@homeflare/alchemy 0.6.0 → 0.7.0

package/dist/openbao/index.js

@@ -804,7 +804,7 @@ var assertBaoIdentity = (input) => {
 import { Resource as Resource3 } from "alchemy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 import * as Provider3 from "alchemy/Provider";
-import * as Effect12 from "effect/Effect";
+import * as Effect13 from "effect/Effect";
 
 // src/openbao/cloudflare-group-scope.ts
 var zoneResource = (zoneId) => `com.cloudflare.api.account.zone.${zoneId}`;
@@ -1184,13 +1184,46 @@ var permissionGroupsFromLiveRoles = (declared) => Effect11.gen(function* () {
   });
 });
 
+// src/openbao/rename.ts
+import * as Effect12 from "effect/Effect";
+var exact = (identity) => identity;
+var declaredString = (news, key) => {
+  if (typeof news !== "object" || news === null)
+    return;
+  const value = news[key];
+  return typeof value === "string" ? value : undefined;
+};
+var isPendingProp = (news, key) => {
+  if (typeof news !== "object" || news === null)
+    return false;
+  const value = news[key];
+  return value !== undefined && typeof value !== "string";
+};
+var declaredRolePath = (news, rolePath2) => {
+  const mount = declaredString(news, "mount");
+  const name = declaredString(news, "name");
+  return mount === undefined || name === undefined ? undefined : rolePath2(mount, name);
+};
+var policyKey = (name) => name.trim().toLowerCase();
+var isMoved = (stored, declared, key = exact) => declared === undefined ? undefined : key(stored) !== key(declared);
+var triedRolePath = (output, olds, rolePath2) => output === undefined ? declaredRolePath(olds, rolePath2) : rolePath2(output.mount, output.name);
+var judgeMove = (family, tried, declared, pathOf, key = exact) => Effect12.gen(function* () {
+  if (tried === undefined || declared === undefined || key(tried) === key(declared)) {
+    return;
+  }
+  if ((yield* baoRead(pathOf(declared))) === undefined)
+    return { from: tried, to: declared };
+  return yield* Effect12.die(new Error(`${family}: ${tried} → ${declared} would land on an object that already exists at ` + `${declared}. Under RemovalPolicy.destroy() a resource moving off that name (a swap, a ` + "shift, or a reverted move that did not finish) deletes it after this one writes it. " + "Nothing was written. Move through a name nothing holds, in two deploys, or remove " + `${declared} by hand first.`));
+});
+var refuseMovedUpdate = (family, from, to) => Effect12.die(new Error(`${family}: planned as an update, but its identity moved from ${from} to ${to}. Writing ` + `${to} now would leave ${from} live with no state record. Nothing was written. Run the ` + "deploy again: once the value resolves at plan time it plans as a replace."));
+
 // src/openbao/cloudflare-role.ts
 var BaoCloudflareRole = Resource3("Bao.CloudflareRole", {
   defaultRemovalPolicy: "retain"
 });
-var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect12.gen(function* () {
+var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect13.gen(function* () {
   const groups = yield* CloudflarePermissionGroups;
-  const resolved = (props) => Effect12.gen(function* () {
+  const resolved = (props) => Effect13.gen(function* () {
     const refs = new Map;
     for (const policy of props.policies) {
       const scope = policy.scope ?? scopeOfResource(policy.resource);
@@ -1200,18 +1233,25 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
     const ids = yield* groups.resolve(props.mount, [...refs.values()]);
     const { missing, policies } = resolvePolicies(props.policies, ids);
     if (missing.length > 0) {
-      return yield* Effect12.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
+      return yield* Effect13.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
     }
     return policies;
   });
   return BaoCloudflareRole.Provider.of({
-    list: () => Effect12.succeed([]),
-    read: Effect12.fn(function* ({ olds }) {
+    list: () => Effect13.succeed([]),
+    read: Effect13.fn(function* ({ olds }) {
       const live = yield* readCloudflareRole(olds.mount, olds.name);
       return live === undefined ? undefined : attributesOf4(olds, live);
     }),
-    diff: Effect12.fn(function* ({ news, output }) {
-      if (output === undefined || !isResolved3(news))
+    diff: Effect13.fn(function* ({ news, olds, output }) {
+      const tried = triedRolePath(output, olds, rolePath);
+      const declared = declaredRolePath(news, rolePath);
+      const move = yield* judgeMove("Bao.CloudflareRole", tried, declared, (path) => path);
+      if (output === undefined)
+        return;
+      if (move !== undefined)
+        return { action: "replace" };
+      if (!isResolved3(news))
         return;
       if (refusalOf(news) !== undefined)
         return { action: "update" };
@@ -1221,11 +1261,15 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
         return { action: "update" };
       return differences(news, policies, live).length === 0 ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect12.fn(function* ({ news }) {
+    reconcile: Effect13.fn(function* ({ news, output }) {
       const path = rolePath(news.mount, news.name);
+      const before = output === undefined ? path : rolePath(output.mount, output.name);
+      if (isMoved(before, path) === true) {
+        return yield* refuseMovedUpdate("Bao.CloudflareRole", before, path);
+      }
       const refusal2 = refusalOf(news);
       if (refusal2 !== undefined) {
-        return yield* Effect12.die(new Error(`Bao.CloudflareRole ${path}: ${refusal2}.`));
+        return yield* Effect13.die(new Error(`Bao.CloudflareRole ${path}: ${refusal2}.`));
       }
       const policies = yield* resolved(news);
       const live = yield* readCloudflareRole(news.mount, news.name);
@@ -1234,15 +1278,15 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
       }
       const after = yield* readCloudflareRole(news.mount, news.name);
       if (after === undefined) {
-        return yield* Effect12.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
+        return yield* Effect13.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
       }
       const left = differences(news, policies, after);
       if (left.length > 0) {
-        return yield* Effect12.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
+        return yield* Effect13.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
       }
       return attributesOf4(news, after);
     }),
-    delete: Effect12.fn(function* ({ output }) {
+    delete: Effect13.fn(function* ({ output }) {
       yield* deleteCloudflareRole(output.mount, output.name);
       return;
     })
@@ -1492,7 +1536,7 @@ var hostAppRoles = (input) => {
 import { Resource as Resource4 } from "alchemy";
 import { isResolved as isResolved4 } from "alchemy/Diff";
 import * as Provider4 from "alchemy/Provider";
-import * as Effect14 from "effect/Effect";
+import * as Effect15 from "effect/Effect";
 
 // src/openbao/jwt-config-form.ts
 var text5 = (value) => typeof value === "string" ? value.trim() : "";
@@ -1582,16 +1626,16 @@ var problems = (props) => {
 };
 
 // src/openbao/role-reconcile.ts
-import * as Effect13 from "effect/Effect";
-var readRoleAt = (spec) => Effect13.map(baoRead(spec.path), (live) => live === undefined ? undefined : { attributes: spec.attributesOf(live), live });
-var planRole = (spec) => Effect13.gen(function* () {
+import * as Effect14 from "effect/Effect";
+var readRoleAt = (spec) => Effect14.map(baoRead(spec.path), (live) => live === undefined ? undefined : { attributes: spec.attributesOf(live), live });
+var planRole = (spec) => Effect14.gen(function* () {
   if (spec.problems.length > 0)
     return "update";
   const found = yield* readRoleAt(spec);
   return found !== undefined && spec.matches(found.attributes) ? "noop" : "update";
 });
-var refuse2 = (spec, message) => Effect13.die(new Error(`${spec.family} ${spec.path}: ${message}`));
-var reconcileRole = (spec) => Effect13.gen(function* () {
+var refuse2 = (spec, message) => Effect14.die(new Error(`${spec.family} ${spec.path}: ${message}`));
+var reconcileRole = (spec) => Effect14.gen(function* () {
   if (spec.problems.length > 0)
     return yield* refuse2(spec, spec.problems.join("; "));
   const found = yield* readRoleAt(spec);
@@ -1624,29 +1668,29 @@ var jwtConfigSpec = (props) => ({
   problems: problems(props),
   wouldErase
 });
-var BaoJwtAuthConfigProvider = () => Provider4.effect(BaoJwtAuthConfig, Effect14.succeed(BaoJwtAuthConfig.Provider.of({
-  list: () => Effect14.succeed([]),
-  read: Effect14.fn(function* ({ olds }) {
+var BaoJwtAuthConfigProvider = () => Provider4.effect(BaoJwtAuthConfig, Effect15.succeed(BaoJwtAuthConfig.Provider.of({
+  list: () => Effect15.succeed([]),
+  read: Effect15.fn(function* ({ olds }) {
     const found = yield* readRoleAt(jwtConfigSpec(olds));
     return found?.attributes;
   }),
-  diff: Effect14.fn(function* ({ news, output }) {
+  diff: Effect15.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved4(news))
       return;
     if (mountOf(news) !== output.mount)
       return { action: "replace" };
     return { action: yield* planRole(jwtConfigSpec(news)) };
   }),
-  reconcile: Effect14.fn(function* ({ news }) {
+  reconcile: Effect15.fn(function* ({ news }) {
     return yield* reconcileRole(jwtConfigSpec(news));
   }),
-  delete: () => Effect14.void
+  delete: () => Effect15.void
 })));
 // src/openbao/jwt-role.ts
 import { Resource as Resource5 } from "alchemy";
 import { isResolved as isResolved5 } from "alchemy/Diff";
 import * as Provider5 from "alchemy/Provider";
-import * as Effect15 from "effect/Effect";
+import * as Effect16 from "effect/Effect";
 
 // src/openbao/auth-token-form.ts
 var sortedSet2 = (values) => [...new Set(values)].sort();
@@ -1856,13 +1900,13 @@ var jwtRoleSpec = (props) => ({
   path: rolePath2(props),
   problems: problems2(props)
 });
-var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect15.succeed(BaoJwtRole.Provider.of({
-  list: () => Effect15.succeed([]),
-  read: Effect15.fn(function* ({ olds }) {
+var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect16.succeed(BaoJwtRole.Provider.of({
+  list: () => Effect16.succeed([]),
+  read: Effect16.fn(function* ({ olds }) {
     const found = yield* readRoleAt(jwtRoleSpec(olds));
     return found?.attributes;
   }),
-  diff: Effect15.fn(function* ({ news, output }) {
+  diff: Effect16.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved5(news))
       return;
     if (mountOf2(news) !== output.mount || news.name !== output.name) {
@@ -1870,10 +1914,10 @@ var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect15.succeed(Bao
     }
     return { action: yield* planRole(jwtRoleSpec(news)) };
   }),
-  reconcile: Effect15.fn(function* ({ news }) {
+  reconcile: Effect16.fn(function* ({ news }) {
     return yield* reconcileRole(jwtRoleSpec(news));
   }),
-  delete: Effect15.fn(function* ({ output }) {
+  delete: Effect16.fn(function* ({ output }) {
     yield* baoDelete(rolePath2(output));
     return;
   })
@@ -1882,7 +1926,7 @@ var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect15.succeed(Bao
 import { Resource as Resource6 } from "alchemy";
 import { isResolved as isResolved6 } from "alchemy/Diff";
 import * as Provider6 from "alchemy/Provider";
-import * as Effect16 from "effect/Effect";
+import * as Effect17 from "effect/Effect";
 
 // src/openbao/kubernetes-role-form.ts
 var sortedSet4 = (values) => [...new Set(values)].sort();
@@ -1959,13 +2003,13 @@ var kubernetesRoleSpec = (props) => ({
   path: rolePath3(props),
   problems: problems3(props)
 });
-var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect16.succeed(BaoKubernetesRole.Provider.of({
-  list: () => Effect16.succeed([]),
-  read: Effect16.fn(function* ({ olds }) {
+var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect17.succeed(BaoKubernetesRole.Provider.of({
+  list: () => Effect17.succeed([]),
+  read: Effect17.fn(function* ({ olds }) {
     const found = yield* readRoleAt(kubernetesRoleSpec(olds));
     return found?.attributes;
   }),
-  diff: Effect16.fn(function* ({ news, output }) {
+  diff: Effect17.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved6(news))
       return;
     if (mountOf3(news) !== output.mount || news.name !== output.name) {
@@ -1973,10 +2017,10 @@ var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect
     }
     return { action: yield* planRole(kubernetesRoleSpec(news)) };
   }),
-  reconcile: Effect16.fn(function* ({ news }) {
+  reconcile: Effect17.fn(function* ({ news }) {
     return yield* reconcileRole(kubernetesRoleSpec(news));
   }),
-  delete: Effect16.fn(function* ({ output }) {
+  delete: Effect17.fn(function* ({ output }) {
     yield* baoDelete(rolePath3(output));
     return;
   })
@@ -1985,7 +2029,7 @@ var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect
 import { Resource as Resource7 } from "alchemy";
 import { isResolved as isResolved7 } from "alchemy/Diff";
 import * as Provider7 from "alchemy/Provider";
-import * as Effect18 from "effect/Effect";
+import * as Effect19 from "effect/Effect";
 
 // src/openbao/mfa-enforcement-form.ts
 var sortedSet5 = (values) => [...new Set(values.map((value) => value.trim()))].filter((value) => value !== "").sort();
@@ -2053,16 +2097,16 @@ var problems4 = (props, missingPaths) => {
 };
 
 // src/openbao/mfa-wire.ts
-import * as Effect17 from "effect/Effect";
+import * as Effect18 from "effect/Effect";
 var TOTP_PATH = "identity/mfa/method/totp";
 var METHODS_PATH = "identity/mfa/method";
 var enforcementPath = (name) => `identity/mfa/login-enforcement/${name}`;
 var record4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
-var ownNamespacePath = Effect17.gen(function* () {
+var ownNamespacePath = Effect18.gen(function* () {
   const env = yield* BaoEnv;
   return namespacePath(envNamespace(env));
 });
-var findTotp = (name) => Effect17.gen(function* () {
+var findTotp = (name) => Effect18.gen(function* () {
   const listing = yield* baoRead(`${METHODS_PATH}?list=true`);
   const info = record4(listing?.["key_info"]) ?? {};
   const own = yield* ownNamespacePath;
@@ -2071,17 +2115,17 @@ var findTotp = (name) => Effect17.gen(function* () {
     if (live === undefined || live["name"] !== name || live["namespace_path"] !== own)
       continue;
     if (live["type"] !== "totp") {
-      return yield* Effect17.die(new Error(`Bao.MfaTotpMethod ${name}: that name belongs to a ${String(live["type"])} method ` + `(${id}) in this namespace, and a TOTP write would convert it. Pick another name.`));
+      return yield* Effect18.die(new Error(`Bao.MfaTotpMethod ${name}: that name belongs to a ${String(live["type"])} method ` + `(${id}) in this namespace, and a TOTP write would convert it. Pick another name.`));
     }
     return { id, live };
   }
   return;
 });
-var writeTotp = (body) => Effect17.asVoid(baoCall("write", "POST", TOTP_PATH, body));
+var writeTotp = (body) => Effect18.asVoid(baoCall("write", "POST", TOTP_PATH, body));
 var deleteTotp = (id) => baoDelete(`${TOTP_PATH}/${id}`);
 var readEnforcement = (name) => baoRead(enforcementPath(name));
-var writeEnforcement = (name, body) => Effect17.asVoid(baoCall("write", "POST", enforcementPath(name), body));
-var authAccessors = (paths) => Effect17.gen(function* () {
+var writeEnforcement = (name, body) => Effect18.asVoid(baoCall("write", "POST", enforcementPath(name), body));
+var authAccessors = (paths) => Effect18.gen(function* () {
   if (paths.length === 0)
     return { accessors: [], missing: [] };
   const table = (yield* baoRead("sys/auth")) ?? {};
@@ -2101,20 +2145,20 @@ var authAccessors = (paths) => Effect17.gen(function* () {
 var BaoMfaLoginEnforcement = Resource7("Bao.MfaLoginEnforcement", {
   defaultRemovalPolicy: "retain"
 });
-var refuse3 = (name, message) => Effect18.die(new Error(`Bao.MfaLoginEnforcement ${name}: ${message}`));
-var resolveTargets = (props) => Effect18.map(authAccessors(props.authMethodPaths ?? []), ({ accessors, missing }) => ({
+var refuse3 = (name, message) => Effect19.die(new Error(`Bao.MfaLoginEnforcement ${name}: ${message}`));
+var resolveTargets = (props) => Effect19.map(authAccessors(props.authMethodPaths ?? []), ({ accessors, missing }) => ({
   bad: problems4(props, missing),
   resolved: accessors
 }));
-var readLive = (name) => Effect18.map(readEnforcement(name), (live) => live === undefined ? undefined : attributesOf8(name, live));
-var planEnforcement = (props) => Effect18.gen(function* () {
+var readLive = (name) => Effect19.map(readEnforcement(name), (live) => live === undefined ? undefined : attributesOf8(name, live));
+var planEnforcement = (props) => Effect19.gen(function* () {
   const { bad, resolved } = yield* resolveTargets(props);
   if (bad.length > 0)
     return "update";
   const live = yield* readLive(props.name);
   return live !== undefined && matches7(live, props, resolved) ? "noop" : "update";
 });
-var reconcileEnforcement = (props) => Effect18.gen(function* () {
+var reconcileEnforcement = (props) => Effect19.gen(function* () {
   const { bad, resolved } = yield* resolveTargets(props);
   if (bad.length > 0)
     return yield* refuse3(props.name, bad.join("; "));
@@ -2130,22 +2174,22 @@ var reconcileEnforcement = (props) => Effect18.gen(function* () {
   }
   return after;
 });
-var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforcement, Effect18.succeed(BaoMfaLoginEnforcement.Provider.of({
-  list: () => Effect18.succeed([]),
-  read: Effect18.fn(function* ({ olds }) {
+var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforcement, Effect19.succeed(BaoMfaLoginEnforcement.Provider.of({
+  list: () => Effect19.succeed([]),
+  read: Effect19.fn(function* ({ olds }) {
     return yield* readLive(olds.name);
   }),
-  diff: Effect18.fn(function* ({ news, output }) {
+  diff: Effect19.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved7(news))
       return;
     if (news.name !== output.name)
       return { action: "replace" };
     return { action: yield* planEnforcement(news) };
   }),
-  reconcile: Effect18.fn(function* ({ news }) {
+  reconcile: Effect19.fn(function* ({ news }) {
     return yield* reconcileEnforcement(news);
   }),
-  delete: Effect18.fn(function* ({ output }) {
+  delete: Effect19.fn(function* ({ output }) {
     return yield* refuse3(output.name, "REFUSING to delete: OpenBao 2.6.2 drops a login enforcement from memory only, and it " + "returns on the next unseal (openbao/openbao#4030). Set this resource back to " + "retain to drop it from state; remove it for good only once the server is fixed.");
   })
 })));
@@ -2153,7 +2197,7 @@ var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforceme
 import { Resource as Resource8 } from "alchemy";
 import { isResolved as isResolved8 } from "alchemy/Diff";
 import * as Provider8 from "alchemy/Provider";
-import * as Effect19 from "effect/Effect";
+import * as Effect20 from "effect/Effect";
 
 // src/openbao/mfa-totp-form.ts
 var canonical6 = (input) => ({
@@ -2234,15 +2278,15 @@ var problems5 = (props) => {
 var BaoMfaTotpMethod = Resource8("Bao.MfaTotpMethod", {
   defaultRemovalPolicy: "retain"
 });
-var refuse4 = (props, message) => Effect19.die(new Error(`Bao.MfaTotpMethod ${props.name}: ${message}`));
-var readTotp = (props) => Effect19.map(findTotp(props.name), (found) => found === undefined ? undefined : attributesOf9(found.id, found.live));
-var planTotp = (props) => Effect19.gen(function* () {
+var refuse4 = (props, message) => Effect20.die(new Error(`Bao.MfaTotpMethod ${props.name}: ${message}`));
+var readTotp = (props) => Effect20.map(findTotp(props.name), (found) => found === undefined ? undefined : attributesOf9(found.id, found.live));
+var planTotp = (props) => Effect20.gen(function* () {
   if (problems5(props).length > 0)
     return "update";
   const live = yield* readTotp(props);
   return live !== undefined && matches8(live, props) ? "noop" : "update";
 });
-var reconcileTotp = (props) => Effect19.gen(function* () {
+var reconcileTotp = (props) => Effect20.gen(function* () {
   const bad = problems5(props);
   if (bad.length > 0)
     return yield* refuse4(props, bad.join("; "));
@@ -2256,12 +2300,12 @@ var reconcileTotp = (props) => Effect19.gen(function* () {
     return yield* refuse4(props, "the method read back different.");
   return after;
 });
-var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect19.succeed(BaoMfaTotpMethod.Provider.of({
-  list: () => Effect19.succeed([]),
-  read: Effect19.fn(function* ({ olds }) {
+var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect20.succeed(BaoMfaTotpMethod.Provider.of({
+  list: () => Effect20.succeed([]),
+  read: Effect20.fn(function* ({ olds }) {
     return yield* readTotp(olds);
   }),
-  diff: Effect19.fn(function* ({ news, output }) {
+  diff: Effect20.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved8(news))
       return;
     const rename = renameProblem(output.name, news.name);
@@ -2269,10 +2313,10 @@ var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect19
       return yield* refuse4(news, rename);
     return { action: yield* planTotp(news) };
   }),
-  reconcile: Effect19.fn(function* ({ news }) {
+  reconcile: Effect20.fn(function* ({ news }) {
     return yield* reconcileTotp(news);
   }),
-  delete: Effect19.fn(function* ({ output }) {
+  delete: Effect20.fn(function* ({ output }) {
     yield* deleteTotp(output.methodId);
     return;
   })
@@ -2281,24 +2325,24 @@ var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect19
 import { Resource as Resource9 } from "alchemy";
 import { isResolved as isResolved9 } from "alchemy/Diff";
 import * as Provider9 from "alchemy/Provider";
-import * as Effect22 from "effect/Effect";
+import * as Effect23 from "effect/Effect";
 
 // src/openbao/mount-reconcile.ts
-import * as Effect21 from "effect/Effect";
+import * as Effect22 from "effect/Effect";
 
 // src/openbao/mount-wire.ts
-import * as Effect20 from "effect/Effect";
-var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect20.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+import * as Effect21 from "effect/Effect";
+var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect21.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
   ...asked.errors,
   `sys/mounts could not confirm the mount is absent: ${listing.message}`
-])), Effect20.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect20.succeed(undefined) : Effect20.fail(asked)));
-var readMountData = (path) => baoRead(readPath(path)).pipe(Effect20.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
+])), Effect21.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect21.succeed(undefined) : Effect21.fail(asked)));
+var readMountData = (path) => baoRead(readPath(path)).pipe(Effect21.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
 var enableMount = (props) => baoWrite("POST", readPath(props.path), enableBody(props));
 var tuneMount = (props) => baoWrite("POST", tunePath(props.path), tuneBody(props));
 var disableMount = (path) => baoDelete(readPath(path));
 
 // src/openbao/mount-reconcile.ts
-var readMount = (props) => Effect21.gen(function* () {
+var readMount = (props) => Effect22.gen(function* () {
   const live = yield* readMountData(props.path);
   if (live === undefined)
     return;
@@ -2311,10 +2355,10 @@ var moveTarget2 = (props) => ({
   type: props.type,
   wire: mountPath
 });
-var reconcileMount = (news, stated, options) => Effect21.gen(function* () {
+var reconcileMount = (news, stated, options) => Effect22.gen(function* () {
   const move = planMove("Bao.Mount", stated, news.path, news.remountFrom);
   if (move.kind === "refuse")
-    return yield* Effect21.die(new Error(move.message));
+    return yield* Effect22.die(new Error(move.message));
   if (move.kind === "move")
     yield* performMove(moveTarget2(news), move.from, options);
   let live = yield* readMount(news);
@@ -2324,13 +2368,13 @@ var reconcileMount = (news, stated, options) => Effect21.gen(function* () {
       yield* tuneMount(news);
   } else if (!matches(live, news)) {
     if (live.type !== news.type) {
-      return yield* Effect21.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
+      return yield* Effect22.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
     }
     yield* tuneMount(news);
   }
   live = yield* readMount(news);
   if (live === undefined) {
-    return yield* Effect21.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
+    return yield* Effect22.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
   }
   return live;
 });
@@ -2339,17 +2383,17 @@ var reconcileMount = (news, stated, options) => Effect21.gen(function* () {
 var BaoMount = Resource9("Bao.Mount", {
   defaultRemovalPolicy: "retain"
 });
-var BaoMountProvider = () => Provider9.effect(BaoMount, Effect22.succeed(BaoMount.Provider.of({
-  list: () => Effect22.succeed([]),
-  read: Effect22.fn(function* ({ olds }) {
+var BaoMountProvider = () => Provider9.effect(BaoMount, Effect23.succeed(BaoMount.Provider.of({
+  list: () => Effect23.succeed([]),
+  read: Effect23.fn(function* ({ olds }) {
     return yield* readMount(olds);
   }),
-  diff: Effect22.fn(function* ({ news, output }) {
+  diff: Effect23.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved9(news))
       return;
     const move = planMove("Bao.Mount", output.path, news.path, news.remountFrom);
     if (move.kind === "refuse")
-      return yield* Effect22.die(new Error(move.message));
+      return yield* Effect23.die(new Error(move.message));
     if (move.kind === "move")
       return { action: "update" };
     const live = yield* readMount(news);
@@ -2361,10 +2405,10 @@ var BaoMountProvider = () => Provider9.effect(BaoMount, Effect22.succeed(BaoMoun
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect22.fn(function* ({ news, output }) {
+  reconcile: Effect23.fn(function* ({ news, output }) {
     return yield* reconcileMount(news, output?.path);
   }),
-  delete: Effect22.fn(function* ({ output }) {
+  delete: Effect23.fn(function* ({ output }) {
     yield* disableMount(output.path);
     return;
   })
@@ -2373,7 +2417,7 @@ var BaoMountProvider = () => Provider9.effect(BaoMount, Effect22.succeed(BaoMoun
 import { Resource as Resource10 } from "alchemy";
 import { isResolved as isResolved10 } from "alchemy/Diff";
 import * as Provider10 from "alchemy/Provider";
-import * as Effect23 from "effect/Effect";
+import * as Effect24 from "effect/Effect";
 
 // src/openbao/pki-role-canonical.ts
 var DEFAULT_KEY_USAGE = [
@@ -2539,18 +2583,18 @@ var problems6 = (props) => {
 var BaoPkiRole = Resource10("Bao.PkiRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole2 = (props) => Effect23.gen(function* () {
+var readRole2 = (props) => Effect24.gen(function* () {
   const live = yield* baoRead(rolePath4(props));
   if (live === undefined)
     return;
   return attributesOf10(props, live);
 });
-var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect23.succeed(BaoPkiRole.Provider.of({
-  list: () => Effect23.succeed([]),
-  read: Effect23.fn(function* ({ olds }) {
+var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect24.succeed(BaoPkiRole.Provider.of({
+  list: () => Effect24.succeed([]),
+  read: Effect24.fn(function* ({ olds }) {
     return yield* readRole2(olds);
   }),
-  diff: Effect23.fn(function* ({ news, output }) {
+  diff: Effect24.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved10(news))
       return;
     if (mountPath(news.mount ?? "pki") !== output.mount || news.name !== output.name)
@@ -2562,11 +2606,11 @@ var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect23.succeed(Ba
       return { action: "update" };
     return matches9(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect23.fn(function* ({ news }) {
+  reconcile: Effect24.fn(function* ({ news }) {
     const path = rolePath4(news);
     const bad = problems6(news);
     if (bad.length > 0) {
-      return yield* Effect23.die(new Error(`Bao.PkiRole ${path}: ${bad.join(" ")}`));
+      return yield* Effect24.die(new Error(`Bao.PkiRole ${path}: ${bad.join(" ")}`));
     }
     const live = yield* readRole2(news);
     if (live === undefined || !matches9(live, news)) {
@@ -2574,14 +2618,14 @@ var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect23.succeed(Ba
     }
     const after = yield* readRole2(news);
     if (after === undefined) {
-      return yield* Effect23.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
+      return yield* Effect24.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
     }
     if (!matches9(after, news)) {
-      return yield* Effect23.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
+      return yield* Effect24.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
     }
     return after;
   }),
-  delete: Effect23.fn(function* ({ output }) {
+  delete: Effect24.fn(function* ({ output }) {
     yield* baoDelete(rolePath4(output));
     return;
   })
@@ -2590,7 +2634,7 @@ var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect23.succeed(Ba
 import { Resource as Resource11 } from "alchemy";
 import { isResolved as isResolved11 } from "alchemy/Diff";
 import * as Provider11 from "alchemy/Provider";
-import * as Effect25 from "effect/Effect";
+import * as Effect26 from "effect/Effect";
 
 // src/openbao/plugin-form.ts
 var resolve = (props) => ({
@@ -2646,7 +2690,7 @@ var sameArgs = (want, have) => want.length === have.length && want.every((entry,
 var matches10 = (attributes, form) => !attributes.builtin && attributes.version === form.version && attributes.sha256 === form.sha256 && attributes.command === form.command && sameArgs(form.args, attributes.args);
 
 // src/openbao/plugin-reconcile.ts
-import * as Effect24 from "effect/Effect";
+import * as Effect25 from "effect/Effect";
 
 // src/openbao/plugin-wire.ts
 var readPluginData = (form) => baoRead(versionedPath(form.type, form.name, form.version));
@@ -2654,10 +2698,10 @@ var registerPlugin = (form) => baoWrite("PUT", catalogPath(form.type, form.name)
 var deregisterPlugin = (type, name, version) => baoDelete(versionedPath(type, name, version));
 
 // src/openbao/plugin-reconcile.ts
-var readEntry = (form) => Effect24.map(readPluginData(form), (live) => live === undefined ? undefined : { attributes: attributesOf11(form, live), live });
-var refuse5 = (form, message) => Effect24.die(new Error(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}: ${message}`));
+var readEntry = (form) => Effect25.map(readPluginData(form), (live) => live === undefined ? undefined : { attributes: attributesOf11(form, live), live });
+var refuse5 = (form, message) => Effect25.die(new Error(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}: ${message}`));
 var SELF_REPORTED = "the write succeeded but the read-back does not match. If the binary reports its own version, " + "OpenBao filed the registration under it (plugin_catalog.go setInternal) — declare `version` " + "as exactly the version the binary reports; that adopts the entry this write just made.";
-var reconcilePlugin = (props) => Effect24.gen(function* () {
+var reconcilePlugin = (props) => Effect25.gen(function* () {
   const form = resolve(props);
   const bad = problems7(form);
   if (bad.length > 0)
@@ -2684,13 +2728,13 @@ var reconcilePlugin = (props) => Effect24.gen(function* () {
 var BaoPlugin = Resource11("Bao.Plugin", {
   defaultRemovalPolicy: "retain"
 });
-var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect25.succeed(BaoPlugin.Provider.of({
-  list: () => Effect25.succeed([]),
-  read: Effect25.fn(function* ({ olds }) {
+var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect26.succeed(BaoPlugin.Provider.of({
+  list: () => Effect26.succeed([]),
+  read: Effect26.fn(function* ({ olds }) {
     const found = yield* readEntry(resolve(olds));
     return found?.attributes;
   }),
-  diff: Effect25.fn(function* ({ news, output }) {
+  diff: Effect26.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved11(news))
       return;
     const form = resolve(news);
@@ -2702,10 +2746,10 @@ var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect25.succeed(BaoP
       return { action: "update" };
     return matches10(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect25.fn(function* ({ news }) {
+  reconcile: Effect26.fn(function* ({ news }) {
     return yield* reconcilePlugin(news);
   }),
-  delete: Effect25.fn(function* ({ output }) {
+  delete: Effect26.fn(function* ({ output }) {
     yield* deregisterPlugin(output.type, output.name, output.version);
     return;
   })
@@ -2714,7 +2758,7 @@ var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect25.succeed(BaoP
 import { Resource as Resource12 } from "alchemy";
 import { isResolved as isResolved12 } from "alchemy/Diff";
 import * as Provider12 from "alchemy/Provider";
-import * as Effect27 from "effect/Effect";
+import * as Effect28 from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 
@@ -2722,13 +2766,13 @@ import * as Path from "effect/Path";
 var isEmptyAssembly = (parts, joined) => parts === 0 || !/^\s*path\s+"/m.test(joined);
 
 // src/openbao/policy-wire.ts
-import * as Effect26 from "effect/Effect";
+import * as Effect27 from "effect/Effect";
 var policyPath = (name) => `sys/policies/acl/${name}`;
-var readPolicy = (name) => Effect26.flatMap(baoRead(policyPath(name)), (data) => {
+var readPolicy = (name) => Effect27.flatMap(baoRead(policyPath(name)), (data) => {
   if (data === undefined)
-    return Effect26.succeed("");
+    return Effect27.succeed("");
   const text11 = data["policy"];
-  return typeof text11 === "string" ? Effect26.succeed(text11) : Effect26.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
+  return typeof text11 === "string" ? Effect27.succeed(text11) : Effect27.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
 });
 var writePolicy = (name, hcl) => baoWrite("PUT", policyPath(name), { policy: hcl });
 var deletePolicy = (name) => baoDelete(policyPath(name));
@@ -2744,10 +2788,10 @@ var attributesOf12 = (name, hcl, parts) => ({
   grants: grantsOf(hcl),
   parts
 });
-var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect27.gen(function* () {
+var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect28.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const assemble = (dir) => Effect27.gen(function* () {
+  const assemble = (dir) => Effect28.gen(function* () {
     const entries2 = (yield* fs.readDirectory(dir)).filter((f) => f.endsWith(".hcl")).sort();
     let joined = "";
     for (const f of entries2)
@@ -2756,23 +2800,33 @@ var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect27.gen(function
     return { joined, parts: entries2.length };
   });
   return BaoPolicy.Provider.of({
-    list: () => Effect27.succeed([]),
-    read: Effect27.fn(function* ({ olds }) {
+    list: () => Effect28.succeed([]),
+    read: Effect28.fn(function* ({ olds }) {
       const live = yield* readPolicy(olds.name);
       return live.length === 0 ? undefined : attributesOf12(olds.name, live, 0);
     }),
-    diff: Effect27.fn(function* ({ news, output }) {
-      if (output === undefined || !isResolved12(news))
+    diff: Effect28.fn(function* ({ news, olds, output }) {
+      const tried = output?.name ?? declaredString(olds, "name");
+      const declared = declaredString(news, "name");
+      const move = yield* judgeMove("Bao.Policy", tried, declared, policyPath, policyKey);
+      if (output === undefined)
+        return;
+      if (move !== undefined)
+        return { action: "replace" };
+      if (!isResolved12(news))
         return;
       const { joined } = yield* assemble(news.fragments);
       const live = yield* readPolicy(news.name);
       return live.length > 0 && sha256(live) === sha256(joined) ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect27.fn(function* ({ news }) {
+    reconcile: Effect28.fn(function* ({ news, output }) {
       const name = news.name;
+      if (output !== undefined && isMoved(output.name, name, policyKey) === true) {
+        return yield* refuseMovedUpdate(`Bao.Policy ${name}`, output.name, name);
+      }
       const { joined, parts } = yield* assemble(news.fragments);
       if (isEmptyAssembly(parts, joined))
-        return yield* Effect27.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
+        return yield* Effect28.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
       const current = yield* readPolicy(name);
       if (current.length > 0 && sha256(current) === sha256(joined)) {
         return attributesOf12(name, joined, parts);
@@ -2780,7 +2834,7 @@ var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect27.gen(function
       yield* writePolicy(name, joined);
       return attributesOf12(name, joined, parts);
     }),
-    delete: Effect27.fn(function* ({ output }) {
+    delete: Effect28.fn(function* ({ output }) {
       yield* deletePolicy(output.name);
       return;
     })
@@ -2790,7 +2844,7 @@ var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect27.gen(function
 import { Resource as Resource13 } from "alchemy";
 import { isResolved as isResolved13 } from "alchemy/Diff";
 import * as Provider13 from "alchemy/Provider";
-import * as Effect28 from "effect/Effect";
+import * as Effect30 from "effect/Effect";
 
 // src/openbao/proxmox-role-form.ts
 var text11 = (value) => typeof value === "string" ? value : "";
@@ -2836,25 +2890,45 @@ var sameTtl5 = (want, have) => {
   const haveSeconds = ttlSeconds(have);
   return wantSeconds !== undefined && wantSeconds === haveSeconds;
 };
+var rescopeRefusal = (before, mintUser, allowMintUserChange) => before === mintUser || allowMintUserChange === before ? undefined : `re-scopes mint_user ${before} → ${mintUser}. Every token this role mints inherits ` + `the ACL of that PVE user. To re-scope deliberately, declare allowMintUserChange: '${before}'.`;
 var matches11 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl5(props.ttl, attributes.ttl) && sameTtl5(props.maxTtl, attributes.maxTtl);
 
-// src/openbao/proxmox-role.ts
-var BaoProxmoxRole = Resource13("Bao.ProxmoxRole", {
-  defaultRemovalPolicy: "retain"
-});
-var readRole3 = (props) => Effect28.gen(function* () {
+// src/openbao/proxmox-role-wire.ts
+import * as Effect29 from "effect/Effect";
+var readRole3 = (props) => Effect29.gen(function* () {
   const live = yield* baoRead(rolePath5(props.mount, props.name));
   if (live === undefined)
     return;
   return attributesOf13(props, live);
 });
-var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect28.succeed(BaoProxmoxRole.Provider.of({
-  list: () => Effect28.succeed([]),
-  read: Effect28.fn(function* ({ olds }) {
+
+// src/openbao/proxmox-role.ts
+var BaoProxmoxRole = Resource13("Bao.ProxmoxRole", {
+  defaultRemovalPolicy: "retain"
+});
+var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect30.succeed(BaoProxmoxRole.Provider.of({
+  list: () => Effect30.succeed([]),
+  read: Effect30.fn(function* ({ olds }) {
     return yield* readRole3(olds);
   }),
-  diff: Effect28.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved13(news))
+  diff: Effect30.fn(function* ({ news, olds, output }) {
+    const tried = triedRolePath(output, olds, rolePath5);
+    const declared = declaredRolePath(news, rolePath5);
+    const move = yield* judgeMove("Bao.ProxmoxRole", tried, declared, (path) => path);
+    if (output === undefined)
+      return;
+    if (move !== undefined) {
+      const mintUser = declaredString(news, "mintUser");
+      if (mintUser === undefined || isPendingProp(news, "allowMintUserChange"))
+        return;
+      const from = (yield* readRole3(output))?.mintUser ?? output.mintUser;
+      const allow = declaredString(news, "allowMintUserChange");
+      const refusal2 = rescopeRefusal(from, mintUser, allow);
+      if (refusal2 === undefined)
+        return { action: "replace" };
+      return yield* Effect30.die(new Error(`Bao.ProxmoxRole ${move.from} → ${move.to}: the rename ${refusal2}`));
+    }
+    if (!isResolved13(news))
       return;
     const live = yield* readRole3(news);
     if (live === undefined)
@@ -2863,25 +2937,31 @@ var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect28.su
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect28.fn(function* ({ news }) {
+  reconcile: Effect30.fn(function* ({ news, output }) {
+    const path = rolePath5(news.mount, news.name);
+    const before = output === undefined ? path : rolePath5(output.mount, output.name);
+    if (isMoved(before, path) === true) {
+      return yield* refuseMovedUpdate("Bao.ProxmoxRole", before, path);
+    }
     const live = yield* readRole3(news);
-    if (live !== undefined && live.mintUser !== news.mintUser && news.allowMintUserChange !== live.mintUser) {
-      return yield* Effect28.die(new Error(`Bao.ProxmoxRole ${rolePath5(news.mount, news.name)}: live mint_user ` + `${live.mintUser} != declared ${news.mintUser}. Every token this role mints ` + "inherits the ACL of that PVE user. To re-scope deliberately, declare " + `allowMintUserChange: '${live.mintUser}'.`));
+    const rescope = live === undefined ? undefined : rescopeRefusal(live.mintUser, news.mintUser, news.allowMintUserChange);
+    if (rescope !== undefined) {
+      return yield* Effect30.die(new Error(`Bao.ProxmoxRole ${path}: ${rescope}`));
     }
     if (live === undefined || !matches11(live, news)) {
       const write = writeBody9(news);
       if (!write.ok) {
-        return yield* Effect28.die(new Error(`Bao.ProxmoxRole ${rolePath5(news.mount, news.name)}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
+        return yield* Effect30.die(new Error(`Bao.ProxmoxRole ${path}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
       }
-      yield* baoWrite("PUT", rolePath5(news.mount, news.name), write.body);
+      yield* baoWrite("PUT", path, write.body);
     }
     const after = yield* readRole3(news);
     if (after === undefined) {
-      return yield* Effect28.die(new Error(`Bao.ProxmoxRole ${rolePath5(news.mount, news.name)}: write returned no error ` + "but the role is still absent."));
+      return yield* Effect30.die(new Error(`Bao.ProxmoxRole ${path}: write returned no error ` + "but the role is still absent."));
     }
     return after;
   }),
-  delete: Effect28.fn(function* ({ output }) {
+  delete: Effect30.fn(function* ({ output }) {
     yield* baoDelete(rolePath5(output.mount, output.name));
     return;
   })
@@ -2890,7 +2970,7 @@ var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect28.su
 import { Resource as Resource14 } from "alchemy";
 import { isResolved as isResolved14 } from "alchemy/Diff";
 import * as Provider14 from "alchemy/Provider";
-import * as Effect29 from "effect/Effect";
+import * as Effect31 from "effect/Effect";
 
 // src/openbao/ssh-role-form.ts
 var readPath4 = (mount, name) => `${sshMountOf(mount)}/roles/${name}`;
@@ -2982,7 +3062,7 @@ var matches12 = (attributes, form) => attributes.keyType === "ca" && sameList2(f
 var BaoSshRole = Resource14("Bao.SshRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole4 = (form) => Effect29.gen(function* () {
+var readRole4 = (form) => Effect31.gen(function* () {
   const live = yield* baoRead(readPath4(form.mount, form.name));
   if (live === undefined)
     return;
@@ -3008,14 +3088,14 @@ var wouldErase2 = (live) => {
   }
   return lost.sort();
 };
-var refuse6 = (message) => Effect29.die(new Error(message));
-var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect29.succeed(BaoSshRole.Provider.of({
-  list: () => Effect29.succeed([]),
-  read: Effect29.fn(function* ({ olds }) {
+var refuse6 = (message) => Effect31.die(new Error(message));
+var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect31.succeed(BaoSshRole.Provider.of({
+  list: () => Effect31.succeed([]),
+  read: Effect31.fn(function* ({ olds }) {
     const found = yield* readRole4(resolve2(olds));
     return found?.attributes;
   }),
-  diff: Effect29.fn(function* ({ news, output }) {
+  diff: Effect31.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved14(news))
       return;
     const form = resolve2(news);
@@ -3027,7 +3107,7 @@ var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect29.succeed(Ba
       return { action: "update" };
     return matches12(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect29.fn(function* ({ news }) {
+  reconcile: Effect31.fn(function* ({ news }) {
     const form = resolve2(news);
     const path = readPath4(form.mount, form.name);
     const bad = badDurations(form);
@@ -3053,7 +3133,7 @@ var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect29.succeed(Ba
     }
     return after.attributes;
   }),
-  delete: Effect29.fn(function* ({ output }) {
+  delete: Effect31.fn(function* ({ output }) {
     yield* baoDelete(readPath4(output.mount, output.name));
     return;
   })
@@ -3107,5 +3187,5 @@ export {
   revokeSelfEffect
 };
 
-//# debugId=7E1DFE85CC398C5464756E2164756E21
+//# debugId=81D869587FC0B7AF64756E2164756E21
 //# sourceMappingURL=index.js.map