@homeflare/alchemy 0.39.0 → 0.40.0

package/dist/talos/index.js

@@ -1,8 +1,9 @@
 // src/talos/kubeconfig.ts
+import { chmodSync } from "node:fs";
 import { Resource } from "alchemy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
-import * as Effect3 from "effect/Effect";
+import * as Effect4 from "effect/Effect";
 
 // src/talos/credentials.ts
 import { closeSync, openSync, writeFileSync } from "node:fs";
@@ -10,96 +11,104 @@ import * as Effect from "effect/Effect";
 import * as Stream from "effect/Stream";
 import * as ChildProcess from "effect/unstable/process/ChildProcess";
 import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
-var defaultKey = (target) => target.talosconfigKey ?? "data/talosconfig";
-var mintTalosconfig = (target) => Effect.scoped(Effect.gen(function* () {
+var DEFAULT_TALOSCONFIG_KEY = "talosconfig";
+var DEFAULT_KUBECONFIG_KEY = "kubeconfig";
+var readKvValue = (mount, key, fields) => Effect.gen(function* () {
   const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-  const key = defaultKey(target);
-  const result = yield* ChildProcess.make("bao", ["kv", "get", "-format=json", `${target.mount}/${key}`], { detached: false, extendEnv: true, stderr: "pipe", stdin: "ignore", stdout: "pipe" }).pipe(spawner.spawn, Effect.flatMap((child) => Effect.all({
+  const result = yield* ChildProcess.make("bao", ["kv", "get", "-format=json", `${mount}/${key}`], { detached: false, extendEnv: true, stderr: "pipe", stdin: "ignore", stdout: "pipe" }).pipe(spawner.spawn, Effect.flatMap((child) => Effect.all({
     exitCode: child.exitCode,
     stderr: child.stderr.pipe(Stream.decodeText, Stream.mkString, Effect.map((text) => text.trim())),
     stdout: child.stdout.pipe(Stream.decodeText, Stream.mkString, Effect.map((text) => text.trim()))
   }, { concurrency: "unbounded" })), Effect.scoped);
   if (result.exitCode !== 0) {
-    return yield* Effect.fail(new Error(`bao kv get ${target.mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`));
+    return yield* Effect.fail(new Error(`bao kv get ${mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`));
   }
   const parsed = JSON.parse(result.stdout);
   const data = parsed.data?.data;
-  const raw = data?.["talosconfig"] ?? data?.["config"];
-  if (typeof raw !== "string" || raw.trim() === "") {
-    return yield* Effect.fail(new Error(`${target.mount}/${key} returned no talosconfig field. Expected a KV key named 'talosconfig' or 'config' — never store the value in Alchemy props.`));
+  for (const field of fields) {
+    const raw = data?.[field];
+    if (typeof raw === "string" && raw.trim() !== "")
+      return raw;
   }
-  const talosconfigPath = `${Bun.env["TMPDIR"] ?? "/tmp"}/hf-talos-${target.cluster}-${Bun.randomUUIDv7()}.yaml`;
-  yield* Effect.try({
+  return yield* Effect.fail(new Error(`${mount}/${key} returned no ${fields.join("/")} field. Never store the value itself in ` + "an Alchemy prop or attribute — fix the KV entry, not the caller."));
+});
+var mintKvTempFile = (raw, label) => Effect.gen(function* () {
+  const path = `${Bun.env["TMPDIR"] ?? "/tmp"}/hf-talos-${label}-${Bun.randomUUIDv7()}.yaml`;
+  yield* Effect.acquireRelease(Effect.try({
     try: () => {
-      const fd = openSync(talosconfigPath, "wx", 384);
+      const fd = openSync(path, "wx", 384);
       try {
         writeFileSync(fd, raw);
       } finally {
         closeSync(fd);
       }
     },
-    catch: (cause) => new Error(`writing temp talosconfig: ${String(cause)}`)
-  });
-  yield* Effect.addFinalizer(() => Effect.tryPromise({
-    try: () => Bun.file(talosconfigPath).delete(),
-    catch: () => {
-      return;
-    }
-  }).pipe(Effect.orElseSucceed(() => {
+    catch: (cause) => new Error(`writing ${label} temp file: ${String(cause)}`)
+  }), () => Effect.tryPromise({ try: () => Bun.file(path).delete(), catch: () => {
+    return;
+  } }).pipe(Effect.orElseSucceed(() => {
     return;
   })));
-  return { talosconfigPath };
-}));
+  return { path };
+});
+var mintTalosconfig = (target) => readKvValue(target.mount, target.talosconfigKey ?? DEFAULT_TALOSCONFIG_KEY, [
+  "talosconfig",
+  "config"
+]).pipe(Effect.flatMap((raw) => mintKvTempFile(raw, `${target.cluster}-talosconfig`)), Effect.map(({ path }) => ({ talosconfigPath: path })));
 
-// src/talos/talosctl.ts
+// src/talos/credentials-write.ts
 import * as Effect2 from "effect/Effect";
 import * as Stream2 from "effect/Stream";
 import * as ChildProcess2 from "effect/unstable/process/ChildProcess";
 import * as ChildProcessSpawner3 from "effect/unstable/process/ChildProcessSpawner";
-
-class TalosError extends Error {
-  command;
-  exitCode;
-  constructor(command, exitCode, detail) {
-    super(`talosctl ${command} -> ${String(exitCode)}: ${detail}`);
-    this.command = command;
-    this.exitCode = exitCode;
-    this.name = "TalosError";
-  }
-}
-var talosctl = (args, options) => Effect2.gen(function* () {
+var reservedTempPath = (label) => Effect2.gen(function* () {
+  const path = `${Bun.env["TMPDIR"] ?? "/tmp"}/hf-talos-${label}-${Bun.randomUUIDv7()}.yaml`;
+  yield* Effect2.addFinalizer(() => Effect2.tryPromise({ try: () => Bun.file(path).delete(), catch: () => {
+    return;
+  } }).pipe(Effect2.orElseSucceed(() => {
+    return;
+  })));
+  return { path };
+});
+var writeKvValue = (mount, key, field, value) => Effect2.gen(function* () {
   const spawner = yield* ChildProcessSpawner3.ChildProcessSpawner;
-  const argv = [
-    ...args,
-    "--talosconfig",
-    options.talosconfigPath,
-    ...options.nodes === undefined ? [] : ["--nodes", options.nodes.join(",")],
-    ...options.endpoints === undefined ? [] : ["--endpoints", options.endpoints.join(",")]
-  ];
-  const result = yield* ChildProcess2.make("talosctl", argv, {
+  const result = yield* ChildProcess2.make("bao", ["kv", "put", `${mount}/${key}`, `${field}=-`], {
     detached: false,
     extendEnv: true,
     stderr: "pipe",
-    stdin: "ignore",
+    stdin: Stream2.fromIterable([new TextEncoder().encode(value)]),
     stdout: "pipe"
   }).pipe(spawner.spawn, Effect2.flatMap((child) => Effect2.all({
     exitCode: child.exitCode,
-    stderr: child.stderr.pipe(Stream2.decodeText, Stream2.mkString, Effect2.map((text) => text.trim())),
-    stdout: child.stdout.pipe(Stream2.decodeText, Stream2.mkString, Effect2.map((text) => text.trim()))
+    stderr: child.stderr.pipe(Stream2.decodeText, Stream2.mkString, Effect2.map((text) => text.trim()))
   }, { concurrency: "unbounded" })), Effect2.scoped);
-  const command = args.join(" ");
   if (result.exitCode !== 0) {
-    return yield* Effect2.fail(new TalosError(command, result.exitCode, result.stderr.slice(0, 300)));
+    return yield* Effect2.fail(new Error(`bao kv put ${mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`));
   }
-  return result.stdout;
 });
-var talosctlOrAlready = (args, options) => talosctl(args, options).pipe(Effect2.catchIf((cause) => cause instanceof TalosError && cause.exitCode !== 0 && /already|exists|bootstrapped/i.test(cause.message), () => Effect2.succeed("")));
 
 // src/talos/values.ts
 import { createHash } from "node:crypto";
 var canonicalText = (text) => text.trimEnd();
 var sha256 = (text) => createHash("sha256").update(canonicalText(text)).digest("hex");
 var configDigest = (text) => sha256(text);
+var extractMachineConfigSpec = (wrapperYaml) => {
+  let doc;
+  try {
+    doc = Bun.YAML.parse(wrapperYaml);
+  } catch {
+    return;
+  }
+  if (Array.isArray(doc)) {
+    if (doc.length !== 1)
+      return;
+    doc = doc[0];
+  }
+  if (doc === null || typeof doc !== "object")
+    return;
+  const spec = doc.spec;
+  return typeof spec === "string" ? spec : undefined;
+};
 var kubeconfigMetadata = (yamlText, contextName) => {
   let doc;
   try {
@@ -125,27 +134,18 @@ var kubeconfigMetadata = (yamlText, contextName) => {
     endpoint
   };
 };
-var resolveConfigPath = (stackDir, configFile) => configFile.startsWith("/") ? configFile : `${stackDir}/${configFile}`;
 
-// src/talos/kubeconfig.ts
-var TalosKubeconfig = Resource("Talos.Kubeconfig");
+// src/talos/kubeconfig-attrs.ts
 var generation = (meta) => sha256(`${meta.context}
 ${meta.endpoint}
 ${meta.caFingerprint}
 ${meta.clientFingerprint}`);
+var UNWIRED_KUBECONFIG_PATH = "/talos-first-boot-unwired/wire-Kubernetes.ClusterAdapter-to-mintKubeconfig";
 var toConnection = (props) => ({
-  auth: { context: props.context, kind: "kubeconfig", path: props.runtimePath }
+  auth: { context: props.context, kind: "kubeconfig", path: UNWIRED_KUBECONFIG_PATH }
 });
-var readFileMeta = (props) => Effect3.gen(function* () {
-  const text = yield* Effect3.tryPromise({
-    try: () => Bun.file(props.runtimePath).text(),
-    catch: (cause) => new Error(String(cause))
-  }).pipe(Effect3.orElseSucceed(() => {
-    return;
-  }));
-  if (text === undefined)
-    return;
-  const meta = kubeconfigMetadata(text, props.context);
+var buildAttrs = (raw, props) => {
+  const meta = kubeconfigMetadata(raw, props.context);
   if (meta === undefined)
     return;
   return {
@@ -156,80 +156,203 @@ var readFileMeta = (props) => Effect3.gen(function* () {
     credentialGeneration: generation({ ...meta, context: props.context }),
     endpoint: meta.endpoint
   };
+};
+
+// src/talos/talosctl.ts
+import * as Effect3 from "effect/Effect";
+import * as Stream3 from "effect/Stream";
+import * as ChildProcess3 from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner5 from "effect/unstable/process/ChildProcessSpawner";
+
+class TalosError extends Error {
+  command;
+  exitCode;
+  constructor(command, exitCode, detail) {
+    super(`talosctl ${command} -> ${String(exitCode)}: ${detail}`);
+    this.command = command;
+    this.exitCode = exitCode;
+    this.name = "TalosError";
+  }
+}
+var talosctl = (args, options) => Effect3.gen(function* () {
+  const spawner = yield* ChildProcessSpawner5.ChildProcessSpawner;
+  const argv = [
+    ...args,
+    "--talosconfig",
+    options.talosconfigPath,
+    ...options.nodes === undefined ? [] : ["--nodes", options.nodes.join(",")],
+    ...options.endpoints === undefined ? [] : ["--endpoints", options.endpoints.join(",")],
+    ...options.insecure === true ? ["--insecure"] : []
+  ];
+  const result = yield* ChildProcess3.make("talosctl", argv, {
+    detached: false,
+    extendEnv: true,
+    stderr: "pipe",
+    stdin: "ignore",
+    stdout: "pipe"
+  }).pipe(spawner.spawn, Effect3.flatMap((child) => Effect3.all({
+    exitCode: child.exitCode,
+    stderr: child.stderr.pipe(Stream3.decodeText, Stream3.mkString, Effect3.map((text) => text.trim())),
+    stdout: child.stdout.pipe(Stream3.decodeText, Stream3.mkString, Effect3.map((text) => text.trim()))
+  }, { concurrency: "unbounded" })), Effect3.scoped);
+  const command = args.join(" ");
+  if (result.exitCode !== 0) {
+    return yield* Effect3.fail(new TalosError(command, result.exitCode, result.stderr.slice(0, 300)));
+  }
+  return result.stdout;
+});
+var talosctlOrAlready = (args, options) => talosctl(args, options).pipe(Effect3.catchIf((cause) => cause instanceof TalosError && cause.exitCode !== 0 && /already|exists|bootstrapped/i.test(cause.message), () => Effect3.succeed("")));
+
+// src/talos/kubeconfig.ts
+var TalosKubeconfig = Resource("Talos.Kubeconfig");
+var isVaultKeyAbsent = (error) => error instanceof Error && /no value found at/i.test(error.message);
+var readVaultMeta = (props, key) => readKvValue(props.target.mount, key, ["kubeconfig", "config"]).pipe(Effect4.catchIf(isVaultKeyAbsent, () => Effect4.succeed(undefined)));
+var readKubeconfig = (props) => Effect4.gen(function* () {
+  const key = props.kubeconfigKey ?? DEFAULT_KUBECONFIG_KEY;
+  const raw = yield* readVaultMeta(props, key);
+  if (raw === undefined)
+    return;
+  const meta = buildAttrs(raw, props);
+  if (meta === undefined) {
+    return yield* Effect4.fail(new Error(`${props.target.mount}/${key}: vault content exists but does not parse as a kubeconfig ` + `for context ${props.context} — not a cold start. Fix the KV entry or the pinned ` + "context rather than trusting an empty read."));
+  }
+  return meta;
 });
-var read = (props) => readFileMeta(props).pipe(Effect3.map((meta) => meta === undefined ? {
-  certificateAuthorityFingerprint: "",
-  clientCertificateFingerprint: "",
-  connection: toConnection(props),
-  context: props.context,
-  credentialGeneration: "",
-  endpoint: ""
-} : meta));
-var diff = (news, output) => Effect3.gen(function* () {
+var diffKubeconfig = (news, output) => Effect4.gen(function* () {
   if (output === undefined || !isResolved(news))
     return;
-  const live = yield* read(news);
-  if (live.credentialGeneration !== "" && output.credentialGeneration === live.credentialGeneration && output.context === live.context && output.endpoint === live.endpoint) {
+  const live = yield* readKubeconfig(news);
+  if (live !== undefined && live.credentialGeneration === output.credentialGeneration && live.context === output.context && live.endpoint === output.endpoint) {
     return { action: "noop" };
   }
   return { action: "update" };
 });
-var reconcile = (props) => Effect3.gen(function* () {
+var reconcileKubeconfig = (props, output) => Effect4.scoped(Effect4.gen(function* () {
+  const key = props.kubeconfigKey ?? DEFAULT_KUBECONFIG_KEY;
+  if (output !== undefined && output.credentialGeneration !== "") {
+    const raw2 = yield* readKvValue(props.target.mount, key, ["kubeconfig", "config"]);
+    const meta2 = buildAttrs(raw2, props);
+    if (meta2 === undefined) {
+      return yield* Effect4.die(new Error(`${props.target.mount}/${key}: vault content no longer parses as a kubeconfig for ` + `context ${props.context}. Read back rather than trusting the write once.`));
+    }
+    return meta2;
+  }
   const credential = yield* mintTalosconfig(props.target);
-  yield* talosctl([
-    "kubeconfig",
-    props.runtimePath,
-    "--merge=false",
-    "--force",
-    "--force-context-name",
-    props.context
-  ], { nodes: [props.node], talosconfigPath: credential.talosconfigPath });
-  const meta = yield* readFileMeta(props);
+  const { path: outPath } = yield* reservedTempPath(`${props.target.cluster}-${props.node}-kubeconfig-out`);
+  yield* talosctl(["kubeconfig", outPath, "--merge=false", "--force", "--force-context-name", props.context], { nodes: [props.node], talosconfigPath: credential.talosconfigPath });
+  const raw = yield* Effect4.tryPromise({
+    catch: (cause) => new Error(`${outPath}: reading generated kubeconfig: ${String(cause)}`),
+    try: () => Bun.file(outPath).text()
+  });
+  if (raw.trim() === "") {
+    return yield* Effect4.die(new Error(`${props.node}: talosctl kubeconfig returned no error but wrote an empty file. Read ` + "back rather than trusting the exit code alone."));
+  }
+  yield* Effect4.try({
+    catch: (cause) => new Error(`${outPath}: chmod 0600: ${String(cause)}`),
+    try: () => chmodSync(outPath, 384)
+  });
+  const meta = buildAttrs(raw, props);
   if (meta === undefined) {
-    return yield* Effect3.die(new Error(`${props.runtimePath}: talosctl kubeconfig returned no error but the file is missing ` + "or unparsable. Read back rather than trusting the exit code alone."));
+    return yield* Effect4.die(new Error(`${props.node}: talosctl kubeconfig wrote a file that does not parse for context ` + `${props.context}.`));
   }
+  yield* writeKvValue(props.target.mount, key, "kubeconfig", raw);
   return meta;
-});
+}));
 var handlers = {
-  delete: () => Effect3.void,
+  delete: () => Effect4.void,
   diff: ({
     news,
     output
-  }) => diff(news, output),
-  list: () => Effect3.succeed([]),
-  read: ({ olds }) => read(olds),
-  reconcile: ({ news }) => reconcile(news)
+  }) => diffKubeconfig(news, output),
+  list: () => Effect4.succeed([]),
+  read: ({ olds }) => readKubeconfig(olds),
+  reconcile: ({
+    news,
+    output
+  }) => reconcileKubeconfig(news, output)
 };
-var TalosKubeconfigProvider = () => Provider.effect(TalosKubeconfig, Effect3.succeed(TalosKubeconfig.Provider.of(handlers)));
+var TalosKubeconfigProvider = () => Provider.effect(TalosKubeconfig, Effect4.succeed(TalosKubeconfig.Provider.of(handlers)));
 // src/talos/talos-bootstrap.ts
 import { Resource as Resource2 } from "alchemy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect4 from "effect/Effect";
-var TalosBootstrap = Resource2("Talos.Bootstrap", {
-  defaultRemovalPolicy: "retain"
-});
+import * as Effect6 from "effect/Effect";
+
+// src/talos/talos-bootstrap-etcd.ts
+import * as Effect5 from "effect/Effect";
+
+// src/talos/talos-errors.ts
+import * as Data from "effect/Data";
+
+class TalosConfigDigestMismatch extends Data.TaggedError("TalosConfigDigestMismatch") {
+  get message() {
+    return `${this.mount}/${this.key}: live content digest ${this.got} does not match the pinned ` + `configDigest ${this.expected}. Fail closed — nothing was sent to talosctl. Either the KV ` + "value was rewritten without a matching PR, or the pinned digest is stale; check which one " + "moved before re-pinning either side.";
+  }
+}
+
+class TalosConvergenceTimeout extends Data.TaggedError("TalosConvergenceTimeout") {
+  get message() {
+    return `${this.node}: apply-config (--mode ${this.mode}) was accepted but the live machineconfig ` + `digest never matched the pin within ${this.attempts} bounded poll attempts. Refusing to ` + "report converged — hand this node to the operator rather than silently pass.";
+  }
+}
+
+class TalosReBootstrapRefused extends Data.TaggedError("TalosReBootstrapRefused") {
+  get message() {
+    return `${this.node}: state already recorded a successful bootstrap, and a live check could not ` + `reconfirm it (${this.detail}). Refusing to run 'talosctl bootstrap' again — that risks a ` + "second, isolated etcd cluster on a reset node. This needs an operator, not a reconcile.";
+  }
+}
+
+// src/talos/talos-bootstrap-etcd.ts
 var isBootstrapped = (props, talosconfigPath) => talosctl(["get", "etcdmembers", "-o", "json"], {
   nodes: [props.node],
   talosconfigPath
-}).pipe(Effect4.map((text) => text.includes('"id"') || text.includes('"member"')), Effect4.orElseSucceed(() => false));
-var read2 = (props) => Effect4.gen(function* () {
+}).pipe(Effect5.map((text) => text.includes('"id"') || text.includes('"member"')));
+var assertNoLivePeers = (props, talosconfigPath) => Effect5.all((props.peers ?? []).map((peer) => isBootstrapped({ ...props, node: peer }, talosconfigPath).pipe(Effect5.matchEffect({
+  onFailure: (cause) => Effect5.fail(new TalosReBootstrapRefused({
+    detail: `peer ${peer}: live read failed before bootstrap: ${String(cause)}`,
+    node: props.node
+  })),
+  onSuccess: (hasMembers) => hasMembers ? Effect5.fail(new TalosReBootstrapRefused({
+    detail: `peer ${peer} already reports etcd members — a cluster may already exist; ` + "refusing to bootstrap a second one",
+    node: props.node
+  })) : Effect5.void
+}))), { discard: true });
+
+// src/talos/talos-bootstrap.ts
+var TalosBootstrap = Resource2("Talos.Bootstrap", {
+  defaultRemovalPolicy: "retain"
+});
+var readBootstrap = (props) => Effect6.scoped(Effect6.gen(function* () {
   const credential = yield* mintTalosconfig(props.target);
   const bootstrapped = yield* isBootstrapped(props, credential.talosconfigPath);
-  return { bootstrapped, node: props.node };
-});
-var diff2 = (news, output) => Effect4.gen(function* () {
+  return bootstrapped ? { bootstrapped: true, node: props.node } : undefined;
+}));
+var diffBootstrap = (news, output) => Effect6.gen(function* () {
   if (output === undefined || !isResolved2(news))
     return;
-  const live = yield* read2(news);
-  if (live.bootstrapped)
+  if (output.bootstrapped)
     return { action: "noop" };
-  return { action: "update" };
+  const live = yield* readBootstrap(news);
+  return live?.bootstrapped === true ? { action: "noop" } : { action: "update" };
 });
-var reconcile2 = (props) => Effect4.gen(function* () {
+var reconcileBootstrap = (props, output) => Effect6.scoped(Effect6.gen(function* () {
   const credential = yield* mintTalosconfig(props.target);
+  if (output?.bootstrapped === true) {
+    const stillBootstrapped = yield* isBootstrapped(props, credential.talosconfigPath).pipe(Effect6.catchIf(() => true, (cause) => Effect6.fail(new TalosReBootstrapRefused({
+      detail: `live read failed: ${String(cause)}`,
+      node: props.node
+    }))));
+    if (!stillBootstrapped) {
+      return yield* Effect6.fail(new TalosReBootstrapRefused({
+        detail: "etcd members are absent on a live read against already-bootstrapped state",
+        node: props.node
+      }));
+    }
+    return { bootstrapped: true, node: props.node };
+  }
   const before = yield* isBootstrapped(props, credential.talosconfigPath);
   if (!before) {
+    yield* assertNoLivePeers(props, credential.talosconfigPath);
     yield* talosctlOrAlready(["bootstrap"], {
       nodes: [props.node],
       talosconfigPath: credential.talosconfigPath
@@ -237,26 +360,29 @@ var reconcile2 = (props) => Effect4.gen(function* () {
   }
   const after = yield* isBootstrapped(props, credential.talosconfigPath);
   if (!after) {
-    return yield* Effect4.die(new Error(`${props.node}: bootstrap returned no error but etcd members are still absent. ` + "Read back rather than trusting the exit code alone."));
+    return yield* Effect6.die(new Error(`${props.node}: bootstrap returned no error but etcd members are still absent. ` + "Read back rather than trusting the exit code alone."));
   }
   return { bootstrapped: true, node: props.node };
-});
+}));
 var handlers2 = {
-  delete: () => Effect4.void,
+  delete: () => Effect6.void,
   diff: ({
     news,
     output
-  }) => diff2(news, output),
-  list: () => Effect4.succeed([]),
-  read: ({ olds }) => read2(olds),
-  reconcile: ({ news }) => reconcile2(news)
+  }) => diffBootstrap(news, output),
+  list: () => Effect6.succeed([]),
+  read: ({ olds }) => readBootstrap(olds),
+  reconcile: ({
+    news,
+    output
+  }) => reconcileBootstrap(news, output)
 };
-var TalosBootstrapProvider = () => Provider2.effect(TalosBootstrap, Effect4.succeed(TalosBootstrap.Provider.of(handlers2)));
+var TalosBootstrapProvider = () => Provider2.effect(TalosBootstrap, Effect6.succeed(TalosBootstrap.Provider.of(handlers2)));
 // src/talos/talos-cluster-health.ts
 import { Resource as Resource3 } from "alchemy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 import * as Provider3 from "alchemy/Provider";
-import * as Effect5 from "effect/Effect";
+import * as Effect7 from "effect/Effect";
 var TalosClusterHealth = Resource3("Talos.ClusterHealth");
 var nodeCsv = (nodes) => nodes === undefined || nodes.length === 0 ? "" : nodes.join(",");
 var healthArgs = (props, waitTimeout) => {
@@ -269,10 +395,15 @@ var healthArgs = (props, waitTimeout) => {
     args.push("--worker-nodes", workers);
   return args;
 };
-var check = (props, waitTimeout) => Effect5.gen(function* () {
+var check = (props, waitTimeout) => Effect7.scoped(Effect7.gen(function* () {
   const credential = yield* mintTalosconfig(props.target);
+  const contact = props.controlPlaneNodes[0];
+  if (contact === undefined) {
+    return yield* Effect7.fail(new Error(`Talos.ClusterHealth ${props.target.cluster}: controlPlaneNodes is empty — need at ` + "least one node to contact."));
+  }
   yield* talosctl(healthArgs(props, waitTimeout), {
-    nodes: [...props.controlPlaneNodes],
+    endpoints: [contact],
+    nodes: [contact],
     talosconfigPath: credential.talosconfigPath
   });
   return {
@@ -280,113 +411,166 @@ var check = (props, waitTimeout) => Effect5.gen(function* () {
     healthy: true,
     workerNodes: nodeCsv(props.workerNodes)
   };
-});
-var read3 = (props) => check(props, "5s").pipe(Effect5.orElseSucceed(() => ({
+}));
+var isTalosError = (cause) => cause instanceof TalosError;
+var readClusterHealth = (props) => check(props, "5s").pipe(Effect7.catchIf(isTalosError, () => Effect7.succeed({
   controlPlaneNodes: nodeCsv(props.controlPlaneNodes),
   healthy: false,
   workerNodes: nodeCsv(props.workerNodes)
 })));
-var diff3 = (news, output) => Effect5.gen(function* () {
+var diffClusterHealth = (news, output) => Effect7.gen(function* () {
   if (output === undefined || !isResolved3(news))
     return;
-  const live = yield* read3(news);
+  const live = yield* readClusterHealth(news);
   if (live.healthy)
     return { action: "noop" };
   return { action: "update" };
 });
-var reconcile3 = (props) => check(props, props.waitTimeout ?? "20m0s").pipe(Effect5.mapError((cause) => new Error(`Talos.ClusterHealth ${props.target.cluster}: cluster not healthy within ` + `${props.waitTimeout ?? "20m0s"} — ${String(cause)}`)));
+var reconcileClusterHealth = (props) => check(props, props.waitTimeout ?? "20m0s").pipe(Effect7.catchIf(isTalosError, (cause) => Effect7.fail(new Error(`Talos.ClusterHealth ${props.target.cluster}: cluster not healthy within ` + `${props.waitTimeout ?? "20m0s"} — ${String(cause)}`))));
 var handlers3 = {
-  delete: () => Effect5.void,
+  delete: () => Effect7.void,
   diff: ({
     news,
     output
-  }) => diff3(news, output),
-  list: () => Effect5.succeed([]),
-  read: ({ olds }) => read3(olds),
-  reconcile: ({ news }) => reconcile3(news)
+  }) => diffClusterHealth(news, output),
+  list: () => Effect7.succeed([]),
+  read: ({ olds }) => readClusterHealth(olds),
+  reconcile: ({ news }) => reconcileClusterHealth(news)
 };
-var TalosClusterHealthProvider = () => Provider3.effect(TalosClusterHealth, Effect5.succeed(TalosClusterHealth.Provider.of(handlers3)));
+var TalosClusterHealthProvider = () => Provider3.effect(TalosClusterHealth, Effect7.succeed(TalosClusterHealth.Provider.of(handlers3)));
 // src/talos/talos-machine-config.ts
 import { Resource as Resource4 } from "alchemy";
-import { isResolved as isResolved4 } from "alchemy/Diff";
 import * as Provider4 from "alchemy/Provider";
-import * as Effect6 from "effect/Effect";
-var STACK_DIR = new URL("..", import.meta.url).pathname;
-var TalosMachineConfig = Resource4("Talos.MachineConfig");
-var loadDigest = (props) => Effect6.gen(function* () {
-  const path = resolveConfigPath(STACK_DIR, props.configFile);
-  const text = yield* Effect6.tryPromise({
-    try: () => Bun.file(path).text(),
-    catch: (cause) => new Error(`reading ${props.configFile}: ${String(cause)}`)
-  });
-  return configDigest(text);
-});
-var liveDigest = (props, talosconfigPath) => talosctl(["get", "machineconfig", "-o", "yaml"], {
+import * as Effect10 from "effect/Effect";
+
+// src/talos/machine-config-read.ts
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved4 } from "alchemy/Diff";
+import * as Effect8 from "effect/Effect";
+import * as Result from "effect/Result";
+var liveSpecDigest = (props, talosconfigPath) => talosctl(["get", "machineconfig", "v1alpha1", "-o", "yaml"], {
+  endpoints: [props.node],
   nodes: [props.node],
   talosconfigPath
-}).pipe(Effect6.map((yaml) => configDigest(yaml)), Effect6.orElseSucceed(() => {
-  return;
+}).pipe(Effect8.flatMap((wrapperYaml) => {
+  const spec = extractMachineConfigSpec(wrapperYaml);
+  return spec === undefined ? Effect8.fail(new Error(`${props.node}: get machineconfig v1alpha1 returned no string 'spec' field — see ` + "values.ts extractMachineConfigSpec for the expected shape.")) : Effect8.succeed(configDigest(spec));
 }));
-var read4 = (props) => Effect6.gen(function* () {
-  const wanted = yield* loadDigest(props);
+var probeMaintenanceMode = (props, talosconfigPath) => talosctl(["version"], {
+  endpoints: [props.node],
+  insecure: true,
+  nodes: [props.node],
+  talosconfigPath
+}).pipe(Effect8.as(true), Effect8.orElseSucceed(() => false));
+var readMachineConfig = (props) => Effect8.scoped(Effect8.gen(function* () {
   const credential = yield* mintTalosconfig(props.target);
-  const live = yield* liveDigest(props, credential.talosconfigPath);
-  return {
-    configDigest: wanted,
-    converged: live === wanted,
+  const outcome = yield* Effect8.result(liveSpecDigest(props, credential.talosconfigPath));
+  if (Result.isFailure(outcome)) {
+    const reachable = yield* probeMaintenanceMode(props, credential.talosconfigPath);
+    return reachable ? undefined : yield* Effect8.fail(outcome.failure);
+  }
+  const attrs = {
+    configDigest: props.configDigest,
+    converged: outcome.success === props.configDigest ? "read-back" : false,
     mode: props.mode ?? "auto",
     node: props.node
   };
-});
-var diff4 = (news, output) => Effect6.gen(function* () {
+  return attrs.converged === false ? Unowned(attrs) : attrs;
+}));
+var diffMachineConfig = (news, output) => Effect8.gen(function* () {
   if (output === undefined || !isResolved4(news))
     return;
-  const live = yield* read4(news);
-  if (live.converged)
+  const live = yield* readMachineConfig(news);
+  if (live !== undefined && live.converged !== false)
     return { action: "noop" };
   return { action: "update" };
 });
-var reconcile4 = (props) => Effect6.gen(function* () {
-  const path = resolveConfigPath(STACK_DIR, props.configFile);
-  const wanted = yield* loadDigest(props);
+
+// src/talos/machine-config-poll.ts
+import * as Effect9 from "effect/Effect";
+var isRebootish = (mode) => mode === "reboot" || mode === "auto";
+var POLICY = {
+  immediate: { intervalMs: 2000, maxAttempts: 5 },
+  rebootish: { intervalMs: 5000, maxAttempts: 24 }
+};
+var pollUntilMatch = (check2, policy) => Effect9.gen(function* () {
+  for (let attempt = 1;attempt <= policy.maxAttempts; attempt++) {
+    const matched = yield* check2.pipe(Effect9.orElseSucceed(() => false));
+    if (matched)
+      return true;
+    if (attempt < policy.maxAttempts)
+      yield* Effect9.sleep(policy.intervalMs);
+  }
+  return false;
+});
+var confirmConverged = (node, mode, check2, policies = POLICY) => Effect9.gen(function* () {
+  const rebootish = isRebootish(mode);
+  const policy = rebootish ? policies.rebootish : policies.immediate;
+  const matched = yield* pollUntilMatch(check2, policy);
+  if (!matched) {
+    return yield* Effect9.fail(new TalosConvergenceTimeout({ attempts: policy.maxAttempts, mode, node }));
+  }
+  return rebootish ? "accepted" : "read-back";
+});
+
+// src/talos/talos-machine-config.ts
+var TalosMachineConfig = Resource4("Talos.MachineConfig");
+var reconcileMachineConfig = (props, output, pollPolicies) => Effect10.scoped(Effect10.gen(function* () {
+  const mode = props.mode ?? "auto";
+  const raw = yield* readKvValue(props.target.mount, props.configKey, ["config"]);
+  const gotDigest = configDigest(raw);
+  if (gotDigest !== props.configDigest) {
+    return yield* Effect10.fail(new TalosConfigDigestMismatch({
+      expected: props.configDigest,
+      got: gotDigest,
+      key: props.configKey,
+      mount: props.target.mount
+    }));
+  }
   const credential = yield* mintTalosconfig(props.target);
+  const { path } = yield* mintKvTempFile(raw, `${props.target.cluster}-${props.node}-config`);
+  const isCreate = output === undefined;
   const args = [
     "apply-config",
     "--file",
     path,
     "--mode",
-    props.mode ?? "auto",
-    ...props.insecure === true ? ["--insecure"] : []
+    mode,
+    ...isCreate ? ["--insecure"] : []
   ];
   yield* talosctl(args, { nodes: [props.node], talosconfigPath: credential.talosconfigPath });
-  const live = yield* liveDigest(props, credential.talosconfigPath);
-  if (live !== wanted) {
-    return yield* Effect6.die(new Error(`${props.node}: apply-config returned no error but machineconfig digest still differs. ` + "Read back rather than trusting the exit code alone."));
-  }
+  const converged = yield* confirmConverged(props.node, mode, liveSpecDigest(props, credential.talosconfigPath).pipe(Effect10.map((live) => live === props.configDigest)), pollPolicies);
   return {
-    configDigest: wanted,
-    converged: true,
-    mode: props.mode ?? "auto",
+    configDigest: props.configDigest,
+    converged,
+    mode,
     node: props.node
   };
-});
+}));
 var handlers4 = {
-  delete: () => Effect6.void,
+  delete: () => Effect10.void,
   diff: ({
     news,
     output
-  }) => diff4(news, output),
-  list: () => Effect6.succeed([]),
-  read: ({ olds }) => read4(olds),
-  reconcile: ({ news }) => reconcile4(news)
+  }) => diffMachineConfig(news, output),
+  list: () => Effect10.succeed([]),
+  read: ({ olds }) => readMachineConfig(olds),
+  reconcile: ({
+    news,
+    output
+  }) => reconcileMachineConfig(news, output)
 };
-var TalosMachineConfigProvider = () => Provider4.effect(TalosMachineConfig, Effect6.succeed(TalosMachineConfig.Provider.of(handlers4)));
+var TalosMachineConfigProvider = () => Provider4.effect(TalosMachineConfig, Effect10.succeed(TalosMachineConfig.Provider.of(handlers4)));
 export {
+  TalosBootstrap,
   TalosBootstrapProvider,
+  TalosClusterHealth,
   TalosClusterHealthProvider,
+  TalosKubeconfig,
   TalosKubeconfigProvider,
+  TalosMachineConfig,
   TalosMachineConfigProvider
 };
 
-//# debugId=6CD90391393B548364756E2164756E21
+//# debugId=D7E7AB43E3608FE064756E2164756E21
 //# sourceMappingURL=index.js.map