@homeflare/alchemy 0.1.0

package/dist/proxmox/zfs-pool.d.ts

@@ -0,0 +1,146 @@
+/**
+ * `Proxmox.ZfsPool` — a zpool built on one node's physical disks, declared.
+ *
+ * ⛔ A CREATE HERE WIPES THE DISKS IT IS GIVEN AND THERE IS NO UNDO. `POST /nodes/{node}/disks/zfs`
+ *   runs `zpool create` on the block devices named in `devices`; whatever was on them is gone the
+ *   moment the worker runs. Every other decision in this file follows from that one sentence, and
+ *   each of them is written out below rather than left to be inferred.
+ *
+ * ⛔ DESTROY IS REFUSED. `delete` MAKES NO API CALL — removing this resource from a stack leaves
+ *   the zpool and its data exactly where they are, and Alchemy simply forgets about them. The
+ *   asymmetry is the whole argument: an ORPHANED pool is recoverable (declare it again, or destroy
+ *   it by hand once a human has looked at which disks are in it), a DESTROYED pool is not. Alchemy
+ *   deletes for reasons that have nothing to do with anybody intending it — a line removed from a
+ *   stack file, a resource renamed so the old id is dropped, a whole stack torn down by the wrong
+ *   command, a replace triggered by a prop nobody meant to touch. Handing `zpool destroy` to any
+ *   of those is not a feature. MEASURED in the node's own source: the DELETE handler forks
+ *   `zfsremove`, which runs `zpool destroy <name>` unconditionally, and with `cleanup-disks` then
+ *   calls `wipe_blockdev` on every member. Neither flag is offered as a prop, because there is no
+ *   call here for them to reach.
+ *   ★ THE OPERATOR'S PATH IS `pvesh delete /nodes/<node>/disks/zfs/<name>`, typed by a person who
+ *     has just looked at the pool. Do not "complete the CRUD" by wiring `delete` to `ops.destroy`:
+ *     that one line turns a text edit into an unrecoverable one.
+ *
+ * ⛔ THERE IS NO PUT ON THIS FAMILY AT ALL. MEASURED from the cluster's own published schema
+ *   (`/usr/share/pve-docs/api-viewer/apidoc.js`, read on n2 2026-09-13): `/nodes/{node}/disks/zfs`
+ *   has GET and POST, `/nodes/{node}/disks/zfs/{name}` has GET and DELETE, and that is the whole
+ *   surface. So `updateForm` is omitted — which, per `resource.ts`, makes any `matches` = false a
+ *   REPLACE. A replace is a delete followed by a create, and on this family the delete is the
+ *   thing above. Read the ⛔ on `matches` before adding anything to it.
+ *
+ * ⛔ NOT ONE CREATE PARAMETER COMES BACK ON READ, SO `matches` COMPARES NOTHING. MEASURED against
+ *   the live cluster: `GET /nodes/n2/disks/zfs/rpool` answers exactly
+ *   `{action, children, errors, leaf, name, scan, state, status}` — no `ashift`, no `compression`,
+ *   no `raidlevel`, no `devices`, no `add_storage`. Every create parameter is write-only. There is
+ *   therefore no field a declaration and a live pool can both be asked about, and a `matches` that
+ *   invented one would plan a replace — i.e. a `zpool destroy` — over a difference it could never
+ *   verify in the first place.
+ *
+ * ⚠️ AND WHAT THE INDEX RETURNS IS LIVE TELEMETRY, NOT CONFIGURATION. `GET /nodes/n2/disks/zfs`
+ *   gives `alloc`, `free`, `frag`, `dedup`, `size`, `health`. MEASURED: two reads of n2 seconds
+ *   apart returned `alloc` 14474944512 then 14472740864 — it moves on its own, with no declaration
+ *   anywhere near it. `scan` in the detail read moves the same way (it carries the last scrub), and
+ *   `status`/`action` appear and vanish as ZFS feature flags and faults come and go. None of them
+ *   is compared, and the three churning strings are kept out of the state store entirely rather
+ *   than rewriting this resource's row every time somebody writes a file.
+ *
+ * ⚠️ TWO HANDLERS ARE OVERRIDDEN AND THE OTHER THREE COME FROM THE FACTORY — see the ★ above
+ *   `handlers`. `delete` is the ⛔ above. `reconcile` is because the create is a FORKED WORKER, so
+ *   the factory's immediate read-back would report a successful create as a failure; the measured
+ *   detail is in the ⛔ on `createPool` in zfs-pool-create.ts.
+ *
+ * ⚠️ PRIVILEGES, FROM THE SCHEMA. Read and diff need `Sys.Audit` on `/` — both GETs check it.
+ *   Reconcile needs `Sys.Modify` on `/` for the POST. `Datastore.Allocate` on `/storage` is NOT
+ *   needed, because `add_storage` is not offered — see the ⛔ on `ZfsPoolProps`. `delete` needs
+ *   nothing at all, since it calls nothing.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import { type PveRequirements, type WithTarget } from './resource.ts';
+/** PVE's layouts. ⚠️ Each has a minimum disk count PVE enforces, and `raid10` needs an even one. */
+export type ZfsRaidLevel = 'single' | 'mirror' | 'raid10' | 'raidz' | 'raidz2' | 'raidz3' | 'draid' | 'draid2' | 'draid3';
+export type ZfsCompression = 'on' | 'off' | 'gzip' | 'lz4' | 'lzjb' | 'zle' | 'zstd';
+/**
+ * ⛔ THERE IS NO `add_storage`, `cleanup-config` OR `cleanup-disks` PROP, AND THAT IS NOT AN
+ *   OVERSIGHT. The last two belong to the DELETE this resource refuses to make. `add_storage=1`
+ *   would have the POST build a `Proxmox.Storage`-shaped object this resource does not own, cannot
+ *   see on any later read, and cannot remove — invisible to every diff forever, and a collision
+ *   waiting for the day somebody also declares the storage properly. Declare a `Proxmox.Storage`
+ *   with `type: 'zfspool'` and `locator: { pool: <this pool's name> }` instead, reading the `name`
+ *   attribute below so Alchemy orders the storage after the pool.
+ */
+export interface ZfsPoolProps extends WithTarget {
+    /**
+     * ⛔ A ZPOOL IS NODE-LOCAL AND THIS IS HALF ITS IDENTITY. Changing it moves nothing: `path` then
+     *   points at a different node, the read answers absent, and reconcile tries to CREATE the pool
+     *   over there — on whatever `/dev/...` happens to answer to those names on that machine.
+     *   Declare a separate resource per node instead.
+     */
+    node: string;
+    /** The zpool name, and PVE's key for it on this node. ⚠️ Changing it creates a SECOND pool. */
+    name: string;
+    /**
+     * The block devices to build it on.
+     *
+     * ⛔ NAME THEM BY `/dev/disk/by-id/...`, NOT `/dev/sdb`. Kernel names are not stable across
+     *   reboots; a by-id link is. MEASURED in the node's source: PVE resolves what it is handed to a
+     *   by-id link only AFTER it has decided the device is free, so a stale `/dev/sdb` in a stack
+     *   file is checked against, and then wiped, whichever disk currently answers to that name.
+     * ⚠️ ORDER IS MEANING FOR `raid10` AND IS PRESERVED — PVE walks the list two at a time and makes
+     *   each pair a mirror. This is why the form uses a plain join and NOT `csv()` from values.ts:
+     *   `csv` sorts, and sorting this list silently re-pairs the mirrors into a different pool.
+     * ⚠️ PVE's only guard is `assert_disk_unused`, i.e. its own `disk_is_used` over the same `used`
+     *   column the Disks view shows. A blank disk it considers free is wiped with no confirmation.
+     */
+    devices: readonly string[];
+    raidlevel: ZfsRaidLevel;
+    /**
+     * Sector size exponent, 9–16, PVE default 12.
+     *
+     * ⛔ WRITE-ONLY AND IMMUTABLE FOR THE LIFE OF THE POOL. It is consumed by `zpool create -o
+     *   ashift=` and never returned by any read on this family, so changing it later plans as `noop`
+     *   and changes nothing. A different ashift means destroying and rebuilding the pool, by hand,
+     *   with the data moved off first.
+     */
+    ashift?: number;
+    /**
+     * ⚠️ Write-only in the same way as `ashift`: applied by `zfs set compression=` at create time and
+     *   never read back, so a later change plans `noop`. Change it with `zfs set` on the node.
+     */
+    compression?: ZfsCompression;
+    /**
+     * `data=<integer>,spares=<integer>`. ⚠️ THE WIRE NAME IS KEPT, HYPHEN AND ALL, for the reason
+     * `storage.ts` keeps `prune-backups`: a second spelling is a second name for one thing.
+     * ⚠️ PVE refuses it outright unless `raidlevel` is one of the `draid*` levels.
+     */
+    'draid-config'?: string;
+}
+/**
+ * ⚠️ EVERYTHING HERE IS REPORTED, NOTHING HERE IS COMPARED — see the ⛔ on `matches`. These exist
+ *   so a plan and the state store can say what the pool actually is, on a family where the
+ *   declaration and the live object share no comparable field at all.
+ */
+export interface ZfsPoolAttributes {
+    /** ★ The value a `Proxmox.Storage` should read to order itself after this pool. */
+    name: string;
+    node: string;
+    /** `ONLINE` | `DEGRADED` | `FAULTED` | … Health, not configuration. */
+    state: string;
+    /** ZFS's own error summary, e.g. `No known data errors`. */
+    errors: string;
+    /**
+     * The leaf devices ZFS reports, in vdev order, comma-joined.
+     *
+     * ⚠️ THIS IS WHAT ZFS RESOLVED, NOT WHAT WAS DECLARED, and the two normally differ: PVE rewrites
+     *   a `/dev/sdb` into a by-id link before creating, and ZFS reports partition paths (`…-part3`)
+     *   for a pool built on partitions — MEASURED, that is exactly what n2's `rpool` reports. Never
+     *   compare it with `props.devices`.
+     */
+    devices: string;
+}
+export interface ProxmoxZfsPool extends Resource<'Proxmox.ZfsPool', ZfsPoolProps, ZfsPoolAttributes, never, PveRequirements> {
+}
+/** ★ `retain` by default — a pool holding datasets cannot be rebuilt. See the ★ in resource.ts. */
+export declare const ProxmoxZfsPool: import("alchemy").ResourceClass<ProxmoxZfsPool>;
+export declare const ProxmoxZfsPoolProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxZfsPool>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=zfs-pool.d.ts.map

package/dist/proxmox/zfs-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zfs-pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,UAAU,EAGhB,MAAM,eAAe,CAAC;AAIvB,oGAAoG;AACpG,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,QAAQ,CAAC;AAEb,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;AAErF;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,YAAY,CAAC;IACxB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,mGAAmG;AACnG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AA6EH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}

package/dist/talos/credentials.d.ts

@@ -0,0 +1,30 @@
+import * as Effect from 'effect/Effect';
+import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
+/** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */
+export type TalosTarget = {
+    /** OpenBao KV mount holding Talos material, e.g. `talos-tb4`. */
+    readonly mount: string;
+    /** Logical cluster name — safe to persist and log. */
+    readonly cluster: string;
+    /**
+     * Path under the mount for the talosconfig YAML.
+     *
+     * ⚠️ DEFAULT IS REASONED. The first real deploy will confirm or correct the path; a wrong path
+     *   fails closed with a bao error rather than writing an empty talosconfig.
+     */
+    readonly talosconfigKey?: string;
+};
+export type TalosCredential = {
+    /** Absolute path to a temp talosconfig. ⛔ NEVER PERSIST, NEVER LOG CONTENTS. */
+    readonly talosconfigPath: string;
+};
+/**
+ * Mint one talosconfig file for `target`.
+ *
+ * ★ SHELLS OUT TO `bao` RATHER THAN SPEAKING THE HTTP API — same reasoning as proxmox credentials.
+ *   The estate's BAO_ADDR / BAO_NAMESPACE / approle contract already lives in that binary.
+ */
+export declare const mintTalosconfig: (target: TalosTarget) => Effect.Effect<{
+    talosconfigPath: string;
+}, Error | import("effect/PlatformError").PlatformError, ChildProcessSpawner.ChildProcessSpawner>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/talos/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/talos/credentials.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF,+FAA+F;AAC/F,MAAM,MAAM,WAAW,GAAG;IACxB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAIF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAAY,WAAW;;iGAsFhD,CAAC"}

package/dist/talos/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Talos providers for Alchemy.
+ *
+ * ⛔ THIS BARREL IS THE PUBLIC API, AND IT IS DELIBERATELY SMALLER THAN THE DIRECTORY.
+ *   These are the symbols a real stack consumes; the rest of the files are internals a
+ *   provider needs but a consumer should not depend on. An `export *` here would publish
+ *   every helper as API and make the next refactor a breaking change.
+ * ★ Anything unlisted is still reachable by path if you genuinely need it — that is a
+ *   deliberate, visible act rather than an accident of barrelling.
+ */
+export { TalosKubeconfigProvider } from './kubeconfig.ts';
+export { TalosBootstrapProvider } from './talos-bootstrap.ts';
+export { TalosClusterHealthProvider } from './talos-cluster-health.ts';
+export { TalosMachineConfigProvider } from './talos-machine-config.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/talos/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/talos/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/talos/index.js

@@ -0,0 +1,392 @@
+// src/talos/kubeconfig.ts
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect3 from "effect/Effect";
+
+// src/talos/credentials.ts
+import { closeSync, openSync, writeFileSync } from "node:fs";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+var defaultKey = (target) => target.talosconfigKey ?? "data/talosconfig";
+var mintTalosconfig = (target) => Effect.scoped(Effect.gen(function* () {
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const key = defaultKey(target);
+  const result = yield* ChildProcess.make("bao", ["kv", "get", "-format=json", `${target.mount}/${key}`], { detached: false, extendEnv: true, stderr: "pipe", stdin: "ignore", stdout: "pipe" }).pipe(spawner.spawn, Effect.flatMap((child) => Effect.all({
+    exitCode: child.exitCode,
+    stderr: child.stderr.pipe(Stream.decodeText, Stream.mkString, Effect.map((text) => text.trim())),
+    stdout: child.stdout.pipe(Stream.decodeText, Stream.mkString, Effect.map((text) => text.trim()))
+  }, { concurrency: "unbounded" })), Effect.scoped);
+  if (result.exitCode !== 0) {
+    return yield* Effect.fail(new Error(`bao kv get ${target.mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`));
+  }
+  const parsed = JSON.parse(result.stdout);
+  const data = parsed.data?.data;
+  const raw = data?.["talosconfig"] ?? data?.["config"];
+  if (typeof raw !== "string" || raw.trim() === "") {
+    return yield* Effect.fail(new Error(`${target.mount}/${key} returned no talosconfig field. Expected a KV key named 'talosconfig' or 'config' — never store the value in Alchemy props.`));
+  }
+  const talosconfigPath = `${Bun.env["TMPDIR"] ?? "/tmp"}/hf-talos-${target.cluster}-${Bun.randomUUIDv7()}.yaml`;
+  yield* Effect.try({
+    try: () => {
+      const fd = openSync(talosconfigPath, "wx", 384);
+      try {
+        writeFileSync(fd, raw);
+      } finally {
+        closeSync(fd);
+      }
+    },
+    catch: (cause) => new Error(`writing temp talosconfig: ${String(cause)}`)
+  });
+  yield* Effect.addFinalizer(() => Effect.tryPromise({
+    try: () => Bun.file(talosconfigPath).delete(),
+    catch: () => {
+      return;
+    }
+  }).pipe(Effect.orElseSucceed(() => {
+    return;
+  })));
+  return { talosconfigPath };
+}));
+
+// src/talos/talosctl.ts
+import * as Effect2 from "effect/Effect";
+import * as Stream2 from "effect/Stream";
+import * as ChildProcess2 from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner3 from "effect/unstable/process/ChildProcessSpawner";
+
+class TalosError extends Error {
+  command;
+  exitCode;
+  constructor(command, exitCode, detail) {
+    super(`talosctl ${command} -> ${String(exitCode)}: ${detail}`);
+    this.command = command;
+    this.exitCode = exitCode;
+    this.name = "TalosError";
+  }
+}
+var talosctl = (args, options) => Effect2.gen(function* () {
+  const spawner = yield* ChildProcessSpawner3.ChildProcessSpawner;
+  const argv = [
+    ...args,
+    "--talosconfig",
+    options.talosconfigPath,
+    ...options.nodes === undefined ? [] : ["--nodes", options.nodes.join(",")],
+    ...options.endpoints === undefined ? [] : ["--endpoints", options.endpoints.join(",")]
+  ];
+  const result = yield* ChildProcess2.make("talosctl", argv, {
+    detached: false,
+    extendEnv: true,
+    stderr: "pipe",
+    stdin: "ignore",
+    stdout: "pipe"
+  }).pipe(spawner.spawn, Effect2.flatMap((child) => Effect2.all({
+    exitCode: child.exitCode,
+    stderr: child.stderr.pipe(Stream2.decodeText, Stream2.mkString, Effect2.map((text) => text.trim())),
+    stdout: child.stdout.pipe(Stream2.decodeText, Stream2.mkString, Effect2.map((text) => text.trim()))
+  }, { concurrency: "unbounded" })), Effect2.scoped);
+  const command = args.join(" ");
+  if (result.exitCode !== 0) {
+    return yield* Effect2.fail(new TalosError(command, result.exitCode, result.stderr.slice(0, 300)));
+  }
+  return result.stdout;
+});
+var talosctlOrAlready = (args, options) => talosctl(args, options).pipe(Effect2.catchIf((cause) => cause instanceof TalosError && cause.exitCode !== 0 && /already|exists|bootstrapped/i.test(cause.message), () => Effect2.succeed("")));
+
+// src/talos/values.ts
+import { createHash } from "node:crypto";
+var canonicalText = (text) => text.trimEnd();
+var sha256 = (text) => createHash("sha256").update(canonicalText(text)).digest("hex");
+var configDigest = (text) => sha256(text);
+var kubeconfigMetadata = (yamlText, contextName) => {
+  let doc;
+  try {
+    doc = Bun.YAML.parse(yamlText);
+  } catch {
+    return;
+  }
+  const ctx = doc.contexts?.find((row) => row.name === contextName)?.context;
+  const clusterName = ctx?.cluster;
+  const userName = ctx?.user;
+  if (clusterName === undefined || userName === undefined)
+    return;
+  const cluster = doc.clusters?.find((row) => row.name === clusterName)?.cluster;
+  const user = doc.users?.find((row) => row.name === userName)?.user;
+  const endpoint = cluster?.server;
+  const ca = cluster?.["certificate-authority-data"];
+  const cert = user?.["client-certificate-data"] ?? user?.["client-key-data"];
+  if (endpoint === undefined || ca === undefined || cert === undefined)
+    return;
+  return {
+    caFingerprint: sha256(ca),
+    clientFingerprint: sha256(cert),
+    endpoint
+  };
+};
+var resolveConfigPath = (stackDir, configFile) => configFile.startsWith("/") ? configFile : `${stackDir}/${configFile}`;
+
+// src/talos/kubeconfig.ts
+var TalosKubeconfig = Resource("Talos.Kubeconfig");
+var generation = (meta) => sha256(`${meta.context}
+${meta.endpoint}
+${meta.caFingerprint}
+${meta.clientFingerprint}`);
+var toConnection = (props) => ({
+  auth: { context: props.context, kind: "kubeconfig", path: props.runtimePath }
+});
+var readFileMeta = (props) => Effect3.gen(function* () {
+  const text = yield* Effect3.tryPromise({
+    try: () => Bun.file(props.runtimePath).text(),
+    catch: (cause) => new Error(String(cause))
+  }).pipe(Effect3.orElseSucceed(() => {
+    return;
+  }));
+  if (text === undefined)
+    return;
+  const meta = kubeconfigMetadata(text, props.context);
+  if (meta === undefined)
+    return;
+  return {
+    certificateAuthorityFingerprint: meta.caFingerprint,
+    clientCertificateFingerprint: meta.clientFingerprint,
+    connection: toConnection(props),
+    context: props.context,
+    credentialGeneration: generation({ ...meta, context: props.context }),
+    endpoint: meta.endpoint
+  };
+});
+var read = (props) => readFileMeta(props).pipe(Effect3.map((meta) => meta === undefined ? {
+  certificateAuthorityFingerprint: "",
+  clientCertificateFingerprint: "",
+  connection: toConnection(props),
+  context: props.context,
+  credentialGeneration: "",
+  endpoint: ""
+} : meta));
+var diff = (news, output) => Effect3.gen(function* () {
+  if (output === undefined || !isResolved(news))
+    return;
+  const live = yield* read(news);
+  if (live.credentialGeneration !== "" && output.credentialGeneration === live.credentialGeneration && output.context === live.context && output.endpoint === live.endpoint) {
+    return { action: "noop" };
+  }
+  return { action: "update" };
+});
+var reconcile = (props) => Effect3.gen(function* () {
+  const credential = yield* mintTalosconfig(props.target);
+  yield* talosctl([
+    "kubeconfig",
+    props.runtimePath,
+    "--merge=false",
+    "--force",
+    "--force-context-name",
+    props.context
+  ], { nodes: [props.node], talosconfigPath: credential.talosconfigPath });
+  const meta = yield* readFileMeta(props);
+  if (meta === undefined) {
+    return yield* Effect3.die(new Error(`${props.runtimePath}: talosctl kubeconfig returned no error but the file is missing ` + "or unparsable. Read back rather than trusting the exit code alone."));
+  }
+  return meta;
+});
+var handlers = {
+  delete: () => Effect3.void,
+  diff: ({
+    news,
+    output
+  }) => diff(news, output),
+  list: () => Effect3.succeed([]),
+  read: ({ olds }) => read(olds),
+  reconcile: ({ news }) => reconcile(news)
+};
+var TalosKubeconfigProvider = () => Provider.effect(TalosKubeconfig, Effect3.succeed(TalosKubeconfig.Provider.of(handlers)));
+// src/talos/talos-bootstrap.ts
+import { Resource as Resource2 } from "alchemy";
+import { isResolved as isResolved2 } from "alchemy/Diff";
+import * as Provider2 from "alchemy/Provider";
+import * as Effect4 from "effect/Effect";
+var TalosBootstrap = Resource2("Talos.Bootstrap", {
+  defaultRemovalPolicy: "retain"
+});
+var isBootstrapped = (props, talosconfigPath) => talosctl(["get", "etcdmembers", "-o", "json"], {
+  nodes: [props.node],
+  talosconfigPath
+}).pipe(Effect4.map((text) => text.includes('"id"') || text.includes('"member"')), Effect4.orElseSucceed(() => false));
+var read2 = (props) => Effect4.gen(function* () {
+  const credential = yield* mintTalosconfig(props.target);
+  const bootstrapped = yield* isBootstrapped(props, credential.talosconfigPath);
+  return { bootstrapped, node: props.node };
+});
+var diff2 = (news, output) => Effect4.gen(function* () {
+  if (output === undefined || !isResolved2(news))
+    return;
+  const live = yield* read2(news);
+  if (live.bootstrapped)
+    return { action: "noop" };
+  return { action: "update" };
+});
+var reconcile2 = (props) => Effect4.gen(function* () {
+  const credential = yield* mintTalosconfig(props.target);
+  const before = yield* isBootstrapped(props, credential.talosconfigPath);
+  if (!before) {
+    yield* talosctlOrAlready(["bootstrap"], {
+      nodes: [props.node],
+      talosconfigPath: credential.talosconfigPath
+    });
+  }
+  const after = yield* isBootstrapped(props, credential.talosconfigPath);
+  if (!after) {
+    return yield* Effect4.die(new Error(`${props.node}: bootstrap returned no error but etcd members are still absent. ` + "Read back rather than trusting the exit code alone."));
+  }
+  return { bootstrapped: true, node: props.node };
+});
+var handlers2 = {
+  delete: () => Effect4.void,
+  diff: ({
+    news,
+    output
+  }) => diff2(news, output),
+  list: () => Effect4.succeed([]),
+  read: ({ olds }) => read2(olds),
+  reconcile: ({ news }) => reconcile2(news)
+};
+var TalosBootstrapProvider = () => Provider2.effect(TalosBootstrap, Effect4.succeed(TalosBootstrap.Provider.of(handlers2)));
+// src/talos/talos-cluster-health.ts
+import { Resource as Resource3 } from "alchemy";
+import { isResolved as isResolved3 } from "alchemy/Diff";
+import * as Provider3 from "alchemy/Provider";
+import * as Effect5 from "effect/Effect";
+var TalosClusterHealth = Resource3("Talos.ClusterHealth");
+var nodeCsv = (nodes) => nodes === undefined || nodes.length === 0 ? "" : nodes.join(",");
+var healthArgs = (props, waitTimeout) => {
+  const args = ["health", "--wait-timeout", waitTimeout];
+  const cp = nodeCsv(props.controlPlaneNodes);
+  const workers = nodeCsv(props.workerNodes);
+  if (cp !== "")
+    args.push("--control-plane-nodes", cp);
+  if (workers !== "")
+    args.push("--worker-nodes", workers);
+  return args;
+};
+var check = (props, waitTimeout) => Effect5.gen(function* () {
+  const credential = yield* mintTalosconfig(props.target);
+  yield* talosctl(healthArgs(props, waitTimeout), {
+    nodes: [...props.controlPlaneNodes],
+    talosconfigPath: credential.talosconfigPath
+  });
+  return {
+    controlPlaneNodes: nodeCsv(props.controlPlaneNodes),
+    healthy: true,
+    workerNodes: nodeCsv(props.workerNodes)
+  };
+});
+var read3 = (props) => check(props, "5s").pipe(Effect5.orElseSucceed(() => ({
+  controlPlaneNodes: nodeCsv(props.controlPlaneNodes),
+  healthy: false,
+  workerNodes: nodeCsv(props.workerNodes)
+})));
+var diff3 = (news, output) => Effect5.gen(function* () {
+  if (output === undefined || !isResolved3(news))
+    return;
+  const live = yield* read3(news);
+  if (live.healthy)
+    return { action: "noop" };
+  return { action: "update" };
+});
+var reconcile3 = (props) => check(props, props.waitTimeout ?? "20m0s").pipe(Effect5.mapError((cause) => new Error(`Talos.ClusterHealth ${props.target.cluster}: cluster not healthy within ` + `${props.waitTimeout ?? "20m0s"} — ${String(cause)}`)));
+var handlers3 = {
+  delete: () => Effect5.void,
+  diff: ({
+    news,
+    output
+  }) => diff3(news, output),
+  list: () => Effect5.succeed([]),
+  read: ({ olds }) => read3(olds),
+  reconcile: ({ news }) => reconcile3(news)
+};
+var TalosClusterHealthProvider = () => Provider3.effect(TalosClusterHealth, Effect5.succeed(TalosClusterHealth.Provider.of(handlers3)));
+// src/talos/talos-machine-config.ts
+import { Resource as Resource4 } from "alchemy";
+import { isResolved as isResolved4 } from "alchemy/Diff";
+import * as Provider4 from "alchemy/Provider";
+import * as Effect6 from "effect/Effect";
+var STACK_DIR = new URL("..", import.meta.url).pathname;
+var TalosMachineConfig = Resource4("Talos.MachineConfig");
+var loadDigest = (props) => Effect6.gen(function* () {
+  const path = resolveConfigPath(STACK_DIR, props.configFile);
+  const text = yield* Effect6.tryPromise({
+    try: () => Bun.file(path).text(),
+    catch: (cause) => new Error(`reading ${props.configFile}: ${String(cause)}`)
+  });
+  return configDigest(text);
+});
+var liveDigest = (props, talosconfigPath) => talosctl(["get", "machineconfig", "-o", "yaml"], {
+  nodes: [props.node],
+  talosconfigPath
+}).pipe(Effect6.map((yaml) => configDigest(yaml)), Effect6.orElseSucceed(() => {
+  return;
+}));
+var read4 = (props) => Effect6.gen(function* () {
+  const wanted = yield* loadDigest(props);
+  const credential = yield* mintTalosconfig(props.target);
+  const live = yield* liveDigest(props, credential.talosconfigPath);
+  return {
+    configDigest: wanted,
+    converged: live === wanted,
+    mode: props.mode ?? "auto",
+    node: props.node
+  };
+});
+var diff4 = (news, output) => Effect6.gen(function* () {
+  if (output === undefined || !isResolved4(news))
+    return;
+  const live = yield* read4(news);
+  if (live.converged)
+    return { action: "noop" };
+  return { action: "update" };
+});
+var reconcile4 = (props) => Effect6.gen(function* () {
+  const path = resolveConfigPath(STACK_DIR, props.configFile);
+  const wanted = yield* loadDigest(props);
+  const credential = yield* mintTalosconfig(props.target);
+  const args = [
+    "apply-config",
+    "--file",
+    path,
+    "--mode",
+    props.mode ?? "auto",
+    ...props.insecure === true ? ["--insecure"] : []
+  ];
+  yield* talosctl(args, { nodes: [props.node], talosconfigPath: credential.talosconfigPath });
+  const live = yield* liveDigest(props, credential.talosconfigPath);
+  if (live !== wanted) {
+    return yield* Effect6.die(new Error(`${props.node}: apply-config returned no error but machineconfig digest still differs. ` + "Read back rather than trusting the exit code alone."));
+  }
+  return {
+    configDigest: wanted,
+    converged: true,
+    mode: props.mode ?? "auto",
+    node: props.node
+  };
+});
+var handlers4 = {
+  delete: () => Effect6.void,
+  diff: ({
+    news,
+    output
+  }) => diff4(news, output),
+  list: () => Effect6.succeed([]),
+  read: ({ olds }) => read4(olds),
+  reconcile: ({ news }) => reconcile4(news)
+};
+var TalosMachineConfigProvider = () => Provider4.effect(TalosMachineConfig, Effect6.succeed(TalosMachineConfig.Provider.of(handlers4)));
+export {
+  TalosBootstrapProvider,
+  TalosClusterHealthProvider,
+  TalosKubeconfigProvider,
+  TalosMachineConfigProvider
+};
+
+//# debugId=6CD90391393B548364756E2164756E21
+//# sourceMappingURL=index.js.map