var readFs = (props) => runPve(props.target, "read", false, nodes2.listNodeCephFs({ node: props.node })).pipe(Effect17.map((rows) => readRow(rows, props)));
+var readFs = (props) => runPve(props.target, "read", false, nodes2.listNodeCephFs({ node: props.node })).pipe(Effect16.map((rows) => readRow(rows, props)));
 var toDistilledCreate = (props) => ({
   ...createForm2(props),
   name: props.name,
   node: props.node
 });
-var settleTask = (props, upid) => Effect17.gen(function* () {
+var settleTask = (props, upid) => Effect16.gen(function* () {
   for (let attempt = 0;attempt < POLL_ATTEMPTS; attempt += 1) {
-    const status = yield* runPve(props.target, "read", false, nodes2.getNodeTaskStatus({ node: props.node, upid })).pipe(Effect17.orElseSucceed(() => {
+    const status = yield* runPve(props.target, "read", false, nodes2.getNodeTaskStatus({ node: props.node, upid })).pipe(Effect16.orElseSucceed(() => {
       return;
     }));
     if (status?.status === "stopped") {
       if (status.exitstatus === "OK")
         return;
-      return yield* Effect17.die(new Error(`${objectPath(props)}: PVE task ${upid} finished with "${status.exitstatus ?? "no exit status"}". ` + "The write returned HTTP 200 because it only forked the worker -- the real error is " + `in \`pvesh get /nodes/${props.node}/tasks/${upid}/log\`.`));
+      return yield* Effect16.die(new Error(`${objectPath(props)}: PVE task ${upid} finished with "${status.exitstatus ?? "no exit status"}". ` + "The write returned HTTP 200 because it only forked the worker -- the real error is " + `in \`pvesh get /nodes/${props.node}/tasks/${upid}/log\`.`));
     }
-    yield* Effect17.sleep(POLL_SECONDS * 1000);
+    yield* Effect16.sleep(POLL_SECONDS * 1000);
   }
-  return yield* Effect17.die(new Error(`${objectPath(props)}: PVE task ${upid} was still running after ` + `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its status could not be read. Check the ` + "task log, and check that the `read` role holds Sys.Audit on " + `/nodes/${props.node} -- each call mints a new token, so the poller is never the task ` + "owner and is answered 403 rather than told to wait."));
+  return yield* Effect16.die(new Error(`${objectPath(props)}: PVE task ${upid} was still running after ` + `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its status could not be read. Check the ` + "task log, and check that the `read` role holds Sys.Audit on " + `/nodes/${props.node} -- each call mints a new token, so the poller is never the task ` + "owner and is answered 403 rather than told to wait."));
 });
-var createFs = (props) => Effect17.gen(function* () {
+var createFs = (props) => Effect16.gen(function* () {
   const upid = yield* runPve(props.target, "provision", true, nodes2.updateNodeCephFs(toDistilledCreate(props)));
   if (upid === "") {
-    return yield* Effect17.die(new Error(`${objectPath(props)}: POST returned no task id. PVE wraps every answer in ` + '{"data":...} and can report success on a call that did nothing.'));
+    return yield* Effect16.die(new Error(`${objectPath(props)}: POST returned no task id. PVE wraps every answer in ` + '{"data":...} and can report success on a call that did nothing.'));
   }
   yield* settleTask(props, upid);
 });
-var destroyFs = (props) => Effect17.gen(function* () {
+var destroyFs = (props) => Effect16.gen(function* () {
   const upid = yield* runPve(props.target, "provision", true, nodes2.deleteNodeCephFs({
     node: props.node,
     name: props.name,
     ...props["remove-pools"] === true ? { remove_pools: "1" } : {},
     ...props["remove-storages"] === true ? { remove_storages: "1" } : {}
-  })).pipe(Effect17.catchTag("CephFsNotFound", () => Effect17.succeed("")));
+  })).pipe(Effect16.catchTag("CephFsNotFound", () => Effect16.succeed("")));
   if (upid !== "")
     yield* settleTask(props, upid);
 });
@@ -1948,12 +1878,12 @@ var destroyFs = (props) => Effect17.gen(function* () {
 var ProxmoxCephFs = Resource6("Proxmox.CephFs", {
   defaultRemovalPolicy: "retain"
 });
-var ProxmoxCephFsProvider = () => Provider6.effect(ProxmoxCephFs, Effect18.succeed(ProxmoxCephFs.Provider.of({
-  list: () => Effect18.succeed([]),
-  read: Effect18.fn(function* ({ olds }) {
+var ProxmoxCephFsProvider = () => Provider6.effect(ProxmoxCephFs, Effect17.succeed(ProxmoxCephFs.Provider.of({
+  list: () => Effect17.succeed([]),
+  read: Effect17.fn(function* ({ olds }) {
     return yield* readFs(olds);
   }),
-  diff: Effect18.fn(function* ({ news, output }) {
+  diff: Effect17.fn(function* ({ news, output }) {
     if (!isResolved6(news))
       return;
     yield* guardWrite2(CEPH_FS_CREATE, createForm2(news), output === undefined);
@@ -1969,34 +1899,34 @@ var ProxmoxCephFsProvider = () => Provider6.effect(ProxmoxCephFs, Effect18.succe
     }
     return { action: "noop" };
   }),
-  reconcile: Effect18.fn(function* ({ news }) {
+  reconcile: Effect17.fn(function* ({ news }) {
     const live = yield* readFs(news);
     if (live !== undefined)
       return live;
     yield* createFs(news);
     const after = yield* readFs(news);
     if (after === undefined)
-      return yield* Effect18.die(notCreated2(news));
+      return yield* Effect17.die(notCreated2(news));
     return after;
   }),
-  delete: Effect18.fn(function* ({ olds }) {
+  delete: Effect17.fn(function* ({ olds }) {
     if ((yield* readFs(olds)) === undefined)
       return;
     yield* destroyFs(olds);
     const after = yield* readFs(olds);
     if (after !== undefined)
-      return yield* Effect18.die(notDestroyed(olds));
+      return yield* Effect17.die(notDestroyed(olds));
   })
 })));
 // src/proxmox/ceph-osd.ts
 import { Resource as Resource7 } from "alchemy";
 import { isResolved as isResolved7 } from "alchemy/Diff";
 import * as Provider7 from "alchemy/Provider";
-import * as Effect21 from "effect/Effect";
+import * as Effect20 from "effect/Effect";
 
 // src/proxmox/ceph-osd-tree.ts
 import * as nodes3 from "@distilled.cloud/proxmox/nodes";
-import * as Effect19 from "effect/Effect";
+import * as Effect18 from "effect/Effect";
 var branches = (node) => (Array.isArray(node["children"]) ? node["children"] : []).filter((child) => typeof child === "object" && child !== null);
 var osdLeaves = (tree) => {
   const root = tree["root"];
@@ -2022,23 +1952,23 @@ var osdAttributes = (leaf, props) => ({
   status: text(leaf["status"]),
   total_space: num(leaf["total_space"], 0)
 });
-var readOsd = (props) => runPve(props.target, "read", false, nodes3.getNodeCephOsd({ node: props.node })).pipe(Effect19.map((t) => {
+var readOsd = (props) => runPve(props.target, "read", false, nodes3.getNodeCephOsd({ node: props.node })).pipe(Effect18.map((t) => {
   const leaf = findOsd(t, props.osdid);
   return leaf === undefined ? undefined : osdAttributes(leaf, props);
 }));
 
 // src/proxmox/ceph-osd-write.ts
 import * as nodes4 from "@distilled.cloud/proxmox/nodes";
-import * as Effect20 from "effect/Effect";
+import * as Effect19 from "effect/Effect";
 var OSD_CREATE_ENDPOINT = "pve:POST /nodes/{node}/ceph/osd";
 var describe = (props) => `osd.${String(props.osdid)} on ${props.node}`;
 var createOsdForm = (props, dev) => ({
   dev,
   ...props.device_class === undefined ? {} : { "crush-device-class": props.device_class }
 });
-var createOsd = Effect20.fn(function* (news) {
+var createOsd = Effect19.fn(function* (news) {
   if (news.dev === undefined) {
-    return yield* Effect20.die(new Error(`${describe(news)}: no such OSD in the CRUSH tree, and no \`dev\` was declared. ` + "Without a device this resource is an ASSERTION over an OSD that must already " + "exist. Declare `dev` to let it create one -- which WIPES that device -- or fix " + "the declaration; if the disk was there yesterday, a replica is missing and Ceph " + "is degraded."));
+    return yield* Effect19.die(new Error(`${describe(news)}: no such OSD in the CRUSH tree, and no \`dev\` was declared. ` + "Without a device this resource is an ASSERTION over an OSD that must already " + "exist. Declare `dev` to let it create one -- which WIPES that device -- or fix " + "the declaration; if the disk was there yesterday, a replica is missing and Ceph " + "is degraded."));
   }
   const form = createOsdForm(news, news.dev);
   yield* guardForm(OSD_CREATE_ENDPOINT, form, true);
@@ -2049,7 +1979,7 @@ var createOsd = Effect20.fn(function* (news) {
   }));
   const created = yield* readOsd(news);
   if (created === undefined) {
-    return yield* Effect20.die(new Error(`${describe(news)}: the create returned no error but osd.${String(news.osdid)} is ` + "still absent. Ceph allocates OSD ids and cannot be told which to use, so it most " + "likely assigned a different number -- check `ceph osd tree`, and declare the id it " + "actually gave the device rather than deploying again."));
+    return yield* Effect19.die(new Error(`${describe(news)}: the create returned no error but osd.${String(news.osdid)} is ` + "still absent. Ceph allocates OSD ids and cannot be told which to use, so it most " + "likely assigned a different number -- check `ceph osd tree`, and declare the id it " + "actually gave the device rather than deploying again."));
   }
   return created;
 });
@@ -2065,12 +1995,12 @@ var ProxmoxCephOsd = Resource7("Proxmox.CephOsd", {
 });
 var settled = (live, props) => (props.host === undefined || props.host === live.host) && (props.device_class === undefined || props.device_class === live.device_class);
 var describe2 = (props) => `osd.${String(props.osdid)} (read via nodes/${props.node}/ceph/osd)`;
-var handlers2 = {
-  list: () => Effect21.succeed([]),
-  read: Effect21.fn(function* ({ olds }) {
+var handlers = {
+  list: () => Effect20.succeed([]),
+  read: Effect20.fn(function* ({ olds }) {
     return yield* readOsd(olds);
   }),
-  diff: Effect21.fn(function* ({
+  diff: Effect20.fn(function* ({
     news,
     output
   }) {
@@ -2083,27 +2013,27 @@ var handlers2 = {
       return { action: "update" };
     return settled(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect21.fn(function* ({ news }) {
+  reconcile: Effect20.fn(function* ({ news }) {
     const live = yield* readOsd(news);
     if (live === undefined) {
       return yield* createOsd(news);
     }
     if (!settled(live, news)) {
-      return yield* Effect21.die(new Error(`${describe2(news)}: exists but not as declared -- live host=${live.host} ` + `device_class=${live.device_class}. Nothing here moves an OSD between hosts or ` + "reclassifies it; fix the declaration, or move it deliberately with `ceph osd crush " + "move` / `ceph osd crush set-device-class` and deploy again."));
+      return yield* Effect20.die(new Error(`${describe2(news)}: exists but not as declared -- live host=${live.host} ` + `device_class=${live.device_class}. Nothing here moves an OSD between hosts or ` + "reclassifies it; fix the declaration, or move it deliberately with `ceph osd crush " + "move` / `ceph osd crush set-device-class` and deploy again."));
     }
     return live;
   }),
-  delete: Effect21.fn(function* ({ olds }) {
+  delete: Effect20.fn(function* ({ olds }) {
     yield* destroyOsd(olds);
   })
 };
-var ProxmoxCephOsdProvider = () => Provider7.effect(ProxmoxCephOsd, Effect21.succeed(ProxmoxCephOsd.Provider.of(handlers2)));
+var ProxmoxCephOsdProvider = () => Provider7.effect(ProxmoxCephOsd, Effect20.succeed(ProxmoxCephOsd.Provider.of(handlers)));
 // src/proxmox/ceph-pool.ts
 import { Resource as Resource8 } from "alchemy";
 import { isResolved as isResolved8 } from "alchemy/Diff";
 import * as Provider8 from "alchemy/Provider";
 import * as nodes7 from "@distilled.cloud/proxmox/nodes";
-import * as Effect24 from "effect/Effect";
+import * as Effect23 from "effect/Effect";
 
 // src/proxmox/ceph-pool-form.ts
 var object = (props) => `nodes/${props.node}/ceph/pool/${props.name}`;
@@ -2132,22 +2062,22 @@ var createBody = (props) => ({
 
 // src/proxmox/ceph-pool-settle.ts
 import * as nodes5 from "@distilled.cloud/proxmox/nodes";
-import * as Effect22 from "effect/Effect";
-var confirmAbsent = (props, describe3) => runPve(props.target, "read", false, nodes5.listNodeCephPool({ node: props.node })).pipe(Effect22.flatMap((rows) => rows.some((row) => row.pool_name === props.name) ? Effect22.die(new Error(`${describe3}: the cluster lists this pool but its status could not be read, ` + "so this deploy will NOT create over it. Check that the node is up and that the " + "read role holds Sys.Audit or Datastore.Audit on / -- a create here would apply " + "pg_num to a live pool and start a PG merge.")) : Effect22.void));
-var settle = (props, read, done) => Effect22.gen(function* () {
+import * as Effect21 from "effect/Effect";
+var confirmAbsent = (props, describe3) => runPve(props.target, "read", false, nodes5.listNodeCephPool({ node: props.node })).pipe(Effect21.flatMap((rows) => rows.some((row) => row.pool_name === props.name) ? Effect21.die(new Error(`${describe3}: the cluster lists this pool but its status could not be read, ` + "so this deploy will NOT create over it. Check that the node is up and that the " + "read role holds Sys.Audit or Datastore.Audit on / -- a create here would apply " + "pg_num to a live pool and start a PG merge.")) : Effect21.void));
+var settle = (props, read, done) => Effect21.gen(function* () {
   for (let attempt = 0;attempt < 30; attempt += 1) {
     const live = yield* read(props);
     if (done(live))
       return live;
-    yield* Effect22.sleep("2 seconds");
+    yield* Effect21.sleep("2 seconds");
   }
   return yield* read(props);
 });
 
 // src/proxmox/ceph-pool-wire.ts
 import * as nodes6 from "@distilled.cloud/proxmox/nodes";
-import * as Effect23 from "effect/Effect";
-var attributesOf3 = (live, props) => {
+import * as Effect22 from "effect/Effect";
+var attributesOf4 = (live, props) => {
   const row = live;
   if (typeof row["name"] !== "string")
     return;
@@ -2169,7 +2099,7 @@ var attributesOf3 = (live, props) => {
     target_size_ratio: num(row["target_size_ratio"], UNSET)
   };
 };
-var readPoolStatus = (props) => runPve(props.target, "read", false, nodes6.getNodeCephPoolStatus({ name: props.name, node: props.node, verbose: "1" })).pipe(Effect23.map((live) => attributesOf3(live, props)), Effect23.catchTag("CephPoolNotFound", () => Effect23.succeed(undefined)));
+var readPoolStatus = (props) => runPve(props.target, "read", false, nodes6.getNodeCephPoolStatus({ name: props.name, node: props.node, verbose: "1" })).pipe(Effect22.map((live) => attributesOf4(live, props)), Effect22.catchTag("CephPoolNotFound", () => Effect22.succeed(undefined)));
 var CEPH_POOL_CREATE = "pve:POST /nodes/{node}/ceph/pool";
 var CEPH_POOL_UPDATE = "pve:PUT /nodes/{node}/ceph/pool/{name}";
 var toDistilledCreate2 = (props) => ({
@@ -2186,11 +2116,11 @@ var toDistilledUpdate = (props) => ({
 var ProxmoxCephPool = Resource8("Proxmox.CephPool", {
   defaultRemovalPolicy: "retain"
 });
-var matches3 = (attributes, props) => same(props.size, attributes.size, attributes.nosizechange) && same(props.min_size, attributes.min_size, attributes.nosizechange) && same(props.pg_autoscale_mode, attributes.pg_autoscale_mode) && same(hint(props.pg_num_min), attributes.pg_num_min, attributes.nopgchange) && same(props.crush_rule, attributes.crush_rule, attributes.crush_rule === "") && same(hint(props.target_size), attributes.target_size);
-var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect24.succeed(ProxmoxCephPool.Provider.of({
-  list: () => Effect24.succeed([]),
+var matches4 = (attributes, props) => same(props.size, attributes.size, attributes.nosizechange) && same(props.min_size, attributes.min_size, attributes.nosizechange) && same(props.pg_autoscale_mode, attributes.pg_autoscale_mode) && same(hint(props.pg_num_min), attributes.pg_num_min, attributes.nopgchange) && same(props.crush_rule, attributes.crush_rule, attributes.crush_rule === "") && same(hint(props.target_size), attributes.target_size);
+var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect23.succeed(ProxmoxCephPool.Provider.of({
+  list: () => Effect23.succeed([]),
   read: ({ olds }) => readPoolStatus(olds),
-  diff: Effect24.fn(function* ({ news, output }) {
+  diff: Effect23.fn(function* ({ news, output }) {
     if (!isResolved8(news))
       return;
     yield* guardWrite2(CEPH_POOL_CREATE, createBody(news), output === undefined);
@@ -2202,9 +2132,9 @@ var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect24.s
       yield* guardWrite2(CEPH_POOL_CREATE, createBody(news), true);
       return { action: "update" };
     }
-    return matches3(live, news) ? { action: "noop" } : { action: "update" };
+    return matches4(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect24.fn(function* ({ news }) {
+  reconcile: Effect23.fn(function* ({ news }) {
     const live = yield* readPoolStatus(news);
     let upid;
     if (live === undefined) {
@@ -2212,36 +2142,36 @@ var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect24.s
       yield* confirmAbsent(news, object(news));
       upid = yield* runPve(news.target, "provision", true, nodes7.createNodeCephPool(toDistilledCreate2(news)));
     } else {
-      const form = formToSend(matches3, live, news, updateBody(news));
+      const form = formToSend(matches4, live, news, updateBody(news));
       if (form !== undefined) {
         yield* guardWrite2(CEPH_POOL_UPDATE, updateBody(news), false);
         upid = yield* runPve(news.target, "provision", true, nodes7.putNodeCephPool(toDistilledUpdate(news)));
       }
     }
-    const after = yield* settle(news, readPoolStatus, (row) => row !== undefined && matches3(row, news));
-    if (after === undefined || !matches3(after, news)) {
-      return yield* Effect24.die(new Error(`${object(news)}: the write returned no error but the pool still does not match ` + `the declaration after 60s. PVE answered with task ${upid ?? "(none)"} -- read ` + "its log with `pvesh get /nodes/<node>/tasks/<upid>/log` to see what Ceph " + "refused."));
+    const after = yield* settle(news, readPoolStatus, (row) => row !== undefined && matches4(row, news));
+    if (after === undefined || !matches4(after, news)) {
+      return yield* Effect23.die(new Error(`${object(news)}: the write returned no error but the pool still does not match ` + `the declaration after 60s. PVE answered with task ${upid ?? "(none)"} -- read ` + "its log with `pvesh get /nodes/<node>/tasks/<upid>/log` to see what Ceph " + "refused."));
     }
     return after;
   }),
-  delete: Effect24.fn(function* ({ olds }) {
+  delete: Effect23.fn(function* ({ olds }) {
     yield* runPve(olds.target, "provision", true, nodes7.deleteNodeCephPool({ name: olds.name, node: olds.node }));
     const left = yield* settle(olds, readPoolStatus, (row) => row === undefined);
     if (left !== undefined) {
-      return yield* Effect24.die(new Error(`${object(olds)}: the DELETE returned no error but the pool is still there after ` + "60s. Either a storage on it still holds RBD images, or the mons are running " + "with mon_allow_pool_delete false."));
+      return yield* Effect23.die(new Error(`${object(olds)}: the DELETE returned no error but the pool is still there after ` + "60s. Either a storage on it still holds RBD images, or the mons are running " + "with mon_allow_pool_delete false."));
     }
   })
 })));
 // src/proxmox/firewall-alias.ts
 import { Resource as Resource9 } from "alchemy";
 import * as Provider9 from "alchemy/Provider";
-import * as Effect26 from "effect/Effect";
+import * as Effect25 from "effect/Effect";
 
 // src/proxmox/firewall-alias-lifecycle.ts
 import { isResolved as isResolved9 } from "alchemy/Diff";
-import * as cluster3 from "@distilled.cloud/proxmox/cluster";
+import * as cluster4 from "@distilled.cloud/proxmox/cluster";
 import { ProxmoxParseError as ProxmoxParseError2 } from "@distilled.cloud/proxmox/Errors";
-import * as Effect25 from "effect/Effect";
+import * as Effect24 from "effect/Effect";
 
 // src/proxmox/firewall-alias-form.ts
 var fold = (name) => name.trim().toLowerCase();
@@ -2283,20 +2213,20 @@ var firewallAliasSpec = {
 
 // src/proxmox/firewall-alias-lifecycle.ts
 var { guardCreate: guardCreate2, guardUpdate: guardUpdate2 } = specGuards(firewallAliasSpec);
-var readFirewallAlias = (props) => runPve(props.target, "read", false, cluster3.getClusterFirewallAlias({ name: props.name })).pipe(Effect25.flatMap((live) => {
+var readFirewallAlias = (props) => runPve(props.target, "read", false, cluster4.getClusterFirewallAlias({ name: props.name })).pipe(Effect24.flatMap((live) => {
   if (live === null || typeof live !== "object" || Array.isArray(live) || !("name" in live) || typeof live.name !== "string" || fold(live.name) !== fold(props.name) || !("cidr" in live) || typeof live.cidr !== "string" || cidr(live.cidr) === "") {
-    return Effect25.fail(new ProxmoxParseError2({
+    return Effect24.fail(new ProxmoxParseError2({
       body: undefined,
       cause: "Firewall alias response does not match the requested vendor identity"
     }));
   }
-  return Effect25.succeed(firewallAliasSpec.attributes({ ...live }, props));
-}), Effect25.catchTag("FirewallAliasNotFound", () => Effect25.succeed(undefined)));
-var deleteFirewallAlias = (props) => runPve(props.target, "provision", true, cluster3.deleteClusterFirewallAlias({ name: props.name }));
+  return Effect24.succeed(firewallAliasSpec.attributes({ ...live }, props));
+}), Effect24.catchTag("FirewallAliasNotFound", () => Effect24.succeed(undefined)));
+var deleteFirewallAlias = (props) => runPve(props.target, "provision", true, cluster4.deleteClusterFirewallAlias({ name: props.name }));
 var firewallAliasHandlers = {
-  list: () => Effect25.succeed([]),
+  list: () => Effect24.succeed([]),
   read: ({ olds }) => readFirewallAlias(olds),
-  diff: Effect25.fn(function* ({
+  diff: Effect24.fn(function* ({
     news,
     output
   }) {
@@ -2315,20 +2245,20 @@ var firewallAliasHandlers = {
     }
     return { action: firewallAliasSpec.matches(live, news) ? "noop" : "update" };
   }),
-  reconcile: Effect25.fn(function* ({ news }) {
+  reconcile: Effect24.fn(function* ({ news }) {
     const live = yield* readFirewallAlias(news);
     yield* guardCreate2(news, live === undefined);
     yield* guardUpdate2(news);
     if (live === undefined) {
-      yield* runPve(news.target, "provision", true, cluster3.createClusterFirewallAlias(firewallAliasSpec.createForm(news)));
+      yield* runPve(news.target, "provision", true, cluster4.createClusterFirewallAlias(firewallAliasSpec.createForm(news)));
     } else {
       const form = formToSend(firewallAliasSpec.matches, live, news, firewallAliasSpec.updateForm(news));
       if (form !== undefined)
-        yield* runPve(news.target, "provision", true, cluster3.putClusterFirewallAlias({ ...form, name: news.name }));
+        yield* runPve(news.target, "provision", true, cluster4.putClusterFirewallAlias({ ...form, name: news.name }));
     }
     const after = yield* readFirewallAlias(news);
     if (after === undefined)
-      return yield* Effect25.fail(new Error(`${firewallAliasSpec.path(news)}: write returned success but the resource is still absent`));
+      return yield* Effect24.fail(new Error(`${firewallAliasSpec.path(news)}: write returned success but the resource is still absent`));
     return after;
   }),
   delete: ({ olds }) => deleteFirewallAlias(olds)
@@ -2336,17 +2266,17 @@ var firewallAliasHandlers = {
 
 // src/proxmox/firewall-alias.ts
 var ProxmoxFirewallAlias = Resource9("Proxmox.FirewallAlias");
-var ProxmoxFirewallAliasProvider = () => Provider9.effect(ProxmoxFirewallAlias, Effect26.succeed(ProxmoxFirewallAlias.Provider.of(firewallAliasHandlers)));
+var ProxmoxFirewallAliasProvider = () => Provider9.effect(ProxmoxFirewallAlias, Effect25.succeed(ProxmoxFirewallAlias.Provider.of(firewallAliasHandlers)));
 // src/proxmox/group.ts
 import { Resource as Resource10 } from "alchemy";
 import { isResolved as isResolved10 } from "alchemy/Diff";
 import * as Provider10 from "alchemy/Provider";
 import * as access4 from "@distilled.cloud/proxmox/access";
-import * as Effect28 from "effect/Effect";
+import * as Effect27 from "effect/Effect";
 
 // src/proxmox/group-wire.ts
 import * as access3 from "@distilled.cloud/proxmox/access";
-import * as Effect27 from "effect/Effect";
+import * as Effect26 from "effect/Effect";
 var GROUP_CREATE = "pve:POST /access/groups";
 var GROUP_UPDATE = "pve:PUT /access/groups/{groupid}";
 var storedComment = (comment2) => {
@@ -2361,70 +2291,188 @@ var createForm3 = (props) => ({
   comment: storedComment(props.comment),
   groupid: props.groupid
 });
-var updateForm = (props) => ({
+var updateForm2 = (props) => ({
   comment: storedComment(props.comment),
   groupid: props.groupid
 });
-var attributesOf4 = (live, props) => ({
+var attributesOf5 = (live, props) => ({
   comment: text(live.comment),
   groupid: props.groupid,
   members: memberList(live.members)
 });
-var matches4 = (attributes, props) => attributes.comment === storedComment(props.comment);
-var readGroupOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, access3.getAccessGroup({ groupid: props.groupid }))).pipe(Effect27.map((live) => live === UNREADABLE ? UNREADABLE : live.members === undefined ? undefined : attributesOf4(live, props)));
-var readGroup = (props) => readGroupOrFail(props).pipe(Effect27.catchTag("GroupNotFound", () => Effect27.succeed(undefined)));
+var matches5 = (attributes, props) => attributes.comment === storedComment(props.comment);
+var readGroupOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, access3.getAccessGroup({ groupid: props.groupid }))).pipe(Effect26.map((live) => live === UNREADABLE ? UNREADABLE : live.members === undefined ? undefined : attributesOf5(live, props)));
+var readGroup = (props) => readGroupOrFail(props).pipe(Effect26.catchTag("GroupNotFound", () => Effect26.succeed(undefined)));
 var dropUnreadable3 = (live) => live === UNREADABLE ? undefined : live;
 
 // src/proxmox/group.ts
 var ProxmoxGroup = Resource10("Proxmox.Group", {
   defaultRemovalPolicy: "retain"
 });
-var ProxmoxGroupProvider = () => Provider10.effect(ProxmoxGroup, Effect28.succeed(ProxmoxGroup.Provider.of({
-  list: () => Effect28.succeed([]),
-  read: Effect28.fn(function* ({ olds, output }) {
+var ProxmoxGroupProvider = () => Provider10.effect(ProxmoxGroup, Effect27.succeed(ProxmoxGroup.Provider.of({
+  list: () => Effect27.succeed([]),
+  read: Effect27.fn(function* ({ olds, output }) {
     return dropUnreadable3(yield* output === undefined ? readGroup(olds) : readGroupOrFail(olds));
   }),
-  diff: Effect28.fn(function* ({ news, output }) {
+  diff: Effect27.fn(function* ({ news, output }) {
     if (!isResolved10(news))
       return;
     yield* guardWrite2(GROUP_CREATE, createForm3(news), output === undefined);
-    yield* guardWrite2(GROUP_UPDATE, updateForm(news), false);
+    yield* guardWrite2(GROUP_UPDATE, updateForm2(news), false);
     if (output === undefined)
       return;
     const live = yield* readGroupOrFail(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.Group", news.groupid);
+      yield* unreadableWarning("Proxmox.Group", news.groupid, news.target.mount, mintTier(news.target, "read"));
       return { action: "noop" };
     }
     if (live === undefined) {
       yield* guardWrite2(GROUP_CREATE, createForm3(news), true);
       return { action: "update" };
     }
-    return matches4(live, news) ? { action: "noop" } : { action: "update" };
+    return matches5(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect28.fn(function* ({ news }) {
+  reconcile: Effect27.fn(function* ({ news }) {
     const before = dropUnreadable3(yield* readGroup(news));
     yield* guardWrite2(GROUP_CREATE, createForm3(news), before === undefined);
-    yield* guardWrite2(GROUP_UPDATE, updateForm(news), false);
+    yield* guardWrite2(GROUP_UPDATE, updateForm2(news), false);
     if (before === undefined) {
       yield* runPve(news.target, "provision", true, access4.createAccessGroup(createForm3(news)));
-    } else if (!matches4(before, news)) {
-      yield* runPve(news.target, "provision", true, access4.putAccessGroup(updateForm(news)));
+    } else if (!matches5(before, news)) {
+      yield* runPve(news.target, "provision", true, access4.putAccessGroup(updateForm2(news)));
     }
     const after = dropUnreadable3(yield* readGroup(news));
     if (after === undefined) {
-      return yield* Effect28.die(new Error(`access/groups/${news.groupid}: the write returned no error but the group is ` + 'still absent. PVE wraps every answer in {"data":...} and can report success ' + "on a call that did nothing -- read back rather than trusting the status code."));
+      return yield* Effect27.die(new Error(`access/groups/${news.groupid}: the write returned no error but the group is ` + 'still absent. PVE wraps every answer in {"data":...} and can report success ' + "on a call that did nothing -- read back rather than trusting the status code."));
     }
     return after;
   }),
-  delete: Effect28.fn(function* ({ olds }) {
+  delete: Effect27.fn(function* ({ olds }) {
     yield* runPve(olds.target, "provision", true, access4.deleteAccessGroup({ groupid: olds.groupid }));
   })
 })));
 // src/proxmox/ha-resource.ts
 import { Resource as Resource11 } from "alchemy";
 import * as Provider11 from "alchemy/Provider";
+import * as Effect30 from "effect/Effect";
+
+// src/proxmox/resource.ts
+import { isResolved as isResolved11 } from "alchemy/Diff";
 import * as Effect29 from "effect/Effect";
+
+// src/proxmox/client.ts
+import * as Effect28 from "effect/Effect";
+import * as HttpClient5 from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest2 from "effect/unstable/http/HttpClientRequest";
+class PveError extends Error {
+  status;
+  method;
+  path;
+  constructor(status, method, path, detail) {
+    super(`PVE ${method} ${path} -> ${String(status)}: ${detail}`);
+    this.status = status;
+    this.method = method;
+    this.path = path;
+    this.name = "PveError";
+  }
+}
+var clusterExhausted = (method, path, attempts) => new PveError(0, method, path, `all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join("; ")}`);
+var encode = (form) => {
+  const params = new URLSearchParams;
+  for (const [key, value] of Object.entries(form)) {
+    if (typeof value === "string")
+      params.append(key, value);
+    else
+      for (const item of value)
+        params.append(key, item);
+  }
+  return params.toString();
+};
+var buildRequest = (method, apiBase, path, credential, target, form) => {
+  const url = `${apiBase}/${path}`;
+  return HttpClientRequest2.make(method)(url).pipe(HttpClientRequest2.setHeaders({ Authorization: authorization(credential, target) }), form === undefined ? (self) => self : HttpClientRequest2.bodyText(encode(form), "application/x-www-form-urlencoded"));
+};
+var executeOne = (target, credential, method, path, form, apiBase) => Effect28.gen(function* () {
+  const client = yield* HttpClient5.HttpClient;
+  const request = buildRequest(method, apiBase, path, credential, target, form);
+  return yield* client.execute(request).pipe(Effect28.mapError((cause) => new PveError(0, method, path, String(cause))));
+});
+var readResponse = (response, method, path) => Effect28.gen(function* () {
+  if (response.status < 200 || response.status >= 300) {
+    const detail = yield* response.text.pipe(Effect28.orElseSucceed(() => ""));
+    return yield* Effect28.fail(new PveError(response.status, method, path, detail.slice(0, 300)));
+  }
+  const body2 = yield* response.json.pipe(Effect28.mapError((cause) => new PveError(0, method, path, String(cause))));
+  return body2.data;
+});
+var pveWith = (target, credential, method, path, form) => Effect28.gen(function* () {
+  const response = target.scheme === "pve" ? yield* executeOnCluster(target, method, path, (apiBase) => buildRequest(method, apiBase, path, credential, target, form)).pipe(Effect28.mapError((failure) => failure.tag === "cluster" ? clusterExhausted(failure.method, failure.path, failure.attempts) : new PveError(0, method, path, String(failure)))) : yield* executeOne(target, credential, method, path, form, target.api);
+  return yield* readResponse(response, method, path);
+});
+var pve = (target, role, method, path, form) => Effect28.gen(function* () {
+  const credential = yield* leased(target, role);
+  return yield* pveWith(target, credential, method, path, form);
+});
+
+// src/proxmox/resource.ts
+var pveOperations = (spec) => {
+  const { guardCreate: guardCreate3, guardUpdate: guardUpdate3 } = specGuards(spec);
+  const read = (props) => pve(props.target, spec.readRole ?? "read", "GET", spec.path(props)).pipe(Effect29.map((data) => data == null ? undefined : spec.attributes(data, props)), Effect29.orElseSucceed(() => {
+    return;
+  }));
+  return {
+    guardCreate: guardCreate3,
+    guardUpdate: guardUpdate3,
+    read,
+    diff: (news, output) => Effect29.gen(function* () {
+      if (!isResolved11(news))
+        return;
+      yield* guardCreate3(news, output === undefined);
+      yield* guardUpdate3(news);
+      if (output === undefined)
+        return;
+      const live = yield* read(news);
+      if (live === undefined) {
+        yield* guardCreate3(news, true);
+        return { action: "update" };
+      }
+      if (spec.matches(live, news))
+        return { action: "noop" };
+      return spec.updateForm === undefined ? { action: "replace" } : { action: "update" };
+    }),
+    reconcile: (news) => Effect29.gen(function* () {
+      const live = yield* read(news);
+      yield* guardCreate3(news, live === undefined);
+      yield* guardUpdate3(news);
+      if (live === undefined) {
+        yield* pve(news.target, "provision", "POST", spec.collection(news), spec.createForm(news));
+      } else if (spec.updateForm !== undefined) {
+        const form = formToSend(spec.matches, live, news, spec.updateForm(news));
+        if (form !== undefined) {
+          yield* pve(news.target, "provision", "PUT", spec.path(news), form);
+        }
+      }
+      const after = yield* read(news);
+      if (after === undefined) {
+        return yield* Effect29.die(new Error(`${spec.path(news)}: the write returned no error but the object is still absent. ` + 'PVE wraps every answer in {"data":...} and can report success on a call that did ' + "nothing -- read back rather than trusting the status code."));
+      }
+      return after;
+    }),
+    destroy: (olds) => pve(olds.target, "provision", "DELETE", spec.path(olds))
+  };
+};
+var pveHandlers = (spec) => {
+  const ops = pveOperations(spec);
+  return {
+    list: () => Effect29.succeed([]),
+    read: ({ olds }) => ops.read(olds),
+    diff: ({ news, output }) => ops.diff(news, output),
+    reconcile: ({ news }) => ops.reconcile(news),
+    delete: ({ olds }) => ops.destroy(olds)
+  };
+};
+
+// src/proxmox/ha-resource.ts
 var ProxmoxHaResource = Resource11("Proxmox.HaResource");
 var kind = (sid) => sid.split(":")[0] ?? "";
 var shape3 = (props) => ({
@@ -2433,7 +2481,7 @@ var shape3 = (props) => ({
   max_restart: String(props.max_restart ?? 1),
   state: props.state ?? "started"
 });
-var handlers3 = pveHandlers({
+var handlers2 = pveHandlers({
   attributes: (live, props) => ({
     comment: typeof live["comment"] === "string" ? live["comment"] : "",
     max_relocate: num(live["max_relocate"], 1),
@@ -2452,11 +2500,11 @@ var handlers3 = pveHandlers({
   path: (props) => `cluster/ha/resources/${props.sid}`,
   updateForm: shape3
 });
-var ProxmoxHaResourceProvider = () => Provider11.effect(ProxmoxHaResource, Effect29.succeed(ProxmoxHaResource.Provider.of(handlers3)));
+var ProxmoxHaResourceProvider = () => Provider11.effect(ProxmoxHaResource, Effect30.succeed(ProxmoxHaResource.Provider.of(handlers2)));
 // src/proxmox/ha-rule.ts
 import { Resource as Resource12 } from "alchemy";
 import * as Provider12 from "alchemy/Provider";
-import * as Effect30 from "effect/Effect";
+import * as Effect31 from "effect/Effect";
 
 // src/proxmox/ha-rule-form.ts
 var nodeList = (value) => {
@@ -2504,7 +2552,7 @@ var clearList = (props) => Object.entries(optional(props)).filter(([, value]) =>
 
 // src/proxmox/ha-rule.ts
 var ProxmoxHaRule = Resource12("Proxmox.HaRule");
-var handlers4 = pveHandlers({
+var handlers3 = pveHandlers({
   attributes: (live, props) => {
     const liveType = text(live["type"]);
     if (liveType !== "" && liveType !== props.type)
@@ -2533,43 +2581,43 @@ var handlers4 = pveHandlers({
     return withClears(fields, clear);
   }
 });
-var ProxmoxHaRuleProvider = () => Provider12.effect(ProxmoxHaRule, Effect30.succeed(ProxmoxHaRule.Provider.of(handlers4)));
+var ProxmoxHaRuleProvider = () => Provider12.effect(ProxmoxHaRule, Effect31.succeed(ProxmoxHaRule.Provider.of(handlers3)));
 // src/proxmox/lxc.ts
 import { Resource as Resource13 } from "alchemy";
-import { isResolved as isResolved11 } from "alchemy/Diff";
+import { isResolved as isResolved12 } from "alchemy/Diff";
 import * as Provider13 from "alchemy/Provider";
-import * as Effect41 from "effect/Effect";
+import * as Effect42 from "effect/Effect";
 
 // src/ownership/adopt.ts
 import { AdoptPolicy } from "alchemy/AdoptPolicy";
 import { AlchemyContext } from "alchemy/AlchemyContext";
 import { Stack as Stack3 } from "alchemy/Stack";
-import * as Effect34 from "effect/Effect";
+import * as Effect35 from "effect/Effect";
 import * as Option5 from "effect/Option";
 
 // src/ownership/resume.ts
 import { Unowned } from "alchemy/AdoptPolicy";
 import { Artifacts } from "alchemy/Artifacts";
-import * as Effect31 from "effect/Effect";
+import * as Effect32 from "effect/Effect";
 import * as Option2 from "effect/Option";
 var PROVEN = "homeflare/ownership/resumes";
 var UNFINISHED = "homeflare/ownership/unfinished";
-var note = (key, instanceId) => Effect31.gen(function* () {
-  const bag = yield* Effect31.serviceOption(Artifacts);
+var note = (key, instanceId) => Effect32.gen(function* () {
+  const bag = yield* Effect32.serviceOption(Artifacts);
   if (Option2.isSome(bag))
     yield* bag.value.set(key, instanceId);
 });
-var noted = (key, instanceId) => Effect31.gen(function* () {
-  const bag = yield* Effect31.serviceOption(Artifacts);
+var noted = (key, instanceId) => Effect32.gen(function* () {
+  const bag = yield* Effect32.serviceOption(Artifacts);
   if (Option2.isNone(bag))
     return false;
   return (yield* bag.value.get(key)) === instanceId;
 });
-var noteUnfinished = (instanceId) => Effect31.as(note(UNFINISHED, instanceId), undefined);
-var noteResume = (instanceId, recovered) => Effect31.gen(function* () {
+var noteUnfinished = (instanceId) => Effect32.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect32.gen(function* () {
   yield* noteUnfinished(instanceId);
-  const unproven = () => Effect31.succeed(undefined);
-  const found = yield* recovered.pipe(Effect31.catch(unproven), Effect31.catchDefect(unproven));
+  const unproven = () => Effect32.succeed(undefined);
+  const found = yield* recovered.pipe(Effect32.catch(unproven), Effect32.catchDefect(unproven));
   if (found === undefined || found === null || Unowned.is(found))
     return;
   yield* note(PROVEN, instanceId);
@@ -2580,7 +2628,7 @@ var provingResumes = (service) => {
   const { diff, read } = service;
   if (diff === undefined || read === undefined)
     return service;
-  const proving = (input) => Effect31.gen(function* () {
+  const proving = (input) => Effect32.gen(function* () {
     if (input.output === undefined) {
       yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
     }
@@ -2592,12 +2640,12 @@ var provingResumes = (service) => {
 // src/ownership/rows.ts
 import { Stack as Stack2 } from "alchemy/Stack";
 import { State, isActionState } from "alchemy/State/State";
-import * as Effect33 from "effect/Effect";
+import * as Effect34 from "effect/Effect";
 import * as Option4 from "effect/Option";
 
 // src/ownership/whole.ts
 import { Stack } from "alchemy/Stack";
-import * as Effect32 from "effect/Effect";
+import * as Effect33 from "effect/Effect";
 import * as Option3 from "effect/Option";
 var absent = (value) => value === undefined || value === null;
 var isPlainObject = (value) => {
@@ -2623,22 +2671,22 @@ var carries = (declared, recorded) => {
   }
   return true;
 };
-var wholeDeclaration = (fqn, props) => Effect32.map(Effect32.serviceOption(Stack), (stack) => {
+var wholeDeclaration = (fqn, props) => Effect33.map(Effect33.serviceOption(Stack), (stack) => {
   const declared = Option3.isSome(stack) ? stack.value.resources[fqn] : undefined;
   return declared !== undefined && carries(declared.Props, props);
 });
 
 // src/ownership/rows.ts
-var storeOf = Effect33.gen(function* () {
-  const stack = yield* Effect33.serviceOption(Stack2);
-  const state = yield* Effect33.serviceOption(State);
+var storeOf = Effect34.gen(function* () {
+  const stack = yield* Effect34.serviceOption(Stack2);
+  const state = yield* Effect34.serviceOption(State);
   if (Option4.isNone(stack) || Option4.isNone(state))
     return;
   const store = yield* state.value;
   const where = { stack: stack.value.name, stage: stack.value.stage };
   return { resources: stack.value.resources, store, where };
 });
-var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect33.orElseSucceed(() => {
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect34.orElseSucceed(() => {
   return;
 }));
 var generationOf = (row, instanceId) => {
@@ -2651,7 +2699,7 @@ var generationOf = (row, instanceId) => {
   }
   return;
 };
-var recordedGeneration = (fqn, instanceId) => Effect33.gen(function* () {
+var recordedGeneration = (fqn, instanceId) => Effect34.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return;
@@ -2662,14 +2710,14 @@ var recordedGeneration = (fqn, instanceId) => Effect33.gen(function* () {
   }
   return;
 });
-var recordedInstance = (fqn, instanceId) => Effect33.gen(function* () {
+var recordedInstance = (fqn, instanceId) => Effect34.gen(function* () {
   const generation = yield* recordedGeneration(fqn, instanceId);
   if (generation === undefined)
     return "absent";
   return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
 });
-var isCreate = (fqn, instanceId) => Effect33.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
-var forgetRefusedCreate = (fqn, instanceId) => Effect33.gen(function* () {
+var isCreate = (fqn, instanceId) => Effect34.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var forgetRefusedCreate = (fqn, instanceId) => Effect34.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return;
@@ -2678,32 +2726,32 @@ var forgetRefusedCreate = (fqn, instanceId) => Effect33.gen(function* () {
   if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
     return;
   }
-  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect33.ignore);
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect34.ignore);
 });
 
 // src/ownership/adopt.ts
-var adoptEnabled = (fqn) => Effect34.gen(function* () {
-  const stack = yield* Effect34.serviceOption(Stack3);
+var adoptEnabled = (fqn) => Effect35.gen(function* () {
+  const stack = yield* Effect35.serviceOption(Stack3);
   const scoped = Option5.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
   if (scoped !== undefined)
     return scoped;
-  const policy = yield* Effect34.serviceOption(AdoptPolicy);
+  const policy = yield* Effect35.serviceOption(AdoptPolicy);
   if (Option5.isSome(policy))
     return policy.value;
-  const context = yield* Effect34.serviceOption(AlchemyContext);
+  const context = yield* Effect35.serviceOption(AlchemyContext);
   return Option5.isSome(context) ? context.value.adopt : false;
 });
-var adoptable = (owner) => Effect34.gen(function* () {
+var adoptable = (owner) => Effect35.gen(function* () {
   if (yield* isCreate(owner.fqn, owner.instanceId))
     return true;
   return yield* unfinished(owner.instanceId);
 });
-var adoptsAtApply = (owner) => Effect34.gen(function* () {
+var adoptsAtApply = (owner) => Effect35.gen(function* () {
   if (!(yield* adoptEnabled(owner.fqn)))
     return false;
   return yield* adoptable(owner);
 });
-var refuseTakeover = (owner, what) => Effect34.gen(function* () {
+var refuseTakeover = (owner, what) => Effect35.gen(function* () {
   if (owner.output !== undefined)
     return;
   if (yield* resumes(owner.instanceId))
@@ -2713,25 +2761,25 @@ var refuseTakeover = (owner, what) => Effect34.gen(function* () {
     return;
   yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
   const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
-  return yield* Effect34.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+  return yield* Effect35.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
 });
 var claimFor = (owner) => (what) => refuseTakeover(owner, what);
 
 // src/ownership/probe.ts
 import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
-import * as Effect35 from "effect/Effect";
-var provenOurs = (ask, settled2) => Effect35.gen(function* () {
+import * as Effect36 from "effect/Effect";
+var provenOurs = (ask, settled2) => Effect36.gen(function* () {
   const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
   if (recorded === "absent")
     return false;
   if (recorded === "partial") {
-    yield* Effect35.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
+    yield* Effect36.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
     return false;
   }
-  const unproven = (reason) => Effect35.as(Effect35.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
-  return yield* settled2.pipe(Effect35.catch(unproven), Effect35.catchDefect(unproven));
+  const unproven = (reason) => Effect36.as(Effect36.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
+  return yield* settled2.pipe(Effect36.catch(unproven), Effect36.catchDefect(unproven));
 });
-var ownedRead = (ask, found, settled2) => Effect35.gen(function* () {
+var ownedRead = (ask, found, settled2) => Effect36.gen(function* () {
   if (found === undefined || ask.output !== undefined)
     return found;
   return (yield* provenOurs(ask, settled2)) ? found : Unowned2(found);
@@ -2789,8 +2837,8 @@ var optionMap = (value, family, defaultKey) => {
   return out;
 };
 var sameMap = (left, right) => left.size === right.size && [...left].every(([key, value]) => right.get(key) === value);
-var sortedForm = (map13) => [...map13].map(([key, value]) => `${key}=${value}`).sort().join(",");
-var printMap = (map13, lead = []) => [...lead.filter((key) => map13.has(key)), ...[...map13.keys()].filter((k) => !lead.includes(k))].map((key) => `${key}=${map13.get(key) ?? ""}`).join(",");
+var sortedForm = (map14) => [...map14].map(([key, value]) => `${key}=${value}`).sort().join(",");
+var printMap = (map14, lead = []) => [...lead.filter((key) => map14.has(key)), ...[...map14.keys()].filter((k) => !lead.includes(k))].map((key) => `${key}=${map14.get(key) ?? ""}`).join(",");
 var netMaps = (declared, live) => {
   const want = optionMap(declared, "net");
   const have = optionMap(live, "net");
@@ -3186,11 +3234,11 @@ var identityRefusals = (news, olds, output) => {
 };
 
 // src/proxmox/lxc-adoption.ts
-import * as Effect40 from "effect/Effect";
+import * as Effect41 from "effect/Effect";
 
 // src/ownership/adopting.ts
-import * as Effect36 from "effect/Effect";
-var adopting = (owner, settled2) => Effect36.gen(function* () {
+import * as Effect37 from "effect/Effect";
+var adopting = (owner, settled2) => Effect37.gen(function* () {
   if (owner.output === undefined)
     return false;
   const generation = yield* recordedGeneration(owner.fqn, owner.instanceId);
@@ -3202,7 +3250,7 @@ var adopting = (owner, settled2) => Effect36.gen(function* () {
 });
 
 // src/proxmox/lxc-lifecycle.ts
-import * as Effect39 from "effect/Effect";
+import * as Effect40 from "effect/Effect";
 import * as nodes10 from "@distilled.cloud/proxmox/nodes";
 
 // src/proxmox/lxc-errors.ts
@@ -3211,44 +3259,44 @@ class LxcRefusedError extends Error {
 }
 
 // src/proxmox/lxc-read.ts
-import * as cluster4 from "@distilled.cloud/proxmox/cluster";
+import * as cluster5 from "@distilled.cloud/proxmox/cluster";
 import * as nodes8 from "@distilled.cloud/proxmox/nodes";
-import * as Effect37 from "effect/Effect";
-var readLive = (where) => Effect37.gen(function* () {
+import * as Effect38 from "effect/Effect";
+var readLive = (where) => Effect38.gen(function* () {
   const credential = yield* leased(where.target, "read");
-  const answer = yield* runPveWith(where.target, credential, false, nodes8.getNodeLxcConfig({ node: where.node, vmid: String(where.vmid) })).pipe(Effect37.map((data) => ({ data, error: undefined })), Effect37.catchTag("LxcConfigNotFound", (error) => Effect37.succeed({ data: undefined, error })));
+  const answer = yield* runPveWith(where.target, credential, false, nodes8.getNodeLxcConfig({ node: where.node, vmid: String(where.vmid) })).pipe(Effect38.map((data) => ({ data, error: undefined })), Effect38.catchTag("LxcConfigNotFound", (error) => Effect38.succeed({ data: undefined, error })));
   if (answer.error === undefined) {
     const live = answer.data;
     if (live === null || typeof live !== "object" || Array.isArray(live) || !("digest" in live) || typeof live.digest !== "string" || live.digest === "") {
-      return yield* Effect37.fail(new LxcRefusedError(`CT ${String(where.vmid)}: config read did not return a valid digest-bearing config.`));
+      return yield* Effect38.fail(new LxcRefusedError(`CT ${String(where.vmid)}: config read did not return a valid digest-bearing config.`));
     }
     return live;
   }
-  const rows = yield* runPveWith(where.target, credential, false, cluster4.listClusterResources({ type: "vm" }));
+  const rows = yield* runPveWith(where.target, credential, false, cluster5.listClusterResources({ type: "vm" }));
   if (!Array.isArray(rows) || rows.some((row) => !Number.isSafeInteger(Number(row?.vmid)) || Number(row?.vmid) <= 0 || typeof row?.node !== "string" || row.node === "" || !["lxc", "qemu"].includes(row.type))) {
-    return yield* Effect37.fail(new LxcRefusedError("The cluster guest index did not identify its rows."));
+    return yield* Effect38.fail(new LxcRefusedError("The cluster guest index did not identify its rows."));
   }
   const found = rows.find((row) => Number(row.vmid) === where.vmid);
   if (found !== undefined && found.node === where.node && found.type === "lxc") {
-    return yield* Effect37.fail(answer.error);
+    return yield* Effect38.fail(answer.error);
   }
   if (found !== undefined) {
-    return yield* Effect37.fail(new LxcRefusedError(`vmid ${String(where.vmid)} is a ${text(found.type, "guest")} on ` + `${text(found.node, "?")}, not a container on ${where.node}. A migration is not an ` + "update and vmids are cluster-wide: declare the node it is on, or pick a free vmid."));
+    return yield* Effect38.fail(new LxcRefusedError(`vmid ${String(where.vmid)} is a ${text(found.type, "guest")} on ` + `${text(found.node, "?")}, not a container on ${where.node}. A migration is not an ` + "update and vmids are cluster-wide: declare the node it is on, or pick a free vmid."));
   }
   return;
 });
 
 // src/proxmox/lxc-task.ts
 import * as nodes9 from "@distilled.cloud/proxmox/nodes";
-import * as Effect38 from "effect/Effect";
-var lxcTask = (where, operation, what, polls) => Effect38.gen(function* () {
+import * as Effect39 from "effect/Effect";
+var lxcTask = (where, operation, what, polls) => Effect39.gen(function* () {
   const credential = yield* mint(where.target, "provision");
   const upid = text(yield* runPveWith(where.target, credential, true, operation));
   if (upid === "")
-    return yield* Effect38.fail(new LxcRefusedError(`${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`));
+    return yield* Effect39.fail(new LxcRefusedError(`${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`));
   let exit = "still running when this provider stopped waiting";
   for (let attempt = 0;attempt < polls; attempt++) {
-    const status = yield* runPveWith(where.target, credential, false, nodes9.getNodeTaskStatus({ node: where.node, upid })).pipe(Effect38.orElseSucceed(() => {
+    const status = yield* runPveWith(where.target, credential, false, nodes9.getNodeTaskStatus({ node: where.node, upid })).pipe(Effect39.orElseSucceed(() => {
       return;
     }));
     if (status === undefined || status.status === undefined) {
@@ -3259,10 +3307,10 @@ var lxcTask = (where, operation, what, polls) => Effect38.gen(function* () {
       exit = text(status.exitstatus, "stopped with no exitstatus");
       break;
     }
-    yield* Effect38.sleep("1 second");
+    yield* Effect39.sleep("1 second");
   }
   if (exit !== "OK")
-    return yield* Effect38.fail(new LxcRefusedError(`${what}: task ${upid} ended "${exit}". Read \`pvesh get /nodes/${where.node}/tasks/` + `${upid}/log\` before running the deploy again.`));
+    return yield* Effect39.fail(new LxcRefusedError(`${what}: task ${upid} ended "${exit}". Read \`pvesh get /nodes/${where.node}/tasks/` + `${upid}/log\` before running the deploy again.`));
 });
 
 // src/proxmox/lxc-lifecycle.ts
@@ -3273,13 +3321,13 @@ var LXC_ENDPOINTS = {
 };
 var CREATE_POLLS = 180;
 var TASK_POLLS = 60;
-var attributesOf5 = (where, live) => ({
+var attributesOf6 = (where, live) => ({
   config: storedConfig(live),
   node: where.node,
   rawKeys: rawKeysOf(live),
   vmid: where.vmid
 });
-var createGuest = (props) => Effect39.gen(function* () {
+var createGuest = (props) => Effect40.gen(function* () {
   const form = createForm4(props);
   yield* guardForm(LXC_ENDPOINTS.create, form, true);
   return yield* lxcTask(props, nodes10.createNodeLxc({
@@ -3289,7 +3337,7 @@ var createGuest = (props) => Effect39.gen(function* () {
     ostemplate: text(form["ostemplate"])
   }), `create CT ${String(props.vmid)}`, CREATE_POLLS);
 });
-var updateGuest = (props, change, digest) => Effect39.gen(function* () {
+var updateGuest = (props, change, digest) => Effect40.gen(function* () {
   if (Object.keys(change.put).length > 0 || change.clear.length > 0) {
     const form = withClears({ ...change.put, ...digest === "" ? {} : { digest } }, change.clear);
     yield* guardForm(LXC_ENDPOINTS.update, form, false);
@@ -3301,47 +3349,47 @@ var updateGuest = (props, change, digest) => Effect39.gen(function* () {
     yield* lxcTask(props, nodes10.putNodeLxcResize({ ...grown, node: props.node, vmid: String(props.vmid) }), `grow ${grow.disk} of CT ${String(props.vmid)} to ${grow.size}`, TASK_POLLS);
   }
 });
-var destroyGuest = (where, declared) => Effect39.gen(function* () {
+var destroyGuest = (where, declared) => Effect40.gen(function* () {
   const live = yield* readLive(where);
   if (live === undefined)
     return;
   const drift = judge(declared, live).drift;
   if (drift.length > 0) {
-    return yield* Effect39.fail(new LxcRefusedError(`destroy CT ${String(where.vmid)}: the guest on ${where.node} no longer matches its last ` + `declaration (${drift.join(", ")}), so it may not be the guest this stack made. ` + "Nothing was deleted. Delete it by hand if it should go, or declare it again."));
+    return yield* Effect40.fail(new LxcRefusedError(`destroy CT ${String(where.vmid)}: the guest on ${where.node} no longer matches its last ` + `declaration (${drift.join(", ")}), so it may not be the guest this stack made. ` + "Nothing was deleted. Delete it by hand if it should go, or declare it again."));
   }
   yield* lxcTask(where, nodes10.deleteNodeLxc({ node: where.node, vmid: String(where.vmid) }), `destroy CT ${String(where.vmid)}`, TASK_POLLS);
 });
 
 // src/proxmox/lxc-adoption.ts
 var adoptionRefusal = (props, drift) => `CT ${String(props.vmid)} on ${props.node}: adopting it would change ${drift.join(", ")}. An ` + "adoption never changes a guest, so nothing is written. Declare what is live for these keys " + "(the plan names keys, never values) and plan again; change them after the adoption, as an " + "update.";
-var refuseAdoptedDrift = (owner, props, live, change) => Effect40.gen(function* () {
+var refuseAdoptedDrift = (owner, props, live, change) => Effect41.gen(function* () {
   if (change.drift.length === 0)
     return;
-  const settled2 = (recorded) => Effect40.sync(() => judge(recorded, live).drift.length === 0);
+  const settled2 = (recorded) => Effect41.sync(() => judge(recorded, live).drift.length === 0);
   if (!(yield* adopting(owner, settled2)))
     return;
-  return yield* Effect40.fail(new LxcRefusedError(adoptionRefusal(props, change.drift)));
+  return yield* Effect41.fail(new LxcRefusedError(adoptionRefusal(props, change.drift)));
 });
 
 // src/proxmox/lxc.ts
 var ProxmoxLxc = Resource13("Proxmox.Lxc", { defaultRemovalPolicy: "retain" });
-var refused = (reasons) => Effect41.fail(new LxcRefusedError(reasons.join(`
+var refused = (reasons) => Effect42.fail(new LxcRefusedError(reasons.join(`
 `)));
-var diff = (owner, news, olds) => Effect41.gen(function* () {
+var diff = (owner, news, olds) => Effect42.gen(function* () {
   const { output } = owner;
   const identity2 = identityRefusals(news, olds, output);
   if (identity2.length > 0)
     return yield* refused(identity2);
   if (output === undefined)
     return;
-  if (!isResolved11(news))
+  if (!isResolved12(news))
     return;
   const live = yield* readLive(news);
   if (live === undefined) {
     const refusals = createRefusals(news);
     if (refusals.length > 0)
       return yield* refused(refusals);
-    yield* Effect41.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: the cluster lists no guest with this ` + "vmid -- a deploy CREATES it again from ostemplate, with new, empty volumes.");
+    yield* Effect42.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: the cluster lists no guest with this ` + "vmid -- a deploy CREATES it again from ostemplate, with new, empty volumes.");
     return { action: "update" };
   }
   const change = judge(news, live);
@@ -3352,10 +3400,10 @@ var diff = (owner, news, olds) => Effect41.gen(function* () {
   if (change.drift.length === 0 && !moved)
     return { action: "noop" };
   const what = change.drift.length === 0 ? `the guest is on ${news.node} now, not ${output.node} -- a deploy re-records it, ` + "writing nothing." : `live config differs from the declaration in ${change.drift.join(", ")} -- a ` + "deploy writes these.";
-  yield* Effect41.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: ${what}`);
+  yield* Effect42.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: ${what}`);
   return { action: "update" };
 });
-var reconcile = (owner, news) => Effect41.gen(function* () {
+var reconcile = (owner, news) => Effect42.gen(function* () {
   const { output } = owner;
   const identity2 = identityRefusals(news, news, output);
   if (identity2.length > 0)
@@ -3394,22 +3442,22 @@ var reconcile = (owner, news) => Effect41.gen(function* () {
       `CT ${String(news.vmid)}: after the write, ${left.join(", ")} still differ from the ` + "declaration. PVE may have normalised the value (tags are lower-cased by default) -- " + "declare what it stores."
     ]);
   }
-  return attributesOf5(news, after);
+  return attributesOf6(news, after);
 });
 var whereOf = (olds, output) => ({
   node: output?.node ?? olds.node,
   target: olds.target,
   vmid: output?.vmid ?? olds.vmid
 });
-var read = (owner, olds) => Effect41.gen(function* () {
+var read = (owner, olds) => Effect42.gen(function* () {
   const where = whereOf(olds, owner.output);
   const live = yield* readLive(where);
   if (live === undefined)
     return;
-  const settled2 = Effect41.sync(() => judge(olds, live).drift.length === 0);
-  return yield* ownedRead(owner, attributesOf5(where, live), settled2);
+  const settled2 = Effect42.sync(() => judge(olds, live).drift.length === 0);
+  return yield* ownedRead(owner, attributesOf6(where, live), settled2);
 });
-var handlers5 = {
+var handlers4 = {
   delete: ({ olds, output }) => destroyGuest(whereOf(olds, output), olds),
   diff: ({
     fqn,
@@ -3418,7 +3466,7 @@ var handlers5 = {
     olds,
     output
   }) => diff({ fqn, instanceId, output }, news, olds),
-  list: () => Effect41.succeed([]),
+  list: () => Effect42.succeed([]),
   read: ({
     fqn,
     instanceId,
@@ -3432,11 +3480,11 @@ var handlers5 = {
     output
   }) => reconcile({ fqn, instanceId, output }, news)
 };
-var ProxmoxLxcProvider = () => Provider13.effect(ProxmoxLxc, Effect41.succeed(ProxmoxLxc.Provider.of(handlers5)).pipe(Effect41.map(provingResumes)));
+var ProxmoxLxcProvider = () => Provider13.effect(ProxmoxLxc, Effect42.succeed(ProxmoxLxc.Provider.of(handlers4)).pipe(Effect42.map(provingResumes)));
 // src/proxmox/metric-server.ts
 import { Resource as Resource14 } from "alchemy";
-import { isResolved as isResolved12 } from "alchemy/Diff";
-import * as cluster6 from "@distilled.cloud/proxmox/cluster";
+import { isResolved as isResolved13 } from "alchemy/Diff";
+import * as cluster7 from "@distilled.cloud/proxmox/cluster";
 
 // src/proxmox/metric-server-form.ts
 var UNSET2 = -1;
@@ -3550,15 +3598,15 @@ var metricServerSpec = {
 };
 
 // src/proxmox/metric-server-distilled.ts
-import * as cluster5 from "@distilled.cloud/proxmox/cluster";
+import * as cluster6 from "@distilled.cloud/proxmox/cluster";
 import { ProxmoxParseError as ProxmoxParseError3 } from "@distilled.cloud/proxmox/Errors";
-import * as Effect42 from "effect/Effect";
+import * as Effect43 from "effect/Effect";
 import * as Schema2 from "effect/Schema";
-var readMetricServerRow = (props) => runPve(props.target, "read", false, cluster5.getClusterMetricsServer({ id: props.id })).pipe(Effect42.flatMap((body4) => Schema2.decodeUnknownEffect(Schema2.Record(Schema2.String, Schema2.Unknown))(body4).pipe(Effect42.mapError(() => new ProxmoxParseError3({
+var readMetricServerRow = (props) => runPve(props.target, "read", false, cluster6.getClusterMetricsServer({ id: props.id })).pipe(Effect43.flatMap((body4) => Schema2.decodeUnknownEffect(Schema2.Record(Schema2.String, Schema2.Unknown))(body4).pipe(Effect43.mapError(() => new ProxmoxParseError3({
   body: undefined,
   cause: "Metric server response must be an object"
-})))), Effect42.catchTag("MetricServerNotFound", () => Effect42.succeed(undefined)), Effect42.catchTag("NotFound", () => Effect42.succeed(undefined)));
-var readMetricServer = (props) => readMetricServerRow(props).pipe(Effect42.map((row) => row === undefined ? undefined : metricServerSpec.attributes(row, props)));
+})))), Effect43.catchTag("MetricServerNotFound", () => Effect43.succeed(undefined)), Effect43.catchTag("NotFound", () => Effect43.succeed(undefined)));
+var readMetricServer = (props) => readMetricServerRow(props).pipe(Effect43.map((row) => row === undefined ? undefined : metricServerSpec.attributes(row, props)));
 var metricServerRequest = (props, form) => ({
   ...asForm2({
     api_path_prefix: form["api-path-prefix"],
@@ -3583,22 +3631,22 @@ var metricServerRequest = (props, form) => ({
   port: String(props.port),
   server: props.server
 });
-var deleteMetricServer = (props) => Effect42.gen(function* () {
+var deleteMetricServer = (props) => Effect43.gen(function* () {
   if ((yield* readMetricServerRow(props)) === undefined)
     return;
-  yield* runPve(props.target, "provision", true, cluster5.deleteClusterMetricsServer({ id: props.id }));
+  yield* runPve(props.target, "provision", true, cluster6.deleteClusterMetricsServer({ id: props.id }));
 });
 
 // src/proxmox/metric-server.ts
 import * as Provider14 from "alchemy/Provider";
-import * as Effect43 from "effect/Effect";
+import * as Effect44 from "effect/Effect";
 var ProxmoxMetricServer = Resource14("Proxmox.MetricServer");
 var { guardCreate: guardCreate3, guardUpdate: guardUpdate3 } = specGuards(metricServerSpec);
-var ProxmoxMetricServerProvider = () => Provider14.effect(ProxmoxMetricServer, Effect43.succeed(ProxmoxMetricServer.Provider.of({
-  list: () => Effect43.succeed([]),
+var ProxmoxMetricServerProvider = () => Provider14.effect(ProxmoxMetricServer, Effect44.succeed(ProxmoxMetricServer.Provider.of({
+  list: () => Effect44.succeed([]),
   read: ({ olds }) => readMetricServer(olds),
-  diff: Effect43.fn(function* ({ news, output }) {
-    if (!isResolved12(news))
+  diff: Effect44.fn(function* ({ news, output }) {
+    if (!isResolved13(news))
       return;
     yield* guardCreate3(news, output === undefined);
     yield* guardUpdate3(news);
@@ -3611,36 +3659,36 @@ var ProxmoxMetricServerProvider = () => Provider14.effect(ProxmoxMetricServer, E
     }
     return { action: metricServerSpec.matches(live, news) ? "noop" : "update" };
   }),
-  reconcile: Effect43.fn(function* ({ news }) {
+  reconcile: Effect44.fn(function* ({ news }) {
     const live = yield* readMetricServer(news);
     yield* guardCreate3(news, live === undefined);
     yield* guardUpdate3(news);
     if (live === undefined) {
-      yield* runPve(news.target, "provision", true, cluster6.updateClusterMetricsServer({
+      yield* runPve(news.target, "provision", true, cluster7.updateClusterMetricsServer({
         ...metricServerRequest(news, metricServerSpec.createForm(news)),
         type: news.type
       }));
     } else {
       const form = formToSend(metricServerSpec.matches, live, news, metricServerSpec.updateForm(news));
       if (form !== undefined)
-        yield* runPve(news.target, "provision", true, cluster6.putClusterMetricsServer(metricServerRequest(news, form)));
+        yield* runPve(news.target, "provision", true, cluster7.putClusterMetricsServer(metricServerRequest(news, form)));
     }
     const after = yield* readMetricServer(news);
     if (after === undefined)
-      return yield* Effect43.fail(new Error(`${metricServerSpec.path(news)}: write returned success but the resource is still absent`));
+      return yield* Effect44.fail(new Error(`${metricServerSpec.path(news)}: write returned success but the resource is still absent`));
     return after;
   }),
   delete: ({ olds }) => deleteMetricServer(olds)
 })));
 // src/proxmox/network-apply.ts
 import { Resource as Resource15 } from "alchemy";
-import { isResolved as isResolved13 } from "alchemy/Diff";
+import { isResolved as isResolved14 } from "alchemy/Diff";
 import * as Provider15 from "alchemy/Provider";
-import * as Effect46 from "effect/Effect";
+import * as Effect47 from "effect/Effect";
 
 // src/proxmox/network-apply-run.ts
 import * as nodes12 from "@distilled.cloud/proxmox/nodes";
-import * as Effect45 from "effect/Effect";
+import * as Effect46 from "effect/Effect";
 
 // src/proxmox/apply-endpoints.ts
 var NETWORK_APPLY_ENDPOINT = "pve:PUT /nodes/{node}/network";
@@ -3649,10 +3697,10 @@ var guardNetworkApply = guardForm(NETWORK_APPLY_ENDPOINT, {}, true);
 var guardSdnApply = guardForm(SDN_APPLY_ENDPOINT, {}, true);
 
 // src/proxmox/network-apply-read.ts
-import * as cluster7 from "@distilled.cloud/proxmox/cluster";
+import * as cluster8 from "@distilled.cloud/proxmox/cluster";
 import * as nodes11 from "@distilled.cloud/proxmox/nodes";
-import * as Effect44 from "effect/Effect";
-var stagedDiff = (target, node) => Effect44.gen(function* () {
+import * as Effect45 from "effect/Effect";
+var stagedDiff = (target, node) => Effect45.gen(function* () {
   const credential = yield* leased(target, "read");
   const live = yield* runPveWith(target, credential, false, nodes11.listNodeNetwork({ node }));
   return Array.isArray(live) ? "" : live.changes;
@@ -3664,36 +3712,36 @@ var pendingLines = (diff2) => {
 `).filter((line) => (line.startsWith("+") || line.startsWith("-")) && !line.startsWith("+++") && !line.startsWith("---")).length;
   return Math.max(changed, 1);
 };
-var pendingCount = (target, node) => stagedDiff(target, node).pipe(Effect44.map(pendingLines));
-var clusterHealth = (target) => runPve(target, "read", false, cluster7.listClusterStatus({})).pipe(Effect44.map((rows) => {
+var pendingCount = (target, node) => stagedDiff(target, node).pipe(Effect45.map(pendingLines));
+var clusterHealth = (target) => runPve(target, "read", false, cluster8.listClusterStatus({})).pipe(Effect45.map((rows) => {
   const all = rows ?? [];
-  const cluster8 = all.find((row) => row.type === "cluster");
+  const cluster9 = all.find((row) => row.type === "cluster");
   return {
     offline: all.filter((row) => row.type === "node" && !bool(row.online)).map((row) => text(row.name, "<unnamed>")),
-    quorate: cluster8 === undefined ? true : bool(cluster8.quorate)
+    quorate: cluster9 === undefined ? true : bool(cluster9.quorate)
   };
 }));
-var degradedReason = (target) => clusterHealth(target).pipe(Effect44.map((health) => health.quorate && health.offline.length === 0 ? undefined : `quorate=${String(health.quorate)} offline=[${health.offline.join(", ")}]`));
+var degradedReason = (target) => clusterHealth(target).pipe(Effect45.map((health) => health.quorate && health.offline.length === 0 ? undefined : `quorate=${String(health.quorate)} offline=[${health.offline.join(", ")}]`));
 var UNREACHABLE = "the task could not be read -- the node stopped answering, or this lease cannot see it";
 var STILL_RUNNING = "still running when this provider stopped waiting";
 var ATTEMPTS = 30;
-var awaitTask = (target, credential, node, upid, attempts = ATTEMPTS) => Effect44.gen(function* () {
+var awaitTask = (target, credential, node, upid, attempts = ATTEMPTS) => Effect45.gen(function* () {
   for (let attempt = 0;attempt < attempts; attempt += 1) {
-    const status = yield* runPveWith(target, credential, false, nodes11.getNodeTaskStatus({ node, upid })).pipe(Effect44.orElseSucceed(() => {
+    const status = yield* runPveWith(target, credential, false, nodes11.getNodeTaskStatus({ node, upid })).pipe(Effect45.orElseSucceed(() => {
       return;
     }));
     if (status === undefined)
       return UNREACHABLE;
     if (status.status === "stopped")
       return text(status.exitstatus, "stopped with no exitstatus");
-    yield* Effect44.sleep("1 second");
+    yield* Effect45.sleep("1 second");
   }
   return STILL_RUNNING;
 });
 
 // src/proxmox/network-apply-run.ts
-var refuse = (node, why) => Effect45.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));
-var applyNetwork = (props) => Effect45.gen(function* () {
+var refuse = (node, why) => Effect46.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));
+var applyNetwork = (props) => Effect46.gen(function* () {
   const node = props.node;
   const staged = yield* pendingCount(props.target, node);
   if (staged === 0)
@@ -3725,27 +3773,27 @@ var applyNetwork = (props) => Effect45.gen(function* () {
 
 // src/proxmox/network-apply.ts
 var ProxmoxNetworkApply = Resource15("Proxmox.NetworkApply");
-var read2 = (props) => pendingCount(props.target, props.node).pipe(Effect46.map((pending) => ({ node: props.node, pending })));
-var diff2 = (news) => Effect46.gen(function* () {
-  if (!isResolved13(news))
+var read2 = (props) => pendingCount(props.target, props.node).pipe(Effect47.map((pending) => ({ node: props.node, pending })));
+var diff2 = (news) => Effect47.gen(function* () {
+  if (!isResolved14(news))
     return;
   const { pending } = yield* read2(news);
   return pending === 0 ? { action: "noop" } : { action: "update" };
 });
-var handlers6 = {
-  delete: () => Effect46.void,
+var handlers5 = {
+  delete: () => Effect47.void,
   diff: ({ news }) => diff2(news),
-  list: () => Effect46.succeed([]),
+  list: () => Effect47.succeed([]),
   read: ({ olds }) => read2(olds),
   reconcile: ({ news }) => applyNetwork(news)
 };
-var ProxmoxNetworkApplyProvider = () => Provider15.effect(ProxmoxNetworkApply, Effect46.succeed(ProxmoxNetworkApply.Provider.of(handlers6)));
+var ProxmoxNetworkApplyProvider = () => Provider15.effect(ProxmoxNetworkApply, Effect47.succeed(ProxmoxNetworkApply.Provider.of(handlers5)));
 // src/proxmox/node-network.ts
 import { Resource as Resource16 } from "alchemy";
-import { isResolved as isResolved14 } from "alchemy/Diff";
+import { isResolved as isResolved15 } from "alchemy/Diff";
 import * as Provider16 from "alchemy/Provider";
 import * as nodes14 from "@distilled.cloud/proxmox/nodes";
-import * as Effect48 from "effect/Effect";
+import * as Effect49 from "effect/Effect";
 
 // src/proxmox/node-network-form.ts
 var NODE_NETWORK_CREATE = "pve:POST /nodes/{node}/network";
@@ -3778,7 +3826,7 @@ var createForm5 = (props) => ({
   ...body4(props),
   iface: props.iface
 });
-var updateForm2 = (props) => {
+var updateForm3 = (props) => {
   const clear = [
     ...props.cidr === undefined ? ["cidr"] : [],
     ...props.bridge_vlan_aware === false ? ["bridge_vlan_aware"] : []
@@ -3788,8 +3836,8 @@ var updateForm2 = (props) => {
 
 // src/proxmox/node-network-wire.ts
 import * as nodes13 from "@distilled.cloud/proxmox/nodes";
-import * as Effect47 from "effect/Effect";
-var attributesOf6 = (live, props) => {
+import * as Effect48 from "effect/Effect";
+var attributesOf7 = (live, props) => {
   const data = live;
   const liveType = text(data["type"]);
   if (liveType !== "" && liveType !== props.type)
@@ -3822,16 +3870,16 @@ var attributesOf6 = (live, props) => {
     "vlan-raw-device": text(data["vlan-raw-device"])
   };
 };
-var readInterfaceOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, nodes13.getNodeNetwork({ iface: props.iface, node: props.node })).pipe(Effect47.catchTag("NetworkInterfaceNotFound", () => Effect47.succeed(undefined)))).pipe(Effect47.map((live) => {
+var readInterfaceOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, nodes13.getNodeNetwork({ iface: props.iface, node: props.node })).pipe(Effect48.catchTag("NetworkInterfaceNotFound", () => Effect48.succeed(undefined)))).pipe(Effect48.map((live) => {
   if (live === UNREADABLE)
     return UNREADABLE;
-  return live === undefined ? undefined : attributesOf6(live, props);
+  return live === undefined ? undefined : attributesOf7(live, props);
 }));
-var readInterface = (props) => readInterfaceOrFail(props).pipe(Effect47.orElseSucceed(() => {
+var readInterface = (props) => readInterfaceOrFail(props).pipe(Effect48.orElseSucceed(() => {
   return;
 }));
 var dropUnreadable4 = (live) => live === UNREADABLE ? undefined : live;
-var matches5 = (attributes, props) => attributes.cidr === (props.cidr ?? "") && same2(props.gateway, attributes.gateway) && same2(props.autostart, attributes.autostart) && same2(props.mtu, attributes.mtu) && sameComment(props.comments, attributes.comments) && sameList(props.bridge_ports, attributes.bridge_ports) && sameList(props.bridge_vids, attributes.bridge_vids) && same2(props.bridge_vlan_aware, attributes.bridge_vlan_aware) && sameList(props.slaves, attributes.slaves) && same2(props.bond_mode, attributes.bond_mode) && same2(props.bond_xmit_hash_policy, attributes.bond_xmit_hash_policy) && same2(props["bond-primary"], attributes["bond-primary"]) && same2(props["vlan-id"], attributes["vlan-id"]) && same2(props["vlan-raw-device"], attributes["vlan-raw-device"]);
+var matches6 = (attributes, props) => attributes.cidr === (props.cidr ?? "") && same2(props.gateway, attributes.gateway) && same2(props.autostart, attributes.autostart) && same2(props.mtu, attributes.mtu) && sameComment(props.comments, attributes.comments) && sameList(props.bridge_ports, attributes.bridge_ports) && sameList(props.bridge_vids, attributes.bridge_vids) && same2(props.bridge_vlan_aware, attributes.bridge_vlan_aware) && sameList(props.slaves, attributes.slaves) && same2(props.bond_mode, attributes.bond_mode) && same2(props.bond_xmit_hash_policy, attributes.bond_xmit_hash_policy) && same2(props["bond-primary"], attributes["bond-primary"]) && same2(props["vlan-id"], attributes["vlan-id"]) && same2(props["vlan-raw-device"], attributes["vlan-raw-device"]);
 
 // src/proxmox/node-network.ts
 var ProxmoxNodeNetwork = Resource16("Proxmox.NodeNetwork", {
@@ -3848,60 +3896,60 @@ var toDistilledCreate3 = (props) => ({
   node: props.node
 });
 var toDistilledUpdate2 = (props) => ({
-  ...toDistilled(updateForm2(props)),
+  ...toDistilled(updateForm3(props)),
   iface: props.iface,
   node: props.node
 });
-var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Effect48.succeed(ProxmoxNodeNetwork.Provider.of({
-  list: () => Effect48.succeed([]),
-  read: Effect48.fn(function* ({ olds, output }) {
+var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Effect49.succeed(ProxmoxNodeNetwork.Provider.of({
+  list: () => Effect49.succeed([]),
+  read: Effect49.fn(function* ({ olds, output }) {
     return dropUnreadable4(yield* output === undefined ? readInterface(olds) : readInterfaceOrFail(olds));
   }),
-  diff: Effect48.fn(function* ({ news, output }) {
-    if (!isResolved14(news))
+  diff: Effect49.fn(function* ({ news, output }) {
+    if (!isResolved15(news))
       return;
     yield* guardWrite2(NODE_NETWORK_CREATE, createForm5(news), output === undefined);
-    yield* guardWrite2(NODE_NETWORK_UPDATE, updateForm2(news), false);
+    yield* guardWrite2(NODE_NETWORK_UPDATE, updateForm3(news), false);
     if (output === undefined)
       return;
     const live = yield* readInterfaceOrFail(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.NodeNetwork", `${news.node}/${news.iface}`);
+      yield* unreadableWarning("Proxmox.NodeNetwork", `${news.node}/${news.iface}`, news.target.mount, mintTier(news.target, "read"));
       return { action: "noop" };
     }
     if (live === undefined) {
       yield* guardWrite2(NODE_NETWORK_CREATE, createForm5(news), true);
       return { action: "update" };
     }
-    return matches5(live, news) ? { action: "noop" } : { action: "update" };
+    return matches6(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect48.fn(function* ({ news }) {
+  reconcile: Effect49.fn(function* ({ news }) {
     const before = dropUnreadable4(yield* readInterface(news));
     yield* guardWrite2(NODE_NETWORK_CREATE, createForm5(news), before === undefined);
-    yield* guardWrite2(NODE_NETWORK_UPDATE, updateForm2(news), false);
+    yield* guardWrite2(NODE_NETWORK_UPDATE, updateForm3(news), false);
     if (before === undefined) {
       yield* runPve(news.target, "provision", true, nodes14.createNodeNetwork(toDistilledCreate3(news)));
-    } else if (!matches5(before, news)) {
+    } else if (!matches6(before, news)) {
       yield* runPve(news.target, "provision", true, nodes14.putNodeNetwork2(toDistilledUpdate2(news)));
     }
     const after = dropUnreadable4(yield* readInterface(news));
     if (after === undefined) {
-      return yield* Effect48.die(new Error(`nodes/${news.node}/network/${news.iface}: wrote with no error, but the ` + 'interface is still absent -- PVE wraps every answer in {"data":...} and can ' + "report success on a call that did nothing, so read back rather than trust it."));
+      return yield* Effect49.die(new Error(`nodes/${news.node}/network/${news.iface}: wrote with no error, but the ` + 'interface is still absent -- PVE wraps every answer in {"data":...} and can ' + "report success on a call that did nothing, so read back rather than trust it."));
     }
     return after;
   }),
-  delete: Effect48.fn(function* ({ olds }) {
+  delete: Effect49.fn(function* ({ olds }) {
     yield* runPve(olds.target, "provision", true, nodes14.deleteNodeNetwork2({ iface: olds.iface, node: olds.node }));
   })
 })));
 // src/proxmox/notification-matcher.ts
 import { Resource as Resource17 } from "alchemy";
 import * as Provider17 from "alchemy/Provider";
-import * as Effect52 from "effect/Effect";
+import * as Effect53 from "effect/Effect";
 
 // src/proxmox/notification-matcher-lifecycle.ts
-import { isResolved as isResolved15 } from "alchemy/Diff";
-import * as Effect51 from "effect/Effect";
+import { isResolved as isResolved16 } from "alchemy/Diff";
+import * as Effect52 from "effect/Effect";
 
 // src/proxmox/notification-matcher-form.ts
 var list = (value) => Array.isArray(value) ? value.map((item) => String(item)) : [];
@@ -3978,49 +4026,49 @@ var matcherUpdateForm = (fields) => {
 };
 
 // src/proxmox/notification-matcher-distilled.ts
-import * as cluster8 from "@distilled.cloud/proxmox/cluster";
-import * as Effect50 from "effect/Effect";
+import * as cluster9 from "@distilled.cloud/proxmox/cluster";
+import * as Effect51 from "effect/Effect";
 
 // src/proxmox/notification-sdk-input.ts
 import { ProxmoxParseError as ProxmoxParseError4 } from "@distilled.cloud/proxmox/Errors";
 import * as Data2 from "effect/Data";
-import * as Effect49 from "effect/Effect";
+import * as Effect50 from "effect/Effect";
 import * as Schema3 from "effect/Schema";
 
 class NotificationRequestInvalid extends Data2.TaggedError("NotificationRequestInvalid") {
 }
-var notificationRequest = (schema, fields) => Schema3.decodeUnknownEffect(Schema3.toType(schema), { onExcessProperty: "error" })(Object.fromEntries(Object.entries(fields).map(([key, value]) => [key.replaceAll("-", "_"), value]))).pipe(Effect49.mapError(() => new NotificationRequestInvalid({ operation: "PVE notification write" })));
-var notificationResponse = (schema) => (body5) => Schema3.decodeUnknownEffect(Schema3.toType(schema))(body5).pipe(Effect49.as(body5), Effect49.mapError(() => new ProxmoxParseError4({
+var notificationRequest = (schema, fields) => Schema3.decodeUnknownEffect(Schema3.toType(schema), { onExcessProperty: "error" })(Object.fromEntries(Object.entries(fields).map(([key, value]) => [key.replaceAll("-", "_"), value]))).pipe(Effect50.mapError(() => new NotificationRequestInvalid({ operation: "PVE notification write" })));
+var notificationResponse = (schema) => (body5) => Schema3.decodeUnknownEffect(Schema3.toType(schema))(body5).pipe(Effect50.as(body5), Effect50.mapError(() => new ProxmoxParseError4({
   body: undefined,
   cause: "PVE notification response does not match its SDK schema"
 })));
 
 // src/proxmox/notification-matcher-distilled.ts
-var readMatcher = (props) => runPve(props.target, "read", false, cluster8.getClusterNotificationMatcher({ name: props.name })).pipe(Effect50.flatMap(notificationResponse(cluster8.GetClusterNotificationMatcherResponse)), Effect50.map((live) => matcherAttributes({
+var readMatcher = (props) => runPve(props.target, "read", false, cluster9.getClusterNotificationMatcher({ name: props.name })).pipe(Effect51.flatMap(notificationResponse(cluster9.GetClusterNotificationMatcherResponse)), Effect51.map((live) => matcherAttributes({
   ...live,
   "invert-match": live.invert_match,
   "match-calendar": live.match_calendar,
   "match-field": live.match_field,
   "match-severity": live.match_severity
-}, props.name)), Effect50.catchTag("NotFound", () => Effect50.succeed(undefined)));
-var createMatcher = (props) => Effect50.gen(function* () {
-  const input = yield* notificationRequest(cluster8.CreateClusterNotificationMatcherRequest, matcherCreateForm(props));
-  yield* runPve(props.target, "provision", true, cluster8.createClusterNotificationMatcher(input));
+}, props.name)), Effect51.catchTag("NotFound", () => Effect51.succeed(undefined)));
+var createMatcher = (props) => Effect51.gen(function* () {
+  const input = yield* notificationRequest(cluster9.CreateClusterNotificationMatcherRequest, matcherCreateForm(props));
+  yield* runPve(props.target, "provision", true, cluster9.createClusterNotificationMatcher(input));
 });
-var updateMatcher = (props) => Effect50.gen(function* () {
-  const input = yield* notificationRequest(cluster8.PutClusterNotificationMatcherRequest, {
+var updateMatcher = (props) => Effect51.gen(function* () {
+  const input = yield* notificationRequest(cluster9.PutClusterNotificationMatcherRequest, {
     ...matcherUpdateForm(props),
     name: props.name
   });
-  yield* runPve(props.target, "provision", true, cluster8.putClusterNotificationMatcher(input));
+  yield* runPve(props.target, "provision", true, cluster9.putClusterNotificationMatcher(input));
 });
-var deleteMatcher = (props) => runPve(props.target, "provision", true, cluster8.deleteClusterNotificationMatcher({ name: props.name })).pipe(Effect50.catchTag("NotFound", () => Effect50.void));
+var deleteMatcher = (props) => runPve(props.target, "provision", true, cluster9.deleteClusterNotificationMatcher({ name: props.name })).pipe(Effect51.catchTag("NotFound", () => Effect51.void));
 
 // src/proxmox/notification-matcher-lifecycle.ts
-var guard = (props, create) => guardForm("pve:POST /cluster/notifications/matchers", matcherCreateForm(props), create).pipe(Effect51.andThen(guardForm("pve:PUT /cluster/notifications/matchers/{name}", matcherUpdateForm(props), false)));
+var guard = (props, create) => guardForm("pve:POST /cluster/notifications/matchers", matcherCreateForm(props), create).pipe(Effect52.andThen(guardForm("pve:PUT /cluster/notifications/matchers/{name}", matcherUpdateForm(props), false)));
 var matcherHandlers = {
-  list: () => Effect51.succeed([]),
-  read: ({ olds }) => Effect51.gen(function* () {
+  list: () => Effect52.succeed([]),
+  read: ({ olds }) => Effect52.gen(function* () {
     const live = yield* readMatcher(olds);
     yield* guard(olds, live === undefined);
     return live;
@@ -4029,8 +4077,8 @@ var matcherHandlers = {
     news,
     olds,
     output
-  }) => Effect51.gen(function* () {
-    if (!isResolved15(news))
+  }) => Effect52.gen(function* () {
+    if (!isResolved16(news))
       return;
     if (olds.name !== news.name)
       return { action: "replace" };
@@ -4044,7 +4092,7 @@ var matcherHandlers = {
     }
     return { action: matcherMatches(live, news) ? "noop" : "update" };
   }),
-  reconcile: ({ news }) => Effect51.gen(function* () {
+  reconcile: ({ news }) => Effect52.gen(function* () {
     const live = yield* readMatcher(news);
     yield* guard(news, live === undefined);
     if (live === undefined)
@@ -4053,7 +4101,7 @@ var matcherHandlers = {
       yield* updateMatcher(news);
     const after = yield* readMatcher(news);
     if (after === undefined)
-      return yield* Effect51.die(new Error(`Notification matcher ${news.name}: write returned but read-back is absent.`));
+      return yield* Effect52.die(new Error(`Notification matcher ${news.name}: write returned but read-back is absent.`));
     return after;
   }),
   delete: ({ olds }) => deleteMatcher(olds)
@@ -4061,15 +4109,15 @@ var matcherHandlers = {
 
 // src/proxmox/notification-matcher.ts
 var ProxmoxNotificationMatcher = Resource17("Proxmox.NotificationMatcher");
-var ProxmoxNotificationMatcherProvider = () => Provider17.effect(ProxmoxNotificationMatcher, Effect52.succeed(ProxmoxNotificationMatcher.Provider.of(matcherHandlers)));
+var ProxmoxNotificationMatcherProvider = () => Provider17.effect(ProxmoxNotificationMatcher, Effect53.succeed(ProxmoxNotificationMatcher.Provider.of(matcherHandlers)));
 // src/proxmox/notification-target.ts
 import { Resource as Resource18 } from "alchemy";
 import * as Provider18 from "alchemy/Provider";
-import * as Effect55 from "effect/Effect";
+import * as Effect56 from "effect/Effect";
 
 // src/proxmox/notification-target-lifecycle.ts
-import { isResolved as isResolved16 } from "alchemy/Diff";
-import * as Effect54 from "effect/Effect";
+import { isResolved as isResolved17 } from "alchemy/Diff";
+import * as Effect55 from "effect/Effect";
 
 // src/proxmox/notification-target-endpoint.ts
 var ENDPOINTS = {
@@ -4152,30 +4200,30 @@ var targetSpec = {
 };
 
 // src/proxmox/notification-target-distilled.ts
-import * as cluster9 from "@distilled.cloud/proxmox/cluster";
-import * as Effect53 from "effect/Effect";
+import * as cluster10 from "@distilled.cloud/proxmox/cluster";
+import * as Effect54 from "effect/Effect";
 var read3 = (props) => {
   const request = { name: props.name };
   switch (props.type) {
     case "gotify":
-      return cluster9.getClusterNotificationEndpointGotify(request).pipe(Effect53.flatMap(notificationResponse(cluster9.GetClusterNotificationEndpointGotifyResponse)), Effect53.map((row) => ({ ...row })));
+      return cluster10.getClusterNotificationEndpointGotify(request).pipe(Effect54.flatMap(notificationResponse(cluster10.GetClusterNotificationEndpointGotifyResponse)), Effect54.map((row) => ({ ...row })));
     case "sendmail":
-      return cluster9.getClusterNotificationEndpointSendmail(request).pipe(Effect53.flatMap(notificationResponse(cluster9.GetClusterNotificationEndpointSendmailResponse)), Effect53.map((row) => ({
+      return cluster10.getClusterNotificationEndpointSendmail(request).pipe(Effect54.flatMap(notificationResponse(cluster10.GetClusterNotificationEndpointSendmailResponse)), Effect54.map((row) => ({
         ...row,
         "from-address": row.from_address,
         "mailto-user": row.mailto_user
       })));
     case "smtp":
-      return cluster9.getClusterNotificationEndpointSmtp(request).pipe(Effect53.flatMap(notificationResponse(cluster9.GetClusterNotificationEndpointSmtpResponse)), Effect53.map((row) => ({
+      return cluster10.getClusterNotificationEndpointSmtp(request).pipe(Effect54.flatMap(notificationResponse(cluster10.GetClusterNotificationEndpointSmtpResponse)), Effect54.map((row) => ({
         ...row,
         "from-address": row.from_address,
         "mailto-user": row.mailto_user
       })));
     case "webhook":
-      return cluster9.getClusterNotificationEndpointWebhook(request).pipe(Effect53.flatMap(notificationResponse(cluster9.GetClusterNotificationEndpointWebhookResponse)), Effect53.map((row) => ({ ...row })));
+      return cluster10.getClusterNotificationEndpointWebhook(request).pipe(Effect54.flatMap(notificationResponse(cluster10.GetClusterNotificationEndpointWebhookResponse)), Effect54.map((row) => ({ ...row })));
   }
 };
-var readTarget = (props) => runPve(props.target, "read", false, read3(props)).pipe(Effect53.map((row) => targetSpec.attributes(row, props)), Effect53.catchTag("NotFound", () => Effect53.succeed(undefined)));
+var readTarget = (props) => runPve(props.target, "read", false, read3(props)).pipe(Effect54.map((row) => targetSpec.attributes(row, props)), Effect54.catchTag("NotFound", () => Effect54.succeed(undefined)));
 var fields = (props, create) => {
   const form = {
     ...create ? createShape(props) : shape4(props),
@@ -4209,40 +4257,40 @@ var fields = (props, create) => {
 };
 var validateTargetWrite = (props, create) => {
   const schema = create ? {
-    sendmail: cluster9.CreateClusterNotificationEndpointSendmailRequest,
-    smtp: cluster9.CreateClusterNotificationEndpointSmtpRequest,
-    gotify: cluster9.CreateClusterNotificationEndpointGotifyRequest,
-    webhook: cluster9.CreateClusterNotificationEndpointWebhookRequest
+    sendmail: cluster10.CreateClusterNotificationEndpointSendmailRequest,
+    smtp: cluster10.CreateClusterNotificationEndpointSmtpRequest,
+    gotify: cluster10.CreateClusterNotificationEndpointGotifyRequest,
+    webhook: cluster10.CreateClusterNotificationEndpointWebhookRequest
   }[props.type] : {
-    sendmail: cluster9.PutClusterNotificationEndpointSendmailRequest,
-    smtp: cluster9.PutClusterNotificationEndpointSmtpRequest,
-    gotify: cluster9.PutClusterNotificationEndpointGotifyRequest,
-    webhook: cluster9.PutClusterNotificationEndpointWebhookRequest
+    sendmail: cluster10.PutClusterNotificationEndpointSendmailRequest,
+    smtp: cluster10.PutClusterNotificationEndpointSmtpRequest,
+    gotify: cluster10.PutClusterNotificationEndpointGotifyRequest,
+    webhook: cluster10.PutClusterNotificationEndpointWebhookRequest
   }[props.type];
-  return notificationRequest(schema, fields(props, create)).pipe(Effect53.asVoid);
+  return notificationRequest(schema, fields(props, create)).pipe(Effect54.asVoid);
 };
 var createTarget = (props) => {
   const form = fields(props, true);
-  const operation = props.type === "sendmail" ? notificationRequest(cluster9.CreateClusterNotificationEndpointSendmailRequest, form).pipe(Effect53.flatMap(cluster9.createClusterNotificationEndpointSendmail)) : props.type === "smtp" ? notificationRequest(cluster9.CreateClusterNotificationEndpointSmtpRequest, form).pipe(Effect53.flatMap(cluster9.createClusterNotificationEndpointSmtp)) : props.type === "gotify" ? notificationRequest(cluster9.CreateClusterNotificationEndpointGotifyRequest, form).pipe(Effect53.flatMap(cluster9.createClusterNotificationEndpointGotify)) : notificationRequest(cluster9.CreateClusterNotificationEndpointWebhookRequest, form).pipe(Effect53.flatMap(cluster9.createClusterNotificationEndpointWebhook));
+  const operation = props.type === "sendmail" ? notificationRequest(cluster10.CreateClusterNotificationEndpointSendmailRequest, form).pipe(Effect54.flatMap(cluster10.createClusterNotificationEndpointSendmail)) : props.type === "smtp" ? notificationRequest(cluster10.CreateClusterNotificationEndpointSmtpRequest, form).pipe(Effect54.flatMap(cluster10.createClusterNotificationEndpointSmtp)) : props.type === "gotify" ? notificationRequest(cluster10.CreateClusterNotificationEndpointGotifyRequest, form).pipe(Effect54.flatMap(cluster10.createClusterNotificationEndpointGotify)) : notificationRequest(cluster10.CreateClusterNotificationEndpointWebhookRequest, form).pipe(Effect54.flatMap(cluster10.createClusterNotificationEndpointWebhook));
   return runPve(props.target, "provision", true, operation);
 };
 var updateTarget = (props) => {
   const form = fields(props, false);
-  const operation = props.type === "sendmail" ? notificationRequest(cluster9.PutClusterNotificationEndpointSendmailRequest, form).pipe(Effect53.flatMap(cluster9.putClusterNotificationEndpointSendmail)) : props.type === "smtp" ? notificationRequest(cluster9.PutClusterNotificationEndpointSmtpRequest, form).pipe(Effect53.flatMap(cluster9.putClusterNotificationEndpointSmtp)) : props.type === "gotify" ? notificationRequest(cluster9.PutClusterNotificationEndpointGotifyRequest, form).pipe(Effect53.flatMap(cluster9.putClusterNotificationEndpointGotify)) : notificationRequest(cluster9.PutClusterNotificationEndpointWebhookRequest, form).pipe(Effect53.flatMap(cluster9.putClusterNotificationEndpointWebhook));
+  const operation = props.type === "sendmail" ? notificationRequest(cluster10.PutClusterNotificationEndpointSendmailRequest, form).pipe(Effect54.flatMap(cluster10.putClusterNotificationEndpointSendmail)) : props.type === "smtp" ? notificationRequest(cluster10.PutClusterNotificationEndpointSmtpRequest, form).pipe(Effect54.flatMap(cluster10.putClusterNotificationEndpointSmtp)) : props.type === "gotify" ? notificationRequest(cluster10.PutClusterNotificationEndpointGotifyRequest, form).pipe(Effect54.flatMap(cluster10.putClusterNotificationEndpointGotify)) : notificationRequest(cluster10.PutClusterNotificationEndpointWebhookRequest, form).pipe(Effect54.flatMap(cluster10.putClusterNotificationEndpointWebhook));
   return runPve(props.target, "provision", true, operation);
 };
 var deleteTarget = (props) => {
   const request = { name: props.name };
-  const operation = props.type === "sendmail" ? cluster9.deleteClusterNotificationEndpointSendmail(request) : props.type === "smtp" ? cluster9.deleteClusterNotificationEndpointSmtp(request) : props.type === "gotify" ? cluster9.deleteClusterNotificationEndpointGotify(request) : cluster9.deleteClusterNotificationEndpointWebhook(request);
-  return runPve(props.target, "provision", true, operation).pipe(Effect53.catchTag("NotFound", () => Effect53.void));
+  const operation = props.type === "sendmail" ? cluster10.deleteClusterNotificationEndpointSendmail(request) : props.type === "smtp" ? cluster10.deleteClusterNotificationEndpointSmtp(request) : props.type === "gotify" ? cluster10.deleteClusterNotificationEndpointGotify(request) : cluster10.deleteClusterNotificationEndpointWebhook(request);
+  return runPve(props.target, "provision", true, operation).pipe(Effect54.catchTag("NotFound", () => Effect54.void));
 };
 
 // src/proxmox/notification-target-lifecycle.ts
 var { guardCreate: guardCreate4, guardUpdate: guardUpdate4 } = specGuards(targetSpec);
-var guard2 = (props, create) => guardCreate4(props, create).pipe(Effect54.andThen(guardUpdate4(props)));
+var guard2 = (props, create) => guardCreate4(props, create).pipe(Effect55.andThen(guardUpdate4(props)));
 var targetHandlers = {
-  list: () => Effect54.succeed([]),
-  read: ({ olds }) => Effect54.gen(function* () {
+  list: () => Effect55.succeed([]),
+  read: ({ olds }) => Effect55.gen(function* () {
     const live = yield* readTarget(olds);
     yield* guard2(olds, live === undefined);
     return live;
@@ -4251,8 +4299,8 @@ var targetHandlers = {
     news,
     olds,
     output
-  }) => Effect54.gen(function* () {
-    if (!isResolved16(news))
+  }) => Effect55.gen(function* () {
+    if (!isResolved17(news))
       return;
     if (olds.name !== news.name || olds.type !== news.type) {
       const destination = yield* readTarget(news);
@@ -4270,7 +4318,7 @@ var targetHandlers = {
     }
     return { action: targetSpec.matches(live, news) ? "noop" : "update" };
   }),
-  reconcile: ({ news }) => Effect54.gen(function* () {
+  reconcile: ({ news }) => Effect55.gen(function* () {
     const live = yield* readTarget(news);
     yield* guard2(news, live === undefined);
     if (live === undefined)
@@ -4279,7 +4327,7 @@ var targetHandlers = {
       yield* updateTarget(news);
     const after = yield* readTarget(news);
     if (after === undefined)
-      return yield* Effect54.die(new Error(`Notification target ${news.name}: write returned but read-back is absent.`));
+      return yield* Effect55.die(new Error(`Notification target ${news.name}: write returned but read-back is absent.`));
     return after;
   }),
   delete: ({ olds }) => deleteTarget(olds)
@@ -4287,15 +4335,15 @@ var targetHandlers = {
 
 // src/proxmox/notification-target.ts
 var ProxmoxNotificationTarget = Resource18("Proxmox.NotificationTarget");
-var ProxmoxNotificationTargetProvider = () => Provider18.effect(ProxmoxNotificationTarget, Effect55.succeed(ProxmoxNotificationTarget.Provider.of(targetHandlers)));
+var ProxmoxNotificationTargetProvider = () => Provider18.effect(ProxmoxNotificationTarget, Effect56.succeed(ProxmoxNotificationTarget.Provider.of(targetHandlers)));
 // src/proxmox/pbs-datastore.ts
 import { Resource as Resource19 } from "alchemy";
 import * as Provider19 from "alchemy/Provider";
-import * as Effect61 from "effect/Effect";
+import * as Effect62 from "effect/Effect";
 
 // src/proxmox/pbs-datastore-lifecycle.ts
-import { isResolved as isResolved17 } from "alchemy/Diff";
-import * as Effect60 from "effect/Effect";
+import { isResolved as isResolved18 } from "alchemy/Diff";
+import * as Effect61 from "effect/Effect";
 
 // src/proxmox/pbs-datastore-form.ts
 var attributes = (live, props) => ({
@@ -4320,7 +4368,7 @@ var attributes = (live, props) => ({
   "verify-new": bool(live["verify-new"])
 });
 var same4 = (declared, live) => declared === undefined || declared === live;
-var matches6 = (live, props) => same4(props.comment, live.comment) && same4(props["gc-schedule"]?.trim(), live["gc-schedule"]) && same4(props["prune-schedule"]?.trim(), live["prune-schedule"]) && same4(props["keep-last"], live["keep-last"]) && same4(props["keep-hourly"], live["keep-hourly"]) && same4(props["keep-daily"], live["keep-daily"]) && same4(props["keep-weekly"], live["keep-weekly"]) && same4(props["keep-monthly"], live["keep-monthly"]) && same4(props["keep-yearly"], live["keep-yearly"]) && same4(props["notify-user"], live["notify-user"]) && same4(props["counter-reset-schedule"]?.trim(), live["counter-reset-schedule"]) && (props["notification-thresholds"] === undefined || propertyString(props["notification-thresholds"]) === live["notification-thresholds"]) && same4(props["verify-new"], live["verify-new"]) && (props.notify === undefined || propertyString(props.notify) === live.notify) && (props.tuning === undefined || propertyString(props.tuning) === live.tuning) && (props["maintenance-mode"] === undefined || propertyString(props["maintenance-mode"], "type") === live["maintenance-mode"]);
+var matches7 = (live, props) => same4(props.comment, live.comment) && same4(props["gc-schedule"]?.trim(), live["gc-schedule"]) && same4(props["prune-schedule"]?.trim(), live["prune-schedule"]) && same4(props["keep-last"], live["keep-last"]) && same4(props["keep-hourly"], live["keep-hourly"]) && same4(props["keep-daily"], live["keep-daily"]) && same4(props["keep-weekly"], live["keep-weekly"]) && same4(props["keep-monthly"], live["keep-monthly"]) && same4(props["keep-yearly"], live["keep-yearly"]) && same4(props["notify-user"], live["notify-user"]) && same4(props["counter-reset-schedule"]?.trim(), live["counter-reset-schedule"]) && (props["notification-thresholds"] === undefined || propertyString(props["notification-thresholds"]) === live["notification-thresholds"]) && same4(props["verify-new"], live["verify-new"]) && (props.notify === undefined || propertyString(props.notify) === live.notify) && (props.tuning === undefined || propertyString(props.tuning) === live.tuning) && (props["maintenance-mode"] === undefined || propertyString(props["maintenance-mode"], "type") === live["maintenance-mode"]);
 var set2 = (key, value) => value === undefined ? {} : { [key]: value };
 var count = (value) => value === undefined ? undefined : String(value);
 var mutable = (props) => ({
@@ -4347,23 +4395,23 @@ var createForm6 = (props) => ({
   path: props.path,
   ...props.backend === undefined ? {} : { backend: props.backend }
 });
-var updateForm3 = (props) => mutable(props);
+var updateForm4 = (props) => mutable(props);
 var object2 = (props) => `config/datastore/${props.name}`;
 
 // src/proxmox/pbs-datastore-wire.ts
 import * as config from "@distilled.cloud/proxmox-backup/config";
-import * as Effect57 from "effect/Effect";
+import * as Effect58 from "effect/Effect";
 
 // src/proxmox/distilled-pbs.ts
 import { credentials } from "@distilled.cloud/proxmox-backup/Credentials";
 import * as Retry from "@distilled.cloud/proxmox-backup/Retry";
-import * as Effect56 from "effect/Effect";
-var runPbsWith = (target, credential, op, timeout5 = MEMBER_TIMEOUT) => op.pipe(Retry.none, Effect56.provide(credentials({
+import * as Effect57 from "effect/Effect";
+var runPbsWith = (target, credential, op, timeout5 = MEMBER_TIMEOUT) => op.pipe(Retry.none, Effect57.provide(credentials({
   baseUrl: target.api,
   secret: credential.secret,
   tokenId: credential.tokenId
-})), Effect56.timeout(timeout5));
-var runPbs = (target, role, op) => Effect56.gen(function* () {
+})), Effect57.timeout(timeout5));
+var runPbs = (target, role, op) => Effect57.gen(function* () {
   const credential = yield* leased(target, role);
   return yield* runPbsWith(target, credential, op);
 });
@@ -4394,7 +4442,7 @@ var createRequest = (props) => ({
   ...props.backend === undefined ? {} : { backend: props.backend }
 });
 var updateRequest = (props) => ({
-  ...members(updateForm3(props)),
+  ...members(updateForm4(props)),
   name: props.name
 });
 var wire = (row) => ({
@@ -4413,53 +4461,53 @@ var wire = (row) => ({
   "prune-schedule": row.prune_schedule,
   "verify-new": row.verify_new
 });
-var readOne = (props) => runPbs(props.target, "read", config.getConfigDatastore({ name: props.name })).pipe(Effect57.map((live) => attributes(wire(live), props)), Effect57.catchTag("DatastoreNotFound", () => Effect57.succeed(undefined)));
+var readOne = (props) => runPbs(props.target, "read", config.getConfigDatastore({ name: props.name })).pipe(Effect58.map((live) => attributes(wire(live), props)), Effect58.catchTag("DatastoreNotFound", () => Effect58.succeed(undefined)));
 var createOne = (props) => runPbs(props.target, "provision", config.createConfigDatastore(createRequest(props)));
 var updateOne = (props) => runPbs(props.target, "provision", config.putConfigDatastore(updateRequest(props)));
-var deleteOne = (props) => Effect57.gen(function* () {
+var deleteOne = (props) => Effect58.gen(function* () {
   if ((yield* readOne(props)) === undefined)
     return;
   return yield* runPbs(props.target, "provision", config.deleteConfigDatastore({ name: props.name }));
 });
 
 // src/proxmox/pbs-datastore-guard.ts
-import * as Effect58 from "effect/Effect";
+import * as Effect59 from "effect/Effect";
 var samePath = (left, right) => {
   const trim = (value) => value.length > 1 ? value.replace(/\/+$/, "") : value;
   return trim(left) === trim(right);
 };
-var guardPath = (live, props) => live.path === "" || samePath(live.path, props.path) ? Effect58.void : Effect58.die(new Error(`${object2(props)}: declared path ${props.path} but PBS holds ${live.path}. \`path\` ` + "is create-only, so this cannot be reconciled and will NOT be planned as a silent " + "noop: backups would keep landing in the old directory behind a green plan. Correct " + "the declaration, or remove the datastore and declare a new one -- the contents live, " + "because `destroy-data` is never sent."));
-var guardBackend = (live, props) => props.backend === undefined || propertyString(props.backend) === live.backend ? Effect58.void : Effect58.die(new Error(`${object2(props)}: declared backend ${props.backend} but PBS holds ` + `${live.backend === "" ? "(none — a local datastore)" : live.backend}. \`backend\` ` + "is create-only: PBS has no update for it, so this cannot be reconciled and will NOT " + "be planned as a silent noop. Correct the declaration to match what is really there, " + "or remove the datastore and declare a new one -- the contents live, because " + "`destroy-data` is never sent."));
-var settle2 = (read4, done) => Effect58.gen(function* () {
+var guardPath = (live, props) => live.path === "" || samePath(live.path, props.path) ? Effect59.void : Effect59.die(new Error(`${object2(props)}: declared path ${props.path} but PBS holds ${live.path}. \`path\` ` + "is create-only, so this cannot be reconciled and will NOT be planned as a silent " + "noop: backups would keep landing in the old directory behind a green plan. Correct " + "the declaration, or remove the datastore and declare a new one -- the contents live, " + "because `destroy-data` is never sent."));
+var guardBackend = (live, props) => props.backend === undefined || propertyString(props.backend) === live.backend ? Effect59.void : Effect59.die(new Error(`${object2(props)}: declared backend ${props.backend} but PBS holds ` + `${live.backend === "" ? "(none — a local datastore)" : live.backend}. \`backend\` ` + "is create-only: PBS has no update for it, so this cannot be reconciled and will NOT " + "be planned as a silent noop. Correct the declaration to match what is really there, " + "or remove the datastore and declare a new one -- the contents live, because " + "`destroy-data` is never sent."));
+var settle2 = (read4, done) => Effect59.gen(function* () {
   for (let attempt = 0;attempt < 60; attempt += 1) {
     const live = yield* read4;
     if (done(live))
       return live;
-    yield* Effect58.sleep("2 seconds");
+    yield* Effect59.sleep("2 seconds");
   }
   return yield* read4;
 });
 
 // src/proxmox/pbs-datastore-endpoint.ts
-import * as Effect59 from "effect/Effect";
+import * as Effect60 from "effect/Effect";
 var DATASTORE_ENDPOINT = {
   create: "pbs:POST /config/datastore",
   update: "pbs:PUT /config/datastore/{name}"
 };
-var guardDatastoreForms = (props) => Effect59.gen(function* () {
+var guardDatastoreForms = (props) => Effect60.gen(function* () {
   yield* guardForm(DATASTORE_ENDPOINT.create, createForm6(props), true);
-  yield* guardForm(DATASTORE_ENDPOINT.update, updateForm3(props), false);
+  yield* guardForm(DATASTORE_ENDPOINT.update, updateForm4(props), false);
 });
 
 // src/proxmox/pbs-datastore-lifecycle.ts
-var handlers7 = {
-  list: () => Effect60.succeed([]),
+var handlers6 = {
+  list: () => Effect61.succeed([]),
   read: ({ olds }) => readOne(olds),
   diff: ({
     news,
     output
-  }) => Effect60.gen(function* () {
-    if (!isResolved17(news))
+  }) => Effect61.gen(function* () {
+    if (!isResolved18(news))
       return;
     yield* guardDatastoreForms(news);
     if (output === undefined)
@@ -4469,9 +4517,9 @@ var handlers7 = {
       return { action: "update" };
     yield* guardPath(live, news);
     yield* guardBackend(live, news);
-    return matches6(live, news) ? { action: "noop" } : { action: "update" };
+    return matches7(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect60.fn(function* ({ news }) {
+  reconcile: Effect61.fn(function* ({ news }) {
     yield* guardDatastoreForms(news);
     const live = yield* readOne(news);
     if (live === undefined) {
@@ -4479,22 +4527,22 @@ var handlers7 = {
     } else {
       yield* guardPath(live, news);
       yield* guardBackend(live, news);
-      const form = formToSend(matches6, live, news, updateForm3(news));
+      const form = formToSend(matches7, live, news, updateForm4(news));
       if (form !== undefined) {
         yield* updateOne(news);
       }
     }
-    const after = yield* settle2(readOne(news), (row) => row !== undefined && matches6(row, news));
-    if (after === undefined || !matches6(after, news)) {
-      return yield* Effect60.die(new Error(`${object2(news)}: the write returned no error but the datastore still does not ` + "match the declaration after 120s. Check the PBS task list " + "-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a " + "plausible cause (see `settle`); a create over an existing chunk store is not, " + "because PBS refuses that outright rather than timing out."));
+    const after = yield* settle2(readOne(news), (row) => row !== undefined && matches7(row, news));
+    if (after === undefined || !matches7(after, news)) {
+      return yield* Effect61.die(new Error(`${object2(news)}: the write returned no error but the datastore still does not ` + "match the declaration after 120s. Check the PBS task list " + "-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a " + "plausible cause (see `settle`); a create over an existing chunk store is not, " + "because PBS refuses that outright rather than timing out."));
     }
     return after;
   }),
-  delete: Effect60.fn(function* ({ olds }) {
+  delete: Effect61.fn(function* ({ olds }) {
     yield* deleteOne(olds);
     const left = yield* settle2(readOne(olds), (row) => row === undefined);
     if (left !== undefined) {
-      return yield* Effect60.die(new Error(`${object2(olds)}: the DELETE returned no error but the datastore is still in ` + "datastore.cfg after 120s. Either a backup, verify or GC task still holds it, " + "or the provision role lacks Datastore.Allocate on /datastore/" + `${olds.name}. Read the task log with \`proxmox-backup-manager task log <upid>\`.`));
+      return yield* Effect61.die(new Error(`${object2(olds)}: the DELETE returned no error but the datastore is still in ` + "datastore.cfg after 120s. Either a backup, verify or GC task still holds it, " + "or the provision role lacks Datastore.Allocate on /datastore/" + `${olds.name}. Read the task log with \`proxmox-backup-manager task log <upid>\`.`));
     }
   })
 };
@@ -4503,36 +4551,36 @@ var handlers7 = {
 var PbsDatastore = Resource19("Pbs.Datastore", {
   defaultRemovalPolicy: "retain"
 });
-var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect61.succeed(PbsDatastore.Provider.of(handlers7)));
+var PbsDatastoreProvider = () => Provider19.effect(PbsDatastore, Effect62.succeed(PbsDatastore.Provider.of(handlers6)));
 // src/proxmox/pbs-notification-matcher.ts
 import { Resource as Resource20 } from "alchemy";
 import * as Provider20 from "alchemy/Provider";
-import { isResolved as isResolved18 } from "alchemy/Diff";
-import * as Effect64 from "effect/Effect";
+import { isResolved as isResolved19 } from "alchemy/Diff";
+import * as Effect65 from "effect/Effect";
 
 // src/proxmox/pbs-notification-matcher-distilled.ts
 import * as config2 from "@distilled.cloud/proxmox-backup/config";
-import * as Effect63 from "effect/Effect";
+import * as Effect64 from "effect/Effect";
 
 // src/proxmox/pbs-notification-input.ts
 import * as Data3 from "effect/Data";
-import * as Effect62 from "effect/Effect";
+import * as Effect63 from "effect/Effect";
 import * as Schema4 from "effect/Schema";
 
 class PbsNotificationInputRefusal extends Data3.TaggedError("PbsNotificationInputRefusal") {
 }
-var notificationInput = (schema, fields2) => Schema4.decodeUnknownEffect(Schema4.toType(schema))(fields2).pipe(Effect62.mapError(() => new PbsNotificationInputRefusal({
+var notificationInput = (schema, fields2) => Schema4.decodeUnknownEffect(Schema4.toType(schema))(fields2).pipe(Effect63.mapError(() => new PbsNotificationInputRefusal({
   message: "PBS notification fields do not match the SDK request schema; no PBS request was sent."
 })));
 
 // src/proxmox/pbs-notification-matcher-distilled.ts
-var readMatcher2 = (props) => runPbs(props.target, "read", config2.getConfigNotificationMatcher({ name: props.name })).pipe(Effect63.map((row) => matcherAttributes({
+var readMatcher2 = (props) => runPbs(props.target, "read", config2.getConfigNotificationMatcher({ name: props.name })).pipe(Effect64.map((row) => matcherAttributes({
   ...row,
   "invert-match": row.invert_match,
   "match-calendar": row.match_calendar,
   "match-field": row.match_field,
   "match-severity": row.match_severity
-}, props.name)), Effect63.catchTag("NotFound", () => Effect63.succeed(undefined)));
+}, props.name)), Effect64.catchTag("NotFound", () => Effect64.succeed(undefined)));
 var requestFields = (props, form) => ({
   ...form,
   invert_match: form["invert-match"],
@@ -4541,23 +4589,23 @@ var requestFields = (props, form) => ({
   match_severity: form["match-severity"],
   name: props.name
 });
-var createMatcher2 = (props, form) => runPbs(props.target, "provision", notificationInput(config2.CreateConfigNotificationMatcherRequest, requestFields(props, form)).pipe(Effect63.flatMap(config2.createConfigNotificationMatcher)));
-var updateMatcher2 = (props, form) => runPbs(props.target, "provision", notificationInput(config2.PutConfigNotificationMatcherRequest, requestFields(props, form)).pipe(Effect63.flatMap(config2.putConfigNotificationMatcher)));
-var deleteMatcher2 = (props) => runPbs(props.target, "provision", config2.deleteConfigNotificationMatcher({ name: props.name })).pipe(Effect63.catchTag("NotFound", () => Effect63.void));
+var createMatcher2 = (props, form) => runPbs(props.target, "provision", notificationInput(config2.CreateConfigNotificationMatcherRequest, requestFields(props, form)).pipe(Effect64.flatMap(config2.createConfigNotificationMatcher)));
+var updateMatcher2 = (props, form) => runPbs(props.target, "provision", notificationInput(config2.PutConfigNotificationMatcherRequest, requestFields(props, form)).pipe(Effect64.flatMap(config2.putConfigNotificationMatcher)));
+var deleteMatcher2 = (props) => runPbs(props.target, "provision", config2.deleteConfigNotificationMatcher({ name: props.name })).pipe(Effect64.catchTag("NotFound", () => Effect64.void));
 
 // src/proxmox/pbs-notification-matcher.ts
 var PbsNotificationMatcher = Resource20("Pbs.NotificationMatcher");
 var guardCreate5 = (props, requirePresence) => guardForm("pbs:POST /config/notifications/matchers", matcherCreateForm(props), requirePresence);
 var guardUpdate5 = (props) => guardForm("pbs:PUT /config/notifications/matchers/{name}", matcherUpdateForm(props), false);
-var handlers8 = {
-  list: () => Effect64.succeed([]),
+var handlers7 = {
+  list: () => Effect65.succeed([]),
   read: ({ olds }) => readMatcher2(olds),
   diff: ({
     news,
     olds,
     output
-  }) => Effect64.gen(function* () {
-    if (!isResolved18(news))
+  }) => Effect65.gen(function* () {
+    if (!isResolved19(news))
       return;
     yield* guardCreate5(news, output === undefined);
     yield* guardUpdate5(news);
@@ -4572,7 +4620,7 @@ var handlers8 = {
     }
     return { action: matcherMatches(live, news) ? "noop" : "update" };
   }),
-  reconcile: ({ news }) => Effect64.gen(function* () {
+  reconcile: ({ news }) => Effect65.gen(function* () {
     const live = yield* readMatcher2(news);
     yield* guardCreate5(news, live === undefined);
     yield* guardUpdate5(news);
@@ -4582,24 +4630,24 @@ var handlers8 = {
       yield* updateMatcher2(news, matcherUpdateForm(news));
     const after = yield* readMatcher2(news);
     if (after === undefined)
-      return yield* Effect64.fail(new Error(`config/notifications/matchers/${news.name}: the write returned no error but the matcher is still absent.`));
+      return yield* Effect65.fail(new Error(`config/notifications/matchers/${news.name}: the write returned no error but the matcher is still absent.`));
     return after;
   }),
   delete: ({ olds }) => deleteMatcher2(olds)
 };
-var PbsNotificationMatcherProvider = () => Provider20.effect(PbsNotificationMatcher, Effect64.succeed(PbsNotificationMatcher.Provider.of(handlers8)));
+var PbsNotificationMatcherProvider = () => Provider20.effect(PbsNotificationMatcher, Effect65.succeed(PbsNotificationMatcher.Provider.of(handlers7)));
 // src/proxmox/pbs-notification-target.ts
 import { Resource as Resource21 } from "alchemy";
 import * as Provider21 from "alchemy/Provider";
-import * as Effect67 from "effect/Effect";
+import * as Effect68 from "effect/Effect";
 
 // src/proxmox/pbs-notification-target-lifecycle.ts
-import { isResolved as isResolved19 } from "alchemy/Diff";
-import * as Effect66 from "effect/Effect";
+import { isResolved as isResolved20 } from "alchemy/Diff";
+import * as Effect67 from "effect/Effect";
 
 // src/proxmox/pbs-notification-target-distilled.ts
 import * as config3 from "@distilled.cloud/proxmox-backup/config";
-import * as Effect65 from "effect/Effect";
+import * as Effect66 from "effect/Effect";
 
 // src/proxmox/pbs-notification-target-wire.ts
 import { Buffer as Buffer2 } from "node:buffer";
@@ -4700,22 +4748,22 @@ var requestFields2 = (props, form) => ({
 var read4 = (props) => {
   switch (props.type) {
     case "sendmail":
-      return config3.getConfigNotificationEndpointSendmail({ name: props.name }).pipe(Effect65.map((row) => ({
+      return config3.getConfigNotificationEndpointSendmail({ name: props.name }).pipe(Effect66.map((row) => ({
         ...row,
         "from-address": row.from_address,
         "mailto-user": row.mailto_user
       })));
     case "smtp":
-      return config3.getConfigNotificationEndpointSmtp({ name: props.name }).pipe(Effect65.map((row) => ({
+      return config3.getConfigNotificationEndpointSmtp({ name: props.name }).pipe(Effect66.map((row) => ({
         ...row,
         "from-address": row.from_address,
         "mailto-user": row.mailto_user
       })));
     case "webhook":
-      return config3.getConfigNotificationEndpointWebhook({ name: props.name }).pipe(Effect65.map((row) => ({ ...row })));
+      return config3.getConfigNotificationEndpointWebhook({ name: props.name }).pipe(Effect66.map((row) => ({ ...row })));
   }
 };
-var readTarget2 = (props) => runPbs(props.target, "read", read4(props)).pipe(Effect65.map((row) => targetAttributes(row, props)), Effect65.catchTag("NotFound", () => Effect65.succeed(undefined)));
+var readTarget2 = (props) => runPbs(props.target, "read", read4(props)).pipe(Effect66.map((row) => targetAttributes(row, props)), Effect66.catchTag("NotFound", () => Effect66.succeed(undefined)));
 var validateTargetWrite2 = (props, form, mode) => {
   const schema = mode === "create" ? {
     sendmail: config3.CreateConfigNotificationEndpointSendmailRequest,
@@ -4726,22 +4774,22 @@ var validateTargetWrite2 = (props, form, mode) => {
     smtp: config3.PutConfigNotificationEndpointSmtpRequest,
     webhook: config3.PutConfigNotificationEndpointWebhookRequest
   }[props.type];
-  return notificationInput(schema, requestFields2(props, form)).pipe(Effect65.asVoid);
+  return notificationInput(schema, requestFields2(props, form)).pipe(Effect66.asVoid);
 };
 var createTarget2 = (props, form) => {
   const fields2 = requestFields2(props, form);
-  const operation = props.type === "sendmail" ? notificationInput(config3.CreateConfigNotificationEndpointSendmailRequest, fields2).pipe(Effect65.flatMap(config3.createConfigNotificationEndpointSendmail)) : props.type === "smtp" ? notificationInput(config3.CreateConfigNotificationEndpointSmtpRequest, fields2).pipe(Effect65.flatMap(config3.createConfigNotificationEndpointSmtp)) : notificationInput(config3.CreateConfigNotificationEndpointWebhookRequest, fields2).pipe(Effect65.flatMap(config3.createConfigNotificationEndpointWebhook));
+  const operation = props.type === "sendmail" ? notificationInput(config3.CreateConfigNotificationEndpointSendmailRequest, fields2).pipe(Effect66.flatMap(config3.createConfigNotificationEndpointSendmail)) : props.type === "smtp" ? notificationInput(config3.CreateConfigNotificationEndpointSmtpRequest, fields2).pipe(Effect66.flatMap(config3.createConfigNotificationEndpointSmtp)) : notificationInput(config3.CreateConfigNotificationEndpointWebhookRequest, fields2).pipe(Effect66.flatMap(config3.createConfigNotificationEndpointWebhook));
   return runPbs(props.target, "provision", operation);
 };
 var updateTarget2 = (props, form) => {
   const fields2 = requestFields2(props, form);
-  const operation = props.type === "sendmail" ? notificationInput(config3.PutConfigNotificationEndpointSendmailRequest, fields2).pipe(Effect65.flatMap(config3.putConfigNotificationEndpointSendmail)) : props.type === "smtp" ? notificationInput(config3.PutConfigNotificationEndpointSmtpRequest, fields2).pipe(Effect65.flatMap(config3.putConfigNotificationEndpointSmtp)) : notificationInput(config3.PutConfigNotificationEndpointWebhookRequest, fields2).pipe(Effect65.flatMap(config3.putConfigNotificationEndpointWebhook));
+  const operation = props.type === "sendmail" ? notificationInput(config3.PutConfigNotificationEndpointSendmailRequest, fields2).pipe(Effect66.flatMap(config3.putConfigNotificationEndpointSendmail)) : props.type === "smtp" ? notificationInput(config3.PutConfigNotificationEndpointSmtpRequest, fields2).pipe(Effect66.flatMap(config3.putConfigNotificationEndpointSmtp)) : notificationInput(config3.PutConfigNotificationEndpointWebhookRequest, fields2).pipe(Effect66.flatMap(config3.putConfigNotificationEndpointWebhook));
   return runPbs(props.target, "provision", operation);
 };
 var deleteTarget2 = (props) => {
   const request = { name: props.name };
   const operation = props.type === "sendmail" ? config3.deleteConfigNotificationEndpointSendmail(request) : props.type === "smtp" ? config3.deleteConfigNotificationEndpointSmtp(request) : config3.deleteConfigNotificationEndpointWebhook(request);
-  return runPbs(props.target, "provision", operation).pipe(Effect65.catchTag("NotFound", () => Effect65.void));
+  return runPbs(props.target, "provision", operation).pipe(Effect66.catchTag("NotFound", () => Effect66.void));
 };
 
 // src/proxmox/pbs-notification-target-endpoint.ts
@@ -4932,7 +4980,7 @@ var targetForm = (props, groups, carry, mode) => {
 var path = (props) => `config/notifications/endpoints/${props.type}/${props.name}`;
 var refuse2 = (props) => {
   const reasons = refusals(props);
-  return reasons.length === 0 ? Effect66.void : Effect66.die(new Error(`${path(props)}: ${reasons.join("; ")}.`));
+  return reasons.length === 0 ? Effect67.void : Effect67.die(new Error(`${path(props)}: ${reasons.join("; ")}.`));
 };
 var toCarry = (live, props, groups, sealed) => {
   const header = headerState(live, props, groups) === "stale";
@@ -4944,17 +4992,17 @@ var requireValues = (props, groups, carry) => {
     ...carry.header ? groups.header.missing : [],
     ...carry.sealed ? groups.sealed.missing : []
   ];
-  return missing.length === 0 ? Effect66.void : Effect66.die(new Error(`${path(props)}: this write must send write-only values, and ${missing.join(", ")} ` + "is unset or empty in the deploying environment. Export it and deploy again."));
+  return missing.length === 0 ? Effect67.void : Effect67.die(new Error(`${path(props)}: this write must send write-only values, and ${missing.join(", ")} ` + "is unset or empty in the deploying environment. Export it and deploy again."));
 };
-var handlers9 = {
-  list: () => Effect66.succeed([]),
-  read: ({ olds, output }) => (output === undefined ? refuse2(olds) : Effect66.void).pipe(Effect66.andThen(readTarget2(olds)), Effect66.map((live) => live === undefined ? undefined : { ...live, sealed: output?.sealed ?? "" })),
+var handlers8 = {
+  list: () => Effect67.succeed([]),
+  read: ({ olds, output }) => (output === undefined ? refuse2(olds) : Effect67.void).pipe(Effect67.andThen(readTarget2(olds)), Effect67.map((live) => live === undefined ? undefined : { ...live, sealed: output?.sealed ?? "" })),
   diff: ({
     news,
     olds,
     output
-  }) => Effect66.gen(function* () {
-    if (output === undefined || !isResolved19(news))
+  }) => Effect67.gen(function* () {
+    if (output === undefined || !isResolved20(news))
       return;
     yield* refuse2(news);
     if (olds !== undefined && (olds.type !== news.type || olds.name !== news.name)) {
@@ -4975,7 +5023,7 @@ var handlers9 = {
       return { action: "update" };
     return toCarry(live, news, resolveGroups(news), output.sealed) === undefined ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: ({ news, output }) => Effect66.gen(function* () {
+  reconcile: ({ news, output }) => Effect67.gen(function* () {
     yield* refuse2(news);
     const groups = resolveGroups(news);
     const live = yield* readTarget2(news);
@@ -5000,7 +5048,7 @@ var handlers9 = {
     }
     const after = yield* readTarget2(news);
     if (after === undefined) {
-      return yield* Effect66.die(new Error(`${path(news)}: the write returned no error but the target is still absent.`));
+      return yield* Effect67.die(new Error(`${path(news)}: the write returned no error but the target is still absent.`));
     }
     return { ...after, sealed };
   }),
@@ -5009,15 +5057,15 @@ var handlers9 = {
 
 // src/proxmox/pbs-notification-target.ts
 var PbsNotificationTarget = Resource21("Pbs.NotificationTarget");
-var PbsNotificationTargetProvider = () => Provider21.effect(PbsNotificationTarget, Effect67.succeed(PbsNotificationTarget.Provider.of(handlers9)));
+var PbsNotificationTargetProvider = () => Provider21.effect(PbsNotificationTarget, Effect68.succeed(PbsNotificationTarget.Provider.of(handlers8)));
 // src/proxmox/pbs-prune-job.ts
 import { Resource as Resource22 } from "alchemy";
 import * as Provider22 from "alchemy/Provider";
-import * as Effect70 from "effect/Effect";
+import * as Effect71 from "effect/Effect";
 
 // src/proxmox/pbs-prune-job-lifecycle.ts
-import { isResolved as isResolved20 } from "alchemy/Diff";
-import * as Effect69 from "effect/Effect";
+import { isResolved as isResolved21 } from "alchemy/Diff";
+import * as Effect70 from "effect/Effect";
 
 // src/proxmox/pbs-prune-job-form.ts
 var KEEP_KEYS = [
@@ -5095,7 +5143,7 @@ var spec = {
 
 // src/proxmox/pbs-prune-job-wire.ts
 import * as config4 from "@distilled.cloud/proxmox-backup/config";
-import * as Effect68 from "effect/Effect";
+import * as Effect69 from "effect/Effect";
 var members2 = (form) => ({
   ...form["comment"] === undefined ? {} : { comment: form["comment"] },
   ...form["disable"] === undefined ? {} : { disable: form["disable"] },
@@ -5130,10 +5178,10 @@ var wire2 = (row) => ({
   "keep-yearly": row.keep_yearly,
   "max-depth": row.max_depth
 });
-var readOne2 = (props) => runPbs(props.target, "read", config4.getConfigPrune({ id: props.id })).pipe(Effect68.map((row) => spec.attributes(wire2(row), props)), Effect68.catchTag("PruneJobNotFound", () => Effect68.succeed(undefined)));
+var readOne2 = (props) => runPbs(props.target, "read", config4.getConfigPrune({ id: props.id })).pipe(Effect69.map((row) => spec.attributes(wire2(row), props)), Effect69.catchTag("PruneJobNotFound", () => Effect69.succeed(undefined)));
 var createOne2 = (props) => runPbs(props.target, "provision", config4.createConfigPrune(createRequest2(props)));
 var updateOne2 = (props) => runPbs(props.target, "provision", config4.putConfigPrune(updateRequest2(props)));
-var deleteOne2 = (props) => Effect68.gen(function* () {
+var deleteOne2 = (props) => Effect69.gen(function* () {
   if ((yield* readOne2(props)) === undefined)
     return;
   return yield* runPbs(props.target, "provision", config4.deleteConfigPrune({ id: props.id }));
@@ -5141,14 +5189,14 @@ var deleteOne2 = (props) => Effect68.gen(function* () {
 
 // src/proxmox/pbs-prune-job-lifecycle.ts
 var { guardCreate: guardCreate6, guardUpdate: guardUpdate6 } = specGuards(spec);
-var handlers10 = {
-  list: () => Effect69.succeed([]),
+var handlers9 = {
+  list: () => Effect70.succeed([]),
   read: ({ olds }) => readOne2(olds),
   diff: ({
     news,
     output
-  }) => Effect69.gen(function* () {
-    if (!isResolved20(news))
+  }) => Effect70.gen(function* () {
+    if (!isResolved21(news))
       return;
     yield* guardCreate6(news, output === undefined);
     yield* guardUpdate6(news);
@@ -5161,7 +5209,7 @@ var handlers10 = {
     }
     return { action: spec.matches(live, news) ? "noop" : "update" };
   }),
-  reconcile: ({ news }) => Effect69.gen(function* () {
+  reconcile: ({ news }) => Effect70.gen(function* () {
     const live = yield* readOne2(news);
     yield* guardCreate6(news, live === undefined);
     yield* guardUpdate6(news);
@@ -5171,7 +5219,7 @@ var handlers10 = {
       yield* updateOne2(news);
     const after = yield* readOne2(news);
     if (after === undefined) {
-      return yield* Effect69.fail(new Error(`${spec.path(news)}: write succeeded but job is absent.`));
+      return yield* Effect70.fail(new Error(`${spec.path(news)}: write succeeded but job is absent.`));
     }
     return after;
   }),
@@ -5180,15 +5228,15 @@ var handlers10 = {
 
 // src/proxmox/pbs-prune-job.ts
 var PbsPruneJob = Resource22("Pbs.PruneJob");
-var PbsPruneJobProvider = () => Provider22.effect(PbsPruneJob, Effect70.succeed(PbsPruneJob.Provider.of(handlers10)));
+var PbsPruneJobProvider = () => Provider22.effect(PbsPruneJob, Effect71.succeed(PbsPruneJob.Provider.of(handlers9)));
 // src/proxmox/pbs-sync-job.ts
 import { Resource as Resource23 } from "alchemy";
 import * as Provider23 from "alchemy/Provider";
-import * as Effect73 from "effect/Effect";
+import * as Effect74 from "effect/Effect";
 
 // src/proxmox/pbs-sync-job-lifecycle.ts
-import { isResolved as isResolved21 } from "alchemy/Diff";
-import * as Effect72 from "effect/Effect";
+import { isResolved as isResolved22 } from "alchemy/Diff";
+import * as Effect73 from "effect/Effect";
 
 // src/proxmox/pbs-sync-job-form.ts
 var UNSET4 = -1;
@@ -5265,7 +5313,7 @@ var spec2 = {
 
 // src/proxmox/pbs-sync-job-wire.ts
 import * as config5 from "@distilled.cloud/proxmox-backup/config";
-import * as Effect71 from "effect/Effect";
+import * as Effect72 from "effect/Effect";
 var members3 = (form) => ({
   ...form["remote-store"] === undefined ? {} : { remote_store: form["remote-store"] },
   ...form["remove-vanished"] === undefined ? {} : { remove_vanished: form["remove-vanished"] },
@@ -5304,10 +5352,10 @@ var wire3 = (row) => ({
   "sync-direction": row.sync_direction,
   "group-filter": row.group_filter
 });
-var readOne3 = (props) => runPbs(props.target, "read", config5.getConfigSync({ id: props.id })).pipe(Effect71.map((row) => spec2.attributes(wire3(row), props)), Effect71.catchTag("SyncJobNotFound", () => Effect71.succeed(undefined)));
+var readOne3 = (props) => runPbs(props.target, "read", config5.getConfigSync({ id: props.id })).pipe(Effect72.map((row) => spec2.attributes(wire3(row), props)), Effect72.catchTag("SyncJobNotFound", () => Effect72.succeed(undefined)));
 var createOne3 = (props) => runPbs(props.target, "provision", config5.syncConfig(createRequest3(props)));
 var updateOne3 = (props) => runPbs(props.target, "provision", config5.putConfigSync(updateRequest3(props)));
-var deleteOne3 = (props) => Effect71.gen(function* () {
+var deleteOne3 = (props) => Effect72.gen(function* () {
   if ((yield* readOne3(props)) === undefined)
     return;
   return yield* runPbs(props.target, "provision", config5.deleteConfigSync({ id: props.id }));
@@ -5315,11 +5363,11 @@ var deleteOne3 = (props) => Effect71.gen(function* () {
 
 // src/proxmox/pbs-sync-job-lifecycle.ts
 var { guardCreate: guardCreate7, guardUpdate: guardUpdate7 } = specGuards(spec2);
-var handlers11 = {
-  list: () => Effect72.succeed([]),
+var handlers10 = {
+  list: () => Effect73.succeed([]),
   read: ({ olds }) => readOne3(olds),
-  diff: ({ news, output }) => Effect72.gen(function* () {
-    if (!isResolved21(news))
+  diff: ({ news, output }) => Effect73.gen(function* () {
+    if (!isResolved22(news))
       return;
     yield* guardCreate7(news, output === undefined);
     yield* guardUpdate7(news);
@@ -5332,7 +5380,7 @@ var handlers11 = {
     }
     return { action: spec2.matches(live, news) ? "noop" : "update" };
   }),
-  reconcile: ({ news }) => Effect72.gen(function* () {
+  reconcile: ({ news }) => Effect73.gen(function* () {
     const live = yield* readOne3(news);
     yield* guardCreate7(news, live === undefined);
     yield* guardUpdate7(news);
@@ -5342,7 +5390,7 @@ var handlers11 = {
       yield* updateOne3(news);
     const after = yield* readOne3(news);
     if (after === undefined) {
-      return yield* Effect72.fail(new Error(`${spec2.path(news)}: write succeeded but job is absent.`));
+      return yield* Effect73.fail(new Error(`${spec2.path(news)}: write succeeded but job is absent.`));
     }
     return after;
   }),
@@ -5351,15 +5399,15 @@ var handlers11 = {
 
 // src/proxmox/pbs-sync-job.ts
 var PbsSyncJob = Resource23("Pbs.SyncJob");
-var PbsSyncJobProvider = () => Provider23.effect(PbsSyncJob, Effect73.succeed(PbsSyncJob.Provider.of(handlers11)));
+var PbsSyncJobProvider = () => Provider23.effect(PbsSyncJob, Effect74.succeed(PbsSyncJob.Provider.of(handlers10)));
 // src/proxmox/pbs-verify-job.ts
 import { Resource as Resource24 } from "alchemy";
 import * as Provider24 from "alchemy/Provider";
-import * as Effect76 from "effect/Effect";
+import * as Effect77 from "effect/Effect";
 
 // src/proxmox/pbs-verify-job-lifecycle.ts
-import { isResolved as isResolved22 } from "alchemy/Diff";
-import * as Effect75 from "effect/Effect";
+import { isResolved as isResolved23 } from "alchemy/Diff";
+import * as Effect76 from "effect/Effect";
 
 // src/proxmox/pbs-verify-job-form.ts
 var rechecks = (ignoreVerified, outdatedAfter) => {
@@ -5406,7 +5454,7 @@ var spec3 = {
 
 // src/proxmox/pbs-verify-job-wire.ts
 import * as config6 from "@distilled.cloud/proxmox-backup/config";
-import * as Effect74 from "effect/Effect";
+import * as Effect75 from "effect/Effect";
 var members4 = (form) => ({
   ...form["ignore-verified"] === undefined ? {} : { ignore_verified: form["ignore-verified"] },
   ...form["store"] === undefined ? {} : { store: form["store"] },
@@ -5431,10 +5479,10 @@ var wire4 = (row) => ({
   "max-depth": row.max_depth,
   "outdated-after": row.outdated_after
 });
-var readOne4 = (props) => runPbs(props.target, "read", config6.getConfigVerify({ id: props.id })).pipe(Effect74.map((row) => spec3.attributes(wire4(row), props)), Effect74.catchTag("VerifyJobNotFound", () => Effect74.succeed(undefined)));
+var readOne4 = (props) => runPbs(props.target, "read", config6.getConfigVerify({ id: props.id })).pipe(Effect75.map((row) => spec3.attributes(wire4(row), props)), Effect75.catchTag("VerifyJobNotFound", () => Effect75.succeed(undefined)));
 var createOne4 = (props) => runPbs(props.target, "provision", config6.verifyConfig(createRequest4(props)));
 var updateOne4 = (props) => runPbs(props.target, "provision", config6.putConfigVerify(updateRequest4(props)));
-var deleteOne4 = (props) => Effect74.gen(function* () {
+var deleteOne4 = (props) => Effect75.gen(function* () {
   if ((yield* readOne4(props)) === undefined)
     return;
   return yield* runPbs(props.target, "provision", config6.deleteConfigVerify({ id: props.id }));
@@ -5442,14 +5490,14 @@ var deleteOne4 = (props) => Effect74.gen(function* () {
 
 // src/proxmox/pbs-verify-job-lifecycle.ts
 var { guardCreate: guardCreate8, guardUpdate: guardUpdate8 } = specGuards(spec3);
-var handlers12 = {
-  list: () => Effect75.succeed([]),
+var handlers11 = {
+  list: () => Effect76.succeed([]),
   read: ({ olds }) => readOne4(olds),
   diff: ({
     news,
     output
-  }) => Effect75.gen(function* () {
-    if (!isResolved22(news))
+  }) => Effect76.gen(function* () {
+    if (!isResolved23(news))
       return;
     yield* guardCreate8(news, output === undefined);
     yield* guardUpdate8(news);
@@ -5462,7 +5510,7 @@ var handlers12 = {
     }
     return { action: spec3.matches(live, news) ? "noop" : "update" };
   }),
-  reconcile: ({ news }) => Effect75.gen(function* () {
+  reconcile: ({ news }) => Effect76.gen(function* () {
     const live = yield* readOne4(news);
     yield* guardCreate8(news, live === undefined);
     yield* guardUpdate8(news);
@@ -5472,7 +5520,7 @@ var handlers12 = {
       yield* updateOne4(news);
     const after = yield* readOne4(news);
     if (after === undefined) {
-      return yield* Effect75.fail(new Error(`${spec3.path(news)}: write succeeded but job is absent.`));
+      return yield* Effect76.fail(new Error(`${spec3.path(news)}: write succeeded but job is absent.`));
     }
     return after;
   }),
@@ -5481,15 +5529,15 @@ var handlers12 = {
 
 // src/proxmox/pbs-verify-job.ts
 var PbsVerifyJob = Resource24("Pbs.VerifyJob");
-var PbsVerifyJobProvider = () => Provider24.effect(PbsVerifyJob, Effect76.succeed(PbsVerifyJob.Provider.of(handlers12)));
+var PbsVerifyJobProvider = () => Provider24.effect(PbsVerifyJob, Effect77.succeed(PbsVerifyJob.Provider.of(handlers11)));
 // src/proxmox/pool.ts
 import { Resource as Resource25 } from "alchemy";
-import { isResolved as isResolved23 } from "alchemy/Diff";
+import { isResolved as isResolved24 } from "alchemy/Diff";
 import * as Provider25 from "alchemy/Provider";
 import * as pools from "@distilled.cloud/proxmox/pools";
 import { ProxmoxParseError as ProxmoxParseError5 } from "@distilled.cloud/proxmox/Errors";
 import * as Schema5 from "effect/Schema";
-import * as Effect77 from "effect/Effect";
+import * as Effect78 from "effect/Effect";
 var ProxmoxPool = Resource25("Proxmox.Pool");
 var poolCreateForm = (props) => ({
   comment: props.comment ?? "",
@@ -5515,16 +5563,16 @@ var spec4 = {
   updateForm: poolUpdateForm
 };
 var { guardCreate: guardCreate9, guardUpdate: guardUpdate9 } = specGuards(spec4);
-var readPool = (props) => runPve(props.target, "read", false, pools.getPool({ poolid: props.poolid })).pipe(Effect77.flatMap((live) => Schema5.decodeUnknownEffect(Schema5.toType(pools.GetPoolResponse))(live).pipe(Effect77.mapError(() => new ProxmoxParseError5({
+var readPool = (props) => runPve(props.target, "read", false, pools.getPool({ poolid: props.poolid })).pipe(Effect78.flatMap((live) => Schema5.decodeUnknownEffect(Schema5.toType(pools.GetPoolResponse))(live).pipe(Effect78.mapError(() => new ProxmoxParseError5({
   body: undefined,
   cause: "Pool response does not match its vendor schema"
-})), Effect77.as(live))), Effect77.map((live) => spec4.attributes({ ...live }, props)), Effect77.catchTag("PoolNotFound", () => Effect77.succeed(undefined)), Effect77.catchTag("NotFound", () => Effect77.succeed(undefined)));
-var deletePool2 = (props) => runPve(props.target, "provision", true, pools.deletePool({ poolid: props.poolid })).pipe(Effect77.catchTag("PoolNotFound", () => Effect77.void), Effect77.catchTag("NotFound", () => Effect77.void));
-var ProxmoxPoolProvider = () => Provider25.effect(ProxmoxPool, Effect77.succeed(ProxmoxPool.Provider.of({
-  list: () => Effect77.succeed([]),
+})), Effect78.as(live))), Effect78.map((live) => spec4.attributes({ ...live }, props)), Effect78.catchTag("PoolNotFound", () => Effect78.succeed(undefined)), Effect78.catchTag("NotFound", () => Effect78.succeed(undefined)));
+var deletePool2 = (props) => runPve(props.target, "provision", true, pools.deletePool({ poolid: props.poolid })).pipe(Effect78.catchTag("PoolNotFound", () => Effect78.void), Effect78.catchTag("NotFound", () => Effect78.void));
+var ProxmoxPoolProvider = () => Provider25.effect(ProxmoxPool, Effect78.succeed(ProxmoxPool.Provider.of({
+  list: () => Effect78.succeed([]),
   read: ({ olds }) => readPool(olds),
-  diff: Effect77.fn(function* ({ news, output }) {
-    if (!isResolved23(news))
+  diff: Effect78.fn(function* ({ news, output }) {
+    if (!isResolved24(news))
       return;
     yield* guardCreate9(news, output === undefined);
     yield* guardUpdate9(news);
@@ -5537,7 +5585,7 @@ var ProxmoxPoolProvider = () => Provider25.effect(ProxmoxPool, Effect77.succeed(
     }
     return { action: spec4.matches(live, news) ? "noop" : "update" };
   }),
-  reconcile: Effect77.fn(function* ({ news }) {
+  reconcile: Effect78.fn(function* ({ news }) {
     const live = yield* readPool(news);
     yield* guardCreate9(news, live === undefined);
     yield* guardUpdate9(news);
@@ -5553,7 +5601,7 @@ var ProxmoxPoolProvider = () => Provider25.effect(ProxmoxPool, Effect77.succeed(
     }
     const after = yield* readPool(news);
     if (after === undefined)
-      return yield* Effect77.fail(new Error(`pools/${news.poolid}: write returned success but the pool is still absent`));
+      return yield* Effect78.fail(new Error(`pools/${news.poolid}: write returned success but the pool is still absent`));
     return after;
   }),
   delete: ({ olds }) => deletePool2(olds)
@@ -5750,14 +5798,14 @@ echo 'provision baseline: done. Next: point the OpenBao proxmox mount at these u
 // src/proxmox/provision-declare.ts
 import { adopt } from "alchemy/AdoptPolicy";
 import * as RemovalPolicy from "alchemy/RemovalPolicy";
-import * as Effect81 from "effect/Effect";
+import * as Effect82 from "effect/Effect";
 
 // src/proxmox/role.ts
 import { Resource as Resource26 } from "alchemy";
-import { isResolved as isResolved24 } from "alchemy/Diff";
+import { isResolved as isResolved25 } from "alchemy/Diff";
 import * as Provider26 from "alchemy/Provider";
 import * as access5 from "@distilled.cloud/proxmox/access";
-import * as Effect78 from "effect/Effect";
+import * as Effect79 from "effect/Effect";
 
 // src/proxmox/role-wire.ts
 var ROLE_CREATE = "pve:POST /access/roles";
@@ -5767,79 +5815,79 @@ var createForm7 = (props) => ({
   privs: canonical2(props.privs).join(","),
   roleid: props.roleid
 });
-var updateForm4 = (props) => ({
+var updateForm5 = (props) => ({
   privs: canonical2(props.privs).join(","),
   roleid: props.roleid
 });
 var find2 = (rows, roleid) => rows.find((row) => row.roleid === roleid);
-var attributesOf7 = (row, props) => ({
+var attributesOf8 = (row, props) => ({
   privs: canonical2(row.privs === undefined ? [] : row.privs.split(",")),
   roleid: props.roleid
 });
-var matches7 = (attributes2, props) => canonical2(attributes2.privs).join(",") === canonical2(props.privs).join(",");
+var matches8 = (attributes2, props) => canonical2(attributes2.privs).join(",") === canonical2(props.privs).join(",");
 
 // src/proxmox/role.ts
 var ProxmoxRole = Resource26("Proxmox.Role");
-var readRole = (props) => readOrUnreadable(runPve(props.target, "read", false, access5.listAccessRoles({}))).pipe(Effect78.map((rows) => {
+var readRole = (props) => readOrUnreadable(runPve(props.target, "read", false, access5.listAccessRoles({}))).pipe(Effect79.map((rows) => {
   if (rows === UNREADABLE)
     return UNREADABLE;
   const row = find2(rows, props.roleid);
-  return row === undefined ? undefined : attributesOf7(row, props);
+  return row === undefined ? undefined : attributesOf8(row, props);
 }));
 var dropUnreadable5 = (live) => live === UNREADABLE ? undefined : live;
-var ProxmoxRoleProvider = () => Provider26.effect(ProxmoxRole, Effect78.succeed(ProxmoxRole.Provider.of({
-  list: () => Effect78.succeed([]),
-  read: Effect78.fn(function* ({ olds }) {
+var ProxmoxRoleProvider = () => Provider26.effect(ProxmoxRole, Effect79.succeed(ProxmoxRole.Provider.of({
+  list: () => Effect79.succeed([]),
+  read: Effect79.fn(function* ({ olds }) {
     return dropUnreadable5(yield* readRole(olds));
   }),
-  diff: Effect78.fn(function* ({ news, output }) {
-    if (!isResolved24(news))
+  diff: Effect79.fn(function* ({ news, output }) {
+    if (!isResolved25(news))
       return;
     yield* guardWrite2(ROLE_CREATE, createForm7(news), output === undefined);
-    yield* guardWrite2(ROLE_UPDATE, updateForm4(news), false);
+    yield* guardWrite2(ROLE_UPDATE, updateForm5(news), false);
     if (output === undefined)
       return;
     const live = yield* readRole(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.Role", news.roleid);
+      yield* unreadableWarning("Proxmox.Role", news.roleid, news.target.mount, mintTier(news.target, "read"));
       return { action: "noop" };
     }
     if (live === undefined) {
       yield* guardWrite2(ROLE_CREATE, createForm7(news), true);
       return { action: "update" };
     }
-    return matches7(live, news) ? { action: "noop" } : { action: "update" };
+    return matches8(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect78.fn(function* ({ news }) {
+  reconcile: Effect79.fn(function* ({ news }) {
     const before = dropUnreadable5(yield* readRole(news));
     yield* guardWrite2(ROLE_CREATE, createForm7(news), before === undefined);
-    yield* guardWrite2(ROLE_UPDATE, updateForm4(news), false);
+    yield* guardWrite2(ROLE_UPDATE, updateForm5(news), false);
     if (before === undefined) {
       yield* runPve(news.target, "provision", true, access5.createAccessRole(createForm7(news)));
-    } else if (!matches7(before, news)) {
-      yield* runPve(news.target, "provision", true, access5.putAccessRole(updateForm4(news)));
+    } else if (!matches8(before, news)) {
+      yield* runPve(news.target, "provision", true, access5.putAccessRole(updateForm5(news)));
     }
     const after = dropUnreadable5(yield* readRole(news));
     if (after === undefined) {
-      return yield* Effect78.die(new Error(`access/roles/${news.roleid}: the write returned no error but the role is ` + 'still absent. PVE wraps every answer in {"data":...} and can report success ' + "on a call that did nothing -- read back rather than trusting the status code."));
+      return yield* Effect79.die(new Error(`access/roles/${news.roleid}: the write returned no error but the role is ` + 'still absent. PVE wraps every answer in {"data":...} and can report success ' + "on a call that did nothing -- read back rather than trusting the status code."));
     }
     return after;
   }),
-  delete: Effect78.fn(function* ({ olds }) {
+  delete: Effect79.fn(function* ({ olds }) {
     yield* runPve(olds.target, "provision", true, access5.deleteAccessRole({ roleid: olds.roleid }));
   })
 })));
 
 // src/proxmox/user.ts
 import { Resource as Resource27 } from "alchemy";
-import { isResolved as isResolved25 } from "alchemy/Diff";
+import { isResolved as isResolved26 } from "alchemy/Diff";
 import * as Provider27 from "alchemy/Provider";
 import * as access7 from "@distilled.cloud/proxmox/access";
-import * as Effect80 from "effect/Effect";
+import * as Effect81 from "effect/Effect";
 
 // src/proxmox/user-wire.ts
 import * as access6 from "@distilled.cloud/proxmox/access";
-import * as Effect79 from "effect/Effect";
+import * as Effect80 from "effect/Effect";
 var USER_CREATE = "pve:POST /access/users";
 var USER_UPDATE = "pve:PUT /access/users/{userid}";
 var int2 = (value) => {
@@ -5865,11 +5913,11 @@ var createForm8 = (props) => ({
   ...shape8(props),
   userid: props.userid
 });
-var updateForm5 = (props) => ({
+var updateForm6 = (props) => ({
   ...shape8(props),
   userid: props.userid
 });
-var attributesOf8 = (live, props) => ({
+var attributesOf9 = (live, props) => ({
   comment: text(live.comment),
   email: text(live.email),
   enable: bool(live.enable, true),
@@ -5880,59 +5928,59 @@ var attributesOf8 = (live, props) => ({
   tokens: tokenNames(live.tokens),
   userid: props.userid
 });
-var matches8 = (attributes2, props) => attributes2.comment === (props.comment ?? "") && attributes2.email === (props.email ?? "") && attributes2.enable === (props.enable !== false) && attributes2.expire === (props.expire ?? 0) && attributes2.firstname === (props.firstname ?? "") && attributes2.lastname === (props.lastname ?? "") && attributes2.groups.join(",") === groupSet(props.groups).join(",");
-var readUserOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, access6.getAccessUser({ userid: props.userid }))).pipe(Effect79.map((live) => live === UNREADABLE ? UNREADABLE : attributesOf8(live, props)));
-var readUser = (props) => readUserOrFail(props).pipe(Effect79.catchTag("UserNotFound", () => Effect79.succeed(undefined)));
+var matches9 = (attributes2, props) => attributes2.comment === (props.comment ?? "") && attributes2.email === (props.email ?? "") && attributes2.enable === (props.enable !== false) && attributes2.expire === (props.expire ?? 0) && attributes2.firstname === (props.firstname ?? "") && attributes2.lastname === (props.lastname ?? "") && attributes2.groups.join(",") === groupSet(props.groups).join(",");
+var readUserOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, access6.getAccessUser({ userid: props.userid }))).pipe(Effect80.map((live) => live === UNREADABLE ? UNREADABLE : attributesOf9(live, props)));
+var readUser = (props) => readUserOrFail(props).pipe(Effect80.catchTag("UserNotFound", () => Effect80.succeed(undefined)));
 var dropUnreadable6 = (live) => live === UNREADABLE ? undefined : live;
 
 // src/proxmox/user.ts
 var ProxmoxUser = Resource27("Proxmox.User");
-var ProxmoxUserProvider = () => Provider27.effect(ProxmoxUser, Effect80.succeed(ProxmoxUser.Provider.of({
-  list: () => Effect80.succeed([]),
-  read: Effect80.fn(function* ({ olds, output }) {
+var ProxmoxUserProvider = () => Provider27.effect(ProxmoxUser, Effect81.succeed(ProxmoxUser.Provider.of({
+  list: () => Effect81.succeed([]),
+  read: Effect81.fn(function* ({ olds, output }) {
     return dropUnreadable6(yield* output === undefined ? readUser(olds) : readUserOrFail(olds));
   }),
-  diff: Effect80.fn(function* ({ news, output }) {
-    if (!isResolved25(news))
+  diff: Effect81.fn(function* ({ news, output }) {
+    if (!isResolved26(news))
       return;
     yield* guardWrite2(USER_CREATE, createForm8(news), output === undefined);
-    yield* guardWrite2(USER_UPDATE, updateForm5(news), false);
+    yield* guardWrite2(USER_UPDATE, updateForm6(news), false);
     if (output === undefined)
       return;
     const live = yield* readUserOrFail(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.User", news.userid);
+      yield* unreadableWarning("Proxmox.User", news.userid, news.target.mount, mintTier(news.target, "read"));
       return { action: "noop" };
     }
     if (live === undefined) {
       yield* guardWrite2(USER_CREATE, createForm8(news), true);
       return { action: "update" };
     }
-    return matches8(live, news) ? { action: "noop" } : { action: "update" };
+    return matches9(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect80.fn(function* ({ news }) {
+  reconcile: Effect81.fn(function* ({ news }) {
     const before = dropUnreadable6(yield* readUser(news));
     yield* guardWrite2(USER_CREATE, createForm8(news), before === undefined);
-    yield* guardWrite2(USER_UPDATE, updateForm5(news), false);
+    yield* guardWrite2(USER_UPDATE, updateForm6(news), false);
     if (before === undefined) {
       yield* runPve(news.target, "provision", true, access7.createAccessUser(createForm8(news)));
-    } else if (!matches8(before, news)) {
-      yield* runPve(news.target, "provision", true, access7.putAccessUser(updateForm5(news)));
+    } else if (!matches9(before, news)) {
+      yield* runPve(news.target, "provision", true, access7.putAccessUser(updateForm6(news)));
     }
     const after = dropUnreadable6(yield* readUser(news));
     if (after === undefined) {
-      return yield* Effect80.die(new Error(`access/users/${news.userid}: the write returned no error but the account is ` + 'still absent. PVE wraps every answer in {"data":...} and can report success ' + "on a call that did nothing -- read back rather than trusting the status code."));
+      return yield* Effect81.die(new Error(`access/users/${news.userid}: the write returned no error but the account is ` + 'still absent. PVE wraps every answer in {"data":...} and can report success ' + "on a call that did nothing -- read back rather than trusting the status code."));
     }
     return after;
   }),
-  delete: Effect80.fn(function* ({ olds }) {
+  delete: Effect81.fn(function* ({ olds }) {
     yield* runPve(olds.target, "provision", true, access7.deleteAccessUser({ userid: olds.userid }));
   })
 })));
 
 // src/proxmox/provision-declare.ts
-var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect81.gen(function* () {
-  const baseline = yield* Effect81.try({
+var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect82.gen(function* () {
+  const baseline = yield* Effect82.try({
     catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
     try: () => provisionBaseline(names2)
   });
@@ -5946,13 +5994,13 @@ var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect
     target
   }));
   const group = yield* owned(ProxmoxGroup(`${id}-mint-group`, { ...baseline.group, target }));
-  const users = yield* Effect81.all(baseline.users.map((user) => owned(ProxmoxUser(`${id}-${user.lane}-user`, {
+  const users = yield* Effect82.all(baseline.users.map((user) => owned(ProxmoxUser(`${id}-${user.lane}-user`, {
     comment: user.comment,
     groups: [...user.groups],
     target,
     userid: user.userid
   }))));
-  const grants = yield* Effect81.all(baseline.grants.map((grant) => owned(ProxmoxAcl(`${id}-${grant.lane}-grant`, {
+  const grants = yield* Effect82.all(baseline.grants.map((grant) => owned(ProxmoxAcl(`${id}-${grant.lane}-grant`, {
     path: "/",
     propagate: true,
     roleid: grant.roleid,
@@ -5965,12 +6013,12 @@ var declareProvisionBaseline = (id, target, names2 = {}, options = {}) => Effect
 // src/proxmox/qemu.ts
 import { Resource as Resource28 } from "alchemy";
 import * as Provider28 from "alchemy/Provider";
-import * as Effect85 from "effect/Effect";
+import * as Effect86 from "effect/Effect";
 
 // src/proxmox/qemu-lifecycle.ts
-import { isResolved as isResolved26 } from "alchemy/Diff";
+import { isResolved as isResolved27 } from "alchemy/Diff";
 import * as nodes17 from "@distilled.cloud/proxmox/nodes";
-import * as Effect84 from "effect/Effect";
+import * as Effect85 from "effect/Effect";
 
 // src/proxmox/qemu-props.ts
 var NOT_CONFIG2 = new Set(["node", "target", "vmid"]);
@@ -6031,7 +6079,7 @@ var createForm9 = (props) => ({
   ...form(props),
   vmid: String(props.vmid)
 });
-var updateForm6 = form;
+var updateForm7 = form;
 
 // src/proxmox/qemu-errors.ts
 class QemuRefusedError extends Error {
@@ -6126,7 +6174,7 @@ var netPairs = (value) => new Map(value.split(",").map((part) => part.trim()).fi
   const at = part.indexOf("=");
   return at === -1 ? [part, ""] : [part.slice(0, at), part.slice(at + 1)];
 }));
-var modelKey = (map31) => NIC_MODELS.find((model) => map31.has(model));
+var modelKey = (map32) => NIC_MODELS.find((model) => map32.has(model));
 var netMaps2 = (declared2, live) => {
   const want = netPairs(declared2);
   const have = netPairs(live);
@@ -6197,44 +6245,44 @@ var judge2 = (props, config7) => {
 var identityRefusal = (vmid, was) => was === undefined || vmid === was ? undefined : `vmid: ${String(was)} -> ${String(vmid)} is a different VM. Declare it as a new resource; ` + "this one is retained when its declaration goes.";
 
 // src/proxmox/qemu-read.ts
-import * as cluster10 from "@distilled.cloud/proxmox/cluster";
+import * as cluster11 from "@distilled.cloud/proxmox/cluster";
 import * as nodes15 from "@distilled.cloud/proxmox/nodes";
-import * as Effect82 from "effect/Effect";
+import * as Effect83 from "effect/Effect";
 var guestTypes = ["lxc", "qemu"];
-var readVm = (props) => Effect82.gen(function* () {
+var readVm = (props) => Effect83.gen(function* () {
   const credential = yield* leased(props.target, "read");
-  const answer = yield* runPveWith(props.target, credential, false, nodes15.getNodeQemuConfig({ node: props.node, vmid: String(props.vmid) })).pipe(Effect82.map((data) => ({ data, error: undefined })), Effect82.catchTag("QemuConfigNotFound", (error) => Effect82.succeed({ data: undefined, error })));
+  const answer = yield* runPveWith(props.target, credential, false, nodes15.getNodeQemuConfig({ node: props.node, vmid: String(props.vmid) })).pipe(Effect83.map((data) => ({ data, error: undefined })), Effect83.catchTag("QemuConfigNotFound", (error) => Effect83.succeed({ data: undefined, error })));
   if (answer.error === undefined) {
     const live = answer.data;
     if (typeof live.digest !== "string" || live.digest === "") {
-      return yield* Effect82.fail(new QemuRefusedError(`VM ${String(props.vmid)}: config read did not return a digest-bearing config.`));
+      return yield* Effect83.fail(new QemuRefusedError(`VM ${String(props.vmid)}: config read did not return a digest-bearing config.`));
     }
     return live;
   }
-  const rows = yield* runPveWith(props.target, credential, false, cluster10.listClusterResources({ type: "vm" }));
+  const rows = yield* runPveWith(props.target, credential, false, cluster11.listClusterResources({ type: "vm" }));
   if (!Array.isArray(rows) || rows.some((row) => !Number.isSafeInteger(Number(row?.vmid)) || Number(row?.vmid) <= 0 || typeof row?.node !== "string" || row.node === "" || !guestTypes.includes(row.type))) {
-    return yield* Effect82.fail(new QemuRefusedError("The cluster guest index did not identify its rows."));
+    return yield* Effect83.fail(new QemuRefusedError("The cluster guest index did not identify its rows."));
   }
   const found = rows.find((row) => Number(row.vmid) === props.vmid);
   if (found === undefined)
     return;
   if (found.node === props.node && found.type === "qemu")
-    return yield* Effect82.fail(answer.error);
-  return yield* Effect82.fail(new QemuRefusedError(`vmid ${String(props.vmid)} is a ${text(found.type, "guest")} on ` + `${text(found.node, "?")}, not a VM on ${props.node}. A migration is not an ` + "update and vmids are cluster-wide: declare the node it is on, or pick a free vmid."));
+    return yield* Effect83.fail(answer.error);
+  return yield* Effect83.fail(new QemuRefusedError(`vmid ${String(props.vmid)} is a ${text(found.type, "guest")} on ` + `${text(found.node, "?")}, not a VM on ${props.node}. A migration is not an ` + "update and vmids are cluster-wide: declare the node it is on, or pick a free vmid."));
 });
 
 // src/proxmox/qemu-task.ts
 import * as nodes16 from "@distilled.cloud/proxmox/nodes";
-import * as Effect83 from "effect/Effect";
-var qemuTask = (props, operation, what, polls) => Effect83.gen(function* () {
+import * as Effect84 from "effect/Effect";
+var qemuTask = (props, operation, what, polls) => Effect84.gen(function* () {
   const credential = yield* mint(props.target, "provision");
   const upid = text(yield* runPveWith(props.target, credential, true, operation));
   if (upid === "") {
-    return yield* Effect83.fail(new QemuRefusedError(`${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`));
+    return yield* Effect84.fail(new QemuRefusedError(`${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`));
   }
   let exit = "still running when this provider stopped waiting";
   for (let attempt = 0;attempt < polls; attempt++) {
-    const status = yield* runPveWith(props.target, credential, false, nodes16.getNodeTaskStatus({ node: props.node, upid })).pipe(Effect83.orElseSucceed(() => {
+    const status = yield* runPveWith(props.target, credential, false, nodes16.getNodeTaskStatus({ node: props.node, upid })).pipe(Effect84.orElseSucceed(() => {
       return;
     }));
     if (status === undefined || status.status === undefined) {
@@ -6245,66 +6293,66 @@ var qemuTask = (props, operation, what, polls) => Effect83.gen(function* () {
       exit = text(status.exitstatus, "stopped with no exitstatus");
       break;
     }
-    yield* Effect83.sleep("1 second");
+    yield* Effect84.sleep("1 second");
   }
   if (exit !== "OK") {
-    return yield* Effect83.fail(new QemuRefusedError(`${what}: task ${upid} ended "${exit}". Read the task log before running the deploy again.`));
+    return yield* Effect84.fail(new QemuRefusedError(`${what}: task ${upid} ended "${exit}". Read the task log before running the deploy again.`));
   }
 });
 
 // src/proxmox/qemu-lifecycle.ts
 var CREATE_POLLS2 = 180;
 var DELETE_POLLS = 60;
-var attributesOf9 = (live, props) => ({
+var attributesOf10 = (live, props) => ({
   config: storedConfig2(live),
   node: props.node,
   vmid: props.vmid
 });
-var matches9 = (attributes2, props) => declaredKeys2(props).filter(isManagedKey2).every((key) => attributes2.config[key] === wireValue2(declaredValue2(props, key)));
+var matches10 = (attributes2, props) => declaredKeys2(props).filter(isManagedKey2).every((key) => attributes2.config[key] === wireValue2(declaredValue2(props, key)));
 var spec5 = {
-  attributes: attributesOf9,
+  attributes: attributesOf10,
   collection: (props) => `nodes/${props.node}/qemu`,
   createForm: createForm9,
   endpoint: {
     create: "pve:POST /nodes/{node}/qemu",
     update: "pve:PUT /nodes/{node}/qemu/{vmid}/config"
   },
-  matches: matches9,
+  matches: matches10,
   path: (props) => `nodes/${props.node}/qemu/${String(props.vmid)}/config`,
-  updateForm: updateForm6
+  updateForm: updateForm7
 };
 var { guardCreate: guardCreate10, guardUpdate: guardUpdate10 } = specGuards(spec5);
-var readQemu = (props) => readVm(props).pipe(Effect84.map((live) => live === undefined ? undefined : attributesOf9(live, props)));
-var deleteQemu = (props) => qemuTask(props, nodes17.deleteNodeQemu({ node: props.node, vmid: String(props.vmid) }), `destroy VM ${String(props.vmid)}`, DELETE_POLLS).pipe(Effect84.catchTag("QemuConfigNotFound", () => Effect84.void));
+var readQemu = (props) => readVm(props).pipe(Effect85.map((live) => live === undefined ? undefined : attributesOf10(live, props)));
+var deleteQemu = (props) => qemuTask(props, nodes17.deleteNodeQemu({ node: props.node, vmid: String(props.vmid) }), `destroy VM ${String(props.vmid)}`, DELETE_POLLS).pipe(Effect85.catchTag("QemuConfigNotFound", () => Effect85.void));
 var refuseUnmanaged = (props) => {
   const refused2 = formRefusals(props);
-  return refused2.length === 0 ? Effect84.void : Effect84.fail(new QemuRefusedError(refused2.join(`
+  return refused2.length === 0 ? Effect85.void : Effect85.fail(new QemuRefusedError(refused2.join(`
 `)));
 };
-var refuseChange = (change) => change.refuse.length === 0 ? Effect84.void : Effect84.fail(new QemuRefusedError(change.refuse.join(`
+var refuseChange = (change) => change.refuse.length === 0 ? Effect85.void : Effect85.fail(new QemuRefusedError(change.refuse.join(`
 `)));
 var qemuHandlers = {
-  list: () => Effect84.succeed([]),
-  read: Effect84.fn(function* ({
+  list: () => Effect85.succeed([]),
+  read: Effect85.fn(function* ({
     fqn,
     instanceId,
     olds,
     output
   }) {
     const found = yield* readQemu(olds);
-    const settled2 = Effect84.sync(() => found !== undefined && judge2(olds, found.config).drift.length === 0);
+    const settled2 = Effect85.sync(() => found !== undefined && judge2(olds, found.config).drift.length === 0);
     return yield* ownedRead({ fqn, instanceId, output }, found, settled2);
   }),
-  diff: Effect84.fn(function* ({
+  diff: Effect85.fn(function* ({
     news,
     olds,
     output
   }) {
-    if (!isResolved26(news))
+    if (!isResolved27(news))
       return;
     const identity2 = identityRefusal(news.vmid, output?.vmid ?? olds.vmid);
     if (identity2 !== undefined)
-      return yield* Effect84.fail(new QemuRefusedError(identity2));
+      return yield* Effect85.fail(new QemuRefusedError(identity2));
     yield* refuseUnmanaged(news);
     yield* guardCreate10(news, output === undefined);
     yield* guardUpdate10(news);
@@ -6312,7 +6360,7 @@ var qemuHandlers = {
       return;
     const live = yield* readQemu(news);
     if (live === undefined) {
-      yield* Effect84.logWarning(`Proxmox.Vm ${news.node}/${String(news.vmid)}: the cluster lists no VM with this vmid -- ` + "a deploy CREATES it again, with new, empty volumes.");
+      yield* Effect85.logWarning(`Proxmox.Vm ${news.node}/${String(news.vmid)}: the cluster lists no VM with this vmid -- ` + "a deploy CREATES it again, with new, empty volumes.");
       yield* guardCreate10(news, true);
       return { action: "update" };
     }
@@ -6320,7 +6368,7 @@ var qemuHandlers = {
     yield* refuseChange(change);
     return { action: change.drift.length === 0 ? "noop" : "update" };
   }),
-  reconcile: Effect84.fn(function* ({
+  reconcile: Effect85.fn(function* ({
     fqn,
     instanceId,
     news,
@@ -6329,7 +6377,7 @@ var qemuHandlers = {
   }) {
     const identity2 = identityRefusal(news.vmid, output?.vmid ?? olds?.vmid);
     if (identity2 !== undefined)
-      return yield* Effect84.fail(new QemuRefusedError(identity2));
+      return yield* Effect85.fail(new QemuRefusedError(identity2));
     yield* refuseUnmanaged(news);
     const live = yield* readQemu(news);
     yield* guardCreate10(news, live === undefined);
@@ -6346,11 +6394,11 @@ var qemuHandlers = {
     }
     const after = yield* readQemu(news);
     if (after === undefined) {
-      return yield* Effect84.fail(new QemuRefusedError(`${spec5.path(news)}: write returned success but the VM is still absent`));
+      return yield* Effect85.fail(new QemuRefusedError(`${spec5.path(news)}: write returned success but the VM is still absent`));
     }
     const left = judge2(news, after.config);
     if (left.drift.length > 0) {
-      return yield* Effect84.fail(new QemuRefusedError(`${spec5.path(news)}: after the write, ${left.drift.join(", ")} still differ from the ` + "declaration. PVE may have normalised the value -- declare what it stores."));
+      return yield* Effect85.fail(new QemuRefusedError(`${spec5.path(news)}: after the write, ${left.drift.join(", ")} still differ from the ` + "declaration. PVE may have normalised the value -- declare what it stores."));
     }
     return after;
   }),
@@ -6359,16 +6407,16 @@ var qemuHandlers = {
 
 // src/proxmox/qemu.ts
 var ProxmoxVm = Resource28("Proxmox.Vm", { defaultRemovalPolicy: "retain" });
-var ProxmoxVmProvider = () => Provider28.effect(ProxmoxVm, Effect85.succeed(ProxmoxVm.Provider.of(qemuHandlers)));
+var ProxmoxVmProvider = () => Provider28.effect(ProxmoxVm, Effect86.succeed(ProxmoxVm.Provider.of(qemuHandlers)));
 // src/proxmox/storage-download.ts
 import { Resource as Resource29 } from "alchemy";
 import * as Provider29 from "alchemy/Provider";
-import * as Effect88 from "effect/Effect";
+import * as Effect89 from "effect/Effect";
 
 // src/proxmox/storage-download-lifecycle.ts
-import { isResolved as isResolved27 } from "alchemy/Diff";
+import { isResolved as isResolved28 } from "alchemy/Diff";
 import * as nodes19 from "@distilled.cloud/proxmox/nodes";
-import * as Effect87 from "effect/Effect";
+import * as Effect88 from "effect/Effect";
 
 // src/proxmox/storage-download-identity.ts
 var PINNED = [
@@ -6403,16 +6451,16 @@ class StorageDownloadRefusedError extends Error {
 
 // src/proxmox/storage-download-task.ts
 import * as nodes18 from "@distilled.cloud/proxmox/nodes";
-import * as Effect86 from "effect/Effect";
-var storageDownloadTask = (where, operation, what, polls) => Effect86.gen(function* () {
+import * as Effect87 from "effect/Effect";
+var storageDownloadTask = (where, operation, what, polls) => Effect87.gen(function* () {
   const credential = yield* mint(where.target, "provision");
   const upid = text(yield* runPveWith(where.target, credential, true, operation));
   if (upid === "") {
-    return yield* Effect86.fail(new StorageDownloadRefusedError(`${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`));
+    return yield* Effect87.fail(new StorageDownloadRefusedError(`${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`));
   }
   let exit = "still running when this provider stopped waiting";
   for (let attempt = 0;attempt < polls; attempt++) {
-    const status = yield* runPveWith(where.target, credential, false, nodes18.getNodeTaskStatus({ node: where.node, upid })).pipe(Effect86.orElseSucceed(() => {
+    const status = yield* runPveWith(where.target, credential, false, nodes18.getNodeTaskStatus({ node: where.node, upid })).pipe(Effect87.orElseSucceed(() => {
       return;
     }));
     if (status === undefined || status.status === undefined) {
@@ -6423,10 +6471,10 @@ var storageDownloadTask = (where, operation, what, polls) => Effect86.gen(functi
       exit = text(status.exitstatus, "stopped with no exitstatus");
       break;
     }
-    yield* Effect86.sleep("1 second");
+    yield* Effect87.sleep("1 second");
   }
   if (exit !== "OK") {
-    return yield* Effect86.fail(new StorageDownloadRefusedError(`${what}: task ${upid} ended "${exit}". Read the task log before running the deploy again.`));
+    return yield* Effect87.fail(new StorageDownloadRefusedError(`${what}: task ${upid} ended "${exit}". Read the task log before running the deploy again.`));
   }
 });
 
@@ -6452,14 +6500,14 @@ var createRefusals2 = (props) => {
   }
   return refuse3.concat(formViolations(DOWNLOAD_ENDPOINT, downloadForm(props), true).map((why) => `${props.filename}: ${why}`));
 };
-var readDownload = (props) => Effect87.gen(function* () {
+var readDownload = (props) => Effect88.gen(function* () {
   const rows = yield* runPve(props.target, "read", false, nodes19.listNodeStorageContent({
     content: "import",
     node: props.node,
     storage: props.storage
   }));
   if (!Array.isArray(rows)) {
-    return yield* Effect87.fail(new StorageDownloadRefusedError(`${props.storage}: the content list did not come back as a list.`));
+    return yield* Effect88.fail(new StorageDownloadRefusedError(`${props.storage}: the content list did not come back as a list.`));
   }
   const found = rows.find((row) => row.volid.endsWith(`/${props.filename}`));
   if (found === undefined)
@@ -6473,7 +6521,7 @@ var readDownload = (props) => Effect87.gen(function* () {
     volid: text(found.volid, "")
   };
 });
-var destroyDownload = (props) => Effect87.gen(function* () {
+var destroyDownload = (props) => Effect88.gen(function* () {
   const live = yield* readDownload(props);
   if (live === undefined)
     return;
@@ -6484,26 +6532,26 @@ var destroyDownload = (props) => Effect87.gen(function* () {
   }), `delete ${live.volid}`, DELETE_POLLS2);
 });
 var storageDownloadHandlers = {
-  list: () => Effect87.succeed([]),
-  read: Effect87.fn(function* ({
+  list: () => Effect88.succeed([]),
+  read: Effect88.fn(function* ({
     fqn,
     instanceId,
     olds,
     output
   }) {
     const found = yield* readDownload(olds);
-    return yield* ownedRead({ fqn, instanceId, output }, found, Effect87.succeed(true));
+    return yield* ownedRead({ fqn, instanceId, output }, found, Effect88.succeed(true));
   }),
-  diff: Effect87.fn(function* ({
+  diff: Effect88.fn(function* ({
     news,
     olds,
     output
   }) {
-    if (!isResolved27(news))
+    if (!isResolved28(news))
       return;
     const refused2 = createRefusals2(news);
     if (refused2.length > 0) {
-      return yield* Effect87.fail(new StorageDownloadRefusedError(refused2.join(`
+      return yield* Effect88.fail(new StorageDownloadRefusedError(refused2.join(`
 `)));
     }
     if (output === undefined)
@@ -6513,11 +6561,11 @@ var storageDownloadHandlers = {
       return { action: "replace" };
     const live = yield* readDownload(news);
     if (identity2.kind === "pin-changed" && live !== undefined) {
-      return yield* Effect87.fail(new StorageDownloadRefusedError(identity2.refuse));
+      return yield* Effect88.fail(new StorageDownloadRefusedError(identity2.refuse));
     }
     return { action: live === undefined ? "update" : "noop" };
   }),
-  reconcile: Effect87.fn(function* ({
+  reconcile: Effect88.fn(function* ({
     fqn,
     instanceId,
     news,
@@ -6525,7 +6573,7 @@ var storageDownloadHandlers = {
   }) {
     const refused2 = createRefusals2(news);
     if (refused2.length > 0) {
-      return yield* Effect87.fail(new StorageDownloadRefusedError(refused2.join(`
+      return yield* Effect88.fail(new StorageDownloadRefusedError(refused2.join(`
 `)));
     }
     const live = yield* readDownload(news);
@@ -6536,7 +6584,7 @@ var storageDownloadHandlers = {
     }
     const after = yield* readDownload(news);
     if (after === undefined) {
-      return yield* Effect87.fail(new StorageDownloadRefusedError(`${news.filename}: the write returned no error but ${news.storage} still has no ` + "matching content — PVE may have normalised the filename; read it back by hand."));
+      return yield* Effect88.fail(new StorageDownloadRefusedError(`${news.filename}: the write returned no error but ${news.storage} still has no ` + "matching content — PVE may have normalised the filename; read it back by hand."));
     }
     return after;
   }),
@@ -6545,17 +6593,17 @@ var storageDownloadHandlers = {
 
 // src/proxmox/storage-download.ts
 var ProxmoxStorageDownload = Resource29("Proxmox.StorageDownload");
-var ProxmoxStorageDownloadProvider = () => Provider29.effect(ProxmoxStorageDownload, Effect88.succeed(ProxmoxStorageDownload.Provider.of(storageDownloadHandlers)));
+var ProxmoxStorageDownloadProvider = () => Provider29.effect(ProxmoxStorageDownload, Effect89.succeed(ProxmoxStorageDownload.Provider.of(storageDownloadHandlers)));
 // src/proxmox/replication-job.ts
 import { Resource as Resource30 } from "alchemy";
 import * as Provider30 from "alchemy/Provider";
-import * as Effect90 from "effect/Effect";
+import * as Effect91 from "effect/Effect";
 
 // src/proxmox/replication-job-lifecycle.ts
-import { isResolved as isResolved28 } from "alchemy/Diff";
-import * as cluster11 from "@distilled.cloud/proxmox/cluster";
+import { isResolved as isResolved29 } from "alchemy/Diff";
+import * as cluster12 from "@distilled.cloud/proxmox/cluster";
 import { ProxmoxParseError as ProxmoxParseError6 } from "@distilled.cloud/proxmox/Errors";
-import * as Effect89 from "effect/Effect";
+import * as Effect90 from "effect/Effect";
 import * as Schema6 from "effect/Schema";
 
 // src/proxmox/replication-job-form.ts
@@ -6616,21 +6664,21 @@ var malformed = () => new ProxmoxParseError6({
   body: undefined,
   cause: "Replication job response does not match the requested vendor identity"
 });
-var readReplicationJob = (props) => runPve(props.target, "read", false, cluster11.getClusterReplication({ id: jobId(props) })).pipe(Effect89.flatMap((live) => Schema6.decodeUnknownEffect(Schema6.toType(cluster11.GetClusterReplicationResponse))({
+var readReplicationJob = (props) => runPve(props.target, "read", false, cluster12.getClusterReplication({ id: jobId(props) })).pipe(Effect90.flatMap((live) => Schema6.decodeUnknownEffect(Schema6.toType(cluster12.GetClusterReplicationResponse))({
   ...live,
   guest: int(live.guest, Number.NaN),
   jobnum: int(live.jobnum, Number.NaN),
   rate: undefined
-}).pipe(Effect89.mapError(malformed), Effect89.as(live))), Effect89.flatMap((live) => live.id === jobId(props) && int(live.guest, Number.NaN) === props.guest && int(live.jobnum, Number.NaN) === props.jobnum ? Effect89.succeed(replicationJobSpec.attributes({ ...live }, props)) : Effect89.fail(malformed())), Effect89.catchTag("ReplicationJobNotFound", () => Effect89.succeed(undefined)));
-var deleteReplicationJob = (props) => runPve(props.target, "provision", true, cluster11.deleteClusterReplication({ id: jobId(props) })).pipe(Effect89.catchTag("ReplicationJobNotFound", () => Effect89.void));
+}).pipe(Effect90.mapError(malformed), Effect90.as(live))), Effect90.flatMap((live) => live.id === jobId(props) && int(live.guest, Number.NaN) === props.guest && int(live.jobnum, Number.NaN) === props.jobnum ? Effect90.succeed(replicationJobSpec.attributes({ ...live }, props)) : Effect90.fail(malformed())), Effect90.catchTag("ReplicationJobNotFound", () => Effect90.succeed(undefined)));
+var deleteReplicationJob = (props) => runPve(props.target, "provision", true, cluster12.deleteClusterReplication({ id: jobId(props) })).pipe(Effect90.catchTag("ReplicationJobNotFound", () => Effect90.void));
 var replicationJobHandlers = {
-  list: () => Effect89.succeed([]),
+  list: () => Effect90.succeed([]),
   read: ({ olds }) => readReplicationJob(olds),
-  diff: Effect89.fn(function* ({
+  diff: Effect90.fn(function* ({
     news,
     output
   }) {
-    if (!isResolved28(news))
+    if (!isResolved29(news))
       return;
     yield* guardCreate11(news, output === undefined);
     yield* guardUpdate11(news);
@@ -6643,20 +6691,20 @@ var replicationJobHandlers = {
     }
     return { action: replicationJobSpec.matches(live, news) ? "noop" : "update" };
   }),
-  reconcile: Effect89.fn(function* ({ news }) {
+  reconcile: Effect90.fn(function* ({ news }) {
     const live = yield* readReplicationJob(news);
     yield* guardCreate11(news, live === undefined);
     yield* guardUpdate11(news);
     if (live === undefined) {
-      yield* runPve(news.target, "provision", true, cluster11.createClusterReplication(replicationJobSpec.createForm(news)));
+      yield* runPve(news.target, "provision", true, cluster12.createClusterReplication(replicationJobSpec.createForm(news)));
     } else {
       const form2 = formToSend(replicationJobSpec.matches, live, news, replicationJobSpec.updateForm(news));
       if (form2 !== undefined)
-        yield* runPve(news.target, "provision", true, cluster11.putClusterReplication({ ...form2, id: jobId(news) }));
+        yield* runPve(news.target, "provision", true, cluster12.putClusterReplication({ ...form2, id: jobId(news) }));
     }
     const after = yield* readReplicationJob(news);
     if (after === undefined)
-      return yield* Effect89.fail(new Error(`${replicationJobSpec.path(news)}: write returned success but the resource is still absent`));
+      return yield* Effect90.fail(new Error(`${replicationJobSpec.path(news)}: write returned success but the resource is still absent`));
     return after;
   }),
   delete: ({ olds }) => deleteReplicationJob(olds)
@@ -6664,15 +6712,15 @@ var replicationJobHandlers = {
 
 // src/proxmox/replication-job.ts
 var ProxmoxReplicationJob = Resource30("Proxmox.ReplicationJob");
-var ProxmoxReplicationJobProvider = () => Provider30.effect(ProxmoxReplicationJob, Effect90.succeed(ProxmoxReplicationJob.Provider.of(replicationJobHandlers)));
+var ProxmoxReplicationJobProvider = () => Provider30.effect(ProxmoxReplicationJob, Effect91.succeed(ProxmoxReplicationJob.Provider.of(replicationJobHandlers)));
 // src/proxmox/sdn-apply.ts
 import { Resource as Resource31 } from "alchemy";
-import { isResolved as isResolved29 } from "alchemy/Diff";
+import { isResolved as isResolved30 } from "alchemy/Diff";
 import * as Provider31 from "alchemy/Provider";
-import * as Effect92 from "effect/Effect";
+import * as Effect93 from "effect/Effect";
 
 // src/proxmox/sdn-apply-read.ts
-import * as Effect91 from "effect/Effect";
+import * as Effect92 from "effect/Effect";
 var MARKED = [
   "cluster/sdn/zones",
   "cluster/sdn/vnets",
@@ -6681,7 +6729,7 @@ var MARKED = [
   "cluster/sdn/route-maps"
 ];
 var subsystemAbsent = (error) => error instanceof PveError && error.status === 501;
-var markedPending = (target) => Effect91.all(MARKED.map((collection) => pve(target, "read", "GET", `${collection}?pending=1`).pipe(Effect91.map((rows) => (rows ?? []).filter((row) => row.state !== undefined).length), Effect91.catchIf(subsystemAbsent, () => Effect91.succeed(0)))), { concurrency: "unbounded" }).pipe(Effect91.map((counts) => counts.reduce((total, count2) => total + count2, 0)));
+var markedPending = (target) => Effect92.all(MARKED.map((collection) => pve(target, "read", "GET", `${collection}?pending=1`).pipe(Effect92.map((rows) => (rows ?? []).filter((row) => row.state !== undefined).length), Effect92.catchIf(subsystemAbsent, () => Effect92.succeed(0)))), { concurrency: "unbounded" }).pipe(Effect92.map((counts) => counts.reduce((total, count2) => total + count2, 0)));
 var fabricStaged = (staged, running) => {
   if (staged === undefined && running === undefined)
     return 0;
@@ -6689,9 +6737,9 @@ var fabricStaged = (staged, running) => {
     return "inconsistent";
   return staged === running ? 0 : 1;
 };
-var fabricPending = (target) => Effect91.all(["pending", "running"].map((view) => pve(target, "read", "GET", `cluster/sdn/fabrics/all?${view}=1`).pipe(Effect91.map(canonical3), Effect91.catchIf(subsystemAbsent, () => Effect91.succeed(undefined)))), { concurrency: "unbounded" }).pipe(Effect91.flatMap(([staged, running]) => {
+var fabricPending = (target) => Effect92.all(["pending", "running"].map((view) => pve(target, "read", "GET", `cluster/sdn/fabrics/all?${view}=1`).pipe(Effect92.map(canonical3), Effect92.catchIf(subsystemAbsent, () => Effect92.succeed(undefined)))), { concurrency: "unbounded" }).pipe(Effect92.flatMap(([staged, running]) => {
   const verdict = fabricStaged(staged, running);
-  return verdict === "inconsistent" ? Effect91.die(new Error("cluster/sdn/fabrics/all answered 501 for one of ?pending=1 and ?running=1 and not " + "the other. Refusing to read that as a staged fabric change.")) : Effect91.succeed(verdict);
+  return verdict === "inconsistent" ? Effect92.die(new Error("cluster/sdn/fabrics/all answered 501 for one of ?pending=1 and ?running=1 and not " + "the other. Refusing to read that as a staged fabric change.")) : Effect92.succeed(verdict);
 }));
 var canonical3 = (value) => JSON.stringify(sortDeep(value));
 var sortDeep = (value) => {
@@ -6704,23 +6752,23 @@ var sortDeep = (value) => {
   }
   return value;
 };
-var sdnPendingCount = (target) => Effect91.all([markedPending(target), fabricPending(target)], { concurrency: "unbounded" }).pipe(Effect91.map(([marked, fabric]) => marked + fabric));
+var sdnPendingCount = (target) => Effect92.all([markedPending(target), fabricPending(target)], { concurrency: "unbounded" }).pipe(Effect92.map(([marked, fabric]) => marked + fabric));
 
 // src/proxmox/sdn-apply.ts
 var ProxmoxSdnApply = Resource31("Proxmox.SdnApply");
-var read5 = (props) => sdnPendingCount(props.target).pipe(Effect92.map((pending) => ({ pending })));
-var ProxmoxSdnApplyProvider = () => Provider31.effect(ProxmoxSdnApply, Effect92.succeed(ProxmoxSdnApply.Provider.of({
-  list: () => Effect92.succeed([]),
-  read: Effect92.fn(function* ({ olds }) {
+var read5 = (props) => sdnPendingCount(props.target).pipe(Effect93.map((pending) => ({ pending })));
+var ProxmoxSdnApplyProvider = () => Provider31.effect(ProxmoxSdnApply, Effect93.succeed(ProxmoxSdnApply.Provider.of({
+  list: () => Effect93.succeed([]),
+  read: Effect93.fn(function* ({ olds }) {
     return yield* read5(olds);
   }),
-  diff: Effect92.fn(function* ({ news }) {
-    if (!isResolved29(news))
+  diff: Effect93.fn(function* ({ news }) {
+    if (!isResolved30(news))
       return;
     const { pending } = yield* read5(news);
     return pending === 0 ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect92.fn(function* ({ news }) {
+  reconcile: Effect93.fn(function* ({ news }) {
     const staged = yield* read5(news);
     if (staged.pending === 0)
       return staged;
@@ -6728,16 +6776,16 @@ var ProxmoxSdnApplyProvider = () => Provider31.effect(ProxmoxSdnApply, Effect92.
     yield* pve(news.target, "provision", "PUT", "cluster/sdn");
     const after = yield* read5(news);
     if (after.pending !== 0) {
-      return yield* Effect92.die(new Error(`PUT /cluster/sdn returned no error but ${String(after.pending)} SDN object(s) ` + "are still staged. The running config does not match the declared one -- check " + "`pvesh get /cluster/sdn/zones --pending 1` for the objects PVE refused."));
+      return yield* Effect93.die(new Error(`PUT /cluster/sdn returned no error but ${String(after.pending)} SDN object(s) ` + "are still staged. The running config does not match the declared one -- check " + "`pvesh get /cluster/sdn/zones --pending 1` for the objects PVE refused."));
     }
     return after;
   }),
-  delete: () => Effect92.void
+  delete: () => Effect93.void
 })));
 // src/proxmox/sdn-subnet.ts
 import { Resource as Resource32 } from "alchemy";
 import * as Provider32 from "alchemy/Provider";
-import * as Effect93 from "effect/Effect";
+import * as Effect94 from "effect/Effect";
 
 // src/proxmox/sdn-subnet-form.ts
 var subnetId = (props) => `${props.zone}-${props.cidr.replace("/", "-")}`;
@@ -6761,14 +6809,14 @@ var createForm10 = (props) => ({
   subnet: props.cidr,
   type: "subnet"
 });
-var updateForm7 = (props) => {
+var updateForm8 = (props) => {
   const clear = Object.entries(optional3(props)).filter(([, value]) => value === undefined).map(([key]) => key);
   return withClears(body5(props), clear);
 };
 
 // src/proxmox/sdn-subnet.ts
 var ProxmoxSdnSubnet = Resource32("Proxmox.SdnSubnet");
-var handlers13 = pveHandlers({
+var handlers12 = pveHandlers({
   attributes: (live, props) => {
     const liveVnet = text(live["vnet"]);
     if (liveVnet !== "" && liveVnet !== props.vnet)
@@ -6795,13 +6843,13 @@ var handlers13 = pveHandlers({
   },
   matches: (attributes2, props) => attributes2.gateway === (props.gateway ?? "") && attributes2.snat === (props.snat === true) && attributes2.dnszoneprefix === (props.dnszoneprefix ?? "") && attributes2.dhcpDnsServer === (props.dhcpDnsServer ?? "") && attributes2.dhcpRange === declaredRanges(props.dhcpRange),
   path: (props) => `cluster/sdn/vnets/${props.vnet}/subnets/${subnetId(props)}`,
-  updateForm: updateForm7
+  updateForm: updateForm8
 });
-var ProxmoxSdnSubnetProvider = () => Provider32.effect(ProxmoxSdnSubnet, Effect93.succeed(ProxmoxSdnSubnet.Provider.of(handlers13)));
+var ProxmoxSdnSubnetProvider = () => Provider32.effect(ProxmoxSdnSubnet, Effect94.succeed(ProxmoxSdnSubnet.Provider.of(handlers12)));
 // src/proxmox/sdn-vnet.ts
 import { Resource as Resource33 } from "alchemy";
 import * as Provider33 from "alchemy/Provider";
-import * as Effect94 from "effect/Effect";
+import * as Effect95 from "effect/Effect";
 var ProxmoxSdnVnet = Resource33("Proxmox.SdnVnet");
 var tagOf = (value) => typeof value === "number" ? value : undefined;
 var shape10 = (props) => {
@@ -6814,14 +6862,14 @@ var shape10 = (props) => {
     ...props.tag === undefined ? {} : { tag: String(props.tag) }
   };
 };
-var updateForm8 = (props) => {
+var updateForm9 = (props) => {
   const unset2 = [
     ...(props.alias ?? "") === "" ? ["alias"] : [],
     ...props.tag === undefined ? ["tag"] : []
   ];
   return withClears(shape10(props), unset2);
 };
-var handlers14 = pveHandlers({
+var handlers13 = pveHandlers({
   readRole: "provision",
   attributes: (live, props) => ({
     alias: typeof live["alias"] === "string" ? live["alias"] : "",
@@ -6837,13 +6885,13 @@ var handlers14 = pveHandlers({
   endpoint: { create: "pve:POST /cluster/sdn/vnets", update: "pve:PUT /cluster/sdn/vnets/{vnet}" },
   matches: (attributes2, props) => attributes2.zone === props.zone && attributes2.alias === (props.alias ?? "") && attributes2.tag === props.tag && attributes2.vlanaware === (props.vlanaware === true) && attributes2.isolatePorts === (props.isolatePorts === true),
   path: (props) => `cluster/sdn/vnets/${props.vnet}`,
-  updateForm: updateForm8
+  updateForm: updateForm9
 });
-var ProxmoxSdnVnetProvider = () => Provider33.effect(ProxmoxSdnVnet, Effect94.succeed(ProxmoxSdnVnet.Provider.of(handlers14)));
+var ProxmoxSdnVnetProvider = () => Provider33.effect(ProxmoxSdnVnet, Effect95.succeed(ProxmoxSdnVnet.Provider.of(handlers13)));
 // src/proxmox/sdn-zone.ts
 import { Resource as Resource34 } from "alchemy";
 import * as Provider34 from "alchemy/Provider";
-import * as Effect95 from "effect/Effect";
+import * as Effect96 from "effect/Effect";
 var ProxmoxSdnZone = Resource34("Proxmox.SdnZone");
 var sameIpam = (live, declared2) => (live === "" ? "pve" : live) === (declared2 === undefined || declared2 === "" ? "pve" : declared2);
 var body6 = (props) => ({
@@ -6864,7 +6912,7 @@ var clearable = {
   vlan: ["dns", "dnszone", "ipam", "mtu", "nodes"],
   vxlan: ["dns", "dnszone", "ipam", "mtu", "nodes"]
 };
-var handlers15 = pveHandlers({
+var handlers14 = pveHandlers({
   readRole: "provision",
   attributes: (live, props) => {
     const liveType = text(live["type"]);
@@ -6896,13 +6944,13 @@ var handlers15 = pveHandlers({
     return withClears(fields2, clear);
   }
 });
-var ProxmoxSdnZoneProvider = () => Provider34.effect(ProxmoxSdnZone, Effect95.succeed(ProxmoxSdnZone.Provider.of(handlers15)));
+var ProxmoxSdnZoneProvider = () => Provider34.effect(ProxmoxSdnZone, Effect96.succeed(ProxmoxSdnZone.Provider.of(handlers14)));
 // src/proxmox/storage.ts
 import { Resource as Resource35 } from "alchemy";
-import { isResolved as isResolved30 } from "alchemy/Diff";
+import { isResolved as isResolved31 } from "alchemy/Diff";
 import * as Provider35 from "alchemy/Provider";
 import * as storage2 from "@distilled.cloud/proxmox/storage";
-import * as Effect97 from "effect/Effect";
+import * as Effect98 from "effect/Effect";
 
 // src/proxmox/storage-plugin-options.ts
 var SHARED_ACCEPTED_TYPES = new Set(["dir", "lvm", "btrfs", "esxi"]);
@@ -6910,12 +6958,12 @@ var sharedAccepted = (type) => SHARED_ACCEPTED_TYPES.has(type);
 
 // src/proxmox/storage-wire.ts
 import * as storage from "@distilled.cloud/proxmox/storage";
-import * as Effect96 from "effect/Effect";
+import * as Effect97 from "effect/Effect";
 var str2 = (value, fallback = "") => typeof value === "string" ? value : fallback;
 var tokens = (value) => value.split(",").map((part) => part.trim()).filter((part) => part !== "").sort().join(",");
 var sameList2 = (declared2, live) => declared2 === undefined || tokens(declared2) === tokens(live);
 var same7 = (declared2, live) => declared2 === undefined || declared2 === live;
-var attributesOf10 = (live, props) => {
+var attributesOf11 = (live, props) => {
   const data = live;
   return {
     comment: str2(data["comment"]),
@@ -6929,8 +6977,8 @@ var attributesOf10 = (live, props) => {
     type: str2(data["type"], props.type)
   };
 };
-var readStorageOrFail = (props) => readOrUnreadable(runPve(props.target, "provision", false, storage.getStorage({ storage: props.storage }))).pipe(Effect96.map((live) => live === UNREADABLE ? UNREADABLE : attributesOf10(live, props)));
-var readStorage = (props) => readStorageOrFail(props).pipe(Effect96.catchTag("StorageNotFound", () => Effect96.succeed(undefined)));
+var readStorageOrFail = (props) => readOrUnreadable(runPve(props.target, "provision", false, storage.getStorage({ storage: props.storage }))).pipe(Effect97.map((live) => live === UNREADABLE ? UNREADABLE : attributesOf11(live, props)));
+var readStorage = (props) => readStorageOrFail(props).pipe(Effect97.catchTag("StorageNotFound", () => Effect97.succeed(undefined)));
 var dropUnreadable7 = (live) => live === UNREADABLE ? undefined : live;
 var changedProps = (live, props) => ({
   ...sameList2(props.content, live.content) ? {} : { content: props.content },
@@ -6941,7 +6989,7 @@ var changedProps = (live, props) => ({
   ...same7(props.preallocation, live.preallocation) ? {} : { preallocation: props.preallocation },
   ...same7(props.comment, live.comment) ? {} : { comment: props.comment }
 });
-var matches10 = (attributes2, props) => !sharedAccepted(props.type) && !same7(props.shared, attributes2.shared) ? Effect96.die(new Error(`storage/${props.storage}: declared shared: ${String(props.shared)}, but PVE reports ` + `${String(attributes2.shared)} and '${props.type}' storages never accept a 'shared' ` + "write (storage-plugin-options.ts) -- remove the declared shared or set it to match " + "what PVE already reports; this value can never be applied.")) : Effect96.succeed(Object.keys(changedProps(attributes2, props)).length === 0);
+var matches11 = (attributes2, props) => !sharedAccepted(props.type) && !same7(props.shared, attributes2.shared) ? Effect97.die(new Error(`storage/${props.storage}: declared shared: ${String(props.shared)}, but PVE reports ` + `${String(attributes2.shared)} and '${props.type}' storages never accept a 'shared' ` + "write (storage-plugin-options.ts) -- remove the declared shared or set it to match " + "what PVE already reports; this value can never be applied.")) : Effect97.succeed(Object.keys(changedProps(attributes2, props)).length === 0);
 
 // src/proxmox/storage-form.ts
 var STORAGE_CREATE = "pve:POST /storage";
@@ -6964,7 +7012,7 @@ var createForm11 = (props) => ({
   storage: props.storage,
   type: props.type
 });
-var updateForm9 = (props, live) => ({
+var updateForm10 = (props, live) => ({
   ...mutable2(props.type, live === undefined ? props : changedProps(live, props)),
   storage: props.storage
 });
@@ -6975,82 +7023,82 @@ var toDistilledUpdate3 = (form2) => underscored(form2);
 var ProxmoxStorage = Resource35("Proxmox.Storage", {
   defaultRemovalPolicy: "retain"
 });
-var ProxmoxStorageProvider = () => Provider35.effect(ProxmoxStorage, Effect97.succeed(ProxmoxStorage.Provider.of({
-  list: () => Effect97.succeed([]),
-  read: Effect97.fn(function* ({ olds, output }) {
+var ProxmoxStorageProvider = () => Provider35.effect(ProxmoxStorage, Effect98.succeed(ProxmoxStorage.Provider.of({
+  list: () => Effect98.succeed([]),
+  read: Effect98.fn(function* ({ olds, output }) {
     return dropUnreadable7(yield* output === undefined ? readStorage(olds) : readStorageOrFail(olds));
   }),
-  diff: Effect97.fn(function* ({ news, output }) {
-    if (!isResolved30(news))
+  diff: Effect98.fn(function* ({ news, output }) {
+    if (!isResolved31(news))
       return;
     yield* guardWrite2(STORAGE_CREATE, createForm11(news), output === undefined);
-    yield* guardWrite2(STORAGE_UPDATE, updateForm9(news, undefined), false);
+    yield* guardWrite2(STORAGE_UPDATE, updateForm10(news, undefined), false);
     if (output === undefined)
       return;
     const live = yield* readStorageOrFail(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.Storage", news.storage);
+      yield* unreadableWarning("Proxmox.Storage", news.storage, news.target.mount, mintTier(news.target, "provision"));
       return { action: "noop" };
     }
     if (live === undefined) {
       yield* guardWrite2(STORAGE_CREATE, createForm11(news), true);
       return { action: "update" };
     }
-    return (yield* matches10(live, news)) ? { action: "noop" } : { action: "update" };
+    return (yield* matches11(live, news)) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect97.fn(function* ({ news }) {
+  reconcile: Effect98.fn(function* ({ news }) {
     const before = dropUnreadable7(yield* readStorage(news));
     yield* guardWrite2(STORAGE_CREATE, createForm11(news), before === undefined);
-    const update2 = updateForm9(news, before);
+    const update2 = updateForm10(news, before);
     yield* guardWrite2(STORAGE_UPDATE, update2, false);
     if (before === undefined) {
       yield* runPve(news.target, "provision", true, storage2.createStorage(toDistilledCreate4(news)));
-    } else if (!(yield* matches10(before, news))) {
+    } else if (!(yield* matches11(before, news))) {
       yield* runPve(news.target, "provision", true, storage2.putStorage(toDistilledUpdate3(update2)));
     }
     const after = dropUnreadable7(yield* readStorage(news));
     if (after === undefined) {
-      return yield* Effect97.die(new Error(`storage/${news.storage}: the write returned no error but the storage is still ` + 'absent. PVE wraps every answer in {"data":...} and can report success on a ' + "call that did nothing -- read back rather than trusting the status code."));
+      return yield* Effect98.die(new Error(`storage/${news.storage}: the write returned no error but the storage is still ` + 'absent. PVE wraps every answer in {"data":...} and can report success on a ' + "call that did nothing -- read back rather than trusting the status code."));
     }
     return after;
   }),
-  delete: Effect97.fn(function* ({ olds }) {
+  delete: Effect98.fn(function* ({ olds }) {
     yield* runPve(olds.target, "provision", true, storage2.deleteStorage({ storage: olds.storage }));
   })
 })));
 // src/proxmox/zfs-pool.ts
 import { Resource as Resource36 } from "alchemy";
-import { isResolved as isResolved31 } from "alchemy/Diff";
+import { isResolved as isResolved32 } from "alchemy/Diff";
 import * as Provider36 from "alchemy/Provider";
-import * as Effect100 from "effect/Effect";
+import * as Effect101 from "effect/Effect";
 
 // src/proxmox/zfs-pool-wire.ts
 import * as nodes20 from "@distilled.cloud/proxmox/nodes";
-import * as Effect98 from "effect/Effect";
+import * as Effect99 from "effect/Effect";
 var leafDevices = (children) => Array.isArray(children) ? children.flatMap((entry) => {
   const vdev = entry;
   const nested = leafDevices(vdev.children);
   return nested.length > 0 ? nested : [text(vdev.name)].filter((name) => name !== "");
 }) : [];
-var attributesOf11 = (live, props) => ({
+var attributesOf12 = (live, props) => ({
   devices: leafDevices(live.children).join(","),
   errors: text(live.errors, "unknown"),
   name: props.name,
   node: props.node,
   state: text(live.state, "unknown")
 });
-var readPoolOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, nodes20.getNodeDiskZfs({ name: props.name, node: props.node }))).pipe(Effect98.map((live) => {
+var readPoolOrFail = (props) => readOrUnreadable(runPve(props.target, "read", false, nodes20.getNodeDiskZfs({ name: props.name, node: props.node }))).pipe(Effect99.map((live) => {
   if (live === UNREADABLE)
     return UNREADABLE;
-  return text(live.name) === "" ? undefined : attributesOf11(live, props);
+  return text(live.name) === "" ? undefined : attributesOf12(live, props);
 }));
-var readPool2 = (props) => readPoolOrFail(props).pipe(Effect98.orElseSucceed(() => {
+var readPool2 = (props) => readPoolOrFail(props).pipe(Effect99.orElseSucceed(() => {
   return;
 }));
 var dropUnreadable8 = (live) => live === UNREADABLE ? undefined : live;
 
 // src/proxmox/zfs-pool-form.ts
-import * as Effect99 from "effect/Effect";
+import * as Effect100 from "effect/Effect";
 import * as nodes21 from "@distilled.cloud/proxmox/nodes";
 var ZFS_POOL_CREATE = "pve:POST /nodes/{node}/disks/zfs";
 var zfsPoolCreateEndpoint = (props) => props.devices === undefined || props.raidlevel === undefined ? undefined : ZFS_POOL_CREATE;
@@ -7071,25 +7119,25 @@ var toDistilledCreate5 = (props) => {
   };
 };
 var SETTLE_ATTEMPTS = 30;
-var createPool2 = (props, read6) => Effect99.gen(function* () {
+var createPool2 = (props, read6) => Effect100.gen(function* () {
   const existing = yield* read6(props);
   if (existing !== undefined)
     return existing;
   if (props.devices === undefined || props.raidlevel === undefined) {
-    return yield* Effect99.die(new Error(`${props.node}/${props.name}: this is an adopt-only declaration (no \`devices\` or ` + "`raidlevel`) and the pool is not there to adopt. An adopt-only Proxmox.ZfsPool never " + "creates -- declare both fields for a pool this resource should build, or point this " + "declaration at a pool that already exists on this node."));
+    return yield* Effect100.die(new Error(`${props.node}/${props.name}: this is an adopt-only declaration (no \`devices\` or ` + "`raidlevel`) and the pool is not there to adopt. An adopt-only Proxmox.ZfsPool never " + "creates -- declare both fields for a pool this resource should build, or point this " + "declaration at a pool that already exists on this node."));
   }
   yield* guardForm(zfsPoolCreateEndpoint(props), asForm2(createForm12(props)), true);
   const upid = yield* runPve(props.target, "provision", true, nodes21.createNodeDiskZfs(toDistilledCreate5(props)));
-  const settle3 = (attempts) => Effect99.gen(function* () {
+  const settle3 = (attempts) => Effect100.gen(function* () {
     const live = yield* read6(props);
     if (live !== undefined || attempts <= 0)
       return live;
-    yield* Effect99.sleep("2 seconds");
+    yield* Effect100.sleep("2 seconds");
     return yield* settle3(attempts - 1);
   });
   const after = yield* settle3(SETTLE_ATTEMPTS);
   if (after === undefined) {
-    return yield* Effect99.die(new Error(`nodes/${props.node}/disks/zfs/${props.name}: POST returned ${text(upid, "(no UPID)")} ` + "but the pool has not appeared. That POST only forks a `zfscreate` worker, so the task " + `holds the real error -- read it with \`pvesh get /nodes/${props.node}/tasks/<upid>/log\`. ` + "NOTHING WAS RETRIED AND NOTHING WAS CLEANED UP: if the worker reached `zpool create`, " + "the declared devices have already been written to. DO NOT RE-RUN THIS DEPLOY BEFORE " + 'READING THAT LOG: `read` cannot tell "the worker is still running" from "the pool is ' + 'genuinely gone", so a re-run this soon can POST a SECOND `zpool create` at the SAME ' + "devices while the first one is still mid-write -- confirm the task finished (one way " + "or the other) before trying again."));
+    return yield* Effect100.die(new Error(`nodes/${props.node}/disks/zfs/${props.name}: POST returned ${text(upid, "(no UPID)")} ` + "but the pool has not appeared. That POST only forks a `zfscreate` worker, so the task " + `holds the real error -- read it with \`pvesh get /nodes/${props.node}/tasks/<upid>/log\`. ` + "NOTHING WAS RETRIED AND NOTHING WAS CLEANED UP: if the worker reached `zpool create`, " + "the declared devices have already been written to. DO NOT RE-RUN THIS DEPLOY BEFORE " + 'READING THAT LOG: `read` cannot tell "the worker is still running" from "the pool is ' + 'genuinely gone", so a re-run this soon can POST a SECOND `zpool create` at the SAME ' + "devices while the first one is still mid-write -- confirm the task finished (one way " + "or the other) before trying again."));
   }
   return after;
 });
@@ -7099,20 +7147,20 @@ var destroyPool = (props) => runPve(props.target, "provision", true, nodes21.del
 var ProxmoxZfsPool = Resource36("Proxmox.ZfsPool", {
   defaultRemovalPolicy: "retain"
 });
-var ProxmoxZfsPoolProvider = () => Provider36.effect(ProxmoxZfsPool, Effect100.succeed(ProxmoxZfsPool.Provider.of({
-  list: () => Effect100.succeed([]),
-  read: Effect100.fn(function* ({ olds, output }) {
+var ProxmoxZfsPoolProvider = () => Provider36.effect(ProxmoxZfsPool, Effect101.succeed(ProxmoxZfsPool.Provider.of({
+  list: () => Effect101.succeed([]),
+  read: Effect101.fn(function* ({ olds, output }) {
     return dropUnreadable8(yield* output === undefined ? readPool2(olds) : readPoolOrFail(olds));
   }),
-  diff: Effect100.fn(function* ({ news, output }) {
-    if (!isResolved31(news))
+  diff: Effect101.fn(function* ({ news, output }) {
+    if (!isResolved32(news))
       return;
     yield* guardForm(zfsPoolCreateEndpoint(news), asForm2(createForm12(news)), output === undefined);
     if (output === undefined)
       return;
     const live = yield* readPoolOrFail(news);
     if (live === UNREADABLE) {
-      yield* unreadableWarning("Proxmox.ZfsPool", `${news.node}/${news.name}`);
+      yield* unreadableWarning("Proxmox.ZfsPool", `${news.node}/${news.name}`, news.target.mount, mintTier(news.target, "read"));
       return { action: "noop" };
     }
     if (live === undefined) {
@@ -7121,10 +7169,10 @@ var ProxmoxZfsPoolProvider = () => Provider36.effect(ProxmoxZfsPool, Effect100.s
     }
     return { action: "noop" };
   }),
-  reconcile: Effect100.fn(function* ({ news }) {
-    return yield* createPool2(news, (props) => readPool2(props).pipe(Effect100.map(dropUnreadable8)));
+  reconcile: Effect101.fn(function* ({ news }) {
+    return yield* createPool2(news, (props) => readPool2(props).pipe(Effect101.map(dropUnreadable8)));
   }),
-  delete: Effect100.fn(function* ({ olds }) {
+  delete: Effect101.fn(function* ({ olds }) {
     yield* destroyPool(olds);
   })
 })));
@@ -7207,5 +7255,5 @@ export {
   violations
 };
 
-//# debugId=23CD7F01601D5A3A64756E2164756E21
+//# debugId=267899A4B122300564756E2164756E21
 //# sourceMappingURL=index.js.map