@homeflare/alchemy 0.39.0 → 0.40.0

package/dist/talos/machine-config-poll.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Post-apply convergence for `Talos.MachineConfig` — split out of talos-machine-config.ts
+ * (2026-09-26, K-A3) once the bounded-poll logic needed its own header. See
+ * docs/plans/2026-09-26-talos-stack-first-boot.md, "Converged" and "Bootstrap" sections.
+ *
+ * ⛔ NO SILENT `converged: false` HERE. A single attempt's own transport failure is swallowed
+ *   ONLY inside the bounded loop below — a rebooting node's API is legitimately unreachable for a
+ *   while — but the loop AS A WHOLE never swallows: running out of attempts always raises
+ *   `TalosConvergenceTimeout`, never a quiet `false`. That distinction is read()'s job, not
+ *   reconcile's — see talos-machine-config.ts.
+ * ⚠️ SHORT INTERVALS, A LOW CAP, NEVER ONE LONG SLEEP — the house timeout rule, and the specific
+ *   reason talosctl's own `health` gate has a 20-minute `--wait-timeout`: a single blocking wait
+ *   that long would hide whether THIS process is still alive from anything watching it.
+ */
+import * as Effect from 'effect/Effect';
+import type { ApplyMode } from './resource.ts';
+import { TalosConvergenceTimeout } from './talos-errors.ts';
+/**
+ * ★ TWO POLICIES, ONE PER MODE CLASS — REASONED, no live cluster to time this against yet.
+ *   `no-reboot` never drops the API, so a handful of quick retries covers only ordinary
+ *   config-propagation lag. `reboot`/`auto` can drop the API for a full boot cycle, so the cap is
+ *   longer and the interval coarser. Both stay well inside the house rule above.
+ */
+export type PollPolicy = {
+    readonly intervalMs: number;
+    readonly maxAttempts: number;
+};
+/**
+ * Confirm convergence per `mode`'s policy, or fail with `TalosConvergenceTimeout`.
+ *
+ * Returns which CLAIM was proven, never a boolean — `'read-back'` for the immediate policy
+ * (no-reboot), `'accepted'` for the reboot-tolerant one (reboot/auto): state records which kind of
+ * confirmation actually happened, per the design doc's `converged` field.
+ *
+ * ⚠️ `policies` IS A TEST SEAM, NOT A PROP. `talos-machine-config.ts` never passes it, so
+ *   production always runs the REASONED defaults above; tests pass tiny intervals so a bounded
+ *   poll test finishes in milliseconds instead of the real ~10s/~2m caps.
+ */
+export declare const confirmConverged: <E, R>(node: string, mode: ApplyMode, check: Effect.Effect<boolean, E, R>, policies?: {
+    readonly immediate: PollPolicy;
+    readonly rebootish: PollPolicy;
+}) => Effect.Effect<'read-back' | 'accepted', TalosConvergenceTimeout, R>;
+//# sourceMappingURL=machine-config-poll.d.ts.map

package/dist/talos/machine-config-poll.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-config-poll.d.ts","sourceRoot":"","sources":["../../src/talos/machine-config-poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAQ5D;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAwBvF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,EAAE,CAAC,QAC7B,MAAM,QACN,SAAS,SACR,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,aACzB;IAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;CAAE,KAC3E,MAAM,CAAC,MAAM,CAAC,WAAW,GAAG,UAAU,EAAE,uBAAuB,EAAE,CAAC,CAWjE,CAAC"}

package/dist/talos/machine-config-read.d.ts

@@ -0,0 +1,49 @@
+import type { Input } from 'alchemy/Input';
+import * as Effect from 'effect/Effect';
+import type { MachineConfigAttributes, MachineConfigProps } from './talos-machine-config.ts';
+/**
+ * Single live read: `talosctl get machineconfig v1alpha1`, extract `spec`, hash it. No retry, no
+ * swallow.
+ *
+ * ⛔ THE ID IS NEVER OMITTED (fix-first #2, PR 307 red team). An unfiltered `get machineconfig`
+ *   lists `persistent` AND `v1alpha1`, sorted by id — `persistent` first — so a caller that does not
+ *   name `v1alpha1` gets whichever the SDK's `doc[0]` happens to be, never provably the applied
+ *   config (values.ts's own multi-document guard is the second half of this fix).
+ * ★ `endpoints: [props.node]` (fix-first #5, same review) — without it talosctl falls back to the
+ *   talosconfig context's own endpoints, which may be a control-plane VIP that only comes up AFTER
+ *   bootstrap; every pre-bootstrap call in this file targets the node directly instead.
+ */
+export declare const liveSpecDigest: (props: MachineConfigProps, talosconfigPath: string) => Effect.Effect<string, Error | import("effect/PlatformError").PlatformError | import("./talosctl.ts").TalosError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+/**
+ * ⛔ NO SWALLOWING. A transport failure here propagates as its own error (TalosError or the
+ *   shape error above) — never as `converged: false`. A false only means "read succeeded, and
+ *   genuinely differs" (docs/plans/2026-09-26-talos-stack-first-boot.md, acceptance test 3).
+ * ⛔ THREE-WAY COLD-START ANSWER, NOT TWO (fix-first #1). Alchemy's engine calls this exact
+ *   function as its adoption probe with no prior state (alchemy beta.79 Plan.ts:1302-1318) and
+ *   again to recover an interrupted create (`:1413-1450`) — both hand it nothing to distinguish
+ *   "not created" from "already configured". Answering only "attrs or error" (the shipped shape)
+ *   meant a maintenance-mode node's expected auth failure aborted the plan instead of reaching
+ *   CREATE, and a genuinely different node's matching-cluster-CA-but-wrong-content read landed as a
+ *   plain, unbranded attrs object — a silent adopt with no `adopt()`, breaking first-boot acceptance
+ *   test 1 ("zero adopts"). Now: authenticated read fails but the maintenance probe succeeds →
+ *   `undefined` (not created); authenticated read succeeds and the digest matches → plain attrs
+ *   (ours); succeeds and differs → `Unowned` (exists, not proven ours — the digest match IS this
+ *   family's ownership proof, not a state-row lookup like `ownership/probe.ts`'s generic
+ *   `ownedRead`, which answers a different question: "did OUR state row create this name", not
+ *   "does this node hold OUR pinned content"); both reads fail → the authenticated error propagates.
+ *
+ * ★ EXPORTED (like proxmox/ceph-daemon.ts's `reconcileDaemon`) so tests call it directly with a
+ *   fake `ChildProcessSpawner` instead of driving it through the full Alchemy engine.
+ */
+export declare const readMachineConfig: (props: MachineConfigProps) => Effect.Effect<{
+    configDigest: string;
+    converged: "read-back" | false;
+    mode: import("./resource.ts").ApplyMode;
+    node: string;
+} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const diffMachineConfig: (news: Input<MachineConfigProps>, output: MachineConfigAttributes | undefined) => Effect.Effect<{
+    readonly action: 'noop';
+} | {
+    readonly action: 'update';
+} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+//# sourceMappingURL=machine-config-read.d.ts.map

package/dist/talos/machine-config-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-config-read.d.ts","sourceRoot":"","sources":["../../src/talos/machine-config-read.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAI7F;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,UAAW,kBAAkB,mBAAmB,MAAM,gMAiB9E,CAAC;AAuBJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,iBAAiB,UAAW,kBAAkB;;;;;+IAiBxD,CAAC;AAEJ,eAAO,MAAM,iBAAiB,SACtB,KAAK,CAAC,kBAAkB,CAAC,UACvB,uBAAuB,GAAG,SAAS;qBAK4B,MAAM;;qBAC1D,QAAQ;+IACzB,CAAC"}

package/dist/talos/resource.d.ts

@@ -29,4 +29,22 @@ export type TalosRequirements = ChildProcessSpawner.ChildProcessSpawner;
 export type WithTarget = {
     target: TalosTarget;
 };
+/**
+ * `talosctl apply-config -m/--mode`. Lives here, not in talos-machine-config.ts, so
+ * talos-errors.ts can name it in `TalosConvergenceTimeout` without importing that file back
+ * (machine-config-poll.ts -> talos-errors.ts -> talos-machine-config.ts would cycle).
+ *
+ * ★ K-A3 DROPPED THE `insecure` PROP THAT USED TO SIT BESIDE THIS TYPE. A fixed `insecure` prop
+ *   fails in both directions (`true` breaks every later update, `false` breaks the very first
+ *   apply against a node with no talosconfig auth yet), so `Talos.MachineConfig` now derives it
+ *   itself: CREATE (`output === undefined`) applies `--insecure`, UPDATE never does.
+ * ⛔ `'staged'` AND `'try'` ARE DROPPED (fix-first #2, PR 307 red team). `try` reverts itself after
+ *   its timeout, so a bounded poll that later reads the reverted config would see it never match
+ *   the pin and re-run `apply-config` on every deploy — the poll would be "confirming" a change
+ *   `try` had already undone. `staged` defers the write to the NEXT reboot rather than applying it,
+ *   which `isRebootish` (machine-config-poll.ts) cannot honestly claim `'accepted'` for without a
+ *   reboot ever happening — the reboot for a staged config is a separate, later operator action
+ *   this package does not drive. Both need their own design work, not a poll-policy guess.
+ */
+export type ApplyMode = 'auto' | 'no-reboot' | 'reboot';
 //# sourceMappingURL=resource.d.ts.map

package/dist/talos/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/talos/resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AACxF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,mBAAmB,CAAC;AAExE,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/talos/resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AACxF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,mBAAmB,CAAC;AAExE,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC"}

package/dist/talos/talos-bootstrap-etcd.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `Talos.Bootstrap`'s etcd-members probe and split-brain guard — split out of talos-bootstrap.ts
+ * (LAND, 2026-09-26, I4 fix) once adding the guard pushed that file over the 250-line cap, the same
+ * reason machine-config-read.ts was split out of talos-machine-config.ts before it. Only
+ * `import type` comes back from talos-bootstrap.ts, so there is no runtime cycle between the files.
+ */
+import * as Effect from 'effect/Effect';
+import type { BootstrapProps } from './talos-bootstrap.ts';
+import { TalosReBootstrapRefused } from './talos-errors.ts';
+/**
+ * REASONED: `talosctl get etcdmembers -o json` should list members after bootstrap.
+ * ⚠️ NOT MEASURED — first live deploy confirms the resource type name.
+ * ⛔ NO SWALLOWING (K-talos-first-boot) — a transport failure propagates as its own error; only a
+ *   SUCCESSFUL read may conclude presence or absence. Every caller decides for itself what a
+ *   failure here means (talos-bootstrap.ts's `read`/`reconcile`, and `assertNoLivePeers` below), so
+ *   it is not decided here.
+ */
+export declare const isBootstrapped: (props: BootstrapProps, talosconfigPath: string) => Effect.Effect<boolean, import("effect/PlatformError").PlatformError | import("./talosctl.ts").TalosError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+/**
+ * ⛔ I4 FIX (LAND red team, 2026-09-26) — THE CREATE PATH ONLY CHECKED THIS NODE. If the state row
+ *   is lost (wrong `--stage`, an FQN rename, a wiped state store) while the cluster already lives on
+ *   OTHER control-plane nodes, the cold-start adoption read on THIS node comes back empty, plan
+ *   calls `create`, and `talosctl bootstrap` runs here too — a SECOND, isolated etcd cluster: split
+ *   brain. Before bootstrapping, every OTHER declared control-plane node (`props.peers`) must show a
+ *   successful, EMPTY etcd-members read — proof no cluster already exists anywhere this row knows
+ *   about. A peer that already has members, or a peer whose read fails, refuses bootstrap exactly
+ *   like an already-bootstrapped confirmation failure does (same typed error, same "hand it to a
+ *   human" posture) — a genuinely fresh cluster has no peers with members yet, so this never blocks
+ *   a real first boot.
+ * ⚠️ `peers` IS OPTIONAL, SO THIS GUARD IS OPT-IN — an existing single-control-plane declaration
+ *   keeps working unguarded; a consuming stack with more than one control-plane node (decision 66:
+ *   3, one per TB4 node) SHOULD list the other two here to get the protection.
+ * ★ `Effect.all` over a mapped array, not `Effect.forEach` — oxlint's unicorn/no-array-for-each
+ *   matches the method NAME and cannot tell Effect's from Array's (same pattern as
+ *   openbao/cloudflare-permission-groups.ts).
+ */
+export declare const assertNoLivePeers: (props: BootstrapProps, talosconfigPath: string) => Effect.Effect<void, TalosReBootstrapRefused, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+//# sourceMappingURL=talos-bootstrap-etcd.d.ts.map

package/dist/talos/talos-bootstrap-etcd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"talos-bootstrap-etcd.d.ts","sourceRoot":"","sources":["../../src/talos/talos-bootstrap-etcd.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAAW,cAAc,mBAAmB,MAAM,yLAIM,CAAC;AAEpF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,UAAW,cAAc,mBAAmB,MAAM,4HA2B7E,CAAC"}

package/dist/talos/talos-bootstrap.d.ts

@@ -6,13 +6,41 @@
  *   the bootstrap node. This command must run exactly once per cluster.
  *
  * ⛔ NOT A FACTORY RESOURCE — bootstrap cannot be deleted or updated in place; `delete` is a no-op.
+ *
+ * ⛔ ONCE MEANS ONCE (K-talos-first-boot, 2026-09-26) — THE SHIPPED SHAPE COULD BOOTSTRAP A SECOND
+ *   etcd CLUSTER. The original `isBootstrapped` turned every read failure into `false`
+ *   (`Effect.orElseSucceed`), `diff` then planned `update`, and `reconcile` re-ran `talosctl
+ *   bootstrap` — Talos's only server-side guard is a non-empty etcd data directory (REASONED,
+ *   `v1alpha1_server.go:441`), so a reinstalled or reset bootstrap node re-bootstrapped a fresh,
+ *   isolated single-member cluster: split brain. Fixed per
+ *   docs/plans/2026-09-26-talos-stack-first-boot.md's "Bootstrap — once means once" section:
+ *     - `read` now answers presence/absence correctly instead of always returning a defined
+ *       object — `undefined` only from a SUCCESSFUL read that finds no members (cold-start
+ *       absence); a failing read propagates its error instead of being reinterpreted as absence.
+ *     - `diff` trusts `output.bootstrapped` once it is `true` and reports `noop` without touching
+ *       the live cluster at all — confirmation is `reconcile`'s job now, not plan's.
+ *     - `reconcile` checks `output?.bootstrapped` FIRST: once true, it NEVER calls `talosctl
+ *       bootstrap` again, no matter what a live read says. A live read that fails OR comes back
+ *       empty both raise the same `TalosReBootstrapRefused` — re-bootstrap is a human decision.
  */
 import { Resource } from 'alchemy';
+import type { Input } from 'alchemy/Input';
 import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
 import type { TalosRequirements, WithTarget } from './resource.ts';
+import { TalosReBootstrapRefused } from './talos-errors.ts';
 export interface BootstrapProps extends WithTarget {
     /** The ONE control-plane node that receives `talosctl bootstrap`. */
     node: string;
+    /**
+     * The OTHER declared control-plane nodes — never `node` itself. Optional, but a multi-control-
+     * plane cluster (decision 66: 3, one per TB4 node) SHOULD set it: `reconcileBootstrap`'s CREATE
+     * path (I4 fix, LAND red team, 2026-09-26) requires every one of these to show a successful,
+     * EMPTY etcd-members read before it will bootstrap `node` — the guard against re-bootstrapping a
+     * split-brain second cluster when this row's own state was lost. See talos-bootstrap-etcd.ts's
+     * `assertNoLivePeers`.
+     */
+    peers?: readonly string[];
     /** Machine configs for this node (and peers) must be applied first. */
     after?: readonly unknown[];
 }
@@ -23,5 +51,64 @@ export interface BootstrapAttributes {
 export interface TalosBootstrap extends Resource<'Talos.Bootstrap', BootstrapProps, BootstrapAttributes, never, TalosRequirements> {
 }
 export declare const TalosBootstrap: import("alchemy").ResourceClass<TalosBootstrap>;
+/**
+ * ⛔ WRAPPED IN `Effect.scoped` (K-A3, 2026-09-26) — `mintTalosconfig` contributes `Scope.Scope`
+ *   to its own return type rather than closing its scope internally (the C1 fix, credentials.ts's
+ *   own header); this is the caller that owns the temp talosconfig's lifetime for the read.
+ *
+ * ⛔ ANSWERS PRESENCE/ABSENCE, NOT "attrs-or-error" (K-talos-first-boot, fixes the shipped shape).
+ *   `undefined` only when a read SUCCEEDS and finds no members — the honest "not created yet"
+ *   Alchemy's engine expects from a cold-start adoption probe. A failing read propagates instead
+ *   of being reinterpreted as absence — this is the fix `isBootstrapped` no longer hides.
+ *
+ * ★ EXPORTED (like proxmox/ceph-daemon.ts's `reconcileDaemon`, machine-config-read.ts's
+ *   `readMachineConfig`) so talos-bootstrap.test.ts calls it directly with a fake spawner instead
+ *   of driving it through the full Alchemy engine.
+ */
+export declare const readBootstrap: (props: BootstrapProps) => Effect.Effect<{
+    readonly bootstrapped: true;
+    readonly node: string;
+} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+/**
+ * ⛔ TRUSTS STATE, NEVER TOUCHES THE LIVE CLUSTER (K-talos-first-boot) — once `output.bootstrapped`
+ *   is `true` this always reports `noop`, unconditionally, with zero live calls.
+ *
+ * ⛔ I3 CORRECTION (LAND red team, 2026-09-26) — THE OLD COMMENT HERE CLAIMED "confirming the
+ *   invariant against etcd is reconcile's job (every deploy calls it)". THAT IS FALSE, VERIFIED
+ *   against the pinned alchemy beta.79 source: Apply never reconciles a node whose diff came back
+ *   `noop` (`Apply.ts`'s `noop` branch just refreshes row metadata and signals ready — it does not
+ *   call `provider.reconcile` at all). This file's own `noop` above IS what skips it. So
+ *   `reconcileBootstrap`'s re-confirm branch (the one that raises `TalosReBootstrapRefused` on a
+ *   failed or empty read) never runs on an ordinary `plan`/`deploy` once `bootstrapped: true` is
+ *   recorded — only `--force` reaches it, by forcing a reconcile regardless of the plan action.
+ *   Safety still holds — `talosctl bootstrap` genuinely never re-runs while state exists — but a
+ *   reset control-plane node (etcd wiped, VM replaced) stays silently invisible to `plan` and
+ *   `deploy` alike until an operator runs `--force` or a verify pass.
+ *   ⚠️ NOT FIXED BY HAVING `diff` READ HERE TOO (the finding's other offered fix) — that would touch
+ *   the live cluster (and mint a talosconfig) on EVERY plan for an already-bootstrapped node, for a
+ *   scenario (a reset node) that a `configDigest`-style pinned check can't distinguish from a merely
+ *   slow/unreachable read; a single transient failure would then abort every future plan for a
+ *   healthy node, for no benefit — the exact cost the original (correct) half of this comment
+ *   already named. `MachineConfig`/`ClusterHealth`'s diffs DO mint and read live on every plan
+ *   (D2 puts that on the admin/operator lane, not agent), so this isn't a lane-access limit; it is
+ *   this resource's own choice to trust a `true` boolean forever rather than re-derive it from a
+ *   live signal that cannot yet tell "reset" apart from "briefly unreachable". Recorded as an open
+ *   gap for whoever builds the operator verify pass, not silently fixed here.
+ */
+export declare const diffBootstrap: (news: Input<BootstrapProps>, output: BootstrapAttributes | undefined) => Effect.Effect<{
+    readonly action: 'noop';
+} | {
+    readonly action: 'update';
+} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+/**
+ * ⛔ ONCE MEANS ONCE — see this file's own header. `output?.bootstrapped === true` is checked
+ *   BEFORE anything else, and that branch never builds a `talosctl bootstrap` argv at all — the
+ *   confirmation read below can fail, or succeed and say "absent", and EITHER way this raises
+ *   `TalosReBootstrapRefused` rather than treating "absent" as licence to bootstrap again.
+ */
+export declare const reconcileBootstrap: (props: BootstrapProps, output: BootstrapAttributes | undefined) => Effect.Effect<{
+    bootstrapped: boolean;
+    node: string;
+}, Error | import("effect/PlatformError").PlatformError | TalosReBootstrapRefused, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
 export declare const TalosBootstrapProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosBootstrap>, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
 //# sourceMappingURL=talos-bootstrap.d.ts.map

package/dist/talos/talos-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"talos-bootstrap.d.ts","sourceRoot":"","sources":["../../src/talos/talos-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAGzB,CAAC;AAkEH,eAAO,MAAM,sBAAsB,yJACoD,CAAC"}
+{"version":3,"file":"talos-bootstrap.d.ts","sourceRoot":"","sources":["../../src/talos/talos-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAGzB,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,UAAW,cAAc;;;+IAOhD,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,aAAa,SAClB,KAAK,CAAC,cAAc,CAAC,UACnB,mBAAmB,GAAG,SAAS;qBAIK,MAAM;;qBAIjC,QAAQ;+IACvB,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,UACtB,cAAc,UACb,mBAAmB,GAAG,SAAS;;;6JAmDtC,CAAC;AAsBJ,eAAO,MAAM,sBAAsB,yJACoD,CAAC"}

package/dist/talos/talos-cluster-health.d.ts

@@ -6,9 +6,27 @@
  *
  * ⚠️ PLAN READS USE A SHORT TIMEOUT SO `plan` DOES NOT BLOCK TWENTY MINUTES. Reconcile uses the
  *   declared timeout — that is the deploy gate, not the plan gate.
+ *
+ * ⛔ THIS RESOURCE ASSUMES A CNI IS ALREADY RUNNING (K-talos-first-boot, 2026-09-26). The default
+ *   `talosctl health` suite checks nodes Ready, kube-proxy and CoreDNS, and Talos's own source
+ *   comment says these wait on the CNI (REASONED, `pkg/cluster/check/default.go:28-60,89-91`;
+ *   docs/plans/2026-09-26-talos-stack-first-boot.md's "CNI ordering" section). A consuming stack's
+ *   `after` MUST include the Cilium install step, not just `Talos.Bootstrap`/`Talos.Kubeconfig` —
+ *   declaring this row directly after bootstrap deadlocks into the `--wait-timeout` on every first
+ *   deploy, because Argo CD itself needs pod networking before it can install Cilium. Row order:
+ *   Bootstrap → Kubeconfig → Cilium (inline manifests in the seeded machine config, D-S2) →
+ *   `Talos.ClusterHealth`.
+ * ⛔ NO SWALLOWED TRANSPORT ERRORS (K-talos-first-boot) — the shipped `read` caught EVERY error
+ *   from `check()`, including a `mintTalosconfig`/`bao` failure, into a plain `healthy: false`. A
+ *   vault outage would then read as "cluster not healthy yet" — an operator chasing a Cilium
+ *   rollout would never learn the real problem was vault. Both `read` and `reconcile` now only
+ *   catch `TalosError` (`talosctl health` itself ran and exited non-zero — the one case this
+ *   family may honestly call "not healthy"); anything else propagates untouched.
  */
 import { Resource } from 'alchemy';
+import type { Input } from 'alchemy/Input';
 import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
 import type { TalosRequirements, WithTarget } from './resource.ts';
 export interface ClusterHealthProps extends WithTarget {
     /** Control-plane node IPs passed to `--control-plane-nodes`. */
@@ -21,7 +39,11 @@ export interface ClusterHealthProps extends WithTarget {
      * ⚠️ REASONED default — not measured here.
      */
     waitTimeout?: string;
-    /** Bootstrap and kubeconfig should complete before health is enforced. */
+    /**
+     * Ordering edge. ⛔ MUST reach past `Talos.Bootstrap`/`Talos.Kubeconfig` all the way through the
+     * Cilium CNI install (this file's own header, "CNI ordering") — the default health checks wait
+     * on kube-proxy and CoreDNS, both of which wait on a CNI that does not exist yet at bootstrap.
+     */
     after?: readonly unknown[];
 }
 export interface ClusterHealthAttributes {
@@ -32,5 +54,25 @@ export interface ClusterHealthAttributes {
 export interface TalosClusterHealth extends Resource<'Talos.ClusterHealth', ClusterHealthProps, ClusterHealthAttributes, never, TalosRequirements> {
 }
 export declare const TalosClusterHealth: import("alchemy").ResourceClass<TalosClusterHealth>;
+/** ★ EXPORTED for talos-cluster-health.test.ts — see talos-bootstrap.ts's own note on the pattern. */
+export declare const readClusterHealth: (props: ClusterHealthProps) => Effect.Effect<{
+    controlPlaneNodes: string;
+    healthy: boolean;
+    workerNodes: string;
+} | {
+    controlPlaneNodes: string;
+    healthy: boolean;
+    workerNodes: string;
+}, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const diffClusterHealth: (news: Input<ClusterHealthProps>, output: ClusterHealthAttributes | undefined) => Effect.Effect<{
+    readonly action: 'noop';
+} | {
+    readonly action: 'update';
+} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const reconcileClusterHealth: (props: ClusterHealthProps) => Effect.Effect<{
+    controlPlaneNodes: string;
+    healthy: boolean;
+    workerNodes: string;
+}, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
 export declare const TalosClusterHealthProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosClusterHealth>, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
 //# sourceMappingURL=talos-cluster-health.d.ts.map

package/dist/talos/talos-cluster-health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"talos-cluster-health.d.ts","sourceRoot":"","sources":["../../src/talos/talos-cluster-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,gEAAgE;IAChE,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kDAAkD;IAClD,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAAsD,CAAC;AAsEtF,eAAO,MAAM,0BAA0B,6JACwD,CAAC"}
+{"version":3,"file":"talos-cluster-health.d.ts","sourceRoot":"","sources":["../../src/talos/talos-cluster-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,gEAAgE;IAChE,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kDAAkD;IAClD,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAAsD,CAAC;AAgEtF,sGAAsG;AACtG,eAAO,MAAM,iBAAiB,UAAW,kBAAkB;;;;;;;;mIASxD,CAAC;AAEJ,eAAO,MAAM,iBAAiB,SACtB,KAAK,CAAC,kBAAkB,CAAC,UACvB,uBAAuB,GAAG,SAAS;qBAKN,MAAM;;qBACxB,QAAQ;+IACzB,CAAC;AAEL,eAAO,MAAM,sBAAsB,UAAW,kBAAkB;;;;mIAU7D,CAAC;AAgBJ,eAAO,MAAM,0BAA0B,6JACwD,CAAC"}

package/dist/talos/talos-errors.d.ts

@@ -0,0 +1,68 @@
+import type { ApplyMode } from './resource.ts';
+declare const TalosConfigDigestMismatch_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosConfigDigestMismatch";
+} & Readonly<A>;
+/**
+ * The OpenBao KV content at `mount/key` does not hash to the pinned `configDigest`.
+ *
+ * ★ FAIL CLOSED, NO SPAWN — docs/plans/2026-09-26-talos-secrets-flow.md's O-A: "a poisoned or
+ *   fat-fingered KV write cannot silently reach a node". Raised BEFORE any talosctl process
+ *   starts, so a mismatch never sends an unpinned config anywhere — see reconcile() in
+ *   talos-machine-config.ts, which checks this ahead of minting the talosconfig credential too.
+ * ⛔ NEITHER DIGEST IN THIS MESSAGE IS THE CONFIG. Both are sha256 hex digests — safe to log,
+ *   safe to persist — never the KV content itself.
+ */
+export declare class TalosConfigDigestMismatch extends TalosConfigDigestMismatch_base<{
+    readonly mount: string;
+    readonly key: string;
+    readonly expected: string;
+    readonly got: string;
+}> {
+    get message(): string;
+}
+declare const TalosConvergenceTimeout_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosConvergenceTimeout";
+} & Readonly<A>;
+/**
+ * `apply-config` returned success but the live machineconfig digest never matched the pin within
+ * the bounded poll (machine-config-poll.ts). See
+ * docs/plans/2026-09-26-talos-stack-first-boot.md's "Converged" section.
+ *
+ * ⛔ THIS IS THE REPLACEMENT FOR A SILENT `converged: false`. The shipped code let a read
+ *   failure during convergence checking disguise itself as "not converged yet" forever
+ *   (`orElseSucceed`); this type makes cap expiry a refusal an operator sees, not a plan that
+ *   quietly retries the same apply on every future run.
+ */
+export declare class TalosConvergenceTimeout extends TalosConvergenceTimeout_base<{
+    readonly node: string;
+    readonly mode: ApplyMode;
+    readonly attempts: number;
+}> {
+    get message(): string;
+}
+declare const TalosReBootstrapRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosReBootstrapRefused";
+} & Readonly<A>;
+/**
+ * `Talos.Bootstrap` reconcile found state already recording `bootstrapped: true`, and a live
+ * check against etcd could not reconfirm it — either the read itself failed (`detail` carries the
+ * propagated cause), or it succeeded and came back with no members.
+ *
+ * ★ K-talos-first-boot's "once means once" — docs/plans/2026-09-26-talos-stack-first-boot.md's own
+ *   section of that name. EITHER cause raises this SAME typed error, and both ways `talosctl
+ *   bootstrap` is never spawned a second time: re-running it against a node that lost its etcd
+ *   data (a VM replace, a reset) forms a second, isolated single-member etcd cluster instead of
+ *   rejoining the existing one (REASONED, `v1alpha1_server.go:441` — Talos's only server-side
+ *   guard is a non-empty data directory, not "did this cluster already bootstrap"). That is split
+ *   brain, and nothing here can tell a genuinely reset node (needs its own operator-run recovery)
+ *   apart from a merely slow or unreachable read (needs a retry) — so both refuse alike and hand
+ *   the node to a human instead of guessing.
+ */
+export declare class TalosReBootstrapRefused extends TalosReBootstrapRefused_base<{
+    readonly node: string;
+    readonly detail: string;
+}> {
+    get message(): string;
+}
+export {};
+//# sourceMappingURL=talos-errors.d.ts.map

package/dist/talos/talos-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"talos-errors.d.ts","sourceRoot":"","sources":["../../src/talos/talos-errors.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;;;;AAE/C;;;;;;;;;GASG;AACH,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF"}

package/dist/talos/talos-machine-config.d.ts

@@ -2,28 +2,44 @@
  * `Talos.MachineConfig` — apply one machine configuration document to one node.
  *
  * ★ REASONED FROM talosctl apply-config (Talos v1.13 CLI reference): `-f/--file`, `-n/--nodes`,
- *   `-m/--mode`, `-i/--insecure` for maintenance mode, `--dry-run` for planning without a write.
+ *   `-m/--mode`, `-i/--insecure` for maintenance mode.
  *
- * ⛔ THE CONFIG BODY IS NEVER AN ATTRIBUTE. Machine configs can embed cluster tokens; only a digest
- *   of the repo file is persisted. Read `configFile` from disk at reconcile time.
+ * ⛔ THE CONFIG BODY IS NEVER AN ATTRIBUTE, A PROP, OR ARGV — ONLY ITS DIGEST. K-A3
+ *   (docs/plans/2026-09-26-talos-secrets-flow.md, option O-A) moved the source of truth from a
+ *   repo file (the shipped `configFile` + `STACK_DIR`, gone with this rewrite) to OpenBao: props
+ *   carry a `configKey` (a vault path) and a `configDigest` PINNED IN GIT, never the bytes. The
+ *   source is write-only from Alchemy's point of view — content is read once per reconcile,
+ *   verified against the pin, written to a session-temp file, and never returned from any
+ *   handler.
+ * ⛔ NEVER `--dry-run`. Talos's dry-run prints a full, unredacted old/new config diff — with an
+ *   empty old config (the first apply) that diff IS the whole config, CA private key and
+ *   bootstrap token included (REASONED, `internal/app/machined/.../v1alpha1_server.go:258-272` +
+ *   `configdiff.go`; docs/plans/2026-09-26-talos-stack-first-boot.md). This file never builds
+ *   that flag.
+ * ⛔ `insecure` IS NOT A PROP. A fixed value fails in both directions — `true` breaks every later
+ *   update, `false` breaks the very first apply against a node with no talosconfig auth yet — so
+ *   CREATE (`output === undefined`) applies `--insecure` and UPDATE never does (resource.ts).
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import type { TalosRequirements, WithTarget } from './resource.ts';
-export type ApplyMode = 'auto' | 'no-reboot' | 'reboot' | 'staged' | 'try';
+import * as Effect from 'effect/Effect';
+import { type PollPolicy } from './machine-config-poll.ts';
+import type { ApplyMode, TalosRequirements, WithTarget } from './resource.ts';
+import { TalosConfigDigestMismatch } from './talos-errors.ts';
+export type { ApplyMode } from './resource.ts';
 export interface MachineConfigProps extends WithTarget {
     /** Node IP or hostname — the `-n` target. */
     node: string;
-    /** Repo-relative or absolute path to the YAML file passed to `-f`. */
-    configFile: string;
-    /** talosctl `-m` mode. Default `auto` per published CLI. */
-    mode?: ApplyMode;
+    /** OpenBao KV path under `target.mount` holding this node's rendered config, e.g. `nodes/10001`. */
+    configKey: string;
     /**
-     * Maintenance-mode apply only (`-i`). Default false — post-bootstrap applies use talosconfig auth.
-     *
-     * ⚠️ REASONED: docs describe `--insecure` for the first apply before talosconfig exists.
+     * sha256(canonicalText(content)) of the seeded KV value (values.ts `configDigest`), pinned in
+     * git by the operator. ⛔ Verified against the live KV content before ANY talosctl spawn — a
+     * mismatch fails closed (`TalosConfigDigestMismatch`), nothing is applied.
      */
-    insecure?: boolean;
+    configDigest: string;
+    /** talosctl `-m` mode. Default `auto` per published CLI. */
+    mode?: ApplyMode;
     /** Ordering edge — e.g. wait for Proxmox.Vm. */
     after?: readonly unknown[];
 }
@@ -31,11 +47,31 @@ export interface MachineConfigAttributes {
     node: string;
     configDigest: string;
     mode: ApplyMode;
-    /** True when the node's reported config digest matches the declared file. */
-    converged: boolean;
+    /**
+     * Which convergence claim was made. `'read-back'`/`'accepted'` only come from `reconcile` (see
+     * machine-config-poll.ts); `false` only comes from `read`, meaning a live digest was
+     * successfully fetched and genuinely differs — never a stand-in for a failed read, which
+     * propagates as its own error instead (docs/plans/2026-09-26-talos-stack-first-boot.md).
+     */
+    converged: 'read-back' | 'accepted' | false;
 }
 export interface TalosMachineConfig extends Resource<'Talos.MachineConfig', MachineConfigProps, MachineConfigAttributes, never, TalosRequirements> {
 }
 export declare const TalosMachineConfig: import("alchemy").ResourceClass<TalosMachineConfig>;
+/**
+ * The read path (`readMachineConfig`, `diffMachineConfig`, `liveSpecDigest`) lives in
+ * machine-config-read.ts — see that file's own header for the ownership-aware three-way answer
+ * `read` now gives (fix-first #1/#2, PR 307 red team).
+ */
+/** `pollPolicies` is a test seam only — see machine-config-poll.ts's `confirmConverged`. */
+export declare const reconcileMachineConfig: (props: MachineConfigProps, output: MachineConfigAttributes | undefined, pollPolicies?: {
+    readonly immediate: PollPolicy;
+    readonly rebootish: PollPolicy;
+}) => Effect.Effect<{
+    configDigest: string;
+    converged: "accepted" | "read-back";
+    mode: ApplyMode;
+    node: string;
+}, Error | import("effect/PlatformError").PlatformError | TalosConfigDigestMismatch | import("./talos-errors.ts").TalosConvergenceTimeout, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
 export declare const TalosMachineConfigProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosMachineConfig>, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
 //# sourceMappingURL=talos-machine-config.d.ts.map

package/dist/talos/talos-machine-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"talos-machine-config.d.ts","sourceRoot":"","sources":["../../src/talos/talos-machine-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAMnE,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE3E,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gDAAgD;IAChD,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB,6EAA6E;IAC7E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAAsD,CAAC;AAwFtF,eAAO,MAAM,0BAA0B,6JACwD,CAAC"}
+{"version":3,"file":"talos-machine-config.d.ts","sourceRoot":"","sources":["../../src/talos/talos-machine-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,0BAA0B,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAI9D,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,gDAAgD;IAChD,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,EAAE,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;CAC7C;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAAsD,CAAC;AAEtF;;;;GAIG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,UAC1B,kBAAkB,UACjB,uBAAuB,GAAG,SAAS,iBAC5B;IAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;CAAE;;;;;qNAkDhF,CAAC;AAsBJ,eAAO,MAAM,0BAA0B,6JACwD,CAAC"}

package/dist/talos/talosctl.d.ts

@@ -21,6 +21,13 @@ export type TalosRunOptions = {
     readonly talosconfigPath: string;
     readonly nodes?: readonly string[];
     readonly endpoints?: readonly string[];
+    /**
+     * `-i/--insecure` — a maintenance-mode node has no established PKI yet. Used by the CREATE apply
+     * (resource.ts's own header) and by talos-machine-config.ts's maintenance-mode probe (fix-first
+     * #1, PR 307 red team): `--talosconfig` is still passed alongside it, matching the CREATE path,
+     * since insecure mode ignores the file's certs rather than requiring their absence.
+     */
+    readonly insecure?: boolean;
 };
 /** Run `talosctl <args…>`. Returns trimmed stdout, or '' when empty. */
 export declare const talosctl: (args: readonly string[], options: TalosRunOptions) => Effect.Effect<string, import("effect/PlatformError").PlatformError | TalosError, ChildProcessSpawner.ChildProcessSpawner>;

package/dist/talos/talosctl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"talosctl.d.ts","sourceRoot":"","sources":["../../src/talos/talosctl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAF3B,YACW,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,EAIf;CACF;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,QAAQ,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,8HA8CtE,CAAC;AAEL,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,iHAShF,CAAC"}
+{"version":3,"file":"talosctl.d.ts","sourceRoot":"","sources":["../../src/talos/talosctl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAF3B,YACW,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,EAIf;CACF;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,QAAQ,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,8HA+CtE,CAAC;AAEL,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,iHAShF,CAAC"}

package/dist/talos/values.d.ts

@@ -2,8 +2,30 @@
 export declare const canonicalText: (text: string) => string;
 /** SHA-256 hex digest of canonical text. Safe to persist — it is not reversible to the input. */
 export declare const sha256: (text: string) => string;
-/** Digest of a machine config file read from the repo. ⛔ Never persist the file body itself. */
+/** Digest of a machine config's canonical text. ⛔ Never persist the text itself. */
 export declare const configDigest: (text: string) => string;
+/**
+ * Extract the raw config text under `spec` from `talosctl get machineconfig -o yaml`'s wrapper.
+ *
+ * ⛔ THE WHOLE WRAPPER CAN NEVER MATCH THE PINNED DIGEST, AND HASHING IT WAS THE SHIPPED BUG.
+ *   REASONED from talosctl source (`cmd/talosctl/.../output/yaml.go:63`,
+ *   `resources/config/machine_config.go:40-50`): the resource envelope nests a `node:` line and
+ *   resource metadata (version, timestamps) around the config, which is itself a raw YAML STRING
+ *   under `spec`. Metadata changes on every observation, so `configDigest(wrapper)` never equals
+ *   `configDigest(seededConfigText)` even when nothing changed — every reconcile would die, every
+ *   diff would plan `update`, verify would never go quiet (all three MEASURED against the shipped
+ *   code's shape, docs/plans/2026-09-26-talos-stack-first-boot.md).
+ * ⚠️ Returns `undefined` for any shape without a string `spec`, so a caller cannot mistake
+ *   "unparsable wrapper" for "empty config" — those must fail differently (the caller's job).
+ * ⛔ MORE THAN ONE DOCUMENT IS REFUSED, NEVER `doc[0]` (fix-first #2, PR 307 red team). An unfiltered
+ *   `get machineconfig` lists BOTH the `persistent` and `v1alpha1` resources, sorted by id
+ *   (REASONED, cosi-project/runtime `inmem/collection.go:122-124`), so a bare `doc[0]` is always
+ *   `persistent` — never the config this package applies. The caller (machine-config-read.ts) now
+ *   always requests the single named resource (`get machineconfig v1alpha1`); a second document
+ *   showing up here means that request shape changed without this guard changing with it, and
+ *   silently picking one would repeat the exact shipped bug.
+ */
+export declare const extractMachineConfigSpec: (wrapperYaml: string) => string | undefined;
 /**
  * Public metadata extracted from a kubeconfig file on disk.
  *
@@ -15,6 +37,4 @@ export declare const kubeconfigMetadata: (yamlText: string, contextName: string)
     caFingerprint: string;
     clientFingerprint: string;
 } | undefined;
-/** Resolve a config file path relative to the declaring stack file. */
-export declare const resolveConfigPath: (stackDir: string, configFile: string) => string;
 //# sourceMappingURL=values.d.ts.map

package/dist/talos/values.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../src/talos/values.ts"],"names":[],"mappings":"AAQA,2EAA2E;AAC3E,eAAO,MAAM,aAAa,SAAU,MAAM,WAAmB,CAAC;AAE9D,iGAAiG;AACjG,eAAO,MAAM,MAAM,SAAU,MAAM,WAC6B,CAAC;AAEjE,gGAAgG;AAChG,eAAO,MAAM,YAAY,SAAU,MAAM,WAAiB,CAAC;AAe3D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,aACnB,MAAM,eACH,MAAM,KAClB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,SAyB3E,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,aAAc,MAAM,cAAc,MAAM,WACC,CAAC"}
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../src/talos/values.ts"],"names":[],"mappings":"AASA,2EAA2E;AAC3E,eAAO,MAAM,aAAa,SAAU,MAAM,WAAmB,CAAC;AAE9D,iGAAiG;AACjG,eAAO,MAAM,MAAM,SAAU,MAAM,WAC6B,CAAC;AAEjE,oFAAoF;AACpF,eAAO,MAAM,YAAY,SAAU,MAAM,WAAiB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,wBAAwB,gBAAiB,MAAM,KAAG,MAAM,GAAG,SAcvE,CAAC;AAeF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,aACnB,MAAM,eACH,MAAM,KAClB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,SAyB3E,CAAC"}