@homeflare/alchemy 0.38.0 → 0.40.0

package/dist/proxmox/storage-download.d.ts

@@ -0,0 +1,44 @@
+/**
+ * `Proxmox.StorageDownload` — one `download-url` fetch of an image onto a named storage's
+ * `import` content, declared. Joined 2026-09-26 for Talos: a node needs a boot image on shared
+ * storage (`cephtb4`/`cephfs-tb4`) before `Proxmox.Vm` can reference it as a disk source.
+ *
+ * ★ A CREATE-ORIENTED FAMILY, NOT A GENERAL DOWNLOADER. `content` is fixed to `import` — never a
+ *   prop — because that is the one content type a VM disk import consumes; an ISO or a container
+ *   template already has its own path (`upload`, or an out-of-band copy) and does not belong here.
+ *
+ * ⛔ `checksum` AND `checksumAlgorithm` ARE REQUIRED, NOT OPTIONAL, EVEN THOUGH PVE'S OWN SCHEMA
+ *   MARKS BOTH OPTIONAL (`generated/pve/nodes-node-storage-storage.ts`). An unpinned download is
+ *   not a declaration — it is a promise that whatever the URL answers today is what a Talos node
+ *   boots from, silently, on every future adopt. This resource narrows the vendor's own contract
+ *   on purpose; `storage-download-lifecycle.ts`'s `createRefusals` is the runtime backstop for a
+ *   caller that casts around the type.
+ *
+ * ⛔ THERE IS NO UPDATE PATH. PVE does not remember the `url` or `checksum` a volume was created
+ *   from — `GET .../content` reports only `format`/`size`/`volid` — so once the file exists on
+ *   `storage`, this resource has nothing left to compare a new declaration against except the
+ *   PREVIOUS one (storage-download-identity.ts). A DIFFERENT `checksum`/`url` on the SAME `filename`
+ *   is REFUSED, never silently written or silently `noop` (2026-09-26, red-team I2 on PR 297):
+ *   change `filename` to force a new download, which plans a `replace` — the old file is deleted and
+ *   the new one downloaded under its own name — exactly as an immutable artifact should be.
+ *
+ * ⛔ NO SECRET IS A PROP. Every field here — `node`, `storage`, `filename`, `url`, the checksum
+ *   pair, `compression`, `verifyCertificates` — is either an identity or a public download
+ *   parameter; none is a credential, matching the "no secret prop" rule every PVE family here
+ *   carries (see qemu-props.ts's `cipassword`/`machine` for the family that has one to guard).
+ *
+ * ★ NOT `retain` BY DEFAULT, UNLIKE `Proxmox.Vm`/`Proxmox.Lxc`. A downloaded image is reproducible
+ *   from its own declaration (the same `url` and `checksum` rebuild it byte-for-byte); a VM's
+ *   disk state or a container's data is not. Dropping this declaration deletes the file — an
+ *   operator who wants to keep an unreferenced image around pins its own `RemovalPolicy.retain()`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type { PveRequirements } from './resource.ts';
+import type { StorageDownloadAttributes, StorageDownloadProps } from './storage-download-props.ts';
+export type { StorageDownloadAttributes, StorageDownloadProps } from './storage-download-props.ts';
+export interface ProxmoxStorageDownload extends Resource<'Proxmox.StorageDownload', StorageDownloadProps, StorageDownloadAttributes, never, PveRequirements> {
+}
+export declare const ProxmoxStorageDownload: import("alchemy").ResourceClass<ProxmoxStorageDownload>;
+export declare const ProxmoxStorageDownloadProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxStorageDownload>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=storage-download.d.ts.map

package/dist/proxmox/storage-download.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-download.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-download.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnG,YAAY,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnG,MAAM,WAAW,sBAAuB,SAAQ,QAAQ,CACtD,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,sBAAsB,yDAA8D,CAAC;AAElG,eAAO,MAAM,8BAA8B,4IAIxC,CAAC"}

package/dist/talos/credentials-write.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The write half of Talos's OpenBao KV access — split out of credentials.ts (2026-09-26,
+ * K-talos-first-boot) once it needed its own header, the same reason machine-config-read.ts,
+ * machine-config-poll.ts and talos-errors.ts were split out of talos-machine-config.ts before it.
+ * `credentials.ts` stays the read side (mint a talosconfig, read a KV value); this file is the one
+ * place anything in this package ever writes TO OpenBao.
+ *
+ * ★ FIRST CALLER: `Talos.Kubeconfig` (kubeconfig.ts) writing the admin kubeconfig it generates at
+ *   cluster bring-up into the vault instead of an un-vaulted host `runtimePath` — see that file's
+ *   own header. `Ceph.AuthEntity` (K-A4, a separate design/PR) is expected to need the same shape
+ *   for its own vault-written entity keys; this is not yet shared with it on purpose — two callers
+ *   is the point at which sharing stops being speculative.
+ */
+import * as Effect from 'effect/Effect';
+import type * as Scope from 'effect/Scope';
+import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
+/**
+ * A fresh, unguessable temp path for SOME OTHER PROCESS (talosctl) to create — unlike
+ * `credentials.ts`'s `mintKvTempFile`, this does NOT pre-create the file with `wx`, because the
+ * caller here is capturing a command's OWN output rather than writing known content itself. The
+ * random UUIDv7 name is the only pre-fabrication guard (an attacker cannot pre-plant a symlink at a
+ * path it cannot predict) — first used by `kubeconfig.ts` to capture `talosctl kubeconfig`'s
+ * generated file before reading it back and writing it into the vault.
+ */
+export declare const reservedTempPath: (label: string) => Effect.Effect<{
+    readonly path: string;
+}, never, Scope.Scope>;
+/**
+ * Write one field of an OpenBao KV-v2 value from `value` — never argv, the mirror image of
+ * `credentials.ts`'s `readKvValue`.
+ *
+ * ⛔ C2 FIX (LAND red team, 2026-09-26) — `field=@-` IS WRONG AND WAS NEVER MEASURED. `@value` means
+ *   "read a file at this path"; a literal path of `-` is not the stdin convention for `@` — it is
+ *   just a file named `-`. MEASURED against the estate's OpenBao v2.6.2 binary (isolated in-memory
+ *   dev server, `env -i`, scratch HOME, no estate credentials involved; server removed after):
+ *   `field=@-` exits 1 with `invalid key/value pair "field=@-": error reading file: open -: no
+ *   such file or directory`, and if a file literally named `-` exists in the working directory it
+ *   silently stores THAT file's bytes instead. `field=-` (no `@`) is Vault/OpenBao's own stdin
+ *   convention and was confirmed against the same binary to read the piped bytes correctly. Every
+ *   `Talos.Kubeconfig` create failed here — AFTER `talosctl kubeconfig` had already issued a fresh
+ *   admin client certificate, which cannot be revoked.
+ * ⛔ stderr ONLY ON FAILURE — same rule as `readKvValue`: never echo what was being written, on
+ *   success or failure.
+ */
+export declare const writeKvValue: (mount: string, key: string, field: string, value: string) => Effect.Effect<void, Error, ChildProcessSpawner.ChildProcessSpawner>;
+//# sourceMappingURL=credentials-write.d.ts.map

package/dist/talos/credentials-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-write.d.ts","sourceRoot":"","sources":["../../src/talos/credentials-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,UACpB,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAS1D,CAAC;AAEL;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,UAChB,MAAM,OACR,MAAM,SACJ,MAAM,SACN,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,mBAAmB,CAgCjE,CAAC"}

package/dist/talos/credentials.d.ts

@@ -1,4 +1,5 @@
 import * as Effect from 'effect/Effect';
+import type * as Scope from 'effect/Scope';
 import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
 /** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */
 export type TalosTarget = {
@@ -7,10 +8,10 @@ export type TalosTarget = {
     /** Logical cluster name — safe to persist and log. */
     readonly cluster: string;
     /**
-     * Path under the mount for the talosconfig YAML.
-     *
-     * ⚠️ DEFAULT IS REASONED. The first real deploy will confirm or correct the path; a wrong path
-     *   fails closed with a bao error rather than writing an empty talosconfig.
+     * Path under the mount for the talosconfig YAML. Default `'talosconfig'` — FIXED 2026-09-26;
+     * the shipped default was `'data/talosconfig'`, which `bao kv get` turned into
+     * `<mount>/data/data/talosconfig` (see the ⚠️ above). It failed closed rather than reading an
+     * empty talosconfig, but it would have blocked the very first deploy.
      */
     readonly talosconfigKey?: string;
 };
@@ -18,13 +19,54 @@ export type TalosCredential = {
     /** Absolute path to a temp talosconfig. ⛔ NEVER PERSIST, NEVER LOG CONTENTS. */
     readonly talosconfigPath: string;
 };
+/**
+ * Default OpenBao KV path (under `target.mount`) for the admin kubeconfig `Talos.Kubeconfig`
+ * writes once at cluster bring-up. See kubeconfig.ts's own header (K-talos-first-boot, 2026-09-26)
+ * and docs/plans/2026-09-26-talos-secrets-flow.md's O1 key list.
+ */
+export declare const DEFAULT_KUBECONFIG_KEY = "kubeconfig";
+/**
+ * Read one OpenBao KV-v2 value and return the first of `fields` that is a non-empty string.
+ *
+ * ★ THE ONE PLACE THIS PACKAGE SHELLS TO `bao` — talosconfig, per-node machine config and any
+ *   future KV-backed Talos material (secrets.yaml, ceph entity keys) all read through this,
+ *   so there is exactly one spot that must never echo a KV value on failure.
+ * ⛔ stderr ONLY ON FAILURE. stdout may hold the very secret this call exists to fetch.
+ */
+export declare const readKvValue: (mount: string, key: string, fields: readonly string[]) => Effect.Effect<string, Error, ChildProcessSpawner.ChildProcessSpawner>;
+/**
+ * Write `raw` to a session-temp, 0600, exclusively-created file whose lifetime is the CALLER's
+ * `Effect.scoped`, not this call's. See the ⛔ C1 FIX note at the top of this file.
+ *
+ * ⛔ 0600, CREATED EXCLUSIVELY, AND `Bun.write` CANNOT DO EITHER. This file can hold a cluster
+ *   admin client certificate or a machine config's bootstrap token. `Bun.write` takes no mode, so
+ *   it lands at the process umask — world-readable on this estate — for as long as the resource
+ *   runs. The name is unguessable, and "unguessable" is not a permission.
+ * ⚠️ `wx` IS THE OTHER HALF. `O_EXCL` means this cannot be made to write through a path an
+ *   attacker pre-created (the classic /tmp symlink race), and with a UUIDv7 name a collision is a
+ *   genuine error rather than something to paper over.
+ * ⚠️ A HARD KILL (SIGKILL, power loss) skips the finalizer and leaves the file behind. 0600 is
+ *   what makes that survivable rather than a disclosure.
+ */
+export declare const mintKvTempFile: (raw: string, label: string) => Effect.Effect<{
+    readonly path: string;
+}, Error, Scope.Scope>;
 /**
  * Mint one talosconfig file for `target`.
  *
- * ★ SHELLS OUT TO `bao` RATHER THAN SPEAKING THE HTTP API — same reasoning as proxmox credentials.
- *   The estate's BAO_ADDR / BAO_NAMESPACE / approle contract already lives in that binary.
+ * ⛔ CALLERS MUST WRAP THEIR WHOLE USE OF `credential.talosconfigPath` — not just this call — in
+ *   `Effect.scoped(...)`. This function's own `Scope.Scope` requirement is what makes that the
+ *   caller's job instead of a lie this function tells itself; see the header above.
+ */
+export declare const mintTalosconfig: (target: TalosTarget) => Effect.Effect<TalosCredential, Error, ChildProcessSpawner.ChildProcessSpawner | Scope.Scope>;
+/**
+ * Mint one temp kubeconfig file from the vault copy `Talos.Kubeconfig` writes at bring-up
+ * (K-talos-first-boot, 2026-09-26) — the consumer-side counterpart to {@link mintTalosconfig},
+ * named as the future seam for `Kubernetes.ClusterAdapter` in
+ * docs/plans/2026-09-26-talos-secrets-flow.md ("consumers mint it the way the talosconfig is
+ * minted"). Not yet wired to that adapter — this only makes the read+materialize step exist.
  */
-export declare const mintTalosconfig: (target: TalosTarget) => Effect.Effect<{
-    talosconfigPath: string;
-}, Error | import("effect/PlatformError").PlatformError, ChildProcessSpawner.ChildProcessSpawner>;
+export declare const mintKubeconfig: (target: TalosTarget, key?: string) => Effect.Effect<{
+    readonly path: string;
+}, Error, ChildProcessSpawner.ChildProcessSpawner | Scope.Scope>;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/talos/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/talos/credentials.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF,+FAA+F;AAC/F,MAAM,MAAM,WAAW,GAAG;IACxB,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAIF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAAY,WAAW;;iGAsFhD,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/talos/credentials.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF,+FAA+F;AAC/F,MAAM,MAAM,WAAW,GAAG;IACxB,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,UACf,MAAM,OACR,MAAM,UACH,SAAS,MAAM,EAAE,KACxB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,mBAAmB,CAAC,mBAAmB,CAgDnE,CAAC;AAEL;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,QACpB,MAAM,SACJ,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAqB1D,CAAC;AAEL;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAClB,WAAW,KAClB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,mBAAmB,CAAC,mBAAmB,GAAG,KAAK,CAAC,KAAK,CAO3F,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,WACjB,WAAW,mBAElB,MAAM,CAAC,MAAM,CACd;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACzB,KAAK,EACL,mBAAmB,CAAC,mBAAmB,GAAG,KAAK,CAAC,KAAK,CAIpD,CAAC"}

package/dist/talos/fake-process.d.ts

@@ -0,0 +1,56 @@
+/**
+ * A fake `ChildProcessSpawner` for offline Talos tests — no real `bao` or `talosctl` process ever
+ * starts. Shared by credentials.test.ts and talos-machine-config.test.ts (2026-09-26, K-A3);
+ * this package had NO process-level test fake before this file — every Talos resource file spawns
+ * a real binary in production and none of that was previously exercised offline.
+ *
+ * ★ A FULL FAKE SERVICE, NOT A REAL SPAWN WITH A FIXTURE EXECUTABLE ON `PATH`. The alternative —
+ *   a tiny fake `bao`/`talosctl` script and a mutated `process.env.PATH` — spawns a REAL OS
+ *   process and mutates process-global state for the test's duration, which is exactly the kind
+ *   of cross-test interference the house rules ask tests to avoid. `ChildProcessSpawner.make`
+ *   takes just a `spawn` function and derives everything else, so a fake `spawn` is the whole cost.
+ */
+import * as Effect from 'effect/Effect';
+import * as Stream from 'effect/Stream';
+import type { Command } from 'effect/unstable/process/ChildProcess';
+import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
+export type FakeResult = {
+    readonly stdout?: string;
+    readonly stderr?: string;
+    readonly exitCode?: number;
+};
+export type FakeCall = {
+    readonly command: string;
+    readonly args: readonly string[];
+    /**
+     * Decoded stdin text, present only when the real caller piped a `Stream` in (K-talos-first-boot,
+     * `credentials-write.ts`'s `writeKvValue`) — the whole reason this fake exists is to prove a
+     * value went in via stdin and never via argv, so a test needs to see it.
+     */
+    readonly stdin?: string;
+};
+export type FakeHandler = (call: FakeCall) => FakeResult;
+/**
+ * Build a fake `ChildProcessSpawner.Service` from `handler`, which sees every command's
+ * executable + argv (+ decoded stdin, when piped) and returns canned stdout/stderr/exitCode.
+ * `credentials.ts` and `talosctl.ts` only ever build `StandardCommand`s (never a piped command),
+ * so that is the only shape this fake accepts — a `PipedCommand` is a test-authoring mistake, not
+ * something to fake.
+ */
+export declare const fakeSpawner: (handler: FakeHandler, calls?: FakeCall[]) => {
+    spawn(command: Command): Effect.Effect<ChildProcessSpawner.ChildProcessHandle, import("effect/PlatformError").PlatformError, import("effect/Scope").Scope>;
+    exitCode(command: Command): Effect.Effect<ChildProcessSpawner.ExitCode, import("effect/PlatformError").PlatformError>;
+    streamString(command: Command, options?: {
+        readonly includeStderr?: boolean | undefined;
+    }): Stream.Stream<string, import("effect/PlatformError").PlatformError>;
+    streamLines(command: Command, options?: {
+        readonly includeStderr?: boolean | undefined;
+    }): Stream.Stream<string, import("effect/PlatformError").PlatformError>;
+    lines(command: Command, options?: {
+        readonly includeStderr?: boolean | undefined;
+    }): Effect.Effect<Array<string>, import("effect/PlatformError").PlatformError>;
+    string(command: Command, options?: {
+        readonly includeStderr?: boolean | undefined;
+    }): Effect.Effect<string, import("effect/PlatformError").PlatformError>;
+};
+//# sourceMappingURL=fake-process.d.ts.map

package/dist/talos/fake-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-process.d.ts","sourceRoot":"","sources":["../../src/talos/fake-process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU,CAAC;AAsCzD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAAa,WAAW,UAAS,QAAQ,EAAE;;;;;;;;;;;;;;;CAehE,CAAC"}

package/dist/talos/index.d.ts

@@ -5,11 +5,26 @@
  *   These are the symbols a real stack consumes; the rest of the files are internals a
  *   provider needs but a consumer should not depend on. An `export *` here would publish
  *   every helper as API and make the next refactor a breaking change.
+ * ★ `Talos.MachineConfig`'S RESOURCE CLASS JOINED ITS PROVIDER 2026-09-26 (K-A3) — until now this
+ *   barrel exported only `Talos*Provider`, which builds the provider but gives a consuming stack
+ *   nothing to `new` or call to actually DECLARE a row (the same gap proxmox/index.ts's own header
+ *   calls out for `ProxmoxVm`). MachineConfig is safe to declare today: it fails closed on a digest
+ *   mismatch before touching a node, and its cold-start read never silently adopts (PR 307 fix-first
+ *   #1, machine-config-read.ts's own header).
+ * ★ BOOTSTRAP, CLUSTERHEALTH AND KUBECONFIG JOIN THEM (K-talos-first-boot, 2026-09-26) — PR 307's
+ *   red team (fix-first #3) held these back because `Talos.Bootstrap` could re-run `talosctl
+ *   bootstrap` against an already-bootstrapped cluster and `Talos.Kubeconfig` wrote a cluster-admin
+ *   kubeconfig to un-vaulted host disk. Both are fixed now: bootstrap's "once means once" invariant
+ *   (talos-bootstrap.ts's own header) and kubeconfig landing in OpenBao, written once at bring-up
+ *   (kubeconfig.ts's own header) — plus `Talos.ClusterHealth`'s error handling no longer conflates a
+ *   vault/transport failure with "cluster not healthy yet" (talos-cluster-health.ts's own header).
  * ★ Anything unlisted is still reachable by path if you genuinely need it — that is a
  *   deliberate, visible act rather than an accident of barrelling.
  */
-export { TalosKubeconfigProvider } from './kubeconfig.ts';
-export { TalosBootstrapProvider } from './talos-bootstrap.ts';
-export { TalosClusterHealthProvider } from './talos-cluster-health.ts';
-export { TalosMachineConfigProvider } from './talos-machine-config.ts';
+export type { TalosCredential, TalosTarget } from './credentials.ts';
+export { type KubeconfigAttributes, type KubeconfigProps, TalosKubeconfig, TalosKubeconfigProvider, } from './kubeconfig.ts';
+export type { ApplyMode, WithTarget } from './resource.ts';
+export { type BootstrapAttributes, type BootstrapProps, TalosBootstrap, TalosBootstrapProvider, } from './talos-bootstrap.ts';
+export { type ClusterHealthAttributes, type ClusterHealthProps, TalosClusterHealth, TalosClusterHealthProvider, } from './talos-cluster-health.ts';
+export { type MachineConfigAttributes, type MachineConfigProps, TalosMachineConfig, TalosMachineConfigProvider, } from './talos-machine-config.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/talos/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/talos/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/talos/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,eAAe,EACf,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,cAAc,EACd,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC"}