@homeflare/alchemy 0.1.0

package/dist/talos/index.js.map

@@ -0,0 +1,16 @@
+{
+  "version": 3,
+  "sources": ["../src/talos/kubeconfig.ts", "../src/talos/credentials.ts", "../src/talos/talosctl.ts", "../src/talos/values.ts", "../src/talos/talos-bootstrap.ts", "../src/talos/talos-cluster-health.ts", "../src/talos/talos-machine-config.ts"],
+  "sourcesContent": [
+    "/**\n * `Talos.Kubeconfig` — fetch admin kubeconfig so `Kubernetes.*` workloads can connect.\n *\n * ★ REASONED FROM talosctl kubeconfig (Talos v1.13 CLI reference): writes a kubeconfig file;\n *   `--merge=false` keeps it isolated; `-f/--force` overwrites an existing file.\n *\n * ⛔ THE KUBECONFIG FILE CONTAINS A CLIENT CERTIFICATE — IT MUST NOT BE AN ATTRIBUTE. Alchemy\n *   persists attributes unencrypted. This resource:\n *     - writes the file to `runtimePath` at reconcile time (re-minted each deploy),\n *     - persists ONLY public metadata + fingerprints,\n *     - exposes a `connection` field referencing the runtime path for `Kubernetes.ClusterAdapter`.\n *\n * ⚠️ `runtimePath` IS PERSISTED AS A STRING, NOT AS FILE CONTENTS. The path is a contract between\n *   this resource and the host filesystem — same pattern as pointing Kubernetes.KubeConfig at\n *   `/opt/homeflare/...` rendered outside Postgres.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport type { Connection } from 'alchemy/Kubernetes/Connection';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { mintTalosconfig } from './credentials.ts';\nimport type { TalosRequirements, WithTarget } from './resource.ts';\nimport { talosctl } from './talosctl.ts';\nimport { kubeconfigMetadata, sha256 } from './values.ts';\n\nexport interface KubeconfigProps extends WithTarget {\n  /** Node that serves `talosctl kubeconfig`. */\n  node: string;\n  /** Context name inside the generated kubeconfig — not secret. */\n  context: string;\n  /**\n   * Host path where talosctl writes the kubeconfig each reconcile.\n   *\n   * ⛔ Must be outside Alchemy state and rotated by redeploy, never copied into attributes.\n   */\n  runtimePath: string;\n  after?: readonly unknown[];\n}\n\nexport interface KubeconfigAttributes {\n  context: string;\n  endpoint: string;\n  certificateAuthorityFingerprint: string;\n  clientCertificateFingerprint: string;\n  /** Digest of endpoint+context+fingerprints — detects credential rotation without storing PEM. */\n  credentialGeneration: string;\n  /**\n   * Serializable `Kubernetes.Connection` for downstream workloads.\n   *\n   * ★ auth.kind `kubeconfig` is the stock ClusterAdapter — provider-roadmap.md names this seam.\n   *   Only `path` and `context` appear here; the adapter reads credentials from disk at call time.\n   */\n  connection: Connection;\n}\n\nexport interface TalosKubeconfig extends Resource<\n  'Talos.Kubeconfig',\n  KubeconfigProps,\n  KubeconfigAttributes,\n  never,\n  TalosRequirements\n> {}\n\nexport const TalosKubeconfig = Resource<TalosKubeconfig>('Talos.Kubeconfig');\n\nconst generation = (meta: {\n  endpoint: string;\n  caFingerprint: string;\n  clientFingerprint: string;\n  context: string;\n}) => sha256(`${meta.context}\\n${meta.endpoint}\\n${meta.caFingerprint}\\n${meta.clientFingerprint}`);\n\nconst toConnection = (props: KubeconfigProps): Connection => ({\n  auth: { context: props.context, kind: 'kubeconfig', path: props.runtimePath },\n});\n\nconst readFileMeta = (props: KubeconfigProps) =>\n  Effect.gen(function* () {\n    const text = yield* Effect.tryPromise({\n      try: () => Bun.file(props.runtimePath).text(),\n      catch: (cause) => new Error(String(cause)),\n    }).pipe(Effect.orElseSucceed(() => undefined as string | undefined));\n    if (text === undefined) return undefined;\n    const meta = kubeconfigMetadata(text, props.context);\n    if (meta === undefined) return undefined;\n    return {\n      certificateAuthorityFingerprint: meta.caFingerprint,\n      clientCertificateFingerprint: meta.clientFingerprint,\n      connection: toConnection(props),\n      context: props.context,\n      credentialGeneration: generation({ ...meta, context: props.context }),\n      endpoint: meta.endpoint,\n    };\n  });\n\nconst read = (props: KubeconfigProps) =>\n  readFileMeta(props).pipe(\n    Effect.map((meta) =>\n      meta === undefined\n        ? {\n            certificateAuthorityFingerprint: '',\n            clientCertificateFingerprint: '',\n            connection: toConnection(props),\n            context: props.context,\n            credentialGeneration: '',\n            endpoint: '',\n          }\n        : meta,\n    ),\n  );\n\nconst diff = (news: Input<KubeconfigProps>, output: KubeconfigAttributes | undefined) =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    const live = yield* read(news);\n    if (\n      live.credentialGeneration !== '' &&\n      output.credentialGeneration === live.credentialGeneration &&\n      output.context === live.context &&\n      output.endpoint === live.endpoint\n    ) {\n      return { action: 'noop' } as const;\n    }\n    return { action: 'update' } as const;\n  });\n\nconst reconcile = (props: KubeconfigProps) =>\n  Effect.gen(function* () {\n    const credential = yield* mintTalosconfig(props.target);\n    yield* talosctl(\n      [\n        'kubeconfig',\n        props.runtimePath,\n        '--merge=false',\n        '--force',\n        '--force-context-name',\n        props.context,\n      ],\n      { nodes: [props.node], talosconfigPath: credential.talosconfigPath },\n    );\n    const meta = yield* readFileMeta(props);\n    if (meta === undefined) {\n      return yield* Effect.die(\n        new Error(\n          `${props.runtimePath}: talosctl kubeconfig returned no error but the file is missing ` +\n            'or unparsable. Read back rather than trusting the exit code alone.',\n        ),\n      );\n    }\n    return meta;\n  });\n\nconst handlers = {\n  delete: () => Effect.void,\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<KubeconfigProps>;\n    output: KubeconfigAttributes | undefined;\n  }) => diff(news, output),\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: KubeconfigProps }) => read(olds),\n  reconcile: ({ news }: { news: KubeconfigProps }) => reconcile(news),\n};\n\nexport const TalosKubeconfigProvider = () =>\n  Provider.effect(TalosKubeconfig, Effect.succeed(TalosKubeconfig.Provider.of(handlers)));\n",
+    "/**\n * The Talos client credential a reconcile runs with: minted from OpenBao, written to a temp file.\n *\n * ⛔ TALOSCONFIG AND secrets.yaml HOLD CLIENT CERTIFICATES AND CLUSTER CA PRIVATE KEYS. Alchemy\n *   persists resource attributes WITHOUT encryption — StateEncoding.ts writes `Redacted` as\n *   `{\"@redacted\": <plaintext>}` — and this estate's state store is the `alchemy` Postgres that\n *   pg-backup.sh dumps nightly. Neither file may be a prop, an attribute, or a log line.\n *\n * ★ MODELED ON house/proxmox/src/credentials.ts: mint at call time through `ChildProcessSpawner`,\n *   use the material to build a client, drop it when the scope ends. The difference is Talos wants a\n *   FILE (`--talosconfig` / `TALOSCONFIG`), so mint writes a temp path and registers cleanup.\n *\n * ⚠️ REASONED FROM THE PUBLISHED TALOS WORKFLOW, NOT MEASURED ON THIS ESTATE. There is no Talos\n *   cluster here yet; paths below follow the same `mount/data/…` shape other infra mounts use.\n */\nimport { closeSync, openSync, writeFileSync } from 'node:fs';\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/unstable/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';\n\n/** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */\nexport type TalosTarget = {\n  /** OpenBao KV mount holding Talos material, e.g. `talos-tb4`. */\n  readonly mount: string;\n  /** Logical cluster name — safe to persist and log. */\n  readonly cluster: string;\n  /**\n   * Path under the mount for the talosconfig YAML.\n   *\n   * ⚠️ DEFAULT IS REASONED. The first real deploy will confirm or correct the path; a wrong path\n   *   fails closed with a bao error rather than writing an empty talosconfig.\n   */\n  readonly talosconfigKey?: string;\n};\n\nexport type TalosCredential = {\n  /** Absolute path to a temp talosconfig. ⛔ NEVER PERSIST, NEVER LOG CONTENTS. */\n  readonly talosconfigPath: string;\n};\n\nconst defaultKey = (target: TalosTarget) => target.talosconfigKey ?? 'data/talosconfig';\n\n/**\n * Mint one talosconfig file for `target`.\n *\n * ★ SHELLS OUT TO `bao` RATHER THAN SPEAKING THE HTTP API — same reasoning as proxmox credentials.\n *   The estate's BAO_ADDR / BAO_NAMESPACE / approle contract already lives in that binary.\n */\nexport const mintTalosconfig = (target: TalosTarget) =>\n  Effect.scoped(\n    Effect.gen(function* () {\n      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n      const key = defaultKey(target);\n      const result = yield* ChildProcess.make(\n        'bao',\n        ['kv', 'get', '-format=json', `${target.mount}/${key}`],\n        { detached: false, extendEnv: true, stderr: 'pipe', stdin: 'ignore', stdout: 'pipe' },\n      ).pipe(\n        spawner.spawn,\n        Effect.flatMap((child) =>\n          Effect.all(\n            {\n              exitCode: child.exitCode,\n              stderr: child.stderr.pipe(\n                Stream.decodeText,\n                Stream.mkString,\n                Effect.map((text) => text.trim()),\n              ),\n              stdout: child.stdout.pipe(\n                Stream.decodeText,\n                Stream.mkString,\n                Effect.map((text) => text.trim()),\n              ),\n            },\n            { concurrency: 'unbounded' },\n          ),\n        ),\n        Effect.scoped,\n      );\n\n      if (result.exitCode !== 0) {\n        // ⛔ stderr ONLY — stdout may hold talosconfig YAML with client credentials.\n        return yield* Effect.fail(\n          new Error(\n            `bao kv get ${target.mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`,\n          ),\n        );\n      }\n\n      const parsed = JSON.parse(result.stdout) as { data?: { data?: Record<string, unknown> } };\n      const data = parsed.data?.data;\n      const raw = data?.['talosconfig'] ?? data?.['config'];\n      if (typeof raw !== 'string' || raw.trim() === '') {\n        return yield* Effect.fail(\n          new Error(\n            `${target.mount}/${key} returned no talosconfig field. Expected a KV key named 'talosconfig' or 'config' — never store the value in Alchemy props.`,\n          ),\n        );\n      }\n\n      const talosconfigPath = `${Bun.env['TMPDIR'] ?? '/tmp'}/hf-talos-${target.cluster}-${Bun.randomUUIDv7()}.yaml`;\n      /**\n       * ⛔ 0600, CREATED EXCLUSIVELY, AND `Bun.write` CANNOT DO EITHER. This file holds the\n       *   cluster's admin client certificate — everything talosctl needs to reconfigure or wipe a\n       *   node. `Bun.write` takes no mode, so it lands at the process umask, which on this estate\n       *   is 0644: world-readable, in a world-readable directory, for as long as the resource\n       *   runs. The name is unguessable, and \"unguessable\" is not a permission.\n       * ⚠️ `wx` IS THE OTHER HALF. Opening with O_EXCL means this cannot be made to write through\n       *   a path an attacker pre-created — the classic /tmp symlink race — and with a UUIDv7 name\n       *   a collision is a genuine error rather than something to paper over.\n       * ⚠️ THE FINALIZER BELOW REMOVES IT ON EVERY EXIT PATH, but a hard kill (SIGKILL, power\n       *   loss) leaves it behind. 0600 is what makes that survivable rather than a disclosure.\n       */\n      yield* Effect.try({\n        try: () => {\n          const fd = openSync(talosconfigPath, 'wx', 0o600);\n          try {\n            writeFileSync(fd, raw);\n          } finally {\n            closeSync(fd);\n          }\n        },\n        catch: (cause) => new Error(`writing temp talosconfig: ${String(cause)}`),\n      });\n\n      yield* Effect.addFinalizer(() =>\n        Effect.tryPromise({\n          try: () => Bun.file(talosconfigPath).delete(),\n          catch: () => undefined,\n        }).pipe(Effect.orElseSucceed(() => undefined)),\n      );\n\n      return { talosconfigPath } satisfies TalosCredential;\n    }),\n  );\n",
+    "/**\n * One `talosctl` invocation — stdout/stderr captured, secrets never echoed.\n *\n * ★ SHELL OUT LIKE ALCHEMY'S DOCKER PROVIDER (ChildProcessSpawner), NOT A SECOND SDK. Talos speaks\n *   gRPC; the published, stable surface for operators is `talosctl`. No Talos npm package is added.\n *\n * ⚠️ REASONED FROM docs.siderolabs.com/talos/v1.13/reference/cli — nothing here was measured on a\n *   live cluster in this session.\n *\n * ⛔ DO NOT LOG STDOUT ON FAILURE. `talosctl kubeconfig` and error paths have been observed in the\n *   wild to include credential material; stderr is the safe diagnostic channel.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/unstable/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';\n\nexport class TalosError extends Error {\n  constructor(\n    readonly command: string,\n    readonly exitCode: number,\n    detail: string,\n  ) {\n    super(`talosctl ${command} -> ${String(exitCode)}: ${detail}`);\n    this.name = 'TalosError';\n  }\n}\n\nexport type TalosRunOptions = {\n  readonly talosconfigPath: string;\n  readonly nodes?: readonly string[];\n  readonly endpoints?: readonly string[];\n};\n\n/** Run `talosctl <args…>`. Returns trimmed stdout, or '' when empty. */\nexport const talosctl = (args: readonly string[], options: TalosRunOptions) =>\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n    const argv = [\n      ...args,\n      '--talosconfig',\n      options.talosconfigPath,\n      ...(options.nodes === undefined ? [] : ['--nodes', options.nodes.join(',')]),\n      ...(options.endpoints === undefined ? [] : ['--endpoints', options.endpoints.join(',')]),\n    ];\n    const result = yield* ChildProcess.make('talosctl', argv, {\n      detached: false,\n      extendEnv: true,\n      stderr: 'pipe',\n      stdin: 'ignore',\n      stdout: 'pipe',\n    }).pipe(\n      spawner.spawn,\n      Effect.flatMap((child) =>\n        Effect.all(\n          {\n            exitCode: child.exitCode,\n            stderr: child.stderr.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n            stdout: child.stdout.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n          },\n          { concurrency: 'unbounded' },\n        ),\n      ),\n      Effect.scoped,\n    );\n\n    const command = args.join(' ');\n    if (result.exitCode !== 0) {\n      return yield* Effect.fail(\n        new TalosError(command, result.exitCode, result.stderr.slice(0, 300)),\n      );\n    }\n    return result.stdout;\n  });\n\n/** Like `talosctl`, but exit code 1 with \"already\" in stderr is treated as success. */\nexport const talosctlOrAlready = (args: readonly string[], options: TalosRunOptions) =>\n  talosctl(args, options).pipe(\n    Effect.catchIf(\n      (cause): cause is TalosError =>\n        cause instanceof TalosError &&\n        cause.exitCode !== 0 &&\n        /already|exists|bootstrapped/i.test(cause.message),\n      () => Effect.succeed(''),\n    ),\n  );\n",
+    "/**\n * Coercions and digests for Talos resources — every function here exists because a trap does.\n *\n * ⚠️ NOTHING IN THIS FILE TOUCHES A LIVE CLUSTER. Digests are computed from repo files or from\n *   kubeconfig YAML already on disk at reconcile time; tests use fixtures only.\n */\nimport { createHash } from 'node:crypto';\n\n/** Trim trailing whitespace only — leading space in YAML is meaningful. */\nexport const canonicalText = (text: string) => text.trimEnd();\n\n/** SHA-256 hex digest of canonical text. Safe to persist — it is not reversible to the input. */\nexport const sha256 = (text: string) =>\n  createHash('sha256').update(canonicalText(text)).digest('hex');\n\n/** Digest of a machine config file read from the repo. ⛔ Never persist the file body itself. */\nexport const configDigest = (text: string) => sha256(text);\n\ntype KubeconfigDoc = {\n  clusters?: {\n    cluster?: { server?: string; 'certificate-authority-data'?: string };\n    name?: string;\n  }[];\n  contexts?: { context?: { cluster?: string; user?: string }; name?: string }[];\n  users?: {\n    name?: string;\n    user?: { 'client-certificate-data'?: string; 'client-key-data'?: string };\n  }[];\n  'current-context'?: string;\n};\n\n/**\n * Public metadata extracted from a kubeconfig file on disk.\n *\n * ⛔ RETURNS FINGERPRINTS ONLY. The admin kubeconfig contains a client certificate; Alchemy state\n *   may hold the API server URL and CA/client cert digests, never the PEM bytes.\n */\nexport const kubeconfigMetadata = (\n  yamlText: string,\n  contextName: string,\n): { endpoint: string; caFingerprint: string; clientFingerprint: string } | undefined => {\n  let doc: KubeconfigDoc;\n  try {\n    doc = Bun.YAML.parse(yamlText) as KubeconfigDoc;\n  } catch {\n    return undefined;\n  }\n\n  const ctx = doc.contexts?.find((row) => row.name === contextName)?.context;\n  const clusterName = ctx?.cluster;\n  const userName = ctx?.user;\n  if (clusterName === undefined || userName === undefined) return undefined;\n\n  const cluster = doc.clusters?.find((row) => row.name === clusterName)?.cluster;\n  const user = doc.users?.find((row) => row.name === userName)?.user;\n  const endpoint = cluster?.server;\n  const ca = cluster?.['certificate-authority-data'];\n  const cert = user?.['client-certificate-data'] ?? user?.['client-key-data'];\n  if (endpoint === undefined || ca === undefined || cert === undefined) return undefined;\n\n  return {\n    caFingerprint: sha256(ca),\n    clientFingerprint: sha256(cert),\n    endpoint,\n  };\n};\n\n/** Resolve a config file path relative to the declaring stack file. */\nexport const resolveConfigPath = (stackDir: string, configFile: string) =>\n  configFile.startsWith('/') ? configFile : `${stackDir}/${configFile}`;\n",
+    "/**\n * `Talos.Bootstrap` — initialize etcd once on ONE control-plane node.\n *\n * ★ REASONED FROM talosctl bootstrap (Talos v1.13 CLI reference): one node aborts the etcd join\n *   loop and forms the initial cluster; other control-plane nodes join after Kubernetes starts on\n *   the bootstrap node. This command must run exactly once per cluster.\n *\n * ⛔ NOT A FACTORY RESOURCE — bootstrap cannot be deleted or updated in place; `delete` is a no-op.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { mintTalosconfig } from './credentials.ts';\nimport type { TalosRequirements, WithTarget } from './resource.ts';\nimport { talosctl, talosctlOrAlready } from './talosctl.ts';\n\nexport interface BootstrapProps extends WithTarget {\n  /** The ONE control-plane node that receives `talosctl bootstrap`. */\n  node: string;\n  /** Machine configs for this node (and peers) must be applied first. */\n  after?: readonly unknown[];\n}\n\nexport interface BootstrapAttributes {\n  node: string;\n  bootstrapped: boolean;\n}\n\nexport interface TalosBootstrap extends Resource<\n  'Talos.Bootstrap',\n  BootstrapProps,\n  BootstrapAttributes,\n  never,\n  TalosRequirements\n> {}\n\nexport const TalosBootstrap = Resource<TalosBootstrap>('Talos.Bootstrap', {\n  /** etcd data is irreplaceable — opt into destroy explicitly if Talos ever adds an undo. */\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * REASONED: `talosctl get etcdmembers -o json` should list members after bootstrap.\n * ⚠️ NOT MEASURED — first live deploy confirms the resource type name.\n */\nconst isBootstrapped = (props: BootstrapProps, talosconfigPath: string) =>\n  talosctl(['get', 'etcdmembers', '-o', 'json'], {\n    nodes: [props.node],\n    talosconfigPath,\n  }).pipe(\n    Effect.map((text) => text.includes('\"id\"') || text.includes('\"member\"')),\n    Effect.orElseSucceed(() => false),\n  );\n\nconst read = (props: BootstrapProps) =>\n  Effect.gen(function* () {\n    const credential = yield* mintTalosconfig(props.target);\n    const bootstrapped = yield* isBootstrapped(props, credential.talosconfigPath);\n    return { bootstrapped, node: props.node };\n  });\n\nconst diff = (news: Input<BootstrapProps>, output: BootstrapAttributes | undefined) =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    const live = yield* read(news);\n    if (live.bootstrapped) return { action: 'noop' } as const;\n    return { action: 'update' } as const;\n  });\n\nconst reconcile = (props: BootstrapProps) =>\n  Effect.gen(function* () {\n    const credential = yield* mintTalosconfig(props.target);\n    const before = yield* isBootstrapped(props, credential.talosconfigPath);\n    if (!before) {\n      yield* talosctlOrAlready(['bootstrap'], {\n        nodes: [props.node],\n        talosconfigPath: credential.talosconfigPath,\n      });\n    }\n    const after = yield* isBootstrapped(props, credential.talosconfigPath);\n    if (!after) {\n      return yield* Effect.die(\n        new Error(\n          `${props.node}: bootstrap returned no error but etcd members are still absent. ` +\n            'Read back rather than trusting the exit code alone.',\n        ),\n      );\n    }\n    return { bootstrapped: true, node: props.node };\n  });\n\nconst handlers = {\n  delete: () => Effect.void,\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<BootstrapProps>;\n    output: BootstrapAttributes | undefined;\n  }) => diff(news, output),\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: BootstrapProps }) => read(olds),\n  reconcile: ({ news }: { news: BootstrapProps }) => reconcile(news),\n};\n\nexport const TalosBootstrapProvider = () =>\n  Provider.effect(TalosBootstrap, Effect.succeed(TalosBootstrap.Provider.of(handlers)));\n",
+    "/**\n * `Talos.ClusterHealth` — readiness gate other resources can depend on via `after`.\n *\n * ★ REASONED FROM talosctl health (Talos v1.13 CLI reference): checks Talos services, etcd, and\n *   Kubernetes component health; `--wait-timeout` defaults to 20m0s.\n *\n * ⚠️ PLAN READS USE A SHORT TIMEOUT SO `plan` DOES NOT BLOCK TWENTY MINUTES. Reconcile uses the\n *   declared timeout — that is the deploy gate, not the plan gate.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { mintTalosconfig } from './credentials.ts';\nimport type { TalosRequirements, WithTarget } from './resource.ts';\nimport { talosctl } from './talosctl.ts';\n\nexport interface ClusterHealthProps extends WithTarget {\n  /** Control-plane node IPs passed to `--control-plane-nodes`. */\n  controlPlaneNodes: readonly string[];\n  /** Worker node IPs passed to `--worker-nodes`. */\n  workerNodes?: readonly string[];\n  /**\n   * Reconcile wait (`--wait-timeout`), e.g. `20m0s`. Default from published CLI.\n   *\n   * ⚠️ REASONED default — not measured here.\n   */\n  waitTimeout?: string;\n  /** Bootstrap and kubeconfig should complete before health is enforced. */\n  after?: readonly unknown[];\n}\n\nexport interface ClusterHealthAttributes {\n  healthy: boolean;\n  controlPlaneNodes: string;\n  workerNodes: string;\n}\n\nexport interface TalosClusterHealth extends Resource<\n  'Talos.ClusterHealth',\n  ClusterHealthProps,\n  ClusterHealthAttributes,\n  never,\n  TalosRequirements\n> {}\n\nexport const TalosClusterHealth = Resource<TalosClusterHealth>('Talos.ClusterHealth');\n\nconst nodeCsv = (nodes: readonly string[] | undefined) =>\n  nodes === undefined || nodes.length === 0 ? '' : nodes.join(',');\n\nconst healthArgs = (props: ClusterHealthProps, waitTimeout: string) => {\n  const args = ['health', '--wait-timeout', waitTimeout];\n  const cp = nodeCsv(props.controlPlaneNodes);\n  const workers = nodeCsv(props.workerNodes);\n  if (cp !== '') args.push('--control-plane-nodes', cp);\n  if (workers !== '') args.push('--worker-nodes', workers);\n  return args;\n};\n\nconst check = (props: ClusterHealthProps, waitTimeout: string) =>\n  Effect.gen(function* () {\n    const credential = yield* mintTalosconfig(props.target);\n    yield* talosctl(healthArgs(props, waitTimeout), {\n      nodes: [...props.controlPlaneNodes],\n      talosconfigPath: credential.talosconfigPath,\n    });\n    return {\n      controlPlaneNodes: nodeCsv(props.controlPlaneNodes),\n      healthy: true,\n      workerNodes: nodeCsv(props.workerNodes),\n    };\n  });\n\nconst read = (props: ClusterHealthProps) =>\n  check(props, '5s').pipe(\n    Effect.orElseSucceed(() => ({\n      controlPlaneNodes: nodeCsv(props.controlPlaneNodes),\n      healthy: false,\n      workerNodes: nodeCsv(props.workerNodes),\n    })),\n  );\n\nconst diff = (news: Input<ClusterHealthProps>, output: ClusterHealthAttributes | undefined) =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    const live = yield* read(news);\n    if (live.healthy) return { action: 'noop' } as const;\n    return { action: 'update' } as const;\n  });\n\nconst reconcile = (props: ClusterHealthProps) =>\n  check(props, props.waitTimeout ?? '20m0s').pipe(\n    Effect.mapError(\n      (cause) =>\n        new Error(\n          `Talos.ClusterHealth ${props.target.cluster}: cluster not healthy within ` +\n            `${props.waitTimeout ?? '20m0s'} — ${String(cause)}`,\n        ),\n    ),\n  );\n\nconst handlers = {\n  delete: () => Effect.void,\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<ClusterHealthProps>;\n    output: ClusterHealthAttributes | undefined;\n  }) => diff(news, output),\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: ClusterHealthProps }) => read(olds),\n  reconcile: ({ news }: { news: ClusterHealthProps }) => reconcile(news),\n};\n\nexport const TalosClusterHealthProvider = () =>\n  Provider.effect(TalosClusterHealth, Effect.succeed(TalosClusterHealth.Provider.of(handlers)));\n",
+    "/**\n * `Talos.MachineConfig` — apply one machine configuration document to one node.\n *\n * ★ REASONED FROM talosctl apply-config (Talos v1.13 CLI reference): `-f/--file`, `-n/--nodes`,\n *   `-m/--mode`, `-i/--insecure` for maintenance mode, `--dry-run` for planning without a write.\n *\n * ⛔ THE CONFIG BODY IS NEVER AN ATTRIBUTE. Machine configs can embed cluster tokens; only a digest\n *   of the repo file is persisted. Read `configFile` from disk at reconcile time.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { mintTalosconfig } from './credentials.ts';\nimport type { TalosRequirements, WithTarget } from './resource.ts';\nimport { talosctl } from './talosctl.ts';\nimport { configDigest, resolveConfigPath } from './values.ts';\n\nconst STACK_DIR = new URL('..', import.meta.url).pathname;\n\nexport type ApplyMode = 'auto' | 'no-reboot' | 'reboot' | 'staged' | 'try';\n\nexport interface MachineConfigProps extends WithTarget {\n  /** Node IP or hostname — the `-n` target. */\n  node: string;\n  /** Repo-relative or absolute path to the YAML file passed to `-f`. */\n  configFile: string;\n  /** talosctl `-m` mode. Default `auto` per published CLI. */\n  mode?: ApplyMode;\n  /**\n   * Maintenance-mode apply only (`-i`). Default false — post-bootstrap applies use talosconfig auth.\n   *\n   * ⚠️ REASONED: docs describe `--insecure` for the first apply before talosconfig exists.\n   */\n  insecure?: boolean;\n  /** Ordering edge — e.g. wait for Proxmox.Vm. */\n  after?: readonly unknown[];\n}\n\nexport interface MachineConfigAttributes {\n  node: string;\n  configDigest: string;\n  mode: ApplyMode;\n  /** True when the node's reported config digest matches the declared file. */\n  converged: boolean;\n}\n\nexport interface TalosMachineConfig extends Resource<\n  'Talos.MachineConfig',\n  MachineConfigProps,\n  MachineConfigAttributes,\n  never,\n  TalosRequirements\n> {}\n\nexport const TalosMachineConfig = Resource<TalosMachineConfig>('Talos.MachineConfig');\n\nconst loadDigest = (props: MachineConfigProps) =>\n  Effect.gen(function* () {\n    const path = resolveConfigPath(STACK_DIR, props.configFile);\n    const text = yield* Effect.tryPromise({\n      try: () => Bun.file(path).text(),\n      catch: (cause) => new Error(`reading ${props.configFile}: ${String(cause)}`),\n    });\n    return configDigest(text);\n  });\n\n/** REASONED: `talosctl get machineconfig -o yaml` returns the live document. */\nconst liveDigest = (props: MachineConfigProps, talosconfigPath: string) =>\n  talosctl(['get', 'machineconfig', '-o', 'yaml'], {\n    nodes: [props.node],\n    talosconfigPath,\n  }).pipe(\n    Effect.map((yaml) => configDigest(yaml)),\n    Effect.orElseSucceed(() => undefined),\n  );\n\nconst read = (props: MachineConfigProps) =>\n  Effect.gen(function* () {\n    const wanted = yield* loadDigest(props);\n    const credential = yield* mintTalosconfig(props.target);\n    const live = yield* liveDigest(props, credential.talosconfigPath);\n    return {\n      configDigest: wanted,\n      converged: live === wanted,\n      mode: props.mode ?? 'auto',\n      node: props.node,\n    };\n  });\n\nconst diff = (news: Input<MachineConfigProps>, output: MachineConfigAttributes | undefined) =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    const live = yield* read(news);\n    if (live.converged) return { action: 'noop' } as const;\n    return { action: 'update' } as const;\n  });\n\nconst reconcile = (props: MachineConfigProps) =>\n  Effect.gen(function* () {\n    const path = resolveConfigPath(STACK_DIR, props.configFile);\n    const wanted = yield* loadDigest(props);\n    const credential = yield* mintTalosconfig(props.target);\n    const args = [\n      'apply-config',\n      '--file',\n      path,\n      '--mode',\n      props.mode ?? 'auto',\n      ...(props.insecure === true ? ['--insecure'] : []),\n    ];\n    yield* talosctl(args, { nodes: [props.node], talosconfigPath: credential.talosconfigPath });\n    const live = yield* liveDigest(props, credential.talosconfigPath);\n    if (live !== wanted) {\n      return yield* Effect.die(\n        new Error(\n          `${props.node}: apply-config returned no error but machineconfig digest still differs. ` +\n            'Read back rather than trusting the exit code alone.',\n        ),\n      );\n    }\n    return {\n      configDigest: wanted,\n      converged: true,\n      mode: props.mode ?? 'auto',\n      node: props.node,\n    };\n  });\n\nconst handlers = {\n  delete: () => Effect.void,\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<MachineConfigProps>;\n    output: MachineConfigAttributes | undefined;\n  }) => diff(news, output),\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: MachineConfigProps }) => read(olds),\n  reconcile: ({ news }: { news: MachineConfigProps }) => reconcile(news),\n};\n\nexport const TalosMachineConfigProvider = () =>\n  Provider.effect(TalosMachineConfig, Effect.succeed(TalosMachineConfig.Provider.of(handlers)));\n"
+  ],
+  "mappings": ";AAgBA;AACA;AAGA;AACA;;;ACNA;AACA;AACA;AACA;AACA;AAsBA,IAAM,aAAa,CAAC,WAAwB,OAAO,kBAAkB;AAQ9D,IAAM,kBAAkB,CAAC,WACvB,cACE,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,OAA2B;AAAA,EAC3C,MAAM,MAAM,WAAW,MAAM;AAAA,EAC7B,MAAM,SAAS,OAAoB,kBACjC,OACA,CAAC,MAAM,OAAO,gBAAgB,GAAG,OAAO,SAAS,KAAK,GACtD,EAAE,UAAU,OAAO,WAAW,MAAM,QAAQ,QAAQ,OAAO,UAAU,QAAQ,OAAO,CACtF,EAAE,KACA,QAAQ,OACD,eAAQ,CAAC,UACP,WACL;AAAA,IACE,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM,OAAO,KACZ,mBACA,iBACA,WAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAClC;AAAA,IACA,QAAQ,MAAM,OAAO,KACZ,mBACA,iBACA,WAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAClC;AAAA,EACF,GACA,EAAE,aAAa,YAAY,CAC7B,CACF,GACO,aACT;AAAA,EAEA,IAAI,OAAO,aAAa,GAAG;AAAA,IAEzB,OAAO,OAAc,YACnB,IAAI,MACF,cAAc,OAAO,SAAS,cAAc,OAAO,OAAO,QAAQ,MAAM,OAAO,QACjF,CACF;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,KAAK,MAAM,OAAO,MAAM;AAAA,EACvC,MAAM,OAAO,OAAO,MAAM;AAAA,EAC1B,MAAM,MAAM,OAAO,kBAAkB,OAAO;AAAA,EAC5C,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAAA,IAChD,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,OAAO,SAAS,gIACrB,CACF;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,GAAG,IAAI,IAAI,aAAa,mBAAmB,OAAO,WAAW,IAAI,aAAa;AAAA,EAatG,OAAc,WAAI;AAAA,IAChB,KAAK,MAAM;AAAA,MACT,MAAM,KAAK,SAAS,iBAAiB,MAAM,GAAK;AAAA,MAChD,IAAI;AAAA,QACF,cAAc,IAAI,GAAG;AAAA,gBACrB;AAAA,QACA,UAAU,EAAE;AAAA;AAAA;AAAA,IAGhB,OAAO,CAAC,UAAU,IAAI,MAAM,6BAA6B,OAAO,KAAK,GAAG;AAAA,EAC1E,CAAC;AAAA,EAED,OAAc,oBAAa,MAClB,kBAAW;AAAA,IAChB,KAAK,MAAM,IAAI,KAAK,eAAe,EAAE,OAAO;AAAA,IAC5C,OAAO,MAAG;AAAA,MAAG;AAAA;AAAA,EACf,CAAC,EAAE,KAAY,qBAAc,MAAG;AAAA,IAAG;AAAA,GAAS,CAAC,CAC/C;AAAA,EAEA,OAAO,EAAE,gBAAgB;AAAA,CAC1B,CACH;;;AC3HF;AACA;AACA;AACA;AAAA;AAEO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EACA;AAAA,EAFX,WAAW,CACA,SACA,UACT,QACA;AAAA,IACA,MAAM,YAAY,cAAc,OAAO,QAAQ,MAAM,QAAQ;AAAA,IAJpD;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AASO,IAAM,WAAW,CAAC,MAAyB,YACzC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,OAA2B;AAAA,EAC3C,MAAM,OAAO;AAAA,IACX,GAAG;AAAA,IACH;AAAA,IACA,QAAQ;AAAA,IACR,GAAI,QAAQ,UAAU,YAAY,CAAC,IAAI,CAAC,WAAW,QAAQ,MAAM,KAAK,GAAG,CAAC;AAAA,IAC1E,GAAI,QAAQ,cAAc,YAAY,CAAC,IAAI,CAAC,eAAe,QAAQ,UAAU,KAAK,GAAG,CAAC;AAAA,EACxF;AAAA,EACA,MAAM,SAAS,OAAoB,mBAAK,YAAY,MAAM;AAAA,IACxD,UAAU;AAAA,IACV,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,QAAQ;AAAA,EACV,CAAC,EAAE,KACD,QAAQ,OACD,gBAAQ,CAAC,UACP,YACL;AAAA,IACE,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM,OAAO,KACZ,oBACA,kBACA,YAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAClC;AAAA,IACA,QAAQ,MAAM,OAAO,KACZ,oBACA,kBACA,YAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAClC;AAAA,EACF,GACA,EAAE,aAAa,YAAY,CAC7B,CACF,GACO,cACT;AAAA,EAEA,MAAM,UAAU,KAAK,KAAK,GAAG;AAAA,EAC7B,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,OAAO,OAAc,aACnB,IAAI,WAAW,SAAS,OAAO,UAAU,OAAO,OAAO,MAAM,GAAG,GAAG,CAAC,CACtE;AAAA,EACF;AAAA,EACA,OAAO,OAAO;AAAA,CACf;AAGI,IAAM,oBAAoB,CAAC,MAAyB,YACzD,SAAS,MAAM,OAAO,EAAE,KACf,gBACL,CAAC,UACC,iBAAiB,cACjB,MAAM,aAAa,KACnB,+BAA+B,KAAK,MAAM,OAAO,GACnD,MAAa,gBAAQ,EAAE,CACzB,CACF;;;ACvFF;AAGO,IAAM,gBAAgB,CAAC,SAAiB,KAAK,QAAQ;AAGrD,IAAM,SAAS,CAAC,SACrB,WAAW,QAAQ,EAAE,OAAO,cAAc,IAAI,CAAC,EAAE,OAAO,KAAK;AAGxD,IAAM,eAAe,CAAC,SAAiB,OAAO,IAAI;AAqBlD,IAAM,qBAAqB,CAChC,UACA,gBACuF;AAAA,EACvF,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,IAAI,KAAK,MAAM,QAAQ;AAAA,IAC7B,MAAM;AAAA,IACN;AAAA;AAAA,EAGF,MAAM,MAAM,IAAI,UAAU,KAAK,CAAC,QAAQ,IAAI,SAAS,WAAW,GAAG;AAAA,EACnE,MAAM,cAAc,KAAK;AAAA,EACzB,MAAM,WAAW,KAAK;AAAA,EACtB,IAAI,gBAAgB,aAAa,aAAa;AAAA,IAAW;AAAA,EAEzD,MAAM,UAAU,IAAI,UAAU,KAAK,CAAC,QAAQ,IAAI,SAAS,WAAW,GAAG;AAAA,EACvE,MAAM,OAAO,IAAI,OAAO,KAAK,CAAC,QAAQ,IAAI,SAAS,QAAQ,GAAG;AAAA,EAC9D,MAAM,WAAW,SAAS;AAAA,EAC1B,MAAM,KAAK,UAAU;AAAA,EACrB,MAAM,OAAO,OAAO,8BAA8B,OAAO;AAAA,EACzD,IAAI,aAAa,aAAa,OAAO,aAAa,SAAS;AAAA,IAAW;AAAA,EAEtE,OAAO;AAAA,IACL,eAAe,OAAO,EAAE;AAAA,IACxB,mBAAmB,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AAAA;AAIK,IAAM,oBAAoB,CAAC,UAAkB,eAClD,WAAW,WAAW,GAAG,IAAI,aAAa,GAAG,YAAY;;;AHJpD,IAAM,kBAAkB,SAA0B,kBAAkB;AAE3E,IAAM,aAAa,CAAC,SAKd,OAAO,GAAG,KAAK;AAAA,EAAY,KAAK;AAAA,EAAa,KAAK;AAAA,EAAkB,KAAK,mBAAmB;AAElG,IAAM,eAAe,CAAC,WAAwC;AAAA,EAC5D,MAAM,EAAE,SAAS,MAAM,SAAS,MAAM,cAAc,MAAM,MAAM,YAAY;AAC9E;AAEA,IAAM,eAAe,CAAC,UACb,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAc,mBAAW;AAAA,IACpC,KAAK,MAAM,IAAI,KAAK,MAAM,WAAW,EAAE,KAAK;AAAA,IAC5C,OAAO,CAAC,UAAU,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,EAC3C,CAAC,EAAE,KAAY,sBAAc,MAAG;AAAA,IAAG;AAAA,GAA+B,CAAC;AAAA,EACnE,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,OAAO,mBAAmB,MAAM,MAAM,OAAO;AAAA,EACnD,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,OAAO;AAAA,IACL,iCAAiC,KAAK;AAAA,IACtC,8BAA8B,KAAK;AAAA,IACnC,YAAY,aAAa,KAAK;AAAA,IAC9B,SAAS,MAAM;AAAA,IACf,sBAAsB,WAAW,KAAK,MAAM,SAAS,MAAM,QAAQ,CAAC;AAAA,IACpE,UAAU,KAAK;AAAA,EACjB;AAAA,CACD;AAEH,IAAM,OAAO,CAAC,UACZ,aAAa,KAAK,EAAE,KACX,YAAI,CAAC,SACV,SAAS,YACL;AAAA,EACE,iCAAiC;AAAA,EACjC,8BAA8B;AAAA,EAC9B,YAAY,aAAa,KAAK;AAAA,EAC9B,SAAS,MAAM;AAAA,EACf,sBAAsB;AAAA,EACtB,UAAU;AACZ,IACA,IACN,CACF;AAEF,IAAM,OAAO,CAAC,MAA8B,WACnC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,WAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,EAC7B,IACE,KAAK,yBAAyB,MAC9B,OAAO,yBAAyB,KAAK,wBACrC,OAAO,YAAY,KAAK,WACxB,OAAO,aAAa,KAAK,UACzB;AAAA,IACA,OAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B;AAAA,EACA,OAAO,EAAE,QAAQ,SAAS;AAAA,CAC3B;AAEH,IAAM,YAAY,CAAC,UACV,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,gBAAgB,MAAM,MAAM;AAAA,EACtD,OAAO,SACL;AAAA,IACE;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,EACR,GACA,EAAE,OAAO,CAAC,MAAM,IAAI,GAAG,iBAAiB,WAAW,gBAAgB,CACrE;AAAA,EACA,MAAM,OAAO,OAAO,aAAa,KAAK;AAAA,EACtC,IAAI,SAAS,WAAW;AAAA,IACtB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,MAAM,gFACP,oEACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAEH,IAAM,WAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAII,KAAK,MAAM,MAAM;AAAA,EACvB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAsC,KAAK,IAAI;AAAA,EACxD,WAAW,GAAG,WAAsC,UAAU,IAAI;AACpE;AAEO,IAAM,0BAA0B,MAC5B,gBAAO,iBAAwB,gBAAQ,gBAAgB,SAAS,GAAG,QAAQ,CAAC,CAAC;;AIhKxF,qBAAS;AACT,uBAAS;AAET;AACA;AAyBO,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EAExE,sBAAsB;AACxB,CAAC;AAMD,IAAM,iBAAiB,CAAC,OAAuB,oBAC7C,SAAS,CAAC,OAAO,eAAe,MAAM,MAAM,GAAG;AAAA,EAC7C,OAAO,CAAC,MAAM,IAAI;AAAA,EAClB;AACF,CAAC,EAAE,KACM,YAAI,CAAC,SAAS,KAAK,SAAS,MAAM,KAAK,KAAK,SAAS,UAAU,CAAC,GAChE,sBAAc,MAAM,KAAK,CAClC;AAEF,IAAM,QAAO,CAAC,UACL,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,gBAAgB,MAAM,MAAM;AAAA,EACtD,MAAM,eAAe,OAAO,eAAe,OAAO,WAAW,eAAe;AAAA,EAC5E,OAAO,EAAE,cAAc,MAAM,MAAM,KAAK;AAAA,CACzC;AAEH,IAAM,QAAO,CAAC,MAA6B,WAClC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,MAAM,OAAO,OAAO,MAAK,IAAI;AAAA,EAC7B,IAAI,KAAK;AAAA,IAAc,OAAO,EAAE,QAAQ,OAAO;AAAA,EAC/C,OAAO,EAAE,QAAQ,SAAS;AAAA,CAC3B;AAEH,IAAM,aAAY,CAAC,UACV,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,gBAAgB,MAAM,MAAM;AAAA,EACtD,MAAM,SAAS,OAAO,eAAe,OAAO,WAAW,eAAe;AAAA,EACtE,IAAI,CAAC,QAAQ;AAAA,IACX,OAAO,kBAAkB,CAAC,WAAW,GAAG;AAAA,MACtC,OAAO,CAAC,MAAM,IAAI;AAAA,MAClB,iBAAiB,WAAW;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EACA,MAAM,QAAQ,OAAO,eAAe,OAAO,WAAW,eAAe;AAAA,EACrE,IAAI,CAAC,OAAO;AAAA,IACV,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,MAAM,0EACP,qDACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,EAAE,cAAc,MAAM,MAAM,MAAM,KAAK;AAAA,CAC/C;AAEH,IAAM,YAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAII,MAAK,MAAM,MAAM;AAAA,EACvB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAqC,MAAK,IAAI;AAAA,EACvD,WAAW,GAAG,WAAqC,WAAU,IAAI;AACnE;AAEO,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,gBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACnGtF,qBAAS;AACT,uBAAS;AAET;AACA;AAkCO,IAAM,qBAAqB,UAA6B,qBAAqB;AAEpF,IAAM,UAAU,CAAC,UACf,UAAU,aAAa,MAAM,WAAW,IAAI,KAAK,MAAM,KAAK,GAAG;AAEjE,IAAM,aAAa,CAAC,OAA2B,gBAAwB;AAAA,EACrE,MAAM,OAAO,CAAC,UAAU,kBAAkB,WAAW;AAAA,EACrD,MAAM,KAAK,QAAQ,MAAM,iBAAiB;AAAA,EAC1C,MAAM,UAAU,QAAQ,MAAM,WAAW;AAAA,EACzC,IAAI,OAAO;AAAA,IAAI,KAAK,KAAK,yBAAyB,EAAE;AAAA,EACpD,IAAI,YAAY;AAAA,IAAI,KAAK,KAAK,kBAAkB,OAAO;AAAA,EACvD,OAAO;AAAA;AAGT,IAAM,QAAQ,CAAC,OAA2B,gBACjC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,gBAAgB,MAAM,MAAM;AAAA,EACtD,OAAO,SAAS,WAAW,OAAO,WAAW,GAAG;AAAA,IAC9C,OAAO,CAAC,GAAG,MAAM,iBAAiB;AAAA,IAClC,iBAAiB,WAAW;AAAA,EAC9B,CAAC;AAAA,EACD,OAAO;AAAA,IACL,mBAAmB,QAAQ,MAAM,iBAAiB;AAAA,IAClD,SAAS;AAAA,IACT,aAAa,QAAQ,MAAM,WAAW;AAAA,EACxC;AAAA,CACD;AAEH,IAAM,QAAO,CAAC,UACZ,MAAM,OAAO,IAAI,EAAE,KACV,sBAAc,OAAO;AAAA,EAC1B,mBAAmB,QAAQ,MAAM,iBAAiB;AAAA,EAClD,SAAS;AAAA,EACT,aAAa,QAAQ,MAAM,WAAW;AACxC,EAAE,CACJ;AAEF,IAAM,QAAO,CAAC,MAAiC,WACtC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,MAAM,OAAO,OAAO,MAAK,IAAI;AAAA,EAC7B,IAAI,KAAK;AAAA,IAAS,OAAO,EAAE,QAAQ,OAAO;AAAA,EAC1C,OAAO,EAAE,QAAQ,SAAS;AAAA,CAC3B;AAEH,IAAM,aAAY,CAAC,UACjB,MAAM,OAAO,MAAM,eAAe,OAAO,EAAE,KAClC,iBACL,CAAC,UACC,IAAI,MACF,uBAAuB,MAAM,OAAO,yCAClC,GAAG,MAAM,eAAe,aAAa,OAAO,KAAK,GACrD,CACJ,CACF;AAEF,IAAM,YAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAII,MAAK,MAAM,MAAM;AAAA,EACvB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAyC,MAAK,IAAI;AAAA,EAC3D,WAAW,GAAG,WAAyC,WAAU,IAAI;AACvE;AAEO,IAAM,6BAA6B,MAC/B,iBAAO,oBAA2B,gBAAQ,mBAAmB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AC7G9F,qBAAS;AACT,uBAAS;AAET;AACA;AAMA,IAAM,YAAY,IAAI,IAAI,MAAM,YAAY,GAAG,EAAE;AAqC1C,IAAM,qBAAqB,UAA6B,qBAAqB;AAEpF,IAAM,aAAa,CAAC,UACX,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,kBAAkB,WAAW,MAAM,UAAU;AAAA,EAC1D,MAAM,OAAO,OAAc,mBAAW;AAAA,IACpC,KAAK,MAAM,IAAI,KAAK,IAAI,EAAE,KAAK;AAAA,IAC/B,OAAO,CAAC,UAAU,IAAI,MAAM,WAAW,MAAM,eAAe,OAAO,KAAK,GAAG;AAAA,EAC7E,CAAC;AAAA,EACD,OAAO,aAAa,IAAI;AAAA,CACzB;AAGH,IAAM,aAAa,CAAC,OAA2B,oBAC7C,SAAS,CAAC,OAAO,iBAAiB,MAAM,MAAM,GAAG;AAAA,EAC/C,OAAO,CAAC,MAAM,IAAI;AAAA,EAClB;AACF,CAAC,EAAE,KACM,YAAI,CAAC,SAAS,aAAa,IAAI,CAAC,GAChC,sBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CACtC;AAEF,IAAM,QAAO,CAAC,UACL,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO,WAAW,KAAK;AAAA,EACtC,MAAM,aAAa,OAAO,gBAAgB,MAAM,MAAM;AAAA,EACtD,MAAM,OAAO,OAAO,WAAW,OAAO,WAAW,eAAe;AAAA,EAChE,OAAO;AAAA,IACL,cAAc;AAAA,IACd,WAAW,SAAS;AAAA,IACpB,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM;AAAA,EACd;AAAA,CACD;AAEH,IAAM,QAAO,CAAC,MAAiC,WACtC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,MAAM,OAAO,OAAO,MAAK,IAAI;AAAA,EAC7B,IAAI,KAAK;AAAA,IAAW,OAAO,EAAE,QAAQ,OAAO;AAAA,EAC5C,OAAO,EAAE,QAAQ,SAAS;AAAA,CAC3B;AAEH,IAAM,aAAY,CAAC,UACV,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,kBAAkB,WAAW,MAAM,UAAU;AAAA,EAC1D,MAAM,SAAS,OAAO,WAAW,KAAK;AAAA,EACtC,MAAM,aAAa,OAAO,gBAAgB,MAAM,MAAM;AAAA,EACtD,MAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,QAAQ;AAAA,IACd,GAAI,MAAM,aAAa,OAAO,CAAC,YAAY,IAAI,CAAC;AAAA,EAClD;AAAA,EACA,OAAO,SAAS,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,GAAG,iBAAiB,WAAW,gBAAgB,CAAC;AAAA,EAC1F,MAAM,OAAO,OAAO,WAAW,OAAO,WAAW,eAAe;AAAA,EAChE,IAAI,SAAS,QAAQ;AAAA,IACnB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,MAAM,kFACP,qDACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL,cAAc;AAAA,IACd,WAAW;AAAA,IACX,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM;AAAA,EACd;AAAA,CACD;AAEH,IAAM,YAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAII,MAAK,MAAM,MAAM;AAAA,EACvB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAyC,MAAK,IAAI;AAAA,EAC3D,WAAW,GAAG,WAAyC,WAAU,IAAI;AACvE;AAEO,IAAM,6BAA6B,MAC/B,iBAAO,oBAA2B,gBAAQ,mBAAmB,SAAS,GAAG,SAAQ,CAAC,CAAC;",
+  "debugId": "6CD90391393B548364756E2164756E21",
+  "names": []
+}

package/dist/talos/kubeconfig.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `Talos.Kubeconfig` — fetch admin kubeconfig so `Kubernetes.*` workloads can connect.
+ *
+ * ★ REASONED FROM talosctl kubeconfig (Talos v1.13 CLI reference): writes a kubeconfig file;
+ *   `--merge=false` keeps it isolated; `-f/--force` overwrites an existing file.
+ *
+ * ⛔ THE KUBECONFIG FILE CONTAINS A CLIENT CERTIFICATE — IT MUST NOT BE AN ATTRIBUTE. Alchemy
+ *   persists attributes unencrypted. This resource:
+ *     - writes the file to `runtimePath` at reconcile time (re-minted each deploy),
+ *     - persists ONLY public metadata + fingerprints,
+ *     - exposes a `connection` field referencing the runtime path for `Kubernetes.ClusterAdapter`.
+ *
+ * ⚠️ `runtimePath` IS PERSISTED AS A STRING, NOT AS FILE CONTENTS. The path is a contract between
+ *   this resource and the host filesystem — same pattern as pointing Kubernetes.KubeConfig at
+ *   `/opt/homeflare/...` rendered outside Postgres.
+ */
+import { Resource } from 'alchemy';
+import type { Connection } from 'alchemy/Kubernetes/Connection';
+import * as Provider from 'alchemy/Provider';
+import type { TalosRequirements, WithTarget } from './resource.ts';
+export interface KubeconfigProps extends WithTarget {
+    /** Node that serves `talosctl kubeconfig`. */
+    node: string;
+    /** Context name inside the generated kubeconfig — not secret. */
+    context: string;
+    /**
+     * Host path where talosctl writes the kubeconfig each reconcile.
+     *
+     * ⛔ Must be outside Alchemy state and rotated by redeploy, never copied into attributes.
+     */
+    runtimePath: string;
+    after?: readonly unknown[];
+}
+export interface KubeconfigAttributes {
+    context: string;
+    endpoint: string;
+    certificateAuthorityFingerprint: string;
+    clientCertificateFingerprint: string;
+    /** Digest of endpoint+context+fingerprints — detects credential rotation without storing PEM. */
+    credentialGeneration: string;
+    /**
+     * Serializable `Kubernetes.Connection` for downstream workloads.
+     *
+     * ★ auth.kind `kubeconfig` is the stock ClusterAdapter — provider-roadmap.md names this seam.
+     *   Only `path` and `context` appear here; the adapter reads credentials from disk at call time.
+     */
+    connection: Connection;
+}
+export interface TalosKubeconfig extends Resource<'Talos.Kubeconfig', KubeconfigProps, KubeconfigAttributes, never, TalosRequirements> {
+}
+export declare const TalosKubeconfig: import("alchemy").ResourceClass<TalosKubeconfig>;
+export declare const TalosKubeconfigProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosKubeconfig>, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+//# sourceMappingURL=kubeconfig.d.ts.map

package/dist/talos/kubeconfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubeconfig.d.ts","sourceRoot":"","sources":["../../src/talos/kubeconfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAInE,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B,EAAE,MAAM,CAAC;IACxC,4BAA4B,EAAE,MAAM,CAAC;IACrC,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,eAAe,kDAAgD,CAAC;AAuG7E,eAAO,MAAM,uBAAuB,0JACqD,CAAC"}

package/dist/talos/resource.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Talos has no REST CRUD factory — and pretending otherwise would lie in every plan.
+ *
+ * ⛔ THE FORGEJO/PVE FACTORY IS create / read / update / delete OVER ONE JSON OBJECT AT ONE PATH.
+ *   Talos machine configuration is `talosctl apply-config`; bootstrap is a one-shot
+ *   `talosctl bootstrap`; health is `talosctl health`; kubeconfig is `talosctl kubeconfig`. None
+ *   of those are the same four operations with a different path — bootstrap cannot be deleted,
+ *   health is a gate not an object, and kubeconfig must not round-trip credential bytes through
+ *   Postgres. Copying forgejoOperations here would force `matches` to compare a declaration to
+ *   itself and answer `noop` forever, exactly the failure mode documented on Proxmox.NetworkApply.
+ *
+ * ★ SO EACH FAMILY BELOW HAND-WRITES THE FIVE PROVIDER HANDLERS, LIKE network-apply.ts and
+ *   sdn-apply.ts. Shared pieces are credentials.ts (mint) and talosctl.ts (spawn).
+ *
+ * ⚠️ EVERY CLAIM ABOUT talosctl FLAGS IN THIS PACKAGE IS REASONED FROM THE PUBLISHED CLI REFERENCE
+ *   (Talos v1.13 docs, fetched 2026-09-13 in this session). Nothing was measured on a live cluster.
+ */
+import type * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
+import type { TalosTarget } from './credentials.ts';
+/**
+ * ★ WHAT EVERY OPERATION HERE NEEDS FROM THE RUNTIME — ChildProcessSpawner only.
+ *
+ *   Talos credentials are minted by shelling out to `bao` and then shelling out to `talosctl`.
+ *   There is no HttpClient call in this package on purpose: the published operator surface is the
+ *   CLI, and a parallel gRPC client would be a second SDK the repo rules forbid.
+ */
+export type TalosRequirements = ChildProcessSpawner.ChildProcessSpawner;
+/** Every resource names which cluster's OpenBao mount it uses. */
+export type WithTarget = {
+    target: TalosTarget;
+};
+//# sourceMappingURL=resource.d.ts.map

package/dist/talos/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/talos/resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AACxF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,mBAAmB,CAAC;AAExE,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC"}

package/dist/talos/talos-bootstrap.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `Talos.Bootstrap` — initialize etcd once on ONE control-plane node.
+ *
+ * ★ REASONED FROM talosctl bootstrap (Talos v1.13 CLI reference): one node aborts the etcd join
+ *   loop and forms the initial cluster; other control-plane nodes join after Kubernetes starts on
+ *   the bootstrap node. This command must run exactly once per cluster.
+ *
+ * ⛔ NOT A FACTORY RESOURCE — bootstrap cannot be deleted or updated in place; `delete` is a no-op.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type { TalosRequirements, WithTarget } from './resource.ts';
+export interface BootstrapProps extends WithTarget {
+    /** The ONE control-plane node that receives `talosctl bootstrap`. */
+    node: string;
+    /** Machine configs for this node (and peers) must be applied first. */
+    after?: readonly unknown[];
+}
+export interface BootstrapAttributes {
+    node: string;
+    bootstrapped: boolean;
+}
+export interface TalosBootstrap extends Resource<'Talos.Bootstrap', BootstrapProps, BootstrapAttributes, never, TalosRequirements> {
+}
+export declare const TalosBootstrap: import("alchemy").ResourceClass<TalosBootstrap>;
+export declare const TalosBootstrapProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosBootstrap>, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+//# sourceMappingURL=talos-bootstrap.d.ts.map

package/dist/talos/talos-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"talos-bootstrap.d.ts","sourceRoot":"","sources":["../../src/talos/talos-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAGzB,CAAC;AAkEH,eAAO,MAAM,sBAAsB,yJACoD,CAAC"}

package/dist/talos/talos-cluster-health.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `Talos.ClusterHealth` — readiness gate other resources can depend on via `after`.
+ *
+ * ★ REASONED FROM talosctl health (Talos v1.13 CLI reference): checks Talos services, etcd, and
+ *   Kubernetes component health; `--wait-timeout` defaults to 20m0s.
+ *
+ * ⚠️ PLAN READS USE A SHORT TIMEOUT SO `plan` DOES NOT BLOCK TWENTY MINUTES. Reconcile uses the
+ *   declared timeout — that is the deploy gate, not the plan gate.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type { TalosRequirements, WithTarget } from './resource.ts';
+export interface ClusterHealthProps extends WithTarget {
+    /** Control-plane node IPs passed to `--control-plane-nodes`. */
+    controlPlaneNodes: readonly string[];
+    /** Worker node IPs passed to `--worker-nodes`. */
+    workerNodes?: readonly string[];
+    /**
+     * Reconcile wait (`--wait-timeout`), e.g. `20m0s`. Default from published CLI.
+     *
+     * ⚠️ REASONED default — not measured here.
+     */
+    waitTimeout?: string;
+    /** Bootstrap and kubeconfig should complete before health is enforced. */
+    after?: readonly unknown[];
+}
+export interface ClusterHealthAttributes {
+    healthy: boolean;
+    controlPlaneNodes: string;
+    workerNodes: string;
+}
+export interface TalosClusterHealth extends Resource<'Talos.ClusterHealth', ClusterHealthProps, ClusterHealthAttributes, never, TalosRequirements> {
+}
+export declare const TalosClusterHealth: import("alchemy").ResourceClass<TalosClusterHealth>;
+export declare const TalosClusterHealthProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosClusterHealth>, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+//# sourceMappingURL=talos-cluster-health.d.ts.map

package/dist/talos/talos-cluster-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"talos-cluster-health.d.ts","sourceRoot":"","sources":["../../src/talos/talos-cluster-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,gEAAgE;IAChE,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kDAAkD;IAClD,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAAsD,CAAC;AAsEtF,eAAO,MAAM,0BAA0B,6JACwD,CAAC"}

package/dist/talos/talos-machine-config.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `Talos.MachineConfig` — apply one machine configuration document to one node.
+ *
+ * ★ REASONED FROM talosctl apply-config (Talos v1.13 CLI reference): `-f/--file`, `-n/--nodes`,
+ *   `-m/--mode`, `-i/--insecure` for maintenance mode, `--dry-run` for planning without a write.
+ *
+ * ⛔ THE CONFIG BODY IS NEVER AN ATTRIBUTE. Machine configs can embed cluster tokens; only a digest
+ *   of the repo file is persisted. Read `configFile` from disk at reconcile time.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type { TalosRequirements, WithTarget } from './resource.ts';
+export type ApplyMode = 'auto' | 'no-reboot' | 'reboot' | 'staged' | 'try';
+export interface MachineConfigProps extends WithTarget {
+    /** Node IP or hostname — the `-n` target. */
+    node: string;
+    /** Repo-relative or absolute path to the YAML file passed to `-f`. */
+    configFile: string;
+    /** talosctl `-m` mode. Default `auto` per published CLI. */
+    mode?: ApplyMode;
+    /**
+     * Maintenance-mode apply only (`-i`). Default false — post-bootstrap applies use talosconfig auth.
+     *
+     * ⚠️ REASONED: docs describe `--insecure` for the first apply before talosconfig exists.
+     */
+    insecure?: boolean;
+    /** Ordering edge — e.g. wait for Proxmox.Vm. */
+    after?: readonly unknown[];
+}
+export interface MachineConfigAttributes {
+    node: string;
+    configDigest: string;
+    mode: ApplyMode;
+    /** True when the node's reported config digest matches the declared file. */
+    converged: boolean;
+}
+export interface TalosMachineConfig extends Resource<'Talos.MachineConfig', MachineConfigProps, MachineConfigAttributes, never, TalosRequirements> {
+}
+export declare const TalosMachineConfig: import("alchemy").ResourceClass<TalosMachineConfig>;
+export declare const TalosMachineConfigProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosMachineConfig>, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+//# sourceMappingURL=talos-machine-config.d.ts.map

package/dist/talos/talos-machine-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"talos-machine-config.d.ts","sourceRoot":"","sources":["../../src/talos/talos-machine-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAMnE,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE3E,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gDAAgD;IAChD,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB,6EAA6E;IAC7E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAAsD,CAAC;AAwFtF,eAAO,MAAM,0BAA0B,6JACwD,CAAC"}

package/dist/talos/talosctl.d.ts

@@ -0,0 +1,29 @@
+/**
+ * One `talosctl` invocation — stdout/stderr captured, secrets never echoed.
+ *
+ * ★ SHELL OUT LIKE ALCHEMY'S DOCKER PROVIDER (ChildProcessSpawner), NOT A SECOND SDK. Talos speaks
+ *   gRPC; the published, stable surface for operators is `talosctl`. No Talos npm package is added.
+ *
+ * ⚠️ REASONED FROM docs.siderolabs.com/talos/v1.13/reference/cli — nothing here was measured on a
+ *   live cluster in this session.
+ *
+ * ⛔ DO NOT LOG STDOUT ON FAILURE. `talosctl kubeconfig` and error paths have been observed in the
+ *   wild to include credential material; stderr is the safe diagnostic channel.
+ */
+import * as Effect from 'effect/Effect';
+import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
+export declare class TalosError extends Error {
+    readonly command: string;
+    readonly exitCode: number;
+    constructor(command: string, exitCode: number, detail: string);
+}
+export type TalosRunOptions = {
+    readonly talosconfigPath: string;
+    readonly nodes?: readonly string[];
+    readonly endpoints?: readonly string[];
+};
+/** Run `talosctl <args…>`. Returns trimmed stdout, or '' when empty. */
+export declare const talosctl: (args: readonly string[], options: TalosRunOptions) => Effect.Effect<string, import("effect/PlatformError").PlatformError | TalosError, ChildProcessSpawner.ChildProcessSpawner>;
+/** Like `talosctl`, but exit code 1 with "already" in stderr is treated as success. */
+export declare const talosctlOrAlready: (args: readonly string[], options: TalosRunOptions) => Effect.Effect<string, import("effect/PlatformError").PlatformError, ChildProcessSpawner.ChildProcessSpawner>;
+//# sourceMappingURL=talosctl.d.ts.map

package/dist/talos/talosctl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"talosctl.d.ts","sourceRoot":"","sources":["../../src/talos/talosctl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAF3B,YACW,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,EAIf;CACF;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,QAAQ,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,8HA8CtE,CAAC;AAEL,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,iHAShF,CAAC"}

package/dist/talos/values.d.ts

@@ -0,0 +1,20 @@
+/** Trim trailing whitespace only — leading space in YAML is meaningful. */
+export declare const canonicalText: (text: string) => string;
+/** SHA-256 hex digest of canonical text. Safe to persist — it is not reversible to the input. */
+export declare const sha256: (text: string) => string;
+/** Digest of a machine config file read from the repo. ⛔ Never persist the file body itself. */
+export declare const configDigest: (text: string) => string;
+/**
+ * Public metadata extracted from a kubeconfig file on disk.
+ *
+ * ⛔ RETURNS FINGERPRINTS ONLY. The admin kubeconfig contains a client certificate; Alchemy state
+ *   may hold the API server URL and CA/client cert digests, never the PEM bytes.
+ */
+export declare const kubeconfigMetadata: (yamlText: string, contextName: string) => {
+    endpoint: string;
+    caFingerprint: string;
+    clientFingerprint: string;
+} | undefined;
+/** Resolve a config file path relative to the declaring stack file. */
+export declare const resolveConfigPath: (stackDir: string, configFile: string) => string;
+//# sourceMappingURL=values.d.ts.map

package/dist/talos/values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../src/talos/values.ts"],"names":[],"mappings":"AAQA,2EAA2E;AAC3E,eAAO,MAAM,aAAa,SAAU,MAAM,WAAmB,CAAC;AAE9D,iGAAiG;AACjG,eAAO,MAAM,MAAM,SAAU,MAAM,WAC6B,CAAC;AAEjE,gGAAgG;AAChG,eAAO,MAAM,YAAY,SAAU,MAAM,WAAiB,CAAC;AAe3D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,aACnB,MAAM,eACH,MAAM,KAClB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,SAyB3E,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,aAAc,MAAM,cAAc,MAAM,WACC,CAAC"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@homeflare/alchemy",
+  "version": "0.1.0",
+  "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo and Talos.",
+  "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
+  "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",
+  "license": "MIT",
+  "author": "Timothy Schneider",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/taslabs-net/homeflare-kit.git",
+    "directory": "packages/alchemy"
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./cloudflare": {
+      "types": "./dist/cloudflare/index.d.ts",
+      "default": "./dist/cloudflare/index.js"
+    },
+    "./forgejo": {
+      "types": "./dist/forgejo/index.d.ts",
+      "default": "./dist/forgejo/index.js"
+    },
+    "./openbao": {
+      "types": "./dist/openbao/index.d.ts",
+      "default": "./dist/openbao/index.js"
+    },
+    "./talos": {
+      "types": "./dist/talos/index.d.ts",
+      "default": "./dist/talos/index.js"
+    },
+    "./proxmox": {
+      "types": "./dist/proxmox/index.d.ts",
+      "default": "./dist/proxmox/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "alchemy": ">=2.0.0-beta.77",
+    "cloudflare": ">=4.5.0",
+    "effect": ">=4.0.0-rc.112"
+  }
+}

package/src/cloudflare/client.ts

@@ -0,0 +1,76 @@
+/**
+ * The Cloudflare REST API as an Effect service, over `cloudflare-typescript`. Codex standard 5:
+ * the vendor's SDK, never a hand-rolled client — and never a hand-rolled `fetch` either.
+ *
+ * ⛔ THE SDK WAS ALREADY IN THE STORE AND DECLARED BY NOBODY. Measured 2026-09-15:
+ *   `node_modules/.pnpm/cloudflare@4.5.0` exists as a transitive dependency of `alchemy`, and
+ *   `pnpm ls cloudflare --depth 0` at the root and in every workspace package returns nothing.
+ *   `house/local/scripts/vendor-sdk-ratchet.ts` row R2 says exactly that — "not declared anywhere
+ *   in the workspace yet … the row adds the dependency once, then converts the TS callers" — so
+ *   this package is that row's first half, and the twenty ratcheted offences keep their rows.
+ *
+ * ⛔ AND IT IS PINNED EXACTLY, NOT `catalog:`. There is no catalog entry for `cloudflare`, and the
+ *   version that resolves today is the one alchemy pulls in. Pinning `4.5.0` means a future
+ *   alchemy bump moves alchemy's copy and not this package's contract — the alternative is a
+ *   provider whose request shape changes because an unrelated dependency was upgraded.
+ *
+ * ⚠️ `fetch` IS A SEAM, NOT A CONVENIENCE — the same argument `packages/litellm-client` makes. The
+ *   SDK hands its custom fetch the URL and init it built, so a test double conforming to
+ *   `Core.Fetch` exercises the real path assembly, the real body serialisation and the real header
+ *   set. A test that stubbed `client.r2.buckets.locks.update` would prove only that a stub was
+ *   called, which is precisely the class of check this estate keeps finding green over nothing.
+ */
+import Cloudflare from 'cloudflare';
+import * as Config from 'effect/Config';
+import * as Context from 'effect/Context';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as Redacted from 'effect/Redacted';
+
+/** What the SDK accepts for `fetch`, restated so tests can name it without importing SDK internals. */
+export type ClientFetch = (url: string | URL | Request, init?: RequestInit) => Promise<Response>;
+
+export class CloudflareApi extends Context.Service<CloudflareApi, Cloudflare>()(
+  'homeflare/CloudflareApi',
+) {}
+
+/**
+ * ⚠️ THE FAKE FETCH IS THE ONLY REASON THIS TAKES OPTIONS AT ALL. Everything else the SDK reads
+ *   from the environment the estate CLI already populates.
+ */
+export const makeClient = (options: { apiToken: string; fetch?: ClientFetch }): Cloudflare =>
+  new Cloudflare({
+    apiToken: options.apiToken,
+    ...(options.fetch === undefined ? {} : { fetch: options.fetch }),
+  });
+
+/**
+ * ⛔ FAIL CLOSED ON THE VALUE, NEVER ON THE VARIABLE EXISTING. AGENTS.md "the four that cost the
+ *   most" §4: a denied OpenBao path renders the template EMPTY rather than erroring, and every
+ *   Cloudflare call then answers 403 exactly like a revoked token — which sends the operator to
+ *   Cloudflare to rotate a credential that was fine. Your deploy wrapper should write
+ *   CLOUDFLARE_API_TOKEN from the stack's declared role, short-lived and scoped.
+ */
+const MISSING_TOKEN =
+  'CLOUDFLARE_API_TOKEN is not set. Mint a short-lived, scoped token and export it before ' +
+  'role named in estate.stack.ts; running `alchemy` directly skips that and there is no default.';
+
+const EMPTY_TOKEN =
+  'CLOUDFLARE_API_TOKEN is set but EMPTY. That is a denied or missing OpenBao grant on the ' +
+  'stack’s role, not a rotated token — re-mint it rather than rotating anything at Cloudflare.';
+
+/**
+ * ⛔ A LAYER'S ERROR CHANNEL MUST BE `never`, so a ConfigError becomes a defect carrying a sentence
+ *   rather than a type error pushed up into `Stack`. Same decision, same words, as `LiteLLMLive`.
+ */
+export const CloudflareApiLive = Layer.effect(
+  CloudflareApi,
+  Effect.gen(function* () {
+    const token = yield* Config.redacted('CLOUDFLARE_API_TOKEN').pipe(
+      Effect.catchTag('ConfigError', () => Effect.die(new Error(MISSING_TOKEN))),
+    );
+    const value = Redacted.value(token);
+    if (value.length === 0) return yield* Effect.die(new Error(EMPTY_TOKEN));
+    return makeClient({ apiToken: value });
+  }),
+);

package/src/cloudflare/index.ts

@@ -0,0 +1,10 @@
+/**
+ * Cloudflare providers for Alchemy — the gaps the vendor SDK leaves.
+ *
+ * ★ Built on the official `cloudflare` SDK, not hand-rolled HTTP: it already has
+ *   `r2.buckets.locks.update/get` over the documented endpoints, so there is no path
+ *   string this package invents.
+ */
+export type { R2LockRule } from './lock-rules.ts';
+export { R2BucketLock, type R2BucketLockProps } from './r2-bucket-lock.ts';
+export { providers } from './providers.ts';

package/src/cloudflare/lock-rules.ts

@@ -0,0 +1,60 @@
+/**
+ * The vocabulary of an R2 lock rule, and the comparison that decides whether to write one.
+ *
+ * ★ ITS OWN MODULE FOR THE REASON `house/litellm/src/equal.ts` IS ONE: the comparison is the
+ *   riskiest function in the provider and it deserves to be readable and testable without the
+ *   lifecycle around it. An equality that returned true for everything would make every reconcile
+ *   a no-op and the resource would silently never write anything — which looks exactly like a
+ *   converged stack.
+ */
+/** Jurisdictions the API accepts, as the SDK declares them. */
+export type Jurisdiction = 'default' | 'eu' | 'fedramp';
+
+/**
+ * One lock rule. ⚠️ `prefix` OMITTED MEANS THE WHOLE BUCKET — the SDK documents an empty prefix as
+ * the way to scope a rule to every object, and omitting the key is how that is spelled on the wire.
+ */
+export type R2LockRule = {
+  readonly id: string;
+  readonly enabled: boolean;
+  readonly prefix?: string;
+  readonly condition:
+    | { readonly type: 'Age'; readonly maxAgeSeconds: number }
+    | { readonly type: 'Date'; readonly date: string }
+    | { readonly type: 'Indefinite' };
+};
+
+/** ⚠️ `undefined` and `'default'` are the same jurisdiction; normalise so a diff never sees both. */
+export const jurisdictionOf = (props: { readonly jurisdiction?: Jurisdiction }): Jurisdiction =>
+  props.jurisdiction ?? 'default';
+
+/**
+ * ⛔ FIELD BY FIELD, IN ORDER, AND NOT `JSON.stringify` OF EITHER SIDE. The API returns rules in
+ *   its own key order and omits `prefix` where this repo may spell it `''`; a stringify compare
+ *   would report drift on every plan and PUT an identical body each deploy. Order across the list
+ *   IS compared, because the rule set is a replace and the list is what gets sent.
+ */
+export function rulesEqual(a: readonly R2LockRule[], b: readonly R2LockRule[]): boolean {
+  if (a.length !== b.length) return false;
+  return a.every((left, index) => {
+    const right = b[index];
+    if (right === undefined) return false;
+    if (left.id !== right.id || left.enabled !== right.enabled) return false;
+    if ((left.prefix ?? '') !== (right.prefix ?? '')) return false;
+    const [lc, rc] = [left.condition, right.condition];
+    if (lc.type !== rc.type) return false;
+    if (lc.type === 'Age') return rc.type === 'Age' && lc.maxAgeSeconds === rc.maxAgeSeconds;
+    if (lc.type === 'Date') return rc.type === 'Date' && lc.date === rc.date;
+    return true;
+  });
+}
+
+/**
+ * The body the SDK sends. Split out so the test can assert the wire shape against one function.
+ *
+ * ⚠️ IT TAKES THE RULES, NOT THE PROPS, so this module names nothing from the resource — the
+ *   comparison and the vocabulary stay readable without the lifecycle around them.
+ */
+export const toBody = (rules: readonly R2LockRule[]): { rules: R2LockRule[] } => ({
+  rules: rules.map((rule) => ({ ...rule })),
+});

package/src/cloudflare/providers.ts

@@ -0,0 +1,23 @@
+/**
+ * The HomeFlare Cloudflare provider collection, in the shape `LiteLLM.providers()` has.
+ *
+ * ★ ONE LAYER, BUILT ONCE, so the single `Config.redacted('CLOUDFLARE_API_TOKEN')` read is shared
+ *   by every resource in the stack rather than repeated per resource.
+ *
+ * ⚠️ THIS IS NOT `alchemy/Cloudflare`'s COLLECTION AND DOES NOT REPLACE IT. A stack that declares
+ *   both a `Cloudflare.R2.Bucket` and this lock merges the two:
+ *   `Layer.mergeAll(Cloudflare.providers(), HomeflareCloudflare.providers())` — the shape
+ *   a consuming stack names for one talking to more than one account.
+ */
+import * as Provider from 'alchemy/Provider';
+import * as Layer from 'effect/Layer';
+import { CloudflareApiLive } from './client.ts';
+import { R2BucketLock, R2BucketLockProvider } from './r2-bucket-lock.ts';
+
+export class Providers extends Provider.ProviderCollection<Providers>()('HomeflareCloudflare') {}
+
+export const providers = () =>
+  Layer.effect(Providers, Provider.collection([R2BucketLock])).pipe(
+    Layer.provide(R2BucketLockProvider()),
+    Layer.provideMerge(CloudflareApiLive),
+  );