@homeflare/alchemy 0.6.0 → 0.8.0

package/dist/openbao/index.js

@@ -616,7 +616,7 @@ var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect7.succeed
 import { Resource as Resource2 } from "alchemy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect8 from "effect/Effect";
+import * as Effect10 from "effect/Effect";
 
 // src/openbao/auth-role-form.ts
 var policiesOf = (live) => {
@@ -665,7 +665,6 @@ var writeBody = (props) => {
   }
   return body;
 };
-var isRename = (from, to) => from.toLowerCase() !== to.toLowerCase();
 var samePolicies = (want, have) => want.length === have.length && want.every((policy, index) => policy === have[index]);
 var sameTtl3 = (want, have) => {
   const wantSeconds = parseDuration(want);
@@ -677,26 +676,90 @@ var matches3 = (attributes, props) => {
   return samePolicies(wantPolicies, attributes.tokenPolicies) && sameTtl3(props.tokenTtl, attributes.tokenTtl) && sameTtl3(props.tokenMaxTtl, attributes.tokenMaxTtl) && sameTtl3(props.secretIdTtl, attributes.secretIdTtl) && (props.bindSecretId === undefined || attributes.bindSecretId === props.bindSecretId) && (props.secretIdNumUses === undefined || attributes.secretIdNumUses === props.secretIdNumUses);
 };
 
+// src/openbao/rename-identity.ts
+import * as Effect9 from "effect/Effect";
+
+// src/openbao/rename.ts
+import * as Effect8 from "effect/Effect";
+var exact = (identity) => identity;
+var declaredString = (news, key) => {
+  if (typeof news !== "object" || news === null)
+    return;
+  const value = news[key];
+  return typeof value === "string" ? value : undefined;
+};
+var isPendingProp = (news, key) => {
+  if (typeof news !== "object" || news === null)
+    return false;
+  const value = news[key];
+  return value !== undefined && typeof value !== "string";
+};
+var declaredOr = (news, key, fallback) => isPendingProp(news, key) ? undefined : declaredString(news, key) ?? fallback;
+var declaredRolePath = (news, rolePath, defaultMount) => {
+  const mount = defaultMount === undefined ? declaredString(news, "mount") : declaredOr(news, "mount", defaultMount);
+  const name = declaredString(news, "name");
+  return mount === undefined || name === undefined ? undefined : rolePath(mount, name);
+};
+var policyKey = (name) => name.trim().toLowerCase();
+var isMoved = (stored, declared, key = exact) => declared === undefined ? undefined : key(stored) !== key(declared);
+var judgeMove = (family, tried, declared, pathOf, key = exact) => Effect8.gen(function* () {
+  if (tried === undefined || declared === undefined || key(tried) === key(declared)) {
+    return;
+  }
+  if ((yield* baoRead(pathOf(declared))) === undefined)
+    return { from: tried, to: declared };
+  return yield* Effect8.die(new Error(`${family}: ${tried} → ${declared} would land on an object that already exists at ` + `${declared}. Under RemovalPolicy.destroy() a resource moving off that name (a swap, a ` + "shift, or a reverted move that did not finish) deletes it after this one writes it. " + "Nothing was written. Move through a name nothing holds, in two deploys, or remove " + `${declared} by hand first.`));
+});
+var refuseMovedUpdate = (family, from, to) => Effect8.die(new Error(`${family}: planned as an update, but its identity moved from ${from} to ${to}. Writing ` + `${to} now would leave ${from} live with no state record. Nothing was written. Run the ` + "deploy again: once the value resolves at plan time it plans as a replace."));
+
+// src/openbao/rename-identity.ts
+var nameIdentity = (family, pathOf, key) => ({
+  declared: (props) => declaredString(props, "name"),
+  family,
+  key,
+  pathOf,
+  recorded: (output) => output.name
+});
+var roleIdentity = (family, rolePath, defaultMount, key) => ({
+  declared: (props) => declaredRolePath(props, rolePath, defaultMount),
+  family,
+  key,
+  recorded: (output) => rolePath(output.mount, output.name)
+});
+var foldName = (path) => path.replace(/[^/]+$/, (name) => name.toLowerCase());
+var judgeRename = (identity, olds, news, output) => judgeMove(identity.family, output === undefined ? identity.declared(olds) : identity.recorded(output), identity.declared(news), identity.pathOf ?? ((path) => path), identity.key);
+var guardRename = (identity, news, output) => {
+  if (output === undefined)
+    return Effect9.void;
+  const from = identity.recorded(output);
+  const to = identity.declared(news);
+  return to !== undefined && isMoved(from, to, identity.key) === true ? refuseMovedUpdate(identity.family, from, to) : Effect9.void;
+};
+
 // src/openbao/auth-role.ts
 var BaoAuthRole = Resource2("Bao.AuthRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole = (props) => Effect8.gen(function* () {
+var IDENTITY = nameIdentity("Bao.AuthRole", readPath3, foldName);
+var readRole = (props) => Effect10.gen(function* () {
   const live = yield* baoRead(readPath3(props.name));
   if (live === undefined)
     return;
   return attributesOf3(props, live);
 });
-var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect8.succeed(BaoAuthRole.Provider.of({
-  list: () => Effect8.succeed([]),
-  read: Effect8.fn(function* ({ olds }) {
+var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect10.succeed(BaoAuthRole.Provider.of({
+  list: () => Effect10.succeed([]),
+  read: Effect10.fn(function* ({ olds }) {
     return yield* readRole(olds);
   }),
-  diff: Effect8.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved2(news))
+  diff: Effect10.fn(function* ({ news, olds, output }) {
+    const move = yield* judgeRename(IDENTITY, olds, news, output);
+    if (output === undefined)
       return;
-    if (isRename(output.name, news.name))
+    if (move !== undefined)
       return { action: "replace" };
+    if (!isResolved2(news))
+      return;
     const live = yield* readRole(news);
     if (live === undefined)
       return { action: "update" };
@@ -704,24 +767,25 @@ var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect8.succeed(Ba
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect8.fn(function* ({ news }) {
+  reconcile: Effect10.fn(function* ({ news, output }) {
+    yield* guardRename(IDENTITY, news, output);
     const live = yield* readRole(news);
     if (live === undefined || !matches3(live, news)) {
       yield* baoWrite("PUT", readPath3(news.name), writeBody(news));
     }
     const after = yield* readRole(news);
     if (after === undefined) {
-      return yield* Effect8.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
+      return yield* Effect10.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
     }
     return after;
   }),
-  delete: Effect8.fn(function* ({ output }) {
+  delete: Effect10.fn(function* ({ output }) {
     yield* baoDelete(readPath3(output.name));
     return;
   })
 })));
 // src/openbao/bao-identity.ts
-import * as Effect9 from "effect/Effect";
+import * as Effect11 from "effect/Effect";
 import * as FetchHttpClient3 from "effect/unstable/http/FetchHttpClient";
 
 // src/openbao/bao-namespace.ts
@@ -769,42 +833,42 @@ var checkHealth = (address, expectedCluster, body) => {
   }
   return { clusterId: text3(body["cluster_id"]), version: text3(body["version"]) };
 };
-var assertBaoIdentityEffect = (expected) => Effect9.gen(function* () {
+var assertBaoIdentityEffect = (expected) => Effect11.gen(function* () {
   const env = yield* BaoEnv;
   const address = addressOf(env);
   const clusterName = expected.clusterName.trim();
   if (clusterName === "") {
-    return yield* Effect9.fail(new BaoIdentityError("input", "clusterName is empty, so there is nothing to compare."));
+    return yield* Effect11.fail(new BaoIdentityError("input", "clusterName is empty, so there is nothing to compare."));
   }
   const namespace = canonicalNamespace(expected.namespace);
   const sent = envNamespace(env);
   if (sent !== namespace) {
-    return yield* Effect9.fail(new BaoIdentityError("mismatch", `BAO_NAMESPACE resolves to \`${namespaceLabel(sent)}\`, but this stack expects ` + `\`${namespaceLabel(namespace)}\`.`));
+    return yield* Effect11.fail(new BaoIdentityError("mismatch", `BAO_NAMESPACE resolves to \`${namespaceLabel(sent)}\`, but this stack expects ` + `\`${namespaceLabel(namespace)}\`.`));
   }
   const anonymous = { ...env, BAO_NAMESPACE: "", BAO_TOKEN: "" };
-  const body = yield* baoCall("read", "GET", HEALTH_PATH).pipe(Effect9.provideService(BaoEnv, anonymous), Effect9.mapError(unreachable(address, "sys/health")));
+  const body = yield* baoCall("read", "GET", HEALTH_PATH).pipe(Effect11.provideService(BaoEnv, anonymous), Effect11.mapError(unreachable(address, "sys/health")));
   const health = checkHealth(address, clusterName, body);
   if (health instanceof BaoIdentityError)
-    return yield* Effect9.fail(health);
+    return yield* Effect11.fail(health);
   if (namespace !== "") {
     const scoped = { ...env, BAO_NAMESPACE: namespace, BAO_TOKEN: "" };
-    const probe = yield* baoCall("read", "GET", NAMESPACE_PROBE_PATH).pipe(Effect9.provideService(BaoEnv, scoped), Effect9.mapError(unreachable(address, `the namespace probe for \`${namespace}\``)));
+    const probe = yield* baoCall("read", "GET", NAMESPACE_PROBE_PATH).pipe(Effect11.provideService(BaoEnv, scoped), Effect11.mapError(unreachable(address, `the namespace probe for \`${namespace}\``)));
     if (probe === undefined) {
-      return yield* Effect9.fail(new BaoIdentityError("mismatch", `cluster \`${clusterName}\` at ${address} has no namespace \`${namespace}\`.`));
+      return yield* Effect11.fail(new BaoIdentityError("mismatch", `cluster \`${clusterName}\` at ${address} has no namespace \`${namespace}\`.`));
     }
   }
   return { address, clusterName, namespace, ...health };
 });
 var assertBaoIdentity = (input) => {
   const effect3 = assertBaoIdentityEffect(input);
-  const scoped = input.env === undefined ? effect3 : Effect9.provideService(effect3, BaoEnv, input.env);
-  return Effect9.runPromise(scoped.pipe(Effect9.provide(FetchHttpClient3.layer)));
+  const scoped = input.env === undefined ? effect3 : Effect11.provideService(effect3, BaoEnv, input.env);
+  return Effect11.runPromise(scoped.pipe(Effect11.provide(FetchHttpClient3.layer)));
 };
 // src/openbao/cloudflare-role.ts
 import { Resource as Resource3 } from "alchemy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 import * as Provider3 from "alchemy/Provider";
-import * as Effect12 from "effect/Effect";
+import * as Effect14 from "effect/Effect";
 
 // src/openbao/cloudflare-group-scope.ts
 var zoneResource = (zoneId) => `com.cloudflare.api.account.zone.${zoneId}`;
@@ -824,7 +888,7 @@ var groupKey = (name, scope) => `${scope} ${name}`;
 
 // src/openbao/cloudflare-permission-groups.ts
 import * as Context2 from "effect/Context";
-import * as Effect11 from "effect/Effect";
+import * as Effect13 from "effect/Effect";
 
 // src/openbao/cloudflare-permission-groups-solve.ts
 var observationsOf = (declared, live) => declared.flatMap((role) => {
@@ -994,7 +1058,7 @@ var samePolicies2 = (want, have) => want.length === have.length && want.every((w
 });
 
 // src/openbao/cloudflare-role-wire.ts
-import * as Effect10 from "effect/Effect";
+import * as Effect12 from "effect/Effect";
 
 // src/openbao/cloudflare-role-form.ts
 var rolePath = (mount, name) => `${mountPath(mount)}/roles/${name}`;
@@ -1059,7 +1123,7 @@ var differences = (props, policies, live) => {
 };
 
 // src/openbao/cloudflare-role-wire.ts
-var readCloudflareRole = (mount, name) => Effect10.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
+var readCloudflareRole = (mount, name) => Effect12.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
 var writeCloudflareRole = (mount, name, body) => baoWrite("PUT", rolePath(mount, name), body);
 var deleteCloudflareRole = (mount, name) => baoDelete(rolePath(mount, name));
 
@@ -1081,9 +1145,9 @@ var pick = (mount, groups, refs, hint) => {
   const unknown = refs.filter((ref) => !groups.has(groupKey(ref.name, ref.scope)));
   if (unknown.length > 0) {
     const problems = unknown.map((ref) => `unknown group ${JSON.stringify(ref.name)} at scope ${ref.scope} — ${hint}`);
-    return Effect11.fail(new CloudflareGroupsError(mount, problems));
+    return Effect13.fail(new CloudflareGroupsError(mount, problems));
   }
-  return Effect11.succeed(new Map(refs.flatMap((ref) => {
+  return Effect13.succeed(new Map(refs.flatMap((ref) => {
     const key = groupKey(ref.name, ref.scope);
     const id = groups.get(key);
     return id === undefined ? [] : [[key, id]];
@@ -1091,15 +1155,15 @@ var pick = (mount, groups, refs, hint) => {
 };
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var deniedHint = (mount) => `GET ${mountPath(mount)}/permission-groups answered 403 — this token's policy carries no ` + `\`path "${mountPath(mount)}/permission-groups" { capabilities = ["read"] }\` grant. ` + "It is declared in ../platform/secrets/vault/policies/homeflare-admin/" + "20-cloudflare-permission-groups.hcl and applies with `alchemy deploy` of this stack";
-var deniedNamed = (mount, read) => Effect11.catchIf(read, (error) => error.status === 403, () => Effect11.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
-var engineGroups = (mount) => Effect11.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
+var deniedNamed = (mount, read) => Effect13.catchIf(read, (error) => error.status === 403, () => Effect13.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
+var engineGroups = (mount) => Effect13.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
   const list = data?.["permission_groups"];
   if (data === undefined) {
     const why = "GET <mount>/permission-groups answered 404 — the endpoint is not deployed here";
-    return Effect11.fail(new CloudflareGroupsError(mount, [why]));
+    return Effect13.fail(new CloudflareGroupsError(mount, [why]));
   }
   if (!Array.isArray(list)) {
-    return Effect11.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
+    return Effect13.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
   }
   const scoped = new Map;
   const idsOf = new Map;
@@ -1126,24 +1190,24 @@ var engineGroups = (mount) => Effect11.flatMap(deniedNamed(mount, baoRead(`${mou
     const only = [...ids];
     return ids.size === 1 && only[0] !== undefined ? [[name, only[0]]] : [];
   }));
-  return problems.length > 0 ? Effect11.fail(new CloudflareGroupsError(mount, problems)) : Effect11.succeed(new Map([...atEveryScope(sole), ...scoped]));
+  return problems.length > 0 ? Effect13.fail(new CloudflareGroupsError(mount, problems)) : Effect13.succeed(new Map([...atEveryScope(sole), ...scoped]));
 });
-var permissionGroupsFromEngine = () => Effect11.sync(() => {
+var permissionGroupsFromEngine = () => Effect13.sync(() => {
   const cache = new Map;
-  const cachedFor = (mount) => Effect11.suspend(() => {
+  const cachedFor = (mount) => Effect13.suspend(() => {
     const hit = cache.get(mountPath(mount));
     if (hit !== undefined)
       return hit;
-    return Effect11.flatMap(Effect11.cached(engineGroups(mount)), (lookup) => {
+    return Effect13.flatMap(Effect13.cached(engineGroups(mount)), (lookup) => {
       cache.set(mountPath(mount), lookup);
       return lookup;
     });
   });
   return CloudflarePermissionGroups.of({
-    resolve: (mount, refs) => Effect11.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
+    resolve: (mount, refs) => Effect13.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
   });
 });
-var permissionGroupsFromLiveRoles = (declared) => Effect11.gen(function* () {
+var permissionGroupsFromLiveRoles = (declared) => Effect13.gen(function* () {
   const accountOf = new Map;
   const byAccount = new Map;
   for (const [mount, roles] of declared) {
@@ -1154,9 +1218,9 @@ var permissionGroupsFromLiveRoles = (declared) => Effect11.gen(function* () {
   }
   const solved = new Map;
   for (const [account, roles] of byAccount) {
-    const solve = Effect11.gen(function* () {
+    const solve = Effect13.gen(function* () {
       const live = new Map;
-      yield* Effect11.all(roles.map((role) => Effect11.map(readCloudflareRole(role.mount, role.name), (read) => {
+      yield* Effect13.all(roles.map((role) => Effect13.map(readCloudflareRole(role.mount, role.name), (read) => {
         if (read?.policies !== undefined) {
           live.set(`${role.mount}/${role.name}`, read.policies);
         }
@@ -1164,11 +1228,11 @@ var permissionGroupsFromLiveRoles = (declared) => Effect11.gen(function* () {
       const result = solveGroups(observationsOf(roles, live));
       const problems = describeProblems(result);
       if (problems.length > 0) {
-        return yield* Effect11.fail(new CloudflareGroupsError(`account ${account}`, problems));
+        return yield* Effect13.fail(new CloudflareGroupsError(`account ${account}`, problems));
       }
       return atEveryScope(result.groups);
     });
-    solved.set(account, yield* Effect11.cached(solve));
+    solved.set(account, yield* Effect13.cached(solve));
   }
   return CloudflarePermissionGroups.of({
     resolve: (mount, refs) => {
@@ -1176,10 +1240,10 @@ var permissionGroupsFromLiveRoles = (declared) => Effect11.gen(function* () {
       const lookup = account === undefined ? undefined : solved.get(account);
       if (account === undefined || lookup === undefined) {
         const why = "no declared role on this mount, so no live role can vouch for its groups";
-        return Effect11.fail(new CloudflareGroupsError(mount, [why]));
+        return Effect13.fail(new CloudflareGroupsError(mount, [why]));
       }
       const hint = `no live role on account ${account} carries it; a NEW group needs the engine endpoint`;
-      return Effect11.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
+      return Effect13.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
     }
   });
 });
@@ -1188,9 +1252,10 @@ var permissionGroupsFromLiveRoles = (declared) => Effect11.gen(function* () {
 var BaoCloudflareRole = Resource3("Bao.CloudflareRole", {
   defaultRemovalPolicy: "retain"
 });
-var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect12.gen(function* () {
+var IDENTITY2 = roleIdentity("Bao.CloudflareRole", rolePath);
+var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect14.gen(function* () {
   const groups = yield* CloudflarePermissionGroups;
-  const resolved = (props) => Effect12.gen(function* () {
+  const resolved = (props) => Effect14.gen(function* () {
     const refs = new Map;
     for (const policy of props.policies) {
       const scope = policy.scope ?? scopeOfResource(policy.resource);
@@ -1200,18 +1265,23 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
     const ids = yield* groups.resolve(props.mount, [...refs.values()]);
     const { missing, policies } = resolvePolicies(props.policies, ids);
     if (missing.length > 0) {
-      return yield* Effect12.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
+      return yield* Effect14.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
     }
     return policies;
   });
   return BaoCloudflareRole.Provider.of({
-    list: () => Effect12.succeed([]),
-    read: Effect12.fn(function* ({ olds }) {
+    list: () => Effect14.succeed([]),
+    read: Effect14.fn(function* ({ olds }) {
       const live = yield* readCloudflareRole(olds.mount, olds.name);
       return live === undefined ? undefined : attributesOf4(olds, live);
     }),
-    diff: Effect12.fn(function* ({ news, output }) {
-      if (output === undefined || !isResolved3(news))
+    diff: Effect14.fn(function* ({ news, olds, output }) {
+      const move = yield* judgeRename(IDENTITY2, olds, news, output);
+      if (output === undefined)
+        return;
+      if (move !== undefined)
+        return { action: "replace" };
+      if (!isResolved3(news))
         return;
       if (refusalOf(news) !== undefined)
         return { action: "update" };
@@ -1221,11 +1291,12 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
         return { action: "update" };
       return differences(news, policies, live).length === 0 ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect12.fn(function* ({ news }) {
+    reconcile: Effect14.fn(function* ({ news, output }) {
       const path = rolePath(news.mount, news.name);
+      yield* guardRename(IDENTITY2, news, output);
       const refusal2 = refusalOf(news);
       if (refusal2 !== undefined) {
-        return yield* Effect12.die(new Error(`Bao.CloudflareRole ${path}: ${refusal2}.`));
+        return yield* Effect14.die(new Error(`Bao.CloudflareRole ${path}: ${refusal2}.`));
       }
       const policies = yield* resolved(news);
       const live = yield* readCloudflareRole(news.mount, news.name);
@@ -1234,15 +1305,15 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
       }
       const after = yield* readCloudflareRole(news.mount, news.name);
       if (after === undefined) {
-        return yield* Effect12.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
+        return yield* Effect14.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
       }
       const left = differences(news, policies, after);
       if (left.length > 0) {
-        return yield* Effect12.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
+        return yield* Effect14.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
       }
       return attributesOf4(news, after);
     }),
-    delete: Effect12.fn(function* ({ output }) {
+    delete: Effect14.fn(function* ({ output }) {
       yield* deleteCloudflareRole(output.mount, output.name);
       return;
     })
@@ -1465,17 +1536,19 @@ var hostAppRoles = (input) => {
     if (!NAME.test(host.name)) {
       problems.push(`host \`${host.name}\` is not lowercase letters, digits, single hyphens`);
     }
-    if (seen.has(host.name))
-      problems.push(`host \`${host.name}\` is listed twice`);
-    seen.add(host.name);
-    const spec = input.classes[host.class];
+    const name = hostRoleName(host.class, host.name);
+    if (seen.has(name)) {
+      problems.push(`host \`${host.name}\` is listed twice in class \`${host.class}\``);
+    }
+    seen.add(name);
+    const spec = Object.hasOwn(input.classes, host.class) ? input.classes[host.class] : undefined;
     if (spec === undefined) {
       problems.push(`host \`${host.name}\` names unknown class \`${host.class}\``);
       continue;
     }
     roles.push({
       bindSecretId: true,
-      name: hostRoleName(host.class, host.name),
+      name,
       secretIdNumUses: spec.secretIdNumUses ?? 0,
       secretIdTtl: spec.secretIdTtl,
       tokenMaxTtl: spec.tokenMaxTtl,
@@ -1492,7 +1565,7 @@ var hostAppRoles = (input) => {
 import { Resource as Resource4 } from "alchemy";
 import { isResolved as isResolved4 } from "alchemy/Diff";
 import * as Provider4 from "alchemy/Provider";
-import * as Effect14 from "effect/Effect";
+import * as Effect16 from "effect/Effect";
 
 // src/openbao/jwt-config-form.ts
 var text5 = (value) => typeof value === "string" ? value.trim() : "";
@@ -1582,16 +1655,16 @@ var problems = (props) => {
 };
 
 // src/openbao/role-reconcile.ts
-import * as Effect13 from "effect/Effect";
-var readRoleAt = (spec) => Effect13.map(baoRead(spec.path), (live) => live === undefined ? undefined : { attributes: spec.attributesOf(live), live });
-var planRole = (spec) => Effect13.gen(function* () {
+import * as Effect15 from "effect/Effect";
+var readRoleAt = (spec) => Effect15.map(baoRead(spec.path), (live) => live === undefined ? undefined : { attributes: spec.attributesOf(live), live });
+var planRole = (spec) => Effect15.gen(function* () {
   if (spec.problems.length > 0)
     return "update";
   const found = yield* readRoleAt(spec);
   return found !== undefined && spec.matches(found.attributes) ? "noop" : "update";
 });
-var refuse2 = (spec, message) => Effect13.die(new Error(`${spec.family} ${spec.path}: ${message}`));
-var reconcileRole = (spec) => Effect13.gen(function* () {
+var refuse2 = (spec, message) => Effect15.die(new Error(`${spec.family} ${spec.path}: ${message}`));
+var reconcileRole = (spec) => Effect15.gen(function* () {
   if (spec.problems.length > 0)
     return yield* refuse2(spec, spec.problems.join("; "));
   const found = yield* readRoleAt(spec);
@@ -1615,6 +1688,14 @@ var reconcileRole = (spec) => Effect13.gen(function* () {
 var BaoJwtAuthConfig = Resource4("Bao.JwtAuthConfig", {
   defaultRemovalPolicy: "retain"
 });
+var IDENTITY3 = {
+  declared: (props) => {
+    const mount = declaredOr(props, "mount", "jwt");
+    return mount === undefined ? undefined : configPath({ mount });
+  },
+  family: "Bao.JwtAuthConfig",
+  recorded: (output) => configPath(output)
+};
 var jwtConfigSpec = (props) => ({
   attributesOf: (live) => attributesOf5(props, live),
   body: writeBody3(props),
@@ -1624,29 +1705,33 @@ var jwtConfigSpec = (props) => ({
   problems: problems(props),
   wouldErase
 });
-var BaoJwtAuthConfigProvider = () => Provider4.effect(BaoJwtAuthConfig, Effect14.succeed(BaoJwtAuthConfig.Provider.of({
-  list: () => Effect14.succeed([]),
-  read: Effect14.fn(function* ({ olds }) {
+var BaoJwtAuthConfigProvider = () => Provider4.effect(BaoJwtAuthConfig, Effect16.succeed(BaoJwtAuthConfig.Provider.of({
+  list: () => Effect16.succeed([]),
+  read: Effect16.fn(function* ({ olds }) {
     const found = yield* readRoleAt(jwtConfigSpec(olds));
     return found?.attributes;
   }),
-  diff: Effect14.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved4(news))
+  diff: Effect16.fn(function* ({ news, olds, output }) {
+    const move = yield* judgeRename(IDENTITY3, olds, news, output);
+    if (output === undefined)
       return;
-    if (mountOf(news) !== output.mount)
+    if (move !== undefined)
       return { action: "replace" };
+    if (!isResolved4(news))
+      return;
     return { action: yield* planRole(jwtConfigSpec(news)) };
   }),
-  reconcile: Effect14.fn(function* ({ news }) {
+  reconcile: Effect16.fn(function* ({ news, output }) {
+    yield* guardRename(IDENTITY3, news, output);
     return yield* reconcileRole(jwtConfigSpec(news));
   }),
-  delete: () => Effect14.void
+  delete: () => Effect16.void
 })));
 // src/openbao/jwt-role.ts
 import { Resource as Resource5 } from "alchemy";
 import { isResolved as isResolved5 } from "alchemy/Diff";
 import * as Provider5 from "alchemy/Provider";
-import * as Effect15 from "effect/Effect";
+import * as Effect17 from "effect/Effect";
 
 // src/openbao/auth-token-form.ts
 var sortedSet2 = (values) => [...new Set(values)].sort();
@@ -1848,6 +1933,7 @@ var problems2 = (props) => {
 var BaoJwtRole = Resource5("Bao.JwtRole", {
   defaultRemovalPolicy: "retain"
 });
+var IDENTITY4 = roleIdentity("Bao.JwtRole", (mount, name) => rolePath2({ mount, name }), "jwt", foldName);
 var jwtRoleSpec = (props) => ({
   attributesOf: (live) => attributesOf6(props, live),
   body: writeBody4(props),
@@ -1856,24 +1942,27 @@ var jwtRoleSpec = (props) => ({
   path: rolePath2(props),
   problems: problems2(props)
 });
-var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect15.succeed(BaoJwtRole.Provider.of({
-  list: () => Effect15.succeed([]),
-  read: Effect15.fn(function* ({ olds }) {
+var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect17.succeed(BaoJwtRole.Provider.of({
+  list: () => Effect17.succeed([]),
+  read: Effect17.fn(function* ({ olds }) {
     const found = yield* readRoleAt(jwtRoleSpec(olds));
     return found?.attributes;
   }),
-  diff: Effect15.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved5(news))
+  diff: Effect17.fn(function* ({ news, olds, output }) {
+    const move = yield* judgeRename(IDENTITY4, olds, news, output);
+    if (output === undefined)
       return;
-    if (mountOf2(news) !== output.mount || news.name !== output.name) {
+    if (move !== undefined)
       return { action: "replace" };
-    }
+    if (!isResolved5(news))
+      return;
     return { action: yield* planRole(jwtRoleSpec(news)) };
   }),
-  reconcile: Effect15.fn(function* ({ news }) {
+  reconcile: Effect17.fn(function* ({ news, output }) {
+    yield* guardRename(IDENTITY4, news, output);
     return yield* reconcileRole(jwtRoleSpec(news));
   }),
-  delete: Effect15.fn(function* ({ output }) {
+  delete: Effect17.fn(function* ({ output }) {
     yield* baoDelete(rolePath2(output));
     return;
   })
@@ -1882,7 +1971,7 @@ var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect15.succeed(Bao
 import { Resource as Resource6 } from "alchemy";
 import { isResolved as isResolved6 } from "alchemy/Diff";
 import * as Provider6 from "alchemy/Provider";
-import * as Effect16 from "effect/Effect";
+import * as Effect18 from "effect/Effect";
 
 // src/openbao/kubernetes-role-form.ts
 var sortedSet4 = (values) => [...new Set(values)].sort();
@@ -1951,6 +2040,7 @@ var problems3 = (props) => {
 var BaoKubernetesRole = Resource6("Bao.KubernetesRole", {
   defaultRemovalPolicy: "retain"
 });
+var IDENTITY5 = roleIdentity("Bao.KubernetesRole", (mount, name) => rolePath3({ mount, name }), "kubernetes", foldName);
 var kubernetesRoleSpec = (props) => ({
   attributesOf: (live) => attributesOf7(props, live),
   body: writeBody5(props),
@@ -1959,24 +2049,27 @@ var kubernetesRoleSpec = (props) => ({
   path: rolePath3(props),
   problems: problems3(props)
 });
-var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect16.succeed(BaoKubernetesRole.Provider.of({
-  list: () => Effect16.succeed([]),
-  read: Effect16.fn(function* ({ olds }) {
+var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect18.succeed(BaoKubernetesRole.Provider.of({
+  list: () => Effect18.succeed([]),
+  read: Effect18.fn(function* ({ olds }) {
     const found = yield* readRoleAt(kubernetesRoleSpec(olds));
     return found?.attributes;
   }),
-  diff: Effect16.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved6(news))
+  diff: Effect18.fn(function* ({ news, olds, output }) {
+    const move = yield* judgeRename(IDENTITY5, olds, news, output);
+    if (output === undefined)
       return;
-    if (mountOf3(news) !== output.mount || news.name !== output.name) {
+    if (move !== undefined)
       return { action: "replace" };
-    }
+    if (!isResolved6(news))
+      return;
     return { action: yield* planRole(kubernetesRoleSpec(news)) };
   }),
-  reconcile: Effect16.fn(function* ({ news }) {
+  reconcile: Effect18.fn(function* ({ news, output }) {
+    yield* guardRename(IDENTITY5, news, output);
     return yield* reconcileRole(kubernetesRoleSpec(news));
   }),
-  delete: Effect16.fn(function* ({ output }) {
+  delete: Effect18.fn(function* ({ output }) {
     yield* baoDelete(rolePath3(output));
     return;
   })
@@ -1985,7 +2078,7 @@ var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect
 import { Resource as Resource7 } from "alchemy";
 import { isResolved as isResolved7 } from "alchemy/Diff";
 import * as Provider7 from "alchemy/Provider";
-import * as Effect18 from "effect/Effect";
+import * as Effect20 from "effect/Effect";
 
 // src/openbao/mfa-enforcement-form.ts
 var sortedSet5 = (values) => [...new Set(values.map((value) => value.trim()))].filter((value) => value !== "").sort();
@@ -2053,16 +2146,16 @@ var problems4 = (props, missingPaths) => {
 };
 
 // src/openbao/mfa-wire.ts
-import * as Effect17 from "effect/Effect";
+import * as Effect19 from "effect/Effect";
 var TOTP_PATH = "identity/mfa/method/totp";
 var METHODS_PATH = "identity/mfa/method";
 var enforcementPath = (name) => `identity/mfa/login-enforcement/${name}`;
 var record4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
-var ownNamespacePath = Effect17.gen(function* () {
+var ownNamespacePath = Effect19.gen(function* () {
   const env = yield* BaoEnv;
   return namespacePath(envNamespace(env));
 });
-var findTotp = (name) => Effect17.gen(function* () {
+var findTotp = (name) => Effect19.gen(function* () {
   const listing = yield* baoRead(`${METHODS_PATH}?list=true`);
   const info = record4(listing?.["key_info"]) ?? {};
   const own = yield* ownNamespacePath;
@@ -2071,17 +2164,17 @@ var findTotp = (name) => Effect17.gen(function* () {
     if (live === undefined || live["name"] !== name || live["namespace_path"] !== own)
       continue;
     if (live["type"] !== "totp") {
-      return yield* Effect17.die(new Error(`Bao.MfaTotpMethod ${name}: that name belongs to a ${String(live["type"])} method ` + `(${id}) in this namespace, and a TOTP write would convert it. Pick another name.`));
+      return yield* Effect19.die(new Error(`Bao.MfaTotpMethod ${name}: that name belongs to a ${String(live["type"])} method ` + `(${id}) in this namespace, and a TOTP write would convert it. Pick another name.`));
     }
     return { id, live };
   }
   return;
 });
-var writeTotp = (body) => Effect17.asVoid(baoCall("write", "POST", TOTP_PATH, body));
+var writeTotp = (body) => Effect19.asVoid(baoCall("write", "POST", TOTP_PATH, body));
 var deleteTotp = (id) => baoDelete(`${TOTP_PATH}/${id}`);
 var readEnforcement = (name) => baoRead(enforcementPath(name));
-var writeEnforcement = (name, body) => Effect17.asVoid(baoCall("write", "POST", enforcementPath(name), body));
-var authAccessors = (paths) => Effect17.gen(function* () {
+var writeEnforcement = (name, body) => Effect19.asVoid(baoCall("write", "POST", enforcementPath(name), body));
+var authAccessors = (paths) => Effect19.gen(function* () {
   if (paths.length === 0)
     return { accessors: [], missing: [] };
   const table = (yield* baoRead("sys/auth")) ?? {};
@@ -2101,20 +2194,21 @@ var authAccessors = (paths) => Effect17.gen(function* () {
 var BaoMfaLoginEnforcement = Resource7("Bao.MfaLoginEnforcement", {
   defaultRemovalPolicy: "retain"
 });
-var refuse3 = (name, message) => Effect18.die(new Error(`Bao.MfaLoginEnforcement ${name}: ${message}`));
-var resolveTargets = (props) => Effect18.map(authAccessors(props.authMethodPaths ?? []), ({ accessors, missing }) => ({
+var IDENTITY6 = nameIdentity("Bao.MfaLoginEnforcement", enforcementPath);
+var refuse3 = (name, message) => Effect20.die(new Error(`Bao.MfaLoginEnforcement ${name}: ${message}`));
+var resolveTargets = (props) => Effect20.map(authAccessors(props.authMethodPaths ?? []), ({ accessors, missing }) => ({
   bad: problems4(props, missing),
   resolved: accessors
 }));
-var readLive = (name) => Effect18.map(readEnforcement(name), (live) => live === undefined ? undefined : attributesOf8(name, live));
-var planEnforcement = (props) => Effect18.gen(function* () {
+var readLive = (name) => Effect20.map(readEnforcement(name), (live) => live === undefined ? undefined : attributesOf8(name, live));
+var planEnforcement = (props) => Effect20.gen(function* () {
   const { bad, resolved } = yield* resolveTargets(props);
   if (bad.length > 0)
     return "update";
   const live = yield* readLive(props.name);
   return live !== undefined && matches7(live, props, resolved) ? "noop" : "update";
 });
-var reconcileEnforcement = (props) => Effect18.gen(function* () {
+var reconcileEnforcement = (props) => Effect20.gen(function* () {
   const { bad, resolved } = yield* resolveTargets(props);
   if (bad.length > 0)
     return yield* refuse3(props.name, bad.join("; "));
@@ -2130,22 +2224,26 @@ var reconcileEnforcement = (props) => Effect18.gen(function* () {
   }
   return after;
 });
-var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforcement, Effect18.succeed(BaoMfaLoginEnforcement.Provider.of({
-  list: () => Effect18.succeed([]),
-  read: Effect18.fn(function* ({ olds }) {
+var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforcement, Effect20.succeed(BaoMfaLoginEnforcement.Provider.of({
+  list: () => Effect20.succeed([]),
+  read: Effect20.fn(function* ({ olds }) {
     return yield* readLive(olds.name);
   }),
-  diff: Effect18.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved7(news))
+  diff: Effect20.fn(function* ({ news, olds, output }) {
+    const move = yield* judgeRename(IDENTITY6, olds, news, output);
+    if (output === undefined)
       return;
-    if (news.name !== output.name)
+    if (move !== undefined)
       return { action: "replace" };
+    if (!isResolved7(news))
+      return;
     return { action: yield* planEnforcement(news) };
   }),
-  reconcile: Effect18.fn(function* ({ news }) {
+  reconcile: Effect20.fn(function* ({ news, output }) {
+    yield* guardRename(IDENTITY6, news, output);
     return yield* reconcileEnforcement(news);
   }),
-  delete: Effect18.fn(function* ({ output }) {
+  delete: Effect20.fn(function* ({ output }) {
     return yield* refuse3(output.name, "REFUSING to delete: OpenBao 2.6.2 drops a login enforcement from memory only, and it " + "returns on the next unseal (openbao/openbao#4030). Set this resource back to " + "retain to drop it from state; remove it for good only once the server is fixed.");
   })
 })));
@@ -2153,7 +2251,7 @@ var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforceme
 import { Resource as Resource8 } from "alchemy";
 import { isResolved as isResolved8 } from "alchemy/Diff";
 import * as Provider8 from "alchemy/Provider";
-import * as Effect19 from "effect/Effect";
+import * as Effect21 from "effect/Effect";
 
 // src/openbao/mfa-totp-form.ts
 var canonical6 = (input) => ({
@@ -2234,45 +2332,51 @@ var problems5 = (props) => {
 var BaoMfaTotpMethod = Resource8("Bao.MfaTotpMethod", {
   defaultRemovalPolicy: "retain"
 });
-var refuse4 = (props, message) => Effect19.die(new Error(`Bao.MfaTotpMethod ${props.name}: ${message}`));
-var readTotp = (props) => Effect19.map(findTotp(props.name), (found) => found === undefined ? undefined : attributesOf9(found.id, found.live));
-var planTotp = (props) => Effect19.gen(function* () {
+var refuse4 = (name, message) => Effect21.die(new Error(`Bao.MfaTotpMethod ${name}: ${message}`));
+var readTotp = (props) => Effect21.map(findTotp(props.name), (found) => found === undefined ? undefined : attributesOf9(found.id, found.live));
+var planTotp = (props) => Effect21.gen(function* () {
   if (problems5(props).length > 0)
     return "update";
   const live = yield* readTotp(props);
   return live !== undefined && matches8(live, props) ? "noop" : "update";
 });
-var reconcileTotp = (props) => Effect19.gen(function* () {
+var reconcileTotp = (props) => Effect21.gen(function* () {
   const bad = problems5(props);
   if (bad.length > 0)
-    return yield* refuse4(props, bad.join("; "));
+    return yield* refuse4(props.name, bad.join("; "));
   const live = yield* readTotp(props);
   if (live === undefined || !matches8(live, props))
     yield* writeTotp(writeBody7(props));
   const after = yield* readTotp(props);
   if (after === undefined)
-    return yield* refuse4(props, "the write succeeded but no method has that name.");
+    return yield* refuse4(props.name, "the write succeeded but no method has that name.");
   if (!matches8(after, props))
-    return yield* refuse4(props, "the method read back different.");
+    return yield* refuse4(props.name, "the method read back different.");
   return after;
 });
-var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect19.succeed(BaoMfaTotpMethod.Provider.of({
-  list: () => Effect19.succeed([]),
-  read: Effect19.fn(function* ({ olds }) {
+var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect21.succeed(BaoMfaTotpMethod.Provider.of({
+  list: () => Effect21.succeed([]),
+  read: Effect21.fn(function* ({ olds }) {
     return yield* readTotp(olds);
   }),
-  diff: Effect19.fn(function* ({ news, output }) {
+  diff: Effect21.fn(function* ({ news, output }) {
+    const name = declaredString(news, "name");
+    if (output !== undefined && name !== undefined) {
+      const rename = renameProblem(output.name, name);
+      if (rename !== undefined)
+        return yield* refuse4(name, rename);
+    }
     if (output === undefined || !isResolved8(news))
       return;
-    const rename = renameProblem(output.name, news.name);
-    if (rename !== undefined)
-      return yield* refuse4(news, rename);
     return { action: yield* planTotp(news) };
   }),
-  reconcile: Effect19.fn(function* ({ news }) {
+  reconcile: Effect21.fn(function* ({ news, output }) {
+    const rename = output === undefined ? undefined : renameProblem(output.name, news.name);
+    if (rename !== undefined)
+      return yield* refuse4(news.name, rename);
     return yield* reconcileTotp(news);
   }),
-  delete: Effect19.fn(function* ({ output }) {
+  delete: Effect21.fn(function* ({ output }) {
     yield* deleteTotp(output.methodId);
     return;
   })
@@ -2281,24 +2385,24 @@ var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect19
 import { Resource as Resource9 } from "alchemy";
 import { isResolved as isResolved9 } from "alchemy/Diff";
 import * as Provider9 from "alchemy/Provider";
-import * as Effect22 from "effect/Effect";
+import * as Effect24 from "effect/Effect";
 
 // src/openbao/mount-reconcile.ts
-import * as Effect21 from "effect/Effect";
+import * as Effect23 from "effect/Effect";
 
 // src/openbao/mount-wire.ts
-import * as Effect20 from "effect/Effect";
-var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect20.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+import * as Effect22 from "effect/Effect";
+var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect22.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
   ...asked.errors,
   `sys/mounts could not confirm the mount is absent: ${listing.message}`
-])), Effect20.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect20.succeed(undefined) : Effect20.fail(asked)));
-var readMountData = (path) => baoRead(readPath(path)).pipe(Effect20.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
+])), Effect22.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect22.succeed(undefined) : Effect22.fail(asked)));
+var readMountData = (path) => baoRead(readPath(path)).pipe(Effect22.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
 var enableMount = (props) => baoWrite("POST", readPath(props.path), enableBody(props));
 var tuneMount = (props) => baoWrite("POST", tunePath(props.path), tuneBody(props));
 var disableMount = (path) => baoDelete(readPath(path));
 
 // src/openbao/mount-reconcile.ts
-var readMount = (props) => Effect21.gen(function* () {
+var readMount = (props) => Effect23.gen(function* () {
   const live = yield* readMountData(props.path);
   if (live === undefined)
     return;
@@ -2311,10 +2415,10 @@ var moveTarget2 = (props) => ({
   type: props.type,
   wire: mountPath
 });
-var reconcileMount = (news, stated, options) => Effect21.gen(function* () {
+var reconcileMount = (news, stated, options) => Effect23.gen(function* () {
   const move = planMove("Bao.Mount", stated, news.path, news.remountFrom);
   if (move.kind === "refuse")
-    return yield* Effect21.die(new Error(move.message));
+    return yield* Effect23.die(new Error(move.message));
   if (move.kind === "move")
     yield* performMove(moveTarget2(news), move.from, options);
   let live = yield* readMount(news);
@@ -2324,13 +2428,13 @@ var reconcileMount = (news, stated, options) => Effect21.gen(function* () {
       yield* tuneMount(news);
   } else if (!matches(live, news)) {
     if (live.type !== news.type) {
-      return yield* Effect21.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
+      return yield* Effect23.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
     }
     yield* tuneMount(news);
   }
   live = yield* readMount(news);
   if (live === undefined) {
-    return yield* Effect21.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
+    return yield* Effect23.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
   }
   return live;
 });
@@ -2339,17 +2443,17 @@ var reconcileMount = (news, stated, options) => Effect21.gen(function* () {
 var BaoMount = Resource9("Bao.Mount", {
   defaultRemovalPolicy: "retain"
 });
-var BaoMountProvider = () => Provider9.effect(BaoMount, Effect22.succeed(BaoMount.Provider.of({
-  list: () => Effect22.succeed([]),
-  read: Effect22.fn(function* ({ olds }) {
+var BaoMountProvider = () => Provider9.effect(BaoMount, Effect24.succeed(BaoMount.Provider.of({
+  list: () => Effect24.succeed([]),
+  read: Effect24.fn(function* ({ olds }) {
     return yield* readMount(olds);
   }),
-  diff: Effect22.fn(function* ({ news, output }) {
+  diff: Effect24.fn(function* ({ news, output }) {
     if (output === undefined || !isResolved9(news))
       return;
     const move = planMove("Bao.Mount", output.path, news.path, news.remountFrom);
     if (move.kind === "refuse")
-      return yield* Effect22.die(new Error(move.message));
+      return yield* Effect24.die(new Error(move.message));
     if (move.kind === "move")
       return { action: "update" };
     const live = yield* readMount(news);
@@ -2361,10 +2465,10 @@ var BaoMountProvider = () => Provider9.effect(BaoMount, Effect22.succeed(BaoMoun
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect22.fn(function* ({ news, output }) {
+  reconcile: Effect24.fn(function* ({ news, output }) {
     return yield* reconcileMount(news, output?.path);
   }),
-  delete: Effect22.fn(function* ({ output }) {
+  delete: Effect24.fn(function* ({ output }) {
     yield* disableMount(output.path);
     return;
   })
@@ -2373,7 +2477,7 @@ var BaoMountProvider = () => Provider9.effect(BaoMount, Effect22.succeed(BaoMoun
 import { Resource as Resource10 } from "alchemy";
 import { isResolved as isResolved10 } from "alchemy/Diff";
 import * as Provider10 from "alchemy/Provider";
-import * as Effect23 from "effect/Effect";
+import * as Effect25 from "effect/Effect";
 
 // src/openbao/pki-role-canonical.ts
 var DEFAULT_KEY_USAGE = [
@@ -2539,22 +2643,26 @@ var problems6 = (props) => {
 var BaoPkiRole = Resource10("Bao.PkiRole", {
   defaultRemovalPolicy: "retain"
 });
-var readRole2 = (props) => Effect23.gen(function* () {
+var IDENTITY7 = roleIdentity("Bao.PkiRole", (mount, name) => rolePath4({ mount, name }), "pki");
+var readRole2 = (props) => Effect25.gen(function* () {
   const live = yield* baoRead(rolePath4(props));
   if (live === undefined)
     return;
   return attributesOf10(props, live);
 });
-var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect23.succeed(BaoPkiRole.Provider.of({
-  list: () => Effect23.succeed([]),
-  read: Effect23.fn(function* ({ olds }) {
+var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect25.succeed(BaoPkiRole.Provider.of({
+  list: () => Effect25.succeed([]),
+  read: Effect25.fn(function* ({ olds }) {
     return yield* readRole2(olds);
   }),
-  diff: Effect23.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved10(news))
+  diff: Effect25.fn(function* ({ news, olds, output }) {
+    const move = yield* judgeRename(IDENTITY7, olds, news, output);
+    if (output === undefined)
       return;
-    if (mountPath(news.mount ?? "pki") !== output.mount || news.name !== output.name)
+    if (move !== undefined)
       return { action: "replace" };
+    if (!isResolved10(news))
+      return;
     if (problems6(news).length > 0)
       return { action: "update" };
     const live = yield* readRole2(news);
@@ -2562,11 +2670,12 @@ var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect23.succeed(Ba
       return { action: "update" };
     return matches9(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect23.fn(function* ({ news }) {
+  reconcile: Effect25.fn(function* ({ news, output }) {
     const path = rolePath4(news);
+    yield* guardRename(IDENTITY7, news, output);
     const bad = problems6(news);
     if (bad.length > 0) {
-      return yield* Effect23.die(new Error(`Bao.PkiRole ${path}: ${bad.join(" ")}`));
+      return yield* Effect25.die(new Error(`Bao.PkiRole ${path}: ${bad.join(" ")}`));
     }
     const live = yield* readRole2(news);
     if (live === undefined || !matches9(live, news)) {
@@ -2574,14 +2683,14 @@ var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect23.succeed(Ba
     }
     const after = yield* readRole2(news);
     if (after === undefined) {
-      return yield* Effect23.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
+      return yield* Effect25.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
     }
     if (!matches9(after, news)) {
-      return yield* Effect23.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
+      return yield* Effect25.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
     }
     return after;
   }),
-  delete: Effect23.fn(function* ({ output }) {
+  delete: Effect25.fn(function* ({ output }) {
     yield* baoDelete(rolePath4(output));
     return;
   })
@@ -2590,7 +2699,7 @@ var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect23.succeed(Ba
 import { Resource as Resource11 } from "alchemy";
 import { isResolved as isResolved11 } from "alchemy/Diff";
 import * as Provider11 from "alchemy/Provider";
-import * as Effect25 from "effect/Effect";
+import * as Effect27 from "effect/Effect";
 
 // src/openbao/plugin-form.ts
 var resolve = (props) => ({
@@ -2646,7 +2755,7 @@ var sameArgs = (want, have) => want.length === have.length && want.every((entry,
 var matches10 = (attributes, form) => !attributes.builtin && attributes.version === form.version && attributes.sha256 === form.sha256 && attributes.command === form.command && sameArgs(form.args, attributes.args);
 
 // src/openbao/plugin-reconcile.ts
-import * as Effect24 from "effect/Effect";
+import * as Effect26 from "effect/Effect";
 
 // src/openbao/plugin-wire.ts
 var readPluginData = (form) => baoRead(versionedPath(form.type, form.name, form.version));
@@ -2654,10 +2763,10 @@ var registerPlugin = (form) => baoWrite("PUT", catalogPath(form.type, form.name)
 var deregisterPlugin = (type, name, version) => baoDelete(versionedPath(type, name, version));
 
 // src/openbao/plugin-reconcile.ts
-var readEntry = (form) => Effect24.map(readPluginData(form), (live) => live === undefined ? undefined : { attributes: attributesOf11(form, live), live });
-var refuse5 = (form, message) => Effect24.die(new Error(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}: ${message}`));
+var readEntry = (form) => Effect26.map(readPluginData(form), (live) => live === undefined ? undefined : { attributes: attributesOf11(form, live), live });
+var refuse5 = (form, message) => Effect26.die(new Error(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}: ${message}`));
 var SELF_REPORTED = "the write succeeded but the read-back does not match. If the binary reports its own version, " + "OpenBao filed the registration under it (plugin_catalog.go setInternal) — declare `version` " + "as exactly the version the binary reports; that adopts the entry this write just made.";
-var reconcilePlugin = (props) => Effect24.gen(function* () {
+var reconcilePlugin = (props) => Effect26.gen(function* () {
   const form = resolve(props);
   const bad = problems7(form);
   if (bad.length > 0)
@@ -2684,28 +2793,43 @@ var reconcilePlugin = (props) => Effect24.gen(function* () {
 var BaoPlugin = Resource11("Bao.Plugin", {
   defaultRemovalPolicy: "retain"
 });
-var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect25.succeed(BaoPlugin.Provider.of({
-  list: () => Effect25.succeed([]),
-  read: Effect25.fn(function* ({ olds }) {
+var IDENTITY8 = {
+  declared: (props) => {
+    const type = declaredString(props, "type");
+    const name = declaredString(props, "name");
+    const version = declaredOr(props, "version", "");
+    if (type === undefined || name === undefined || version === undefined)
+      return;
+    return versionedPath(type, name, version);
+  },
+  family: "Bao.Plugin",
+  recorded: (output) => versionedPath(output.type, output.name, output.version)
+};
+var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect27.succeed(BaoPlugin.Provider.of({
+  list: () => Effect27.succeed([]),
+  read: Effect27.fn(function* ({ olds }) {
     const found = yield* readEntry(resolve(olds));
     return found?.attributes;
   }),
-  diff: Effect25.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved11(news))
+  diff: Effect27.fn(function* ({ news, olds, output }) {
+    const move = yield* judgeRename(IDENTITY8, olds, news, output);
+    if (output === undefined)
       return;
-    const form = resolve(news);
-    if (output.name !== form.name || output.type !== form.type || output.version !== form.version) {
+    if (move !== undefined)
       return { action: "replace" };
-    }
+    if (!isResolved11(news))
+      return;
+    const form = resolve(news);
     const found = yield* readEntry(form);
     if (found === undefined)
       return { action: "update" };
     return matches10(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect25.fn(function* ({ news }) {
+  reconcile: Effect27.fn(function* ({ news, output }) {
+    yield* guardRename(IDENTITY8, news, output);
     return yield* reconcilePlugin(news);
   }),
-  delete: Effect25.fn(function* ({ output }) {
+  delete: Effect27.fn(function* ({ output }) {
     yield* deregisterPlugin(output.type, output.name, output.version);
     return;
   })
@@ -2714,7 +2838,7 @@ var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect25.succeed(BaoP
 import { Resource as Resource12 } from "alchemy";
 import { isResolved as isResolved12 } from "alchemy/Diff";
 import * as Provider12 from "alchemy/Provider";
-import * as Effect27 from "effect/Effect";
+import * as Effect29 from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 
@@ -2722,13 +2846,13 @@ import * as Path from "effect/Path";
 var isEmptyAssembly = (parts, joined) => parts === 0 || !/^\s*path\s+"/m.test(joined);
 
 // src/openbao/policy-wire.ts
-import * as Effect26 from "effect/Effect";
+import * as Effect28 from "effect/Effect";
 var policyPath = (name) => `sys/policies/acl/${name}`;
-var readPolicy = (name) => Effect26.flatMap(baoRead(policyPath(name)), (data) => {
+var readPolicy = (name) => Effect28.flatMap(baoRead(policyPath(name)), (data) => {
   if (data === undefined)
-    return Effect26.succeed("");
+    return Effect28.succeed("");
   const text11 = data["policy"];
-  return typeof text11 === "string" ? Effect26.succeed(text11) : Effect26.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
+  return typeof text11 === "string" ? Effect28.succeed(text11) : Effect28.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
 });
 var writePolicy = (name, hcl) => baoWrite("PUT", policyPath(name), { policy: hcl });
 var deletePolicy = (name) => baoDelete(policyPath(name));
@@ -2737,6 +2861,7 @@ var deletePolicy = (name) => baoDelete(policyPath(name));
 var BaoPolicy = Resource12("Bao.Policy", {
   defaultRemovalPolicy: "retain"
 });
+var IDENTITY9 = nameIdentity("Bao.Policy", policyPath, policyKey);
 var grantsOf = (hcl) => (hcl.match(/^path /gm) ?? []).length;
 var attributesOf12 = (name, hcl, parts) => ({
   name,
@@ -2744,10 +2869,10 @@ var attributesOf12 = (name, hcl, parts) => ({
   grants: grantsOf(hcl),
   parts
 });
-var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect27.gen(function* () {
+var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect29.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const assemble = (dir) => Effect27.gen(function* () {
+  const assemble = (dir) => Effect29.gen(function* () {
     const entries2 = (yield* fs.readDirectory(dir)).filter((f) => f.endsWith(".hcl")).sort();
     let joined = "";
     for (const f of entries2)
@@ -2756,23 +2881,29 @@ var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect27.gen(function
     return { joined, parts: entries2.length };
   });
   return BaoPolicy.Provider.of({
-    list: () => Effect27.succeed([]),
-    read: Effect27.fn(function* ({ olds }) {
+    list: () => Effect29.succeed([]),
+    read: Effect29.fn(function* ({ olds }) {
       const live = yield* readPolicy(olds.name);
       return live.length === 0 ? undefined : attributesOf12(olds.name, live, 0);
     }),
-    diff: Effect27.fn(function* ({ news, output }) {
-      if (output === undefined || !isResolved12(news))
+    diff: Effect29.fn(function* ({ news, olds, output }) {
+      const move = yield* judgeRename(IDENTITY9, olds, news, output);
+      if (output === undefined)
+        return;
+      if (move !== undefined)
+        return { action: "replace" };
+      if (!isResolved12(news))
         return;
       const { joined } = yield* assemble(news.fragments);
       const live = yield* readPolicy(news.name);
       return live.length > 0 && sha256(live) === sha256(joined) ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect27.fn(function* ({ news }) {
+    reconcile: Effect29.fn(function* ({ news, output }) {
       const name = news.name;
+      yield* guardRename(IDENTITY9, news, output);
       const { joined, parts } = yield* assemble(news.fragments);
       if (isEmptyAssembly(parts, joined))
-        return yield* Effect27.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
+        return yield* Effect29.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
       const current = yield* readPolicy(name);
       if (current.length > 0 && sha256(current) === sha256(joined)) {
         return attributesOf12(name, joined, parts);
@@ -2780,7 +2911,7 @@ var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect27.gen(function
       yield* writePolicy(name, joined);
       return attributesOf12(name, joined, parts);
     }),
-    delete: Effect27.fn(function* ({ output }) {
+    delete: Effect29.fn(function* ({ output }) {
       yield* deletePolicy(output.name);
       return;
     })
@@ -2790,7 +2921,7 @@ var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect27.gen(function
 import { Resource as Resource13 } from "alchemy";
 import { isResolved as isResolved13 } from "alchemy/Diff";
 import * as Provider13 from "alchemy/Provider";
-import * as Effect28 from "effect/Effect";
+import * as Effect31 from "effect/Effect";
 
 // src/openbao/proxmox-role-form.ts
 var text11 = (value) => typeof value === "string" ? value : "";
@@ -2836,25 +2967,44 @@ var sameTtl5 = (want, have) => {
   const haveSeconds = ttlSeconds(have);
   return wantSeconds !== undefined && wantSeconds === haveSeconds;
 };
+var rescopeRefusal = (before, mintUser, allowMintUserChange) => before === mintUser || allowMintUserChange === before ? undefined : `re-scopes mint_user ${before} → ${mintUser}. Every token this role mints inherits ` + `the ACL of that PVE user. To re-scope deliberately, declare allowMintUserChange: '${before}'.`;
 var matches11 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl5(props.ttl, attributes.ttl) && sameTtl5(props.maxTtl, attributes.maxTtl);
 
-// src/openbao/proxmox-role.ts
-var BaoProxmoxRole = Resource13("Bao.ProxmoxRole", {
-  defaultRemovalPolicy: "retain"
-});
-var readRole3 = (props) => Effect28.gen(function* () {
+// src/openbao/proxmox-role-wire.ts
+import * as Effect30 from "effect/Effect";
+var readRole3 = (props) => Effect30.gen(function* () {
   const live = yield* baoRead(rolePath5(props.mount, props.name));
   if (live === undefined)
     return;
   return attributesOf13(props, live);
 });
-var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect28.succeed(BaoProxmoxRole.Provider.of({
-  list: () => Effect28.succeed([]),
-  read: Effect28.fn(function* ({ olds }) {
+
+// src/openbao/proxmox-role.ts
+var BaoProxmoxRole = Resource13("Bao.ProxmoxRole", {
+  defaultRemovalPolicy: "retain"
+});
+var IDENTITY10 = roleIdentity("Bao.ProxmoxRole", rolePath5);
+var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect31.succeed(BaoProxmoxRole.Provider.of({
+  list: () => Effect31.succeed([]),
+  read: Effect31.fn(function* ({ olds }) {
     return yield* readRole3(olds);
   }),
-  diff: Effect28.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved13(news))
+  diff: Effect31.fn(function* ({ news, olds, output }) {
+    const move = yield* judgeRename(IDENTITY10, olds, news, output);
+    if (output === undefined)
+      return;
+    if (move !== undefined) {
+      const mintUser = declaredString(news, "mintUser");
+      if (mintUser === undefined || isPendingProp(news, "allowMintUserChange"))
+        return;
+      const from = (yield* readRole3(output))?.mintUser ?? output.mintUser;
+      const allow = declaredString(news, "allowMintUserChange");
+      const refusal2 = rescopeRefusal(from, mintUser, allow);
+      if (refusal2 === undefined)
+        return { action: "replace" };
+      return yield* Effect31.die(new Error(`Bao.ProxmoxRole ${move.from} → ${move.to}: the rename ${refusal2}`));
+    }
+    if (!isResolved13(news))
       return;
     const live = yield* readRole3(news);
     if (live === undefined)
@@ -2863,25 +3013,28 @@ var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect28.su
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect28.fn(function* ({ news }) {
+  reconcile: Effect31.fn(function* ({ news, output }) {
+    const path = rolePath5(news.mount, news.name);
+    yield* guardRename(IDENTITY10, news, output);
     const live = yield* readRole3(news);
-    if (live !== undefined && live.mintUser !== news.mintUser && news.allowMintUserChange !== live.mintUser) {
-      return yield* Effect28.die(new Error(`Bao.ProxmoxRole ${rolePath5(news.mount, news.name)}: live mint_user ` + `${live.mintUser} != declared ${news.mintUser}. Every token this role mints ` + "inherits the ACL of that PVE user. To re-scope deliberately, declare " + `allowMintUserChange: '${live.mintUser}'.`));
+    const rescope = live === undefined ? undefined : rescopeRefusal(live.mintUser, news.mintUser, news.allowMintUserChange);
+    if (rescope !== undefined) {
+      return yield* Effect31.die(new Error(`Bao.ProxmoxRole ${path}: ${rescope}`));
     }
     if (live === undefined || !matches11(live, news)) {
       const write = writeBody9(news);
       if (!write.ok) {
-        return yield* Effect28.die(new Error(`Bao.ProxmoxRole ${rolePath5(news.mount, news.name)}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
+        return yield* Effect31.die(new Error(`Bao.ProxmoxRole ${path}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
       }
-      yield* baoWrite("PUT", rolePath5(news.mount, news.name), write.body);
+      yield* baoWrite("PUT", path, write.body);
     }
     const after = yield* readRole3(news);
     if (after === undefined) {
-      return yield* Effect28.die(new Error(`Bao.ProxmoxRole ${rolePath5(news.mount, news.name)}: write returned no error ` + "but the role is still absent."));
+      return yield* Effect31.die(new Error(`Bao.ProxmoxRole ${path}: write returned no error ` + "but the role is still absent."));
     }
     return after;
   }),
-  delete: Effect28.fn(function* ({ output }) {
+  delete: Effect31.fn(function* ({ output }) {
     yield* baoDelete(rolePath5(output.mount, output.name));
     return;
   })
@@ -2890,7 +3043,7 @@ var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect28.su
 import { Resource as Resource14 } from "alchemy";
 import { isResolved as isResolved14 } from "alchemy/Diff";
 import * as Provider14 from "alchemy/Provider";
-import * as Effect29 from "effect/Effect";
+import * as Effect32 from "effect/Effect";
 
 // src/openbao/ssh-role-form.ts
 var readPath4 = (mount, name) => `${sshMountOf(mount)}/roles/${name}`;
@@ -2978,16 +3131,7 @@ var sameTtl6 = (want, have) => parseDuration(want) === have;
 var badDurations = (form) => ["ttl", "maxTtl"].filter((field) => parseDuration(form[field]) === undefined);
 var matches12 = (attributes, form) => attributes.keyType === "ca" && sameList2(form.allowedUsers, attributes.allowedUsers) && attributes.defaultUser === form.defaultUser && attributes.allowUserCertificates === form.allowUserCertificates && attributes.allowHostCertificates === form.allowHostCertificates && sameList2(form.allowedDomains, attributes.allowedDomains) && attributes.allowSubdomains === form.allowSubdomains && attributes.allowBareDomains === form.allowBareDomains && sameList2(form.allowedExtensions, attributes.allowedExtensions) && sameMap(form.defaultExtensions, attributes.defaultExtensions) && sameList2(form.allowedCriticalOptions, attributes.allowedCriticalOptions) && sameMap(form.defaultCriticalOptions, attributes.defaultCriticalOptions) && attributes.allowEmptyPrincipals === form.allowEmptyPrincipals && sameTtl6(form.ttl, attributes.ttlSeconds) && sameTtl6(form.maxTtl, attributes.maxTtlSeconds);
 
-// src/openbao/ssh-role.ts
-var BaoSshRole = Resource14("Bao.SshRole", {
-  defaultRemovalPolicy: "retain"
-});
-var readRole4 = (form) => Effect29.gen(function* () {
-  const live = yield* baoRead(readPath4(form.mount, form.name));
-  if (live === undefined)
-    return;
-  return { attributes: attributesOf14(form, live), live };
-});
+// src/openbao/ssh-role-erase.ts
 var UNMANAGED_DEFAULTS = {
   algorithm_signer: "default",
   allow_commas_in_identity_templates: false,
@@ -3008,28 +3152,43 @@ var wouldErase2 = (live) => {
   }
   return lost.sort();
 };
-var refuse6 = (message) => Effect29.die(new Error(message));
-var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect29.succeed(BaoSshRole.Provider.of({
-  list: () => Effect29.succeed([]),
-  read: Effect29.fn(function* ({ olds }) {
+
+// src/openbao/ssh-role.ts
+var BaoSshRole = Resource14("Bao.SshRole", {
+  defaultRemovalPolicy: "retain"
+});
+var IDENTITY11 = roleIdentity("Bao.SshRole", readPath4, "ssh");
+var readRole4 = (form) => Effect32.gen(function* () {
+  const live = yield* baoRead(readPath4(form.mount, form.name));
+  if (live === undefined)
+    return;
+  return { attributes: attributesOf14(form, live), live };
+});
+var refuse6 = (message) => Effect32.die(new Error(message));
+var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect32.succeed(BaoSshRole.Provider.of({
+  list: () => Effect32.succeed([]),
+  read: Effect32.fn(function* ({ olds }) {
     const found = yield* readRole4(resolve2(olds));
     return found?.attributes;
   }),
-  diff: Effect29.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved14(news))
+  diff: Effect32.fn(function* ({ news, olds, output }) {
+    const move = yield* judgeRename(IDENTITY11, olds, news, output);
+    if (output === undefined)
       return;
-    const form = resolve2(news);
-    if (output.mount !== form.mount || output.name !== form.name) {
+    if (move !== undefined)
       return { action: "replace" };
-    }
+    if (!isResolved14(news))
+      return;
+    const form = resolve2(news);
     const found = yield* readRole4(form);
     if (found === undefined)
       return { action: "update" };
     return matches12(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect29.fn(function* ({ news }) {
+  reconcile: Effect32.fn(function* ({ news, output }) {
     const form = resolve2(news);
     const path = readPath4(form.mount, form.name);
+    yield* guardRename(IDENTITY11, news, output);
     const bad = badDurations(form);
     if (bad.length > 0) {
       return yield* refuse6(`Bao.SshRole ${path}: ${bad.join(", ")} is not a duration parseDuration understands ` + "(`0` or `<n>s|m|h|d`). It would write, then report update on every plan forever.");
@@ -3053,7 +3212,7 @@ var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect29.succeed(Ba
     }
     return after.attributes;
   }),
-  delete: Effect29.fn(function* ({ output }) {
+  delete: Effect32.fn(function* ({ output }) {
     yield* baoDelete(readPath4(output.mount, output.name));
     return;
   })
@@ -3107,5 +3266,5 @@ export {
   revokeSelfEffect
 };
 
-//# debugId=7E1DFE85CC398C5464756E2164756E21
+//# debugId=B83B2582FB998CE264756E2164756E21
 //# sourceMappingURL=index.js.map