@homeflare/alchemy 0.8.0 → 0.10.0

package/dist/proxmox/index.js

@@ -224,6 +224,11 @@ var pve = (target, role, method, path, form) => Effect4.gen(function* () {
 // src/proxmox/resource.ts
 import { isResolved } from "alchemy/Diff";
 import * as Effect5 from "effect/Effect";
+
+// src/proxmox/update-guard.ts
+var formToSend = (matches, live, props, form) => matches(live, props) || Object.keys(form).length === 0 ? undefined : form;
+
+// src/proxmox/resource.ts
 var pveOperations = (spec) => {
   const read = (props) => pve(props.target, spec.readRole ?? "read", "GET", spec.path(props)).pipe(Effect5.map((data) => data === undefined ? undefined : spec.attributes(data, props)), Effect5.orElseSucceed(() => {
     return;
@@ -244,9 +249,9 @@ var pveOperations = (spec) => {
       const live = yield* read(news);
       if (live === undefined) {
         yield* pve(news.target, "provision", "POST", spec.collection(news), spec.createForm(news));
-      } else if (spec.updateForm !== undefined && !spec.matches(live, news)) {
-        const form = spec.updateForm(news);
-        if (Object.keys(form).length > 0) {
+      } else if (spec.updateForm !== undefined) {
+        const form = formToSend(spec.matches, live, news, spec.updateForm(news));
+        if (form !== undefined) {
           yield* pve(news.target, "provision", "PUT", spec.path(news), form);
         }
       }
@@ -835,8 +840,8 @@ var ProxmoxCephPoolProvider = () => Provider8.effect(ProxmoxCephPool, Effect17.s
       yield* confirmAbsent(news, spec.collection(news), object(news));
       upid = yield* pve(news.target, "provision", "POST", collection(news), createBody(news));
     } else {
-      const form = updateBody(news);
-      if (Object.keys(form).length > 0) {
+      const form = formToSend(spec.matches, live, news, updateBody(news));
+      if (form !== undefined) {
         upid = yield* pve(news.target, "provision", "PUT", object(news), form);
       }
     }
@@ -1041,45 +1046,868 @@ var handlers9 = pveHandlers({
 var ProxmoxHaRuleProvider = () => Provider12.effect(ProxmoxHaRule, Effect21.succeed(ProxmoxHaRule.Provider.of(handlers9)));
 // src/proxmox/lxc.ts
 import { Resource as Resource13 } from "alchemy";
+import { isResolved as isResolved6 } from "alchemy/Diff";
 import * as Provider13 from "alchemy/Provider";
+import * as Effect29 from "effect/Effect";
+
+// src/ownership/adopt.ts
+import { AdoptPolicy } from "alchemy/AdoptPolicy";
+import { AlchemyContext } from "alchemy/AlchemyContext";
+import { Stack as Stack3 } from "alchemy/Stack";
+import * as Effect25 from "effect/Effect";
+import * as Option5 from "effect/Option";
+
+// src/ownership/resume.ts
+import { Unowned } from "alchemy/AdoptPolicy";
+import { Artifacts } from "alchemy/Artifacts";
 import * as Effect22 from "effect/Effect";
-var ProxmoxLxc = Resource13("Proxmox.Lxc");
-var handlers10 = pveHandlers({
-  attributes: (live, props) => ({
-    cores: num(live["cores"], 1),
-    hostname: typeof live["hostname"] === "string" ? live["hostname"] : "",
-    memory: num(live["memory"], 512),
-    node: props.node,
-    onboot: live["onboot"] === 1 || live["onboot"] === true,
-    status: typeof live["status"] === "string" ? live["status"] : "unknown",
-    vmid: props.vmid
-  }),
-  collection: (props) => `nodes/${props.node}/lxc`,
-  createForm: (props) => ({
-    cores: String(props.cores ?? 1),
-    hostname: props.hostname ?? `ct${String(props.vmid)}`,
-    memory: String(props.memory ?? 512),
-    onboot: props.onboot === true ? "1" : "0",
-    ostemplate: props.ostemplate,
-    storage: props.storage,
-    vmid: String(props.vmid),
-    ...props.net0 === undefined ? {} : { net0: props.net0 }
-  }),
-  matches: (attributes, props) => attributes.hostname === (props.hostname ?? `ct${String(props.vmid)}`) && attributes.memory === (props.memory ?? 512) && attributes.cores === (props.cores ?? 1) && attributes.onboot === (props.onboot === true),
-  path: (props) => `nodes/${props.node}/lxc/${String(props.vmid)}/config`,
-  updateForm: (props) => ({
-    cores: String(props.cores ?? 1),
-    hostname: props.hostname ?? `ct${String(props.vmid)}`,
-    memory: String(props.memory ?? 512),
-    onboot: props.onboot === true ? "1" : "0",
-    ...props.net0 === undefined ? {} : { net0: props.net0 }
-  })
+import * as Option2 from "effect/Option";
+var PROVEN = "homeflare/ownership/resumes";
+var UNFINISHED = "homeflare/ownership/unfinished";
+var note = (key, instanceId) => Effect22.gen(function* () {
+  const bag = yield* Effect22.serviceOption(Artifacts);
+  if (Option2.isSome(bag))
+    yield* bag.value.set(key, instanceId);
+});
+var noted = (key, instanceId) => Effect22.gen(function* () {
+  const bag = yield* Effect22.serviceOption(Artifacts);
+  if (Option2.isNone(bag))
+    return false;
+  return (yield* bag.value.get(key)) === instanceId;
+});
+var noteUnfinished = (instanceId) => Effect22.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect22.gen(function* () {
+  yield* noteUnfinished(instanceId);
+  const unproven = () => Effect22.succeed(undefined);
+  const found = yield* recovered.pipe(Effect22.catch(unproven), Effect22.catchDefect(unproven));
+  if (found === undefined || found === null || Unowned.is(found))
+    return;
+  yield* note(PROVEN, instanceId);
+});
+var resumes = (instanceId) => noted(PROVEN, instanceId);
+var unfinished = (instanceId) => noted(UNFINISHED, instanceId);
+var provingResumes = (service) => {
+  const { diff, read } = service;
+  if (diff === undefined || read === undefined)
+    return service;
+  const proving = (input) => Effect22.gen(function* () {
+    if (input.output === undefined) {
+      yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
+    }
+    return yield* diff(input);
+  });
+  return { ...service, diff: proving };
+};
+
+// src/ownership/rows.ts
+import { Stack as Stack2 } from "alchemy/Stack";
+import { State, isActionState } from "alchemy/State/State";
+import * as Effect24 from "effect/Effect";
+import * as Option4 from "effect/Option";
+
+// src/ownership/whole.ts
+import { Stack } from "alchemy/Stack";
+import * as Effect23 from "effect/Effect";
+import * as Option3 from "effect/Option";
+var absent = (value) => value === undefined || value === null;
+var isPlainObject = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var carries = (declared, recorded) => {
+  if (absent(declared))
+    return true;
+  if (absent(recorded))
+    return false;
+  if (Array.isArray(declared)) {
+    if (!Array.isArray(recorded))
+      return false;
+    return declared.every((each, index) => carries(each, recorded[index]));
+  }
+  if (isPlainObject(declared)) {
+    if (!isPlainObject(recorded))
+      return false;
+    return Object.entries(declared).every(([key, each]) => carries(each, recorded[key]));
+  }
+  return true;
+};
+var wholeDeclaration = (fqn, props) => Effect23.map(Effect23.serviceOption(Stack), (stack) => {
+  const declared = Option3.isSome(stack) ? stack.value.resources[fqn] : undefined;
+  return declared !== undefined && carries(declared.Props, props);
+});
+
+// src/ownership/rows.ts
+var storeOf = Effect24.gen(function* () {
+  const stack = yield* Effect24.serviceOption(Stack2);
+  const state = yield* Effect24.serviceOption(State);
+  if (Option4.isNone(stack) || Option4.isNone(state))
+    return;
+  const store = yield* state.value;
+  const where = { stack: stack.value.name, stage: stack.value.stage };
+  return { resources: stack.value.resources, store, where };
+});
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect24.orElseSucceed(() => {
+  return;
+}));
+var generationOf = (row, instanceId) => {
+  let at = row;
+  while (typeof at === "object" && at !== null && !isActionState(at)) {
+    const generation = at;
+    if (generation.instanceId === instanceId)
+      return generation;
+    at = generation.old;
+  }
+  return;
+};
+var recordedGeneration = (fqn, instanceId) => Effect24.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  for (const at of [fqn, ...found.resources[fqn]?.FormerFqns ?? []]) {
+    const generation = generationOf(yield* rowAt(found.store, found.where, at), instanceId);
+    if (generation !== undefined)
+      return generation;
+  }
+  return;
+});
+var recordedInstance = (fqn, instanceId) => Effect24.gen(function* () {
+  const generation = yield* recordedGeneration(fqn, instanceId);
+  if (generation === undefined)
+    return "absent";
+  return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
+});
+var isCreate = (fqn, instanceId) => Effect24.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var forgetRefusedCreate = (fqn, instanceId) => Effect24.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  const row = yield* rowAt(found.store, found.where, fqn);
+  const mine = row;
+  if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
+    return;
+  }
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect24.ignore);
+});
+
+// src/ownership/adopt.ts
+var adoptEnabled = (fqn) => Effect25.gen(function* () {
+  const stack = yield* Effect25.serviceOption(Stack3);
+  const scoped = Option5.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
+  if (scoped !== undefined)
+    return scoped;
+  const policy = yield* Effect25.serviceOption(AdoptPolicy);
+  if (Option5.isSome(policy))
+    return policy.value;
+  const context = yield* Effect25.serviceOption(AlchemyContext);
+  return Option5.isSome(context) ? context.value.adopt : false;
+});
+var adoptable = (owner) => Effect25.gen(function* () {
+  if (yield* isCreate(owner.fqn, owner.instanceId))
+    return true;
+  return yield* unfinished(owner.instanceId);
+});
+var adoptsAtApply = (owner) => Effect25.gen(function* () {
+  if (!(yield* adoptEnabled(owner.fqn)))
+    return false;
+  return yield* adoptable(owner);
 });
-var ProxmoxLxcProvider = () => Provider13.effect(ProxmoxLxc, Effect22.succeed(ProxmoxLxc.Provider.of(handlers10)));
+var refuseTakeover = (owner, what) => Effect25.gen(function* () {
+  if (owner.output !== undefined)
+    return;
+  if (yield* resumes(owner.instanceId))
+    return;
+  const may = yield* adoptable(owner);
+  if (may && (yield* adoptEnabled(owner.fqn)))
+    return;
+  yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
+  const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
+  return yield* Effect25.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+});
+var claimFor = (owner) => (what) => refuseTakeover(owner, what);
+
+// src/ownership/probe.ts
+import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
+import * as Effect26 from "effect/Effect";
+var ownedRead = (ask, found, settled2) => Effect26.gen(function* () {
+  if (found === undefined || ask.output !== undefined)
+    return found;
+  const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
+  if (recorded === "absent")
+    return Unowned2(found);
+  if (recorded === "partial") {
+    yield* Effect26.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
+    return Unowned2(found);
+  }
+  const unproven = (reason) => Effect26.as(Effect26.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
+  const ours = yield* settled2.pipe(Effect26.catch(unproven), Effect26.catchDefect(unproven));
+  return ours ? found : Unowned2(found);
+});
+
+// src/proxmox/lxc-wire.ts
+var pairs = (value, defaultKey) => value.split(",").map((part) => part.trim()).filter((part) => part !== "").map((part) => {
+  const at = part.indexOf("=");
+  if (at === -1)
+    return [defaultKey ?? part, defaultKey === undefined ? "" : part];
+  return [part.slice(0, at).trim(), part.slice(at + 1).trim()];
+});
+var DEFAULTS = {
+  dev: { "deny-write": "0" },
+  features: { force_rw_sys: "0", fuse: "0", keyctl: "0", mknod: "0", nesting: "0" },
+  net: { firewall: "0", "host-managed": "0", link_down: "0", type: "veth" },
+  volume: { backup: "0", keepattrs: "0", quota: "0", replicate: "1", ro: "0", shared: "0" }
+};
+var FLAGS = new Set([
+  "acl",
+  "backup",
+  "deny-write",
+  "firewall",
+  "force_rw_sys",
+  "fuse",
+  "host-managed",
+  "keepattrs",
+  "keyctl",
+  "link_down",
+  "mknod",
+  "nesting",
+  "quota",
+  "replicate",
+  "ro",
+  "shared"
+]);
+var SETS = new Set(["mount", "mountoptions"]);
+var canonicalValue = (key, value) => {
+  if (FLAGS.has(key))
+    return canonicalToken(value);
+  if (SETS.has(key))
+    return [...new Set(value.split(";").map((part) => part.trim()))].sort().join(";");
+  if (key === "hwaddr")
+    return value.toUpperCase();
+  return value;
+};
+var optionMap = (value, family, defaultKey) => {
+  const defaults = DEFAULTS[family] ?? {};
+  const out = new Map;
+  for (const [key, raw] of pairs(value, defaultKey)) {
+    const canonical = canonicalValue(key, raw);
+    if (defaults[key] !== canonical)
+      out.set(key, canonical);
+  }
+  return out;
+};
+var sameMap = (left, right) => left.size === right.size && [...left].every(([key, value]) => right.get(key) === value);
+var sortedForm = (map6) => [...map6].map(([key, value]) => `${key}=${value}`).sort().join(",");
+var printMap = (map6, lead = []) => [...lead.filter((key) => map6.has(key)), ...[...map6.keys()].filter((k) => !lead.includes(k))].map((key) => `${key}=${map6.get(key) ?? ""}`).join(",");
+var netMaps = (declared, live) => {
+  const want = optionMap(declared, "net");
+  const have = optionMap(live, "net");
+  if (!want.has("hwaddr"))
+    have.delete("hwaddr");
+  return { have, want };
+};
+var netWrite = (declared, live) => {
+  const want = new Map(pairs(declared));
+  const mac = live === undefined ? undefined : new Map(pairs(live)).get("hwaddr");
+  if (!want.has("hwaddr") && mac !== undefined)
+    want.set("hwaddr", mac);
+  return printMap(want, ["name"]);
+};
+var tagSet = (value) => [...new Set(value.split(/[;,\s]+/).filter((tag) => tag !== ""))].map((tag) => tag.toLowerCase()).sort().join(";");
+var orderedList = (value) => value.split(/[;,\s]+/).filter((part) => part !== "").join(" ");
+var descriptionText = (value) => value.replace(/\s+$/, "");
+var SCALAR_KINDS = {
+  arch: "text",
+  cmode: "text",
+  console: "flag",
+  cores: "number",
+  cpulimit: "number",
+  cpuunits: "number",
+  description: "form",
+  features: "form",
+  hostname: "text",
+  memory: "number",
+  nameserver: "form",
+  onboot: "flag",
+  ostype: "text",
+  protection: "flag",
+  searchdomain: "form",
+  startup: "form",
+  swap: "number",
+  tags: "form",
+  timezone: "text",
+  tty: "number"
+};
+var CLEARABLE = new Set([
+  "description",
+  "features",
+  "nameserver",
+  "searchdomain",
+  "startup",
+  "tags",
+  "timezone"
+]);
+var SCALAR_DEFAULTS = {
+  arch: "amd64",
+  cmode: "tty",
+  console: "1",
+  cpulimit: "0",
+  memory: "512",
+  onboot: "0",
+  protection: "0",
+  swap: "512",
+  tty: "2"
+};
+var scalarForm = (key, value) => {
+  const kind2 = SCALAR_KINDS[key];
+  if (kind2 === "number")
+    return String(Number(value));
+  if (kind2 === "flag")
+    return canonicalToken(value);
+  if (key === "description")
+    return descriptionText(value);
+  if (key === "features")
+    return sortedForm(optionMap(value, "features"));
+  if (key === "nameserver" || key === "searchdomain")
+    return orderedList(value);
+  if (key === "startup")
+    return propertyString(value, "order");
+  if (key === "tags")
+    return tagSet(value);
+  return value;
+};
+
+// src/proxmox/lxc-props.ts
+var UNSTORED = new Set([
+  "description",
+  "digest",
+  "env",
+  "lock",
+  "lxc",
+  "pending"
+]);
+var INDEXED = {
+  dev: 256,
+  mp: 256,
+  net: 32
+};
+var indexedKey = (key) => {
+  const match = /^(mp|net|dev)(0|[1-9]\d*)$/.exec(key);
+  if (match === null)
+    return;
+  const family = match[1];
+  const index = Number(match[2]);
+  return index < INDEXED[family] ? [family, index] : undefined;
+};
+var NOT_CONFIG = new Set([
+  "node",
+  "ostemplate",
+  "start",
+  "target",
+  "vmid"
+]);
+var declaredValue = (props, key) => props[key];
+var declaredKeys = (props) => Object.keys(props).filter((key) => !NOT_CONFIG.has(key) && declaredValue(props, key) !== undefined).sort();
+var wireValue = (value) => value === true ? "1" : value === false ? "0" : String(value);
+var isManagedKey = (key) => SCALAR_KINDS[key] !== undefined || key === "unprivileged" || key === "rootfs" || indexedKey(key) !== undefined;
+var storedConfig = (live) => {
+  const out = {};
+  for (const [key, value] of Object.entries(live)) {
+    if (!isManagedKey(key) || UNSTORED.has(key))
+      continue;
+    if (value === null || value === undefined || typeof value === "object")
+      continue;
+    out[key] = wireValue(value);
+  }
+  return out;
+};
+var rawKeysOf = (live) => {
+  const raw = live["lxc"];
+  if (!Array.isArray(raw))
+    return [];
+  return raw.map((pair) => Array.isArray(pair) ? String(pair[0]) : "").filter((key) => key !== "");
+};
+
+// src/proxmox/lxc-volume.ts
+var NEW_DISK = /^([^:\s]+):(\d+(?:\.\d+)?)$/;
+var UNITS = {
+  G: 1024 ** 3,
+  K: 1024,
+  M: 1024 ** 2,
+  T: 1024 ** 4
+};
+var sizeBytes = (text2) => {
+  const match = /^(\d+(?:\.\d+)?)([KMGT])?$/.exec(text2.trim());
+  if (match === null)
+    return;
+  return Math.trunc(Number(match[1]) * (match[2] === undefined ? 1 : UNITS[match[2]] ?? 1));
+};
+var parseVolume = (text2) => {
+  const [first] = pairs(text2, "volume");
+  const spec2 = first?.[0] === "volume" ? first[1] : "";
+  const options = optionMap(text2, "volume", "volume");
+  options.delete("volume");
+  const sizeText = options.get("size");
+  options.delete("size");
+  const fresh = NEW_DISK.exec(spec2);
+  if (fresh !== null) {
+    const gib = `${fresh[2] ?? "0"}G`;
+    return {
+      kind: "new",
+      options,
+      size: sizeBytes(gib),
+      sizeText: gib,
+      source: fresh[1] ?? "",
+      volname: ""
+    };
+  }
+  const size = sizeText === undefined ? undefined : sizeBytes(sizeText);
+  if (spec2.startsWith("/")) {
+    const kind2 = spec2.startsWith("/dev/") ? "device" : "bind";
+    return { kind: kind2, options, size, sizeText, source: spec2, volname: "" };
+  }
+  const at = spec2.indexOf(":");
+  return {
+    kind: "volume",
+    options,
+    size,
+    sizeText,
+    source: at === -1 ? spec2 : spec2.slice(0, at),
+    volname: at === -1 ? "" : spec2.slice(at + 1)
+  };
+};
+var isHostPath = (volume) => volume.kind === "bind" || volume.kind === "device";
+var rewrite = (live, declared) => {
+  const parts = [`${live.source}:${live.volname}`];
+  for (const [key, value] of declared.options)
+    parts.push(`${key}=${value}`);
+  if (live.sizeText !== undefined)
+    parts.push(`size=${live.sizeText}`);
+  return parts.join(",");
+};
+var judgeVolume = (key, declared, live) => {
+  const want = parseVolume(declared);
+  const have = parseVolume(live);
+  if (isHostPath(want) || isHostPath(have)) {
+    const same2 = want.kind === have.kind && want.source === have.source && sameMap(want.options, have.options);
+    return same2 ? {} : { rootOnly: true };
+  }
+  if (want.source !== have.source) {
+    return {
+      refuse: `${key}: the volume is on ${have.source}, declared on ${want.source}. Moving it is ` + "`pct move-volume` (a copy), not a config update -- move it by hand, then declare it."
+    };
+  }
+  if (want.kind === "volume" && want.volname !== have.volname) {
+    return {
+      refuse: `${key}: declared volume ${want.volname} is not the live ${have.volname}. Writing it would ` + "detach the live volume to unusedN; attach or swap volumes by hand."
+    };
+  }
+  let resize;
+  if (want.size !== undefined && have.size !== undefined && want.size !== have.size) {
+    if (want.size < have.size) {
+      return {
+        refuse: `${key}: declared ${want.sizeText ?? "?"} is smaller than the live ` + `${have.sizeText ?? "?"}. PVE cannot shrink a container volume ("unable to shrink disk ` + 'size"), and replacing the guest to get there is not an update this resource makes.'
+      };
+    }
+    resize = want.sizeText;
+  }
+  const put = sameMap(want.options, have.options) ? undefined : rewrite(have, want);
+  return {
+    ...put === undefined ? {} : { put },
+    ...resize === undefined ? {} : { resize }
+  };
+};
+
+// src/proxmox/lxc-judge.ts
+var text2 = (value) => value === undefined || value === null ? undefined : wireValue(value);
+var rootOnly = (vmid, key, value, why) => `${key}: ${why} PVE lets only root@pam write it, and an API token is never root@pam. Run ` + `\`pct set ${String(vmid)} ${value === "" ? `--delete ${key}` : `--${key} '${value}'`}\` ` + "on the node, then plan again.";
+var rawFeatures = (value) => new Map(pairs(value).map(([key, entry]) => [key, key === "mount" ? entry : canonicalToken(entry)]));
+var featuresNeedRoot = (live, sent, unprivileged) => {
+  if (!unprivileged)
+    return true;
+  const have = rawFeatures(live);
+  if (sent === undefined)
+    return !(have.size === 0 || have.size === 1 && have.has("nesting"));
+  const want = rawFeatures(sent);
+  const keys = new Set([...have.keys(), ...want.keys()]);
+  return [...keys].some((key) => key !== "nesting" && (have.get(key) ?? "") !== (want.get(key) ?? ""));
+};
+var featureWhy = (unprivileged) => unprivileged ? "A feature other than nesting." : "Any feature on a privileged guest.";
+var judge = (props, live) => {
+  const put = {};
+  const clear = [];
+  const resize = [];
+  const refuse = [];
+  const drift = new Set;
+  const unprivileged = bool(live["unprivileged"], false);
+  for (const key of declaredKeys(props)) {
+    const want = wireValue(declaredValue(props, key));
+    const have = text2(live[key]);
+    const indexed = indexedKey(key);
+    if (key === "unprivileged") {
+      if (canonicalToken(want) !== canonicalToken(have ?? "0")) {
+        drift.add(key);
+        refuse.push(`unprivileged: live ${have ?? "0"}, declared ${want}. PVE refuses to change it ("unable ` + 'to modify read-only option"); only a backup and restore can, and that is a new guest.');
+      }
+      continue;
+    }
+    if (key === "rootfs" || indexed?.[0] === "mp") {
+      if (want === "") {
+        if (have === undefined)
+          continue;
+        drift.add(key);
+        refuse.push(`${key}: detaching a mount point moves its volume to unusedN -- do it by hand.`);
+      } else if (have === undefined) {
+        drift.add(key);
+        if (isHostPath(parseVolume(want))) {
+          refuse.push(rootOnly(props.vmid, key, want, "A bind or device mount point."));
+        } else
+          put[key] = want;
+      } else {
+        const verdict = judgeVolume(key, want, have);
+        if (verdict.refuse !== undefined)
+          refuse.push(verdict.refuse);
+        if (verdict.rootOnly === true) {
+          refuse.push(rootOnly(props.vmid, key, want, "A bind or device mount point."));
+        }
+        if (verdict.put !== undefined)
+          put[key] = verdict.put;
+        if (verdict.resize !== undefined)
+          resize.push({ disk: key, size: verdict.resize });
+        if (Object.keys(verdict).length > 0)
+          drift.add(key);
+      }
+      continue;
+    }
+    if (indexed?.[0] === "dev") {
+      const same2 = want === "" ? have === undefined : have !== undefined && devSame(want, have);
+      if (!same2) {
+        drift.add(key);
+        refuse.push(rootOnly(props.vmid, key, want, "Device passthrough."));
+      }
+      continue;
+    }
+    if (indexed?.[0] === "net") {
+      if (want === "") {
+        if (have !== undefined) {
+          drift.add(key);
+          clear.push(key);
+        }
+      } else if (have === undefined) {
+        drift.add(key);
+        put[key] = want;
+      } else {
+        const maps = netMaps(want, have);
+        if (!sameMap(maps.want, maps.have)) {
+          drift.add(key);
+          put[key] = netWrite(want, have);
+        }
+      }
+      continue;
+    }
+    if (!isManagedKey(key)) {
+      drift.add(key);
+      refuse.push(`${key}: not a config key this resource manages.`);
+      continue;
+    }
+    const wanted = want === "" ? "" : scalarForm(key, want);
+    const current = have ?? SCALAR_DEFAULTS[key];
+    const had = current === undefined ? "" : scalarForm(key, current);
+    if (wanted === had)
+      continue;
+    drift.add(key);
+    const next = key === "features" ? wanted : want;
+    if (key === "features" && featuresNeedRoot(have ?? "", next || undefined, unprivileged)) {
+      refuse.push(rootOnly(props.vmid, key, want, featureWhy(unprivileged)));
+    } else if (next === "" && CLEARABLE.has(key)) {
+      clear.push(key);
+    } else if (next === "") {
+      refuse.push(`${key}: cannot be removed; declare the value it should have.`);
+    } else
+      put[key] = next;
+  }
+  return { clear, drift: [...drift].sort(), put, refuse, resize };
+};
+var devSame = (want, have) => sortedForm(optionMap(want, "dev", "path")) === sortedForm(optionMap(have, "dev", "path"));
+
+// src/proxmox/lxc-create-form.ts
+var existingVolume = (key, value) => `${key}: ${value} names an existing volume, and PVE would unpack the template onto it. A ` + "create allocates new volumes only: declare `storage:GiB`, and attach an existing volume by " + "hand after the create.";
+var createRefusals = (props) => {
+  const refuse = [];
+  if (props.ostemplate === undefined || props.ostemplate === "") {
+    refuse.push(`CT ${String(props.vmid)} does not exist on ${props.node}, and without \`ostemplate\` ` + "there is nothing to create it from. To adopt a guest, declare the node it is on.");
+  }
+  const unprivileged = props.unprivileged === undefined ? true : bool(props.unprivileged);
+  for (const key of declaredKeys(props)) {
+    const value = wireValue(declaredValue(props, key));
+    const family = indexedKey(key)?.[0];
+    if (!isManagedKey(key))
+      refuse.push(`${key}: not a config key this resource manages.`);
+    if (value === "")
+      continue;
+    if (family === "dev")
+      refuse.push(rootOnly(props.vmid, key, value, "Device passthrough."));
+    const volume = family === "mp" || key === "rootfs" ? parseVolume(value) : undefined;
+    if (volume !== undefined && isHostPath(volume)) {
+      refuse.push(rootOnly(props.vmid, key, value, "A bind or device mount point."));
+    }
+    if (volume?.kind === "volume")
+      refuse.push(existingVolume(key, value));
+    if (key === "features" && featuresNeedRoot("", value, unprivileged)) {
+      refuse.push(rootOnly(props.vmid, key, value, featureWhy(unprivileged)));
+    }
+  }
+  return refuse;
+};
+var createForm3 = (props) => {
+  const form = { vmid: String(props.vmid) };
+  if (props.ostemplate !== undefined)
+    form["ostemplate"] = props.ostemplate;
+  if (props.start !== undefined)
+    form["start"] = wireValue(props.start);
+  for (const key of declaredKeys(props)) {
+    const value = wireValue(declaredValue(props, key));
+    if (value === "")
+      continue;
+    form[key] = key === "features" ? scalarForm(key, value) : value;
+  }
+  return form;
+};
+
+// src/proxmox/lxc-identity.ts
+var plain = (news, key) => {
+  const value = news[key];
+  return typeof value === "string" || typeof value === "number" ? value : undefined;
+};
+var identityRefusals = (news, olds, output) => {
+  const was = output?.vmid ?? olds.vmid;
+  const vmid = plain(news, "vmid");
+  const template = plain(news, "ostemplate");
+  const reasons = [];
+  if (vmid !== undefined && vmid !== was) {
+    reasons.push(`vmid: ${String(was)} -> ${String(vmid)} is a different guest. Declare it as a new ` + "resource; this one is retained when its declaration goes.");
+  }
+  if (template !== undefined && olds.ostemplate !== undefined && template !== olds.ostemplate) {
+    reasons.push("ostemplate: a template is consumed at create; another one is a new guest.");
+  }
+  return reasons;
+};
+
+// src/proxmox/lxc-lifecycle.ts
+import * as Effect28 from "effect/Effect";
+
+// src/proxmox/network-apply-read.ts
+import * as Effect27 from "effect/Effect";
+var stagedDiff = (target, node) => Effect27.gen(function* () {
+  const path = `nodes/${node}/network`;
+  const credential = yield* leased(target, "read");
+  const envelope = yield* pveEnvelopeWith(target, credential, "GET", path);
+  return text(envelope.changes);
+});
+var pendingLines = (diff) => {
+  if (diff === "")
+    return 0;
+  const changed = diff.split(`
+`).filter((line) => (line.startsWith("+") || line.startsWith("-")) && !line.startsWith("+++") && !line.startsWith("---")).length;
+  return Math.max(changed, 1);
+};
+var pendingCount = (target, node) => stagedDiff(target, node).pipe(Effect27.map(pendingLines));
+var clusterHealth = (target) => pve(target, "read", "GET", "cluster/status").pipe(Effect27.map((rows) => {
+  const all = rows ?? [];
+  const cluster = all.find((row) => row.type === "cluster");
+  return {
+    offline: all.filter((row) => row.type === "node" && !bool(row.online)).map((row) => text(row.name, "<unnamed>")),
+    quorate: cluster === undefined ? true : bool(cluster.quorate)
+  };
+}));
+var degradedReason = (target) => clusterHealth(target).pipe(Effect27.map((health) => health.quorate && health.offline.length === 0 ? undefined : `quorate=${String(health.quorate)} offline=[${health.offline.join(", ")}]`));
+var UNREACHABLE = "the task could not be read -- the node stopped answering, or this lease cannot see it";
+var STILL_RUNNING = "still running when this provider stopped waiting";
+var ATTEMPTS = 30;
+var awaitTask = (target, credential, node, upid, attempts = ATTEMPTS) => Effect27.gen(function* () {
+  const path = `nodes/${node}/tasks/${upid}/status`;
+  for (let attempt = 0;attempt < attempts; attempt += 1) {
+    const status = yield* pveWith(target, credential, "GET", path).pipe(Effect27.orElseSucceed(() => {
+      return;
+    }));
+    if (status === undefined)
+      return UNREACHABLE;
+    if (status.status === "stopped")
+      return text(status.exitstatus, "stopped with no exitstatus");
+    yield* Effect27.sleep("1 second");
+  }
+  return STILL_RUNNING;
+});
+
+// src/proxmox/lxc-lifecycle.ts
+class LxcRefusedError extends Error {
+  name = "LxcRefusedError";
+}
+var guestPath = (where) => `nodes/${where.node}/lxc/${String(where.vmid)}`;
+var CREATE_POLLS = 180;
+var TASK_POLLS = 60;
+var isServerError = (error) => error instanceof PveError && error.status === 500;
+var readLive = (where) => Effect28.gen(function* () {
+  const answer = yield* pve(where.target, "read", "GET", `${guestPath(where)}/config`).pipe(Effect28.map((data) => ({ data, error: undefined })), Effect28.catchIf(isServerError, (error) => Effect28.succeed({ data: undefined, error })));
+  if (answer.data !== undefined && answer.data !== null)
+    return answer.data;
+  const rows = yield* pve(where.target, "read", "GET", "cluster/resources?type=vm");
+  const found = (rows ?? []).find((row) => Number(row.vmid) === where.vmid);
+  if (found !== undefined && found.node === where.node && found.type === "lxc") {
+    return yield* Effect28.fail(answer.error ?? new LxcRefusedError(`CT ${String(where.vmid)} is listed but its config read empty.`));
+  }
+  if (found !== undefined) {
+    return yield* Effect28.fail(new LxcRefusedError(`vmid ${String(where.vmid)} is a ${text(found.type, "guest")} on ` + `${text(found.node, "?")}, not a container on ${where.node}. A migration is not an ` + "update and vmids are cluster-wide: declare the node it is on, or pick a free vmid."));
+  }
+  return;
+});
+var attributesOf = (where, live) => ({
+  config: storedConfig(live),
+  node: where.node,
+  rawKeys: rawKeysOf(live),
+  vmid: where.vmid
+});
+var task = (where, method, path, what, polls, form) => Effect28.gen(function* () {
+  const credential = yield* mint(where.target, "provision");
+  const upid = text(yield* pveWith(where.target, credential, method, path, form));
+  if (upid === "") {
+    return yield* Effect28.fail(new LxcRefusedError(`${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`));
+  }
+  const exit = yield* awaitTask(where.target, credential, where.node, upid, polls);
+  if (exit !== "OK") {
+    return yield* Effect28.fail(new LxcRefusedError(`${what}: task ${upid} ended "${exit}". Read \`pvesh get /nodes/${where.node}/tasks/` + `${upid}/log\` before running the deploy again.`));
+  }
+});
+var createGuest = (props) => task(props, "POST", `nodes/${props.node}/lxc`, `create CT ${String(props.vmid)}`, CREATE_POLLS, createForm3(props));
+var updateGuest = (props, change, digest) => Effect28.gen(function* () {
+  if (Object.keys(change.put).length > 0 || change.clear.length > 0) {
+    const form = withClears({ ...change.put, ...digest === "" ? {} : { digest } }, change.clear);
+    yield* pve(props.target, "provision", "PUT", `${guestPath(props)}/config`, form);
+  }
+  for (const grow of change.resize) {
+    yield* task(props, "PUT", `${guestPath(props)}/resize`, `grow ${grow.disk} of CT ${String(props.vmid)} to ${grow.size}`, TASK_POLLS, { disk: grow.disk, size: grow.size });
+  }
+});
+var destroyGuest = (where, declared) => Effect28.gen(function* () {
+  const live = yield* readLive(where);
+  if (live === undefined)
+    return;
+  const drift = judge(declared, live).drift;
+  if (drift.length > 0) {
+    return yield* Effect28.fail(new LxcRefusedError(`destroy CT ${String(where.vmid)}: the guest on ${where.node} no longer matches its last ` + `declaration (${drift.join(", ")}), so it may not be the guest this stack made. ` + "Nothing was deleted. Delete it by hand if it should go, or declare it again."));
+  }
+  yield* task(where, "DELETE", guestPath(where), `destroy CT ${String(where.vmid)}`, TASK_POLLS);
+});
+
+// src/proxmox/lxc.ts
+var ProxmoxLxc = Resource13("Proxmox.Lxc", { defaultRemovalPolicy: "retain" });
+var refused = (reasons) => Effect29.fail(new LxcRefusedError(reasons.join(`
+`)));
+var diff = (news, olds, output) => Effect29.gen(function* () {
+  const identity2 = identityRefusals(news, olds, output);
+  if (identity2.length > 0)
+    return yield* refused(identity2);
+  if (output === undefined)
+    return;
+  if (!isResolved6(news))
+    return;
+  const live = yield* readLive(news);
+  if (live === undefined) {
+    const refusals = createRefusals(news);
+    if (refusals.length > 0)
+      return yield* refused(refusals);
+    yield* Effect29.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: the cluster lists no guest with this ` + "vmid -- a deploy CREATES it again from ostemplate, with new, empty volumes.");
+    return { action: "update" };
+  }
+  const change = judge(news, live);
+  if (change.refuse.length > 0)
+    return yield* refused(change.refuse);
+  const moved = news.node !== output.node;
+  if (change.drift.length === 0 && !moved)
+    return { action: "noop" };
+  const what = change.drift.length === 0 ? `the guest is on ${news.node} now, not ${output.node} -- a deploy re-records it, ` + "writing nothing." : `live config differs from the declaration in ${change.drift.join(", ")} -- a ` + "deploy writes these.";
+  yield* Effect29.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: ${what}`);
+  return { action: "update" };
+});
+var reconcile = (owner, news) => Effect29.gen(function* () {
+  const { output } = owner;
+  const identity2 = identityRefusals(news, news, output);
+  if (identity2.length > 0)
+    return yield* refused(identity2);
+  const live = yield* readLive(news);
+  if (live === undefined) {
+    const refusals = createRefusals(news);
+    if (refusals.length > 0)
+      return yield* refused(refusals);
+    yield* createGuest(news);
+  } else {
+    if (output === undefined) {
+      yield* refuseTakeover(owner, `Proxmox.Lxc CT ${String(news.vmid)} on ${news.node}`);
+    }
+    const change = judge(news, live);
+    if (output === undefined && change.drift.length > 0) {
+      return yield* refused([
+        `CT ${String(news.vmid)} already exists on ${news.node} and differs in ` + `${change.drift.join(", ")}, but this deploy planned a create. A create never writes ` + "onto an existing guest: plan again, so the plan can show it and adopt it."
+      ]);
+    }
+    if (change.refuse.length > 0)
+      return yield* refused(change.refuse);
+    if (change.drift.length > 0)
+      yield* updateGuest(news, change, text(live["digest"]));
+  }
+  const after = yield* readLive(news);
+  if (after === undefined) {
+    return yield* refused([
+      `CT ${String(news.vmid)}: the write returned no error but the guest is still absent.`
+    ]);
+  }
+  const left = judge(news, after).drift;
+  if (left.length > 0) {
+    return yield* refused([
+      `CT ${String(news.vmid)}: after the write, ${left.join(", ")} still differ from the ` + "declaration. PVE may have normalised the value (tags are lower-cased by default) -- " + "declare what it stores."
+    ]);
+  }
+  return attributesOf(news, after);
+});
+var whereOf = (olds, output) => ({
+  node: output?.node ?? olds.node,
+  target: olds.target,
+  vmid: output?.vmid ?? olds.vmid
+});
+var read = (owner, olds) => Effect29.gen(function* () {
+  const where = whereOf(olds, owner.output);
+  const live = yield* readLive(where);
+  if (live === undefined)
+    return;
+  const settled2 = Effect29.sync(() => judge(olds, live).drift.length === 0);
+  return yield* ownedRead(owner, attributesOf(where, live), settled2);
+});
+var handlers10 = {
+  delete: ({ olds, output }) => destroyGuest(whereOf(olds, output), olds),
+  diff: ({
+    news,
+    olds,
+    output
+  }) => diff(news, olds, output),
+  list: () => Effect29.succeed([]),
+  read: ({
+    fqn,
+    instanceId,
+    olds,
+    output
+  }) => read({ fqn, instanceId, output }, olds),
+  reconcile: ({
+    fqn,
+    instanceId,
+    news,
+    output
+  }) => reconcile({ fqn, instanceId, output }, news)
+};
+var ProxmoxLxcProvider = () => Provider13.effect(ProxmoxLxc, Effect29.succeed(ProxmoxLxc.Provider.of(handlers10)).pipe(Effect29.map(provingResumes)));
 // src/proxmox/metric-server.ts
 import { Resource as Resource14 } from "alchemy";
 import * as Provider14 from "alchemy/Provider";
-import * as Effect23 from "effect/Effect";
+import * as Effect30 from "effect/Effect";
 
 // src/proxmox/metric-server-form.ts
 var UNSET2 = -1;
@@ -1187,67 +2015,22 @@ var handlers11 = pveHandlers({
   path: (props) => `cluster/metrics/server/${props.id}`,
   updateForm: update
 });
-var ProxmoxMetricServerProvider = () => Provider14.effect(ProxmoxMetricServer, Effect23.succeed(ProxmoxMetricServer.Provider.of(handlers11)));
+var ProxmoxMetricServerProvider = () => Provider14.effect(ProxmoxMetricServer, Effect30.succeed(ProxmoxMetricServer.Provider.of(handlers11)));
 // src/proxmox/network-apply.ts
 import { Resource as Resource15 } from "alchemy";
-import { isResolved as isResolved6 } from "alchemy/Diff";
+import { isResolved as isResolved7 } from "alchemy/Diff";
 import * as Provider15 from "alchemy/Provider";
-import * as Effect25 from "effect/Effect";
-
-// src/proxmox/network-apply-read.ts
-import * as Effect24 from "effect/Effect";
-var stagedDiff = (target, node) => Effect24.gen(function* () {
-  const path = `nodes/${node}/network`;
-  const credential = yield* leased(target, "read");
-  const envelope = yield* pveEnvelopeWith(target, credential, "GET", path);
-  return text(envelope.changes);
-});
-var pendingLines = (diff) => {
-  if (diff === "")
-    return 0;
-  const changed = diff.split(`
-`).filter((line) => (line.startsWith("+") || line.startsWith("-")) && !line.startsWith("+++") && !line.startsWith("---")).length;
-  return Math.max(changed, 1);
-};
-var pendingCount = (target, node) => stagedDiff(target, node).pipe(Effect24.map(pendingLines));
-var clusterHealth = (target) => pve(target, "read", "GET", "cluster/status").pipe(Effect24.map((rows) => {
-  const all = rows ?? [];
-  const cluster = all.find((row) => row.type === "cluster");
-  return {
-    offline: all.filter((row) => row.type === "node" && !bool(row.online)).map((row) => text(row.name, "<unnamed>")),
-    quorate: cluster === undefined ? true : bool(cluster.quorate)
-  };
-}));
-var degradedReason = (target) => clusterHealth(target).pipe(Effect24.map((health) => health.quorate && health.offline.length === 0 ? undefined : `quorate=${String(health.quorate)} offline=[${health.offline.join(", ")}]`));
-var UNREACHABLE = "the task could not be read -- the node stopped answering, or this lease cannot see it";
-var STILL_RUNNING = "still running when this provider stopped waiting";
-var ATTEMPTS = 30;
-var awaitTask = (target, credential, node, upid) => Effect24.gen(function* () {
-  const path = `nodes/${node}/tasks/${upid}/status`;
-  for (let attempt = 0;attempt < ATTEMPTS; attempt += 1) {
-    const status = yield* pveWith(target, credential, "GET", path).pipe(Effect24.orElseSucceed(() => {
-      return;
-    }));
-    if (status === undefined)
-      return UNREACHABLE;
-    if (status.status === "stopped")
-      return text(status.exitstatus, "stopped with no exitstatus");
-    yield* Effect24.sleep("1 second");
-  }
-  return STILL_RUNNING;
-});
-
-// src/proxmox/network-apply.ts
+import * as Effect31 from "effect/Effect";
 var ProxmoxNetworkApply = Resource15("Proxmox.NetworkApply");
-var read = (props) => pendingCount(props.target, props.node).pipe(Effect25.map((pending) => ({ node: props.node, pending })));
-var diff = (news) => Effect25.gen(function* () {
-  if (!isResolved6(news))
+var read2 = (props) => pendingCount(props.target, props.node).pipe(Effect31.map((pending) => ({ node: props.node, pending })));
+var diff2 = (news) => Effect31.gen(function* () {
+  if (!isResolved7(news))
     return;
-  const { pending } = yield* read(news);
+  const { pending } = yield* read2(news);
   return pending === 0 ? { action: "noop" } : { action: "update" };
 });
-var refuse = (node, why) => Effect25.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));
-var apply = (props) => Effect25.gen(function* () {
+var refuse = (node, why) => Effect31.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));
+var apply = (props) => Effect31.gen(function* () {
   const node = props.node;
   const staged = yield* pendingCount(props.target, node);
   if (staged === 0)
@@ -1276,17 +2059,17 @@ var apply = (props) => Effect25.gen(function* () {
   return { node, pending: left };
 });
 var handlers12 = {
-  delete: () => Effect25.void,
-  diff: ({ news }) => diff(news),
-  list: () => Effect25.succeed([]),
-  read: ({ olds }) => read(olds),
+  delete: () => Effect31.void,
+  diff: ({ news }) => diff2(news),
+  list: () => Effect31.succeed([]),
+  read: ({ olds }) => read2(olds),
   reconcile: ({ news }) => apply(news)
 };
-var ProxmoxNetworkApplyProvider = () => Provider15.effect(ProxmoxNetworkApply, Effect25.succeed(ProxmoxNetworkApply.Provider.of(handlers12)));
+var ProxmoxNetworkApplyProvider = () => Provider15.effect(ProxmoxNetworkApply, Effect31.succeed(ProxmoxNetworkApply.Provider.of(handlers12)));
 // src/proxmox/node-network.ts
 import { Resource as Resource16 } from "alchemy";
 import * as Provider16 from "alchemy/Provider";
-import * as Effect26 from "effect/Effect";
+import * as Effect32 from "effect/Effect";
 
 // src/proxmox/node-network-form.ts
 var UNSET3 = -1;
@@ -1366,11 +2149,11 @@ var handlers13 = pveHandlers({
   path: (props) => `nodes/${props.node}/network/${props.iface}`,
   updateForm: updateBody2
 });
-var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Effect26.succeed(ProxmoxNodeNetwork.Provider.of(handlers13)));
+var ProxmoxNodeNetworkProvider = () => Provider16.effect(ProxmoxNodeNetwork, Effect32.succeed(ProxmoxNodeNetwork.Provider.of(handlers13)));
 // src/proxmox/notification-target.ts
 import { Resource as Resource17 } from "alchemy";
 import * as Provider17 from "alchemy/Provider";
-import * as Effect27 from "effect/Effect";
+import * as Effect33 from "effect/Effect";
 
 // src/proxmox/notification-target-form.ts
 var REPEATED_KEY = "\x00";
@@ -1426,15 +2209,15 @@ var handlers14 = pveHandlers({
   path: (props) => `cluster/notifications/endpoints/${props.type}/${props.name}`,
   updateForm: shape4
 });
-var ProxmoxNotificationTargetProvider = () => Provider17.effect(ProxmoxNotificationTarget, Effect27.succeed(ProxmoxNotificationTarget.Provider.of(handlers14)));
+var ProxmoxNotificationTargetProvider = () => Provider17.effect(ProxmoxNotificationTarget, Effect33.succeed(ProxmoxNotificationTarget.Provider.of(handlers14)));
 // src/proxmox/pbs-datastore.ts
 import { Resource as Resource18 } from "alchemy";
-import { isResolved as isResolved7 } from "alchemy/Diff";
+import { isResolved as isResolved8 } from "alchemy/Diff";
 import * as Provider18 from "alchemy/Provider";
-import * as Effect30 from "effect/Effect";
+import * as Effect36 from "effect/Effect";
 
 // src/proxmox/pbs-datastore-form.ts
-import * as Effect28 from "effect/Effect";
+import * as Effect34 from "effect/Effect";
 var attributes = (live, props) => ({
   backend: propertyString(live["backend"]),
   comment: text(live["comment"]),
@@ -1478,7 +2261,7 @@ var mutable = (props) => ({
   ...set2("tuning", props.tuning),
   ...set2("verify-new", flag(props["verify-new"]))
 });
-var createForm3 = (props) => ({
+var createForm4 = (props) => ({
   ...mutable(props),
   name: props.name,
   path: props.path,
@@ -1486,37 +2269,37 @@ var createForm3 = (props) => ({
 });
 var updateForm = (props) => mutable(props);
 var object2 = (props) => `config/datastore/${props.name}`;
-var readOne = (props) => pve(props.target, "read", "GET", object2(props)).pipe(Effect28.map((live) => live === undefined || typeof live["name"] !== "string" ? undefined : attributes(live, props)), Effect28.orElseSucceed(() => {
+var readOne = (props) => pve(props.target, "read", "GET", object2(props)).pipe(Effect34.map((live) => live === undefined || typeof live["name"] !== "string" ? undefined : attributes(live, props)), Effect34.orElseSucceed(() => {
   return;
 }));
 
 // src/proxmox/pbs-datastore-guard.ts
-import * as Effect29 from "effect/Effect";
+import * as Effect35 from "effect/Effect";
 var samePath = (left, right) => {
   const trim = (value) => value.length > 1 ? value.replace(/\/+$/, "") : value;
   return trim(left) === trim(right);
 };
-var guardPath = (live, props) => live.path === "" || samePath(live.path, props.path) ? Effect29.void : Effect29.die(new Error(`${object2(props)}: declared path ${props.path} but PBS holds ${live.path}. \`path\` ` + "is create-only, so this cannot be reconciled and will NOT be planned as a silent " + "noop: backups would keep landing in the old directory behind a green plan. Correct " + "the declaration, or remove the datastore and declare a new one -- the contents live, " + "because `destroy-data` is never sent."));
-var guardBackend = (live, props) => props.backend === undefined || propertyString(props.backend) === live.backend ? Effect29.void : Effect29.die(new Error(`${object2(props)}: declared backend ${props.backend} but PBS holds ` + `${live.backend === "" ? "(none — a local datastore)" : live.backend}. \`backend\` ` + "is create-only: PBS has no update for it, so this cannot be reconciled and will NOT " + "be planned as a silent noop. Correct the declaration to match what is really there, " + "or remove the datastore and declare a new one -- the contents live, because " + "`destroy-data` is never sent."));
-var settle3 = (read2, done) => Effect29.gen(function* () {
+var guardPath = (live, props) => live.path === "" || samePath(live.path, props.path) ? Effect35.void : Effect35.die(new Error(`${object2(props)}: declared path ${props.path} but PBS holds ${live.path}. \`path\` ` + "is create-only, so this cannot be reconciled and will NOT be planned as a silent " + "noop: backups would keep landing in the old directory behind a green plan. Correct " + "the declaration, or remove the datastore and declare a new one -- the contents live, " + "because `destroy-data` is never sent."));
+var guardBackend = (live, props) => props.backend === undefined || propertyString(props.backend) === live.backend ? Effect35.void : Effect35.die(new Error(`${object2(props)}: declared backend ${props.backend} but PBS holds ` + `${live.backend === "" ? "(none — a local datastore)" : live.backend}. \`backend\` ` + "is create-only: PBS has no update for it, so this cannot be reconciled and will NOT " + "be planned as a silent noop. Correct the declaration to match what is really there, " + "or remove the datastore and declare a new one -- the contents live, because " + "`destroy-data` is never sent."));
+var settle3 = (read3, done) => Effect35.gen(function* () {
   for (let attempt = 0;attempt < 60; attempt += 1) {
-    const live = yield* read2;
+    const live = yield* read3;
     if (done(live))
       return live;
-    yield* Effect29.sleep("2 seconds");
+    yield* Effect35.sleep("2 seconds");
   }
-  return yield* read2;
+  return yield* read3;
 });
 
 // src/proxmox/pbs-datastore.ts
 var PbsDatastore = Resource18("Pbs.Datastore", {
   defaultRemovalPolicy: "retain"
 });
-var PbsDatastoreProvider = () => Provider18.effect(PbsDatastore, Effect30.succeed(PbsDatastore.Provider.of({
-  list: () => Effect30.succeed([]),
+var PbsDatastoreProvider = () => Provider18.effect(PbsDatastore, Effect36.succeed(PbsDatastore.Provider.of({
+  list: () => Effect36.succeed([]),
   read: ({ olds }) => readOne(olds),
-  diff: ({ news, output }) => Effect30.gen(function* () {
-    if (output === undefined || !isResolved7(news))
+  diff: ({ news, output }) => Effect36.gen(function* () {
+    if (output === undefined || !isResolved8(news))
       return;
     const live = yield* readOne(news);
     if (live === undefined)
@@ -1525,37 +2308,37 @@ var PbsDatastoreProvider = () => Provider18.effect(PbsDatastore, Effect30.succee
     yield* guardBackend(live, news);
     return matches(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect30.fn(function* ({ news }) {
+  reconcile: Effect36.fn(function* ({ news }) {
     const live = yield* readOne(news);
     let upid;
     if (live === undefined) {
-      upid = yield* pve(news.target, "provision", "POST", "config/datastore", createForm3(news));
+      upid = yield* pve(news.target, "provision", "POST", "config/datastore", createForm4(news));
     } else {
       yield* guardPath(live, news);
       yield* guardBackend(live, news);
-      const form = updateForm(news);
-      if (!matches(live, news) && Object.keys(form).length > 0) {
+      const form = formToSend(matches, live, news, updateForm(news));
+      if (form !== undefined) {
         yield* pve(news.target, "provision", "PUT", object2(news), form);
       }
     }
     const after = yield* settle3(readOne(news), (row) => row !== undefined && matches(row, news));
     if (after === undefined || !matches(after, news)) {
-      return yield* Effect30.die(new Error(`${object2(news)}: the write returned no error but the datastore still does not ` + `match the declaration after 120s. PBS answered with task ${upid ?? "(none)"} ` + "-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a " + "plausible cause (see `settle`); a create over an existing chunk store is not, " + "because PBS refuses that outright rather than timing out."));
+      return yield* Effect36.die(new Error(`${object2(news)}: the write returned no error but the datastore still does not ` + `match the declaration after 120s. PBS answered with task ${upid ?? "(none)"} ` + "-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a " + "plausible cause (see `settle`); a create over an existing chunk store is not, " + "because PBS refuses that outright rather than timing out."));
     }
     return after;
   }),
-  delete: Effect30.fn(function* ({ olds }) {
+  delete: Effect36.fn(function* ({ olds }) {
     yield* pve(olds.target, "provision", "DELETE", object2(olds));
     const left = yield* settle3(readOne(olds), (row) => row === undefined);
     if (left !== undefined) {
-      return yield* Effect30.die(new Error(`${object2(olds)}: the DELETE returned no error but the datastore is still in ` + "datastore.cfg after 120s. Either a backup, verify or GC task still holds it, " + "or the provision role lacks Datastore.Allocate on /datastore/" + `${olds.name}. Read the task log with \`proxmox-backup-manager task log <upid>\`.`));
+      return yield* Effect36.die(new Error(`${object2(olds)}: the DELETE returned no error but the datastore is still in ` + "datastore.cfg after 120s. Either a backup, verify or GC task still holds it, " + "or the provision role lacks Datastore.Allocate on /datastore/" + `${olds.name}. Read the task log with \`proxmox-backup-manager task log <upid>\`.`));
     }
   })
 })));
 // src/proxmox/pbs-prune-job.ts
 import { Resource as Resource19 } from "alchemy";
 import * as Provider19 from "alchemy/Provider";
-import * as Effect31 from "effect/Effect";
+import * as Effect37 from "effect/Effect";
 
 // src/proxmox/pbs-prune-job-form.ts
 var KEEP_KEYS = [
@@ -1630,15 +2413,15 @@ var handlers15 = pveHandlers({
   path: (props) => `config/prune/${props.id}`,
   updateForm: updateBody3
 });
-var PbsPruneJobProvider = () => Provider19.effect(PbsPruneJob, Effect31.succeed(PbsPruneJob.Provider.of(handlers15)));
+var PbsPruneJobProvider = () => Provider19.effect(PbsPruneJob, Effect37.succeed(PbsPruneJob.Provider.of(handlers15)));
 // src/proxmox/pbs-sync-job.ts
 import { Resource as Resource20 } from "alchemy";
 import * as Provider20 from "alchemy/Provider";
-import * as Effect32 from "effect/Effect";
+import * as Effect38 from "effect/Effect";
 
 // src/proxmox/pbs-sync-job-form.ts
 var UNSET4 = -1;
-var UNITS = {
+var UNITS2 = {
   "": 1,
   B: 1,
   GB: 1e9,
@@ -1657,7 +2440,7 @@ var bytes = (value) => {
   const match = /^([0-9]+(?:\.[0-9]+)?)\s*([A-Za-z]*)$/.exec(raw);
   if (match === null)
     return UNSET4;
-  const unit = UNITS[match[2] ?? ""];
+  const unit = UNITS2[match[2] ?? ""];
   return unit === undefined ? UNSET4 : Math.round(Number(match[1] ?? "0") * unit);
 };
 var filters = (value) => Array.isArray(value) ? value.map((entry) => String(entry)).join(" | ") : text(value);
@@ -1710,11 +2493,11 @@ var handlers16 = pveHandlers({
 
 // src/proxmox/pbs-sync-job.ts
 var PbsSyncJob = Resource20("Pbs.SyncJob");
-var PbsSyncJobProvider = () => Provider20.effect(PbsSyncJob, Effect32.succeed(PbsSyncJob.Provider.of(handlers16)));
+var PbsSyncJobProvider = () => Provider20.effect(PbsSyncJob, Effect38.succeed(PbsSyncJob.Provider.of(handlers16)));
 // src/proxmox/pbs-verify-job.ts
 import { Resource as Resource21 } from "alchemy";
 import * as Provider21 from "alchemy/Provider";
-import * as Effect33 from "effect/Effect";
+import * as Effect39 from "effect/Effect";
 
 // src/proxmox/pbs-verify-job-form.ts
 var rechecks = (ignoreVerified, outdatedAfter) => {
@@ -1758,11 +2541,11 @@ var handlers17 = pveHandlers({
   path: (props) => `config/verify/${props.id}`,
   updateForm: shape7
 });
-var PbsVerifyJobProvider = () => Provider21.effect(PbsVerifyJob, Effect33.succeed(PbsVerifyJob.Provider.of(handlers17)));
+var PbsVerifyJobProvider = () => Provider21.effect(PbsVerifyJob, Effect39.succeed(PbsVerifyJob.Provider.of(handlers17)));
 // src/proxmox/pool.ts
 import { Resource as Resource22 } from "alchemy";
 import * as Provider22 from "alchemy/Provider";
-import * as Effect34 from "effect/Effect";
+import * as Effect40 from "effect/Effect";
 var ProxmoxPool = Resource22("Proxmox.Pool");
 var poolCreateForm = (props) => ({
   comment: props.comment ?? "",
@@ -1786,11 +2569,11 @@ var handlers18 = pveHandlers({
   path: (props) => `pools/${props.poolid}`,
   updateForm: poolUpdateForm
 });
-var ProxmoxPoolProvider = () => Provider22.effect(ProxmoxPool, Effect34.succeed(ProxmoxPool.Provider.of(handlers18)));
+var ProxmoxPoolProvider = () => Provider22.effect(ProxmoxPool, Effect40.succeed(ProxmoxPool.Provider.of(handlers18)));
 // src/proxmox/qemu.ts
 import { Resource as Resource23 } from "alchemy";
 import * as Provider23 from "alchemy/Provider";
-import * as Effect35 from "effect/Effect";
+import * as Effect41 from "effect/Effect";
 var ProxmoxVm = Resource23("Proxmox.Vm");
 var shape8 = (props) => ({
   cores: String(props.cores ?? 1),
@@ -1816,11 +2599,11 @@ var handlers19 = pveHandlers({
   path: (props) => `nodes/${props.node}/qemu/${String(props.vmid)}/config`,
   updateForm: shape8
 });
-var ProxmoxVmProvider = () => Provider23.effect(ProxmoxVm, Effect35.succeed(ProxmoxVm.Provider.of(handlers19)));
+var ProxmoxVmProvider = () => Provider23.effect(ProxmoxVm, Effect41.succeed(ProxmoxVm.Provider.of(handlers19)));
 // src/proxmox/replication-job.ts
 import { Resource as Resource24 } from "alchemy";
 import * as Provider24 from "alchemy/Provider";
-import * as Effect36 from "effect/Effect";
+import * as Effect42 from "effect/Effect";
 
 // src/proxmox/replication-job-form.ts
 var DEFAULT_SCHEDULE = "*/15";
@@ -1870,11 +2653,11 @@ var handlers20 = pveHandlers({
   path: (props) => `cluster/replication/${jobId(props)}`,
   updateForm: updateBody5
 });
-var ProxmoxReplicationJobProvider = () => Provider24.effect(ProxmoxReplicationJob, Effect36.succeed(ProxmoxReplicationJob.Provider.of(handlers20)));
+var ProxmoxReplicationJobProvider = () => Provider24.effect(ProxmoxReplicationJob, Effect42.succeed(ProxmoxReplicationJob.Provider.of(handlers20)));
 // src/proxmox/role.ts
 import { Resource as Resource25 } from "alchemy";
 import * as Provider25 from "alchemy/Provider";
-import * as Effect37 from "effect/Effect";
+import * as Effect43 from "effect/Effect";
 var ProxmoxRole = Resource25("Proxmox.Role");
 var canonical = (privs) => [...new Set(privs.map((priv) => priv.trim()).filter((priv) => priv.length > 0))].sort();
 var livePrivs = (live) => {
@@ -1891,15 +2674,15 @@ var handlers21 = pveHandlers({
   path: (props) => `access/roles/${props.roleid}`,
   updateForm: (props) => ({ privs: canonical(props.privs).join(",") })
 });
-var ProxmoxRoleProvider = () => Provider25.effect(ProxmoxRole, Effect37.succeed(ProxmoxRole.Provider.of(handlers21)));
+var ProxmoxRoleProvider = () => Provider25.effect(ProxmoxRole, Effect43.succeed(ProxmoxRole.Provider.of(handlers21)));
 // src/proxmox/sdn-apply.ts
 import { Resource as Resource26 } from "alchemy";
-import { isResolved as isResolved8 } from "alchemy/Diff";
+import { isResolved as isResolved9 } from "alchemy/Diff";
 import * as Provider26 from "alchemy/Provider";
-import * as Effect39 from "effect/Effect";
+import * as Effect45 from "effect/Effect";
 
 // src/proxmox/sdn-apply-read.ts
-import * as Effect38 from "effect/Effect";
+import * as Effect44 from "effect/Effect";
 var MARKED = [
   "cluster/sdn/zones",
   "cluster/sdn/vnets",
@@ -1908,7 +2691,7 @@ var MARKED = [
   "cluster/sdn/route-maps"
 ];
 var subsystemAbsent = (error) => error instanceof PveError && error.status === 501;
-var markedPending = (target) => Effect38.all(MARKED.map((collection2) => pve(target, "read", "GET", `${collection2}?pending=1`).pipe(Effect38.map((rows) => (rows ?? []).filter((row) => row.state !== undefined).length), Effect38.catchIf(subsystemAbsent, () => Effect38.succeed(0)))), { concurrency: "unbounded" }).pipe(Effect38.map((counts) => counts.reduce((total, count2) => total + count2, 0)));
+var markedPending = (target) => Effect44.all(MARKED.map((collection2) => pve(target, "read", "GET", `${collection2}?pending=1`).pipe(Effect44.map((rows) => (rows ?? []).filter((row) => row.state !== undefined).length), Effect44.catchIf(subsystemAbsent, () => Effect44.succeed(0)))), { concurrency: "unbounded" }).pipe(Effect44.map((counts) => counts.reduce((total, count2) => total + count2, 0)));
 var fabricStaged = (staged, running) => {
   if (staged === undefined && running === undefined)
     return 0;
@@ -1916,9 +2699,9 @@ var fabricStaged = (staged, running) => {
     return "inconsistent";
   return staged === running ? 0 : 1;
 };
-var fabricPending = (target) => Effect38.all(["pending", "running"].map((view) => pve(target, "read", "GET", `cluster/sdn/fabrics/all?${view}=1`).pipe(Effect38.map(canonical2), Effect38.catchIf(subsystemAbsent, () => Effect38.succeed(undefined)))), { concurrency: "unbounded" }).pipe(Effect38.flatMap(([staged, running]) => {
+var fabricPending = (target) => Effect44.all(["pending", "running"].map((view) => pve(target, "read", "GET", `cluster/sdn/fabrics/all?${view}=1`).pipe(Effect44.map(canonical2), Effect44.catchIf(subsystemAbsent, () => Effect44.succeed(undefined)))), { concurrency: "unbounded" }).pipe(Effect44.flatMap(([staged, running]) => {
   const verdict = fabricStaged(staged, running);
-  return verdict === "inconsistent" ? Effect38.die(new Error("cluster/sdn/fabrics/all answered 501 for one of ?pending=1 and ?running=1 and not " + "the other. Refusing to read that as a staged fabric change.")) : Effect38.succeed(verdict);
+  return verdict === "inconsistent" ? Effect44.die(new Error("cluster/sdn/fabrics/all answered 501 for one of ?pending=1 and ?running=1 and not " + "the other. Refusing to read that as a staged fabric change.")) : Effect44.succeed(verdict);
 }));
 var canonical2 = (value) => JSON.stringify(sortDeep(value));
 var sortDeep = (value) => {
@@ -1931,39 +2714,39 @@ var sortDeep = (value) => {
   }
   return value;
 };
-var sdnPendingCount = (target) => Effect38.all([markedPending(target), fabricPending(target)], { concurrency: "unbounded" }).pipe(Effect38.map(([marked, fabric]) => marked + fabric));
+var sdnPendingCount = (target) => Effect44.all([markedPending(target), fabricPending(target)], { concurrency: "unbounded" }).pipe(Effect44.map(([marked, fabric]) => marked + fabric));
 
 // src/proxmox/sdn-apply.ts
 var ProxmoxSdnApply = Resource26("Proxmox.SdnApply");
-var read2 = (props) => sdnPendingCount(props.target).pipe(Effect39.map((pending) => ({ pending })));
-var ProxmoxSdnApplyProvider = () => Provider26.effect(ProxmoxSdnApply, Effect39.succeed(ProxmoxSdnApply.Provider.of({
-  list: () => Effect39.succeed([]),
-  read: Effect39.fn(function* ({ olds }) {
-    return yield* read2(olds);
+var read3 = (props) => sdnPendingCount(props.target).pipe(Effect45.map((pending) => ({ pending })));
+var ProxmoxSdnApplyProvider = () => Provider26.effect(ProxmoxSdnApply, Effect45.succeed(ProxmoxSdnApply.Provider.of({
+  list: () => Effect45.succeed([]),
+  read: Effect45.fn(function* ({ olds }) {
+    return yield* read3(olds);
   }),
-  diff: Effect39.fn(function* ({ news }) {
-    if (!isResolved8(news))
+  diff: Effect45.fn(function* ({ news }) {
+    if (!isResolved9(news))
       return;
-    const { pending } = yield* read2(news);
+    const { pending } = yield* read3(news);
     return pending === 0 ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect39.fn(function* ({ news }) {
-    const staged = yield* read2(news);
+  reconcile: Effect45.fn(function* ({ news }) {
+    const staged = yield* read3(news);
     if (staged.pending === 0)
       return staged;
     yield* pve(news.target, "provision", "PUT", "cluster/sdn");
-    const after = yield* read2(news);
+    const after = yield* read3(news);
     if (after.pending !== 0) {
-      return yield* Effect39.die(new Error(`PUT /cluster/sdn returned no error but ${String(after.pending)} SDN object(s) ` + "are still staged. The running config does not match the declared one -- check " + "`pvesh get /cluster/sdn/zones --pending 1` for the objects PVE refused."));
+      return yield* Effect45.die(new Error(`PUT /cluster/sdn returned no error but ${String(after.pending)} SDN object(s) ` + "are still staged. The running config does not match the declared one -- check " + "`pvesh get /cluster/sdn/zones --pending 1` for the objects PVE refused."));
     }
     return after;
   }),
-  delete: () => Effect39.void
+  delete: () => Effect45.void
 })));
 // src/proxmox/sdn-subnet.ts
 import { Resource as Resource27 } from "alchemy";
 import * as Provider27 from "alchemy/Provider";
-import * as Effect40 from "effect/Effect";
+import * as Effect46 from "effect/Effect";
 
 // src/proxmox/sdn-subnet-form.ts
 var subnetId = (props) => `${props.zone}-${props.cidr.replace("/", "-")}`;
@@ -1982,7 +2765,7 @@ var body5 = (props) => ({
   vnet: props.vnet,
   ...Object.fromEntries(Object.entries(optional3(props)).filter((entry) => entry[1] !== undefined))
 });
-var createForm4 = (props) => ({
+var createForm5 = (props) => ({
   ...body5(props),
   subnet: props.cidr,
   type: "subnet"
@@ -2014,16 +2797,16 @@ var handlers22 = pveHandlers({
     };
   },
   collection: (props) => `cluster/sdn/vnets/${props.vnet}/subnets`,
-  createForm: createForm4,
+  createForm: createForm5,
   matches: (attributes2, props) => attributes2.gateway === (props.gateway ?? "") && attributes2.snat === (props.snat === true) && attributes2.dnszoneprefix === (props.dnszoneprefix ?? "") && attributes2.dhcpDnsServer === (props.dhcpDnsServer ?? "") && attributes2.dhcpRange === declaredRanges(props.dhcpRange),
   path: (props) => `cluster/sdn/vnets/${props.vnet}/subnets/${subnetId(props)}`,
   updateForm: updateForm2
 });
-var ProxmoxSdnSubnetProvider = () => Provider27.effect(ProxmoxSdnSubnet, Effect40.succeed(ProxmoxSdnSubnet.Provider.of(handlers22)));
+var ProxmoxSdnSubnetProvider = () => Provider27.effect(ProxmoxSdnSubnet, Effect46.succeed(ProxmoxSdnSubnet.Provider.of(handlers22)));
 // src/proxmox/sdn-vnet.ts
 import { Resource as Resource28 } from "alchemy";
 import * as Provider28 from "alchemy/Provider";
-import * as Effect41 from "effect/Effect";
+import * as Effect47 from "effect/Effect";
 var ProxmoxSdnVnet = Resource28("Proxmox.SdnVnet");
 var tagOf = (value) => typeof value === "number" ? value : undefined;
 var shape10 = (props) => {
@@ -2060,11 +2843,11 @@ var handlers23 = pveHandlers({
   path: (props) => `cluster/sdn/vnets/${props.vnet}`,
   updateForm: updateForm3
 });
-var ProxmoxSdnVnetProvider = () => Provider28.effect(ProxmoxSdnVnet, Effect41.succeed(ProxmoxSdnVnet.Provider.of(handlers23)));
+var ProxmoxSdnVnetProvider = () => Provider28.effect(ProxmoxSdnVnet, Effect47.succeed(ProxmoxSdnVnet.Provider.of(handlers23)));
 // src/proxmox/sdn-zone.ts
 import { Resource as Resource29 } from "alchemy";
 import * as Provider29 from "alchemy/Provider";
-import * as Effect42 from "effect/Effect";
+import * as Effect48 from "effect/Effect";
 var ProxmoxSdnZone = Resource29("Proxmox.SdnZone");
 var sameIpam = (live, declared) => (live === "" ? "pve" : live) === (declared === undefined || declared === "" ? "pve" : declared);
 var body6 = (props) => ({
@@ -2116,11 +2899,11 @@ var handlers24 = pveHandlers({
     return withClears(fields, clear);
   }
 });
-var ProxmoxSdnZoneProvider = () => Provider29.effect(ProxmoxSdnZone, Effect42.succeed(ProxmoxSdnZone.Provider.of(handlers24)));
+var ProxmoxSdnZoneProvider = () => Provider29.effect(ProxmoxSdnZone, Effect48.succeed(ProxmoxSdnZone.Provider.of(handlers24)));
 // src/proxmox/storage.ts
 import { Resource as Resource30 } from "alchemy";
 import * as Provider30 from "alchemy/Provider";
-import * as Effect43 from "effect/Effect";
+import * as Effect49 from "effect/Effect";
 var ProxmoxStorage = Resource30("Proxmox.Storage", {
   defaultRemovalPolicy: "retain"
 });
@@ -2165,11 +2948,11 @@ var handlers25 = pveHandlers({
   path: (props) => `storage/${props.storage}`,
   updateForm: mutable2
 });
-var ProxmoxStorageProvider = () => Provider30.effect(ProxmoxStorage, Effect43.succeed(ProxmoxStorage.Provider.of(handlers25)));
+var ProxmoxStorageProvider = () => Provider30.effect(ProxmoxStorage, Effect49.succeed(ProxmoxStorage.Provider.of(handlers25)));
 // src/proxmox/user.ts
 import { Resource as Resource31 } from "alchemy";
 import * as Provider31 from "alchemy/Provider";
-import * as Effect44 from "effect/Effect";
+import * as Effect50 from "effect/Effect";
 var ProxmoxUser = Resource31("Proxmox.User");
 var str3 = (value) => typeof value === "string" ? value : "";
 var int2 = (value) => {
@@ -2209,15 +2992,15 @@ var handlers26 = pveHandlers({
   path: (props) => `access/users/${props.userid}`,
   updateForm: shape11
 });
-var ProxmoxUserProvider = () => Provider31.effect(ProxmoxUser, Effect44.succeed(ProxmoxUser.Provider.of(handlers26)));
+var ProxmoxUserProvider = () => Provider31.effect(ProxmoxUser, Effect50.succeed(ProxmoxUser.Provider.of(handlers26)));
 // src/proxmox/zfs-pool.ts
 import { Resource as Resource32 } from "alchemy";
 import * as Provider32 from "alchemy/Provider";
-import * as Effect46 from "effect/Effect";
+import * as Effect52 from "effect/Effect";
 
 // src/proxmox/zfs-pool-write.ts
-import * as Effect45 from "effect/Effect";
-var createForm5 = (props) => ({
+import * as Effect51 from "effect/Effect";
+var createForm6 = (props) => ({
   devices: props.devices.join(","),
   name: props.name,
   raidlevel: props.raidlevel,
@@ -2226,21 +3009,21 @@ var createForm5 = (props) => ({
   ...props["draid-config"] === undefined ? {} : { "draid-config": props["draid-config"] }
 });
 var SETTLE_ATTEMPTS = 30;
-var createPool = (props, collection2, path, read3) => Effect45.gen(function* () {
-  const existing = yield* read3(props);
+var createPool = (props, collection2, path, read4) => Effect51.gen(function* () {
+  const existing = yield* read4(props);
   if (existing !== undefined)
     return existing;
-  const upid = yield* pve(props.target, "provision", "POST", collection2, createForm5(props));
-  const settle4 = (attempts) => Effect45.gen(function* () {
-    const live = yield* read3(props);
+  const upid = yield* pve(props.target, "provision", "POST", collection2, createForm6(props));
+  const settle4 = (attempts) => Effect51.gen(function* () {
+    const live = yield* read4(props);
     if (live !== undefined || attempts <= 0)
       return live;
-    yield* Effect45.sleep("2 seconds");
+    yield* Effect51.sleep("2 seconds");
     return yield* settle4(attempts - 1);
   });
   const after = yield* settle4(SETTLE_ATTEMPTS);
   if (after === undefined) {
-    return yield* Effect45.die(new Error(`${path}: POST returned ${text(upid, "(no UPID)")} but the pool has not appeared. That ` + "POST only forks a `zfscreate` worker, so the task holds the real error -- read it " + `with \`pvesh get /nodes/${props.node}/tasks/<upid>/log\`. NOTHING WAS RETRIED AND ` + "NOTHING WAS CLEANED UP: if the worker reached `zpool create`, the declared devices " + "have already been written to."));
+    return yield* Effect51.die(new Error(`${path}: POST returned ${text(upid, "(no UPID)")} but the pool has not appeared. That ` + "POST only forks a `zfscreate` worker, so the task holds the real error -- read it " + `with \`pvesh get /nodes/${props.node}/tasks/<upid>/log\`. NOTHING WAS RETRIED AND ` + "NOTHING WAS CLEANED UP: if the worker reached `zpool create`, the declared devices " + "have already been written to."));
   }
   return after;
 });
@@ -2268,19 +3051,19 @@ var spec2 = {
     };
   },
   collection: (props) => `nodes/${props.node}/disks/zfs`,
-  createForm: createForm5,
+  createForm: createForm6,
   matches: () => true,
   path: (props) => `nodes/${props.node}/disks/zfs/${props.name}`
 };
 var ops5 = pveOperations(spec2);
 var handlers27 = {
   ...pveHandlers(spec2),
-  delete: Effect46.fn(function* ({ olds }) {
+  delete: Effect52.fn(function* ({ olds }) {
     yield* destroyPool(olds, spec2.path(olds));
   }),
   reconcile: ({ news }) => createPool(news, spec2.collection(news), spec2.path(news), ops5.read)
 };
-var ProxmoxZfsPoolProvider = () => Provider32.effect(ProxmoxZfsPool, Effect46.succeed(ProxmoxZfsPool.Provider.of(handlers27)));
+var ProxmoxZfsPoolProvider = () => Provider32.effect(ProxmoxZfsPool, Effect52.succeed(ProxmoxZfsPool.Provider.of(handlers27)));
 export {
   PbsDatastore,
   PbsDatastoreProvider,
@@ -2308,6 +3091,7 @@ export {
   ProxmoxHaResourceProvider,
   ProxmoxHaRule,
   ProxmoxHaRuleProvider,
+  ProxmoxLxc,
   ProxmoxLxcProvider,
   ProxmoxMetricServer,
   ProxmoxMetricServerProvider,
@@ -2336,5 +3120,5 @@ export {
   ProxmoxZfsPoolProvider
 };
 
-//# debugId=9783560E271AFF9D64756E2164756E21
+//# debugId=2E96DC8F7406C81F64756E2164756E21
 //# sourceMappingURL=index.js.map