@homeflare/alchemy 0.39.0 → 0.41.0

package/src/proxmox/storage-update.test.ts

@@ -0,0 +1,183 @@
+/**
+ * `Proxmox.Storage`'s partial-update fix. Measured 2026-09-27, `bun run deploy`: PVE's PUT
+ * /storage/{storage} refused `storage-cephfs-tb4`'s update with `unexpected property 'shared'`,
+ * because `reconcile` used to PUT the FULL declared set whenever anything drifted — including a
+ * `shared` that already matched live, which cephfs's own plugin `options()` never accepts at all
+ * (storage-plugin-options.ts has the vendor citation). storage-form.ts's `updateForm` now sends
+ * only the fields that actually differ from a live read; these tests prove the PUT body shape
+ * directly, never touching a real PVE cluster.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Layer from 'effect/Layer';
+import { engineOver } from '../verify/fake-engine.ts';
+import { FAKE_TARGET, type PveCall, fakePve, withoutBao } from './fake-pve.ts';
+import { createForm } from './storage-form.ts';
+import { ProxmoxStorage, ProxmoxStorageProvider } from './storage.ts';
+
+type Live = Record<string, string>;
+
+/** `storage` (POST) and `storage/{id}` (GET/PUT), keyed by storage id — group.test.ts's shape. */
+const cluster = (stores: Map<string, Live>) =>
+  fakePve((call: PveCall) => {
+    const match = /^storage(?:\/(.+))?$/.exec(call.path);
+    if (match === null) return undefined;
+    const id = match[1];
+    if (call.method === 'GET' && id !== undefined) return stores.get(id);
+    if (call.method === 'PUT' && id !== undefined) {
+      const live = stores.get(id);
+      if (live !== undefined) stores.set(id, { ...live, ...call.form });
+    }
+    return undefined;
+  });
+
+const engineFor = (fake: ReturnType<typeof cluster>) =>
+  engineOver(ProxmoxStorageProvider().pipe(Layer.provideMerge(fake.layer)));
+
+describe('Proxmox.Storage update: a partial PUT, never a property the type refuses', () => {
+  test('a cephfs storage whose only drift is content: PUT carries content and the id, never shared', async () => {
+    // MEASURED SHAPE: live already reports `shared: '1'` (cephfs is implicitly shared) and the
+    // declaration agrees — only `content` (Talos's `import`, the change that triggered the bug)
+    // actually differs.
+    const stores = new Map<string, Live>([
+      ['cephfs-tb4', { content: 'backup', shared: '1', storage: 'cephfs-tb4', type: 'cephfs' }],
+    ]);
+    const fake = cluster(stores);
+    const declare = () =>
+      ProxmoxStorage('cephfs', {
+        content: 'backup,import',
+        shared: true,
+        storage: 'cephfs-tb4',
+        target: FAKE_TARGET,
+        type: 'cephfs',
+      });
+    await withoutBao(async () => {
+      const engine = engineFor(fake);
+      const report = await engine.verify(declare());
+      expect(report.rows[0]).toMatchObject({ diff: 'update' });
+      expect(await engine.deploy(declare())).toEqual({ cephfs: 'adopted' });
+    });
+    // ⚠️ `storage` NAMES THE OBJECT VIA THE PUT'S OWN PATH (`storage/cephfs-tb4` here), NOT A
+    //   BODY FIELD — distilled routes it as a path label (distilled-doctrine: Label -> path), so
+    //   it never reaches `call.form`. `fake.writes()` is what proves the id.
+    expect(fake.writes()).toEqual(['PUT storage/cephfs-tb4']);
+    // ⛔ THE BUG THIS PROVES FIXED: before this fix the body was the full declared set, `shared`
+    //   included — exactly what PVE refused with "unexpected property 'shared'".
+    expect(fake.calls.find((call) => call.method === 'PUT')?.form).toEqual({
+      content: 'backup,import',
+    });
+  });
+
+  test('no drift at all: no PUT is sent', async () => {
+    const stores = new Map<string, Live>([
+      ['cephfs-tb4', { content: 'backup,import', storage: 'cephfs-tb4', type: 'cephfs' }],
+    ]);
+    const fake = cluster(stores);
+    const declare = () =>
+      ProxmoxStorage('cephfs', {
+        content: 'backup,import',
+        storage: 'cephfs-tb4',
+        target: FAKE_TARGET,
+        type: 'cephfs',
+      });
+    await withoutBao(async () => {
+      const engine = engineFor(fake);
+      const report = await engine.verify(declare());
+      expect(report.rows[0]).toMatchObject({ diff: 'noop' });
+      // ⚠️ `'adopted'`, NOT `'noop'` — a first deploy of a matching object is always reported
+      //   `adopted` (adopt-verify.md's own note on Plan.ts/Apply.ts: "the node is adopted either
+      //   way"). The provider's own `diff` (asserted above) is what proves nothing changed;
+      //   `fake.writes()` below is what proves `reconcile` actually wrote nothing.
+      expect(await engine.deploy(declare())).toEqual({ cephfs: 'adopted' });
+    });
+    expect(fake.writes()).toEqual([]);
+  });
+
+  test('a dir storage DOES accept `shared` on update: the PUT carries it', async () => {
+    // VENDOR EVIDENCE (storage-plugin-options.ts): `DirPlugin.pm`'s own `options()` names
+    // `shared => { optional => 1 }`, unlike cephfs — this is the "one more type" contrast case.
+    const stores = new Map<string, Live>([
+      ['local-extra', { content: 'iso', shared: '0', storage: 'local-extra', type: 'dir' }],
+    ]);
+    const fake = cluster(stores);
+    const declare = () =>
+      ProxmoxStorage('dir', {
+        content: 'iso',
+        shared: true,
+        storage: 'local-extra',
+        target: FAKE_TARGET,
+        type: 'dir',
+      });
+    await withoutBao(async () => {
+      const engine = engineFor(fake);
+      expect(await engine.deploy(declare())).toEqual({ dir: 'adopted' });
+    });
+    expect(fake.writes()).toEqual(['PUT storage/local-extra']);
+    expect(fake.calls.find((call) => call.method === 'PUT')?.form).toEqual({ shared: '1' });
+  });
+});
+
+/**
+ * PR 314's own red team (2026-09-27, Important finding): `changedProps` above leaves `shared`
+ * out of its result for any type outside `sharedAccepted`, on purpose — but that means a
+ * genuinely disagreeing declared value would otherwise vanish into an empty diff and report
+ * `noop` forever, with the recorded attribute silently stuck on whatever PVE already has. These
+ * two tests prove `matches` (storage-wire.ts) catches exactly that one case and no other.
+ */
+describe('a declared `shared` a type can never apply dies the plan, never noops forever', () => {
+  test('zfspool (never accepts shared): a genuine disagreement dies rather than reporting noop', async () => {
+    const stores = new Map<string, Live>([
+      ['speed', { content: 'images', shared: '0', storage: 'speed', type: 'zfspool' }],
+    ]);
+    const fake = cluster(stores);
+    const declare = () =>
+      ProxmoxStorage('speed', {
+        content: 'images',
+        shared: true,
+        storage: 'speed',
+        target: FAKE_TARGET,
+        type: 'zfspool',
+      });
+    await withoutBao(async () => {
+      const engine = engineFor(fake);
+      await expect(engine.verify(declare())).rejects.toBeDefined();
+    });
+    expect(fake.writes()).toEqual([]);
+  });
+
+  test('zfspool: a declared shared that already agrees with live still plans noop, not a die', async () => {
+    const stores = new Map<string, Live>([
+      ['speed', { content: 'images', shared: '0', storage: 'speed', type: 'zfspool' }],
+    ]);
+    const fake = cluster(stores);
+    const declare = () =>
+      ProxmoxStorage('speed', {
+        content: 'images',
+        shared: false,
+        storage: 'speed',
+        target: FAKE_TARGET,
+        type: 'zfspool',
+      });
+    await withoutBao(async () => {
+      const engine = engineFor(fake);
+      const report = await engine.verify(declare());
+      expect(report.rows[0]).toMatchObject({ diff: 'noop' });
+    });
+    expect(fake.writes()).toEqual([]);
+  });
+});
+
+/** PR 314's own red team (Minor finding): the create path's own `shared` gate had no test. */
+describe('createForm: `shared` is gated by type on create too, not only on update', () => {
+  test('a declared shared is dropped for cephfs, rbd and pbs, kept for dir, lvm, btrfs and esxi', () => {
+    for (const type of ['dir', 'lvm', 'btrfs', 'esxi']) {
+      expect(createForm({ shared: true, storage: 's', target: FAKE_TARGET, type })).toMatchObject({
+        shared: '1',
+      });
+    }
+    for (const type of ['cephfs', 'rbd', 'pbs']) {
+      expect(
+        createForm({ shared: true, storage: 's', target: FAKE_TARGET, type }),
+      ).not.toHaveProperty('shared');
+    }
+  });
+});

package/src/proxmox/storage-wire.ts

@@ -7,6 +7,8 @@
 import * as storage from '@distilled.cloud/proxmox/storage';
 import * as Effect from 'effect/Effect';
 import { runPve } from './distilled-pve.ts';
+import { sharedAccepted } from './storage-plugin-options.ts';
+import type { MutableFields } from './storage-form.ts';
 import type { StorageProps } from './storage.ts';
 import { UNREADABLE, type Unreadable, readOrUnreadable } from './unreadable-read.ts';
 import { bool } from './values.ts';
@@ -109,15 +111,60 @@ export const readStorage = (props: StorageProps) =>
 export const dropUnreadable = (live: StorageAttributes | Unreadable | undefined) =>
   live === UNREADABLE ? undefined : live;
 
+/**
+ * The declared fields (of the 7 `mutable()` — storage-form.ts — ever writes) whose value
+ * genuinely differs from what PVE just reported. `matches` below and storage-form.ts's
+ * `updateForm` share this one comparison, so the plan's noop/update verdict and the partial PUT
+ * body it sends can never disagree about what "changed" means for a list, a boolean or `shared`.
+ *
+ * ⛔ `shared` IS SKIPPED ENTIRELY FOR A TYPE THAT DOESN'T ACCEPT IT (storage-plugin-options.ts's
+ *   `sharedAccepted`, vendor-cited there) — the same treatment `type` already gets below
+ *   (create-only, never compared) and for the identical reason: PVE will never apply a `shared`
+ *   PUT for cephfs/rbd/zfspool/… (it 500s, `unexpected property 'shared'` — the bug this family
+ *   shipped with, measured 2026-09-27), so comparing it against a live value that can never move
+ *   to match could only ever report `update` forever. Without this skip, `mutable()`'s own gate
+ *   (storage-form.ts) would still keep `shared` out of the wire body, but `matches` would keep
+ *   reporting drift for a field nothing can ever apply — a plan that never reaches noop.
+ */
+export const changedProps = (
+  live: StorageAttributes,
+  props: StorageProps,
+): Partial<MutableFields> => ({
+  ...(sameList(props.content, live.content) ? {} : { content: props.content }),
+  ...(sameList(props.nodes, live.nodes) ? {} : { nodes: props.nodes }),
+  ...(sameList(props['prune-backups'], live['prune-backups'])
+    ? {}
+    : { 'prune-backups': props['prune-backups'] }),
+  ...(same(props.disable, live.disable) ? {} : { disable: props.disable }),
+  ...(sharedAccepted(props.type) && !same(props.shared, live.shared)
+    ? { shared: props.shared }
+    : {}),
+  ...(same(props.preallocation, live.preallocation) ? {} : { preallocation: props.preallocation }),
+  ...(same(props.comment, live.comment) ? {} : { comment: props.comment }),
+});
+
 /**
  * ⚠️ `type` IS NEVER COMPARED — CREATE-ONLY (`storage.ts`'s own `StorageProps.type` doc), so a
  *   changed declaration plans `noop` on it, same as before the migration.
+ *
+ * ⛔ A DECLARED `shared` A TYPE CAN NEVER APPLY MUST FAIL LOUD, NOT NOOP FOREVER — PR 314's own
+ *   red team, 2026-09-27. `changedProps` above leaves `shared` out of its result whenever the
+ *   type is outside `sharedAccepted`, on purpose (PVE 500s on the PUT otherwise) — but that
+ *   means a genuinely disagreeing declared value would otherwise vanish into an empty diff and
+ *   report `noop` forever, with the recorded attribute silently stuck on whatever PVE already
+ *   has. `maxfiles` (storage.ts's header) refuses that same class of bug at compile time; this is
+ *   the update-time equivalent for a field that can't be typed away. So this checks the ONE case
+ *   `changedProps` deliberately can't see — declared and live actually differ, on a type that can
+ *   never carry the write — and dies with a message naming the fix, before `changedProps` runs.
  */
 export const matches = (attributes: StorageAttributes, props: StorageProps) =>
-  sameList(props.content, attributes.content) &&
-  sameList(props.nodes, attributes.nodes) &&
-  sameList(props['prune-backups'], attributes['prune-backups']) &&
-  same(props.disable, attributes.disable) &&
-  same(props.shared, attributes.shared) &&
-  same(props.preallocation, attributes.preallocation) &&
-  same(props.comment, attributes.comment);
+  !sharedAccepted(props.type) && !same(props.shared, attributes.shared)
+    ? Effect.die(
+        new Error(
+          `storage/${props.storage}: declared shared: ${String(props.shared)}, but PVE reports ` +
+            `${String(attributes.shared)} and '${props.type}' storages never accept a 'shared' ` +
+            'write (storage-plugin-options.ts) -- remove the declared shared or set it to match ' +
+            'what PVE already reports; this value can never be applied.',
+        ),
+      )
+    : Effect.succeed(Object.keys(changedProps(attributes, props)).length === 0);

package/src/proxmox/storage.ts

@@ -112,7 +112,12 @@ export interface StorageProps extends WithTarget {
   nodes?: string;
   /** Keeps the definition but stops PVE using it. */
   disable?: boolean;
-  /** Tells PVE the same volumes are visible from every node — a claim, not a mechanism. */
+  /**
+   * Tells PVE the same volumes are visible from every node — a claim, not a mechanism.
+   * ⚠️ ONLY SENT WHEN THE TYPE'S OWN PLUGIN ACCEPTS IT (storage-plugin-options.ts, vendor-cited)
+   *   — elsewhere it is dropped from the wire, and a disagreeing declared value dies the plan
+   *   loud (storage-wire.ts's `matches`) rather than PUTting a field PVE would refuse outright.
+   */
   shared?: boolean;
   /** `off` | `metadata` | `falloc` | `full`. File-based plugins only. */
   preallocation?: string;
@@ -166,7 +171,9 @@ export const ProxmoxStorageProvider = () =>
         diff: Effect.fn(function* ({ news, output }) {
           if (!isResolved(news)) return undefined;
           yield* guardWrite(STORAGE_CREATE, createForm(news), output === undefined);
-          yield* guardWrite(STORAGE_UPDATE, updateForm(news), false);
+          // ⚠️ `live: undefined`: no read yet, so this only sanity-checks the FULL declared set
+          //   (storage-form.ts's `updateForm` doc) — `reconcile` builds the actual partial body.
+          yield* guardWrite(STORAGE_UPDATE, updateForm(news, undefined), false);
           if (output === undefined) return undefined;
           // ⚠️ `readStorageOrFail`, NOT `readStorage` — see that function's own ⛔ in
           //   storage-wire.ts. A genuine TRANSIENT failure here propagates and fails the whole
@@ -182,7 +189,7 @@ export const ProxmoxStorageProvider = () =>
             yield* guardWrite(STORAGE_CREATE, createForm(news), true);
             return { action: 'update' } as const;
           }
-          return matches(live, news)
+          return (yield* matches(live, news))
             ? ({ action: 'noop' } as const)
             : ({ action: 'update' } as const);
         }),
@@ -192,7 +199,12 @@ export const ProxmoxStorageProvider = () =>
           //   handles — group.ts's/user.ts's reconcile have the same note.
           const before = dropUnreadable(yield* readStorage(news));
           yield* guardWrite(STORAGE_CREATE, createForm(news), before === undefined);
-          yield* guardWrite(STORAGE_UPDATE, updateForm(news), false);
+          // ★ COMPUTED ONCE, THEN REUSED FOR BOTH THE GUARD AND THE WRITE — storage-form.ts's own
+          //   ⚠️ on `toDistilledUpdate`: `update` is the partial body (only fields that differ
+          //   from `before`, and never `shared` for a type that doesn't accept it), so the
+          //   constraint check below inspects exactly what the PUT, if any, will carry.
+          const update = updateForm(news, before);
+          yield* guardWrite(STORAGE_UPDATE, update, false);
           if (before === undefined) {
             yield* runPve(
               news.target,
@@ -200,12 +212,12 @@ export const ProxmoxStorageProvider = () =>
               true,
               storage.createStorage(toDistilledCreate(news)),
             );
-          } else if (!matches(before, news)) {
+          } else if (!(yield* matches(before, news))) {
             yield* runPve(
               news.target,
               'provision',
               true,
-              storage.putStorage(toDistilledUpdate(news)),
+              storage.putStorage(toDistilledUpdate(update)),
             );
           }
           const after = dropUnreadable(yield* readStorage(news));

package/src/release/index.ts

@@ -37,6 +37,7 @@ export { VICTORIA_RELEASES } from './victoria.ts';
 export type {
   ExecResult,
   FileStat,
+  HostPlatform,
   HostRunner,
   HostUser,
   WriteOptions,

package/src/talos/credentials-write.test.ts

@@ -0,0 +1,81 @@
+/**
+ * `credentials-write.ts` — offline, fake `bao`, no real process ever spawns. Fixtures only.
+ */
+import assert from 'node:assert/strict';
+import { existsSync } from 'node:fs';
+import { describe, it } from 'node:test';
+import * as Effect from 'effect/Effect';
+import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
+import { reservedTempPath, writeKvValue } from './credentials-write.ts';
+import { type FakeCall, fakeSpawner } from './fake-process.ts';
+
+const run = <A, E>(
+  effect: Effect.Effect<A, E, ChildProcessSpawner.ChildProcessSpawner>,
+  handler: (c: FakeCall) => { stdout?: string; stderr?: string; exitCode?: number },
+  calls: FakeCall[] = [],
+) =>
+  Effect.runPromise(
+    Effect.provideService(
+      effect,
+      ChildProcessSpawner.ChildProcessSpawner,
+      fakeSpawner(handler, calls),
+    ),
+  );
+
+describe('writeKvValue', () => {
+  it('sends the value on stdin, never in argv', async () => {
+    const calls: FakeCall[] = [];
+    await run(
+      writeKvValue('talos-c1', 'kubeconfig', 'kubeconfig', 'super-secret-kubeconfig-body'),
+      () => ({}),
+      calls,
+    );
+    assert.equal(calls.length, 1);
+    // ⛔ C2 (LAND red team): `=-`, never `=@-` — `@` means "read a file at this literal path",
+    // which OpenBao's own CLI rejects (or, worse, silently reads a file named `-` if one exists).
+    assert.deepEqual(calls[0]?.args, ['kv', 'put', 'talos-c1/kubeconfig', 'kubeconfig=-']);
+    assert.equal(calls[0]?.stdin, 'super-secret-kubeconfig-body');
+    // ⛔ THE POINT OF THE TEST: the value appears nowhere in argv.
+    assert.ok(!calls[0]?.args.some((arg) => arg.includes('super-secret-kubeconfig-body')));
+  });
+
+  it('fails on a non-zero exit and never echoes stdin in the error', async () => {
+    await assert.rejects(
+      run(writeKvValue('talos-c1', 'kubeconfig', 'kubeconfig', 'secret-body'), () => ({
+        exitCode: 2,
+        stderr: 'permission denied',
+      })),
+      (error: unknown) =>
+        error instanceof Error &&
+        error.message.includes('permission denied') &&
+        !error.message.includes('secret-body'),
+    );
+  });
+});
+
+describe('reservedTempPath', () => {
+  it('does not pre-create the file, and cleans up if something else wrote there', async () => {
+    let path = '';
+    await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const reserved = yield* reservedTempPath('c1-node-kubeconfig-out');
+          path = reserved.path;
+          assert.equal(existsSync(path), false, 'nothing has written here yet');
+          yield* Effect.promise(() =>
+            Bun.write(path, 'written by the caller, like talosctl would'),
+          );
+          assert.ok(existsSync(path));
+        }),
+      ),
+    );
+    assert.equal(existsSync(path), false, 'must be gone once the caller scope closed');
+  });
+
+  it('two calls never collide on the same path', async () => {
+    const [a, b] = await Effect.runPromise(
+      Effect.scoped(Effect.all([reservedTempPath('same-label'), reservedTempPath('same-label')])),
+    );
+    assert.notEqual(a.path, b.path);
+  });
+});

package/src/talos/credentials-write.ts

@@ -0,0 +1,95 @@
+/**
+ * The write half of Talos's OpenBao KV access — split out of credentials.ts (2026-09-26,
+ * K-talos-first-boot) once it needed its own header, the same reason machine-config-read.ts,
+ * machine-config-poll.ts and talos-errors.ts were split out of talos-machine-config.ts before it.
+ * `credentials.ts` stays the read side (mint a talosconfig, read a KV value); this file is the one
+ * place anything in this package ever writes TO OpenBao.
+ *
+ * ★ FIRST CALLER: `Talos.Kubeconfig` (kubeconfig.ts) writing the admin kubeconfig it generates at
+ *   cluster bring-up into the vault instead of an un-vaulted host `runtimePath` — see that file's
+ *   own header. `Ceph.AuthEntity` (K-A4, a separate design/PR) is expected to need the same shape
+ *   for its own vault-written entity keys; this is not yet shared with it on purpose — two callers
+ *   is the point at which sharing stops being speculative.
+ */
+import * as Effect from 'effect/Effect';
+import type * as Scope from 'effect/Scope';
+import * as Stream from 'effect/Stream';
+import * as ChildProcess from 'effect/unstable/process/ChildProcess';
+import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
+
+/**
+ * A fresh, unguessable temp path for SOME OTHER PROCESS (talosctl) to create — unlike
+ * `credentials.ts`'s `mintKvTempFile`, this does NOT pre-create the file with `wx`, because the
+ * caller here is capturing a command's OWN output rather than writing known content itself. The
+ * random UUIDv7 name is the only pre-fabrication guard (an attacker cannot pre-plant a symlink at a
+ * path it cannot predict) — first used by `kubeconfig.ts` to capture `talosctl kubeconfig`'s
+ * generated file before reading it back and writing it into the vault.
+ */
+export const reservedTempPath = (
+  label: string,
+): Effect.Effect<{ readonly path: string }, never, Scope.Scope> =>
+  Effect.gen(function* () {
+    const path = `${Bun.env['TMPDIR'] ?? '/tmp'}/hf-talos-${label}-${Bun.randomUUIDv7()}.yaml`;
+    yield* Effect.addFinalizer(() =>
+      Effect.tryPromise({ try: () => Bun.file(path).delete(), catch: () => undefined }).pipe(
+        Effect.orElseSucceed(() => undefined),
+      ),
+    );
+    return { path };
+  });
+
+/**
+ * Write one field of an OpenBao KV-v2 value from `value` — never argv, the mirror image of
+ * `credentials.ts`'s `readKvValue`.
+ *
+ * ⛔ C2 FIX (LAND red team, 2026-09-26) — `field=@-` IS WRONG AND WAS NEVER MEASURED. `@value` means
+ *   "read a file at this path"; a literal path of `-` is not the stdin convention for `@` — it is
+ *   just a file named `-`. MEASURED against the estate's OpenBao v2.6.2 binary (isolated in-memory
+ *   dev server, `env -i`, scratch HOME, no estate credentials involved; server removed after):
+ *   `field=@-` exits 1 with `invalid key/value pair "field=@-": error reading file: open -: no
+ *   such file or directory`, and if a file literally named `-` exists in the working directory it
+ *   silently stores THAT file's bytes instead. `field=-` (no `@`) is Vault/OpenBao's own stdin
+ *   convention and was confirmed against the same binary to read the piped bytes correctly. Every
+ *   `Talos.Kubeconfig` create failed here — AFTER `talosctl kubeconfig` had already issued a fresh
+ *   admin client certificate, which cannot be revoked.
+ * ⛔ stderr ONLY ON FAILURE — same rule as `readKvValue`: never echo what was being written, on
+ *   success or failure.
+ */
+export const writeKvValue = (
+  mount: string,
+  key: string,
+  field: string,
+  value: string,
+): Effect.Effect<void, Error, ChildProcessSpawner.ChildProcessSpawner> =>
+  Effect.gen(function* () {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const result = yield* ChildProcess.make('bao', ['kv', 'put', `${mount}/${key}`, `${field}=-`], {
+      detached: false,
+      extendEnv: true,
+      stderr: 'pipe',
+      stdin: Stream.fromIterable([new TextEncoder().encode(value)]),
+      stdout: 'pipe',
+    }).pipe(
+      spawner.spawn,
+      Effect.flatMap((child) =>
+        Effect.all(
+          {
+            exitCode: child.exitCode,
+            stderr: child.stderr.pipe(
+              Stream.decodeText,
+              Stream.mkString,
+              Effect.map((text) => text.trim()),
+            ),
+          },
+          { concurrency: 'unbounded' },
+        ),
+      ),
+      Effect.scoped,
+    );
+
+    if (result.exitCode !== 0) {
+      return yield* Effect.fail(
+        new Error(`bao kv put ${mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`),
+      );
+    }
+  });

package/src/talos/credentials.test.ts

@@ -0,0 +1,157 @@
+/**
+ * The C1 lifetime fix — pins that `mintTalosconfig`'s temp file survives until the CALLER's own
+ * `Effect.scoped` closes, not until `mintTalosconfig` itself returns (the shipped defect,
+ * credentials.ts's own header). Fully offline: fake-process.ts fakes `bao`, nothing real spawns.
+ *
+ * ⚠️ FIXTURES ONLY. No real OpenBao, no real talosconfig material — every "talosconfig" body
+ *   below is a plain marker string, not YAML that could be mistaken for the real shape.
+ */
+import assert from 'node:assert/strict';
+import { existsSync, statSync } from 'node:fs';
+import { describe, it } from 'node:test';
+import * as Effect from 'effect/Effect';
+import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
+import { mintKubeconfig, mintKvTempFile, mintTalosconfig, readKvValue } from './credentials.ts';
+import { type FakeCall, fakeSpawner } from './fake-process.ts';
+
+const bao =
+  (data: Record<string, unknown>, exitCode = 0) =>
+  (call: FakeCall) => {
+    assert.equal(call.command, 'bao');
+    return exitCode === 0
+      ? { stdout: JSON.stringify({ data: { data } }) }
+      : { exitCode, stderr: 'permission denied' };
+  };
+
+const run = <A, E>(
+  effect: Effect.Effect<A, E, ChildProcessSpawner.ChildProcessSpawner>,
+  handler: (c: FakeCall) => ReturnType<ReturnType<typeof bao>>,
+  calls: FakeCall[] = [],
+) =>
+  Effect.runPromise(
+    Effect.provideService(
+      effect,
+      ChildProcessSpawner.ChildProcessSpawner,
+      fakeSpawner(handler, calls),
+    ),
+  );
+
+describe('mintTalosconfig — C1 lifetime fix', () => {
+  it('reads talosconfig/<mount> — the FIXED default key, not the doubled data/data path', async () => {
+    const calls: FakeCall[] = [];
+    let capturedPath = '';
+    await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const credential = yield* mintTalosconfig({ cluster: 'c1', mount: 'talos-c1' });
+          capturedPath = credential.talosconfigPath;
+          assert.ok(existsSync(capturedPath), 'file must exist while the caller scope is open');
+        }),
+      ).pipe(
+        Effect.provideService(
+          ChildProcessSpawner.ChildProcessSpawner,
+          fakeSpawner(bao({ talosconfig: 'fake-talosconfig-body' }), calls),
+        ),
+      ),
+    );
+    assert.equal(calls.length, 1);
+    assert.deepEqual(calls[0]?.args, ['kv', 'get', '-format=json', 'talos-c1/talosconfig']);
+    assert.equal(existsSync(capturedPath), false, 'must be gone once the caller scope closed');
+  });
+
+  it('is gone even when the caller scope is closed by a later failure (finalizers always run)', async () => {
+    let capturedPath = '';
+    const failing = Effect.scoped(
+      Effect.gen(function* () {
+        const credential = yield* mintTalosconfig({ cluster: 'c1', mount: 'talos-c1' });
+        capturedPath = credential.talosconfigPath;
+        return yield* Effect.fail(new Error('downstream talosctl call failed'));
+      }),
+    ).pipe(
+      Effect.provideService(
+        ChildProcessSpawner.ChildProcessSpawner,
+        fakeSpawner(bao({ talosconfig: 'fake-body' })),
+      ),
+    );
+    await assert.rejects(Effect.runPromise(failing));
+    assert.equal(existsSync(capturedPath), false);
+  });
+
+  it('honors a custom talosconfigKey without adding a data/ prefix', async () => {
+    const calls: FakeCall[] = [];
+    await run(
+      Effect.scoped(
+        mintTalosconfig({ cluster: 'c1', mount: 'talos-c1', talosconfigKey: 'context/admin' }),
+      ),
+      bao({ config: 'fallback-field-body' }),
+      calls,
+    );
+    assert.deepEqual(calls[0]?.args, ['kv', 'get', '-format=json', 'talos-c1/context/admin']);
+  });
+
+  it('fails without spawning talosctl or leaving a file when bao denies the read', async () => {
+    await assert.rejects(
+      run(Effect.scoped(mintTalosconfig({ cluster: 'c1', mount: 'talos-c1' })), bao({}, 1)),
+    );
+  });
+
+  it('fails when the KV entry has neither a talosconfig nor a config field', async () => {
+    await assert.rejects(
+      run(
+        Effect.scoped(mintTalosconfig({ cluster: 'c1', mount: 'talos-c1' })),
+        bao({ unrelated: 'x' }),
+      ),
+    );
+  });
+});
+
+describe('mintKvTempFile', () => {
+  it('writes exactly the given content at mode 0600', async () => {
+    let path = '';
+    await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const file = yield* mintKvTempFile('exact body\n', 'c1-node-config');
+          path = file.path;
+          const text = yield* Effect.promise(() => Bun.file(path).text());
+          assert.equal(text, 'exact body\n');
+          assert.equal(statSync(path).mode & 0o777, 0o600);
+        }),
+      ),
+    );
+    assert.equal(existsSync(path), false);
+  });
+});
+
+describe('mintKubeconfig — the consumer-side seam, same lifetime shape as mintTalosconfig', () => {
+  it('reads the default kubeconfig key and the file survives only within the caller scope', async () => {
+    const calls: FakeCall[] = [];
+    let capturedPath = '';
+    await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const file = yield* mintKubeconfig({ cluster: 'c1', mount: 'talos-c1' });
+          capturedPath = file.path;
+          assert.ok(existsSync(capturedPath));
+        }),
+      ).pipe(
+        Effect.provideService(
+          ChildProcessSpawner.ChildProcessSpawner,
+          fakeSpawner(bao({ kubeconfig: 'fake-kubeconfig-body' }), calls),
+        ),
+      ),
+    );
+    assert.deepEqual(calls[0]?.args, ['kv', 'get', '-format=json', 'talos-c1/kubeconfig']);
+    assert.equal(existsSync(capturedPath), false);
+  });
+});
+
+describe('readKvValue', () => {
+  it('tries fields in order and returns the first non-empty match', async () => {
+    const value = await run(
+      readKvValue('talos-c1', 'nodes/10001', ['config', 'legacyConfig']),
+      bao({ legacyConfig: 'second-field-body' }),
+    );
+    assert.equal(value, 'second-field-body');
+  });
+});